DDOS (Distributed Denial of Service) protection method, system and equipment in high-bandwidth scene and medium

Abstract

The invention relates to the technical field of network security, in particular to a DDOS (Distributed Denial of Service) protection method, system and device in a high-bandwidth scene and a medium. Only common DDOS attack traffic is mirrored to a control plane, so that the consumption of unrelated traffic and detected traffic on CPU performance is reduced, and the protection effect of equipment in a high-bandwidth scene is improved; a blacklist and whitelist mechanism is established on a control plane, whether traffic is attack traffic is distinguished according to traffic rate characteristics of messages in a certain period, corresponding IPs are added into a blacklist or a whitelist, the messages with source IPs in the blacklist or the whitelist are not mirrored to the control plane, and abnormal traffic and normal traffic are not mirrored by establishing a blacklist and whitelist queue. And the CPU load is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method, system, device, and medium for DDoS protection in high-bandwidth scenarios. Background Technology

[0002] In industries such as finance, healthcare, and education, networks are vulnerable to DDoS attacks and require specialized DDoS protection equipment. These devices must not only defend against DDoS attacks but also ensure stable business operations, placing a significant challenge on their CPU performance.

[0003] Switching chips are the core hardware of modern network devices (such as switches and routers), specifically designed for high-speed data forwarding and traffic management. Compared to the traditional CPU-based approach to processing network data, switching chips offer significant advantages in performance, efficiency, and cost. However, traditional switching chips are not flexible enough and cannot be programmed to identify attack packets. Therefore, software is needed to identify attacks, organize the identified characteristics into ACL rules, and then distribute them to the switching chip to defend against attacks.

[0004] Chinese invention patents with patent application number "202411294592.2" entitled "AI Acceleration Solution Based on Distributed Denial of Service (DDOS) Using Data Processing Unit (DPU)" and "202510720902.0" entitled "Intelligent Monitoring System for Network Traffic Anomalies Integrating Artificial Intelligence" both employ a hardware-based solution to mirror traffic to the control plane, with software programs performing feature detection on the traffic and then issuing corresponding rules.

[0005] Current technology mirrors all traffic from the data plane to the control plane, where the control program identifies attack packets and issues corresponding protection policies to the data plane. However, in high-traffic scenarios, CPU processing performance becomes a bottleneck. DDoS attack traffic is mixed in with massive amounts of normal business traffic, and the attack traffic is submerged in normal packets and cannot be detected, resulting in poor protection performance. Summary of the Invention

[0006] This invention addresses the problem of existing protection methods that mirror all traffic from the data plane to the control plane, causing attack traffic to be submerged in normal packets and thus undetectable, resulting in poor protection performance. It proposes a DDoS protection method, system, device, and medium for high-bandwidth scenarios. While the switching chip forwards traffic at high speed, it utilizes the switching chip's mirroring function to mirror data packets to the CPU. The control program then identifies whether a packet is a DDoS attack packet. If a DDoS attack is detected, it issues corresponding ACL rules to the switching chip based on the packet characteristics, allowing the switching chip to intercept abnormal data packets and ensure normal service operation.

[0007] The specific implementation details of this invention are as follows: A DDoS protection method for high-bandwidth scenarios includes the following steps: Step S1: Send ACL rules to the switching chip, set the ACL action to mirroring, and mirror the qualified traffic to the control program; Step S2: Issue the QoS policy to the intranet server and establish and maintain a traffic monitoring hash table to statistically analyze the traffic characteristics of the source IP address in real time; Step S3: Determine the queue length according to the ACL entry specifications of the switching chip; the queue includes a blacklist queue and a whitelist queue; data packets with source IPs in the blacklist or whitelist queues will not be mirrored to the control program, and data packets with source IPs in the blacklist queue will be discarded by the switching chip; Step S4: Based on the acquired data packets, count the number of packets and the rate corresponding to the current IP, and perform the corresponding operation based on the statistical results; Step S5: Insert data into the queue and perform the corresponding operation according to the queue status.

