Network traffic detection method and device, equipment and medium

Abstract

One or more embodiments of the invention provide a network traffic detection method and apparatus, a device and a medium. The network traffic detection method comprises the steps of obtaining a first message in network traffic; third information is acquired according to first information and second information in the first message, the first information indicates information of a first session corresponding to the first message, the second information indicates time information, and the third information indicates whether to perform security detection on the first message; and in response to the third information indication, performing security detection on the first message, and performing security detection on the first message. According to the network flow detection method, session cache does not need to be maintained, the performance of network flow sampling detection can be improved, and moreover, due to the fact that the third information is related to the session to which the message belongs and the time information for generating the message, decision consistency of the session level and sampling fairness in a long time period can be guaranteed.

Description

Technical Field

[0001] One or more embodiments of this disclosure relate to a network traffic detection method, a network traffic detection device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Faced with massive network traffic, there is often a need for network traffic detection. However, due to the growth of network services today, it is difficult to detect all packets in the massive network traffic. Therefore, the industry usually adopts sampling detection to detect a portion of the packets in the network traffic.

[0003] Therefore, how to perform sampling to improve network traffic detection performance is particularly important. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] At least one embodiment of this disclosure provides a network traffic detection method, including: acquiring a first packet in network traffic; acquiring third information based on first information and second information in the first packet; wherein the first information indicates information of a first session corresponding to the first packet, the second information indicates time information, and the third information indicates whether to perform security detection on the first packet; and performing security detection on the first packet in response to the third information indicating that security detection is performed on the first packet.

[0006] At least another embodiment of this disclosure provides a network traffic detection device, comprising: a first acquisition module configured to acquire a first packet in network traffic; a second acquisition module configured to acquire third information based on first information and second information in the first packet; wherein the first information indicates information of a first session corresponding to the first packet, the second information indicates time information, and the third information indicates whether to perform security detection on the first packet; and a detection module configured to perform security detection on the first packet in response to the third information indicating that security detection should be performed on the first packet.

[0007] At least one further embodiment of this disclosure provides an electronic device, including: a processing device; and a storage device including one or more computer program instructions; wherein the one or more computer program instructions are executed by the processing device to perform the network traffic detection method provided in at least one embodiment of this disclosure.

[0008] At least one further embodiment of this disclosure provides a computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein the network traffic detection method provided in at least one embodiment of this disclosure is implemented when the computer-readable instructions are executed by a processor.

[0009] At least one embodiment of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the network traffic detection method provided in at least one embodiment of this disclosure. Attached Figure Description

[0010] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0011] Figure 1 This illustration schematically depicts an application scenario of a network traffic detection system provided in at least one embodiment of the present disclosure;

[0012] Figure 2 The illustration shows a flowchart of a network traffic detection method provided in at least one embodiment of the present disclosure;

[0013] Figure 3 The illustration shows a flowchart of a network traffic detection method provided in at least one embodiment of the present disclosure;

[0014] Figure 4 The schematic diagram illustrates the structure of a network traffic detection device according to at least one embodiment of the present disclosure; and

[0015] Figure 5 The schematic diagram illustrates a structure suitable for implementing at least one embodiment of the present disclosure of an electronic device. Detailed Implementation

[0016] One or more embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0017] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0018] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0019] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0020] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0021] The names of the messages or information exchanged between the various devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0022] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0023] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, relevant users should be informed of the type, scope of use, and usage scenarios of the information involved in this disclosure through appropriate means in accordance with relevant laws and regulations, and authorization should be obtained from the relevant users. Among them, relevant users may include any type of rights holder, such as individuals, enterprises, and groups.

[0024] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly indicate that the operation requested by the user will require obtaining and using the user's information. This allows the relevant user to choose whether to provide information to the software or hardware such as the electronic device, application, server, or storage medium that performs the operation of any embodiment of the present disclosure based on the prompt message.

[0025] As an optional but non-restrictive implementation, in response to a user's active request, a prompt message can be sent to the user, such as a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide information to the electronic device.

[0026] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0027] Security inspection of network traffic packets can, to some extent, ensure network security and optimize service quality. For example, by analyzing each packet in network traffic, it is possible to determine whether insecure transmission behavior has occurred and whether services are operating normally.

[0028] In some scenarios, there is a large amount of network traffic. For example, in the protection against distributed denial of service (DDoS) attacks and in the detection of high-traffic business, the scale of network traffic is large. If all packets in the network traffic are fully detected, it will consume a lot of computing and storage resources, and may also cause processing bottlenecks and affect the overall operating performance of the business.

[0029] In the above scenarios, the industry typically uses sampling detection for network traffic detection. Sampling detection can be understood as detecting only a portion of network traffic packets. By sampling and detecting these packets, the overall network traffic status is inferred, thus achieving network traffic detection without affecting the normal operation of services.

