Flow detection processing system, method and device, medium and product

Abstract

The invention provides a flow detection processing system, method and device, a medium and a product. The system comprises a routing device, a programmable device and a detection device, the routing device is connected with the programmable device, and the programmable device is connected with the detection device; the routing equipment is used for acquiring a to-be-detected service data stream, performing mirroring processing on the service data stream to obtain a mirrored data stream, and transmitting the mirrored data stream to the programmable equipment; the programmable equipment is used for receiving the mirror image data stream transmitted by the routing equipment, performing feature extraction processing on a mirror image data packet in the mirror image data stream, generating a flow feature of the mirror image data packet, and transmitting the flow feature of the mirror image data packet to the detection equipment; and the detection equipment is used for receiving the flow characteristics of the mirror image data packet transmitted by the programmable equipment and carrying out flow detection processing on the flow characteristics of the mirror image data packet. According to the invention, network attacks can be well prevented.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a traffic detection and processing system, a traffic detection and processing method, a computer device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] Network attacks exist in computer networks, with common types including DDoS (Distributed Denial of Service) attacks and phishing attacks. A DDoS attack involves an attacker sending a large number of network requests to a target, consuming the target's system resources (such as memory, processor, etc.) and bandwidth, ultimately paralyzing the target's network services. A phishing attack involves an attacker impersonating a trusted entity (such as a company, financial institution, or email provider) to send false information to obtain sensitive information (such as usernames, passwords, and e-account numbers). Currently, traffic detection and processing solutions for network attacks have some shortcomings. For example, packet loss is common during traffic detection, leading to incomplete data streams and missed detections, thus failing to effectively prevent network attacks. Summary of the Invention

[0003] This application provides a traffic detection and processing system, method, device, medium, and product that can effectively prevent network attacks.

[0004] On one hand, embodiments of this application provide a traffic detection and processing system, which includes a routing device, a programmable device, and a detection device. The routing device is connected to the programmable device, and the programmable device is connected to the detection device; wherein:

[0005] The routing device is used to acquire the service data stream to be detected, perform mirroring processing on the service data stream to obtain a mirrored data stream, and transmit the mirrored data stream to the programmable device. The service data stream includes service data packets, and the mirrored data stream includes mirrored data packets. The mirrored data packets are obtained after the service data packets have been mirrored.

[0006] A programmable device is used to receive a mirrored data stream transmitted by a routing device, perform feature extraction processing on the mirrored data packets in the mirrored data stream, generate traffic characteristics of the mirrored data packets, and transmit the traffic characteristics of the mirrored data packets to a detection device.

[0007] The detection equipment is used to receive the traffic characteristics of mirrored data packets transmitted by a programmable device and to perform traffic detection processing on the traffic characteristics of the mirrored data packets.

[0008] In this embodiment, the traffic detection and processing system includes a routing device, a programmable device, and a detection device. The routing device acquires the service data stream to be detected, performs mirroring processing on the service data stream to obtain a mirror data stream, and transmits the mirror data stream to the programmable device. In this way, the routing device can guide the service data stream to the programmable device via the mirror data stream, thereby achieving traffic detection processing in a bypass manner and avoiding impact on the normal processing flow of the service data stream. The programmable device performs feature extraction processing on the mirror data packets in the mirror data stream transmitted by the routing device to generate traffic characteristics of the mirror data packets, and transmits the traffic characteristics of the mirror data packets to the detection device, which then performs traffic detection processing on the traffic characteristics of the mirror data packets. Since the traffic characteristics of mirrored data packets are generated through feature extraction, these characteristics can represent important information about the mirrored data packets (i.e., information that helps with traffic detection and processing, such as packet type, source, destination, packet size, etc.). Transmitting these traffic characteristics to the detection device for traffic detection and processing reduces the data volume of the transmitted traffic characteristics compared to the original mirrored data packets. Furthermore, the detection device can quickly process the traffic characteristics of the mirrored data packets without needing to process and analyze information irrelevant to traffic detection in the mirrored data packets. This reduces the packet receiving load on the detection device and improves its traffic detection efficiency. Additionally, the reduced packet receiving load avoids packet loss issues caused by the device's performance bottlenecks, lowering the likelihood of missed detections of network attacks and thus better preventing network attacks.

[0009] On one hand, embodiments of this application provide a traffic detection and processing method applied to a traffic detection and processing system, the traffic detection and processing system including a routing device, a programmable device, and a detection device; the method includes:

[0010] The process involves acquiring the business data stream to be inspected and mirroring it to obtain a mirrored data stream. The business data stream includes business data packets, and the mirrored data stream includes mirrored data packets, which are obtained by mirroring the business data packets.

[0011] Feature extraction processing is performed on the mirrored data packets in the mirrored data stream to generate traffic features of the mirrored data packets;

[0012] Traffic detection processing is performed on the traffic characteristics of the mirrored data packets.

[0013] In this embodiment, the traffic detection processing method can be applied to a traffic detection processing system, which includes a routing device, a programmable device, and a detection device. This method acquires the service data stream to be detected and performs mirroring processing on the service data stream to obtain a mirror data stream. This allows for bypass traffic detection processing of the service data stream through the mirror data stream, avoiding impact on the normal processing flow of the service data stream. Feature extraction processing is performed on the mirror data packets in the mirror data stream to generate traffic features of the mirror data packets, and traffic detection processing is then performed on these traffic features. This approach allows the generation of traffic features from the mirror data packets, which can provide important information about the mirror data packets (i.e., information that aids in traffic detection processing, such as packet type, source, destination, packet size, etc.). The traffic features of the mirror data packets can be transmitted. Since the transmitted traffic features are smaller than the data volume of the mirror data packets, and the detection device can quickly perform traffic detection processing on the traffic features of the mirror data packets without processing and analyzing information unrelated to traffic detection processing in the mirror data packets, the packet receiving load during traffic detection processing can be reduced, thus improving traffic detection efficiency. On the other hand, by reducing the packet receiving load during the traffic detection and processing process and avoiding packet loss due to the load performance bottleneck of the detection equipment, the possibility of missing detection of network attacks is reduced, thus better preventing network attacks.

[0014] On one hand, embodiments of this application provide a computer device, the computer device comprising:

[0015] A processor is used to load and execute computer programs;

[0016] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described flow detection processing method.

[0017] On one hand, embodiments of this application provide a computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed by the above-described traffic detection processing method.

[0018] On one hand, embodiments of this application provide a computer program product, which includes a computer program that, when executed by a processor, implements the above-described traffic detection and processing method. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the architecture of a traffic detection and processing system provided in an embodiment of this application;

[0020] Figure 2 This is a schematic diagram of a packet receiving payload provided in an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of the architecture of an improved traffic detection and processing system provided in an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of a marking information provided in an embodiment of this application;

[0023] Figure 5 This is a schematic diagram of an iterative loop closure process provided in an embodiment of this application;

[0024] Figure 6 This is a schematic diagram of the registers of a first programmable device provided in an embodiment of this application;

[0025] Figure 7 This is an internal processing logic diagram of a first programmable device provided in an embodiment of this application;

[0026] Figure 8 This is a schematic flowchart of a traffic detection and processing method provided in an embodiment of this application;

[0027] Figure 9 This is a schematic flowchart of an improved traffic detection processing scheme provided in an embodiment of this application;

[0028] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0029] This application provides a traffic detection and processing system, which includes: an operator network 100, routing equipment (which may include a core switching device 2001 and an optical splitter switching device 2002), service equipment 3001, and detection equipment 4001. For an example, please refer to... Figure 1 , Figure 1 This is a schematic diagram of the architecture of a traffic detection and processing system provided in this application; as shown below. Figure 1 As shown, the number of operator networks 100 is at least one. The number of routing devices is at least one, and at least one routing device (which may include core switching device 2001 and optical splitting switching device 2002) constitutes a routing device cluster 200. The number of service devices 3001 is at least one, and at least one service device 3001 constitutes a service cluster 300. The number of detection devices 4001 is at least one, and at least one detection device 4001 constitutes a detection device cluster 400; wherein:

[0030] Carrier Network 100 is a network infrastructure established and managed by a carrier to provide Internet services. This carrier network may include, but is not limited to, fixed-line telephone networks, mobile communication networks, and Internet access networks. A carrier refers to an Internet Service Provider (ISP), and Internet services may include, but are not limited to, Internet access services, information services, and value-added services. Carrier Network 100 can also be called a public network and serves as the gateway to the Internet. Computer devices used by an object (such as a user) can access Carrier Network 100 to obtain Internet services. For example, the computer devices used by the object may include, but are not limited to, smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, in-vehicle terminals, smart home appliances, smart voice interaction devices, and aircraft.

[0031] The routing device cluster 200 includes at least one routing device. A routing device is a network device used in a computer network to receive, process, and forward data packets, connect multiple computer networks, and enable communication between different computer networks. Routing devices include, but are not limited to, routers and switches (such as...). Figure 1The core switching device 2001, optical splitter switching device 2002, firewall, access point (AP), gateway, etc., are shown. Routing devices can use routing tables and routing protocols to implement the transmission and routing of data packets in a computer network. A routing table is a data structure used to guide the forwarding process of data packets. The routing table contains routing information, which may include the destination address (the address pointing to the destination of the data packet (such as an IP address)), the next-hop address (the address pointing to the next network device (such as a router, switch, server, etc.) (such as an IP address)), and other attributes related to the path. These other attributes may include, for example, the route type (indicating whether the source of the route is a directly connected route, a static route, or a dynamic route), and the port (indicating the physical or virtual port used to send data packets). Routing selection refers to the process by which the routing device determines the transmission path of data packets. In one implementation, during the routing selection process, the routing device can select a suitable transmission path to transmit data packets according to the routing table. The routing table can be determined according to the routing protocol. Common routing protocols include, but are not limited to, static routing protocols and dynamic routing protocols. Static routing protocols refer to protocols that manually configure routing tables. The transmission path does not change with network changes and requires manual updates and maintenance. Dynamic routing protocols refer to protocols that automatically update routing tables. Common dynamic routing protocols include, but are not limited to, Routing Information Protocol (RIP), Open Shortest Path First (OSPF), and Border Gateway Protocol (BGP). In another implementation, during the routing process, routing devices can select appropriate transmission paths to transmit data packets based on load balancing algorithms. Load balancing algorithms are used to evenly distribute workloads across multiple network devices (such as storage devices and servers). Their purpose is to ensure that each network device (such as storage devices and servers) can handle an appropriate load, avoiding overload or load imbalance. Common load balancing algorithms include: Round Robin, Least Connections, Weighted Round Robin, Least Response Time, Internet Protocol (IP) Hash Algorithm, Binary Distribution Algorithm, and Five-Tuple Distribution Algorithm. Round-robin algorithms involve repeatedly visiting all available network devices in a computer network and distributing network requests to them one by one. Least connections algorithms allocate network requests to the network device (such as a server) with the fewest current connections. Weighted round-robin algorithms assign a weight to each network device based on its processing capacity and distribute network requests accordingly. Least response time algorithms allocate routing requests to the network device with the shortest response time.IP hash algorithms distribute network requests containing the same source address to the same network device. Binary distribution algorithms distribute network requests containing the same binary tuple to the same network device; the binary tuple includes a first element and a second element, which can be any two of the following: source address, destination address, source port number, and destination port number. Five-tuple distribution algorithms distribute network requests containing the same five-tuple to the same network device; the five-tuple may include the source address, destination address, source port number, destination port number, and the protocol type used by the transport layer.

[0032] A data stream refers to the continuous transmission of data packets in a computer network, typically comprising a source, a destination, and a transmission link. The source is the device that generates the data packet (also known as the sender), the destination is the device that receives the data packet (also known as the receiver), and the transmission link includes the path the data packet takes during transmission. A data packet is the basic unit of data transmission in a computer network (and also the carrier of network requests). A data stream may include at least one (usually two or more) data packets. A data packet typically includes a header and a payload. The header contains control and routing information that helps network devices (such as routers and switches) identify, process, and forward data packets. The payload is the actual data portion that is transmitted; that is, the payload contains the data that the data packet actually needs to transmit. The information contained in the packet header (referred to as header information) may include, but is not limited to, at least one of the following: source address (indicating the address of the sender of the data packet (such as an IP address)), destination address (indicating the address of the destination (i.e., the receiver) to which the data packet is to be received (such as an IP address)), source port number (indicating the port used to send the data packet), destination port number (indicating the port used to receive the data packet), data packet length, message length (such as an IP message), protocol type (such as the protocol types used by various network layers in the computer network protocol stack, such as the application layer, transport layer, network layer, link layer, and physical layer), time to live (TTL, indicating the time a data packet can live in a computer network), window size (indicating how much data the sender can send without waiting for the receiver's confirmation), fragment sequence number (referring to the number of the data fragments transmitted when the data packet is fragmented), etc.

[0033] Computer networks are divided into internal networks and public networks. Public networks refer to public network environments, typically the Internet or resources connected to the external environment through specific protocols (such as the Internet Protocol) and access control; for example... Figure 1The operator network 100 shown is the public network. An internal network, also known as a local area network (LAN), is typically built and managed by a specific organization, providing network services such as storage, computing, or resources, and is only accessible to personnel and devices within that organization. An internal network can be divided into at least one subnet based on function, business needs, or security considerations. Each subnet can have its own independent address range (such as IP addresses) and network devices. Figure 1 In the illustrated traffic detection and processing system, the operator network 100 is a public network, while the other clusters together constitute an internal network. The internal network is functionally divided into two subnets: one for the service cluster 300 (used to implement internet service functions), and the other for the detection device cluster 400 (used to implement traffic detection functions). Each subnet has its own independent IP address range and network devices. The routing device cluster 200 can be located outside either of the two subnets within the internal network (i.e., the routing device cluster 200 does not belong to any of the subnets) to connect the various subnets, ensuring that data packets within the internal network can be transmitted quickly and stably between the subnets. Furthermore, the routing device cluster 200 can also receive, forward, and route data packets from the public network, ensuring that data packets from the public network can be transmitted securely and efficiently to the internal network.

[0034] like Figure 1As shown, the routing device cluster 200 may include at least one core switching device 2001 and at least one optical splitter switching device 2002, with one core switching device 2001 corresponding to one optical splitter switching device 2002. Each core switching device 2001 is connected to its corresponding optical splitter switching device 2002. The core switching device 2001 is a high-performance switching device, characterized by high throughput, low latency, high reliability, and complex routing functions. It can achieve rapid forwarding and processing of data packets. High-performance switching devices typically refer to switches in a network capable of processing large numbers of data packets at high speed and low latency. For example, the core switching device 2001 may be a core switch, which is a switch with low latency, high reliability, and high throughput, capable of supporting large-scale data exchange and transmission, ensuring network stability and reliability. The core switching device 2001 undertakes the backbone switching tasks of the intranet network, responsible for transmitting data packets from the public network to the intranet network, and handling data packets and routing requests within the intranet network, ensuring the efficient operation and stability of the intranet network. Optical splitter switch 2002 is a network device capable of distributing data streams (i.e., distributing individual data packets within a data stream to different network devices). For example, optical splitter switch 2001 can be an optical splitter switch, which also has the ability to copy and transmit data streams from one port to multiple network devices. Optical splitter switch 2002 is responsible for distributing data packets received by core switch 2001 from the public network (i.e., operator network 100) to subnets (such as detection device cluster 400) within the internal network. For example, core switch 2001 can provide a mirroring function. Mirroring refers to the function of copying data packets passing through a first specific port (e.g., one or more ports in core switch 2001) to a second specific port (e.g., a port in the corresponding optical splitter switch 2002). Thus, the mirroring function involves specific port pairs. The specific port pair includes a first specific port, which can be a port in core switch 2001, and a second specific port, which can be a port in the corresponding optical splitter switch 2002.In this embodiment, when any port in a core switching device 2001 receives a service data packet requiring traffic detection processing, this receiving port is designated as the first specific port. At this time, the mirroring function in the core switching device 2001 can be used to mirror the service data packet, generating a mirror data packet. A second specific port is then determined in the corresponding optical splitter switching device 2002, and the generated mirror data packet is sent to the corresponding optical splitter switching device 2002 through the second specific port. The optical splitter switching device 2002 then sends the generated mirror data packet to a detection device 4001 in the detection device cluster 400 for traffic detection processing. This allows traffic detection processing to be performed without affecting data flow transmission. Here, mirroring refers to the process of copying the service data packet and generating a mirror data packet. A mirror data packet is a copy created exactly like the service data packet; that is, a mirror data packet is a data packet generated by copying the service data packet, and the mirror data packet retains the content and structure of the service data packet. For example, the mirror data packet usually also includes some additional identification information (such as a mirror identifier) ​​to distinguish the service data packet from the mirror data packet.