[0008] To better implement the present invention, further, in step S2, each key of the traffic feature is an IP address, and the corresponding value is a structure; The structure includes a message count field, a timestamp field, and a normal count field; The packet count field, initially set to 1, is used to record the number of packets from that IP address. Each time a packet from that IP is received, the field is incremented by 1. If the number of packets exceeds the threshold but the average rate is less than the threshold rate, the packet count field is set to 0. The timestamp field has an initial value that is the time when the data was inserted. If the number of messages exceeds the threshold but the average rate is less than the preset threshold rate, the timestamp field is set to the current system time. The normal number of messages field is initially set to 0. If the number of messages exceeds the threshold but the average rate is less than the threshold rate, it is considered a normal traffic flow, and the field is incremented by 1.

[0009] To better implement the present invention, the queue in step S3 further includes a whitelist queue and a blacklist queue; The elements of the queue are structures, including an IP address field, a formatted time string field, and an ACL index field; The IP address field is the source IP of the packet; the formatted time string field is the current system time that needs to be taken when enqueuing; the ACL index field is the ACL rule index of the switching chip, which comes from the return value of the switching chip after the ACL rule is issued to the switching chip.

[0010] To better realize the present invention, step S4 further includes the following steps: Step S41: Query the traffic monitoring hash table based on the source IP of the packet; if not found, insert a data record into the traffic monitoring hash table, where the key is the source IP of the packet, the value is the structure with the packet number field set to 1, the timestamp field is the current system time, and the normal count field is 0; if found, proceed to step S42. Step S42: Determine whether the number of messages is greater than a preset threshold. If it is less than the threshold, increment the number of messages by 1. If it is greater than the threshold, proceed to step S43. Step S43: Determine if the current system time minus the corresponding timestamp in value is greater than 1 second. If it is greater than 1 second, it means that the IP is sending traffic at a low rate. Update the timestamp in value to the current system time and set the packet count to 0. Proceed to step S44. If it is less than 1 second, it means that the IP is sending traffic at a high rate and is abnormal traffic. Generate a high-priority ACL rule, filter the traffic with the source IP as this IP, and set the action to discard. Send the rule to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue and insert it into the blacklist queue. Finally, delete the data in the traffic monitoring and protection table. Step S44: Determine if the number of normal traffic occurrences exceeds the preset threshold. If it exceeds the threshold, it indicates that the IP is sending a lot of traffic at a low rate, which is legitimate traffic. To reduce CPU load, a high-priority ACL rule is generated to filter traffic originating from this IP, with the action of not mirroring. This rule is then sent to the switching chip. The IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent are organized into a structure corresponding to the whitelist queue, which is then inserted into the queue. Finally, the data is deleted from the traffic monitoring and protection table. If the threshold is not exceeded, the number of normal traffic occurrences is incremented by 1.

[0011] To better implement this invention, further, when inserting data into the blacklist queue, step S5 specifically includes the following steps: Step S51A: Determine if the blacklist queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the source IP of the data packet, discard it, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue element and insert it into the blacklist queue. If the queue is full, proceed to step S52A. Step S52A: Read the ACL rule index of the tail element of the blacklist queue, delete the rule corresponding to the index in the exchange chip, then dequeue the element, and then proceed to step S51A.

[0012] To better implement this invention, furthermore, when inserting data into the whitelist queue, step S5 specifically includes the following steps: Step S51B: Determine if the whitelist queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the same as the source IP of the data packet, set the action to not mirror, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the whitelist queue element and insert it into the whitelist queue. If the queue is full, proceed to step S52B. Step S52B: Read the ACL rule index of the tail element of the whitelist queue, delete the rule corresponding to the index in the exchange chip, then dequeue the element, and then proceed to step S551B.

[0013] To better realize the present invention, it further includes step S6, which specifically includes the following steps: Step S61: Create a timer to collect and execute tasks according to the set time; Step S62: Traverse the elements in the blacklist queue and whitelist queue, subtract the timestamp in the element from the current system time. If the difference is greater than the preset threshold, the element is dequeued, and the ACL rule in the switching chip is deleted according to the ACL index of the element. If the difference is not greater than the preset threshold, continue to traverse the next element.

