Edge node network spoofing defense method and system based on XDP
By employing a lightweight network deception defense method using XDP and eBPF technologies on edge node devices, the problem of high resource consumption for low-computing-power devices when defending against high-speed network scanning attacks is solved, achieving efficient and low-cost defense.
Patent Information
- Application Number
- CN202610035303.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-12
- Publication Date
- 2026-04-17
AI Technical Summary
Existing technologies are insufficient to effectively defend against high-speed network scanning attacks on low-computing-power edge node devices. Traditional defense methods are resource-intensive and complex to deploy, and existing deception defense technologies are difficult to operate efficiently on low-computing-power devices.
A lightweight network spoofing defense method based on XDP is adopted. By quickly intercepting and processing data packets in kernel mode, and combining eBPF mapping table for blacklist and whitelist checks and dynamic key management, a spoofing response is generated to deal with complex scanning behavior.
It achieves efficient defense with low resource consumption, dynamically maintains connection status, improves defense performance and effectiveness, and reduces the cost of deception defense.
Smart Images
Figure CN121887491A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, specifically to an edge node network deception defense method and system based on XDP. Background Technology
[0002] With the rapid development of the Internet of Things (IoT) and edge computing, edge nodes (such as network cameras, smart routers, and industrial sensors) have become primary targets of cyberattacks due to their widespread deployment and low computing power. Attackers can use high-speed scanning technologies (such as ZMap and Masscan) to quickly probe all devices on the network, identify open ports and potential vulnerabilities, and then launch targeted attacks. Traditional defense methods (such as firewalls and intrusion detection systems) rely on upper-layer processing of the protocol stack, making them difficult to deal with high-speed scanning attacks, and they also consume a lot of resources and cannot be adapted to the limited computing power of edge nodes. On this basis, while existing deception defense technologies (such as honeypots) can lure attackers, their highly interactive design leads to complex deployment and high resource consumption, making it difficult to run efficiently on low-computing-power devices. When applied to edge devices, they still have some limitations, such as the limited computing resources on edge devices and the difficulty in deployment in environments where the network topology cannot be easily changed. Summary of the Invention
[0003] The technical problem to be solved by this invention is to provide an edge node network spoofing defense method and system based on XDP, which addresses the above-mentioned problems in the prior art. This invention aims to realize a lightweight and low-cost active defense mechanism, which can quickly intercept attacks at the protocol stack layer, and realize the interception and spoofing response of reconnaissance traffic in the kernel mode to reduce the cost of spoofing defense. At the same time, it can dynamically maintain the spoofing state to deal with complex scanning behavior and improve defense performance and effectiveness.
[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: An edge node network spoofing defense method based on XDP includes the following steps: S101 intercepts inbound packets before they enter the kernel protocol stack via the Fast Data Path (XDP). S102, check the blacklist for the message. If the message matches the blacklist, discard the message and exit; otherwise, proceed to step S103. S103, perform a whitelist check on the message. If the message matches the whitelist, send the message into the kernel protocol stack to provide normal service, end and exit; otherwise, jump to step S104. S104. Determine whether the message is the first request message. If it is the first request message, generate a deceptive response message for the message based on the current key stored in the eBPF mapping table, and return the deceptive response message as the response message. Then, exit. Otherwise, determine whether the message meets the high-interaction attack source judgment conditions based on the current key stored in the eBPF mapping table. If it meets the high-interaction attack source judgment conditions, add the message information to the blacklist. If it does not meet the high-interaction attack source judgment conditions, discard the message directly.
[0005] Optionally, after intercepting the inbound packet before it enters the kernel protocol stack via the Fast Data Path (XDP) in step S101, the method further includes extracting the packet's 5-tuple, TCP flag, and acknowledgment number. The 5-tuple includes the protocol, source address, source port number, destination address, and destination port number.
[0006] Optionally, step S102, which involves checking the message against a blacklist, includes matching the message's 5-tuple with a blacklist stored in the eBPF mapping table. Each item in the blacklist also includes a 5-tuple. If the message's 5-tuple matches a 5-tuple in the blacklist, the message is determined to be in the blacklist; otherwise, the message is determined not to be in the blacklist. Step S103, which involves checking the message against a whitelist, includes matching the message's 5-tuple with a whitelist stored in the eBPF mapping table. Each item in the whitelist also includes a 5-tuple. If the message's 5-tuple matches a 5-tuple in the whitelist, the message is determined to be in the whitelist; otherwise, the message is determined not to be in the whitelist.