[0035] Business cluster 300 operates at least one business system. A business system is a software system containing a set of interrelated software applications and processes designed to support business activities. The at least one business system in business cluster 300 can be independent (i.e., each business system operates independently and manages its own data and business processes) or interconnected (i.e., business systems share data, collaborate on processes, and interact functionally). For example, the at least one business system in business cluster 300 can collaborate to achieve specific business objectives; for instance, business cluster 300 can be a data center, and the at least one business system in the data center can include a financial management system, a human resource management system, a customer relationship management system, a supply chain management system, etc. These business systems can collaborate to achieve the organization's overall business objectives. The organization can include various types of entities such as enterprises, non-profit organizations, government agencies, and schools. A data center is a facility used by an organization to centrally manage, store, and process large amounts of data, responsible for all of the organization's business activities, and typically includes multiple server rooms. Server rooms are rooms used to house large computer equipment and communication equipment, and also include necessary power supply, cooling, and network facilities. The business cluster 300 includes at least one business device 3001, which is used to support and run business systems. For example, the business device 3001 can be a server providing business services. This server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, etc. In addition, the business cluster 300 can also be equipped with other appropriate network devices (such as switches) and software support to ensure smooth communication and collaboration between the various business systems within the business cluster 300.

[0036] The detection equipment cluster 400 includes at least one detection device 4001. Detection device 4001 refers to a network device used for traffic detection processing; for example, detection device 4001 can be an x86 server. Traffic detection processing refers to the process of detecting whether a data stream (such as the business data stream described below) contains network attack behavior. A network attack refers to malicious activities carried out against a target (such as a computer system, object, or organization) through the Internet or computer network. Network attack behavior refers to the actions involved in a network attack, which may include, but is not limited to, at least one of the following: DDoS attack behavior, phishing attack behavior, malware attack behavior, brute-force attack behavior, etc. A DDoS attack behavior refers to an attacker sending a large number of network requests to a target, thereby consuming the target's system resources (such as memory, processor, etc.), bandwidth resources, and other network resources, causing all available network resources of the target to be exhausted, resulting in the paralysis of the target's network services. Common types of DDoS attacks include synchronized flood (SYN flood), acknowledged flood (ACK flood), User Datagram Protocol (UDP) flood, Internet Control Message Protocol (ICMP) flood, and fragmentation attacks. Phishing attacks involve attackers impersonating trusted entities (such as companies, financial institutions, or email providers) to send false information to obtain sensitive information (such as usernames, passwords, and e-account numbers). Malware attacks involve attackers using computer viruses, worms, Trojans, or other malicious software to infiltrate the target's network system, disrupting its functionality or performing malicious actions. Brute-force attacks involve attackers repeatedly attempting to crack various password and username combinations to gain unauthorized access.

[0037] like Figure 1In the architecture of the traffic detection and processing system shown, each operator network 100 is connected to the routing device cluster 200. In one implementation, each operator network 100 is connected to each core switching device 2001 in the routing device cluster 200. The routing device cluster 200 is connected to the service cluster 300. In one implementation, each core switching device 2001 in the routing device cluster 200 is connected to each service device 3001 in the service cluster 300. The routing device cluster 200 is connected to the detection device cluster 400. In one implementation, each optical splitter switch 2002 in the routing device cluster 200 is connected to each detection device 4001 in the detection device cluster 400. The connection in this embodiment refers to establishing a communication connection through a wired network or a wireless network. Establishing a communication connection means that data interaction can be realized. Data interaction refers to the process of data transmission, sharing, or exchange.

[0038] This application provides a traffic detection processing scheme that can be applied to... Figure 1 The flow detection and processing system shown generally includes the following steps 11-14:

[0039] Step 11: An object (such as a user) can use a computer device to request various service requests from a service cluster 300 through at least one operator network 100. This causes the service cluster 300 to bear a large number of service requests, making it a common target for network attacks (such as DDoS attacks). To ensure service security, this embodiment requires traffic detection processing of the service data stream. A service data stream refers to the data stream sent by a computer device to the service cluster 300 through at least one operator network 100. The data packets transmitted in the service data stream are called service data packets. The service data stream includes at least one service data packet, which may include normal data packets corresponding to normal network requests, and may also include abnormal data packets sent by attackers to perform network attacks on the service cluster. When a computer device sends a service data stream to the service cluster 300 through at least one operator network 100, the at least one operator network 100 can send the service data stream to at least one core switching device 2001, which then mirrors the service data stream to obtain a mirrored data stream. The business data stream contains at least one business data packet. Mirroring the business data stream refers to the process of mirroring each business data packet in the business data stream to generate a mirror data packet for each business data packet. Therefore, the mirrored data stream obtained after mirroring includes at least one mirror data packet, and each mirror data packet is obtained by mirroring a business data packet from the business data stream.

[0040] Step 12: After generating a mirrored data stream, at least one core switching device 2001 distributes the mirrored data packets in the mirrored data stream to at least one optical splitter switching device 2002. In one embodiment, any core switching device 2001 sends the mirrored data packets in the mirrored data stream to the corresponding optical splitter switching device 2002 through a specific port pair (including a first specific port and a second specific port) involved in the mirroring function.

[0041] Step 13: After receiving the mirror data packet sent by the core switching device 2001, each optical splitter 2002 can use a binary distribution algorithm to distribute the received mirror data packet to each detection device 4001 in the detection device cluster 400. In one implementation, each detection device 4001 can correspond to at least one binary tuple. When an optical splitter 2002 receives a mirror data packet, it can determine the detection device 4001 corresponding to the binary tuple in the received mirror data packet from at least one detection device 4001 included in the detection device cluster 4000, and send the received mirror data packet to the detection device 4001 corresponding to the binary tuple. In this way, the optical splitter 2002 can allocate mirror data packets with the same binary tuple to the same detection device 4001.

[0042] Step 14: Each detection device 4001 may include at least one processor (Central Processing Unit, CPU). One processor can be used to process a traffic processing queue, which is a queue used to store mirrored data packets that need to be processed. RSS (Receive Side Scaling) is a network performance optimization algorithm that allows data packets (such as mirrored data packets) to be distributed among multiple processors. For example, RSS can be a five-tuple distribution algorithm. In one implementation, each traffic processing queue may correspond to at least one five-tuple. When a detection device 4001 receives a mirrored data packet sent by the optical splitter 2002, it can determine the traffic processing queue corresponding to the five-tuple in the received mirrored data packet based on the five-tuple in the mirrored data packet, and store the mirrored data packet in the corresponding traffic processing queue. Then, the corresponding processor can obtain the traffic characteristics of the mirrored data packet from the corresponding traffic processing queue and perform traffic detection processing on the traffic characteristics of the mirrored data packet, thereby detecting whether there is network attack behavior in the service data stream.

[0043] Based on Figure 1The traffic detection and processing system shown above, during the implementation of steps 11-14 of the traffic detection and processing scheme, revealed the following: Taking detection device 4001 as an x86 server and business cluster 300 as a large-scale data center as an example, the upper limit of the data packet performance (i.e., the upper limit of bandwidth) that a single x86 server can handle is less than 100Gbps (the amount of data transmitted per second is one billion bits), while the bandwidth of a large-scale data center reaches the Tbps level (the amount of data transmitted per second is one trillion bits). Therefore, a large number of detection devices 4001 need to be deployed through horizontal scaling to meet the traffic detection and processing needs of business data streams. However, even with horizontal scaling, the traffic detection and processing system still cannot effectively cope with the ever-increasing threat of network attacks (such as DDoS attacks). This is because the packet receiving load of the processor in the detection device is related to the size of the data stream. When a data stream is a large stream, the performance of a single processor will become a bottleneck, causing packet loss. Here, packet receiving load refers to the workload undertaken by the processor when receiving data packets. An elephant stream refers to a very large data stream that can generate numerous data packets (these packets typically use the same source address and destination port number), and lasts for a long time, consuming a significant amount of network bandwidth. For an example, see [link to example]. Figure 2 The diagram shown illustrates the packet load. When the detection device 4001 distributes mirrored data packets using the five-element distribution algorithm, the mirrored data packets generated by the elephant stream are usually distributed to the same traffic processing queue (such as traffic processing queue 1). Because the processor 1 cannot process the mirrored data packets in traffic processing queue 1 in a timely manner, the storage space of traffic processing queue 1 is filled up, traffic processing queue 1 becomes congested, and packet loss occurs.

[0044] Based on this, this application proposes an improved traffic detection and processing system architecture diagram; the improved traffic detection and processing system includes an operator network 100, routing devices (including a core switching device 2001 and an optical splitter switching device 2002), service devices 3001, detection devices 4001, and programmable devices 5001. The operator network 100 is connected to the core switching device 2001, the core switching device 2001 is connected to the optical splitter switching device 2002, the core switching device 2001 is connected to the service devices 300, the optical splitter switching device 2002 is connected to the programmable devices 5001, and the programmable devices 5001 are connected to the detection devices 4001. For an example, please refer to [link to example]. Figure 3 This is a schematic diagram of the architecture of an improved traffic detection and processing system provided in this application; as shown. Figure 3As shown, the number of operator networks 100 is at least one. The number of routing devices is at least one. The number of service devices 3001 is at least one. The number of detection devices 4001 is at least one. The number of programmable devices 5001 is at least one. In one implementation, at least one routing device (including core switching device 2001 and optical splitting switching device 2002) can constitute a routing device cluster 200, at least one service device 3001 can constitute a service device cluster 300, at least one detection device 4001 can constitute a detection device cluster 400, and at least one programmable device 5001 can constitute a programmable device cluster 500. Figure 3 In the traffic detection and processing system shown: each operator network 100 is connected to a routing device cluster 200. In one implementation, each operator network 100 is connected to each core switching device 2001 in the routing device cluster 200. The routing device cluster 200 is connected to a service cluster 300. In one implementation, each core switching device 2001 in the routing device cluster 200 is connected to each service device 3001 in the service cluster 300. The routing device cluster 200 is connected to a programmable device cluster 500. In one implementation, each optical splitter switch 2002 in the routing device cluster 200 is connected to each programmable device 5001 in the programmable device cluster 500. The programmable device cluster 500 is connected to a detection device cluster 400. In one implementation, each programmable device 5001 in the programmable device cluster 500 is connected to each detection device 4001 in the detection device cluster 400.

[0045] The programmable device 5001 supports both defining the data packet processing method through programming and breaking down the data packet processing into multiple stages (i.e., supporting pipelining technology). This allows for parallel processing of data packets across different functional components, accelerating the overall data packet processing speed. For example, the programmable device 5001 may include a P4 programmable switch. Traditional switches (such as PoE switches and fiber optic switches) have their supported protocols, entry spaces, and forwarding logic fixed at the factory, making them difficult to flexibly support new protocols or tunnel encapsulation. In contrast, the P4 programmable switch allows for defining the data packet processing method through programming, enabling fine-grained control over data packets. Pipelining technology is one of the keys to achieving efficient data packet processing in the P4 programmable switch. P4 is a programming language that can be used to define the data packet processing logic on network devices (such as P4 programmable switches).

[0046] This application proposes an improved traffic detection processing scheme, which can be applied to... Figure 3In the flow detection and processing system shown, the improved flow detection and processing scheme generally includes the following steps 21-24:

[0047] Step 21: Referring to Step 11, the service data stream is identified as the data stream requiring traffic detection processing. When the computer equipment sends the service data stream to the service cluster 300 through at least one operator network 100, the at least one operator network 100 can send the service data stream to at least one core switching device 2001. The at least one core switching device 2001 performs mirroring processing on the service data stream to obtain a mirrored data stream. The service data stream includes at least one service data packet, and the mirrored data stream includes at least one mirrored data packet. Each mirrored data packet is obtained by mirroring one service data packet from the service data stream.

[0048] Step 22: After generating a mirrored data stream, at least one core switching device 2001 distributes the mirrored data packets in the mirrored data stream to at least one optical splitter switching device 2002. In one embodiment, any core switching device 2001 sends the mirrored data packets in the mirrored data stream to the corresponding optical splitter switching device 2002 through a specific port pair (including a first specific port and a second specific port) involved in the mirroring function.

[0049] Step 23: After receiving the mirror data packet sent by the core switching device 2001, each optical splitter 2002 can use a binary group distribution algorithm to distribute the received mirror data packet to each programmable device 5001 in the programmable device cluster 500.

[0050] Step 24: Each programmable device 5001 can perform feature extraction processing on the received mirror data packets, generate traffic characteristics of the mirror data packets, and transmit the traffic characteristics of the mirror data packets to each detection device 4001 in the detection device cluster 400. In this way, the detection device cluster 400 can perform traffic detection processing on the service data stream based on the traffic characteristics of each mirror data packet.

[0051] In the traffic detection processing scheme shown in steps 21-24, the programmable device 5001 in the programmable device cluster 500 performs feature extraction processing on each mirror data packet in the mirror data stream to generate traffic features of each mirror data packet. Compared with the original mirror data packet, the traffic features have a smaller data volume. Thus, using the traffic features of each mirror data packet to replace the original mirror data packet and transmitting it to the detection device cluster 400 can reduce the packet receiving load of the detection device cluster 400, which is beneficial to improving the traffic detection efficiency of the detection device cluster 400, reducing the pressure of horizontal expansion of the detection device cluster 400, and saving costs. On the other hand, the programmable device 5001 in the programmable device cluster 500 can adopt pipeline technology to avoid packet loss during feature extraction processing. Furthermore, since the packet receiving load of the detection device cluster 400 is reduced, the problem of missed detection of network attack behavior due to packet loss during traffic detection processing is solved, which is conducive to better preventing network attacks.

[0052] The following is about Figure 3 The function of each device in the flow detection and processing system shown is explained below:

[0053] 1. Routing equipment (which may include core switching equipment 2001 and optical splitting switching equipment 2002) is used to acquire the service data stream to be detected, perform mirroring processing on the service data stream to obtain a mirrored data stream, and transmit the mirrored data stream to programmable device 5001; the service data stream includes service data packets; the mirrored data stream includes mirrored data packets, which are obtained after the service data packets have been mirrored.

[0054] The business data stream to be detected can be a data stream sent to a protected object. That is, the destination of the business data stream is the protected object, but the source of the business data stream is not restricted. The protected object can be an object vulnerable to network attacks. For example, the protected object can be business cluster 300 (i.e., business device 3001 in business cluster 300). In this case, the business data stream can be a data stream generated by the internal network where the routing device cluster 200 is located during daily business activities. For example, the business data stream to be detected can be a data stream sent by computer devices to business cluster 300 through at least one operator network 100. The data packets transmitted in the business data stream are called business data packets. There must be at least one business data packet in the business data stream. A mirror data stream is a copy made identical to the business data stream. The data packets in the mirror data stream are called mirror data packets. A mirror data packet is a copy made exactly like a business data packet. There must be at least one mirror data packet in the mirror data stream. Since the basic transmission unit of a business data stream is a business data packet, mirroring the business data stream actually involves mirroring each business data packet in the stream, generating a mirror data packet for each business data packet. Thus, the mirrored data stream includes at least one mirror data packet, and a mirror data packet is obtained by mirroring a business data packet. Mirroring refers to the process of copying a business data packet and generating a mirror data packet. In one implementation, a mirror identifier can be added to the mirror data packet to distinguish it from the business data packet. The mirror identifier is a specific identifier used to identify the mirror data packet; this application does not limit the specific form of the mirror identifier.