[0030] Typically, sampling detection relies on maintaining a session cache, which records active sessions in the network. For example, the session cache records sessions that are not yet terminated or sessions that have not yet timed out.

[0031] By updating the session cache, session-level sampling and detection are performed on active sessions within the cache. In other words, when a session in the cache is determined to require sampling and detection, all packets from that session need to be detected; conversely, when a session in the cache is determined not to require sampling and detection, all packets from that session do not need to be detected. By maintaining the session cache, consistent sampling decisions are made for packets within the same session.

[0032] For example, the active sessions in the session cache include sessions A, B, C, and D, with a sampling rate of 25%. Session A is determined to be a session that needs to be sampled and detected, while sessions B, C, and D are determined to be sessions that do not need to be sampled and detected. In this case, for a packet, if the packet belongs to session A, then the packet needs to be detected; if the packet belongs to session B, session C, or session D, then the packet does not need to be detected.

[0033] Since the session cache records active sessions in the above-mentioned sampling and detection method for maintaining the session cache, this method can also be called a stateful sampling and detection method.

[0034] However, stateful sampling and detection methods have at least the following problems: First, when there are a large number of sessions in the communication network, the session cache will occupy a lot of memory resources, causing memory consumption; second, since sessions have a life cycle of creation, aging, and destruction, continuously updating the session cache brings additional processing overhead, and in high-concurrency scenarios, maintaining the session cache may become a performance bottleneck.

[0035] To at least partially solve the above-mentioned technical problem, at least one embodiment of this disclosure provides a network traffic detection method, the method comprising: acquiring a first packet in network traffic; acquiring third information based on first information and second information in the first packet, wherein the first information indicates information of a first session corresponding to the first packet, the second information indicates time information, the third information indicates whether to perform security detection on the first packet, and performing security detection on the first packet in response to the third information indicating to perform security detection on the first packet.

[0036] In a network traffic detection method provided in at least one embodiment of this disclosure, third information indicating whether security detection should be performed is calculated in real time using information indicating the session and recording time information in the packet. This determines whether security detection of the packet is required, thereby achieving sampling detection of packets in network traffic. On the one hand, the real-time information extraction and calculation method eliminates the need to maintain a session cache, enabling stateless sampling detection and improving the performance of network traffic sampling detection. On the other hand, since the sampling determination information is related to the network session to which the packet belongs and the time information of the packet generation, it can ensure the consistency of decisions at the session level and the fairness of sampling over long periods.

[0037] Based on the network traffic detection method provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides a network traffic detection device, electronic device, computer-readable storage medium, and computer program product.

[0038] The present disclosure and some examples thereof will now be described in detail with reference to the accompanying drawings.

[0039] Figure 1 The illustration shows an application scenario diagram of a network traffic detection system provided in at least one embodiment of the present disclosure.

[0040] like Figure 1 As shown, the application scenario provided in this embodiment may include a network traffic detection system 10, which can be understood as a data processing node used for sampling, detection, and judgment. One or more embodiments of this disclosure do not limit the form of the network traffic detection system 10. In some embodiments, the network traffic detection system 10 may be a hardware-based data processing node, such as a firewall or load balancer; in other embodiments, the network traffic detection system 10 may be a software-based data processing node, such as a server process, virtual node, or intermediate node; and in still other embodiments, the network packet processing system 10 may be a data processing node combining hardware and software forms.

[0041] The network traffic detection system 10 can sample, detect and determine the packets between the first network node 21 and the first network node 22. The first network node 21 and the first network node 22 can be any network node in the communication network that can send or receive packets. For example, the first network node 21 and the first network node 22 can be terminal nodes, network transmission nodes, virtual nodes, etc.

[0042] The first network node 21 can send messages to the second network node 22. The network traffic detection system 10 can intercept the messages sent from the first network node 21 to the second network node 22 and determine whether the messages need to be security detected. In this way, by judging the messages in the communication network, the network traffic sampling and detection system can achieve "security detection of some messages and no security detection of some messages".

[0043] In some embodiments, packets in the communication network can be filtered by configuring sampling rules. The network traffic detection system 10 only determines whether packets that match the sampling rules need to be detected. For example, the packet system 10 can deploy a first process and a second process. The first process periodically (e.g., every 10 seconds) pulls the sampling rules. When the sampling rules are updated, the first process sends the latest sampling rules to the second process. The second process then matches packets with the sampling rules and determines whether packets that match the sampling rules need to be detected.

[0044] In the process of determining whether a message needs to be security checked, a third information 103 is obtained based on the first information 101 and the second information 102 in the message. The first information 101 can indicate the network session, the second information 102 can indicate the time information, and the third information can indicate whether the message needs to be security checked.

[0045] In other words, for packets in network traffic, by combining the packet's session information and time information, third-party information is obtained in real time to determine whether to perform security checks on the packet. This enables sampling and detection of packets in network traffic. For example, some packets are allowed to pass through and transmitted to the second network node 22 without additional security checks; conversely, other packets are subjected to security checks, and processed according to the processing method corresponding to the detection requirements. In this way, sampling and detection of network traffic in the communication network is achieved.

