IP attribute filtering method and device, computer equipment, storage medium and program product
By using the XDP program at the network driver layer to filter IP attributes, risky IP attributes are filtered directly before the kernel network stack, solving the problems of low efficiency and high latency in traditional methods and achieving faster and more efficient IP filtering.
Patent Information
- Application Number
- CN202511773353.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-28
- Publication Date
- 2026-02-10
AI Technical Summary
Traditional IP attribute filtering methods are inefficient and cannot meet the needs of real-time defense. Furthermore, they result in high latency due to frequent switching between kernel space and user space.
The XDP program directly processes data packets at the network driver layer, determines the target IP attribute range based on a preset set of IP attributes, and performs risk detection when receiving data packets to be processed, filtering risky IP attributes directly before the kernel network stack.
It reduces latency, improves the processing speed and efficiency of IP filtering, and enables more flexible and reliable IP attribute filtering.
Smart Images
Figure CN121509016A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to an IP attribute filtering method, apparatus, computer equipment, storage medium, and program product. Background Technology
[0002] With the rapid development of the Internet, network attack methods are becoming increasingly diversified and complex, with various new attack methods emerging one after another, posing a severe challenge to the existing network security defense system. Therefore, it is necessary to filter Internet Protocol (IP) attributes that pose risks.
[0003] However, traditional IP attribute filtering methods suffer from low filtering efficiency. Summary of the Invention
[0004] Therefore, it is necessary to provide an IP attribute filtering method, apparatus, computer device, storage medium, and program product to address the aforementioned technical problems.
[0005] Firstly, this application provides an IP attribute filtering method. The method includes:
[0006] Determine the target IP attribute range based on the preset IP attribute set;
[0007] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed.
[0008] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the packet to be processed is discarded to filter the source IP attribute.
[0009] In one embodiment, determining the target IP attribute segment based on a preset set of IP attributes includes:
[0010] Identify the IP attributes in the preset IP attribute set that meet the preset IP attribute requirements as the target IP attributes;
[0011] Based on the target IP attribute, determine the target IP attribute range.
[0012] In one embodiment, determining the target IP attribute segment based on the target IP attribute includes:
[0013] Merge the IP attributes in the target IP attribute to obtain the target IP attribute range;
[0014] Define the target IP attribute range as the target IP attribute segment.
[0015] In one embodiment, determining the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed includes:
[0016] Match the source IP attribute with the target IP attribute range to obtain the matching result;
[0017] The risk detection result is determined based on the matching result.
[0018] In one embodiment, determining the risk detection result based on the matching result includes:
[0019] If the matching result shows that the source IP attribute and the target IP attribute segment match, the risk detection result of the source IP attribute is determined to be a risky IP attribute.
[0020] If the matching result shows that the source IP attribute and the target IP attribute segment do not match, the risk detection result of the source IP attribute is determined to be a secure IP attribute.
[0021] In one embodiment, the target IP attribute segment is stored as a key in a Map. The source IP attribute and the target IP attribute segment are matched to obtain a matching result, including:
[0022] The key of this Map is looked up based on the source IP attribute;
[0023] If the source IP attribute exists in the key of the Map, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment;
[0024] If the source IP attribute does not exist in the key of the Map, then the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
[0025] Secondly, this application also provides an IP attribute filtering device. The device includes:
[0026] The first determining module is used to determine the target IP attribute range based on a preset set of IP attributes;
[0027] The second determining module is used to, in response to the received data packet to be processed, determine the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed by the XDP program loaded on the network card in the server.
[0028] The filtering module is used to discard the data packet to be processed if the risk detection result indicates that the source IP attribute is a risky IP attribute, thereby filtering the source IP attribute.
[0029] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:
[0030] Determine the target IP attribute range based on the preset IP attribute set;
[0031] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed.
[0032] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the packet to be processed is discarded to filter the source IP attribute.
[0033] Fourthly, this application also provides a computer-readable storage medium. This computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:
[0034] Determine the target IP attribute range based on the preset IP attribute set;
[0035] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed.
[0036] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the packet to be processed is discarded to filter the source IP attribute.
[0037] Fifthly, this application also provides a computer program product. This computer program product includes a computer program that, when executed by a processor, performs the following steps:
[0038] Determine the target IP attribute range based on the preset IP attribute set;
[0039] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed.