[0055] For example, the routing device may include a core switching device 2001 and an optical splitter switching device 2002. The core switching device 2001 is connected to the optical splitter switching device 2002, and the optical splitter switching device 2001 is connected to a programmable device 5001. In a feasible implementation, the number of routing devices is at least one, and the at least one routing device can constitute a routing device cluster 200. The routing device cluster 200 may include at least one core switching device 2001 and at least one optical splitter switching device 2002. One core switching device 2001 can correspond to one optical splitter switching device 2002. This application uses the example of a routing device cluster 200 including one core switching device 2001 and one optical splitter switching device 2002 for illustration. The core switching device 2001 can be used to acquire the service data stream to be detected, perform mirroring processing on the service data stream to obtain a mirrored data stream, and transmit the mirrored data stream to the optical splitter switching device 2002. For example, when any port of the core switching device 2001 receives any service data packet from the service data stream to be detected, the mirroring function of the core switching device 2001 can be enabled to mirror the service data packet, generate a mirror data packet corresponding to the service data packet, and send the mirror data packet to the optical splitter switching device 2002. The optical splitter switching device 2002 can be used to receive the mirrored data stream (including at least one mirror data packet) transmitted by the core switching device and transmit the mirrored data stream to the programmable device 5001.

[0056] In one feasible implementation, the number of programmable devices 5001 can be at least one, and at least one programmable device 5001 can constitute a programmable device cluster 500. Each programmable device 5001 includes at least one port; for example, the number of ports on a common P4 programmable switch is approximately between 16 and 256. Each port can correspond to at least one tuple, which includes a first element and a second element. The first element and the second element refer to any two elements among the source address, destination address, source port number, and destination port number; for example, a tuple can include the source address and destination address, or it can include the source port number and destination port number, and so on. Any service data packet in the service data stream is called the first service data packet. After the first service data packet is mirrored, the first mirror data packet in the mirror data stream is obtained. The following uses the first mirrored data packet as an example to illustrate the process by which the routing device (optical splitter 2002) transmits the mirrored data stream to the programmable device 5001. This process includes: the optical splitter 2002 obtaining the tuple contained in the first mirrored data packet, and determining the first port corresponding to the tuple contained in the first mirrored data packet among the ports contained in each programmable device 5001 of the programmable device cluster 500. For example, the optical splitter 2002 may be configured with a port mapping table, which records each port in the programmable device cluster 500 and at least one tuple corresponding to each port. Here, the correspondence between port and tuple means that the port is used to transmit data packets containing the corresponding tuple, and the data packets containing the tuple are transmitted through the corresponding port. The optical splitter switch 2002 can look up the tuple contained in the first mirrored data packet from the port mapping table, and determine the port corresponding to the tuple contained in the first mirrored data packet in the port mapping table as the first port; the optical splitter switch 2002 can transmit the first mirrored data packet to the first programmable device to which the first port belongs through the first port; for example, the tuple contained in the first mirrored data packet includes source address 1 and destination address 1, and at least one tuple corresponding to port 1 contains a tuple including source address 1 and destination address 1, then port 1 can be used as the first port, and the programmable device to which port 1 belongs can be determined as the first programmable device, and the first mirrored data packet can be sent to the programmable device to which port 1 belongs.

[0057] In one feasible embodiment, each port can correspond to a hash value range, where each hash value within that range represents a tuple. When the optical splitter 2002 obtains a tuple contained in the first mirrored data packet, it can determine the hash value obtained by hashing the tuple in the first mirrored data packet as the first hash value, and the port corresponding to the hash value range to which the first hash value belongs as the first port. Hash calculation refers to the process of mapping input data to a fixed-length output data. For example, the port mapping table configured in the optical splitter 2002 can record each port in the programmable device cluster 500 and the corresponding hash value range for each port. The optical splitter 2002 can look up the hash value range to which the first hash value belongs from this port mapping table and determine the port corresponding to the hash value range to which the first hash value belongs as the first port. This helps to speed up the distribution process of the mirrored data packet.

[0058] Therefore, the routing device 2001 can use a bypass (i.e., bypass the transmission path of the service data stream) method to transmit the mirrored data stream to the programmable device 5001, reducing the impact on the transmission of the service data stream. Furthermore, the use of a binary component distribution method to distribute the mirrored data stream can alleviate the network load on a single path.

[0059] 2. Programmable device 5001 is used to receive the mirrored data stream transmitted by the routing device (intermediate optical switching device 2002), perform feature extraction processing on the mirrored data packets in the mirrored data stream, generate traffic characteristics of the mirrored data packets, and transmit the traffic characteristics of the mirrored data packets to the detection device 4001.

[0060] Feature extraction processing refers to the process of extracting traffic features from mirrored data packets. Traffic features are data that represents the characteristics of mirrored data packets and are information that helps in traffic detection and processing. For example, traffic features may include source address, destination address, packet length, IP packet length, data length (payload length), destination port number, source port number, the type of transport layer protocol used, the type of tunneling protocol used, and so on. A tunneling protocol is a technology and protocol used in network communication to encapsulate data packets of one protocol within data packets of another protocol for transmission. For example, the IPv4 (Internet Protocol version 4) tunneling protocol is a tunneling technology that encapsulates IPv4 packets within another protocol for transmission; the IPv6 (Internet Protocol version 6, the next generation of IPv4) tunneling protocol is a tunneling technology that encapsulates IPv6 packets within another protocol for transmission; and GRE (Generic Routing Encapsulation) is a protocol that allows any type of network layer protocol data packet (such as IPv4 packets, IPv6 packets, etc.) to be encapsulated within another network layer protocol for transmission. For example, the packet types of mirrored data packets include, but are not limited to: IPv4 packets (data packets using IPv4 addresses as IP addresses, with an IPv4 address length of 4 bytes, i.e., 32 bits), IPv6 packets (data packets using IPv6 addresses as IP addresses, with an IPv6 address length of 16 bytes, i.e., 128 bits), tunnel packets with IPv4 packets, tunnel packets with IPv6 packets, tunnel packets with GRE packets, TCP packets, UDP packets, and ICMP (Internet Control Message Protocol) packets. The programmable device 5001 has the capability to parse and process various types of mirrored data packets; parsing and processing refers to the process of obtaining the required information from data packets (such as mirrored data packets).

[0061] The following example illustrates how a first mirrored data packet is transmitted from a routing device (optical splitter 2002) to a first programmable device in a programmable device cluster 500, and how the first programmable device receives the first mirrored data packet transmitted by the routing device (optical splitter 2002), performs feature extraction processing on the first mirrored data packet, and generates traffic characteristics of the first mirrored data packet:

[0062] The first programmable device may include a first pipeline architecture, which is a system architecture designed based on pipeline technology. This first pipeline architecture can be used for feature extraction processing. Pipeline technology is a technique that breaks down a task or process into multiple stages (each stage, or execution step), and assigns these stages to different functional components for processing. In other words, the first pipeline architecture can contain multiple different functional components, and can break down the feature extraction process into multiple stages, allowing these functional components to perform feature extraction processing by executing different stages. In one embodiment, when the first programmable device receives a first mirror data packet transmitted by a routing device (optical splitter / switching device 2002), the first programmable device can write the first mirror data packet into its first pipeline architecture and perform feature extraction processing on the first mirror data packet within the first pipeline architecture to generate traffic characteristics of the first mirror data packet.

[0063] Data structures refer to the ways in which data is organized and stored in a computer, such as vectors, arrays, linked lists, stacks, queues, and structures. In one implementation, in a first pipeline architecture, a first programmable device can obtain a predefined first data structure. This predefined first data structure includes at least one feature field. The feature field can be used to identify the meaning of a specific characteristic that represents the mirrored data packet. For example, the feature field is the name that represents a specific attribute of the mirrored data packet, and the feature value of the feature field represents that specific attribute. For instance, the feature field can be a source address field, and the feature value (i.e., the source address) of the source address field is: xxx.xxx.xxx. In a feasible implementation, the predefined first data structure can also contain information such as the length and offset of the feature value of the feature field, which can help to obtain the feature value of the feature field more accurately. For example, a P4 programmable switch typically uses a Packet Header Vector (PHV) to store the result of processing a data packet (such as a mirrored data packet), and the predefined first data structure can be a PHV that stores at least one feature field. The first programmable device can perform feature extraction processing on the first mirror data packet according to a predefined first data structure to obtain the feature values ​​of each feature field in the predefined first data structure. For example, a predefined first data structure and feature extraction processing logic for each feature field in the predefined first data structure can be set in the first programmable device. The first programmable device can perform feature extraction processing on the first mirror data packet according to the feature extraction processing logic for each feature field to obtain the feature values ​​of the corresponding feature fields. The first programmable device can store the extracted feature values ​​of each feature field in the predefined first data structure into the first data structure to obtain an updated first data structure. For example, key-value pairs can be constructed by using feature fields as keys and feature values ​​as values ​​and stored in the updated first data structure. The updated first data structure is then determined as the traffic characteristics of the first mirror data packet.

[0064] If the feature values ​​of each feature field in the predefined first data structure are located in the first image data packet, then the feature extraction process can be a parsing process. That is, the first programmable device can parse the first image data packet according to the predefined first data structure to obtain the feature values ​​of each feature field in the predefined first data structure. The parsing process may include: reading each data field in the image data packet, analyzing the information contained in these data fields, and obtaining the required information from these data fields.

[0065] In one feasible implementation, within the first pipeline architecture, the first programmable device can further acquire a predefined second data structure. This predefined second data structure includes at least one data field, which can be the name of information contained in the data packet. These data fields may include, but are not limited to: source address field, destination address field, source port number field, destination port number field, data packet length field, IP packet length field, protocol type field, TTL field, window size field, fragment sequence number field, etc. The data values ​​of the data fields can be read from the mirrored data packet. The read data values ​​may include, but are not limited to: source address, destination address, source port number, destination port number, data packet length, IP packet length, protocol type used by the transport layer, type of tunneling protocol used, TTL, window size, fragment sequence number, etc. In one feasible implementation, the predefined second data structure may also contain information such as the length and offset of the data field values, which can help to obtain the data field values ​​more accurately. For example, the predefined second data structure may be a PHV storing at least one data field. The first programmable device can parse and process the first image data packet according to a predefined second data structure to obtain the data values ​​of each data field in the predefined second data structure. For example, a predefined second data structure and parsing and processing logic for each data field in the predefined second data structure can be set in the first programmable device. The first programmable device can parse and process the first image data packet according to the parsing and processing logic for each data field to obtain the data value of the corresponding data field. The first programmable device can store the data values ​​of each data field in the parsed predefined second data structure into the second data structure to obtain an updated second data structure. For example, key-value pairs can be constructed by using data fields as keys and data values ​​as values ​​and stored in the updated second data structure.

[0066] In one implementation, when the first programmable device performs feature extraction processing on the first image data packet according to a predefined first data structure, it can determine a target feature field from the predefined first data structure. The target feature field is any feature field in the predefined first data structure. The target feature field is then matched with each data field in the updated second data structure. Field matching refers to detecting whether the target feature field is the same as each data field in the updated second data structure; if they are the same, they match; if they are different, they do not match. If a first data field in the updated second data structure matches the target feature field, the first programmable device can directly determine the data value of the first data field in the updated second data structure as the feature value of the target feature field. If no first data field in the updated second data structure matches the target feature field, the first programmable device can query the second data field associated with the target feature field from the updated second data structure and read the data value of the second data field. The association mentioned here refers to the process of determining the feature value corresponding to the target feature field. If a data value from a certain data field is needed, then that data field is associated with the target feature field. For example, if the target feature field is `key_flag`, its feature value could be `black_window` (this feature value indicates whether a data packet involves network attack behavior). This feature value can be determined based on the data field `window size`. Therefore, `window size` is the second data field associated with `key_flag`. A pre-configured match-action table can be used to transform the data value of the second data field to generate the feature value of the target feature field. For example, the pre-configured match-action table can be used to convert the data value of the second data field `windowsize` into the feature value `black_window` of the `key_flag` field. The match-action table contains the correspondence between rules and actions, specifying which rules to use to transform the data value of the second data field, while the action refers to the operation performed during the transformation process. For example, based on the data value of the second data field "window size", rules for transforming this data value can be matched from the matching action table. These rules could be rules for taking the absolute value, rules for taking the modulo, etc. The transformation process then executes the corresponding action according to the matched rule. For example, taking the absolute value of the data value of the second data field "window size" to obtain the feature value "black_window" of the "key_flag" field, or taking the modulo of the data value of the second data field "window size" to obtain the feature value "black_window" of the "key_flag" field, etc.

[0067] For ease of understanding, the following example of a DDoS attack will be used to illustrate the embodiments of this application. An example of a predefined first data structure (PHV form) provided in this application is shown below:

[0068] header DDoS_key{

[0069] bit <64> flow_label; / / Flow label field

[0070] bit <64> out_dstp_ip_low; / / An address field

[0071] bit <64> out_dstp_ip_high; / / Another address field

[0072] bit <64> in_dstp_ip_low; / / Another address field

[0073] bit <64> in_dstp_ip_high; / / Another address field

[0074] bit <16> raw_len; / / Packet length field

[0075] bit <16> ip_len; / / IP packet length field

[0076] bit <16> data len; / / Packet length field

[0077] bit <16> dport; / / Target port number field

[0078] bit <16> sport; / / Source port number field

[0079] bit <8> tunnel protocol; / / Tunnel protocol type field

[0080] bit <8> protocol; / / Transport layer protocol type field

[0081] bit key_flag / / Feature flag field

[0082] bit <8> type_tcphl; / / Type header field

[0083] bit <8> code_tcpflag; / / Code flag field

[0084] bit<8*9>reserved; / / Reserved field

[0085] };

[0086] In the bit<value> field, the value represents the length of the field (feature field or data field) value (feature value or data value). bit means bit, and one byte consists of 8 bits.

[0087] The value of the `flow_label` field represents transmission configuration information, which may include carrier information (indicating the carrier network sending the first service data packet), data center information (indicating the location of the receiver of the first service data packet), etc. For example, the matching action table may also include the correspondence between the IP address range used by each carrier and the carrier's identifier. Based on the source address in the first mirror data packet, the IP address range to which the source address in the first mirror data packet belongs can be determined from the matching action table, and the carrier's identifier corresponding to that IP address range can be determined as the carrier information contained in the updated first data structure. The matching action table may also include the correspondence between the IP address range used by different data centers and the corresponding data center's identifier. Based on the target address in the first mirror data packet, the IP address range to which the target address in the first mirror data packet belongs can be determined from the matching action table, and the data center's identifier corresponding to that IP address range can be determined as the data center information contained in the updated first data structure.