[0007] Optionally, step S104, which generates a spoofing response message for the message based on the current key stored in the eBPF mapping table, includes: S201, extract the five-tuple of the message, including protocol, source address, source port number, destination address, and destination port number; S202, combine the current key stored in the eBPF mapping table with the five-element combination of the message and calculate the CRC32 check value S1; S203: Use the CRC32 checksum S1 as the sequence number of the spoofing response message and generate a spoofing response message for this message.
[0008] Optionally, step S104, which involves determining whether the message meets the criteria for a high-interaction attack source based on the current key stored in the eBPF mapping table, includes: S301, Combine the current key stored in the eBPF mapping table with the five-element combination of the message and calculate the CRC32 check value S2; S302, if the result of subtracting 1 from the CRC32 checksum S2 and the acknowledgment number of the message are equal, then the message is determined to meet the criteria for identifying a high-interaction attack source; otherwise, the message is determined not to meet the criteria for identifying a high-interaction attack source. Alternatively, step S104, determining whether the message meets the criteria for identifying a high-interaction attack source based on the current key stored in the eBPF mapping table, includes: S401, extract the 5-tuple and acknowledgment number of the message, wherein the 5-tuple includes the protocol, source address, source port number, destination address and destination port number; S402, for each of the multiple keys stored in the eBPF mapping table, including the current key, calculate the CRC32 checksum A by combining each key with the five-element combination of the message. i ; S403, if arbitrarily determine the CRC32 check value A i If the result obtained by subtracting 1 and the acknowledgment number of the message are equal, then the message is determined to meet the criteria for identifying a high-interaction attack source; otherwise, the message is determined not to meet the criteria for identifying a high-interaction attack source.
[0009] Optionally, the current key stored in the eBPF mapping table is a key in a circular array of multiple keys maintained in the eBPF mapping table. The key with a specified index in the circular array is the current key, and the circular array is triggered by a timer to perform a key update operation every t seconds: a new key is generated based on a random number or hash function, the new key overwrites the old key pointed to by the current index, and the current index is updated to the next position in the circular array, so that any key will be overwritten again after being retained in the circular array for n×t seconds, where n is the number of keys in the circular array.
[0010] Optionally, in step S104, determining whether the message is the first request message means judging the TCP flag of the message. If the TCP flag of the message is "SYN", then the message is determined to be the first request message; if the TCP flag of the message is "ACK", then the message is determined not to be the first request message.
[0011] The present invention also provides an XDP-based edge node network spoofing defense system, comprising an interconnected microprocessor and a memory, wherein the microprocessor is programmed or configured to execute the XDP-based edge node network spoofing defense method.
[0012] The present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the XDP-based edge node network spoofing defense method by a processor.
[0013] The present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the XDP-based edge node network spoofing defense method via a processor.
[0014] Compared with the prior art, the present invention can mainly achieve the following beneficial effects: 1. Existing defense technologies typically rely on resource-intensive solutions (such as containerized honeypots and frequently updated host fingerprint databases), which are ill-suited to the low computing power of edge devices. To address the insufficient adaptability of existing defense technologies to low-computing-power edge devices, this invention proposes a lightweight deception defense method. Based on XDP technology, it processes data packets on the kernel-level fast data path XDP, thereby achieving efficient interception and deception response to reconnaissance traffic, significantly reducing resource consumption and enabling it to run on resource-constrained edge devices.
[0015] 2. Existing technologies lack an effective mechanism for dynamically maintaining connection states, which can lead to limitations in defense effectiveness and potential impacts on service availability. This invention, through a dynamic key management mechanism, successfully counters various attack behaviors without storing excessive connection states. The real-time updated key mechanism ensures the flexibility and effectiveness of deception defense, and prevents system crashes due to storing excessive state information. Attached Figure Description
[0016] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.
[0017] Figure 2 This is a schematic diagram illustrating the working principle of the method in an embodiment of the present invention. Detailed Implementation
[0018] This invention aims to solve the problem of efficient defense against high-speed network scanning attacks in existing technologies under low computing power environments. The core innovation of this invention lies in combining the high-efficiency packet processing capabilities of XDP (eXpress Data Path) technology with the dynamic kernel hooking capabilities of eBPF (extended Berkeley Packet Filter) technology. This allows for rapid interception of reconnaissance traffic in kernel mode, and low-resource-consumption network spoofing defense is achieved through dynamic key management. To enable those skilled in the art to better understand the technical solution of this invention, the following detailed description, in conjunction with the accompanying drawings of the embodiments of this invention, will further illustrate the technical solution.