[0040] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the packet to be processed is discarded to filter the source IP attribute.
[0041] The aforementioned IP attribute filtering method, apparatus, computer equipment, storage medium, and program product determine the target IP attribute segment based on a preset IP attribute set; in response to a received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the target IP attribute segment of the data packet to be processed; if the risk detection result indicates that the source IP attribute is a risky IP attribute, the data packet to be processed is discarded to filter the source IP attribute. In this embodiment, the data packet is processed directly at the network driver layer based on the XDP program, thereby filtering the data packet to be processed before it reaches the kernel network stack, reducing latency and improving the processing speed and efficiency of IP filtering. Attached Figure Description
[0042] Figure 1 This is an internal structural diagram of a computer device provided in an embodiment of this application;
[0043] Figure 2 This is a flowchart illustrating an IP attribute filtering method provided in an embodiment of this application;
[0044] Figure 3 This is an architecture diagram of an IP attribute filtering system provided in an embodiment of this application;
[0045] Figure 4 This is a schematic diagram of an IP attribute filtering process based on the XDP program provided in an embodiment of this application;
[0046] Figure 5 This is a flowchart illustrating a method for determining a target IP attribute segment provided in an embodiment of this application;
[0047] Figure 6 This is a flowchart illustrating another method for determining target IP attribute segments provided in an embodiment of this application;
[0048] Figure 7 This is a schematic diagram of a target IP attribute segment processing flow provided in an embodiment of this application;
[0049] Figure 8 This is a flowchart illustrating a method for determining risk detection results provided in an embodiment of this application;
[0050] Figure 9 This is a flowchart illustrating another method for determining risk detection results provided in an embodiment of this application;
[0051] Figure 10 This is a flowchart illustrating a matching result determination method provided in an embodiment of this application;
[0052] Figure 11 This is an architecture diagram of another IP attribute filtering system provided in an embodiment of this application;
[0053] Figure 12 This is a structural block diagram of an IP attribute filtering device provided in an embodiment of this application. Detailed Implementation
[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0055] With the rapid development of the Internet, network attack methods are becoming increasingly diversified and complex, with various new attack methods emerging one after another, posing a severe challenge to the existing network security defense system. Therefore, it is necessary to filter Internet Protocol (IP) attributes that pose risks.
[0056] Traditional IP attribute filtering methods typically require frequent switching between kernel space and user space, resulting in high latency and low processing efficiency, which cannot meet the needs of real-time defense.
[0057] The IP attribute filtering method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown. Figure 1 This is an internal structure diagram of a computer device provided in an embodiment of this application. The computer device may be a server, and its internal structure diagram may be as follows: Figure 1 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements an IP attribute filtering method.
[0058] Those skilled in the art will understand that Figure 1 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0059] In one embodiment, such as Figure 2 As shown, Figure 2This is a flowchart illustrating an IP attribute filtering method provided in an embodiment of this application. This method can be applied to... Figure 1 The method, using a computer device, includes the following steps:
[0060] S201, Determine the target IP attribute range based on the preset IP attribute set.
[0061] Optionally, IP attributes may include geographic location, risk information, application type, and Internet service provider (ISP) information.
[0062] Geographical location may include, for example, country, region, city, etc.; risk information may include, for example, risk score, description of historical attack behavior (including attack type, attack time, etc.); application type may include, for example, IDC (Internet Data Center), VPN (Virtual Private Network), or Dynamic IP (DYN), etc.; Internet Service Provider (ISP) information may include, for example, information about service providers related to IP.
[0063] For example, historical data packet transmission records can be obtained, and the IP attributes contained in the historical data packet transmission records can be stored in a local IP attribute library. The IP attributes stored in the local IP attribute library are the aforementioned preset IP attribute set.
[0064] Optionally, the registered IP attributes can also be obtained and stored in the local IP attribute database.
[0065] In one exemplary implementation, the user-inputted IP attribute filtering requirements can be obtained, and the IP attributes in the preset IP attribute set can be traversed according to the IP attribute filtering requirements to obtain the target IP attribute segment that meets the IP attribute filtering requirements.