[0088] `in_dstp_ip` represents the source address when the first service data packet enters the computer network. `out_dstp_ip` represents the destination address when the first service data packet leaves the computer network. When using a tunneling protocol, the first service data packet undergoes tunnel encapsulation and decapsulation during transmission, resulting in `in_dstp_ip` and `out_dstp_ip` being different in the first service data packet (and the first mirror data packet). However, when not using a tunneling protocol, the first service data packet is transmitted directly through the network, and in this case, `in_dstp_ip` and `out_dstp_ip` are the same in the first service data packet (and the first mirror data packet). If the first mirror packet uses an IPv6 address, the value of the in_dstp_ip_low field represents the lower 8 bytes (last 64 bits) of in_dstp_ip, and the value of the out_dstp_ip_low field represents the lower 8 bytes (last 64 bits) of out_dstp_ip; the value of the in_dstp_ip_high field represents the higher 8 bytes (first 64 bits) of in_dstp_ip, and the value of the out_dstp_ip_high field represents the higher 8 bytes (first 64 bits) of out_dstp_ip. If the first mirror packet uses an IPv4 address, the value of the in_dstp_ip_low field represents in_dstp_ip (containing 4 bytes, 32 bits), the value of the out_dstp_ip_low field represents out_dstp_ip (containing 4 bytes, 32 bits), and the values ​​of the in_dstp_ip_high and out_dstp_ip_high fields are empty, which can be represented by placeholders.

[0089] The `raw_len` field indicates the length of the data packet. The `ip_len` field indicates the length of the IP packet. The `datalen` field indicates the length of the payload. The `dport` field indicates the destination port number. The `sport` field indicates the source port number. The `tunnel protocol` field indicates the type of tunneling protocol used. The `protocol` field indicates the type of protocol used at the transport layer (usually including UDP and TCP).

[0090] The `key_flag` field contains detection features designed to counter DDoS attacks. For illustrative purposes, the `key_flag` field can have values ​​including, but not limited to, at least one of the following: `direction`, `black_window`, `black_sport`, `black_ttl`, `frag flag`, `ipv6 flag`, `tunnel_ipv6`, and `tunnel_flag`. Here, `direction` indicates the transmission direction of the first mirrored data packet, which can include both incoming and outgoing directions. For example, the Virtual Local Area Network (VLAN) information in the first mirrored data packet can be obtained. VLAN information includes a VLAN identifier, which identifies the VLAN. By examining the VLAN identifier in the first mirrored data packet, the VLAN to which the first mirrored data packet belongs can be determined, thus aiding in determining the transmission direction of the first mirrored data packet. Similarly, `Flow Label` is a field in the IPv6 protocol used to identify data flows. By examining the `Flow Label` in the first mirrored data packet, the data flow to which the first mirrored data packet belongs can be determined, thus aiding in determining the transmission direction of the first mirrored data packet. `black_window` indicates whether the first mirrored data packet involves a DDoS attack. The value of `black_window` can be determined based on the window size. For example, an action matching table can indicate the window size range when a DDoS attack is involved, and indicate that if the window size in the first mirrored data packet is within this range, then `black_window` is set to 1; otherwise, it is set to 0. `black_sport` indicates whether the first mirrored data packet involves a DDoS attack. This can be determined based on the port. For example, an action matching table can indicate ports used in DDoS attacks. If the port in the first mirrored data packet is a port used in a DDoS attack, then `black_sport` is set to 1; otherwise, it is set to 0. `black_ttl` indicates whether the first mirrored data packet involves a DDoS attack. This can be determined based on the TTL (Time Limit Tolerance). For example, an action matching table can indicate an abnormal TTL (TTL that does not conform to the normal range). If the TTL in the first mirrored data packet is an abnormal TTL, then `black_ttl` is set to 1; otherwise, it is set to 0.The `frag` flag indicates whether the first mirrored packet used fragmented transmission. This can be determined based on the fragment offset. For example, an action matching table can instruct that if the first mirrored packet contains a fragment offset, the action of setting `fragflag` to 1 should be executed; otherwise, the action of setting `fragflag` to 0 should be executed. The `ipv6` flag indicates whether the first mirrored packet used an IPv6 address. For example, an action matching table can instruct that if the obtained IP address of the first mirrored packet is 16 bytes, the action of setting `ipv6` flag to 1 should be executed; otherwise, the action of setting `ipv6` flag to 0 should be executed. `tunnel_ipv6` indicates whether a tunneling protocol was used to transmit IPv6 packets. For example, the action matching table can indicate that if the obtained IP address is 16 bytes and tunneling protocol-related fields (such as `tunnel_flag`) are obtained, then the action of setting `tunnel_ipv6` to 1 is executed; otherwise, the action of setting `tunnel_ipv6` to 0 is executed. `tunnel_flag` indicates whether a tunneling protocol was used. For example, the action matching table can indicate that if the obtained `itunnel protocol` is not empty, then the action of setting `tunnel_flag` to 1 is executed; otherwise, the action of setting `tunnel_flag` to 0 is executed.

[0091] The `type_tcphl` field can represent either the ICMP type or the TCP HL. The ICMP type indicates the ICMP type, while the TCP HL indicates the length of the TCP header. An ICMP type can use different codes to represent different situations or error reasons. The `code_tcpflag` field can represent either the ICMP code or the TCP flag. The ICMP code refers to the ICMP type code, while the TCP flag represents the TCP flag bits. The `reserved` field is a reserved field used to align the length of traffic characteristics to a specified length (e.g., 64 bytes).

[0092] An embodiment of this application provides a predefined second data structure (PHV form) as shown below:

[0093] header Packet{

[0094] bit <64> out_dstp_ip_low; / / An address field

[0095] bit <64> out_dstp_ip_high; / / Another address field

[0096] bit <64> in_dstp_ip_low; / / Another address field

[0097] bit <64> in_dstp_ip_high; / / Another address field

[0098] bit <16> raw_len; / / Packet length field

[0099] bit <16> ip_len; / / IP packet length field

[0100] bit <16> data len; / / The length field of the data packet (payload).

[0101] bit <16> dport; / / Target port number field

[0102] bit <16> sport; / / Source port number field

[0103] bit <8> tunnel protocol; / / Tunnel protocol type field

[0104] bit <8> protocol; / / Transport layer protocol type field

[0105] bit <8> type_tcphl; / / Type header field

[0106] bit <8> code_tcpflag; / / Code flag field

[0107] bit <16> window size; / / Window size field

[0108] bit <8> ttl; / / Time to Live field

[0109] bit <13> fragment offset; / / fragment sequence number field

[0110] }

[0111] In this embodiment, the window size field represents the window size. The ttl field represents the time to live. The fragmentoffset field represents the fragment number. In this embodiment, each field in the first data structure is called a feature field, and the value of a specific field is called a feature value; each field in the second data structure is called a data field, and the value of a data field is called a data value.

[0112] Therefore, in the process of generating traffic characteristics of mirror packets, key information such as protocol type, source address, destination address, and port number can be extracted from the mirror packets. On the other hand, feature encoding (i.e., using 1 or 0 to represent information) can be performed through an action matching table to reduce unnecessary redundant information. As a result, the traffic characteristics of the generated mirror packets are usually more concise and refined, so much so that the traffic characteristics of the mirror packets are often smaller than the data volume of the mirror packets.

[0113] If the first programmable device transmits only one traffic feature to the detection device 4001 in each round, it may cause the detection device 4001 to be unable to detect and analyze network attack behavior (such as DDoS attack behavior) in a timely and effective manner. Therefore, in this application, the first programmable device transmits the traffic features of P mirror data packets together to the detection device 4001 in each round, where P is a positive integer. In order to improve transmission efficiency, P is usually greater than 1. For example, when P = 5, the first programmable device can store the traffic features of the first 4 acquired mirror data packets in the register of the first programmable device until the traffic feature of the 5th mirror data packet is acquired, at which point the traffic features of the first 4 acquired mirror data packets and the traffic feature of the 5th mirror data packet are sent together to the detection device 4001.

[0114] In one feasible embodiment, a counter can be created in the first programmable device. The value recorded by the counter indicates the number of traffic features stored in the registers of the first programmable device. Thus, after the first programmable device acquires the traffic features of the first mirrored data packet, in the first pipeline architecture, the first programmable device can add the traffic features of the first mirrored data packet to the first mirrored data packet to obtain a concatenated data packet corresponding to the first mirrored data packet. Furthermore, the device can truncate the packets in the concatenated data packet corresponding to the first mirrored data packet to obtain a truncated data packet corresponding to the first mirrored data packet. The concatenated data packet corresponding to the first mirrored data packet is formed by adding the traffic features of the first mirrored data packet to the first mirrored data packet, resulting in a data packet formed as a whole from the traffic features of the first mirrored data packet and the first mirrored data packet. Truncation refers to the process of discarding part or all of the data. The truncated data packet corresponding to the first mirrored data packet is the data packet formed after truncating the packets in the concatenated data packet corresponding to the first mirrored data packet. For example, the traffic characteristics of the first mirrored data packet can be added before the message of the first mirrored data packet to obtain a concatenated data packet corresponding to the first mirrored data packet. After truncating the message of the first mirrored data packet in the concatenated data packet corresponding to the first mirrored data packet, the resulting truncated data packet corresponding to the first mirrored data packet may include the header and traffic characteristics of the first mirrored data packet, that is, the data in the message of the first mirrored data packet is discarded. The header of the first mirrored data packet may include a mirror identifier. When the first programmable device detects the mirror identifier from the truncated data packet corresponding to the first mirrored data packet, it can store the traffic characteristics of the first mirrored data packet in the truncated data packet corresponding to the first mirrored data packet into the register of the first programmable device and update the value recorded by the counter of the first programmable device.

[0115] In one feasible implementation, the header of the first mirrored data packet can be an Ethernet header. The traffic characteristics of the first mirrored data packet are added to the Ethernet header to obtain the concatenated data packet corresponding to the first mirrored data packet. Since the Ethernet header is typically 14 bytes long and has an offset of 0, the content outside the first 78 bytes (including the 14-byte Ethernet header and 64-byte traffic characteristics) of the concatenated data packet corresponding to the first mirrored data packet can be truncated to obtain the truncated data packet corresponding to the first mirrored data packet.

[0116] For example, the number of programmable devices 5001 is at least one, and at least one programmable device 5001 constitutes a programmable device cluster 500; the number of detection devices 4001 is at least one, and at least one detection device 4001 constitutes a detection device cluster 400; the first mirror data packet in the mirror data stream is transmitted by the routing device (the optical splitter / switching device 200 in it) to the first programmable device in the programmable device cluster 500; the first programmable device is provided with a first pipeline architecture, the first programmable device includes registers and counters, the registers of the first programmable device are used to store the traffic characteristics of the mirror data packet; the value recorded by the counter of the first programmable device is used to indicate the number of traffic characteristics stored in the register of the first programmable device. In one implementation, the programmable device 5001 transmits the traffic characteristics of the mirror data packet to the detection device 4001, including: in the first pipeline architecture, the first programmable device obtains the remainder between the value recorded by the counter of the first programmable device and a set value P, where P is an integer greater than 1. For example, each time the value recorded by the counter of the first programmable device is updated, the first programmable device can perform a step of obtaining the remainder between the value recorded by the counter and a set value P. For example, after the first programmable device stores the traffic characteristics of the first mirror data packet in the truncated data packet corresponding to the first mirror data packet into the register of the first programmable device and updates the value recorded by the counter of the first programmable device, it can obtain the remainder between the value recorded by the counter and the set value P. It checks whether the remainder is a first value (the first value can be set as needed, for example, the first value is 0). When the remainder is the first value (such as 0), it means that the first programmable device has stored the traffic characteristics of P mirror data packets in the register of the first programmable device in this round. The first programmable device can obtain the traffic characteristics of P mirror data packets from the register of the first programmable device and assemble them into a detection message. The detection message is a message used for traffic detection processing. For example, with P=5, in the first round, when the register of the first programmable device stores the traffic characteristics of the 1st to 5th mirrored data packets, the first programmable device can assemble the traffic characteristics of the 1st to 5th mirrored data packets in its register into a detection message; in the second round, when the register of the first programmable device stores the traffic characteristics of the 6th to 10th mirrored data packets, the first programmable device can assemble the traffic characteristics of the 6th to 10th mirrored data packets in its register into a detection message. The first programmable device can send the detection message to the first detection device in the detection device cluster 400. The first detection device is any detection device selected from at least one detection device by a selection algorithm, which includes any of the following: a random selection algorithm or a load balancing algorithm.The random selection algorithm refers to randomly selecting one detection device 4001 from the detection device cluster 400 as the first detection device. Load balancing algorithms include, but are not limited to: round-robin algorithm, least connections algorithm, weighted round-robin algorithm, least response time algorithm, Internet Protocol (IP) hash algorithm, binary group distribution algorithm, and quinary group distribution algorithm.

[0117] The process of assembling detection messages presents the following challenges: ① The programmable device 5001 uses registers to store traffic characteristics, but the register width is limited. For example, the maximum storage width of a single register is 32 bits or 64 bits, which presents storage challenges. The depth of a single register defines how many entries can be stored, and the maximum storage width of a single register defines how many bits of data can be stored in each entry. ② In a single data packet processing cycle, only one address can be read or written to a single register. However, the length of the traffic characteristic designed in this application is 64 bytes (i.e., 512 bits). This means that in a single data packet processing cycle, it is impossible to store a traffic characteristic in a single register or to read multiple traffic characteristics simultaneously, which presents read / write challenges. Based on the aforementioned challenges, this application proposes the following design: The programmable device 5001 may contain N registers. In one implementation, N can be the ratio between the length of the traffic feature (such as the length of the traffic feature of the first mirrored data packet) and the maximum storage bit width of a single register. For example, if the length of the traffic feature is 512 bits and the maximum storage bit width of a single register is 32 bits, the programmable device 5001 may contain 16 registers. In another implementation, N may also be greater than the ratio between the length of the traffic feature and the maximum storage bit width of a single register. For example, if the length of the traffic feature is 512 bits and the maximum storage bit width of a single register is 32 bits, the ratio is 16, but the programmable device 5001 may contain 18 registers. Illustratively, the depth of each register may be 256, but this application does not limit the depth of each register. Schematic illustration: Storing the traffic characteristics of the first mirrored data packet in the truncated data packet corresponding to the first mirrored data packet into the registers of the first programmable device includes: obtaining the traffic characteristics of the first mirrored data packet from the truncated data packet corresponding to the first mirrored data packet, and splitting the traffic characteristics of the first mirrored data packet into N feature data, the length of each feature data being equal to the maximum storage bit width of a single register of the first programmable device. Feature data refers to the data obtained by splitting the traffic characteristics of the first mirrored data packet. The N feature data are stored in N registers of the first programmable device respectively, with each feature data stored in one register. In this way, in one data packet processing cycle, N feature data can be read from the N registers of the first programmable device simultaneously, and these N feature data are combined to form the traffic characteristics of the first programmable device.

[0118] The first programmable device expects to read the traffic characteristics of P mirror data packets from its registers and transmit them in one round whenever enough traffic characteristics of P mirror data packets are cached. However, due to pipeline architecture limitations, only one traffic characteristic can be obtained by reading and writing to each of the N registers of the first programmable device once in a single data packet processing cycle. Therefore, to obtain the traffic characteristics of P mirror data packets from the registers of the first programmable device and assemble them into a detection message, this application designs an iterative loopback process. The iterative loopback process includes P loopback processes, which include: in the current loopback process (e.g., the i-th loopback process), reading a traffic characteristic from the registers of the first programmable device, adding the read traffic characteristic to the loopback data packet sent back to the first programmable device in the (i-1)-th loopback process, and using the added loopback data packet to continue executing the next loopback process (e.g., the i+1-th loopback process), and repeating the loopback process P times. The final loopback data packet can contain the traffic characteristics of P mirror data packets. The loopback data packet refers to the data packet that has undergone loopback processing and carries a loopback identifier.

