Attack traffic cleaning processing method and system

Abstract

The application relates to an attack traffic cleaning processing method and system, which comprises the following steps: monitoring traffic data of a target network where an operation and maintenance system is located to obtain a traffic rate curve; determining a plurality of traffic anomaly periods according to the traffic rate curve; for each traffic anomaly period, determining a basic probability that malicious traffic exists in the traffic anomaly period according to a first probability that each traffic record in the traffic anomaly period is a malicious record and a second probability that traffic received by each destination address in the traffic anomaly period is malicious traffic; determining an attack traffic proportion corresponding to the traffic anomaly period according to the basic probability in the traffic anomaly period; and dynamically adjusting a cleaning threshold for cleaning traffic data in the traffic anomaly period according to the attack traffic proportion. The application realizes dynamic adjustment of the cleaning threshold according to the attack traffic, realizes accurate identification and adaptive cleaning of the attack traffic, and can quickly cope with faults or business peaks of the operation and maintenance system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for cleaning and processing attack traffic. Background Technology

[0002] In current integrated digital operations and maintenance systems for industry, distributed denial-of-service (DDoS) attacks have become one of the major cybersecurity risks threatening the continuity and stability of online business, especially in high-concurrency microservice scenarios where attacks can cause service interruptions. To address this threat, the industry commonly employs traffic scrubbing technology, deploying scrubbing centers to detect and filter access traffic, thereby blocking malicious attacks while allowing normal business requests to proceed.

[0003] However, existing traffic scrubbing methods typically rely on preset rules to scrub traffic. When faced with complex and ever-changing distributed denial-of-service attacks, especially those that can simulate normal business access patterns, this strategy struggles to dynamically and accurately adapt to the changing patterns of actual attack traffic. This can easily lead to problems such as inaccurate scrubbing, delayed response, or excessive blocking of normal traffic when the attack intensity fluctuates, thereby affecting the business availability of the operation and maintenance system. Summary of the Invention

[0004] The purpose of this invention is to provide an attack traffic cleaning and processing method and system, which realizes dynamic adjustment of cleaning threshold based on attack traffic, achieves accurate identification and adaptive cleaning of attack traffic, and can quickly respond to system failures or business peaks.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] Firstly, a method for cleaning and processing attack traffic is provided, the method comprising:

[0007] The system monitors the traffic data of the target network where the operation and maintenance system is located to obtain a traffic rate curve. Based on the traffic rate curve, it identifies multiple abnormal traffic periods, which characterize the time intervals in which the traffic rate deviates from the normal range. For each abnormal traffic period, it determines a first probability that a traffic record is malicious based on the request frequency and business intent intensity of each traffic record within the abnormal traffic period. It determines a second probability that the traffic is malicious based on the degree of disorder in the number and type distribution of traffic records received by each destination address within the abnormal traffic period. Based on the first and second probabilities, it determines the basic probability that malicious traffic exists within the abnormal traffic period. Based on the distribution of the basic probabilities across all abnormal traffic periods, it determines the proportion of attack traffic corresponding to non-target abnormal periods and target abnormal periods within the abnormal traffic periods.

[0008] Based on the attack traffic percentage and the preset initial cleaning threshold, the cleaning threshold for cleaning traffic data during the abnormal traffic period is dynamically adjusted.

[0009] Based on the cleaning threshold, the traffic data for the next traffic period is cleaned.

[0010] Optionally, based on the traffic rate curve, multiple abnormal traffic periods are determined, including: determining the degree of traffic deviation at each moment on the traffic rate curve based on the traffic rate values ​​at adjacent moments on the traffic rate curve, as well as the preset upper and lower limits of the normal link traffic rate, the degree of traffic deviation is used to comprehensively characterize the instantaneous change in traffic rate and its deviation from the normal range; determining multiple target moments with a traffic deviation degree greater than or equal to a first preset threshold based on the distribution of the degree of traffic deviation at all moments; and determining the interval between two time-continuous target moments among the multiple target moments as abnormal traffic periods.

[0011] Optionally, determining the first preset threshold includes: sorting the flow deviation at all times according to the numerical value to form a first ordered sequence; determining the maximum difference between two adjacent flow deviations in the first ordered sequence; and determining the larger of the two flow deviations corresponding to the maximum difference as the first preset threshold.

[0012] Optionally, a first probability of a traffic record being a malicious record is determined based on the request frequency and business intent intensity of each traffic record during the abnormal traffic period. This includes: for each traffic record, determining the interval duration characteristic of requests sent on the traffic record and the total number of requests; determining the request frequency of the traffic record based on the interval duration characteristic and the total number of requests; determining the time distance between the first timestamp of the start of the abnormal traffic period and the second timestamp of the start of the preset business activity, and determining the fluctuation degree of business order data during the abnormal traffic period; determining the business intent intensity based on the time distance and the fluctuation degree, whereby the business intent intensity is used to characterize the degree of association between the traffic record and normal business activities; and determining the first probability of a traffic record being a malicious record based on the request frequency and the business intent intensity.

[0013] Optionally, a second probability of traffic being malicious traffic is determined based on the number of traffic records received by each destination address during the abnormal traffic period and the degree of disorder in the type distribution. This includes: for each destination address during the abnormal traffic period, counting the number of traffic records connected to the destination address; determining the degree of disorder in the type distribution based on the record types of all traffic records connected to the destination address; and determining the second probability of traffic received by the destination address being malicious traffic based on the number of traffic records and the degree of disorder in the type distribution.

[0014] Optionally, based on the distribution of the base probability within all the traffic anomaly periods, the attack traffic percentages corresponding to non-target anomaly periods and target anomaly periods are determined, including: based on the distribution of the base probability of all traffic anomaly periods, determining multiple target anomaly periods with a base probability greater than or equal to a second preset threshold, and multiple non-target anomaly periods with a base probability less than the second preset threshold; for each non-target anomaly period, determining the base probability of the non-target anomaly period as the attack traffic percentage corresponding to the non-target anomaly period; for each target anomaly period, determining the deviation between the CPU load rate within the target anomaly period and the CPU load rate during historical normal periods; negatively adjusting the base probability of the target anomaly period based on the deviation to obtain an adjustment value; and standardizing the adjustment value to obtain the attack traffic percentage corresponding to the target anomaly period.