[0066] For example, assuming the IP attribute filtering requirement is: filter IPs with a risk score greater than 65, then the target IP attribute range that meets the IP attribute filtering requirement includes all IP attributes with a risk score greater than 65 in the preset IP attribute set.
[0067] S202, in response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and destination IP attribute segment of the data packet to be processed.
[0068] In one exemplary implementation, refer to 3-4, Figure 3 This is an architecture diagram of an IP attribute filtering system provided in an embodiment of this application. Figure 4 This is a schematic diagram of an IP attribute filtering process based on the XDP program provided in an embodiment of this application. Figures 3-4As shown, the IP attribute filtering system includes at least one server. One of these servers is equipped with a rule generator, which generates target IP attribute ranges (which can be considered a type of filtering rule) and publishes these ranges to a rule executor on the server. The rule executor then executes the IP attribute filtering process. It should be noted that the server with the rule generator and the server with the rule executor can be the same server or different servers within the IP attribute filtering system.
[0069] like Figures 3-4 As shown, when a data packet to be processed arrives at the network card in the server, the XDP program loaded on the network card is triggered and executed. During the execution of the XDP program, the source IP attribute and destination IP attribute segment of the data packet to be processed can be matched. If the source IP attribute of the data packet to be processed matches the destination IP attribute segment, the source IP attribute is determined to be an IP attribute that meets the IP attribute filtering requirements. That is, the risk detection result of the source IP attribute is that the source IP attribute is a risky IP attribute. Conversely, if the source IP attribute of the data packet to be processed does not match the destination IP attribute segment, the risk detection result of the source IP attribute is that the source IP attribute is a safe IP attribute.
[0070] In one possible implementation, such as Figure 4 As shown, the rule executor is deployed on the server that needs protection, which may also be running other services such as nginx, httpd, and MySQL. The rule executor mainly consists of a user-space program and a piece of Extended Berkeley Packet Filter (eBPF) code. The user-space program is responsible for mounting the eBPF code to the kernel's XDP layer and subscribing to a specific rule-topic to obtain the target IP attribute range. After the eBPF program is mounted to XDP, the eBPF code is executed whenever a packet arrives at the network interface card (NIC).
[0071] S203: If the risk detection result indicates that the source IP attribute is a risky IP attribute, discard the data packet to be processed to filter the source IP attribute.
[0072] For example, if the risk detection result indicates that the source IP attribute is a risky IP attribute, that is, if the source IP attribute meets the IP attribute filtering requirements, then the data packet to be processed corresponding to the source IP attribute can be discarded to achieve source IP attribute filtering.
[0073] Alternatively, if the risk detection result indicates that the source IP attribute is a secure IP attribute, then the data packet to be processed is directly allowed and handed over to the subsequent protocol stack for processing.
[0074] In this embodiment, a target IP attribute segment is determined based on a preset set of IP attributes. In response to a received data packet to be processed, the XDP program loaded on the network interface card (NIC) in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the target IP attribute segment of the data packet. If the risk detection result indicates that the source IP attribute is a risky IP attribute, the data packet to be processed is discarded to filter the source IP attribute. In this embodiment, the XDP program directly processes data packets at the network driver layer, thereby filtering the data packets before they reach the kernel network stack, reducing latency and improving the processing speed and efficiency of IP filtering.
[0075] Reference Figure 5 , Figure 5 This is a flowchart illustrating a method for determining a target IP attribute segment according to an embodiment of this application. This embodiment relates to a possible implementation of how to determine a target IP attribute segment based on a preset set of IP attributes. Based on the above embodiment, S201 includes the following steps:
[0076] S501, determine the IP attribute in the preset IP attribute set that meets the preset IP attribute requirements as the target IP attribute.
[0077] In this embodiment of the application, it can be achieved through, as follows: Figures 3-4 The rule generator shown obtains preset IP attribute requirements, filters IP attributes in the preset IP attribute set based on the preset IP attribute requirements, and determines the IP attributes in the preset IP attribute set that meet the preset IP attribute requirements as target IP attributes.
[0078] For example, assuming the preset IP attribute requirement is: filter IPs with a risk score greater than 65, then the target IP attributes that meet the preset IP attribute requirement include all IP attributes with a risk score greater than 65 in the preset IP attribute set.
[0079] Optionally, the initial IP attribute requirements input by the user can be obtained, and then the format of the initial IP attribute requirements can be converted into IP attribute rules that can be directly used by the rule executor to obtain the preset IP attribute requirements.