[0019] like Figure 1 As shown, the edge node network spoofing defense method based on XDP in this embodiment includes the following steps: S101 intercepts inbound packets before they enter the kernel protocol stack via the Fast Data Path (XDP). S102, check the blacklist for the message. If the message matches the blacklist, discard the message and exit; otherwise, proceed to step S103. S103, perform a whitelist check on the message. If the message matches the whitelist, send the message into the kernel protocol stack to provide normal service, end and exit; otherwise, jump to step S104. S104. Determine whether the message is the first request message. If it is the first request message, generate a deceptive response message for the message based on the current key stored in the eBPF map, and return the deceptive response message as the response message. Then, exit. Otherwise, determine whether the message meets the high-interaction attack source judgment conditions based on the current key stored in the eBPF map. If it meets the high-interaction attack source judgment conditions, add the message information to the blacklist. If it does not meet the high-interaction attack source judgment conditions, discard the message directly.
[0020] like Figure 2 As shown, for ordinary users, their packets do not match the blacklist but match the whitelist. Therefore, after passing both blacklist and whitelist checks, they enter the normal kernel protocol stack and provide normal service. The response packets for normal service are then returned to the ordinary user after passing through the kernel protocol stack. For attackers, their packets first undergo a blacklist check. The blacklist check filters attacker scanning requests before they enter the kernel protocol stack. Requests that meet the blacklist criteria are discarded before entering the kernel protocol stack, thus optimizing the processing efficiency of the kernel network protocol stack. Packets that do not meet the blacklist criteria undergo a whitelist check. Packets that meet the whitelist criteria are delivered normally to the kernel protocol stack and provide normal service to the requester.
[0021] In step S101 of this embodiment, after intercepting the inbound packet before it enters the kernel protocol stack via the Fast Data Path (XDP), the method further includes extracting the packet's 5-tuple, TCP flags (such as SYN, ACK, etc.), and acknowledgment number Ack_No. The 5-tuple includes the protocol, source address, source port number, destination address, and destination port number, and can be represented as: (Prot, Addr s Port s Addr t Port t ); Where CRC32 represents the CRC32 check function, Prot is the protocol, and Addr... s For source address, Port s For the source port number, Addrt For destination address, Port t The destination port number.
[0022] In this embodiment, step S102 involves checking the message against a blacklist, which includes matching the message's 5-tuple with a blacklist stored in the eBPF mapping table. Each item in the blacklist also includes a 5-tuple. If the message's 5-tuple matches a 5-tuple in the blacklist, the message is determined to be in the blacklist; otherwise, the message is determined not to be in the blacklist.
[0023] In this embodiment, step S103 involves checking the message against a whitelist, which includes matching the message's 5-tuple with a whitelist stored in the eBPF mapping table. Each item in the whitelist also includes a 5-tuple. If the message's 5-tuple matches a 5-tuple in the whitelist, the message is determined to be in the whitelist; otherwise, the message is determined not to be in the whitelist.
[0024] Messages that pass the whitelist check will proceed to step S104. In this embodiment, step S104 involves generating a spoofing response message for the message based on the current key stored in the eBPF mapping table, including: S201, extract the five-tuple of the message, including protocol, source address, source port number, destination address, and destination port number; S202, calculate the CRC32 checksum S1 by combining the current key stored in the eBPF mapping table with the five-element combination of the message. The function expression is as follows: S1=CRC32(Prot, Addr s Port s Addr t Port t , KEY); Where CRC32 represents the CRC32 check function, Prot is the protocol, and Addr... s For source address, Port s For the source port number, Addr t For destination address, Port t The destination port number is KEY, which is the current key stored in the eBPF mapping table. S203: Use the CRC32 checksum S1 as the sequence number of the spoofing response message and generate a spoofing response message for this message.
[0025] As an optional implementation, step S104, which determines whether the message meets the criteria for a high-interaction attack source based on the current key stored in the eBPF mapping table, includes: S301, calculate the CRC32 checksum S2 by combining the current key stored in the eBPF mapping table with the five-element combination of the message. The function expression is as follows: S2=CRC32(Prot, Addr s Port s Addr t Port t , KEY); Where CRC32 represents the CRC32 check function, Prot is the protocol, and Addr... s For source address, Port s For the source port number, Addr t For destination address, Port t The destination port number is KEY, which is the current key stored in the eBPF mapping table. S302. If the result of subtracting 1 from the CRC32 check value S2 and the acknowledgment number of the message are equal, then the message is determined to meet the criteria for judging a high-interaction attack source; otherwise, the message is determined not to meet the criteria for judging a high-interaction attack source.