[0046] On the one hand, the method of extracting the first and second information from the message in real time and obtaining the third information in real time in one or more embodiments of this disclosure does not require maintaining a session cache. It achieves network traffic sampling and detection while saving storage resources, thereby improving the performance of network traffic sampling and detection.

[0047] On the other hand, since the third information is related to the network session to which the message belongs and the time information when the message was generated, the sampling and detection judgment of the message is also related to the network session to which the message belongs and the time information when the message was generated. For multiple messages in the same network session, it can ensure the consistency of decision-making, and for multiple messages generated in different time periods, it can ensure the fairness of sampling.

[0048] The following will combine Figure 2 and Figure 3 A network traffic detection method provided by at least one embodiment of the present disclosure will be described in detail.

[0049] Figure 2 The illustration shows a flowchart of a network traffic detection method provided in at least one embodiment of the present disclosure.

[0050] like Figure 2 As shown, the network traffic detection method of this embodiment includes steps S201 to S203. In some embodiments, the executing entity of the network traffic detection method can be a data processing node. The network traffic detection method includes:

[0051] Step S201: Obtain the first packet in the network traffic.

[0052] Network traffic can be understood as the total data transmitted in a communication network, including the digital information flow exchanged between various network nodes in the communication network.

[0053] A message, also known as a network message, data packet, or network data packet, can be understood as the basic unit carrying data in network traffic. It is a data unit exchanged and transmitted in the network, and a message can include complete data information to be sent. In one or more embodiments of this disclosure, a first message can be understood as any message in the network traffic generated by the communication network. For example, the first message can be extracted from the network traffic by collecting network traffic in the communication network.

[0054] In some embodiments, considering that the service may have specific detection requirements, sampling rules can be configured to filter packets, selecting those that need to be sampled and detected from a large amount of network traffic. For example, in response to a first packet matching a sampling rule, the first packet is obtained; this sampling rule can be used to filter packets for sampling.

[0055] In other words, in actual business scenarios, it is not necessary to sample and detect all messages. It is only necessary to sample and detect the messages that are of key interest. By defining sampling rules, the messages that need to be focused on can be selected from the messages in the communication network by matching the messages with the sampling rules.

[0056] One or more embodiments of this disclosure do not limit the form of the sampling rule. For example, the sampling rule may include an Internet Protocol (IP) address. If a message includes the IP address, then the message matches the sampling rule. Or, for example, the sampling rule may include a port. If a message includes the port, then the message matches the sampling rule.

[0057] One or more embodiments of this disclosure do not limit the method of matching packets with sampling rules. For example, the data plane development kit (DPDK) has a built-in access control list processing (rte_acl) library. The rte_acl library can be understood as a rule matching engine, which supports matching different fields of packets (such as IP address, port, protocol type, etc.) according to sampling rules. Therefore, the matching process between packets and sampling rules can be realized with the help of the rte_acl library.

[0058] Sampling rules can include one or more. When there are multiple sampling rules, if the first message matches any one of the sampling rules, it indicates that the first message is a message that needs to be sampled and detected. Therefore, the first message can be obtained so that it can be sampled and detected in the future.

[0059] In this way, by combining actual business needs and configuring sampling rules, a large number of packets in the communication network can be initially screened to identify the key packets that match the sampling rules, thereby reducing the number of packets to be sampled and detected, and reducing the computing resources required for sampling and detection.

[0060] Step S202: Obtain the third information based on the first and second information in the first message.

[0061] In one or more embodiments of this disclosure, for the first message, the determination of whether to perform security detection does not rely on the session state in the local session cache, but rather through a deterministic calculation process, sampling and detection are performed in real time based on the information carried by the first message itself.

[0062] A session, also known as a network session or IP session, can be understood as an interactive information exchange process between two or more network nodes. It can be a stateful temporary interactive link during communication.

[0063] In one or more embodiments of this disclosure, the first information may indicate information about the first session corresponding to the first message. The session to which the first message belongs is the first session, and the first message is a message under the first session. In other words, the first information may be used to identify the network session to which the message belongs. For example, the first information may be the field value corresponding to the first field in the message used to identify the session.

[0064] The second information can indicate time information; in other words, the second information can be used to record the time information when the message was generated. For example, the second information can be the field value corresponding to the second field in the message used to record time information.

[0065] The third information can indicate whether to perform security checks on the first message. In other words, the third information can be understood as sampling and judgment information. The third information can be used to determine the sampling and judgment result. That is, through the third information, it can be determined whether the message needs to be security checked.

[0066] In one or more embodiments of this disclosure, the third information is related to the first and second information, that is, the third information is related to the network session to which the message belongs and the time when the message was generated. For example, the third information can be calculated based on the first and second information.