[0080] Alternatively, historical IP attribute filtering data can be analyzed and summarized to obtain preset IP attribute requirements.
[0081] S502, determine the target IP attribute range based on the target IP attributes.
[0082] As an alternative implementation method, the target IP attribute can be directly determined as the target IP attribute segment.
[0083] Alternatively, if the target IP attribute contains multiple IP attributes, consecutive IP attributes from these multiple IP attributes can be merged to obtain the target IP attribute segment.
[0084] In this embodiment, IP attributes that meet the preset IP attribute requirements in the preset IP attribute set are determined as target IP attributes; based on the target IP attributes, target IP attribute segments are determined, thereby defining the IP attribute filtering logic by customizing the preset IP attribute requirements, which improves the flexibility of IP attribute filtering. Based on this flexibility, more complex filtering strategies can be implemented, further improving the reliability and scalability of IP attribute filtering.
[0085] Reference Figure 6 , Figure 6 This is a flowchart illustrating another method for determining a target IP attribute segment provided in this application embodiment. This embodiment relates to a possible implementation of how to determine a target IP attribute segment based on target IP attributes. Based on the above embodiment, S503 includes the following steps:
[0086] S601, merge the IP attributes in the target IP attribute to obtain the target IP attribute range.
[0087] S602, define the target IP attribute range as the target IP attribute segment.
[0088] In one exemplary implementation, reference is made to Figure 7 , Figure 7 This is a schematic diagram of a target IP attribute segment processing flow provided in an embodiment of this application. For example... Figure 7 As shown, after obtaining the target IP attribute through the rule parser, if the target IP attribute includes multiple IP attributes, the target IP attribute can be merged based on the rule merger to obtain the target IP attribute range. The target IP attribute range is then converted into CIDR prefix format to obtain the target IP attribute segment. Finally, the target IP attribute is published to the broker's rule-topic through the rule distributor for use by the rule executor.
[0089] For example, suppose the target IP attributes include IP addresses that satisfy the first preset IP attribute requirement: 192.168.1.0 / 24, and IP addresses that satisfy the second preset IP attribute requirement: 192.168.1.100 to 192.168.1.110. Since the two IP address ranges overlap, the two IP attributes can be merged into 192.168.1.0 / 24, which is the target IP attribute range. Then, 192.168.1.0 / 24 is converted into CIDR prefix format to obtain the target IP attribute segment.
[0090] In this embodiment, the IP attributes in the target IP attributes are merged to obtain the target IP attribute range; the target IP attribute range is determined as the target IP attribute segment, thereby further improving the efficiency of IP attribute filtering based on the merged target IP attribute segment.
[0091] Reference Figure 8 , Figure 8 This is a flowchart illustrating a risk detection result determination method provided in an embodiment of this application. This embodiment relates to a possible implementation of how to determine the risk detection result of the source IP attribute based on the source IP attribute and destination IP attribute segment of the data packet to be processed. Based on the above embodiment, S202 includes the following steps:
[0092] S801 matches the source IP attribute and the target IP attribute range to obtain the matching result.
[0093] S802, determine the risk detection result based on the matching result.
[0094] Optionally, if the matching result shows that the source IP attribute of the data packet to be processed matches the target IP attribute segment, then the source IP attribute is determined to be an IP attribute that meets the preset IP attribute requirements. In this case, the risk detection result of the source IP attribute is that the source IP attribute is a risky IP attribute, so the data packet to be processed corresponding to the source IP attribute can be discarded. Conversely, if the matching result shows that the source IP attribute of the data packet to be processed does not match the target IP attribute segment, then the risk detection result of the source IP attribute is that the source IP attribute is a safe IP attribute. In this case, the data packet can be directly allowed to pass through and handed over to the subsequent protocol stack for processing.
[0095] In this embodiment, the source IP attribute and the target IP attribute segment are matched to obtain the matching result; the risk detection result is determined based on the matching result, thereby filtering the data packets to be processed before they reach the kernel network stack, reducing latency and improving the processing speed and filtering efficiency of IP filtering.
