Programmable data plane flooding suppression method and system based on near-end strategy optimization

Abstract

The invention provides a programmable data plane flooding suppression method and system based on near-end strategy optimization. The method comprises the following steps: acquiring state parameters of a data plane and reporting the state parameters to a control plane; updating a state space of a near-end strategy optimization PPO intelligent agent in the control plane based on the state parameters of the data plane, selecting an action for finely adjusting the flow monitoring module from a preset action space by the PPO intelligent agent based on the updated state space in each decision period, and issuing the action to the flow monitoring module; wherein the action aims at a dynamic parameter of a traffic supervision module, and a reward function of the PPO intelligent agent is constructed based on a message proportion marked by the traffic supervision module; and the flow monitoring module updates dynamic parameters of the flow monitoring module according to the action issued by the control plane, and the updated flow monitoring module is used for carrying out flooding suppression on the message entering the data plane.

Description

Technical Field

[0001] This invention relates to the field of network traffic policing technology, and in particular to a programmable data plane flood suppression method and system based on near-end policy optimization. Background Technology

[0002] IPv4 is a connectionless protocol that operates at the link layer (such as Ethernet) using packet switching. IPv4 is the core of the Internet and the most widely used version of the Internet Protocol, with IPv6 as its successor. The rapid development of IPv6 networks has brought significant improvements in communication efficiency, but it has also introduced new security threats, among which Neighbor Discovery Protocol (NDP) flooding attacks (a type of DoS attack) are particularly prominent. These attacks consume the CPU, bandwidth, and memory resources of the target device by sending a large number of forged NDP messages (such as Router Advertisements (RA) or Neighbor Solicitations (NS)), leading to network paralysis or severe performance degradation. Traditional defense methods mainly rely on static threshold rules or binary classification detection using artificial intelligence, which suffers from poor dynamism and limited detection range (e.g., only supporting RA or NS message detection), and cannot comprehensively address the diverse flooding behaviors in IPv6 (such as Router Requests (RS), Neighbor Advertisements (NA), or redirect flooding).

[0003] Therefore, there is an urgent need for an adaptive traffic protection mechanism that combines a programmable data plane and intelligent control algorithms to achieve fine-grained attack identification and dynamic resource regulation, thereby improving network security and availability.

[0004] Programmable switch technology, especially implementations based on the P4 (Programming Protocol-independent Packet Processors) language, has provided revolutionary flexibility for network traffic management. P4 allows for custom packet processing logic in the data plane, supports protocol-independent forwarding policies, and overcomes the hardware limitations of traditional Software-Defined Networking (SDN). The core advantage of the P4 language lies in its dynamic configuration capabilities. For example, by implementing the token bucket algorithm through P4's Meter module and combining it with P4's Runtime interface to exchange real-time data with the control plane, network devices can accurately parse IPv6 packet header information (such as ICMPv6 types) and perform priority queue management based on traffic characteristics. The introduction of this technology significantly enhances network adaptability and lays the technical foundation for traffic control in complex environments.

[0005] To understand the current state of technological development, existing literature was searched, compared, and analyzed. The following existing network flooding protection technologies with high relevance to this invention were found: "NDP-FD6: A Multi-Classification Detection Framework for NDP Flooding Behavior in IPv6 Networks," which proposes a multi-classification detection framework based on machine learning and deep learning. This research constructs the first AI-driven multi-classification dataset for five packet types (RA, NS) of the IPv6 Neighbor Discovery Protocol (NDP), and compares the performance of algorithms such as XGBoost and Transformer, achieving a detection accuracy of up to 99%. It also supports fine-grained identification of nine types of flooding behavior, addressing the shortcomings of traditional methods in terms of dynamism and classification capabilities.

[0006] However, while existing network flooding protection technologies can achieve high-precision threat identification, they only operate at the protocol layer and fail to integrate with traffic control modules. Their passive detection mechanisms cannot trigger proactive protection actions, resulting in continuous attacks on network resources and a lack of dynamic suppression capabilities when switch queue congestion worsens.

[0007] Therefore, there is an urgent need for a programmable data plane flood suppression method and system that can link detection and control links, use identification results to drive the control mechanism, and automatically realize a closed-loop method for configuring flood suppression strategies. Summary of the Invention

[0008] In view of this, embodiments of the present invention provide a programmable data plane flood suppression method and system based on near-end strategy optimization to eliminate or improve one or more defects existing in the prior art.