[0067] Thus, since the third information is related to the first information used to identify the session, it can ensure the consistency of sampling and detection at the session level to a certain extent, that is, messages under the same session have the same sampling and detection judgment basis; since the third information is related to the second information used to record time information, it can ensure the sampling fairness over a long period to a certain extent, that is, there are differences in the sampling and detection judgment of messages under different units of time.

[0068] In some possible implementations, the first and second information can be calculated separately and then integrated to form the third information. For example, a first digest value can be obtained based on the first information in the first message, and a first time value can be obtained based on the second information in the first message. The third information can then be obtained based on the first digest value and the first time value.

[0069] In other words, during the real-time calculation of the third information, since the first information can identify the session, the first digest value (e.g., a hash value) that can uniquely identify the first session is calculated using the first information that identifies the first session corresponding to the first message; since the second information can record time information, the first time value that can represent the time when the first message was generated is calculated using the second information that records time information; and then the third information is calculated together using the first digest value and the first time value.

[0070] One or more embodiments of this disclosure do not limit the method of calculating the sampling determination information of the first message using the first digest value and the first time value. For example, the first digest value and the first time value can be added together to obtain the third information of the first message.

[0071] In this way, sampling and judgment information is calculated in real time from two dimensions: session and generation time, to jointly determine whether a message needs to be sampled and detected. There is no need to pre-cachise information related to session state, thus achieving stateless message sampling and detection.

[0072] In some embodiments, messages belonging to the first session have the same first digest value, and messages generated within the same unit of time have the same first time value.

[0073] In other words, multiple messages belonging to the same session have the same first digest value, and multiple messages generated within the same unit of time have the same first time value.

[0074] For multiple messages in a session, messages generated within the same unit of time have the same third information, while messages generated in different unit of time may have different third information. That is, messages generated by a session within the same unit of time have the same judgment result. For example, all messages generated by a session within the same unit of time are subject to security checks, or none of the messages generated by a session within the same unit of time are subject to security checks. Messages generated by a session in different unit of time may have different judgment results. For example, messages generated by a session in the first unit of time are subject to security checks, while messages generated by a session in the second unit of time are not subject to security checks.

[0075] Thus, compared to the approach where "the third information is only related to the first digest value," the approach provided in one or more embodiments of this disclosure where "the third information is related to both the first digest value and the first time value" is based on the first digest value. Since the first digest value of the same session is the same and static, the consistency of decision-making for different messages under the same session is guaranteed. In addition, the first time value is also considered. Since the first time value of the same session may be different and dynamically changing, the situation where "for some sessions, the first digest value corresponding to the session is fixed, and the constant corresponds to the judgment result that does not need security detection, resulting in never being able to be detected by security" is avoided. This ensures the sampling fairness of messages under each session within a long period composed of multiple unit time periods.

[0076] For example, the first information can be a 5-tuple, and the first digest value can be a receive sidescaling (RSS) hash value, that is, the first digest value is obtained by calculating the 5-tuple information in the first message using the RSS hash function.

[0077] A 5-tuple can consist of the source IP address, destination IP address, source port, destination port, and transport layer protocol. The 5-tuple can be used to identify the session corresponding to the message. Therefore, the 5-tuple in the first message can be the first information.

[0078] RSS hash functions can be used to calculate RSS hash values ​​(i.e., first digest values). Typically, RSS hash values ​​are used for network traffic distribution. For example, based on the RSS hash value, packets are distributed to different receive queues, and different receive queues process different packets.

[0079] In one or more embodiments of this disclosure, an RSS hash function is applied to the packet sampling and detection process. Since the RSS hash value is calculated from the 5-tuple information, the RSS hash value calculated using the RSS hash function is the same for different packets in the same session. That is, the RSS hash value can be used as the first digest value for subsequent calculation of the third information.

[0080] Thus, by applying the RSS function to scenarios different from network traffic distribution, and leveraging the fact that the RSS hash value remains stable across multiple packets in the same session, it can be used as the basis for judgment during packet sampling and detection, ensuring session-level consistency.

[0081] For example, the second information can be timestamp information, which may include a signature time, proving that the first message existed before the signature time, that is, proving that the first message was generated at the signature time. The first time value can be a time slice factor related to the timestamp information and the unit time, that is, obtaining the first ratio between the timestamp information of the first unit of measurement in the first message and the unit time of the first unit of measurement, and rounding the first ratio to obtain the first time value.

[0082] Timestamp information can be understood as a time marker for the first message. Timestamp information can be used to record the time information when the first message was generated. Therefore, the timestamp information in the first message can be used as second information.

[0083] Since the first time value is related to the unit time, the calculation method of the first time value is related to the unit time and the unit of measurement used. For example, the unit time can be one hour, two hours, etc., and the unit of measurement can be seconds, minutes, etc.