[0014] Based on the above-mentioned DDoS protection method in a high-bandwidth scenario, in order to better realize the present invention, a DDoS protection system in a high-bandwidth scenario is further proposed to execute the above-mentioned DDoS protection method in a high-bandwidth scenario; including an initialization unit, an image processing unit, and a protection unit. The initialization unit is used to send ACL rules to the switching chip, set the ACL action to mirroring, and mirror the qualified traffic to the control program; send QoS policies to the intranet server, and establish and maintain a traffic monitoring hash table to statistically analyze the traffic characteristics of the source IP address in real time. The mirroring processing unit is used to determine the queue length according to the ACL entry specifications of the switching chip; the queue includes a blacklist queue and a whitelist queue; data packets with source IPs in the blacklist and whitelist queues will not be mirrored to the control program, and data packets with source IPs in the blacklist queue will be discarded by the switching chip. The protection unit is used to count the number and rate of packets corresponding to the current IP based on the acquired data packets, and perform corresponding operations based on the statistical results; insert data into the queue, and perform corresponding operations based on the queue status.

[0015] Based on the above-mentioned DDoS protection method for high-bandwidth scenarios, in order to better realize the present invention, an electronic device is further proposed, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the above-mentioned DDoS protection method for high-bandwidth scenarios is implemented.

[0016] Based on the above-mentioned DDoS protection method for high-bandwidth scenarios, in order to better realize the present invention, a computer-readable storage medium is further proposed, wherein computer instructions are stored on the computer-readable storage medium; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned DDoS protection method for high-bandwidth scenarios is realized.

[0017] The present invention has the following beneficial effects: (1) This invention only mirrors common DDoS attack traffic to the control plane, reducing the CPU performance consumption of irrelevant traffic and detected traffic, and improving the protection effect of the device in high bandwidth scenarios.

[0018] (2) The present invention establishes a blacklist and whitelist mechanism in the control plane. Based on the traffic rate characteristics of the packets within a certain period, it distinguishes whether the traffic is attack traffic and adds the corresponding IPs to the blacklist or whitelist respectively. Packets with source IPs in the blacklist or whitelist are not mirrored to the control plane. By establishing blacklist and whitelist queues, abnormal traffic and normal traffic are not mirrored, thus reducing CPU load. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the overall framework provided by the present invention.

[0020] Figure 2 This is a schematic diagram of the queue element structure fields provided in an embodiment of the present invention.

[0021] Figure 3 This is a flowchart illustrating the process of performing processing operations based on statistical results, provided as an embodiment of the present invention.

[0022] Figure 4 This is a schematic diagram illustrating the process of inserting data into a blacklist queue, as provided in an embodiment of the present invention.

[0023] Figure 5 This is a schematic diagram illustrating the process of inserting data into a whitelist queue, as provided in an embodiment of the present invention.

[0024] Figure 6 This is a schematic diagram of the process for periodically cleaning up blacklist and whitelist queues according to an embodiment of the present invention. Detailed Implementation

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments, and therefore should not be regarded as a limitation on the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "set up," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0027] The full English translations of the technical terms and abbreviations used in this embodiment are as follows: DDoS: Distributed Denial of Service attack, is a common type of network security attack. This attack primarily uses malicious traffic to consume network or network device resources, thereby causing websites to malfunction or online services to fail.

[0028] ACL stands for Access Control List. An ACL is a set of rules in network devices (such as routers, switches, and firewalls) used to control the entry and exit of data packets. Essentially, it uses a logic of "matching conditions + executing actions" to determine whether specific data packets are allowed to pass through a device port. Example 1:

[0029] This embodiment proposes a DDoS protection method for high-bandwidth scenarios, which specifically includes the following steps: Step S1: Send ACL rules to the switching chip, set the ACL action to mirroring, and mirror the qualified traffic to the control program; Step S2: Issue the QoS policy to the intranet server and establish and maintain a traffic monitoring hash table to statistically analyze the traffic characteristics of the source IP address in real time; In step S2, each key of the traffic feature is an IP address, and the corresponding value is a structure. The structure includes a message count field, a timestamp field, and a normal count field; The packet count field, initially set to 1, is used to record the number of packets from that IP address. Each time a packet from that IP is received, the field is incremented by 1. If the number of packets exceeds the threshold but the average rate is less than the threshold rate, the packet count field is set to 0. The timestamp field has an initial value that is the time when the data was inserted. If the number of messages exceeds the threshold but the average rate is less than the preset threshold rate, the timestamp field is set to the current system time. The normal number of messages field is initially set to 0. If the number of messages exceeds the threshold but the average rate is less than the threshold rate, it is considered a normal traffic flow, and the field is incremented by 1.