[0009] One aspect of the present invention provides a programmable data plane flood suppression method based on proximal policy optimization (PPO). The method includes the following steps: acquiring state parameters of the data plane and reporting them to the control plane; wherein the state parameters include dynamic parameters of the current traffic policing module and the proportion of packets marked by the traffic policing module, the traffic policing module being located in the data plane; updating the state space of the proximal policy optimization (PPO) agent in the control plane based on the state parameters of the data plane; in each decision cycle, the PPO agent selects an action from a preset action space based on the updated state space for fine-tuning the traffic policing module, and sends the action to the traffic policing module; wherein the action targets the dynamic parameters of the traffic policing module, and the reward function of the PPO agent is constructed based on the proportion of packets marked by the traffic policing module; the traffic policing module updates its dynamic parameters according to the action sent by the control plane, and uses the updated traffic policing module to suppress flooding of packets entering the data plane.

[0010] In some embodiments of the present invention, the state parameters further include the flow rate, number of active flows and flow indicators obtained by parsing and statistically analyzing the data flows entering the data plane, as well as the CPU utilization of the data plane, wherein the flow indicators include queue length and packet loss rate.

[0011] In some embodiments of the present invention, the method further includes a step of parsing the data streams entering the data plane, specifically including: the data plane uses a parser to parse the header of each packet layer by layer according to the protocol specification to obtain key fields including source address, destination address, flow label and hop count limit; performs hash calculation on the key fields to obtain a unique flow ID corresponding to each data stream; establishes flow table entries based on the flow IDs of all data streams; and uses the flow table entries to count traffic rate, number of active flows and traffic metrics.

[0012] In some embodiments of the present invention, the traffic policing module includes a priority queue for policing network traffic, and the method further includes adjusting the priority queue based on key fields or flow table entries obtained by parsing data streams entering the data plane.

[0013] In some embodiments of the present invention, the traffic policing module is based on the dual-priority queue token bucket (trTCM) algorithm. The trTCM algorithm maintains a committed token bucket and a peak token bucket, and marks packets entering the data plane using the committed information rate (CIR), peak information rate (PIR), and associated committed burst size (CBS) and peak burst size (PBS). The dynamic parameters include CIR and PIR. The step of using the updated traffic policing module to flood and suppress packets entering the data plane includes: the committed token bucket continuously generates tokens according to the updated CIR, with a maximum capacity... To commit to the burst size CBS, the peak token bucket continuously generates tokens according to the updated PIR, with a maximum capacity equal to the committed burst size PBS. When the size of a packet entering the data plane is satisfied by both the committed token bucket and the peak token bucket, the packet is marked as green. When the size of a packet entering the data plane is satisfied only by the peak token bucket, the packet is marked as yellow. When the size of a packet entering the data plane is satisfied by neither the peak token bucket nor the committed token bucket, the packet is marked as red. Packets marked as green, yellow, and red are processed according to the set processing rules using the trTCM algorithm to achieve flood suppression.

[0014] In some embodiments of the present invention, when the traffic policing module is based on the trTCM algorithm, the preset action space consists of a series of actions that fine-tune the CIR and / or PIR. The packet ratio division includes the number of packets marked in green and successfully forwarded, the number of packets marked in red but actually belonging to legitimate communication, and the number of packets marked in non-red but actually belonging to attack traffic.

[0015] In some embodiments of the present invention, the traffic policing module is based on the leaky bucket algorithm, which maintains a token leaky bucket. The dynamic parameters include the leaky bucket capacity and the leakage rate of the token leaky bucket. The step of using the updated traffic policing module to suppress flooding of packets entering the data plane includes: marking the packet as green when the size of the packet entering the data plane is satisfied by the token leaky bucket, and marking the packet as red when the size of the packet entering the data plane is not satisfied by the token leaky bucket; and processing the packets marked as green and red according to the leaky bucket algorithm according to the set processing rules to achieve flooding suppression.

[0016] In some embodiments of the present invention, when the traffic monitoring module is based on the leaky bucket algorithm, the preset action space consists of a series of actions that fine-tune the leaky bucket capacity and / or the leakage rate of the token leaky bucket. The packet ratio division includes the number of packets marked in green and successfully forwarded, the number of packets marked in red but actually belonging to legitimate communication, and the number of packets marked in green but actually belonging to attack traffic.

[0017] Corresponding to the above methods, the present invention also provides a programmable data plane flood suppression system based on near-end policy optimization, including a processor, a memory, and a computer program / instructions stored in the memory. The processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the system implements the steps of any of the methods described in the above embodiments.

[0018] In accordance with the above methods, the present invention also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the method as described in any of the above embodiments.