[0119] In one implementation, the register of the first programmable device may contain traffic characteristics of P mirrored data packets. The first programmable device retrieves the traffic characteristics of the P mirrored data packets from its register and assembles them into a detection message. This includes: in a first pipeline architecture, the first programmable device modifies the truncated data packet corresponding to the Pth mirrored data packet among the P mirrored data packets to generate a loopback data packet, and sends the loopback data packet back to the first programmable device through its loopback port. In another implementation, a loopback network interface of the first programmable device can be obtained by setting certain network interfaces of the first programmable device to loopback mode. During the process of setting to loopback mode, it is necessary to additionally configure the port associated with the loopback network interface. This port associated with the loopback network interface is called the loopback port, which facilitates the management of the data flow of the loopback network interface and more precisely controls the transmission path of the loopback data packet. The P mirror data packets that undergo iterative loopback processing can refer to mirror data packets whose flow characteristics are sequentially stored in the register of the first programmable device. For example, after the first programmable device stores the flow characteristics of the first mirror data packet in the truncated data packet corresponding to the first mirror data packet into the register of the first programmable device and updates the value recorded by the counter of the first programmable device, if it is detected that the remainder between the value recorded by the counter of the first programmable device and the set value P is the first value (such as 0), then the first mirror data packet is the Pth mirror data packet. The P-1 mirror data packets other than the first mirror data packet in the P mirror data packets are the P-1 mirror data packets in the register of the first programmable device whose flow characteristics are sequentially stored before the flow characteristics of the first mirror data packet. In one feasible implementation, a first programmable device modifies a truncated data packet corresponding to the Pth mirror data packet among P mirror data packets to generate a loopback data packet. This includes: the first programmable device deleting traffic features from the truncated data packet corresponding to the Pth mirror data packet to obtain a deleted data packet. In one implementation, when the traffic features in the truncated data packet corresponding to the Pth mirror data packet are stored in the register of the first programmable device, the traffic features can be deleted from the truncated data packet corresponding to the Pth mirror data packet. A deleted data packet refers to the data packet formed after deleting the traffic features from the truncated data packet corresponding to the Pth mirror data packet. The first programmable device can add marking information to the deleted data packet to obtain a loopback data packet; the marking information includes one or more of a loopback identifier, packet sequence number, and read index. The loopback identifier is used to identify that a data packet is a loopback data packet, and the form of the loopback identifier is not limited.The packet sequence number indicates the current round number. For example, if P = 5, during the first round of acquiring traffic characteristics for the 1st to 5th mirror packets, the packet sequence number in the loopback packet is equal to 1. During the second round of acquiring traffic characteristics for the 6th to 10th mirror packets, the packet sequence number in the loopback packet is equal to 2. The read index indicates the number of traffic characteristics already included in the loopback packet. See also. Figure 4 The diagram illustrates the tagging information. A loopback identifier can be added to the packet type. For example, during the process of adding tagging information to a deleted packet, the mirror identifier in the deleted packet can be replaced with the loopback identifier. For instance, the length of the loopback identifier, the packet sequence number, and the read index in the tagging information can all be 1 bit. Since the loopback identifier can be detected from the loopback packet, the first programmable device can input the loopback packet into its second pipeline architecture. The second pipeline architecture in the first programmable device is also a system architecture designed based on pipeline technology. The second pipeline architecture is used for iterative loopback processing; that is, it can include multiple different functional components, and the iterative loopback processing can be divided into multiple stages, allowing these functional components to implement the iterative loopback processing process by executing different stages. Thus, the first programmable device can sequentially read the flow characteristics of P mirror packets from its registers according to the storage order of the P mirror packets in the registers, and use the flow characteristics of the sequentially read P mirror packets in the second pipeline architecture to perform iterative loopback processing on the loopback packet, generating a detection message.

[0120] The iterative loopback processing includes P loopback processes. The process of the i-th loopback process is described below. The i-th loopback process includes: In the second pipeline architecture, the first programmable device can obtain the loopback data packet sent back during the (i-1)-th loopback process; i is a positive integer less than or equal to P, and this loopback data packet is sent back to the first programmable device through its loopback port. The first programmable device concatenates the traffic characteristics of the i-th mirror data packet from the P mirror data packets to the message in the loopback data packet, obtaining the concatenated loopback data packet. If i < P, the concatenated loopback data packet is sent back to the first programmable device through its loopback port; if i = P, the message in the concatenated loopback data packet is identified as a detection message. Here, the concatenated loopback data packet refers to the data packet formed by concatenating the traffic characteristics of the i-th mirror data packet to the message in the loopback data packet, and combining the traffic characteristics of the i-th mirror data packet with the loopback data packet as a whole. In one implementation, after concatenating the traffic characteristics of the i-th mirror packet among P mirror packets to the message in the loopback packet, the read index in the loopback packet can be incremented by 1, so that the read index in the loopback packet is i. The read index in the loopback packet can be used to determine whether i is equal to P.

[0121] See Figure 5 The diagram illustrates the iterative loopback process. When i = 1, the loopback data packet sent back during the 0th loopback process (i.e., the deleted data packet with added tag information) does not carry traffic characteristics. The traffic characteristics (such as...) of the first mirror data packet out of the P mirror data packets can be obtained from the register of the first programmable device. Figure 5 The traffic feature 1) is concatenated to the loopback data packet and sent back to the first programmable device through the loopback port; when i=2, the loopback data packet sent back during the first loopback processing carries one traffic feature, and the traffic feature of the second mirror data packet among the P mirror data packets can be obtained from the register of the first programmable device (e.g., the ... port; when i=2, the loopback data packet sent back during the first loopback processing carries one traffic feature, and the traffic feature of the second mirror data packet among the P mirror data packets Figure 5 The traffic characteristics 2) are concatenated to the loopback data packet and sent back to the first programmable device through the loopback port; and so on. When i = P, the loopback data packet sent back during the P-1th loopback process carries P-1 traffic characteristics, and the traffic characteristics of the Pth mirror data packet in the P mirror data packets can be obtained from the loopback data packet (such as the traffic characteristics of the Pth mirror data packet in the P mirror data packets). Figure 5 The traffic characteristics P in the image data packet are concatenated to the message of the loopback data packet. At this time, the message in the loopback data packet is actually a detection message assembled from the traffic characteristics of P image data packets.

[0122] The following example illustrates the process of iterative loop closure. Please refer to [example example]. Figure 6 The diagram shows a schematic of the registers of the first programmable device. The first programmable device contains 16 registers, each with a depth of 256. Each register can store 32 bits of data from a traffic feature. For example, register 0 can store [31:0] data from the traffic feature, register 1 can store [63:32] data from the traffic feature, ..., register 15 can store [255:224] data from the traffic feature. Thus, a traffic feature can be assembled using the feature data stored at the same address in the 16 registers. In this embodiment, a read pointer (read_addr) can be set to indicate which address the feature data should be read from. The read pointer increments by 1 each time a traffic feature of a mirrored data packet is read. During iterative loopback processing, the first programmable device can read the feature data corresponding to the address indicated by the read pointer from its 16 registers during the current loopback process. This 16 read feature data are used to construct a flow feature, which is then appended to the loopback data packet. The read pointer is then incremented by 1. When executing the next loopback process, feature data at the next address can be read from the 16 registers to assemble the flow feature. Additionally, a write pointer (write_ptr) can be set to indicate which address the current flow feature should be written to. The write pointer increments by 1 each time a flow feature of a mirrored data packet is stored. When the write pointer is 255, it will increment to 0, and the feature data previously stored at address 0 will be overwritten (i.e., replaced) by subsequent write instructions.

[0123] Although a larger P value is more beneficial to downstream testing equipment, as the number of loopbacks increases, the loopback data packets become longer, and the bandwidth occupied by the loopback port also increases. When it reaches a certain level, it may cause packet loss on the loopback port. Therefore, it is necessary to set an appropriate P value, which can be determined based on actual experimental data.

[0124] The data packets received by the detection device 4001 mainly include two types: one is detection data packets (data packets used for traffic detection processing), and the other is packets related to IP forwarding, such as ARP (Address Resolution Protocol) request packets. ARP request packets are network protocol packets used to convert IP addresses to MAC addresses (physical addresses). When a device (device A) needs to send data to another device (device B), device A sends an ARP request packet to the network to request the MAC address of device B. After receiving the request, device B sends an ARP request response packet to reply with its own MAC address, thus enabling device A to send data to device B. In one embodiment, the first programmable device can encapsulate the detection message header according to the negotiated transmission protocol to obtain a detection data packet, and set a loopback completion flag in the detection data packet. When the first programmable device detects that the set detection data packet contains a loopback completion flag, it can send the set detection data packet to the first detection device. The loopback completion flag is used to identify the detection data packet, but its form is not limited. In one implementation, setting a loopback completion identifier in the detection data packet includes replacing the loopback identifier in the detection data packet with a loopback completion identifier. The negotiated transmission protocol is a transmission protocol for traffic detection processing obtained through negotiation between the first programmable device and the first detection device. For example, the negotiated transmission protocol can be the UDP protocol, which has characteristics such as low latency, high efficiency, and simplicity, thus accelerating the efficiency of traffic detection processing. Furthermore, negotiating the transmission protocol allows the detection device cluster 400 to quickly determine whether a received data packet is a detection data packet, further accelerating the efficiency of traffic detection processing. In one embodiment, the first programmable device sends the configured detection data packet to the first detection device, including: sending the detection data packet back to the first programmable device through its loopback port; and when the first programmable device detects the loopback completion identifier in the detection data packet, it sends the detection data packet to the first detection device.

[0125] In P4 programmable switches, the pipelined architecture typically includes two phases: the Ingress phase (receive phase) and the Egress phase (transmit phase). The Ingress phase processes data packets received from the network, while the Egress phase processes data packets transmitted from the network. The Ingress phase can utilize three programmable modules (one functional unit): IngressParser, Ingress, and IngressDeparser. The IngressParser module (receive parsing module) parses the data packets received from the network and identifies the packet type. The Ingress module (receive processing module) determines the processing logic for the data packet based on its packet type and further processes the packet according to the determined processing logic. The IngressDeparser module (receive deparser module) reassembles the processed data packets into their original (or specified) format for transmission to the next programmable module. The Egress phase can utilize three programmable modules: EgressParser, Egress, and EgressDeparser. The EgressParser module (send parsing module) parses data packets sent from the network and identifies the packet type. The Egress module (send processing module) determines the processing logic for the data packet based on its packet type and further processes the packet according to the determined processing logic. The EgressDeparser module (send deparser module) reassembles the processed data packets into their original (or specified) format for transmission. These six programmable modules—IngressParser, Ingress, IngressDeparser, EgressParser, Egress, and EgressDeparser—can be shared across multiple pipeline architectures, meaning they can be used in different pipeline architectures. Additionally, the P4 programmable switch includes a PacketRecirEngine, which handles the cyclical flow of data packets, allowing them to pass through multiple stages within the P4 programmable switch.

[0126] The following section uses a P4 programmable switch as the first programmable device to describe the first and second pipeline architectures in detail. (See also...) Figure 7 The diagram shows the internal processing logic of the first programmable device. The first programmable device can be accessed through multiple ports (such as...). Figure 7 The system (ports 0, 1, ..., 16, and the loopback port) receives arbitrary data packets. These packets can be mirrored data packets distributed by the optical splitter / switcher 2002, or loopback or detection data packets sent back to the first programmable device via the loopback port. These arbitrary data packets can be sent to the IngressParser module in the first programmable device, which can then execute... Figure 7 The step of selecting a port based on the type involves identifying the packet type of any data packet. In one implementation, identifying the packet type of any data packet includes: obtaining the type identifier of the arbitrary data packet. This type identifier may include a mirror identifier (representing a mirror data packet), a loopback identifier (representing a loopback data packet), or a loopback completion identifier (representing a detection data packet). If the type identifier of the arbitrary data packet is a mirror identifier, the IngressParser module in the first programmable device can input the arbitrary data packet into the first pipeline architecture of the first programmable device. If the type identifier of the arbitrary data packet is a loopback identifier, the arbitrary data packet can be input into the second pipeline architecture of the first programmable device. If the type identifier of the arbitrary data packet is a loopback completion identifier, the arbitrary data packet can be directly sent to the detection device cluster 400.

[0127] Taking an arbitrary data packet as the first mirror data packet, and the first mirror data packet being input into a first programmable device in a first pipeline architecture as an example: In the first pipeline architecture, the IngressParser module can parse the first mirror data packet according to a predefined second data structure, obtain the data values ​​of each data field in the predefined second data structure, and store the parsed data values ​​of each data field in the predefined second data structure into the corresponding data fields, thus obtaining the updated second data structure; the IngressParser module can send the packet type of the first mirror data packet to the Ingress module, and the Ingress module can determine whether to continue feature extraction processing on the first mirror data packet based on the packet type, thereby obtaining the traffic characteristics of the first mirror data packet, i.e. Figure 7 The operations performed by pipe1Ingress (first receiving and processing module) in the above are as follows: The IngressDeparser module can reassemble the first mirror data packet processed by the Ingress module into a first mirror data packet, and add the traffic characteristics of the first mirror data packet to the first mirror data packet to obtain the concatenated data packet corresponding to the first mirror data packet; the concatenated data packet corresponding to the first mirror data packet can include a concatenation identifier, which is used to identify the concatenated data packet corresponding to the first mirror data packet. This application does not limit the form of the concatenation identifier. The IngressDeparser module can send the concatenated data packet corresponding to the first mirror data packet to the EgressParser module; the EgressParser module can obtain the packet type of the concatenated data packet corresponding to the first mirror data packet based on the concatenation identifier contained in the concatenated data packet corresponding to the first mirror data packet, and send the packet type of the concatenated data packet corresponding to the first mirror data packet to the Egress module; the Egress module can decide to truncate the message in the first mirror data packet in the concatenated data packet corresponding to the first mirror data packet according to the packet type of the concatenated data packet corresponding to the first mirror data packet, to obtain the truncated data packet corresponding to the first mirror data packet, that is... Figure 7 The operations performed by pipe1 Egress (the first sending processing module) are described. The truncation process can be implemented using the mirror module, which is further divided into Ingress to Egress Mirror and Egress to Egress Mirror. The Ingress to Egress Mirror module can only mirror packets entering the Ingress stage, while the Egress to Egress Mirror module can mirror packets processed after the Ingress stage. Therefore, the Egress to Egress Mirror module can be used to truncate the concatenated packet corresponding to the first mirrored packet to obtain the truncated packet corresponding to the first mirrored packet. For example, the first 78 bytes of the packet processed after the Ingress stage are fixed as Ethernet header + traffic characteristics. The maximum mirror length of the Mirror module (i.e., the Egress to Egress Mirror module) can be directly set to 78 bytes. Thus, during the mirroring process of the concatenated packet corresponding to the first mirrored packet, the Mirror module (i.e., the Egress to Egress Mirror module) will only copy the first 78 bytes, thereby achieving truncation to obtain the truncated packet corresponding to the first mirrored packet. While completing the mirroring process, the spliced ​​data packets corresponding to the first mirrored data packet also need to be discarded. The truncated data packet corresponding to the first mirrored data packet is sent by the EgressDeparser module to the EgressParser module. The EgressParser module can send the packet type of the truncated data packet corresponding to the first mirrored data packet to the Egress module based on the mirroring identifier in the truncated data packet. The Egress module can decide whether to store the traffic characteristics of the first mirrored data packet in the truncated data packet corresponding to the first mirrored data packet into the register of the first programmable device, update the value recorded by the counter of the first programmable device, and determine whether to send a loopback data packet. If it is not necessary to send a loopback data packet, the truncated data packet corresponding to the first mirrored data packet is discarded. If it is necessary to send a loopback data packet, the Egress module can modify the truncated data packet corresponding to the first mirrored data packet to obtain the loopback data packet. Figure 7 The operation performed by pipe0 Egress (second sending processing module) in the first programmable device; the loopback data packet can be sent back to the first programmable device by the EgressDeparser module through the loopback port of the first programmable device.