[0030] Step S3: Determine the queue length according to the ACL entry specifications of the switching chip; the queue includes a blacklist queue and a whitelist queue; data packets with source IPs in the blacklist or whitelist queues will not be mirrored to the control program, and data packets with source IPs in the blacklist queue will be discarded by the switching chip; The queues in step S3 include a whitelist queue and a blacklist queue; The elements of the queue are structures, including an IP address field, a formatted time string field, and an ACL index field; The IP address field is the source IP of the packet; the formatted time string field is the current system time that needs to be taken when enqueuing; the ACL index field is the ACL rule index of the switching chip, which comes from the return value of the switching chip after the ACL rule is issued to the switching chip.

[0031] Step S4: Based on the acquired data packets, count the number of packets and the rate corresponding to the current IP, and perform the corresponding operation based on the statistical results; Step S4 specifically includes the following steps: Step S41: Query the traffic monitoring hash table based on the source IP of the packet; if not found, insert a data record into the traffic monitoring hash table, where the key is the source IP of the packet, the value is the structure with the packet number field set to 1, the timestamp field is the current system time, and the normal count field is 0; if found, proceed to step S42. Step S42: Determine whether the number of messages is greater than a preset threshold. If it is less than the threshold, increment the number of messages by 1. If it is greater than the threshold, proceed to step S43. Step S43: Determine if the current system time minus the corresponding timestamp in value is greater than 1 second. If it is greater than 1 second, it means that the IP is sending traffic at a low rate. Update the timestamp in value to the current system time and set the packet count to 0. Proceed to step S44. If it is less than 1 second, it means that the IP is sending traffic at a high rate and is abnormal traffic. Generate a high-priority ACL rule, filter the traffic with the source IP as this IP, and set the action to discard. Send the rule to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue and insert it into the blacklist queue. Finally, delete the data in the traffic monitoring and protection table. Step S44: Determine if the number of normal traffic occurrences exceeds the preset threshold. If it exceeds the threshold, it indicates that the IP is sending a lot of traffic at a low rate, which is legitimate traffic. To reduce CPU load, a high-priority ACL rule is generated to filter traffic originating from this IP, with the action of not mirroring. This rule is then sent to the switching chip. The IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent are organized into a structure corresponding to the whitelist queue, which is then inserted into the queue. Finally, the data is deleted from the traffic monitoring and protection table. If the threshold is not exceeded, the number of normal traffic occurrences is incremented by 1.

[0032] Step S5: Insert data into the queue and perform the corresponding operation according to the queue status.

[0033] When inserting data into the blacklist queue, step S5 specifically includes the following steps: Step S51A: Determine if the blacklist queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the source IP of the data packet, discard it, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue element and insert it into the blacklist queue. If the queue is full, proceed to step S52A. Step S52A: Read the ACL rule index of the tail element of the blacklist queue, delete the rule corresponding to the index in the exchange chip, then dequeue the element, and then proceed to step S51A.

[0034] When inserting data into the whitelist queue, step S5 specifically includes the following steps: Step S51B: Determine if the whitelist queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the same as the source IP of the data packet, set the action to not mirror, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the whitelist queue element and insert it into the whitelist queue. If the queue is full, proceed to step S52B. Step S52B: Read the ACL rule index of the tail element of the whitelist queue, delete the rule corresponding to the index in the exchange chip, then dequeue the element, and then proceed to step S551B.