[0019] Corresponding to the above methods, the present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any of the above embodiments.

[0020] The programmable data plane flood suppression method based on near-end policy optimization proposed in this invention can isolate attack traffic in real time by utilizing network traffic policing. It uses the PPO algorithm to dynamically optimize the parameters used for network traffic policing. The PPO algorithm learns the optimal defense strategy by interacting with the network environment, so that the flood suppression process is carried out dynamically. This helps to dynamically respond to traffic bursts or changes and avoid "starvation" or "overload". Using this invention can help improve bandwidth utilization and anti-attack capabilities, and can provide reliable protection for networks with high security requirements.

[0021] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0022] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings: Figure 1 This is a flowchart of a programmable data plane flood suppression method in one embodiment of the present invention.

[0024] Figure 2 This is a diagram of a programmable data plane flood suppression system architecture in one embodiment of the present invention.

[0025] Figure 3 This is a diagram of a programmable data plane flood suppression system architecture in another embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0027] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0028] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0029] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0030] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0031] In summary, existing network flood protection technologies suffer from at least three systemic flaws. First, the detection and control modules operate in isolation, meaning the identification results cannot drive the control mechanisms outlined in two-thirds of the literature, and the closed-loop latency of manual policy configuration is relatively long, creating defensive vulnerabilities. Second, mainstream algorithms are mismatched with attack scenarios; the convergence lag of DQN and the high latency of the diffusion model are both insufficient to meet the requirements of second-level flood suppression. Third, the programmable data plane capabilities are not fully utilized; the deep packet analysis potential of P4 switches (such as IPv4 or IPv6 extension headers and ICMPv6 type field analysis) remains largely idle, and protection strategies remain at a coarse-grained aggregation level at the IP layer, failing to accurately isolate attack flows. These flaws collectively lead to a severe imbalance in link utilization under flood impact, with frequent congestion on high-load paths and idle inefficient link resources, significantly weakening network reliability and service availability.

[0032] The core of this solution lies in using the P4 language to achieve high-performance packet processing and traffic monitoring on the programmable data plane (which can be a programmable switch). Combined with the near-end policy optimization (PPO) reinforcement learning algorithm running on the control plane, the traffic control policy of the data plane is dynamically and intelligently adjusted, thereby ensuring the quality of service for legitimate users while accurately and efficiently resisting various flooding attacks.

[0033] Taking IPv6 networks as an example, in IPv6 flood attack protection scenarios, the application of a programmable data plane can directly solve the bottlenecks in detection and mitigation. The P4 module implements the traffic policing module's functions within the data plane. For instance, a token bucket mechanism with dual-priority queues can be used for network traffic policing, enabling hierarchical labeling of inbound traffic (e.g., distinguishing high / low priority packets based on Committed Information Rate (CIR) and Peak Information Rate (PIR), and combining this with IPv6 packet parsing to identify malicious traffic patterns (such as NDP flooding characteristics). Simultaneously, the data plane feeds back network environment status parameters to the control plane through the P4's runtime interface. The control plane dynamically adjusts the control parameters of the traffic policing module based on the network environment, thus achieving closed-loop control. This integrated solution not only isolates attack traffic in real time but also dynamically optimizes parameters through intelligent algorithms, effectively improving bandwidth utilization and attack resistance, providing reliable protection for IPv6 networks with high security requirements.

[0034] The programmable data plane (P4) is the tool, and the dual-priority queue token bucket is the flow control algorithm. By implementing the dual-priority queue token bucket mechanism through P4, inbound traffic can be hierarchically labeled (e.g., distinguishing high / low priority packets based on Committed Information Rate (CIR) and Peak Information Rate (PIR). In IPv4 and / or IPv6 networks, combining the programmable data plane (P4) with the Proximal Policy Optimization (PPO) algorithm enables dynamic flood attack protection, thereby achieving enhanced security. Through the dual-priority token bucket mechanism and reinforcement learning parameter tuning, intelligent traffic management and attack suppression can be achieved.

[0035] Figure 1 This is a flowchart of a programmable data plane flood suppression method according to an embodiment of the present invention. The method includes the following steps: Step S110: Obtain the status parameters of the data plane and report them to the control plane; wherein, the status parameters include the dynamic parameters of the current traffic monitoring module and the proportion of packets marked by the traffic monitoring module, and the traffic monitoring module is located in the data plane.

[0036] Step S120: Update the state space of the PPO agent in the control plane based on the state parameters of the data plane. In each decision cycle, the PPO agent selects an action from the preset action space for fine-tuning the traffic monitoring module based on the updated state space, and sends the action to the traffic monitoring module. The action is based on the dynamic parameters of the traffic monitoring module, and the reward function of the PPO agent is constructed based on the proportion of packets marked by the traffic monitoring module.