[0128] In one feasible implementation, in the scenario of detecting DDoS attack behavior, the first programmable device can randomly sample at least one mirror data packet received by the first programmable device through the Ingress module. That is, the first programmable device can process only the sampled part of the mirror data packets and discard the unsampled mirror data packets. This is because the number of data packets contained in the data stream containing DDoS attack behavior is usually very large, and even if only a part of the mirror data packets are sampled, the detection of DDoS attack behavior can be achieved.

[0129] Taking a second pipeline architecture where any data packet is a loopback packet and the loopback packet is input to the first programmable device as an example: In the second pipeline architecture, the IngressParser module can obtain the packet type of the loopback packet based on the loopback identifier in the loopback packet, and send the packet type of the loopback packet to the Ingress module; the Ingress module can determine whether to send the loopback packet directly to the EgressParser module through the IngressDeparser module based on the packet type of the loopback packet, i.e. Figure 7 The operations performed by pipe0 Ingress (the second receiving and processing module) are as follows: The EgressParser module can send the packet type of the loopback data packet to the Egress module. The Egress module can determine the flow characteristics to read from the register of the first programmable device based on the packet type of the loopback data packet, and concatenate the read flow characteristics to the message of the loopback data packet. Figure 7 The operation performed by pipe0 Egress: If the concatenated loopback data packet does not contain P traffic features, the EgressDeparser module continues to send the loopback data packet back to the first programmable device through the loopback port of the first programmable device. If the concatenated loopback data packet contains P traffic features, a detection data packet can be generated, and the EgressDeparser module sends the detection data packet back to the first programmable device through the loopback port of the first programmable device.

[0130] Taking any data packet as a detection data packet, and inputting the detection data packet into the first programmable device as an example: the IngressParser module can obtain the packet type of the detection data packet based on the loopback completion identifier in the detection data packet, and send the packet type of the detection data packet to the Ingress module; the Ingress module can decide whether to send the detection data packet directly to the EgressParser module through the IngressDeparser module based on the packet type of the detection data packet, i.e. Figure 7 The operations performed by pipe0 Ingress; the EgressParser module can send the packet type of the detection data packet to the Egress module, and the Egress module can decide whether to send the detection data packet directly to the detection device cluster 400 based on the packet type. Figure 7 The operation performed by pipe0Egress in the EgressDeparser module is to send the detection data packets to the detection device cluster 400. Ports 32 and 33 are the ports in the detection device cluster 400.

[0131] 3. Detection device 4001 is used to receive the traffic characteristics of the mirror data packets transmitted by programmable device 5001 and to perform traffic detection processing on the traffic characteristics of the mirror data packets.

[0132] In one embodiment, after receiving a detection data packet transmitted to itself, the detection device 4001 can extract P traffic features from the received detection data packet and store the extracted P traffic features in its own shared memory (which can be represented by IO). Shared memory is a storage space that allows various processors in the detection device 4001 to access and use it together.

[0133] In one embodiment, the detection device 4001 can acquire network attack detection logic and perform traffic detection processing on the traffic characteristics of mirrored data packets according to the network attack detection logic. This traffic detection processing is used to detect whether network attack behavior exists in the business data flow. The network attack detection logic is a set of algorithms or rules for detecting network attack behavior, designed to identify potential network attack behavior. For example, the detection device 4001 can acquire the network attack detection logic and obtain one or more traffic characteristics from shared memory, and perform traffic detection processing on the acquired one or more traffic characteristics according to the network attack detection logic. For instance, when detecting DDoS attacks, the detection device 4001 can acquire all traffic characteristics received within a preset period (which can be set as needed, such as 1 minute, 10 minutes, etc.) and perform traffic detection processing on all acquired traffic characteristics when a preset period arrives. When detecting phishing attacks, the detection device 4001 can acquire one traffic characteristic from shared memory each time and perform traffic detection processing on the acquired traffic characteristics. In other words, during the traffic detection and processing process, traffic characteristics of multiple mirror data packets can be obtained for traffic detection and processing each time, or traffic detection and processing can be performed on the traffic characteristics of only one mirror data packet each time.

[0134] In one feasible implementation, taking the network attack behavior detection logic as the network attack behavior detection rules as an example, the detection device 4001 performs traffic detection processing on the traffic characteristics of the mirrored data packets. This includes: the detection device 4001 acquiring the network attack behavior detection rules, which are rules formulated based on the behavioral characteristics of network attacks. The detection device 4001 can match the traffic characteristics of the mirrored data packets with the network attack behavior detection rules to obtain a matching result. This matching process is used to detect whether the traffic characteristics of the mirrored data packets match the network attack behavior detection rules, that is, to detect whether the traffic characteristics of the mirrored data packets exhibit the behavioral characteristics of network attacks. If so, the matching result is a successful match; otherwise, the matching result is a failed match. If the match is successful, the detection device 4001 generates a first traffic detection processing result, which indicates that network attacks exist in the business data stream. If the match fails, the detection device 4001 generates a second traffic detection processing result, which indicates that network attacks do not exist in the business data stream. For example, network attack detection rules could be IP detection rules, which include the IP addresses used in the network attack. If the IP address in the traffic characteristics of any mirrored data packet matches the IP address used in the network attack, a successful match is determined; otherwise, the match fails. Another example is code detection rules, which can include specific code used in the network attack. If the traffic characteristics of any mirrored data packet contain this specific code, a successful match is determined; otherwise, the match fails. Yet another example is UDP Flood attack rules. A UDP Flood attack rule states that if a large number of UDP packets are detected, a UDP Flood attack is determined. This can be achieved by using the transport layer protocol types in the traffic characteristics of multiple received mirrored data packets to count the number of UDP packets. If the number of UDP packets exceeds a preset threshold (which can be set as needed), a successful match is determined; otherwise, the match fails.

[0135] This application does not restrict the detection logic of network attack behavior. For example, the detection logic of network attack behavior can also be based on machine learning detection algorithm. A machine learning model for detecting network attack behavior can be obtained, and the traffic characteristics of each mirror data packet can be input into the machine learning model for detecting network attack behavior. The machine learning model uses the traffic characteristics of each mirror data packet to identify whether the business data stream exhibits the behavioral characteristics of network attack behavior. If so, the match is successful; otherwise, the match fails.

[0136] For example, the detection logic for DDoS attacks can include rule-based judgment logic. For instance, if an IP address sends a large number of fragmented data packets, it may be involved in a fragmentation attack, thus identifying the IP address as an abnormal IP address. The detection logic can also include statistical logic, such as counting the occurrences of `black_sport`, `black_window`, and `black_ttl` for a given IP address. If the occurrence count exceeds a preset limit, the IP address may be involved in a SYN Flood attack, ACK Flood attack, UDP Flood attack, or ICMP Flood attack, thus identifying the IP address as an abnormal IP address. The detection logic can also include field selection logic, such as using the source port number as a monitored field to detect if certain source port numbers are generating abnormally high data flows, thereby identifying the source port number as an abnormal port number. Finally, the detection logic can include correlation logic, such as identifying an IP address as abnormal when a large number of mirrored data packets are detected originating from the same IP address. An abnormal IP address can refer to an IP address involved in a network attack, and an abnormal port number can refer to the source port number involved in a network attack.

[0137] In one feasible implementation, the improved traffic detection and processing system may further include a security protection system, which is used to prevent the protected object from being subjected to network attacks. For example, the security protection system can be deployed in service device 3001. When detection device 4001 detects a network attack in the service data stream (i.e., generates a first traffic detection processing result), it can send an alarm message to the security protection system. This alarm message indicates that a network attack exists in the service data stream sent to service device 3001. In one implementation, the alarm message may include an identified abnormal IP address (or abnormal port number). The security protection system can perform security protection processing on service device 3001 based on the abnormal IP address (or abnormal port number), such as detecting whether the source address in the service data packet sent to service device 3001 is an abnormal IP address (detecting whether the source port number in the service data packet sent to service device 3001 is an abnormal port number). If so, the service data packet is intercepted; otherwise, the service data packet is sent to service device 3001.

[0138] Therefore, the improved traffic detection and processing system can send the mirrored service data stream (i.e., the mirrored data stream) to the programmable device 5001 through the routing device, achieving bypass detection of network attack behaviors without affecting the transmission of the service data stream. The programmable device 5001 can perform feature extraction processing on the mirrored data packets to obtain traffic features, which reduces the amount of data transmitted. Only the traffic features of the mirrored data packets are transmitted to the detection device 4001, which can reduce the packet receiving load of the detection device cluster 400. Furthermore, the register and loopback port can work together to achieve iterative loopback processing and generate detection packets (packets assembled from multiple (e.g., P) traffic features). Sending multiple traffic features in batches can improve the efficiency and effectiveness of traffic detection processing by the detection device 4001, which is beneficial for better preventing network attacks.

[0139] The following describes in detail specific embodiments of the improved traffic detection processing scheme. Please refer to [link to relevant documentation]. Figure 8 , Figure 8 This is a schematic flowchart of a traffic detection processing method provided in an embodiment of this application; the traffic detection processing method can be executed by a routing device (which may include a core switching device 2001 and an optical splitting switching device 2002), a programmable device 5001, and a detection device 4001 in an improved traffic detection processing system, and the traffic detection processing method includes the following steps S101-S103:

[0140] S101. Obtain the business data stream to be detected and perform mirroring processing on the business data stream to obtain the mirrored data stream; the business data stream includes business data packets, and the mirrored data stream includes mirrored data packets, which are obtained after the business data packets have been mirrored.

[0141] S101 can be executed by the aforementioned routing device (which may include core switching device 2001 and optical splitting switching device 2002). For a detailed description of the implementation process of S101, please refer to the description of the function of the aforementioned routing device (which may include core switching device 2001 and optical splitting switching device 2002), which will not be repeated here.

[0142] S102. Perform feature extraction processing on the mirror data packets in the mirror data stream to generate traffic features of the mirror data packets.

[0143] S102 can be executed by the aforementioned programmable device 5001. For a detailed description of the implementation process of S102, please refer to the description of the function of the aforementioned programmable device 5001, which will not be repeated here.

[0144] In one implementation, there is at least one programmable device 5001, which constitutes a routing device cluster 500. The service data stream includes at least one service data packet, and the mirrored data stream includes at least one mirrored data packet. Each mirrored data packet is obtained by mirroring a service data packet. Any service data packet is represented as a first service data packet. The first service data packet is mirrored to obtain a first mirrored data packet in the mirrored data stream. The first mirrored data packet is transmitted from the routing device to the first programmable device in the programmable device cluster 500. The first programmable device is equipped with a first pipeline architecture. Feature extraction processing is performed on the first mirrored data packet in the mirrored data stream by the first programmable device to generate traffic characteristics of the first mirrored data packet. This includes: writing the first mirrored data packet to the first pipeline architecture of the first programmable device, and performing feature extraction processing on the first mirrored data packet in the first pipeline architecture to generate traffic characteristics of the first mirrored data packet. In this way, the first programmable device 5001 can avoid packet loss during feature extraction processing through the first pipeline architecture.

[0145] In one embodiment, feature extraction processing is performed on a first mirror data packet in a mirrored data stream to generate traffic features of the first mirror data packet, including: obtaining a predefined first data structure, the predefined first data structure including at least one feature field; performing feature extraction processing on the first mirror data packet according to the predefined first data structure to obtain feature values ​​of each feature field in the predefined first data structure; storing the extracted feature values ​​of each feature field in the predefined first data structure into the first data structure to obtain an updated first data structure, and determining the updated first data structure as the traffic features of the first mirror data packet.

[0146] For example, a predefined second data structure can be obtained in a first pipeline architecture using a first programmable device. The predefined second data structure includes at least one data field. The first programmable device parses the first image data packet according to the predefined second data structure to obtain the data values ​​of each data field in the predefined second data structure. The parsed data values ​​of each data field in the predefined second data structure are stored in the second data structure to obtain an updated second data structure. Feature extraction processing is performed on the first image data packet according to the predefined first data structure to obtain the feature value of the target feature field in the predefined first data structure. This includes: performing field matching processing between the target feature field and each data field in the updated second data structure; if there is a first data field in the updated second data structure that matches the target feature field, then the data value of the first data field in the updated second data structure is determined as the feature value of the target feature field; if there is no first data field in the updated second data structure that matches the target feature field, then a second data field associated with the target feature field is queried from the updated second data structure; the data value of the second data field is read, and a pre-configured matching action table is used to transform the data value of the second data field to generate the feature value of the target feature field.

[0147] Therefore, in the process of generating traffic characteristics of mirror packets, key information such as protocol type, source address, destination address, and port number can be extracted from the mirror packets. On the other hand, feature encoding (i.e., using 1 or 0 to represent information) can be performed through an action matching table to reduce unnecessary redundant information. As a result, the traffic characteristics of the generated mirror packets are usually more concise and refined, so much so that the traffic characteristics of the mirror packets are often smaller than the data volume of the mirror packets.

[0148] In one embodiment, the first programmable device includes N registers, where N is a positive integer, determined by the ratio between the length of the traffic characteristics of the first mirrored data packet and the maximum storage bit width of a single register of the first programmable device. The first programmable device obtains the traffic characteristics of the first mirrored data packet from the truncated data packet corresponding to the first mirrored data packet, splits the traffic characteristics of the first mirrored data packet into N feature data, and stores the N feature data in the N registers of the first programmable device. One feature data corresponds to one register, and each feature data is stored in its corresponding register. The length of each feature data is equal to the maximum storage bit width of a single register of the first programmable device. This solves the problem that the traffic characteristics of the first mirrored data packet cannot be stored in the registers of the first programmable device during the processing cycle of the first mirrored data packet.

[0149] In one embodiment, the first programmable device includes a register and a counter. In the first pipeline architecture, the first programmable device adds the traffic characteristics of the first mirror data packet to the first mirror data packet to obtain a spliced ​​data packet corresponding to the first mirror data packet. The packets in the first mirror data packet in the spliced ​​data packet corresponding to the first mirror data packet are truncated to obtain a truncated data packet corresponding to the first mirror data packet. The traffic characteristics of the first mirror data packet in the truncated data packet corresponding to the first mirror data packet are stored in the register of the first programmable device, and the value recorded by the counter of the first programmable device is updated. The value recorded by the counter of the first programmable device is used to indicate the number of traffic characteristics stored in the register of the first programmable device.

[0150] In one embodiment, the number of detection devices 4001 is at least one, and the at least one detection device 4001 constitutes a detection device cluster 400. In the first pipeline architecture, the remainder between the value recorded by the counter of the first programmable device and a set value P is obtained through the first programmable device, where P is an integer greater than 1; if the remainder is a first value, the traffic characteristics of P mirror data packets are obtained from the register of the first programmable device and assembled into a detection message, and the detection message is sent to the first detection device in the detection device cluster, where P is a positive integer; the first detection device is any one of the at least one detection devices selected by a selection algorithm, which includes any one of the following: random selection algorithm, load balancing algorithm.

[0151] Therefore, the first programmable device can store traffic features in its register, obtain multiple traffic features from the register, and assemble multiple traffic features into a detection message to achieve batch transmission of traffic features, thereby improving the efficiency and effectiveness of traffic detection and processing, and helping to better prevent network attacks.

[0152] In one embodiment, the registers of the first programmable device store the traffic characteristics of P mirror data packets. The first programmable device also includes a second pipeline architecture. The process of obtaining the traffic characteristics of the P mirror data packets from the registers of the first programmable device and assembling them into a detection message includes: in the first pipeline architecture, modifying the truncated data packet corresponding to the Pth mirror data packet among the P mirror data packets to generate a loopback data packet, and sending the loopback data packet back to the first programmable device through the loopback port of the first programmable device; inputting the loopback data packet into the second pipeline architecture of the first programmable device; sequentially reading the traffic characteristics of the P mirror data packets from the registers of the first programmable device according to the storage order of the P mirror data packets in the registers, and using the sequentially read traffic characteristics of the P mirror data packets to perform iterative loopback processing on the loopback data packet in the second pipeline architecture to generate a detection message.