[0035] It also includes step S6, which specifically includes the following steps: Step S61: Create a timer to collect and execute tasks according to the set time; Step S62: Traverse the elements in the blacklist queue and whitelist queue, subtract the timestamp in the element from the current system time. If the difference is greater than the preset threshold, the element is dequeued, and the ACL rule in the switching chip is deleted according to the ACL index of the element. If the difference is not greater than the preset threshold, continue to traverse the next element.

[0036] Working Principle: DDoS (Distributed Denial of Service) attacks are a common type of network security attack. This type of attack primarily consumes network or network device resources through malicious traffic, causing websites to malfunction or online services to fail. Traditional DDoS protection devices are limited by CPU processing power, and in high-throughput scenarios, insufficient device performance will result in packet loss, affecting normal business operations. The purpose of this embodiment is to achieve DDoS protection while also considering device performance, ensuring stable and fast business operation.

[0037] The basic scheme of this embodiment is that while the switching chip forwards traffic at high speed, it uses the mirroring function of the switching chip to mirror the data packets to the CPU. The control program identifies whether the packets are DDoS attack packets. If a DDoS attack is detected, the corresponding ACL rules are issued to the switching chip according to the packet characteristics. The switching chip then intercepts the abnormal data packets to ensure the normal operation of the service. Example 2:

[0038] This embodiment is based on the above embodiment 1, such as... Figure 1 , Figure 2 , Figure 3 , Figure 4 , Figure 5 , Figure 6 As shown, a specific embodiment will be described in detail.

[0039] This embodiment is for traditional switching chips, which can only dynamically add, delete, or modify the entries and configuration registers inside the chip through the chip manufacturer's SDK.

[0040] Step S1: Based on the protection requirements, the control program sends the corresponding ACL rules to the switch chip (this concept refers to sending rules through the switch chip SDK, which will not be explained further below), sets the ACL action to mirroring, and mirrors the qualified traffic to the control program. For example, if it is necessary to mirror UDP, TCP SYN, and ICMP traffic to internal server A, the control program fills the ACL rules and actions into the corresponding structure according to the data format required by the SDK, and then calls the interface provided by the switch chip to send the rules.

[0041] Step S2: The control program issues a QoS policy to protect the internal network server. For example, if internal network server A can process a maximum of 100,000 data packets per second, the control program issues a QoS policy to limit the number of data packets to server A to no more than 100,000 per second, thus preventing server resource exhaustion.

[0042] The control program establishes and maintains a traffic monitoring hash table for real-time statistics of traffic characteristics for each source IP address. Each key is an IP address, and the corresponding value is a structure containing the following fields, as shown in Table 1. 1. The packet count field, initially set to 1, records the number of packets originating from this IP address. Each received packet from this IP address increments this field by 1. If the packet count exceeds a threshold but the average packet rate is less than the threshold rate, this field is set to 0. 2. Timestamp field: The initial value is the time when the data was inserted. If the number of messages exceeds the threshold but the average rate is less than the preset threshold rate, this field is set to the current system time. 3. The normal number of packets field has an initial value of 0. If the number of packets exceeds the threshold but the average rate is less than the threshold rate, it is considered a normal traffic flow, and this field is incremented by 1. Table 1

[0043] Step S3: The control list maintains two queues: a whitelist queue and a blacklist queue. The size of the queues depends on the size of the ACL entries on the switching chip. Packets with source IPs in the whitelist or blacklist will not be mirrored to the control program, and packets with source IPs in the blacklist queue will be discarded by the switching chip. Each element in the queue is a structure containing the following fields: Figure 2 As shown; 1. IP address, the source IP address of the message; 2. A formatted time string; the current system time needs to be retrieved when enqueuing it. 3. ACL Index: The ACL rule index of the switching chip is derived from the return value of the switching chip after ACL rules are issued to it.

[0044] Step S4: The control program receives the data packet, counts the number and rate of packets corresponding to that IP address, and performs different processing based on the different results. The detailed process is as follows... Figure 3 As shown; 1. Query the traffic monitoring hash table based on the source IP of the packet. If not found, insert a record into the traffic monitoring hash table, with the key being the source IP of the packet, and the value in the corresponding structure having the packet count field set to 1, the timestamp field set to the current system time, and the normal count field set to 0; if found, proceed to step 2.