[0037] Step S130: The traffic monitoring module updates its dynamic parameters according to the actions issued by the control plane, and uses the updated traffic monitoring module to suppress flooding of packets entering the data plane.

[0038] The programmable data plane flood suppression method based on near-end policy optimization proposed in this invention utilizes network traffic policing to isolate attack traffic in real time and uses the PPO algorithm to dynamically optimize the parameters used for network traffic policing. The PPO algorithm learns the optimal defense strategy through interaction with the network environment, thus enabling the flood suppression process to proceed dynamically. This helps to dynamically respond to traffic bursts or changes and avoid causing "starvation" or "overload". Using this invention helps to improve bandwidth utilization and anti-attack capabilities, and can provide reliable protection for IPv4 and / or IPv6 networks with high security requirements.

[0039] In some embodiments of the present invention, the state parameters may also include the flow rate, number of active flows and flow indicators obtained by parsing and statistically analyzing the data flow entering the data plane, as well as the CPU utilization of the data plane, wherein the flow indicators include queue length and packet loss rate.

[0040] By employing this embodiment of the invention and using some or all of the above state parameters, and dynamically considering the influencing factors of the network environment, it helps to present the network environment of the data plane to the control plane in real time and comprehensively, thereby indirectly improving the scientificity, accuracy, and rationality of the control plane in traffic monitoring and regulation.

[0041] In some embodiments of the present invention, the method further includes a step of parsing the data streams entering the data plane, specifically including: the data plane uses a parser to parse the header of each packet layer by layer according to the protocol specification to obtain key fields including source address, destination address, flow label and hop count limit; hash calculation is performed on the key fields to obtain a unique flow ID corresponding to each data stream; flow table entries are established based on the flow IDs of all data streams; and flow table entries are used to count traffic rate, number of active flows and traffic metrics.

[0042] By employing this embodiment of the invention, comprehensive message-related information can be obtained by parsing the message header and extension header of each message in the data stream. This comprehensive message-related information helps to perform precise network traffic flooding suppression.

[0043] In some embodiments of the present invention, the traffic monitoring module includes a priority queue for monitoring network traffic, and the method further includes adjusting the priority queue based on key fields or flow table entries obtained by parsing the data stream entering the data plane.

[0044] Using this embodiment of the invention, traffic characteristics, such as ICMPv6 type, can be identified by accurately parsed packet header information, and priority queue management can be performed precisely based on traffic characteristics.

[0045] In some embodiments of the present invention, the traffic policing module is based on the dual-priority queue token bucket (trTCM) algorithm. The trTCM algorithm maintains a commitment token bucket and a peak token bucket, and marks packets entering the data plane by the commitment information rate (CIR) and peak information rate (PIR), as well as the associated commitment burst size (CBS) and peak burst size (PBS). The dynamic parameters include CIR and PIR.

[0046] Accordingly, the step of using the updated traffic policing module to suppress flooding of packets entering the data plane in step S130 may include: (1) the commitment token bucket continuously generates tokens according to the updated CIR, with a maximum capacity of the commitment burst size CBS, and the peak token bucket continuously generates tokens according to the updated PIR, with a maximum capacity of the commitment burst size PBS; (2) when the size of a packet entering the data plane is satisfied by both the commitment token bucket and the peak token bucket, the packet is marked as green; when the size of a packet entering the data plane is satisfied only by the peak token bucket, the packet is marked as yellow; when the size of a packet entering the data plane is not satisfied by either the peak token bucket or the commitment token bucket, the packet is marked as red; (3) when packets marked as green, yellow, and red are processed according to the set processing rules according to the trTCM algorithm, flooding suppression is achieved.

[0047] This invention employs the trTCM algorithm to suppress data plane flooding. By combining it with a near-end strategy optimization algorithm to optimize the dynamic parameters of the trTCM algorithm, it helps to better adapt to dynamic responses to sudden or changing traffic flows, avoiding "starvation" or "overload" caused by parameter rigidity in the trTCM algorithm. Furthermore, combining the programmable data plane with the intelligent decision-making algorithm (PPO algorithm) helps overcome key shortcomings in current protection technologies, such as the disconnect between detection and control, response lag, and inaccurate resource regulation.