[0015] Optionally, determining the second preset threshold includes: sorting the basic probabilities of abnormal traffic periods according to their numerical values ​​to form a second ordered sequence; determining the maximum difference between two adjacent basic probabilities in the second ordered sequence; and determining the larger of the two basic probabilities corresponding to the maximum difference as the second preset threshold.

[0016] Optionally, the cleaning threshold for cleaning traffic data during the abnormal traffic period can be dynamically adjusted based on the attack traffic ratio and a preset initial cleaning threshold, including: determining a temporary cleaning threshold based on the preset initial cleaning threshold and the attack traffic ratio, wherein the temporary cleaning threshold is negatively correlated with the attack traffic ratio; and determining the maximum value between the temporary cleaning threshold and a preset minimum protection threshold as the final cleaning threshold.

[0017] Optionally, the above-mentioned attack traffic cleaning and processing method further includes: based on the dynamically adjusted cleaning threshold, identifying and filtering malicious traffic in the traffic data according to the characteristics of the traffic data in the protocol dimension, behavior dimension and business logic dimension during the abnormal traffic period; and injecting the filtered traffic data back into the target network.

[0018] Secondly, an attack traffic cleaning and processing system is provided, comprising: a traffic monitoring unit for monitoring traffic data of a target network where an operation and maintenance system is located, and obtaining a traffic rate curve; a time period determination unit for determining multiple abnormal traffic time periods based on the traffic rate curve, wherein the abnormal traffic time periods characterize the time intervals in which the traffic rate deviates from the normal range; a malice assessment unit for determining, for each abnormal traffic time period, a first probability that a traffic record is a malicious record based on the request frequency and business purpose intensity of each traffic record within the abnormal traffic time period; a second probability that the traffic is malicious traffic based on the number and type distribution of traffic records received by each destination address within the abnormal traffic time period; and a base probability that malicious traffic exists within the abnormal traffic time period based on the first probability and the second probability; a proportion determination unit for determining the attack traffic proportions corresponding to non-target abnormal time periods and target abnormal time periods within all the abnormal traffic time periods based on the distribution of the base probabilities; a threshold adjustment unit for dynamically adjusting the cleaning threshold for cleaning traffic data within the abnormal traffic time period based on the attack traffic proportions and a preset initial cleaning threshold; and a traffic cleaning processing unit for cleaning traffic data in the next traffic time period based on the cleaning threshold.

[0019] The present invention has the following beneficial effects:

[0020] The attack traffic cleaning method provided in this invention achieves adaptive and precise cleaning of distributed denial-of-service (DDoS) attack traffic by constructing a complete, closed-loop processing flow from traffic monitoring, anomaly identification, probability assessment, proportion calibration to dynamic threshold adjustment. First, continuous analysis of the traffic rate curve allows for timely and sensitive capture of the start and end times of traffic anomalies, thus defining precise suspected attack time windows and laying an accurate temporal foundation for subsequent in-depth analysis. Second, the method integrates a "first probability" assessment based on the behavioral characteristics of a single record with a "second probability" assessment based on macroscopic traffic distribution patterns. This dual-dimensional analysis mechanism can more comprehensively and profoundly reveal complex attack patterns hidden beneath normal traffic patterns, significantly improving the accuracy of malicious traffic identification and effectively reducing false positives. Finally, the calculated "attack traffic proportion" is dynamically correlated with the "cleaning threshold" for execution, constructing an intelligent response mechanism where "the higher the threat assessment, the greater the cleaning intensity," completely changing the problem of insensitive or excessive interception caused by fixed thresholds in existing technologies. This enables the protection system to intelligently detect, accurately assess, and dynamically handle distributed denial-of-service attacks that are highly similar to normal traffic in high-concurrency business scenarios. As a result, while efficiently mitigating attacks, it maximizes the continuity and stability of normal business operations, significantly improving the overall protection effectiveness and business availability of the operation and maintenance system. Attached Figure Description

[0021] Figure 1 A schematic diagram of the attack traffic scrubbing system provided in an embodiment of the present invention;

[0022] Figure 2 This is a schematic flowchart of an attack traffic cleaning method provided in an embodiment of the present invention. Detailed Implementation

[0023] Please see Figure 1 The diagram illustrates a flowchart of an attack traffic cleaning method according to an embodiment of the present invention, comprising the following steps:

[0024] Step 101: Monitor the traffic data of the target network where the operation and maintenance system is located, and obtain the traffic rate curve.

[0025] One possible approach is to deploy traffic acquisition points at the entry point of the target network requiring protection. These acquisition points use techniques such as port mirroring, optical splitting, or network traffic probes to capture raw traffic packets flowing into the target network in real time and continuously. For the traffic transmission characteristics of high-concurrency service scenarios, a fixed time interval of seconds is set (this interval can be dynamically adapted according to the fluctuation characteristics of service traffic; it can be shortened to milliseconds during peak periods of high concurrency and extended to minutes during off-peak periods to ensure a balance between real-time monitoring and system resource consumption). The traffic data includes key information such as the number of data packets, the number of bytes transmitted, and the transmission protocol type at each moment. Furthermore, based on the collected traffic data, the traffic transmission rate at each moment is calculated in chronological order. The traffic transmission rate at each moment is determined by the ratio of the total number of data packets or the total number of bytes transmitted at that moment to the time interval. The traffic transmission rates at each moment are arranged in chronological order along the time axis to form a traffic rate curve with time as the horizontal axis and traffic transmission rate as the vertical axis. This curve intuitively represents the trend of traffic transmission rate change of the target network throughout the entire time period.

[0026] In some embodiments, to quantify traffic anomalies subsequently, a range of normal link traffic rates for the target network under attack-free and stable service operation conditions is preset or obtained through historical data analysis. This range is defined by two key parameters: the upper limit of the normal link traffic rate. and lower limit value . It represents the upper limit of acceptable traffic rate during peak business hours (such as daily peak access times); This represents the lower limit of typical traffic rate during off-peak hours (such as late at night). These two parameters together define the reasonable boundary for fluctuations in normal business traffic rates.

[0027] Step 102: Based on the flow rate curve, identify multiple periods of abnormal flow.

[0028] Among them, the abnormal flow period is used to characterize the time interval in which the flow rate deviates from the normal range.