[0045] 2. Determine if the number of messages exceeds a preset threshold. If it is less than the threshold, increment the message count by 1. If it exceeds the threshold, proceed to step 3.

[0046] 3. Determine if the difference between the current system time and the corresponding timestamp in `value` is greater than 1 second. If it is greater than 1 second, it indicates that the IP's traffic transmission rate is not high. Update the timestamp in `value` to the current system time and set the packet count to 0, then proceed to step 4. If it is less than 1 second, it indicates that the IP's traffic transmission rate is high, constituting abnormal traffic. Generate a high-priority ACL rule, filtering traffic originating from this IP, setting the action to drop, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue, and insert it into the blacklist queue. Finally, delete the corresponding data from the traffic monitoring and protection table.

[0047] 4. Determine if the number of normal traffic occurrences exceeds a preset threshold. If it exceeds the threshold, it indicates that the IP is sending a large amount of traffic at a low rate, which is legitimate traffic. To reduce CPU load, generate a high-priority ACL rule to filter traffic originating from this IP, set the action to "not mirror," and send it to the switch chip. Then, organize the IP, current system time, and the ACL index returned by the switch chip when the ACL rule is sent into a structure corresponding to the whitelist queue and insert it into the queue. Finally, delete the corresponding data from the traffic monitoring and protection table. If the threshold is not exceeded, increment the number of normal traffic occurrences by 1.

[0048] Step S5: In steps S4, steps 3 and 4, when inserting data into the blacklist and whitelist queues, there may be two scenarios: the queue is not full or it is full. Different handling is required for different scenarios. Details are as follows: Inserting data into the blacklist queue, such as Figure 4 As shown; 1. Determine if the queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the same as the source IP of the data packet, discard it, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue element, and insert it into the blacklist queue; if the queue is full, proceed to step 2.

[0049] 2. Read the ACL rule index of the tail element, delete the rule corresponding to that index in the swap chip, then dequeue the element, and then go back to step 1.

[0050] Inserting data into the whitelist queue, such as Figure 5 As shown; 1. Determine if the queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the same as the source IP of the data packet, set the action to non-mirroring, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the whitelist queue element, and insert it into the whitelist queue; if the queue is full, proceed to step 2.

[0051] 2. Read the ACL rule index of the tail element, delete the rule corresponding to that index in the swap chip, then dequeue the element, and then go back to step 1.

[0052] Step S6: Periodically clean the blacklist and whitelist queues, such as... Figure 6 As shown; 1. Create a timer to execute the task once per second.

[0053] 2. Iterate through the elements in the blacklist / whitelist queue, subtracting the timestamp of each element from the current system time. If the difference is greater than a preset threshold (different thresholds can be set for blacklists and whitelists, e.g., 15 minutes for blacklists and 3 minutes for whitelists), and if it is within the threshold, continue iterating to the next element. If the difference exceeds the threshold, dequeue the element and delete the corresponding ACL rule from the switching chip based on its ACL index.

[0054] Working principle: In high-bandwidth scenarios, existing technologies are limited by CPU performance, and the CPU cannot handle massive amounts of packets, resulting in poor protection effectiveness. This embodiment, without increasing hardware costs, reduces the CPU performance consumption of irrelevant and detected traffic through the following two methods, thereby improving the protection effect of the device in high-bandwidth scenarios.

[0055] 1. Only mirror common DDoS attack traffic to the control plane, such as UDP, TCP SYN, and ICMP.

[0056] 2. Establish a blacklist / whitelist mechanism on the control plane. Based on the traffic rate characteristics of packets within a certain period, distinguish whether the traffic is attacking and add the corresponding IP to the blacklist or whitelist respectively. Packets from source IPs that are on the blacklist or whitelist are not mirrored to the control plane.

[0057] This embodiment establishes a blacklist and whitelist queue, and does not mirror abnormal traffic and normal traffic, thereby reducing CPU load.