[0048] The collaborative protection architecture combining the PPO and trTCM algorithms proposed in this invention breaks through the limitations of traditional static strategies, building upon existing network flood protection mechanisms. By constructing an integrated protection chain of "protocol parsing - traffic classification - dynamic adjustment," it facilitates deep collaboration between the data plane (which can be a P4 programmable switch) and the control plane (which can be the system brain). Experiments have demonstrated that it ultimately achieves the dual optimization goals of millisecond-level attack suppression and service quality assurance, significantly improving the resilience and availability of IPv4 and / or IPv6 networks under high-intensity flood attacks.

[0049] Optionally, the action space can be set as follows: (1) Increase Committed Information Rate (CIR) by 10%: Relax restrictions on compliant traffic. (2) Decrease Committed Information Rate (CIR) by 10%: Tighten restrictions on compliant traffic. (3) Increase Peak Information Rate (PIR) by 10%: Allow larger bursts of traffic. (4) Decrease Peak Information Rate (PIR) by 10%: Strictly limit bursts of traffic. (5) Keep parameters unchanged (No-Op): Maintain stability when the current strategy performs well.

[0050] It should be noted that the above settings for action space and reward function are merely examples, and those skilled in the art can make flexible adjustments according to different actual situations.

[0051] This invention specifically defines the design of the action space and the proportion of messages used to construct the reward function in the PPO algorithm, and provides a specific way to combine the PPO algorithm and the trTCM algorithm. Combining the PPO algorithm and the trTCM algorithm helps to further improve the ability of the trTCM algorithm to cope with sudden changes in network traffic.

[0052] In some embodiments of the present invention, the traffic monitoring module is based on the leaky bucket algorithm, which maintains a token leaky bucket, and the dynamic parameters include the leaky bucket capacity and the leakage rate of the token leaky bucket.

[0053] Accordingly, the step S130, which uses the updated traffic policing module to suppress flooding of packets entering the data plane, may include: marking a packet as green when its size is satisfied by the token leaky bucket, and marking a packet as red when its size is not satisfied by the token leaky bucket; and processing the packets marked as green and red according to the leaky bucket algorithm and the set processing rules to achieve flooding suppression.

[0054] This invention employs a leaky bucket algorithm to suppress data plane flooding. By combining the near-end strategy optimization algorithm with the dynamic parameters in the leaky bucket algorithm, it is possible to further adapt to dynamic responses to sudden or changing traffic flows and avoid "starvation" or "overload" caused by the rigidity of parameters in the leaky bucket algorithm.

[0055] In some embodiments of the present invention, when the traffic monitoring module is based on the leaky bucket algorithm, the preset action space consists of a series of actions that fine-tune the leaky bucket capacity and / or the leakage rate of the token leaky bucket. The packet ratio division includes the number of packets marked in green and successfully forwarded, the number of packets marked in red but actually belonging to legitimate communication, and the number of packets marked in green but actually belonging to attack traffic.

[0056] This invention specifically defines the design of the action space and the proportion of messages used to construct the reward function in the PPO algorithm, and provides a specific way to combine the PPO algorithm and the leaky bucket algorithm. Combining the PPO algorithm and the leaky bucket algorithm helps to further improve the leaky bucket algorithm's ability to cope with sudden changes in network traffic.

[0057] Figure 2This is a diagram of a programmable data plane flood suppression system architecture in one embodiment of the present invention. Network traffic (each flow contains multiple packets) enters the data plane. The packet parser extracts flow features by parsing the header and extension of each packet. After feature extraction, the flow rate is measured by the Meter module. The traffic policing module performs traffic marking and dropping, marking each packet with a color (green, yellow, or red). Green and / or yellow packets are forwarded, and red packets are dropped. This is the path for flood suppression by the data platform. On the other hand, the data platform periodically reports the status parameters of the data platform network environment to the PPO agent of the control platform. The selectable range of these status parameters is flexibly determined by the technicians. Based on the status parameters of the data platform network environment, the PPO agent determines the optimal control parameters for the next stage. These optimal control parameters are for the traffic policing module. For example, when the traffic policing module is based on the trTCM algorithm, the control parameters can refer to CIR and PIR. The PPO agent transmits the optimal control parameters to the traffic policing module through action issuance.

[0058] Figure 3 This is a diagram of a programmable data plane flood suppression system architecture according to another embodiment of the present invention. Figure 3 The illustrated embodiment is compared to Figure 2 A clearer technical implementation path is provided, using an IPv6 network environment as an example.