[0029] As one possible implementation, firstly, based on the traffic rate values ​​at adjacent moments on the traffic rate curve, and the preset upper and lower limits of the normal link traffic rate, the degree of traffic deviation at each moment on the traffic rate curve is determined. This degree of traffic deviation is used to comprehensively characterize the instantaneous change in traffic rate and the degree to which it deviates from the normal range.

[0030] It should be noted that the preset upper and lower limits of normal link traffic rate can be based on the traffic rate data of the target network in a period without attack history (such as the past 30 days), from which the maximum value is obtained as the upper limit, such as 1Gbps, and the minimum value is obtained as the lower limit, such as 70Mbps. This embodiment of the invention does not make specific limitations on this.

[0031] In some embodiments, the formula for calculating the degree of flow deviation at each moment on the flow rate curve is as follows:

[0032]

[0033] In the formula, For the first The degree of flow deviation at any given time For the first The traffic rate at any given time, even when there is no service access to the target network, indicates that there is a minimum level of background traffic on the network link, such as Address Resolution Protocol (ARP) packets, link-layer keep-alive packets, management protocol data (e.g., Simple Network Management Protocol (SNMP) data), routing protocol updates, etc. This traffic ensures... , For the first The flow rate value at any given time. To preset the upper limit of normal link traffic rate, To preset the lower limit of normal link traffic rate, This indicates that the absolute value is being calculated.

[0034] in, This value is used to accurately characterize the instantaneous change in the flow rate between two adjacent moments. The larger the value, the more drastic the fluctuation in the flow rate between adjacent moments. Used to characterize the The degree to which the traffic transmission rate deviates from the normal link traffic rate range at any given time. Higher than or below At this time, this part of the value will increase non-linearly, intuitively reflecting the degree to which the flow rate exceeds the limit. The numerical value combines the instantaneous change in flow rate with the degree of deviation from the normal range. The larger the value, the more significant the number of . The more significant the difference between the traffic at a given moment and the characteristics of normal business traffic, the higher the probability of an anomaly.

[0035] Furthermore, based on the distribution of the degree of flow deviation at all times, multiple target times where the degree of flow deviation is greater than or equal to a first preset threshold are determined.

[0036] In some embodiments, a first preset threshold is first determined based on the degree of flow deviation at all times, including: sorting the degree of flow deviation at all times according to numerical values ​​to form a first ordered sequence; determining the maximum difference between two adjacent degrees of flow deviation in the first ordered sequence, the position corresponding to the maximum difference being the boundary between the "normal interval" and the "abnormal interval" of the flow deviation; and determining the larger of the two degrees of flow deviation corresponding to the maximum difference as the first preset threshold, which serves as the core criterion for distinguishing between normal and abnormal flow, ensuring that only flow that significantly deviates from the normal level is included in the abnormal analysis scope. Subsequently, target times are selected based on the first preset threshold, including: comparing the degree of flow deviation at each time point. Based on the relationship between the flow deviation and the first preset threshold, the moment when the flow deviation is greater than or equal to the first preset threshold is determined as the target moment. The target moment is the moment when the flow shows significant abnormal characteristics. The set of all target moments constitutes the key time node of the flow abnormality.

[0037] Finally, the interval between two consecutive target times among multiple target times is determined as the period of abnormal traffic.

[0038] In some embodiments, all target times are arranged in chronological order, following the principle of "no double counting of adjacent times," and the interval between two consecutive target times is defined as a traffic anomaly period. For example, if the target times arranged in chronological order are t1, t2, t3, and t4, then the interval between t1 and t2, and the interval between t3 and t4, respectively constitute two independent traffic anomaly periods. Each target time participates in the formation of only one traffic anomaly period, avoiding duplicate analysis caused by overlapping periods.

[0039] Understandably, the embodiments of the present invention combine the rate change characteristics of adjacent moments on the traffic rate curve with the preset upper and lower limits of normal link traffic rate to comprehensively quantify the degree of traffic deviation at each moment, and then determine the first preset threshold based on the distribution law of the degree of traffic deviation throughout the time period, thereby screening target moments and defining abnormal traffic periods. Overall, it can achieve accurate identification and efficient division of abnormal traffic periods. Instead of relying on fixed anomaly criteria, this approach dynamically analyzes the degree to which instantaneous fluctuations in traffic rates deviate from normal ranges. This effectively avoids misidentification caused by solely relying on rate fluctuations or rate out-of-bounds judgments. It can accurately capture abnormal periods that match the "sudden increase-high-speed sustained-sudden decrease" characteristics of distributed denial-of-service (DDoS) attack traffic, while also eliminating interference from normal business traffic fluctuations. Furthermore, by determining the first preset threshold through ordered sequence sorting and maximum difference division, the threshold can adapt to the traffic characteristics differences of the target network at different times, eliminating the need for frequent manual adjustments and improving the adaptability and automation of anomaly identification. In addition, the precisely defined abnormal traffic periods provide a clear and focused time range for subsequent processes such as malicious traffic probability calculation and attack traffic proportion analysis, avoiding the waste of system resources caused by indiscriminate analysis throughout the entire time period. This significantly improves the operational efficiency and targeting of the entire DDoS attack traffic cleaning and processing solution, laying a solid foundation for subsequent accurate interception of malicious traffic.

[0040] Step 103: For each abnormal traffic period, determine the first probability that a traffic record is a malicious record based on the request frequency and business intent intensity of each traffic record within the abnormal traffic period.

[0041] Step 104: Based on the number and type of traffic records received by each destination address during the abnormal traffic period, determine the second probability that the traffic is malicious traffic;

[0042] Step 105: Determine the basic probability of malicious traffic during the abnormal traffic period based on the first probability and the second probability.

[0043] As one possible implementation, firstly, based on the frequency of requests and the intensity of business purpose of each traffic record during the abnormal traffic period, a first probability that the traffic record is a malicious record is determined, and based on the degree of disorder in the number and type distribution of traffic records received by each destination address during the abnormal traffic period, a second probability that the traffic is malicious traffic is determined, and then based on the first probability and the second probability, a basic probability that malicious traffic exists during the abnormal traffic period is determined.