[0026] As another optional implementation, step S104, which determines whether the message meets the criteria for a high-interaction attack source based on the current key stored in the eBPF mapping table, includes: S401, extract the 5-tuple and acknowledgment number of the message, wherein the 5-tuple includes the protocol, source address, source port number, destination address and destination port number; S402, for each of the multiple keys stored in the eBPF mapping table, including the current key, calculate the CRC32 checksum A by combining each key with the five-element combination of the message. i As an optional implementation, the eBPF mapping table stores multiple keys, including the current key. i Each key includes: Key[0] (previous key), Key[1] (current key), and Key[2] (next key). The CRC32 checksum A is then calculated. i The function expression is: A1=CRC32(Prot, Addr s Port s Addr t Port t , Key[1]); A2=CRC32(Prot, Addr s Port s Addr t Port t , Key[2]); A3=CRC32(Prot, Addr s Port s Addr t Port t , Key[3]); Where CRC32 represents the CRC32 check function, Prot is the protocol, and Addr... s For source address, Port s For the source port number, Addr t For destination address, Port t The destination port number; S403, if arbitrarily determine the CRC32 check value A i If the result of subtracting 1 and the acknowledgment number of the message are equal, then the message is determined to meet the criteria for identifying a high-interaction attack source; otherwise, the message is determined not to meet the criteria. Specifically, the CRC32 checksum A is arbitrarily evaluated. i The result of subtracting 1 and the acknowledgment number of the message being equal can be represented as: Ack_No= A1-1 || Ack_No= A2-1 || Ack_No= A3-1 Here, Ack_No is the acknowledgment number of the message, and "||" represents the OR operation. This design ensures that during key rotation, even if an attacker's message arrives late due to a key update, verification can still be completed using adjacent keys, avoiding connection interruptions caused by key switching. The short-cycle rotation and multi-key coexistence mechanism significantly increases the difficulty for attackers to reverse-engineer the keys. The keys are stored in the eBPF mapping table, directly accessible from kernel mode, avoiding the overhead of switching between user mode and kernel mode, and adapting to the resource limitations of edge devices. The multi-key parallel verification mechanism ensures the continuity of the connection state during key updates, preventing defense failures.
[0027] In this embodiment, the current key stored in the eBPF mapping table is dynamically generated and updated periodically. Through the dynamic key management mechanism, various attack behaviors are successfully dealt with without storing too many connection states. The real-time updated key mechanism ensures the flexibility and protection effect of deception defense, and will not cause system crashes due to storing too much state information. As an optional implementation, the current key stored in the eBPF mapping table in this embodiment is a key in a circular array composed of multiple keys maintained in the eBPF mapping table. The key with a specified index in the circular array is the current key. For example, in this embodiment, the multiple keys in the circular array are specifically three, and the key with specified index 1 is the current key. The three keys are respectively marked as the previous key Key[0], the current key Key[1], and the next key Key[2].
[0028] To achieve dynamic generation and periodic updates of the current key, this embodiment uses a timer to trigger a key update operation every t seconds (e.g., 1 second). A new key is generated based on a random number (preferably a secure random number generated by a cryptographically secure pseudo-random number generator) or a hash function. This new key overwrites the old key pointed to by the current index, updating the current index to the next position in the circular array. This ensures that any key is retained in the circular array for n×t seconds before being overwritten again, where n is the number of keys in the circular array. This method allows the circular array to cyclically replace one key in the order 0→1→2→0. In the case of three keys in the circular array and t = 1 second, each key is retained for 3 seconds before being overwritten again, ensuring a limited key lifespan and preventing long-term exposure. This design ensures that even if an attacker's message arrives late due to a key update delay during key rotation, verification can still be completed using adjacent keys, avoiding connection interruptions caused by key switching.