[0096] Reference Figure 9 , Figure 9 This is a flowchart illustrating another method for determining risk detection results provided in this application embodiment. This embodiment relates to a possible implementation of how to determine risk detection results based on matching results. Based on the above embodiment, S802 includes the following steps:
[0097] S901, if the matching result shows that the source IP attribute and the target IP attribute segment match, determine that the risk detection result of the source IP attribute is a risky IP attribute.
[0098] S902, if the matching result shows that the source IP attribute and the target IP attribute segment do not match, determine that the risk detection result of the source IP attribute is a secure IP attribute.
[0099] Optionally, if the matching result shows that the source IP attribute of the data packet to be processed matches the target IP attribute segment, then the source IP attribute is determined to be an IP attribute that meets the preset IP attribute requirements. In this case, the risk detection result of the source IP attribute is that the source IP attribute is a risky IP attribute, so the data packet to be processed corresponding to the source IP attribute can be discarded. Conversely, if the matching result shows that the source IP attribute of the data packet to be processed does not match the target IP attribute segment, then the risk detection result of the source IP attribute is that the source IP attribute is a safe IP attribute. In this case, the data packet can be directly allowed to pass through and handed over to the subsequent protocol stack for processing.
[0100] In this embodiment, when the matching result shows that the source IP attribute and the target IP attribute segment match, the risk detection result of the source IP attribute is determined to be a risky IP attribute; when the matching result shows that the source IP attribute and the target IP attribute segment do not match, the risk detection result of the source IP attribute is determined to be a secure IP attribute. This allows for filtering of data packets to be processed before they reach the kernel network stack, reducing latency and improving the processing speed and efficiency of IP filtering.
[0101] Reference Figure 10 , Figure 10 This is a flowchart illustrating a matching result determination method provided in an embodiment of this application. This embodiment relates to a possible implementation of matching source IP attributes and target IP attribute segments to obtain a matching result. Based on the above embodiment, the target IP attribute segment is stored as a key in a Map. Step S801 above includes the following steps:
[0102] S1001, look up the key of the Map based on the source IP attribute.
[0103] In this embodiment, after receiving the target IP attribute segment, the user-space program can send the target IP attribute segment to an eBPF Map of type BPF_MAP_TYPE_LPM_TRIE. This Map uses the target IP attribute segment as the key and a uint64_t counter as the value. When the data packet to be processed arrives at the network interface card (NIC), the eBPF program mounted to XDP is triggered and executed, performing a lookup in the aforementioned eBPF Map of type BPF_MAP_TYPE_LPM_TRIE based on the source IP attribute.
[0104] S1002, if the source IP attribute exists in the key of the Map, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment.
[0105] Optionally, if an IP attribute segment matching the source IP attribute exists in the key of an eBPF Map of type BPF_MAP_TYPE_LPM_TRIE, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment. In this case, the data packet to be processed corresponding to the source IP attribute can be discarded, and the counter corresponding to the source IP attribute can be incremented by one.
[0106] S1003, if the source IP attribute does not exist in the key of the Map, then the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
[0107] Optionally, if there is no IP attribute segment matching the source IP attribute in the key of the eBPF Map of type BPF_MAP_TYPE_LPM_TRIE, the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match. In this case, the data packet can be directly allowed to pass and handed over to the subsequent protocol stack for processing.
[0108] In one exemplary implementation, reference is made to Figure 11 , Figure 11 This is an architecture diagram of another IP attribute filtering system provided in an embodiment of this application. For example... Figure 11 As shown, a message queue broker can be deployed in the IP attribute filtering system to publish target IP attribute ranges and feedback filtering details. A state collector can also be deployed to obtain the filtering details of IP attributes and perform analysis and statistics on these details.
[0109] In this embodiment, the key of the Map is searched based on the source IP attribute; if the source IP attribute exists in the key of the Map, the matching result is determined to be a match between the source IP attribute and the target IP attribute segment; if the source IP attribute does not exist in the key of the Map, the matching result is determined to be a mismatch between the source IP attribute and the target IP attribute segment. Thus, the source IP attribute is matched quickly based on the Map, further reducing latency and improving the processing speed and filtering efficiency of IP filtering.
[0110] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0111] Based on the same inventive concept, this application also provides an IP attribute filtering device for implementing the IP attribute filtering method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more IP attribute filtering device embodiments provided below can be found in the limitations of the IP attribute filtering method described above, and will not be repeated here.