[0044] In some embodiments, determining a first probability that a traffic record is a malicious record based on the request frequency and business intent intensity of each traffic record during the abnormal traffic period includes:

[0045] For each traffic record, determine the interval duration characteristic of requests sent on that traffic record and the total number of requests. The interval duration characteristic is the average of the interval durations between all two consecutive requests, which can be denoted as: This value is used to characterize the regularity of request intervals. A smaller value indicates more uniform and regular request intervals, which better matches the traffic characteristics of a machine-initiated attack. Furthermore, based on the interval duration characteristics and the total number of requests, the frequency of requests in the traffic records is determined, expressed by the formula: In the formula, Periods of abnormal traffic Medium flow record The frequency of requests, Traffic recording The interval duration characteristics, Traffic recording The corresponding total number of requests, It is a very small positive number, and an empirical value of 0.001 can be taken to prevent the denominator from being zero. The larger the value, the more frequent the requests for that traffic record, and the higher the potential risk of malicious attacks.

[0046] Furthermore, the request frequency is adjusted based on the relevance to the business scenario to eliminate interference from frequent requests caused by normal high-concurrency business. First, the timestamp of the start of the period of abnormal traffic is recorded, which can be designated as the first timestamp. Extract the preset business activity start timestamp, which can be recorded as the second timestamp. Then calculate the time distance between the two (such as the absolute value of the difference between the two). This is used to characterize the temporal correlation between periods of abnormal traffic and normal high-concurrency business. It involves statistically analyzing the backend business order data at any two adjacent moments within a period of abnormal traffic, calculating the absolute value of the difference between the order data at each adjacent moment, and then averaging all the absolute values ​​to obtain the degree of fluctuation in the order data, which can be denoted as... , A higher value indicates a higher level of normal business activity during that period. Further, based on time distance and the degree of fluctuation, the intensity of business purpose is determined, expressed by the formula: In the formula, Periods of abnormal traffic Medium flow record The intensity of business purpose, As the first timestamp, This is the second timestamp. For the degree of fluctuation, It should be a very small positive number, and an empirical value of 0.001 can be taken to prevent the denominator from being zero. The intensity of business purpose is used to characterize the degree of correlation between traffic records and normal business activities. The larger the value, the lower the correlation between the traffic record request and normal business activities, and the higher the possibility of non-business purposes.

[0047] Furthermore, based on the frequency of requests and the intensity of business intent, the first probability of a traffic record being a malicious record is determined, expressed by the formula: In the formula, Periods of abnormal traffic Medium flow record The first probability of malicious recording, Periods of abnormal traffic Medium flow record The frequency of requests, Periods of abnormal traffic Medium flow record The intensity of business objectives. The higher the value, the higher the probability that the traffic record is malicious.

[0048] Based on the degree of disorder in the number and type distribution of traffic records received at each destination address during the abnormal traffic period, a second probability is determined to be malicious traffic, including:

[0049] For each destination address during the period of abnormal traffic, first count the number of traffic records connecting to that destination address, which can be denoted as: , Indicates the first A target address is identified. The record types of all traffic records received at that target address are then collected. A pre-defined information analysis algorithm (used to quantify the degree of data type disorder) is used to calculate the information entropy of these traffic record types, which is denoted as the degree of type distribution disorder. Furthermore, based on the degree of disorder in the number and type distribution of traffic records, a second probability is determined that the traffic received at the destination address is malicious traffic. The formula is expressed as follows: In the formula, Periods of abnormal traffic destination address The second probability that the received traffic is malicious traffic. To connect to the destination address The number of traffic records, To connect to the destination address The degree of disorder in the distribution of all traffic record types The larger the value, the more chaotic the types of traffic records received at that destination address, which does not conform to the normal distribution pattern of business traffic types. The larger the value, the more significant the abnormal traffic characteristics of the destination address, and the higher the probability of receiving malicious traffic.

[0050] In some embodiments, the formula for calculating the basic probability of malicious traffic existing during the abnormal traffic period, based on the first probability and the second probability, is as follows:

[0051]

[0052] In the formula, Periods of abnormal traffic The basic probability of malicious traffic. Periods of abnormal traffic Medium flow record The first probability of malicious recording, Periods of abnormal traffic destination address The second probability that the received traffic is malicious traffic. Periods of abnormal traffic The total number of all traffic records in the data. Periods of abnormal traffic The number of all destination addresses in the data. This indicates that normalization processing is being performed, such as based on historical calculations. The historical maximum and minimum values ​​are used to normalize this term using the maximum-minimum normalization method. If... If it is greater than the historical maximum, then The value is 1, if If it is less than the historical minimum, then The value is set to a preset minimum value, such as 0.001.

[0053] in, Periods of abnormal traffic The average of the first probabilities corresponding to all traffic records in the data is used to comprehensively characterize the overall malicious tendency of a single traffic record within that time period. Periods of abnormal traffic The average of the second probabilities corresponding to all destination addresses is used to comprehensively characterize the overall malicious traffic aggregation characteristics at the destination address level during this period. The larger the value, the stronger the malicious attributes presented by the abnormal traffic period in terms of both individual traffic record behavior and address aggregation characteristics, and the higher the possibility of malicious traffic.

[0054] Understandably, in this embodiment of the invention, by considering two core dimensions—the behavior of a single traffic record and the characteristics of traffic aggregation at the destination address—and combining a first probability with a second probability to determine the basic probability of an abnormal traffic period, a comprehensive and accurate assessment of the possibility of malicious traffic is achieved. This approach overcomes the limitations of single-dimensional judgment, capturing the malicious behavior tendencies of a single traffic record through the first probability and identifying the abnormal address aggregation characteristics of multi-source, dispersed, low-frequency, and other covert attacks through the second probability. It comprehensively covers different types of distributed denial-of-service (DDoS) attack scenarios, including high-frequency explosive attacks and covert attacks, effectively avoiding missed or false positives caused by single-feature judgments. Furthermore, this assessment method fully integrates traffic behavior details and address distribution patterns, accurately distinguishing between normal high-concurrency business traffic and malicious attack traffic. Especially in high-concurrency scenarios, it effectively eliminates interference from frequent requests from legitimate businesses and normal address access distribution, ensuring that the basic probability truly reflects the malicious attributes of abnormal traffic periods.

[0055] Step 106: Based on the distribution of the basic probability within all the abnormal traffic periods, determine the proportion of attack traffic corresponding to the non-target abnormal period and the target abnormal period, respectively.