[0029] In step S104 of this embodiment, determining whether the message is a first-time request message refers to checking the TCP flag of the message. If the TCP flag of the message is "SYN", it is determined that the message is a first-time request message; if the TCP flag of the message is "ACK", it is determined that the message is not a first-time request message. If it is a first-time request message, a spoofing response message is generated for the message based on the current key stored in the eBPF map, and the spoofing response message is returned as the response message, ending the process and exiting. Otherwise, it is determined whether the message meets the high-interaction attack source judgment conditions based on the current key stored in the eBPF map. If it meets the high-interaction attack source judgment conditions, the message information is added to the blacklist; if it does not meet the high-interaction attack source judgment conditions, the message is directly discarded.
[0030] To verify the XDP-based edge node network spoofing defense method of this embodiment, a spoofing defense tool with the same functionality implemented in user space using Python was used as a comparative experiment. The comparative experiment showed that the XDP-based edge node network spoofing defense method of this embodiment is superior to the user-space implementation in both CPU usage and RAM usage.
[0031] In summary, this embodiment's XDP-based edge node network spoofing defense method uses XDP to classify packets before they enter the protocol stack, avoiding excessive consumption of computing resources on edge devices and effectively countering fingerprinting. Furthermore, in scenarios where blacklisted source addresses deploy honeypots in the network, XDP can be used to forward reconnaissance requests to the honeypot at extremely low cost. This XDP-based edge node network spoofing defense method is specifically designed for edge nodes to combat large-scale reconnaissance attacks. The core innovations of this method include a state maintenance mechanism based on dynamic key rotation and multi-key verification, and a spoofing response bypassing the protocol stack. In existing technologies, maintaining connection state relies on the kernel protocol stack, which consumes significant computing resources when dealing with large-scale reconnaissance attacks. In contrast, this embodiment's method, based on XDP, effectively reduces the burden on the kernel protocol stack by inspecting packets before they enter the protocol stack. Moreover, the use of keys prevents attackers from cracking this mechanism. Traditional honeypots rely on user-space protocol stacks to simulate services, resulting in high response latency and high resource consumption. This embodiment constructs response packets at the data link layer using XDP and generates templated payloads by passing key fields to user space via eBPF Map, reducing CPU resource consumption and adapting to the low computing power requirements of edge nodes. In summary, this embodiment addresses the core shortcomings of existing technologies in resource consumption and state maintenance through kernel-level dynamic key rotation and efficient response at the protocol stack level, providing a lightweight and highly reliable proactive deception defense solution for edge nodes. Compared with existing technologies, this embodiment has several significant advantages. First, the state maintenance achieved through key rotation and multi-key verification reduces the computational cost of maintaining connections on edge nodes, especially when dealing with large-scale reconnaissance attacks. Existing honeypots deployed on end devices typically run in user space to simulate fake fingerprints to deceive attackers, leading to higher performance overhead. Second, this embodiment uses dynamic keys and allows users to customize deception response templates, increasing the difficulty for attackers to counter honeypots. Common honeypot products in existing technologies are easily analyzed and countered by attackers using fingerprint analysis. Furthermore, this embodiment demonstrates excellent performance, primarily due to its hierarchical processing capabilities for high and low interaction attacks. For low-interaction reconnaissance attacks with a wide scanning range, we prevent them from entering the kernel protocol stack, thus optimizing the performance of deception defense. On the other hand, for high-interaction reconnaissance attacks, their requests are discarded before entering the kernel protocol stack. Alternatively, they can be forwarded to the high-interaction honeypot at low cost according to user needs, allowing the high-interaction honeypot to focus on handling high-interaction reconnaissance attacks.
[0032] Furthermore, this embodiment also provides an XDP-based edge node network spoofing defense system, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the XDP-based edge node network spoofing defense method. This embodiment also provides a computer-readable storage medium storing a computer program or instructions programmed or configured to execute the XDP-based edge node network spoofing defense method via a processor. This embodiment also provides a computer program product, including a computer program or instructions programmed or configured to execute the XDP-based edge node network spoofing defense method via a processor.
[0033] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0034] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.
Claims
1. A method for defending against spoofing in edge node networks based on XDP, characterized in that, Includes the following steps: S101 intercepts inbound packets before they enter the kernel protocol stack via the Fast Data Path (XDP). S102, perform a blacklist check on the message; if the message matches the blacklist, discard the message and exit. Otherwise, proceed to step S103; S103, perform a whitelist check on the message. If the message matches the whitelist, send the message into the kernel protocol stack to provide normal service, then end and exit. Otherwise, proceed to step S104; S104, determine whether the message is the first request message. If it is the first request message, generate a deception response message for the message based on the current key stored in the eBPF mapping table, and return the deception response message as the response message. End and exit. Otherwise, the message is judged based on the current key stored in the eBPF mapping table to determine whether it meets the criteria for a high-interaction attack source. If it meets the criteria, the message information is added to the blacklist; otherwise, the message is discarded.