[0084] Under the same unit of measurement (i.e., the first unit of measurement), the result obtained by rounding the ratio between the timestamp information and the unit time (i.e., the first ratio) can indicate how many units of time correspond to the time information that generated the first message. For messages generated within the same unit of time, by calculating the ratio between the timestamp information and the unit time, and then rounding the ratio between the timestamp information and the unit time, the same first time value can be obtained.

[0085] For example, if the first unit of measurement is seconds and the unit of time is one hour, the timestamp information of the first unit of measurement in the first message is 40000, and the first time value is 11 after rounding up 40000 / 3600; if the timestamp information of the first unit of measurement in the first message is 45000, and the first time value is 12 after rounding up 45000 / 3600, then the first time value of the first message generated in different units of time under the first network session can be different. Consequently, the sampling and judgment information of the first message generated in different units of time under the first network session can be different.

[0086] In this way, by taking advantage of the dynamic nature of the result obtained by rounding the ratio between the timestamp information and the unit time, it serves as a changing time factor in the packet sampling and detection process. This ensures that the judgment result of packets under the same session will change over a long period (e.g., a period composed of multiple unit times), and there will be no situation where "packets under some network sessions will be sampled in a fixed manner, while packets under some network sessions will never be sampled".

[0087] Step S203: In response to the third information instruction, perform security checks on the first message and perform security checks on the first message.

[0088] In one or more embodiments of this disclosure, since it is necessary to determine whether a message should be security checked, a sampling interval can be configured. By combining the sampling interval, it can be determined whether the first message should be checked. For example, the sampling determination result can be determined based on the relationship between the third information and the sampling interval, and the first message can be determined based on the sampling determination result.

[0089] For example, in response to the third information being located in the sampling interval, a security check is performed on the first message.

[0090] The relationship between the third information and the sampling interval can be that the third information is located within the sampling interval, or it can be located outside the sampling interval. By configuring the sampling interval, it is ensured that only packets with a portion of the third information correspond to the sampling judgment results that require security detection, thus realizing the process of sampling and detecting network traffic based on the relationship between the third information of the packet and the sampling interval.

[0091] In some possible approaches, the sampling interval can be a specific numerical range, such as [a1, a2], where a1 and a2 are both values ​​greater than 0. That is, when the third information of the first message belongs to this numerical range, it means that the third information of the first message is within the sampling interval; when the third information of the first message does not belong to this numerical range, it means that the third information of the first message is not within the sampling interval.

[0092] In some other possible implementations, the sampling interval can be related to the sampling rate. For example, the sampling interval can indicate the first sampling rate, obtain the first result of the modulo operation of the third information on 100, and determine the sampling judgment result based on the relationship between the first result and the first sampling rate.

[0093] For example, in response to a first result being less than or equal to a first sampling rate, a security check is performed on the first message.

[0094] Understandably, the first result of the sampling determination information of the first message modulo 100 is an integer between 0 and 99. The sampling rate is also presented as a percentage. Therefore, by comparing the first result with the first sampling rate, if the first result is less than or equal to the first sampling rate, it can be understood that the third information of the first message is located in the sampling interval. If the first result is greater than the first sampling rate, it can be understood that the third information of the first message is not located in the sampling interval.

[0095] For example, if the first sampling rate is 20%, and the first result of modulo operation of the third information of the first message with 100 is 15, then the third information of the first message is within the sampling range and security detection of the first message is required; if the first result of modulo operation of the third information of the first message with 100 is 35, then the third information of the first message is not within the sampling range and security detection of the first message is not required.

[0096] Thus, for a large number of first packets, the sampling judgment result obtained by combining the sampling rate and the first result of mod100 can ensure that the proportion of packets in network traffic that need to be security detected meets the sampling rate, that is, achieve the purpose of sampling and detecting network traffic at the configured sampling rate.

[0097] In one or more embodiments of this disclosure, security detection can be understood as performing detection processing on the first message related to different security dimensions. For example, in response to a third information instruction to perform security detection on the first message, the first message is processed based on a processing method corresponding to the security detection requirements, or in response to a third information instruction not to perform security detection on the first message, the first message is transmitted.

[0098] For example, when the third information of the first message is within the sampling interval and the first result is less than or equal to the first sampling rate, it is determined that the first message will be subject to security detection; when the third information of the first message is not within the sampling interval and the first result is greater than the first sampling rate, it is determined that the first message will not be subject to security detection.

[0099] In other words, when the first packet needs to be sampled, it is used as sample data for security detection processing corresponding to the security detection requirements. For example, abnormal behavior identification can be performed on the first packet to determine whether it is used to perform abnormal behavior; traffic feature extraction can be performed on the first packet to obtain the traffic features contained in the first packet; and field extraction can be performed on the first packet to determine whether there is information in the first packet that does not comply with security specifications. In this way, by performing security detection processing on the first packet, the overall network traffic status can be inferred.