[0112] In one embodiment, such as Figure 12 As shown, Figure 12 This is a structural block diagram of an IP attribute filtering device provided in an embodiment of this application. The device 1200 includes:
[0113] The first determining module 1201 is used to determine the target IP attribute segment based on a preset set of IP attributes.
[0114] The second determining module 1202 is used to, in response to the received data packet to be processed, determine the risk detection result of the source IP attribute based on the source IP attribute and destination IP attribute segment of the data packet to be processed by the XDP program loaded on the network card in the server.
[0115] The filtering module 1203 is used to discard data packets to be processed when the risk detection result indicates that the source IP attribute is a risky IP attribute, in order to filter the source IP attribute.
[0116] In one embodiment, the first determining module 1201 includes:
[0117] The first determining unit is used to determine the IP attribute in the preset IP attribute set that meets the preset IP attribute requirements as the target IP attribute.
[0118] The second determining unit is used to determine the target IP attribute segment based on the target IP attribute.
[0119] In one embodiment, the second determining unit is specifically used to merge each IP attribute in the target IP attribute to obtain the target IP attribute range; and to determine the target IP attribute range as the target IP attribute segment.
[0120] In one embodiment, the second determining module 1202 includes:
[0121] The matching unit is used to match the source IP attribute and the target IP attribute range to obtain the matching result.
[0122] The third determining unit is used to determine the risk detection result based on the matching result.
[0123] In one embodiment, the third determining unit is specifically configured to determine that the risk detection result of the source IP attribute is a risky IP attribute when the matching result is that the source IP attribute and the target IP attribute segment match; and to determine that the risk detection result of the source IP attribute is a secure IP attribute when the matching result is that the source IP attribute and the target IP attribute segment do not match.
[0124] In one embodiment, the target IP attribute segment is stored as a key in a Map. The matching unit is specifically used to search the key of the Map based on the source IP attribute. If the source IP attribute exists in the key of the Map, the matching result is determined to be that the source IP attribute and the target IP attribute segment match. If the source IP attribute does not exist in the key of the Map, the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
[0125] Each module in the aforementioned IP attribute filtering device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.
[0126] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0127] Determine the target IP attribute range based on the preset IP attribute set;
[0128] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and destination IP attribute range of the data packet to be processed.
[0129] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the data packet to be processed is discarded to filter the source IP attribute.
[0130] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0131] Identify the IP attributes in the preset IP attribute set that meet the preset IP attribute requirements as the target IP attributes;
[0132] Determine the target IP attribute range based on the target IP attributes.
[0133] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0134] Merge the IP attributes in the target IP attribute to obtain the target IP attribute range;
[0135] Define the target IP attribute range as the target IP attribute segment.
[0136] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0137] Match the source IP attribute and the target IP attribute range to obtain the matching results;
[0138] The risk detection result is determined based on the matching results.
[0139] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0140] If the matching result shows that the source IP attribute and the target IP attribute segment match, the risk detection result of the source IP attribute is determined to be a risky IP attribute.
[0141] If the matching result shows that the source IP attribute and the target IP attribute segment do not match, the risk detection result of the source IP attribute is determined to be a secure IP attribute.
[0142] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0143] Look up the keys in the Map based on the source IP attribute;
[0144] If the source IP attribute exists in the key of the Map, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment;
[0145] If the source IP attribute does not exist in the key of the Map, the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
[0146] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:
[0147] Determine the target IP attribute range based on the preset IP attribute set;
[0148] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and destination IP attribute range of the data packet to be processed.
[0149] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the data packet to be processed is discarded to filter the source IP attribute.
[0150] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0151] Identify the IP attributes in the preset IP attribute set that meet the preset IP attribute requirements as the target IP attributes;
[0152] Determine the target IP attribute range based on the target IP attributes.
[0153] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0154] Merge the IP attributes in the target IP attribute to obtain the target IP attribute range;
[0155] Define the target IP attribute range as the target IP attribute segment.
[0156] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0157] Match the source IP attribute and the target IP attribute range to obtain the matching results;
[0158] The risk detection result is determined based on the matching results.
[0159] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0160] If the matching result shows that the source IP attribute and the target IP attribute segment match, the risk detection result of the source IP attribute is determined to be a risky IP attribute.