[0056] As one possible implementation, firstly, based on the distribution of the basic probability of all abnormal traffic periods, multiple target abnormal periods with a basic probability greater than or equal to a second preset threshold and multiple non-target abnormal periods with a basic probability less than the second preset threshold are determined.

[0057] In some embodiments, the basic probabilities corresponding to all abnormal traffic periods are first sorted in ascending order to form a second ordered sequence. This sequence clearly shows the distribution gradient of the probability of malicious traffic during each abnormal traffic period. The second ordered sequence is traversed, and the difference between two adjacent basic probabilities is calculated one by one. By comparing the magnitude of all differences, the largest difference is selected. The position corresponding to the largest difference is the natural boundary between the "low-risk interval" and the "high-risk interval" of the basic probability. The larger of the two basic probabilities corresponding to the largest difference is determined as the second preset threshold. This threshold serves as the core standard for determining whether the basic probability needs to be adjusted in conjunction with the system's operating status, ensuring that only high-risk periods are accurately adjusted, avoiding meaningless resource consumption. Subsequently, all abnormal traffic periods are classified based on the second preset threshold: abnormal traffic periods with a basic probability greater than or equal to the second preset threshold are defined as target abnormal periods. These periods have the risk of misjudgment due to normal high system load and require further correction. Abnormal traffic periods with a basic probability less than the second preset threshold are defined as non-target abnormal periods. The impact of normal system load on them is negligible and requires no additional correction.

[0058] Furthermore, for each non-target abnormal period, the base probability of the non-target abnormal period is determined as the proportion of attack traffic corresponding to the non-target abnormal period.

[0059] Furthermore, for each target anomaly period, the CPU load rate at each time point within the target anomaly period is extracted, and the average value is taken as the CPU load rate within the target anomaly period, denoted as . This characterizes the operational activity level during that period; CPU load rate data from historical normal periods (i.e., periods with no deviation in flow rate and no abnormal flow characteristics) are retrieved, and the average CPU load rate for all historical normal periods is calculated and denoted as . This leads to the deviation between the CPU load rate during the abnormal period and the CPU load rate during historical normal periods, denoted as . , Indicates the first For each target abnormal period, the larger the deviation value, the higher the system load during the target abnormal period is compared to the normal level, and the greater the possibility that the base probability is higher due to the high load of normal business.

[0060] Furthermore, the baseline probability of the target's abnormal period is negatively adjusted based on the deviation to obtain an adjusted value. This adjusted value is then standardized to obtain the attack traffic percentage corresponding to the target's abnormal period. The formula is expressed as follows: In the formula, For the target abnormal period The corresponding percentage of attack traffic, For the target abnormal period The corresponding adjustment value, For the target abnormal period The base probability, The CPU load rate during the target abnormal period. The average CPU load rate for all historical normal periods. It is a natural constant. Indicates the period of abnormality of the target The deviation between the CPU load rate and the CPU load rate during historical normal periods. (Exponential function) It is a negative adjustment factor, and its value ranges from 0 to 1. The larger the value, the smaller the regulating factor, and the better the effect. The stronger the attenuation effect, the better it is at offsetting the interference of normal high load on the base probability, thus making the adjustment value... It more closely resembles real attack scenarios. This indicates that the calculated adjustment value has been standardized to map adjustment values ​​of different magnitudes to a reasonable range of 0-1. For example, the calculated adjustment value can be compared with all historical calculations. The ratio of the maximum value in the previous calculations, and the adjusted value obtained in the calculation is greater than all the values ​​in the historical calculations. In the case of the maximum value in the range, the attack traffic percentage is set to 1.

[0061] Understandably, in this embodiment of the invention, by first determining a second preset threshold based on the basic probability distribution of all abnormal traffic periods, accurate classification of abnormal periods is achieved. Then, differentiated attack traffic ratio determination methods are adopted for different types of periods, thus achieving accurate quantification and efficient calculation of attack traffic ratio, providing a reliable basis for subsequent cleaning threshold adjustment. The dynamic determination of the second preset threshold can adapt to the characteristics of the basic probability distribution under different scenarios, reasonably dividing high- and low-risk abnormal periods, avoiding the accuracy problem caused by a uniform processing mode. For low-risk non-target abnormal periods, the basic probability is directly used as the attack traffic ratio, simplifying the processing flow and reducing system resource consumption while ensuring the reliability of the results. For high-risk target abnormal periods, negative adjustment and standardization are performed based on the deviation between the CPU load rate and historical normal periods, effectively eliminating the interference of normal high system load (such as resource occupation caused by high-concurrency services) on malicious traffic judgment, solving the problem of misjudgment where the basic probability is easily overestimated in high-load scenarios, and making the adjusted attack traffic ratio more consistent with the actual attack situation.

[0062] Step 107: Based on the attack traffic ratio and the preset initial cleaning threshold, dynamically adjust the cleaning threshold for cleaning traffic data during the abnormal traffic period.

[0063] As one possible approach, firstly, a temporary cleaning threshold is determined based on a preset initial cleaning threshold and the proportion of attack traffic. The temporary cleaning threshold is negatively correlated with the proportion of attack traffic. The higher the proportion of attack traffic, the lower the cleaning threshold should be to improve the cleaning system's sensitivity to malicious traffic; conversely, the lower the proportion of attack traffic, the higher the cleaning threshold should be to prevent legitimate traffic from being cleaned, ultimately achieving a dynamic balance between "precisely intercepting attacks and fully protecting legitimate traffic."

[0064] In some embodiments, the formula for determining the temporary cleaning threshold is as follows:

[0065]

[0066] In the formula, For the target abnormal period The corresponding temporary cleaning threshold, The preset initial cleaning threshold is determined by comprehensive calibration based on the target network's historical attack traffic data, the system's maximum protection capability, and the peak statistics of normal business traffic. It serves as a benchmark reference value for threshold adjustment, ensuring that the adjustment range meets the actual protection needs of the system. For the target abnormal period The corresponding percentage of attack traffic.

[0067] in, For the target abnormal period The corresponding percentage of attack traffic, with a value ranging from 0 to 1, indicates that the attack traffic is more concentrated and the attack intensity is higher during that period; This is a threshold adjustment factor that fluctuates inversely with the proportion of attack traffic; the higher the proportion of attack traffic, the smaller the adjustment factor. The lower the value, the more sensitively the cleaning system can identify and block malicious traffic; conversely, the lower the proportion of attack traffic, the larger the adjustment coefficient. The higher the value, the lower the probability of misjudging legitimate traffic.