[0100] When the first message does not need to be sampled, there is no need to perform security checks on the first message; the first message is allowed to pass and transmitted to the receiver.

[0101] Thus, by combining the first and second information extracted from the first message, sampling detection and judgment of the first message can be achieved. The above method can be applied to various messages in the communication network to achieve sampling detection of network traffic in the communication network.

[0102] Without creating and maintaining any session-level context (i.e., session cache), it ensures that all packets of the same session have the same third information within the same unit of time, and makes a definite and consistent sampling decision. At the same time, by combining dynamically changing time information, it avoids the problem that some sessions cannot be detected because the first digest value corresponding to some sessions is constant and does not correspond to the decision not to perform sampling detection, and avoids sampling deviation caused by hash collision.

[0103] Figure 3 The illustration shows a flowchart of a network traffic detection method provided in at least one embodiment of the present disclosure.

[0104] like Figure 3 As shown, the overall processing flow for the first message is as follows: First, the first message generated in the communication network is intercepted. Using pre-configured sampling rules, it is determined whether the first message matches the sampling rules. If the first message does not match any sampling rule, the first message is allowed to pass without any security checks. If the first message matches any sampling rule, the third information of the first message is obtained. Then, it is determined whether the third information of the first message is within the sampling interval. If the third information of the first message is not within the sampling interval, the first message is allowed to pass without any security checks. If the third information of the first message is within the sampling interval, the first message is subjected to security checks.

[0105] Thus, by combining the stable first digest value and the periodically changing first time value in the message, and comparing them with the sampling interval (sampling rate), the message is sampled and detected. Without maintaining session state, this ensures decision consistency within the same session within the same unit of time, and also ensures sampling fairness over long periods by introducing time-related parameters.

[0106] Applying the above method to network traffic with bursts or sustained high queries-per-second (QPS) rates enables sampling and detection of network traffic. Only a portion of packets undergoes security detection and processing (such as packet parsing or blocking), while the remaining packets are quickly allowed to pass. This reduces the resource consumption of upstream detection and processing links and the pressure on processing queues, thereby improving the overall stability and responsiveness of the service.

[0107] Applying the above method to elephant flows (i.e., network traffic patterns that continuously generate high bandwidth or high session counts) initiated by a single IP can avoid resource consumption caused by a single hot session (i.e. elephant flow) continuously hitting the sampling rules and requiring detection of all packets over a long period. This ensures fair sampling opportunities for other network traffic, achieves effective diversion of elephant flows, significantly improves the overall throughput and processing latency of the service, and guarantees service quality under extreme network traffic conditions.

[0108] Based on the network traffic detection method provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides a network traffic detection device. The following will be combined with... Figure 4 This network traffic detection device is described in detail.

[0109] Figure 4 The schematic diagram illustrates the structure of a network traffic detection device provided in at least one embodiment of the present disclosure.

[0110] like Figure 4 As shown, the network traffic detection device 400 of this embodiment includes a first acquisition module 401, a second acquisition module 402, and a determination module 403. For example, the first acquisition module 401, the second acquisition module 402, and the determination module 403 can be implemented by hardware (e.g., circuit) modules or software modules. The following embodiments are similar and will not be described again. For example, the first acquisition module 401, the second acquisition module 402, and the determination module 403 can be implemented by a central processing unit (CPU), a general-purpose graphics processor (GPGPU), a graphics processing unit (GPU), a tensor processor (TPU), a field-programmable gate array (FPGA), or other processing units with data processing capabilities and / or instruction execution capabilities, along with corresponding computer instructions.

[0111] The first acquisition module 401 is configured to acquire the first packet in the network traffic. For example, the first acquisition module 401 can be configured to execute step S201 described above. The specific implementation principle can be referred to the relevant description of step S201, which will not be repeated here.

[0112] The second acquisition module 402 is configured to: acquire third information based on the first information and the second information in the first message; wherein the first information indicates information about the first session corresponding to the first message, the second information indicates time information, and the third information indicates whether to perform security detection on the first message. For example, the second acquisition module 402 can be configured to execute step S202 described above; its specific implementation principle can be found in the relevant description of step S202, and will not be repeated here.

[0113] The detection module 403 is configured to perform security detection on the first message in response to the third information indication. For example, the detection module 403 can be configured to execute step S203 described above; its specific implementation principle can be found in the relevant description of step S203, and will not be repeated here.

[0114] In at least one embodiment of this disclosure, the second acquisition module 402 is further configured to: acquire a first digest value based on the first information in the first message, and acquire a first time value based on the second information in the first message; and acquire the third information based on the first digest value and the first time value.

[0115] In at least one embodiment of this disclosure, the first digest values ​​of messages belonging to the first session are the same, and the first time values ​​of messages generated within the same unit of time are the same.

[0116] In at least one embodiment of this disclosure, the second acquisition module 402 is further configured to: calculate the quintuple information in the first message using a receiving end scaling hash function to obtain the first digest value.