[0058] The other parts of this embodiment are the same as those in Embodiment 1 above, so they will not be described again. Example 3:

[0059] Based on any one of Embodiments 1-2 above, this embodiment proposes a DDoS protection system for high-bandwidth scenarios, used to execute the above-mentioned DDoS protection method for high-bandwidth scenarios; it includes an initialization unit, an image processing unit, and a protection unit; The initialization unit is used to send ACL rules to the switching chip, set the ACL action to mirroring, and mirror the qualified traffic to the control program; send QoS policies to the intranet server, and establish and maintain a traffic monitoring hash table to statistically analyze the traffic characteristics of the source IP address in real time. The mirroring processing unit is used to determine the queue length according to the ACL entry specifications of the switching chip; the queue includes a blacklist queue and a whitelist queue; data packets with source IPs in the blacklist and whitelist queues will not be mirrored to the control program, and data packets with source IPs in the blacklist queue will be discarded by the switching chip. The protection unit is used to count the number and rate of packets corresponding to the current IP based on the acquired data packets, and perform corresponding operations based on the statistical results; insert data into the queue, and perform corresponding operations based on the queue status.

[0060] This embodiment also proposes an electronic device, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements the above-described DDoS protection method in a high-bandwidth scenario.

[0061] This embodiment also proposes a computer-readable storage medium storing computer instructions; when the computer instructions are executed on the aforementioned electronic device, the aforementioned DDoS protection method in a high-bandwidth scenario is implemented.

[0062] The other parts of this embodiment are the same as any one of the above embodiments 1-2, so they will not be described again.

[0063] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A DDoS protection method for high-bandwidth scenarios, characterized in that, Specifically, the following steps are included: Step S1: Send ACL rules to the switching chip, set the ACL action to mirroring, and mirror the qualified traffic to the control program; Step S2: Issue the QoS policy to the intranet server and establish and maintain a traffic monitoring hash table to statistically analyze the traffic characteristics of the source IP address in real time; Step S3: Determine the queue length according to the ACL entry specifications of the switching chip; the queue includes a blacklist queue and a whitelist queue; data packets with source IPs in the blacklist or whitelist queues will not be mirrored to the control program, and data packets with source IPs in the blacklist queue will be discarded by the switching chip; Step S4: Based on the acquired data packets, count the number of packets and the rate corresponding to the current IP, and perform the corresponding operation based on the statistical results; Step S5: Insert data into the queue and perform the corresponding operation according to the queue status.

2. The DDoS protection method for high-bandwidth scenarios according to claim 1, characterized in that, In step S2, each key of the traffic feature is an IP address, and the corresponding value is a structure. The structure includes a message count field, a timestamp field, and a normal count field; The packet count field, initially set to 1, is used to record the number of packets from that IP address. Each time a packet from that IP is received, the field is incremented by 1. If the number of packets exceeds the threshold but the average rate is less than the threshold rate, the packet count field is set to 0. The timestamp field has an initial value that is the time when the data was inserted. If the number of messages exceeds the threshold but the average rate is less than the preset threshold rate, the timestamp field is set to the current system time. The normal number of messages field is initially set to 0. If the number of messages exceeds the threshold but the average rate is less than the threshold rate, it is considered a normal traffic flow, and the field is incremented by 1.

3. The DDoS protection method for high-bandwidth scenarios according to claim 1, characterized in that, The queues in step S3 include a whitelist queue and a blacklist queue; The elements of the queue are structures, including an IP address field, a formatted time string field, and an ACL index field; The IP address field is the source IP of the packet; the formatted time string field is the current system time that needs to be taken when enqueuing; the ACL index field is the ACL rule index of the switching chip, which comes from the return value of the switching chip after the ACL rule is issued to the switching chip.