[0059] First, incoming IPv6 packets are parsed at the data plane to achieve fine-grained traffic identification. For each IPv6 packet entering the P4 programmable switch, the packet parser parses the packet header layer by layer according to the protocol specification. Key extracted fields include the source address, destination address, and flow label in the IPv6 basic header. This information together constitutes the key identifier for identifying a network flow. Optionally, the system can also parse IPv6 extension headers, such as hop limit, to obtain richer traffic characteristics. By hashing these key fields, a unique flow ID can be generated for each flow, and a flow table entry can be established in the P4 switch registers accordingly. This entry is used to collect information such as packet rate and byte rate for each flow, providing accurate data input for upper-layer control plane decision-making.

[0060] The core mechanism for flow control in the data plane is the flow policing module, which can use the Dual Rate Tricolor Marking (trTCM) algorithm specified in RFC 2698. This algorithm marks traffic (packets) using two rates (Committed Information Rate CIR and Peak Information Rate PIR) and two associated burst sizes (Committed Burst Size CBS and Peak Burst Size PBS). The working principle of the trTCM algorithm is explained below.

[0061] The TrTCM algorithm maintains two virtual token buckets for each traffic requiring regulated access: a committed token bucket (C bucket) and a peak token bucket (P bucket). The C bucket continuously generates tokens at a committed information rate (CIR) (bits / second), with a maximum capacity of a committed burst size (CBS) (bits); the P bucket continuously generates tokens at a peak information rate (PIR) (bits / second), with a maximum capacity of a peak burst size (PBS) (bits).

[0062] When a B-bit message arrives, the TrTCM algorithm judges it according to the following logic: First, it checks if there are enough tokens in bucket P (i.e., whether the number of tokens in bucket P is greater than or equal to B). If not, the message is marked in red, usually meaning it will be discarded. If there are enough tokens in bucket P, it checks if there are enough tokens in bucket C (i.e., whether the number of tokens in bucket C is greater than or equal to B). If there are also enough tokens in bucket C, the message is marked in green, indicating that it fully complies with the promised traffic specifications. Then, B tokens are subtracted from both bucket P and bucket C. If there are enough tokens in bucket P but not enough in bucket C, the message is marked in yellow, indicating that its traffic exceeds the promised rate but is within the peak rate allowable. Then, only B tokens are subtracted from bucket P. Through this mechanism, green messages represent compliant traffic with guaranteed service quality, yellow messages represent tolerable burst traffic, and red messages represent excessive traffic that must be limited. During a flood attack, the massive volume of attack packets quickly depletes the tokens in the P and C buckets, causing subsequent attack packets to be marked in red and discarded, thus effectively protecting network resources. It should be noted that the above packet marking rules are merely examples, and those skilled in the art can flexibly adjust them based on actual circumstances.

[0063] In order to continuously and dynamically adjust the dynamic parameters of the dual-rate tri-color labeling (trTCM) algorithm of the traffic policing module during the operation of the data platform, this invention also introduces the PPO reinforcement learning algorithm, the core of which is to learn the optimal defense strategy through interaction with the network environment.

[0064] Optionally, the state, action, and reward functions of the PPO algorithm are designed as follows.

[0065] The state space is defined as a set of vectors that comprehensively reflects the current network security posture. It is constructed from state parameters collected and reported in real time by the data plane. The state space design is as follows: in: Total network ingress traffic rate (Mbps) Green message ratio ( ) Yellow message ratio ( ) Red message ratio ( ) Number of activity flows ( ) Switch CPU utilization ( ) Current CIR (Mbps) Current PIR (Mbps, satisfying) ) The action space defines the set of discrete operations that the PPO agent can execute to adjust the trTCM parameters. The agent selects one action in each decision cycle to fine-tune the flow control strategy. The action space is a discrete finite set. Each action corresponds to: Increase Committed Information Rate (CIR) by 10%. Reduce Committed Information Rate (CIR) by 10% Increase Peak Information Rate (PIR) by 10% Reduce Peak Information Rate (PIR) by 10% Keep parameters unchanged (No-Op) At every decision moment The intelligent agent based on the current action and current parameters Calculate the parameters for the next time step: CIR update rules: PIR update rules: The constraints are as follows: 1. Boundary constraints: CIR must be within the preset range PIR must be within the preset range 2. Logical constraints: The fundamental constraint that CIR ≤ PIR is always satisfied. When reducing PIR, it is necessary to ensure That is, not lower than the minimum allowable value and not lower than CIR. Through this series of refined actions, the PPO agent can gradually adjust the trTCM parameters to the optimal state in a small, rapid manner.