[0068] Furthermore, the maximum value between the temporary cleaning threshold and the preset minimum protection threshold is determined as the final cleaning threshold, expressed by the following formula: In the formula, For the target abnormal period The final cleaning threshold, For the target abnormal period The corresponding temporary cleaning threshold, The preset minimum protection threshold is determined based on the minimum traffic transmission requirements required to maintain the target network's basic heartbeat connection and the normal operation of core businesses (such as order payment and user login). It is the bottom line threshold to ensure that the core functions of the system are not interrupted, ensuring that no matter how high the proportion of attack traffic is, the cleaning threshold will not be lower than this bottom line, and avoiding blocking legitimate core business interactions due to the threshold being too low. Functions are used to select The larger value in the threshold is used as the final cleaning threshold, which ensures both sensitive interception during periods of high attack rate and safeguards the bottom line of legitimate traffic protection for core businesses.

[0069] In some embodiments, the initial cleaning threshold With minimum guarantee threshold All support dynamic updates: The system will periodically (e.g., weekly) collect the latest historical attack data, business traffic fluctuation data, and core business requirement changes, and update them accordingly. and Perform calibration and optimization to ensure that the benchmark and boundary of threshold adjustment always match the actual operating state of the target network.

[0070] Step 108, cleaning the traffic data for the next traffic period according to the cleaning threshold, may include: based on the dynamically adjusted cleaning threshold, identifying and filtering malicious traffic in the traffic data according to the characteristics of the traffic data in the protocol dimension, behavior dimension, and business logic dimension during the abnormal traffic period; and injecting the filtered traffic data back into the target network. This includes the following steps.

[0071] First, the original traffic data during the corresponding abnormal traffic period is directed to a dedicated cloud scrubbing center or local scrubbing cluster through routing strategies (such as Border Gateway Protocol (BGP) diversion) or tunneling technologies (such as Generic Routing Encapsulation (GRE) tunneling).

[0072] Furthermore, at the cleaning center, multi-dimensional analysis techniques are used for in-depth traffic inspection: At the protocol level, it checks whether the traffic conforms to the specifications of protocols such as Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), and Domain Name System (DNS), identifying malformed or illegal packets. At the behavioral level, it analyzes behavioral characteristics such as traffic rate, packet size distribution, and request intervals to determine whether it exhibits the regularity of automated tools (such as botnets) rather than the randomness of human users. At the business logic level, it verifies whether the request sequence conforms to the normal business logic of the target application, identifying abnormal access paths or parameters.

[0073] Furthermore, the comprehensive risk score or anomaly indicator generated based on the above multidimensional analysis will be compared with the dynamic cleaning threshold customized for that period. Real-time comparison is performed. Any traffic exceeding this threshold (i.e., traffic deemed malicious or highly suspicious) will be filtered or dropped.

[0074] Finally, the remaining legitimate business traffic after cleaning and filtering will be injected back to the original target network or server through reverse tunneling or route injection, thereby ensuring that normal users' access is not affected and that the business can continue to operate stably.

[0075] Understandably, the attack traffic cleaning method provided in this invention achieves adaptive and precise cleaning of distributed denial-of-service attack traffic by constructing a complete, closed-loop processing flow from traffic monitoring, anomaly identification, probability assessment, proportion calibration to dynamic threshold adjustment. First, continuous analysis of the traffic rate curve allows for timely and sensitive capture of the start and end times of traffic anomalies, thus defining precise suspected attack time windows and laying an accurate temporal foundation for subsequent in-depth analysis. Second, the integration of a "first probability" assessment based on the behavioral characteristics of a single record and a "second probability" assessment based on macroscopic traffic distribution patterns creates a dual-dimensional analysis mechanism that more comprehensively and profoundly reveals complex attack patterns hidden beneath normal traffic patterns, significantly improving the accuracy of malicious traffic identification and effectively reducing false positives. Finally, the calculated "attack traffic proportion" is dynamically correlated with the "cleaning threshold" for execution, constructing an intelligent response mechanism where "the higher the threat assessment, the greater the cleaning intensity," completely changing the problem of insensitive or excessive interception caused by fixed thresholds in existing technologies. This enables the protection system to intelligently detect, accurately assess, and dynamically handle distributed denial-of-service attacks, especially in high-concurrency business scenarios, which are highly similar to normal traffic. This effectively mitigates attacks while maximizing the continuity and stability of normal business operations, significantly improving the overall protection effectiveness and business availability of the system.

[0076] Please see Figure 2 This illustration shows a schematic diagram of an attack traffic scrubbing system according to an embodiment of the present invention. The attack traffic scrubbing system 20 includes...

[0077] The traffic monitoring unit is used to monitor the traffic data of the target network and obtain the traffic rate curve.

[0078] Optionally, the traffic monitoring unit is specifically used to continuously monitor and collect real-time traffic data of the target network ingress at preset time intervals (e.g., a fixed time interval of 1 second, which can be dynamically adjusted according to peak business periods, with shorter intervals during high-concurrency periods to improve real-time performance), generating a traffic rate curve characterizing the change in traffic transmission rate over time. The traffic monitoring unit is typically deployed at the network boundary or as a bypass of the core link, acquiring traffic through mirroring or optical splitting.

[0079] The time period determination unit is used to determine multiple abnormal flow periods based on the flow rate curve. The abnormal flow periods are used to characterize the time intervals in which the flow rate deviates from the normal range.

[0080] Optionally, a time period determination unit is used to first calculate the rate change between adjacent time periods based on the traffic rate values ​​on the traffic rate curve, and then combine the traffic rate at each time with the upper limit (which can be taken as 1.2 times the highest peak traffic rate during stable service periods in historical statistics (excluding known attack periods)) and the lower limit (which can be taken as 0.5 times the average traffic rate during off-peak periods (such as late at night) in historical statistics. For example, if the historical peak traffic rate is 1Gbps, then the upper limit is set to 1.2Gbps) and the lower limit (which can be taken as 0.5 times the average traffic rate during off-peak periods in historical statistics (such as late at night). For example, if the historical peak traffic rate is 200Mb). If the upper limit is set to 100Mbps, the deviation is analyzed to comprehensively determine the degree of traffic deviation at each moment (the degree of traffic deviation is used to comprehensively characterize the instantaneous change in traffic rate and its deviation from the normal range); then, the degree of traffic deviation at all moments is sorted by numerical value to form a first ordered sequence. By analyzing the difference between adjacent deviation degrees in the sequence, the dividing point corresponding to the largest difference is located, and the larger deviation degree corresponding to the dividing point is determined as the first preset threshold; finally, multiple target moments with a traffic deviation degree greater than or equal to the first preset threshold are selected, and the interval between two consecutive target moments is determined as the traffic abnormality period.