2. The edge node network spoofing defense method based on XDP according to claim 1, characterized in that, In step S101, after intercepting the inbound packet before it enters the kernel protocol stack via the Fast Data Path (XDP), the process also includes extracting the packet's 5-tuple, TCP flags, and acknowledgment number. The 5-tuple includes the protocol, source address, source port number, destination address, and destination port number.
3. The edge node network spoofing defense method based on XDP according to claim 2, characterized in that, Step S102, which involves checking the message against a blacklist, includes matching the message's 5-tuple with a blacklist stored in the eBPF mapping table. Each item in the blacklist also includes a 5-tuple. If the message's 5-tuple matches a 5-tuple in the blacklist, the message is determined to be in the blacklist; otherwise, the message is determined not to be in the blacklist. Step S103, which involves checking the message against a whitelist, includes matching the message's 5-tuple with a whitelist stored in the eBPF mapping table. Each item in the whitelist also includes a 5-tuple. If the message's 5-tuple matches a 5-tuple in the whitelist, the message is determined to be in the whitelist; otherwise, the message is determined not to be in the whitelist.
4. The edge node network spoofing defense method based on XDP according to claim 1, characterized in that, Step S104, which generates a spoofing response message for the message based on the current key stored in the eBPF mapping table, includes: S201, extract the five-tuple of the message, including protocol, source address, source port number, destination address, and destination port number; S202, combine the current key stored in the eBPF mapping table with the five-element combination of the message and calculate the CRC32 check value S1; S203: Use the CRC32 checksum S1 as the sequence number of the spoofing response message and generate a spoofing response message for this message.
5. The edge node network spoofing defense method based on XDP according to claim 1, characterized in that, Step S104, which determines whether the message meets the criteria for a high-interaction attack source based on the current key stored in the eBPF mapping table, includes: S301, Combine the current key stored in the eBPF mapping table with the five-element combination of the message and calculate the CRC32 check value S2; S302, if the result of subtracting 1 from the CRC32 checksum S2 and the acknowledgment number of the message are equal, then the message is determined to meet the criteria for identifying a high-interaction attack source; otherwise, the message is determined not to meet the criteria for identifying a high-interaction attack source. Alternatively, step S104, determining whether the message meets the criteria for identifying a high-interaction attack source based on the current key stored in the eBPF mapping table, includes: S401, extract the 5-tuple and acknowledgment number of the message, wherein the 5-tuple includes the protocol, source address, source port number, destination address and destination port number; S402, for each of the multiple keys stored in the eBPF mapping table, including the current key, calculate the CRC32 checksum A by combining each key with the five-element combination of the message. i ; S403, if arbitrarily determine the CRC32 check value A i If the result of subtracting 1 and the acknowledgment number of the message are equal, then the message is determined to meet the criteria for identifying a high-interaction attack source; otherwise, the message is determined not to meet the criteria for identifying a high-interaction attack source.
6. The edge node network spoofing defense method based on XDP according to claim 1, characterized in that, The current key stored in the eBPF mapping table is one of the keys in a circular array of multiple keys maintained in the eBPF mapping table. The key with a specified index in the circular array is the current key, and the circular array is triggered by a timer to perform a key update operation every t seconds: a new key is generated based on a random number or hash function, the new key overwrites the old key pointed to by the current index, and the current index is updated to the next position in the circular array, so that any key will be overwritten again after being retained in the circular array for n×t seconds, where n is the number of keys in the circular array.
7. The edge node network spoofing defense method based on XDP according to claim 1, characterized in that, In step S104, determining whether the packet is the first request packet means checking the TCP flag of the packet. If the TCP flag of the packet is "SYN", then the packet is determined to be the first request packet; if the TCP flag of the packet is "ACK", then the packet is determined not to be the first request packet.
8. An edge node network spoofing defense system based on XDP, comprising interconnected microprocessors and memory, characterized in that, The microprocessor is programmed or configured to execute the XDP-based edge node network deception defense method according to any one of claims 1 to 7.
9. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the XDP-based edge node network deception defense method according to any one of claims 1 to 7 via a processor.
10. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the XDP-based edge node network deception defense method according to any one of claims 1 to 7 via a processor.