4. The DDoS protection method in a high-bandwidth scenario according to claim 1, characterized in that, Step S4 specifically includes the following steps: Step S41: Query the traffic monitoring hash table based on the source IP of the packet; if not found, insert a data record into the traffic monitoring hash table, where the key is the source IP of the packet, the value is the structure with the packet number field set to 1, the timestamp field is the current system time, and the normal count field is 0; if found, proceed to step S42. Step S42: Determine whether the number of messages is greater than a preset threshold. If it is less than the threshold, increment the number of messages by 1. If it is greater than the threshold, proceed to step S43. Step S43: Determine if the current system time minus the corresponding timestamp in value is greater than 1 second. If it is greater than 1 second, it means that the IP is sending traffic at a low rate. Update the timestamp in value to the current system time and set the packet count to 0. Proceed to step S44. If it is less than 1 second, it means that the IP is sending traffic at a high rate and is abnormal traffic. Generate a high-priority ACL rule, filter the traffic with the source IP as this IP, and set the action to discard. Send the rule to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue and insert it into the blacklist queue. Finally, delete the data in the traffic monitoring and protection table. Step S44: Determine if the number of normal traffic occurrences exceeds the preset threshold. If it exceeds the threshold, it indicates that the IP is sending a lot of traffic at a low rate, which is legitimate traffic. To reduce CPU load, a high-priority ACL rule is generated to filter traffic originating from this IP, with the action of not mirroring. This rule is then sent to the switching chip. The IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent are organized into a structure corresponding to the whitelist queue, which is then inserted into the queue. Finally, the data is deleted from the traffic monitoring and protection table. If the threshold is not exceeded, the number of normal traffic occurrences is incremented by 1.

5. The DDoS protection method in a high-bandwidth scenario according to claim 1, characterized in that, When inserting data into the blacklist queue, step S5 specifically includes the following steps: Step S51A: Determine if the blacklist queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the source IP of the data packet, discard it, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the blacklist queue element and insert it into the blacklist queue. If the queue is full, proceed to step S52A. Step S52A: Read the ACL rule index of the tail element of the blacklist queue, delete the rule corresponding to the index in the exchange chip, then dequeue the element, and then proceed to step S51A.

6. The DDoS protection method in a high-bandwidth scenario according to claim 1, characterized in that, When inserting data into the whitelist queue, step S5 specifically includes the following steps: Step S51B: Determine if the whitelist queue is full. If not, generate a high-priority ACL rule, filter traffic whose source IP is the same as the source IP of the data packet, set the action to not mirror, and send it to the switching chip. Then, organize the IP, the current system time, and the ACL index returned by the switching chip when the ACL rule is sent into a structure corresponding to the whitelist queue element and insert it into the whitelist queue. If the queue is full, proceed to step S52B. Step S52B: Read the ACL rule index of the tail element of the whitelist queue, delete the rule corresponding to the index in the exchange chip, then dequeue the element, and then proceed to step S51B.

7. The DDoS protection method for high-bandwidth scenarios according to claim 1, characterized in that, It also includes step S6, which specifically includes the following steps: Step S61: Create a timer to collect and execute tasks according to the set time; Step S62: Traverse the elements in the blacklist queue and whitelist queue, subtract the timestamp in the element from the current system time. If the difference is greater than the preset threshold, the element is dequeued, and the ACL rule in the switching chip is deleted according to the ACL index of the element. If the difference is not greater than the preset threshold, continue to traverse the next element.

8. A DDoS protection system for high-bandwidth scenarios, used to execute the DDoS protection method for high-bandwidth scenarios as described in claim 1; characterized in that, Includes an initialization unit, an image processing unit, and a protection unit; The initialization unit is used to send ACL rules to the switching chip, set the ACL action to mirroring, and mirror the qualified traffic to the control program. Issue QoS policies to the intranet server and establish and maintain a traffic monitoring hash table to statistically analyze the traffic characteristics of source IP addresses in real time; The mirroring processing unit is used to determine the queue length according to the ACL entry specifications of the switching chip; the queue includes a blacklist queue and a whitelist queue; data packets with source IPs in the blacklist and whitelist queues will not be mirrored to the control program, and data packets with source IPs in the blacklist queue will be discarded by the switching chip. The protection unit is used to count the number and rate of packets corresponding to the current IP based on the acquired data packets, and perform corresponding operations based on the statistical results; insert data into the queue, and perform corresponding operations based on the queue status.

9. An electronic device, characterized in that, It includes a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements the DDoS protection method for high-bandwidth scenarios as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 9, the DDoS protection method for high-bandwidth scenarios as described in any one of claims 1-7 is implemented.

Images