[0081] The malicious assessment unit is used to determine, for each abnormal traffic period, a first probability that a traffic record is a malicious record based on the frequency of requests and the intensity of business intent of each traffic record during the abnormal traffic period; a second probability that the traffic is malicious traffic based on the degree of disorder in the number and type distribution of traffic records received by each destination address during the abnormal traffic period; and a base probability that malicious traffic exists during the abnormal traffic period based on the first probability and the second probability.

[0082] Optionally, the malicious assessment unit includes a record analysis module, an address analysis module, and a comprehensive calculation module.

[0083] The record analysis module is used to analyze each traffic record during periods of abnormal traffic. First, it obtains the interval characteristics of requests sent on the record (the average duration of all request intervals) and the total number of requests, thereby determining the request frequency of each record. Then, it obtains the second timestamp of the preset business activity start, calculates the time distance between the first timestamp and the second timestamp of the abnormal traffic period, and simultaneously counts the fluctuation of business order data during this period. Combining the time distance and the fluctuation, it determines the intensity of business intent (used to characterize the correlation between traffic records and normal business activities). Finally, based on the request frequency and the intensity of business intent, it determines the first probability that each traffic record is a malicious record.

[0084] The address analysis module is used to first count the number of traffic records connected to each destination address during periods of abnormal traffic, then analyze the type distribution of all connection records, determine the degree of disorder in the type distribution through a preset information analysis algorithm, and combine the number of records with the degree of disorder in the type distribution to obtain a second probability that the traffic received by each destination address is malicious traffic.

[0085] The comprehensive calculation module is used to average the first probability of all records and the second probability of all destination addresses, and then perform a correlation operation between the two averages to obtain the basic probability that malicious traffic exists during the abnormal traffic period.

[0086] The percentage determination unit is used to determine the percentage of attack traffic corresponding to the non-target abnormal period and the target abnormal period, respectively, based on the distribution of the basic probability within all the abnormal traffic periods.

[0087] Optionally, the proportion determination unit is specifically used to first sort the base probabilities of all abnormal traffic periods by numerical value to form a second ordered sequence. By analyzing the difference between adjacent base probabilities in the sequence, the division point corresponding to the largest difference is located, and the larger base probability corresponding to the division point is determined as the second preset threshold. Subsequently, based on the second preset threshold, multiple target abnormal periods with base probabilities greater than or equal to the threshold, and multiple non-target abnormal periods with base probabilities less than the threshold are selected. For each non-target abnormal period, its base probability is directly determined as the corresponding attack traffic proportion. For each target abnormal period, the CPU load rate at each moment within the period is obtained, and the average CPU load rate of historical normal periods (periods with no deviation in traffic rate) is retrieved. The deviation between the CPU load rate and the average load rate within the target abnormal period is calculated. Based on this deviation, the base probability of the target abnormal period is negatively adjusted (the larger the deviation, the larger the adjustment magnitude, to offset the interference of normal high system load on malicious traffic judgment), and the adjustment value is obtained. Then, the adjustment value is standardized to finally obtain the attack traffic proportion corresponding to the target abnormal period.

[0088] The threshold adjustment unit is used to dynamically adjust the cleaning threshold for cleaning traffic data during the abnormal traffic period based on the attack traffic ratio and the preset initial cleaning threshold.

[0089] Optionally, the threshold adjustment unit is specifically used to first obtain a preset initial cleaning threshold (set to 70% of the total network egress bandwidth, or 1.5 times the historical peak traffic of normal services. For example, for a network with a 1Gbps egress bandwidth, the initial cleaning threshold is set to 700Mbps). Based on the correlation between the initial cleaning threshold and the proportion of attack traffic, a temporary cleaning threshold is calculated (the temporary cleaning threshold is negatively correlated with the proportion of attack traffic; that is, the higher the proportion of attack traffic, the lower the temporary cleaning threshold, in order to improve the sensitivity of the cleaning system to attack traffic). Then, a preset minimum guarantee threshold is retrieved (the minimum cleaning threshold used to maintain the system's basic heartbeat connection and the normal operation of core services, for example, it can be set to 75Mbps). The temporary cleaning threshold is compared with the minimum guarantee threshold, and the larger value is selected as the final cleaning threshold. The final cleaning threshold output by the threshold adjustment unit is shown below.

[0090] The traffic scrubbing and processing unit is used to scrub the traffic data of the next traffic period according to the scrubbing threshold, providing a key execution basis for accurately identifying and filtering malicious traffic and ensuring lossless transmission of legitimate traffic, and realizing a dynamic balance between attack traffic interception and legitimate traffic protection.

[0091] It should be noted that all implementation methods in the above method embodiments are applicable to the system embodiments and can achieve the same technical effect.

[0092] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for cleaning and processing attack traffic, characterized in that, The method includes: Monitor the traffic data of the target network where the operation and maintenance system is located to obtain the traffic rate curve; Based on the flow rate curve, multiple abnormal flow periods are determined, which are used to characterize the time intervals in which the flow rate deviates from the normal range. For each period of abnormal traffic, the probability that a traffic record is a malicious record is determined based on the request frequency and business intent intensity of each traffic record within the period of abnormal traffic; the business intent intensity is used to characterize the degree of association between the traffic record and normal business activities. Based on the number and type distribution of traffic records received by each destination address during the abnormal traffic period, a second probability of the traffic being malicious is determined; the degree of disorder in the type distribution is determined by calculating the information entropy of the record types of traffic records received by the destination receiving address using a preset information analysis algorithm. Based on the first probability and the second probability, determine the basic probability that malicious traffic exists during the abnormal traffic period; Based on the distribution of the basic probability within all the aforementioned abnormal traffic periods, determine the proportion of attack traffic corresponding to non-target abnormal periods and target abnormal periods, respectively. Based on the attack traffic percentage and the preset initial cleaning threshold, the cleaning threshold for cleaning traffic data during the abnormal traffic period is dynamically adjusted. Based on the cleaning threshold, the traffic data for the next traffic period is cleaned.