[0153] For example, the iterative loopback processing includes P loopback processes, wherein the process of the i-th loopback process includes: in the second pipeline architecture, obtaining the loopback data packet sent back during the (i-1)-th loopback process; i is a positive integer less than or equal to P; concatenating the traffic characteristics of the i-th mirror data packet among the P mirror data packets to the message in the loopback data packet to obtain the concatenated loopback data packet; if i < P, then sending the concatenated loopback data packet back to the first programmable device through the loopback port of the first programmable device; if i = P, then determining the message in the concatenated loopback data packet as a detection message.

[0154] Therefore, this application, through the design of iterative loop processing, can realize the process of assembling the traffic characteristics of P mirror data packets from the register of the first programmable device into a detection message, which is beneficial to improving the efficiency and effectiveness of traffic detection processing.

[0155] In one embodiment, modifying the truncated data packet corresponding to the Pth mirror data packet among P mirror data packets to generate a loopback data packet includes: deleting traffic features from the truncated data packet corresponding to the Pth mirror data packet to obtain a deleted data packet; adding marking information to the deleted data packet to obtain a loopback data packet; the marking information includes one or more of loopback identifier, packet sequence number, and read index; the read index is used to indicate the number of traffic features already included in the loopback data packet. This generates a loopback data packet for performing iterative loopback processing, enabling iterative loopback processing to be implemented.

[0156] In one embodiment, sending a detection message to a first detection device in a detection device cluster via a first programmable device includes: encapsulating a header in the detection message using the first programmable device according to a negotiated transmission protocol to obtain a detection data packet; setting a loopback completion identifier in the detection data packet; and sending the configured detection data packet to the first detection device in the detection device cluster via the negotiated transmission protocol. The negotiated transmission protocol is a transmission protocol for traffic detection processing negotiated between the first programmable device and the first detection device. Using the negotiated transmission protocol allows the first detection device to quickly determine whether a received data packet is a detection data packet, thus improving the efficiency of traffic detection processing.

[0157] In one embodiment, when any data packet transmitted to the first programmable device is received, the type identifier of the arbitrary data packet is read by the first programmable device. The type identifier includes a mirror identifier or a loopback identifier. If the type identifier of the arbitrary data packet is a mirror identifier, the arbitrary data packet is input into the first pipeline architecture of the first programmable device. If the type identifier of the arbitrary data packet is a loopback identifier, the arbitrary data packet is input into the second pipeline architecture of the first programmable device. In this way, the pipeline architecture used to execute the data packet can be quickly determined by the type identifier of the data packet, which helps to speed up the efficiency of traffic detection processing.

[0158] S103. Perform traffic detection processing on the traffic characteristics of the mirrored data packets.

[0159] S103 can be executed by the detection device 4001. For a detailed explanation of the function of the detection device 4001, please refer to the above description of the function of the detection device 4001. It will not be repeated here.

[0160] In one embodiment, traffic detection processing is performed on the traffic characteristics of mirrored data packets, including: obtaining detection rules for network attack behavior; matching the traffic characteristics of the mirrored data packets with the detection rules for network attack behavior; if the match is successful, a first traffic detection processing result is generated, which indicates that network attack behavior exists in the business data stream; if the match fails, a second traffic detection processing result is generated, which indicates that network attack behavior does not exist in the business data stream. This allows for accurate detection of whether network attack behavior is stored in the business data stream, improving business security.

[0161] In summary, please refer to Figure 9 , Figure 9 This is a flowchart illustrating an improved traffic detection processing scheme provided in an embodiment of this application; as shown... Figure 9 As shown, when the programmable device 5001 receives a mirror data packet, it can parse the mirror data packet to generate an updated second data structure. The updated second data structure and the matching action table are used to generate traffic characteristics of the mirror data packet. By acquiring the traffic characteristics of P mirror data packets, a detection data packet is assembled. A load balancing algorithm is then used to distribute the obtained detection data packet to each detection device 4001 in the detection device cluster 400. In one embodiment, the programmable device 5001 can send the detection data packet to each detection device 4001 in the detection device cluster 400 via an intranet switch. An intranet switch is a network device used to connect devices within a local area network. The detection device 4001 can use a five-element distribution algorithm to distribute the received detection data packet to its respective processors. Each processor in the detection device 4001 can be equipped with a DPDK module. Each processor can extract traffic characteristics from the received detection data packet using the DPDK module and write the extracted traffic characteristics to shared memory (IO). Then, according to the attack behavior detection logic, it retrieves one or more traffic characteristics from the shared memory to perform traffic detection processing on the service data stream. The attack detection logic includes, but is not limited to, the rule judgment logic, statistical logic, field selection logic, and correlation logic mentioned above. DPDK refers to the Data Plane Development Kit, an open-source project designed to provide a set of high-performance packet processing libraries and drivers to accelerate packet transmission and processing in networks.

[0162] In this embodiment, the traffic detection processing method can be applied to a traffic detection processing system, which includes a routing device, a programmable device, and a detection device. This method acquires the service data stream to be detected and performs mirroring processing on the service data stream to obtain a mirror data stream. This allows for bypass traffic detection processing of the service data stream through the mirror data stream, avoiding impact on the normal processing flow of the service data stream. Feature extraction processing is performed on the mirror data packets in the mirror data stream to generate traffic features of the mirror data packets, and traffic detection processing is then performed on these traffic features. This approach allows the generation of traffic features from the mirror data packets, which can characterize important information about the mirror data packets (i.e., information that aids in traffic detection processing, such as packet type, source, destination, packet size, etc.). The traffic features of the mirror data packets can be transmitted. Since the transmitted traffic features are smaller than the data volume of the mirror data packets, and the detection device can quickly perform traffic detection processing on the traffic features of the mirror data packets without processing and analyzing information unrelated to traffic detection processing in the mirror data packets, the packet receiving load during traffic detection processing can be reduced, thus improving traffic detection efficiency. On the other hand, by reducing the packet receiving load during the traffic detection and processing process and avoiding packet loss due to the load performance bottleneck of the detection equipment, the possibility of missing detection of network attacks is reduced, thus better preventing network attacks.

[0163] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device may include an improved traffic detection and processing system, which may include a routing device, a programmable device, and a detection device. Please refer to [link to previous document]. Figure 10 The computer device includes a processor 1001, a communication interface 1002, and a computer-readable storage medium 1003. The processor 1001, communication interface 1002, and computer-readable storage medium 1003 can be connected via a bus or other means. The communication interface 1002 is used to receive and send data. The computer-readable storage medium 1003 can be stored in the computer device's memory and is used to store computer programs, including program instructions. The processor 1001 is used to execute the program instructions stored in the computer-readable storage medium 1003. The processor 1001 (or CPU (Central Processing Unit)) is the computing and control core of the computer device, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve corresponding method flows or corresponding functions.

[0164] This application embodiment also provides a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the processing system of the computer device. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by the processor 1001, which may be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device; optionally, it can also be at least one computer-readable storage medium located remotely from the aforementioned processor.

[0165] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor 1001 loads and executes one or more instructions stored in the computer-readable storage medium to implement the corresponding steps in the above-described traffic detection processing method embodiment; specifically, the processor 1001 loads and executes one or more instructions in the computer-readable storage medium for the following steps:

[0166] The process involves acquiring the business data stream to be inspected and mirroring it to obtain a mirrored data stream. The business data stream includes business data packets, and the mirrored data stream includes mirrored data packets, which are obtained by mirroring the business data packets.

[0167] Feature extraction processing is performed on the mirrored data packets in the mirrored data stream to generate traffic features of the mirrored data packets;

[0168] Traffic detection processing is performed on the traffic characteristics of the mirrored data packets.

[0169] In one embodiment, the number of programmable devices is at least one, and the at least one programmable device constitutes a routing device cluster; the service data stream includes at least one service data packet, and the mirror data stream includes at least one mirror data packet, each mirror data packet being obtained by mirroring a service data packet; any service data packet is represented as a first service data packet, and the first service data packet is mirrored to obtain a first mirror data packet in the mirror data stream, the first mirror data packet being transmitted by the routing device to the first programmable device in the programmable device cluster; the first programmable device is provided with a first pipeline architecture; the processor 1001 performs feature parsing processing on the first mirror data packet in the mirror data stream through the first programmable device to generate traffic features of the first mirror data packet, including: writing the first mirror data packet to the first pipeline architecture of the first programmable device through the first programmable device, and performing feature extraction processing on the first mirror data packet in the first pipeline architecture to generate traffic features of the first mirror data packet. In this way, the processor 1001 can avoid packet loss during the feature extraction process through the first pipeline architecture in the first programmable device.

[0170] In one embodiment, the processor 1001 performs feature parsing processing on the first mirror data packet in the mirror data stream to generate traffic features of the first mirror data packet, including: obtaining a predefined first data structure, the predefined first data structure including at least one feature field; performing feature extraction processing on the first mirror data packet according to the predefined first data structure to obtain feature values ​​of each feature field in the predefined first data structure; storing the extracted feature values ​​of each feature field in the predefined first data structure into the first data structure to obtain an updated first data structure, and determining the updated first data structure as the traffic features of the first mirror data packet.

[0171] In one embodiment, the processor 1001 obtains a predefined second data structure in a first pipeline architecture through a first programmable device. The predefined second data structure includes at least one data field. The processor 1001 parses the first image data packet according to the predefined second data structure through the first programmable device to obtain the data values ​​of each data field in the predefined second data structure. The processor 1001 then stores the parsed data values ​​of each data field in the predefined second data structure into the second data structure to obtain an updated second data structure.

[0172] In one embodiment, the processor 1001 performs feature extraction processing on the first image data packet according to a predefined first data structure to obtain the feature value of the target feature field in the predefined first data structure, including: performing field matching processing between the target feature field and each data field in the updated second data structure; if there is a first data field in the updated second data structure that matches the target feature field, then the data value of the first data field in the updated second data structure is determined as the feature value of the target feature field; if there is no first data field in the updated second data structure that matches the target feature field, then a second data field associated with the target feature field is queried from the updated second data structure; the data value of the second data field is read, and the data value of the second data field is transformed using a pre-configured matching action table to generate the feature value of the target feature field.

[0173] Therefore, in the process of generating traffic characteristics of mirror packets, key information such as protocol type, source address, destination address, and port number can be extracted from the mirror packets. On the other hand, feature encoding (i.e., using 1 or 0 to represent information) can be performed through an action matching table to reduce unnecessary redundant information. As a result, the traffic characteristics of the generated mirror packets are usually more concise and refined, so much so that the traffic characteristics of the mirror packets are often smaller than the data volume of the mirror packets.

[0174] In one embodiment, the first programmable device includes N registers, where N is a positive integer, determined by the ratio between the length of the traffic characteristics of the first mirrored data packet and the maximum storage bit width of a single register of the first programmable device. The first programmable device obtains the traffic characteristics of the first mirrored data packet from the truncated data packet corresponding to the first mirrored data packet, splits the traffic characteristics of the first mirrored data packet into N feature data, and stores the N feature data in the N registers of the first programmable device. One feature data corresponds to one register, and each feature data is stored in its corresponding register. The length of each feature data is equal to the maximum storage bit width of a single register of the first programmable device. This solves the problem that the traffic characteristics of the first mirrored data packet cannot be stored in the registers of the first programmable device during the processing cycle of the first mirrored data packet.

[0175] In one embodiment, the first programmable device includes a register and a counter. In the first pipeline architecture, the processor 1001 adds the traffic characteristics of the first mirror data packet to the first mirror data packet through the first programmable device to obtain a spliced ​​data packet corresponding to the first mirror data packet, truncates the message in the first mirror data packet in the spliced ​​data packet corresponding to the first mirror data packet to obtain a truncated data packet corresponding to the first mirror data packet, stores the traffic characteristics of the first mirror data packet in the truncated data packet corresponding to the first mirror data packet in the register of the first programmable device, and updates the value recorded by the counter of the first programmable device. The value recorded by the counter of the first programmable device is used to indicate the number of traffic characteristics stored in the register of the first programmable device.

[0176] In one embodiment, in the first pipeline architecture, the processor 1001 obtains the remainder between the value recorded by the counter of the first programmable device and a set value P, where P is an integer greater than 1; if the remainder is a first value, the processor 1001 obtains the traffic characteristics of P mirror data packets from the register of the first programmable device, assembles them into a detection message, and sends the detection message to the first detection device in the detection device cluster, where P is a positive integer; the first detection device is any one of the at least one detection devices selected by a selection algorithm, which includes any one of the following: random selection algorithm, load balancing algorithm.

[0177] Therefore, the processor 1001 can store traffic features in the register of the first programmable device, obtain multiple traffic features from the register of the first programmable device, and assemble multiple traffic features into detection packets to realize the batch transmission of traffic features, thereby improving the efficiency and effectiveness of traffic detection and processing, and helping to better prevent network attacks.

[0178] In one embodiment, the registers of the first programmable device store the traffic characteristics of P mirror data packets. The first programmable device also includes a second pipeline architecture. The processor 1001 obtains the traffic characteristics of the P mirror data packets from the registers of the first programmable device and assembles them into a detection message. This includes: in the first pipeline architecture, modifying the truncated data packet corresponding to the Pth mirror data packet in the P mirror data packets to generate a loopback data packet, and sending the loopback data packet back to the first programmable device through the loopback network interface of the first programmable device; inputting the loopback data packet into the second pipeline architecture of the first programmable device; sequentially reading the traffic characteristics of the P mirror data packets from the registers of the first programmable device according to the storage order of the P mirror data packets in the registers, and using the sequentially read traffic characteristics of the P mirror data packets to perform iterative loopback processing on the loopback data packet in the second pipeline architecture to generate a detection message.

[0179] In one embodiment, the iterative loopback processing includes P loopback processes, wherein the process of the i-th loopback process includes: in the second pipeline architecture, acquiring the loopback data packet received during the (i-1)-th loopback process; i is a positive integer less than or equal to P; concatenating the traffic characteristics of the i-th mirror data packet among the P mirror data packets to the message in the loopback data packet to obtain the concatenated loopback data packet; if i < P, then sending the concatenated loopback data packet back to the first programmable device through the loopback network interface of the first programmable device; if i = P, then determining the message in the concatenated loopback data packet as a detection message.

[0180] Therefore, this application, through the design of iterative loop processing, can realize the process of assembling the traffic characteristics of P mirror data packets from the register of the first programmable device into a detection message, which is beneficial to improving the efficiency and effectiveness of traffic detection processing.

[0181] In one embodiment, the processor 1001 modifies the truncated data packet corresponding to the Pth mirror data packet among P mirror data packets to generate a loopback data packet. This includes: deleting traffic features from the truncated data packet corresponding to the Pth mirror data packet to obtain a deleted data packet; adding marking information to the deleted data packet to obtain a loopback data packet; the marking information includes one or more of a loopback identifier, packet sequence number, and read index; the read index indicates the number of traffic features already included in the loopback data packet. This generates a loopback data packet for performing iterative loopback processing, enabling iterative loopback processing to be implemented.

[0182] In one embodiment, the processor 1001 sends a detection message to a first detection device in a detection device cluster via a first programmable device, including: encapsulating a header in the detection message according to a negotiated transmission protocol to obtain a detection data packet; setting a loopback completion identifier in the detection data packet; and sending the configured detection data packet to the first detection device in the detection device cluster via the negotiated transmission protocol; wherein, the negotiated transmission protocol is a transmission protocol for traffic detection processing negotiated between the first programmable device and the first detection device. The negotiated transmission protocol facilitates the first detection device in quickly determining whether a received data packet is a detection data packet, thereby improving the efficiency of traffic detection processing.