[0117] In at least one embodiment of this disclosure, the second acquisition module 402 is further configured to: acquire a first ratio between the timestamp information of the first unit of measurement in the first message and the unit time of the first unit of measurement; and round the first ratio to obtain the first time value.

[0118] In at least one embodiment of this disclosure, the first acquisition module 401 is further configured to: acquire the first packet in response to a matching of the first packet in the network traffic with a sampling rule, wherein the sampling rule is used to filter packets for sampling determination.

[0119] In at least one embodiment of this disclosure, the detection module 403 is further configured to perform security detection on the first message in response to the third information being located in the sampling interval.

[0120] In at least one embodiment of this disclosure, the sampling interval indicates a first sampling rate, and the detection module 403 is further configured to: obtain a first result of performing a modulo operation on 100 using the third information; and perform security detection on the first message in response to the first result being less than or equal to the first sampling rate.

[0121] In at least one embodiment of this disclosure, the detection module 403 is further configured to transmit the first message in response to the third information indicating that security detection of the first message is not performed.

[0122] It should be noted that, for clarity and brevity, at least one embodiment of this disclosure does not show all the constituent units of the network traffic detection device 400. To achieve the necessary functions of the network traffic detection device 400, those skilled in the art can provide and set other constituent units (not shown) according to specific needs, and one or more embodiments of this disclosure do not limit this.

[0123] At least one embodiment of this disclosure also provides an electronic device, including a processing device and a storage device, the storage device including one or more computer program modules; wherein the one or more computer program modules are stored in the storage device and configured to be executed by the processing device, the one or more computer program modules being used to implement the network traffic detection method provided in any embodiment of this disclosure.

[0124] For example, the processing device may be a processor, such as a central processing unit (CPU), digital signal processor (DSP), image processor (GPU), general-purpose graphics processor (GPGPU), or other form of processing unit with data processing capabilities and / or instruction execution capabilities. It may be a general-purpose processor or a dedicated processor and may control other components in the electronic device to perform the desired functions.

[0125] For example, the storage device may be a memory, which may include one or more computer program products. These computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and a processing device may execute these program instructions to implement the functions (implemented by the processing device) in at least one embodiment of this disclosure and / or other desired functions. Various application programs and various data may also be stored in the computer-readable storage medium, which is not limited by one or more embodiments of this disclosure.

[0126] The following is for reference. Figure 5 The diagram illustrates a structural schematic of an electronic device (e.g., a terminal device or a server) 500 suitable for implementing at least one embodiment of the present disclosure. The terminal device in at least one embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of at least one embodiment of this disclosure.

[0127] like Figure 5 As shown, electronic device 500 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. RAM 503 also stores various programs and data required for the operation of electronic device 500. Processing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0128] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0129] In particular, according to one or more embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, one or more embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of at least one embodiment of this disclosure.

[0130] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0131] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0132] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0133] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the aforementioned network traffic detection method.

[0134] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0135] One or more embodiments of this disclosure also provide a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in any embodiment of this disclosure are generated.

[0136] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0137] When the computer program product is executed by a computer, the computer performs any of the aforementioned network traffic detection methods. The computer program product can be a software installation package; when any of the aforementioned network traffic detection methods is required, the computer program product can be downloaded and executed on the computer.

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0139] The units or modules described in at least one embodiment of this disclosure can be implemented in software or hardware. The names of the units or modules do not necessarily limit the specific unit or module itself.

[0140] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0141] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0142] According to one or more embodiments of this disclosure, Example 1 provides a network traffic detection method, including:

[0143] Retrieve the first packet from network traffic;

[0144] Based on the first information and the second information in the first message, obtain the third information; wherein, the first information indicates the information of the first session corresponding to the first message, the second information indicates time information, and the third information indicates whether to perform security detection on the first message;

[0145] In response to the third information instruction, a security check is performed on the first message.

[0146] According to one or more embodiments of this disclosure, Example 2 provides the method of obtaining third information based on first and second information in the first message, as in Example 1, including:

[0147] Based on the first information in the first message, obtain a first digest value, and based on the second information in the first message, obtain a first time value;

[0148] The third information is obtained based on the first summary value and the first time value.

[0149] According to one or more embodiments of this disclosure, Example 3 provides that the first digest values ​​of messages belonging to the first session in Example 2 are the same, and the first time values ​​of messages generated in the same unit time period are the same.

[0150] According to one or more embodiments of this disclosure, Example 4 provides the method of obtaining a first digest value based on the first information in the first message, as in Example 2, including:

[0151] The first digest value is obtained by calculating the quintuple information in the first message using the receiving end's scaling hash function.

[0152] According to one or more embodiments of this disclosure, Example 5 provides the method of obtaining a first time value based on the second information in the first message, as in Example 2, including:

[0153] Obtain the first ratio between the timestamp information of the first unit of measurement in the first message and the unit time of the first unit of measurement;

[0154] The first ratio is rounded down to obtain the first time value.