[0066] The design of the reward function is crucial in guiding the PPO algorithm towards its intended convergence. Its goal is to maximize the throughput of normal traffic while minimizing false positives against normal traffic and allowing malicious traffic to pass. The reward function R designed in this invention is defined as follows: The meanings of each variable are as follows: First item, This represents the total number of packets marked as green and successfully forwarded within a statistical period. This is the main positive incentive term in the reward function, encouraging the agent to learn strategies that maximize normal business throughput.

[0067] The second item, This represents the number of legitimate packets that were mistakenly dropped. In actual deployments, the number of packets marked in red but actually belonging to legitimate communication can be estimated through sampling analysis or bypass systems. This item is a penalty item used to prevent overly aggressive defense strategies from causing false positives.

[0068] The third item, This represents the number of malicious packets that were mistakenly forwarded, i.e., packets marked in green or yellow that are actually attack traffic. This is another key penalty item used to punish strategies that fail to effectively identify and limit attacks.

[0069] The fourth item, These are weighting coefficients used to balance the importance of the three objectives. For example, in scenarios with extremely high service quality requirements, the weighting coefficient can be increased. The weight is adjusted to reduce interference with normal traffic.

[0070] By maximizing the cumulative reward using the aforementioned reward function, the PPO algorithm can learn an optimal balance strategy that can effectively suppress attack traffic while protecting legitimate communication to the greatest extent.

[0071] Corresponding to the above method, the present invention also provides a programmable data plane flood suppression system based on near-end strategy optimization. The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0072] Corresponding to the methods described above, the present invention also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the method as described in any of the above embodiments. The computer-readable storage medium may be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0073] Corresponding to the above methods, the present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any of the above embodiments.

[0074] Compared with existing technologies, this invention has significant innovation and advancement in dealing with flooding attacks in IPv6 network environments. Its key features are mainly reflected in its deep adaptability to the IPv6 environment, the innovative application of the dual-rate tri-color labeling (trTCM) algorithm conforming to the RFC 2698 standard, and the use of a more advanced PPO reinforcement learning algorithm to achieve intelligent decision-making.

[0075] In summary, the improvements of this invention compared to the prior art include at least the following: (1) It is designed for the IPv6 network environment. Due to the comprehensive consideration of network environment state parameters in multiple dimensions, it has excellent environmental adaptability. Many existing technologies are still focused on IPv4 or have limited support for IPv6. This invention utilizes the flexibility of the P4 programmable data plane to perform deep and line-rate parsing of IPv6 packets and their extension headers, accurately extracting flow features and effectively overcoming the difficulties of attack tracing and traffic identification in the IPv6 environment. This native IPv6 support capability enables this invention to be directly deployed in modern network infrastructure, providing forward-looking security protection. (2) It combines the classic RFC 2698 dual-rate tri-color marking (trTCM) algorithm with reinforcement learning, which can be used to deal with flooding attacks while dynamically meeting the needs of network traffic changes. Current traditional traffic policing methods, such as static access control lists (ACLs) or fixed-rate token buckets, often fail to balance security and performance when facing flooding attacks in mixed traffic scenarios, and are prone to causing "false positives". The present invention dynamically adjusts the CIR and PIR parameters of trTCM through the PPO algorithm, enabling the traffic marking strategy to adapt to changes in network traffic in real time. This adaptive marking mechanism can distinguish traffic in a refined manner, provide quality of service for normal traffic, and strictly limit the rate of suspicious and attack traffic, ensuring the continuity of core services during attacks. This is a significant improvement over traditional static defense methods. (3) The more advanced and efficient Proximal Policy Optimization (PPO) reinforcement learning algorithm is adopted as the core of intelligent decision-making. Compared with traditional Q-learning or DQN equivalent function learning algorithms, PPO, as a policy gradient method, performs better in dealing with complex action spaces and has better convergence and stability. It enables the defense system to get rid of its dependence on static rules and attack feature databases, and dynamically discover and execute the optimal defense strategy through self-learning and real-time interaction with the environment. This allows it to effectively cope with unknown and variable zero-day flood attacks, demonstrating a high degree of intelligence and adaptability.

[0076] In summary, the adaptive defense method and system for IPv6 network flooding attacks proposed in this invention, based on a programmable data plane and deep reinforcement learning, achieves remarkable technical results by organically combining the high-performance packet processing capabilities of the P4 programmable data plane with the intelligent decision-making capabilities of the PPO reinforcement learning algorithm. This invention not only accurately and efficiently defends against various flooding attacks in IPv6 network environments but also maximizes the quality of service for legitimate users through its adaptive traffic marking mechanism. This solution possesses a high degree of automation and adaptability, effectively addressing evolving network threats and significantly improving the robustness and security of network infrastructure, demonstrating high practical value and broad application prospects.