2. The attack traffic cleaning and processing method according to claim 1, characterized in that, Based on the flow rate curve, several periods of abnormal flow were identified, including: Based on the traffic rate values ​​at adjacent moments on the traffic rate curve, and the preset upper and lower limits of the normal link traffic rate, the degree of traffic deviation at each moment on the traffic rate curve is determined. The degree of traffic deviation is used to comprehensively characterize the instantaneous change in traffic rate and the degree to which it deviates from the normal range. Based on the distribution of the degree of flow deviation at all times, determine multiple target times where the degree of flow deviation is greater than or equal to a first preset threshold; The interval between two time-continuous target times among the plurality of target times is determined as the abnormal traffic period.

3. The attack traffic cleaning and processing method according to claim 2, characterized in that, Determining the first preset threshold includes: Sort the flow deviations at all times according to their numerical values ​​to form a first ordered sequence; Determine the maximum difference among the differences between two adjacent flow deviations in the first ordered sequence; The larger of the two flow deviations corresponding to the maximum difference is determined as the first preset threshold.

4. The attack traffic cleaning and processing method according to claim 1, characterized in that, Based on the request frequency and business intent intensity of each traffic record during the abnormal traffic period, a first probability of determining whether a traffic record is malicious is determined, including: For each of the traffic records, determine the interval duration of requests issued on the traffic record and the total number of requests; The frequency of requests for the traffic records is determined based on the interval duration characteristics and the total number of requests. Determine the time distance between the first timestamp of the start of the abnormal traffic period and the second timestamp of the start of the preset business activity, and determine the degree of fluctuation of business order data during the abnormal traffic period; The intensity of business purpose is determined based on the time distance and the degree of fluctuation. Based on the frequency of the requests and the intensity of the business intent, a first probability is determined that the traffic record is a malicious record.

5. The attack traffic cleaning and processing method according to claim 1, characterized in that, Based on the degree of disorder in the number and type distribution of traffic records received at each destination address during the abnormal traffic period, a second probability is determined to be malicious traffic, including: For each destination address during the period of abnormal traffic, count the number of traffic records connected to that destination address; Determine the degree of disorder in the type distribution based on the record types of all traffic records connected to the destination address; Based on the number of traffic records and the degree of disorder in the type distribution, a second probability is determined that the traffic received at the destination address is malicious traffic.

6. The attack traffic cleaning and processing method according to claim 1, characterized in that, Based on the distribution of the basic probability within all the aforementioned abnormal traffic periods, determine the proportion of attack traffic corresponding to non-target abnormal periods and target abnormal periods, respectively, including: Based on the distribution of the basic probability of all abnormal traffic periods, determine a number of target abnormal periods with the basic probability greater than or equal to a second preset threshold, and a number of non-target abnormal periods with the basic probability less than the second preset threshold. For each of the non-target abnormal time periods, the base probability of the non-target abnormal time period is determined as the proportion of attack traffic corresponding to the non-target abnormal time period; For each target abnormal period, determine the deviation between the CPU load rate during the target abnormal period and the CPU load rate during historical normal periods; The base probability of the target abnormal period is negatively adjusted based on the deviation to obtain an adjustment value; The adjustment value is standardized to obtain the attack traffic percentage corresponding to the target abnormal period.

7. The attack traffic cleaning and processing method according to claim 6, characterized in that, Determining the second preset threshold includes: The basic probabilities of the abnormal traffic periods are sorted by numerical value to form a second ordered sequence; Determine the maximum difference among the differences between two adjacent basic probabilities in the second ordered sequence; The larger of the two base probabilities corresponding to the maximum difference is determined as the second preset threshold.

8. The attack traffic cleaning and processing method according to claim 1, characterized in that, Based on the attack traffic percentage and a preset initial cleaning threshold, the cleaning threshold for cleaning traffic data during the abnormal traffic period is dynamically adjusted, including: A temporary cleaning threshold is determined based on a preset initial cleaning threshold and the attack traffic percentage, wherein the temporary cleaning threshold is negatively correlated with the attack traffic percentage. The maximum value between the temporary cleaning threshold and the preset minimum protection threshold is determined as the final cleaning threshold.

9. The attack traffic cleaning and processing method according to claim 1, characterized in that, The method further includes: Based on the dynamically adjusted cleaning threshold, and according to the characteristics of the traffic data in the protocol dimension, behavior dimension, and business logic dimension during the abnormal traffic period, malicious traffic in the traffic data is identified and filtered. The filtered traffic data is then injected back into the target network.

10. An attack traffic scrubbing and processing system, characterized in that, include: The traffic monitoring unit is used to monitor the traffic data of the target network where the operation and maintenance system is located and obtain the traffic rate curve; The time period determination unit is used to determine multiple abnormal flow periods based on the flow rate curve. The abnormal flow periods are used to characterize the time intervals in which the flow rate deviates from the normal range. The malicious assessment unit is used to determine the first probability that a traffic record is a malicious record for each traffic abnormality period based on the request frequency and business intent intensity of each traffic record during the traffic abnormality period. The intensity of business purpose is used to characterize the degree of correlation between traffic records and normal business activities; Based on the number and type of traffic records received by each destination address during the abnormal traffic period, a second probability is determined that the traffic is malicious traffic. The degree of disorder in the type distribution is determined by calculating the information entropy of the record type of the traffic records received at the destination receiving address using a preset information analysis algorithm; based on the first probability and the second probability, the basic probability of malicious traffic existing during the abnormal traffic period is determined. The percentage determination unit is used to determine the percentage of attack traffic corresponding to the non-target abnormal period and the target abnormal period respectively, based on the distribution of the basic probability within all the abnormal traffic periods. The threshold adjustment unit is used to dynamically adjust the cleaning threshold for cleaning traffic data during the abnormal traffic period based on the attack traffic ratio and the preset initial cleaning threshold. The flow cleaning and processing unit is used to clean the flow data for the next flow period according to the cleaning threshold.

Images