[0155] According to one or more embodiments of this disclosure, Example Six provides the method of obtaining a first packet from network traffic as in Example One, including:

[0156] In response to the first packet in the network traffic matching the sampling rule, the first packet is obtained, wherein the sampling rule is used to filter packets for sampling determination.

[0157] According to one or more embodiments of this disclosure, Example 7 provides the security detection of the first message in response to the third information indication, as in Example 1, including:

[0158] In response to the third information being located within the sampling interval, the first message is subjected to security detection.

[0159] According to one or more embodiments of this disclosure, Example 8 provides the sampling interval indication of the first sampling rate in Example 7, wherein the security detection of the first message in response to the third information being located within the sampling interval includes:

[0160] Obtain the first result of the modulo operation on 100 using the third information;

[0161] In response to the first result being less than or equal to the first sampling rate, a security check is performed on the first message.

[0162] According to one or more embodiments of this disclosure, Example Nine provides a method from any of Examples One through Eight, further comprising:

[0163] In response to the third information indicating that no security check is performed on the first message, the first message is transmitted.

[0164] According to one or more embodiments of this disclosure, Example 10 provides a network traffic detection device, comprising:

[0165] The first acquisition module is configured to: acquire the first packet in network traffic;

[0166] The second acquisition module is configured to: acquire third information based on the first information and the second information in the first message; wherein the first information indicates information of the first session corresponding to the first message, the second information indicates time information, and the third information indicates whether to perform security detection on the first message;

[0167] The detection module is configured to perform security detection on the first message in response to the third information indication.

[0168] According to one or more embodiments of this disclosure, Example Eleven provides an electronic device, including:

[0169] Processing device; and

[0170] Storage device, including one or more computer program instructions;

[0171] The one or more computer program instructions are executed by the processing device to perform the network traffic detection method provided in at least one embodiment of the present disclosure.

[0172] According to one or more embodiments of the present disclosure, Example Twelve provides a computer-readable storage medium that non-transitory stores computer-readable instructions, wherein the computer-readable instructions, when executed by a processor, implement the network traffic detection method provided in at least one embodiment of the present disclosure.

[0173] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0174] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0175] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A network traffic detection method, comprising: Retrieve the first packet from network traffic; Based on the first information and the second information in the first message, obtain the third information; wherein, the first information indicates the information of the first session corresponding to the first message, the second information indicates time information, and the third information indicates whether to perform security detection on the first message; In response to the third information instruction, a security check is performed on the first message.

2. The method according to claim 1, wherein, The step of obtaining the third information based on the first and second information in the first message includes: Based on the first information in the first message, obtain a first digest value, and based on the second information in the first message, obtain a first time value; The third information is obtained based on the first summary value and the first time value.

3. The method according to claim 2, wherein, Messages belonging to the first session have the same first digest value, and messages generated within the same unit of time have the same first time value.

4. The method according to claim 2, wherein, The step of obtaining the first digest value based on the first information in the first message includes: The first digest value is obtained by calculating the quintuple information in the first message using the receiving end's scaling hash function.

5. The method according to claim 2, wherein, The step of obtaining the first time value based on the second information in the first message includes: Obtain the first ratio between the timestamp information of the first unit of measurement in the first message and the unit time of the first unit of measurement; The first ratio is rounded down to obtain the first time value.

6. The method according to claim 1, wherein, The acquisition of the first packet in the network traffic includes: In response to the first packet in the network traffic matching the sampling rule, the first packet is obtained, wherein the sampling rule is used to filter packets for sampling determination.

7. The method according to claim 1, wherein, The security inspection of the first message in response to the third information indication includes: In response to the third information being located within the sampling interval, the first message is subjected to security detection.

8. The method according to claim 7, wherein, The sampling interval indicates a first sampling rate, and the security detection of the first message in response to the third information being located within the sampling interval includes: Obtain the first result of the modulo operation on 100 using the third information; In response to the first result being less than or equal to the first sampling rate, a security check is performed on the first message.

9. The method according to any one of claims 1 to 8, further comprising: In response to the third information indicating that no security check is performed on the first message, the first message is transmitted.

10. A network traffic detection device, comprising: The first acquisition module is configured to: acquire the first packet in network traffic; The second acquisition module is configured to: acquire third information based on the first information and the second information in the first message; wherein the first information indicates information of the first session corresponding to the first message, the second information indicates time information, and the third information indicates whether to perform security detection on the first message; The detection module is configured to perform security detection on the first message in response to the third information indication.

11. An electronic device, comprising: Processing device; as well as Storage device, including one or more computer program instructions; The one or more computer program instructions are executed by the processing device to perform the method according to any one of claims 1 to 9.

12. A computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein, The method of any one of claims 1 to 9 is implemented when the computer-readable instructions are executed by a processor.

Images