[0183] In one embodiment, when any data packet transmitted to the first programmable device is received, the processor 1001 reads the type identifier of the arbitrary data packet through the first programmable device. The type identifier includes a mirror identifier or a loopback identifier. If the type identifier of the arbitrary data packet is a mirror identifier, the processor 1001 inputs the arbitrary data packet into the first pipeline architecture of the first programmable device through the first programmable device. If the type identifier of the arbitrary data packet is a loopback identifier, the processor 1001 inputs the arbitrary data packet into the second pipeline architecture of the first programmable device through the first programmable device. In this way, the pipeline architecture for executing the data packet can be quickly determined through the type identifier of the data packet, which helps to speed up the efficiency of traffic detection processing.

[0184] In one embodiment, the processor 1001 performs traffic detection processing on the traffic characteristics of the mirrored data packets, including: acquiring detection rules for network attack behavior; matching the traffic characteristics of the mirrored data packets with the detection rules for network attack behavior; if the match is successful, generating a first traffic detection processing result, which indicates that network attack behavior exists in the business data stream; if the match fails, generating a second traffic detection processing result, which indicates that no network attack behavior exists in the business data stream. This enables accurate detection of whether network attack behavior is stored in the business data stream, improving business security.

[0185] Based on the same inventive concept, the principle and beneficial effects of the computer device provided in the embodiments of this application in solving the problem are similar to the principle and beneficial effects of the traffic detection and processing method in the embodiments of this application in solving the problem. Please refer to the principle and beneficial effects of the implementation of the method. For the sake of brevity, they will not be repeated here.

[0186] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0187] This application also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned traffic detection processing method.

[0188] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A flow detection and processing system, characterized in that, The traffic detection and processing system includes a routing device, a programmable device, and a detection device. The routing device is connected to the programmable device, and the programmable device is connected to the detection device. Wherein: The routing device is configured to acquire the service data stream to be detected, perform mirroring processing on the service data stream to obtain a mirrored data stream, and transmit the mirrored data stream to the programmable device. The service data stream includes service data packets, and the mirrored data stream includes mirrored data packets. The mirrored data packets are obtained after the service data packets have been mirrored. The programmable device is configured to receive the mirrored data stream transmitted by the routing device, perform feature extraction processing on the mirrored data packets in the mirrored data stream to generate traffic features of the mirrored data packets, and transmit the traffic features of the mirrored data packets to the detection device. The detection device is used to receive the traffic characteristics of the mirror data packet transmitted by the programmable device, and to perform traffic detection processing on the traffic characteristics of the mirror data packet.

2. The system as described in claim 1, characterized in that, The routing equipment includes a core switching device and an optical splitting switching device. The core switching device is connected to the optical splitting switching device, and the optical splitting switching device is connected to the programmable device. The core switching device is used to acquire the service data stream to be detected, perform mirroring processing on the service data stream to obtain a mirror data stream, and transmit the mirror data stream to the optical splitting switching device. The optical splitter is used to receive the mirrored data stream transmitted by the core switching device and transmit the mirrored data stream to the programmable device.

3. The system as described in claim 1 or 2, characterized in that, The traffic detection and processing system has at least one programmable device, which constitutes a programmable device cluster. Each programmable device includes at least one port, and each port corresponds to at least one tuple. The service data stream includes at least one service data packet, and the mirrored data stream includes at least one mirrored data packet. Each mirrored data packet is obtained by mirroring a service data packet. Any service data packet is represented as a first service data packet, and the first service data packet is obtained by mirroring to form the first mirrored data packet in the mirrored data stream. The routing equipment includes optical splitting and switching equipment; The routing device transmits the mirrored data stream to the programmable device, including: The optical splitting and switching device acquires the tuple contained in the first image data packet; The optical splitter switch determines, among the ports contained in each of the programmable devices in the programmable device cluster, the first port corresponding to the tuple contained in the first image data packet; The optical splitter switch transmits the first mirror data packet through the first port to the first programmable device to which the first port belongs. The tuple includes a first element and a second element, where the first element and the second element refer to any two elements among the source address, destination address, source port number, and destination port number.

4. The system according to any one of claims 1-3, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; any service data packet in the service data stream is represented as a first service data packet, and the first service data packet is processed by the mirroring to obtain a first mirror data packet in the mirrored data stream, and the first mirror data packet is transmitted by the routing device to the first programmable device in the programmable device cluster; the first programmable device is provided with a first pipeline architecture. The first programmable device writes the first image data packet to the first pipeline architecture of the first programmable device, and performs feature extraction processing on the first image data packet in the first pipeline architecture to generate the traffic features of the first image data packet.

5. The system according to any one of claims 1-4, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the first mirror data packet in the mirror data stream is transmitted by the routing device to the first programmable device in the programmable device cluster; the first programmable device is provided with a first pipeline architecture; The first programmable device performs feature extraction processing on the first mirrored data packet in the first pipeline architecture to generate traffic features of the first mirrored data packet, including: In the first pipeline architecture, the first programmable device acquires a predefined first data structure, the predefined first data structure including at least one feature field; The first programmable device performs feature extraction processing on the first image data packet according to the predefined first data structure to obtain the feature values ​​of each feature field in the predefined first data structure. The first programmable device stores the feature values ​​of each feature field extracted from the predefined first data structure into the first data structure to obtain the updated first data structure, and determines the updated first data structure as the traffic feature of the first mirror data packet.

6. The system according to any one of claims 1-5, characterized in that, The traffic detection and processing system contains at least one programmable device, and at least one programmable device constitutes a programmable device cluster; the first mirror data packet in the mirrored data stream is transmitted by the routing device to the first programmable device in the programmable device cluster; the first programmable device is equipped with a first pipeline architecture; the first programmable device is used for: In the first pipeline architecture, a predefined second data structure is obtained, the predefined second data structure including at least one data field; The first image data packet is parsed and processed according to the predefined second data structure to obtain the data values ​​of each data field in the predefined second data structure. The data values ​​of each data field in the predefined second data structure obtained by parsing are stored in the predefined second data structure to obtain the updated second data structure.

7. The system according to any one of claims 1-6, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the first mirror data packet in the mirror data stream is transmitted by the routing device to the first programmable device in the programmable device cluster; any feature field in the predefined first data structure is represented as a target feature field; The predefined second data structure includes at least one data field, and after being updated, the predefined second data structure stores the data value of at least one data field obtained from parsing the first image data packet; The first programmable device performs feature extraction processing on the first image data packet according to the predefined first data structure to obtain the feature value of the target feature field in the predefined first data structure, including: The first programmable device performs field matching processing on the target feature field and each data field in the updated second data structure; If the updated second data structure contains a first data field that matches the target feature field, then the first programmable device determines the data value of the first data field in the updated second data structure as the feature value of the target feature field. If there is no first data field in the updated second data structure that matches the target feature field, then the first programmable device queries the updated second data structure for the second data field associated with the target feature field. The first programmable device reads the data value of the second data field and uses a pre-configured matching action table to transform the data value of the second data field to generate the feature value of the target feature field.

8. The system according to any one of claims 1-7, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the first mirror data packet in the mirror data stream is transmitted by the routing device to the first programmable device in the programmable device cluster; the first programmable device is provided with a first pipeline architecture; the first programmable device includes registers and counters; the first programmable device is further used for: In the first pipeline architecture, the traffic characteristics of the first mirror data packet are added to the first mirror data packet to obtain the spliced ​​data packet corresponding to the first mirror data packet; The packets in the first mirror data packet in the spliced ​​data packet corresponding to the first mirror data packet are truncated to obtain the truncated data packet corresponding to the first mirror data packet. The traffic characteristics of the first mirrored data packet in the truncated data packet corresponding to the first mirrored data packet are stored in the register of the first programmable device, and the value recorded by the counter of the first programmable device is updated. The value recorded by the counter of the first programmable device is used to indicate the number of traffic characteristics stored in the register of the first programmable device.

9. The system according to any one of claims 1-8, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the first mirror data packet in the mirror data stream is transmitted by the routing device to the first programmable device in the programmable device cluster; The first mirrored data packet is processed by the first programmable device to form a truncated data packet corresponding to the first mirrored data packet; the first programmable device includes N registers, where N is a positive integer, determined based on the ratio between the length of the traffic characteristics of the first mirrored data packet and the maximum storage bit width of a single register of the first programmable device; the first programmable device is further configured to: The traffic characteristics of the first mirror data packet are obtained from the truncated data packet corresponding to the first mirror data packet. The traffic characteristics of the first mirror data packet are split into N feature data, and the length of each feature data is equal to the maximum storage bit width of a single register of the first programmable device. The N feature data are distributed and stored in N registers of the first programmable device, with each feature data being stored in one register.

10. The system according to any one of claims 1-9, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the number of detection devices in the traffic detection and processing system is at least one, and at least one detection device constitutes a detection device cluster; the programmable device cluster includes a first programmable device, the first programmable device is provided with a first pipeline architecture, the first programmable device includes registers and counters, and the registers of the first programmable device are used to store the traffic characteristics of the mirrored data packets; The value recorded by the counter of the first programmable device is used to indicate the number of flow characteristics stored in the register of the first programmable device; The programmable device transmits the traffic characteristics of the mirrored data packet to the detection device, including: In the first pipeline architecture, the first programmable device obtains the remainder between the value recorded by the counter of the first programmable device and a set value P, where P is an integer greater than 1. If the remainder is a first value, then the first programmable device obtains the traffic characteristics of P mirror data packets from the register of the first programmable device and assembles them into a detection message, where P is a positive integer; The first programmable device sends the detection message to the first detection device in the detection device cluster; The first detection device is any one of the detection devices selected from at least one detection device by a selection algorithm, the selection algorithm including any one of the following: random selection algorithm, load balancing algorithm.

11. The system according to any one of claims 1-10, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the programmable device cluster includes a first programmable device, which is provided with a first pipeline architecture and a second pipeline architecture; the first programmable device includes a register, and the register of the first programmable device stores the traffic characteristics of P mirrored data packets, where P is a positive integer; The first programmable device obtains the traffic characteristics of P mirrored data packets from its register and assembles them into a detection message, including: In the first pipeline architecture, the first programmable device modifies the truncated data packet corresponding to the Pth mirror data packet in the P mirror data packets to generate a loopback data packet, and sends the loopback data packet back to the first programmable device through the loopback port of the first programmable device. The first programmable device inputs the loopback data packet to the second pipeline architecture of the first programmable device; The first programmable device sequentially reads the traffic characteristics of the P mirror data packets from the register according to the storage order of the P mirror data packets in the register, and performs iterative loopback processing on the loopback data packets in the second pipeline architecture using the traffic characteristics of the P mirror data packets read sequentially to generate a detection message.

12. The system according to any one of claims 1-11, characterized in that, The number of programmable devices in the flow detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the programmable device cluster includes a first programmable device, and the first programmable device is provided with a second pipeline architecture; the first programmable device includes a register, and the register of the first programmable device stores the flow characteristics of P mirror data packets, where P is a positive integer; the truncated data packet corresponding to the Pth mirror data packet is modified into a loopback data packet by the first programmable device. In the second pipeline architecture, the first programmable device utilizes the traffic characteristics of the P mirrored data packets to perform iterative loopback processing on the loopback data packets. The iterative loopback processing includes P loopback processes, wherein the process of the i-th loopback process includes: In the second pipeline architecture, the loopback data packet sent back during the (i-1)th loopback process is obtained; i is a positive integer less than or equal to P; The traffic characteristics of the i-th mirror data packet in the P mirror data packets are concatenated to the message in the loopback data packet to obtain the concatenated loopback data packet; If i < P, then the concatenated loopback data packet is sent back to the first programmable device through the loopback port of the first programmable device; If i = P, then the message in the concatenated loopback data packet is identified as the detection message.

13. The system according to any one of claims 1-12, characterized in that, The number of programmable devices in the traffic detection and processing system is at least one, and at least one programmable device constitutes a programmable device cluster; the programmable device cluster includes a first programmable device, the first programmable device includes a register, and the register of the first programmable device stores the traffic characteristics of P mirrored data packets, where P is a positive integer; The first programmable device modifies the truncated data packet corresponding to the Pth mirror data packet among the P mirror data packets to generate a loopback data packet, including: The first programmable device deletes the traffic characteristics from the truncated data packet corresponding to the Pth mirrored data packet to obtain the deleted data packet; The first programmable device adds tagging information to the deleted data packet to obtain a loopback data packet; the tagging information includes one or more of loopback identifier, packet sequence number, and read index; the read index is used to indicate the number of traffic features already contained in the loopback data packet.

14. The system according to any one of claims 1-13, characterized in that, The traffic detection and processing system comprises at least one programmable device, which constitutes a programmable device cluster; the traffic detection and processing system also comprises at least one detection device, which constitutes a detection device cluster; the traffic characteristics of P mirrored data packets in the mirrored data stream are transmitted by the first programmable device in the programmable device cluster to the first detection device in the detection device cluster via detection messages; wherein... The first programmable device encapsulates a header into the detection message according to the negotiated transmission protocol to obtain a detection data packet; The first programmable device sets a loopback completion flag in the detection data packet and sends the set detection data packet to the first detection device. The negotiated transmission protocol is a transmission protocol for traffic detection processing obtained through negotiation between the first programmable device and the first detection device.

15. The system according to any one of claims 1-14, characterized in that, The flow detection and processing system comprises at least one programmable device, and the at least one programmable device constitutes a programmable device cluster; the first programmable device in the programmable device cluster is further used for: When any data packet transmitted to the first programmable device is received, the type identifier of the arbitrary data packet is read, and the type identifier includes a mirror identifier or a loopback identifier; If the type identifier of the arbitrary data packet is a mirror identifier, then the arbitrary data packet is input into the first pipeline architecture of the first programmable device; If the type identifier of any data packet is a loopback identifier, then the arbitrary data packet is input into the second pipeline architecture of the first programmable device.

16. A flow detection and processing method, characterized in that, The method is applied to a traffic detection and processing system, which includes routing devices, programmable devices, and detection devices; the method includes: The process involves acquiring a business data stream to be detected and performing mirroring processing on the business data stream to obtain a mirrored data stream. The business data stream includes business data packets, and the mirrored data stream includes mirrored data packets, which are obtained by mirroring the business data packets. The mirrored data packets in the mirrored data stream are subjected to feature extraction processing to generate traffic features of the mirrored data packets; Traffic detection processing is performed on the traffic characteristics of the mirrored data packets.

17. The method as described in claim 16, characterized in that, The service data stream includes at least one service data packet, and the mirror data stream includes at least one mirror data packet. Each mirror data packet is obtained by mirroring a service data packet. Any service data packet is referred to as a first service data packet. The first service data packet is obtained by mirroring a first mirror data packet in the mirror data stream. The mirror data stream includes the first mirror data packet. The first mirrored data packet in the mirrored data stream is subjected to feature extraction processing to generate traffic features of the first mirrored data packet, including: Obtain a predefined first data structure, wherein the predefined first data structure includes at least one feature field; The first image data packet is subjected to feature extraction processing according to the predefined first data structure to obtain the feature values ​​of each feature field in the predefined first data structure. The feature values ​​of each feature field extracted from the predefined first data structure are stored in the first data structure to obtain the updated first data structure, and the updated first data structure is determined as the traffic feature of the first mirror data packet.

18. A computer device, characterized in that, include: A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program that, when executed by the processor, implements the traffic detection processing method as described in any one of claims 1-15 or 16-17.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1-15 or 16-17.

20. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the traffic detection processing method as described in any one of claims 1-15 or 16-17.

Images