[0077] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0078] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0079] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0080] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A programmable data plane flooding suppression method based on near-end strategy optimization, characterized in that, include: The status parameters of the data plane are acquired and reported to the control plane; wherein, the status parameters include the dynamic parameters of the current traffic monitoring module and the proportion of packets marked by the traffic monitoring module, the traffic monitoring module being located in the data plane; The state space of the PPO agent in the control plane is optimized based on the state parameters of the data plane. In each decision cycle, the PPO agent selects an action from the preset action space to fine-tune the traffic monitoring module based on the updated state space, and sends the action to the traffic monitoring module. The action is based on the dynamic parameters of the traffic monitoring module, and the reward function of the PPO agent is constructed based on the proportion of packets marked by the traffic monitoring module. The traffic policing module updates its dynamic parameters according to the actions issued by the control plane, and uses the updated traffic policing module to suppress flooding of packets entering the data plane.

2. The method according to claim 1, characterized in that, The status parameters also include the flow rate, number of active flows and flow metrics obtained by parsing and statistically analyzing the data flows entering the data plane, as well as the CPU utilization of the data plane. The flow metrics include queue length and packet loss rate.

3. The method according to claim 1 or 2, characterized in that, The method also includes a step of parsing the data streams entering the data plane, specifically including: the data plane uses a parser to parse the header of each packet layer by layer according to the protocol specification to obtain key fields including source address, destination address, flow label and hop count limit; hash calculation is performed on the key fields to obtain the unique flow ID corresponding to each data stream; flow table entries are established based on the flow IDs of all data streams; and flow table entries are used to count traffic rate, number of active flows and traffic metrics.

4. The method according to claim 3, characterized in that, The traffic monitoring module includes a priority queue for monitoring network traffic, and the method further includes adjusting the priority queue based on key fields or flow table entries obtained by parsing the data streams entering the data plane.

5. The method according to claim 1, characterized in that, The traffic policing module is based on the dual-priority queue token bucket (trTCM) algorithm. The trTCM algorithm maintains a commitment token bucket and a peak token bucket. It marks packets entering the data plane by the commitment information rate (CIR) and peak information rate (PIR), as well as the associated commitment burst size (CBS) and peak burst size (PBS). The dynamic parameters include CIR and PIR. The step of using the updated traffic policing module to suppress flooding of packets entering the data plane includes: The commitment token bucket continuously generates tokens according to the updated CIR, with a maximum capacity of the commitment burst size CBS. The peak token bucket continuously generates tokens according to the updated PIR, with a maximum capacity of the commitment burst size PBS. When the size of a message entering the data plane is satisfied by both the commitment token bucket and the peak token bucket, the message is marked in green. When the size of a message entering the data plane is satisfied by only the peak token bucket, the message is marked in yellow. When the size of a message entering the data plane is not satisfied by either the peak token bucket or the commitment token bucket, the message is marked in red. When messages marked in green, yellow, and red are processed according to the set processing rules using the trTCM algorithm, flood suppression is achieved.

6. The method according to claim 5, characterized in that, When the traffic policing module is based on the trTCM algorithm, the preset action space consists of a series of actions that fine-tune the CIR and / or PIR. The packet ratio division includes the number of packets marked in green and successfully forwarded, the number of packets marked in red but actually belonging to legitimate communication, and the number of packets marked in non-red but actually belonging to attack traffic.

7. The method according to claim 1, characterized in that, The traffic monitoring module is based on the leaky bucket algorithm, which maintains a token leaky bucket. The dynamic parameters include the leaky bucket capacity and the leakage rate of the token leaky bucket. The step of using the updated traffic policing module to suppress flooding of packets entering the data plane includes: marking a packet as green when its size is satisfied by the token leaky bucket, and marking a packet as red when its size is not satisfied by the token leaky bucket; and processing the packets marked as green and red according to the leaky bucket algorithm and the set processing rules to achieve flooding suppression.

8. The method according to claim 7, characterized in that, When the traffic monitoring module is based on the leaky bucket algorithm, the preset action space consists of a series of actions that fine-tune the leaky bucket capacity and / or the leakage rate of the token leaky bucket. The packet ratio division includes the number of packets marked in green and successfully forwarded, the number of packets marked in red but actually belonging to legitimate communication, and the number of packets marked in green but actually belonging to attack traffic.

9. A programmable data plane flood suppression system based on near-end strategy optimization, comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the system implements the steps of the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 8.

Images