[0161] If the matching result shows that the source IP attribute and the target IP attribute segment do not match, the risk detection result of the source IP attribute is determined to be a secure IP attribute.
[0162] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0163] Look up the keys in the Map based on the source IP attribute;
[0164] If the source IP attribute exists in the key of the Map, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment;
[0165] If the source IP attribute does not exist in the key of the Map, the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
[0166] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:
[0167] Determine the target IP attribute range based on the preset IP attribute set;
[0168] In response to the received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and destination IP attribute range of the data packet to be processed.
[0169] If the risk detection result indicates that the source IP attribute is a risky IP attribute, the data packet to be processed is discarded to filter the source IP attribute.
[0170] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0171] Identify the IP attributes in the preset IP attribute set that meet the preset IP attribute requirements as the target IP attributes;
[0172] Determine the target IP attribute range based on the target IP attributes.
[0173] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0174] Merge the IP attributes in the target IP attribute to obtain the target IP attribute range;
[0175] Define the target IP attribute range as the target IP attribute segment.
[0176] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0177] Match the source IP attribute and the target IP attribute range to obtain the matching results;
[0178] The risk detection result is determined based on the matching results.
[0179] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0180] If the matching result shows that the source IP attribute and the target IP attribute segment match, the risk detection result of the source IP attribute is determined to be a risky IP attribute.
[0181] If the matching result shows that the source IP attribute and the target IP attribute segment do not match, the risk detection result of the source IP attribute is determined to be a secure IP attribute.
[0182] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0183] Look up the keys in the Map based on the source IP attribute;
[0184] If the source IP attribute exists in the key of the Map, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment;
[0185] If the source IP attribute does not exist in the key of the Map, the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
[0186] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.
[0187] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0188] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. An IP attribute filtering method, characterized in that, The method includes: Determine the target IP attribute range based on the preset IP attribute set; In response to a received data packet to be processed, the XDP program loaded on the network card in the server determines the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed. If the risk detection result indicates that the source IP attribute is a risky IP attribute, the data packet to be processed is discarded to filter the source IP attribute.
2. The method according to claim 1, characterized in that, The step of determining the target IP attribute range based on a preset set of IP attributes includes: Identify the IP attributes in the preset IP attribute set that meet the preset IP attribute requirements as the target IP attributes; The target IP attribute segment is determined based on the target IP attribute.
3. The method according to claim 2, characterized in that, Determining the target IP attribute segment based on the target IP attribute includes: The IP attributes in the target IP attribute are merged to obtain the target IP attribute range; The target IP attribute range is defined as the target IP attribute segment.
4. The method according to claim 1, characterized in that, The step of determining the risk detection result of the source IP attribute based on the source IP attribute and the destination IP attribute segment of the data packet to be processed includes: The source IP attribute and the target IP attribute segment are matched to obtain the matching result; The risk detection result is determined based on the matching result.
5. The method according to claim 4, characterized in that, Determining the risk detection result based on the matching result includes: If the matching result shows that the source IP attribute and the target IP attribute segment match, the risk detection result of the source IP attribute is determined to be that the source IP attribute is a risky IP attribute; If the matching result indicates that the source IP attribute and the target IP attribute segment do not match, the risk detection result of the source IP attribute is determined to be a secure IP attribute.
6. The method according to claim 4, characterized in that, The target IP attribute segment is stored as a key in a Map. Matching the source IP attribute and the target IP attribute segment to obtain the matching result includes: The key of the Map is looked up based on the source IP attribute; If the source IP attribute exists in the key of the Map, then the matching result is determined to be a match between the source IP attribute and the target IP attribute segment; If the source IP attribute does not exist in the key of the Map, then the matching result is determined to be that the source IP attribute and the target IP attribute segment do not match.
7. An IP attribute filtering device, characterized in that, The device includes: The first determining module is used to determine the target IP attribute range based on a preset set of IP attributes; The second determining module is used to, in response to the received data packet to be processed, determine the risk detection result of the source IP attribute based on the source IP attribute and the target IP attribute segment of the data packet to be processed by the XDP program loaded on the network card in the server. The filtering module is used to discard the data packet to be processed when the risk detection result indicates that the source IP attribute is a risky IP attribute, so as to filter the source IP attribute.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.