A two-stage flow table establishment method supporting SYN FLOOD protection

Abstract

The present application relates to a kind of two-stage flow table establishment method of supporting SYN FLOOD protection, by "temporary table cache+official table establishment" two-stage design, with "SYN+ACK pairing" as the only trigger condition of official flow table establishment, utilize "time wheel+Hash table" to realize the efficient aging of invalid SYN temporary table item, when SYN FLOOD attack occurs, effectively reduce invalid flow table occupation, reduce CPU load, realize the efficient mitigation to SYN FLOOD attack, guarantee the normal establishment of legal connection.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, and in particular relates to a two-stage flow table establishment method that supports SYN FLOOD protection. Background Technology

[0002] With the rapid development of internet technology, network data transmission volume has surged, posing a severe challenge to network security. DDoS (Distributed Denial of Service) attacks have become one of the most common network attack methods. In TCP protocol communication, the flow table is the core carrier for network devices (such as routers, firewalls, and security detection devices) to forward data and manage connection states. The efficiency of flow table creation, resource consumption, and aging mechanism directly determine the communication performance and attack resistance of network devices.

[0003] Currently, the mainstream flow table establishment method is "SYN-triggered": when a network device receives a SYN packet sent by a client, it immediately creates an initial record in the flow table, waiting for subsequent handshake packets to update the state. This method can meet basic communication needs in a normal network environment, but it has significant technical limitations in DDoS attack scenarios. The core idea of ​​existing related technical solutions all revolves around "SYN packet-triggered flow table establishment," without in-depth optimization for the surge in flow table load and the need for efficient aging under DDoS attacks. Summary of the Invention

[0004] The purpose of this invention is to provide a two-stage flow table establishment method that supports SYN FLOOD protection. Through a two-stage design of "temporary table caching + formal table establishment", the method uses "SYN+ACK pairing" as the sole trigger condition for formal flow table establishment. It utilizes "time wheel + hash table" to achieve efficient aging of invalid SYN temporary table entries. When a SYN FLOOD attack occurs, it effectively reduces the occupation of invalid flow tables, lowers CPU load, achieves efficient mitigation of SYN FLOOD attacks, and ensures the normal establishment of legitimate connections.

[0005] To achieve one of the above-mentioned objectives, one embodiment of the present invention provides a two-stage flow table establishment method supporting SYN FLOOD protection, comprising:

[0006] Receive TCP packets in real time and identify packet types:

[0007] If it is identified as a SYN packet, its characteristics are extracted and recorded in the preset SYN temporary cache table;

[0008] If the packet is identified as an ACK packet, it is matched with all entries in the SYN temporary cache table. If the matching is successful, the connection corresponding to the matched SYN packet is a valid connection, and a formal flow table is established based on the SYN packet and the ACK packet.

[0009] As a further improvement of one embodiment of the present invention, the SYN temporary cache table adopts a storage structure of "time wheel + hash table".

[0010] As a further improvement to one embodiment of the present invention, the SYN temporary cache table specifically includes,

[0011] Use the characteristics of the SYN packet as a unique hash key and calculate the hash value of that key;

[0012] Store the characteristics of the SYN message and the associated time wheel bucket index into the bucket linked list corresponding to the SYN temporary cache table.

[0013] As a further improvement of one embodiment of the present invention, the time wheel adopts a ring-shaped multi-bucket structure, with each bucket corresponding to a fixed time slice precision; the pointer of each entry in the SYN temporary cache table is stored in the linked list of the Index-th bucket of the time wheel, and at the same time, the index of the associated time wheel bucket is recorded inside the SYN temporary cache entry.

[0014] Time wheel bucket index Index = (T expire / time slice_granularity )% (N), T expire The theoretical expiration time of the entry, time slice_granularity Where N is the time slice precision and N is the total number of barrels in the time wheel.

[0015] As a further improvement of one embodiment of the present invention, the theoretical expiration time of the entry is T. expire = T0 +T timeout T0 is the reception time of the SYN packet, T timeout This is the preset aging threshold.

[0016] As a further improvement to one embodiment of the present invention, it also includes,

[0017] While establishing the formal flow table based on SYN and ACK packets, the corresponding entries in the SYN temporary cache table are located and deleted using the time wheel bucket index.

[0018] As a further improvement to one embodiment of the present invention, it also includes,

[0019] If no ACK message successfully matches an entry in the SYN temporary cache table, the aging thread will clean up the SYN temporary cache table in batches according to a preset period.

[0020] As a further improvement to one embodiment of the present invention, the aging thread uses an independent logic counter to drive the time wheel to rotate, specifically including:

[0021] Within a preset period, the aging thread is woken up, the logical counter Tick is incremented by 1, and the current bucket index Index is calculated. current =Tick %N, where N is the total number of buckets in the time wheel;

[0022] Traversing the index current Perform a delete operation on all entries within the corresponding bucket.

[0023] To achieve one of the above-mentioned objectives, one embodiment of the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the establishment method described above.

[0024] To achieve one of the above-mentioned objectives, one embodiment of the present invention also provides an electronic device, comprising:

[0025] Memory, used to store computer programs;

[0026] A processor, used to execute the computer program, implements the steps of the establishment method as described above.

[0027] Compared with the prior art, the two-stage flow table establishment method of the present invention has the following advantages:

[0028] 1. Alleviating flow table pressure from SYN FLOOD attacks at the source: This invention adopts a two-stage structure of "temporary cache table + formal flow table". The formal flow table is only created after SYN+ACK pairing is successful, preventing flow establishment triggered by SYN packets alone. The large number of forged SYN packets in a SYN FLOOD attack will only be stored in the temporary cache table, without consuming core formal flow table resources. This fundamentally prevents the formal flow table from being exhausted, ensuring that legitimate user connections can be established normally.

[0029] 2. Reduce CPU and memory load under SYN FLOOD attack: Through the bidirectional association of "time wheel + hash table" and independent aging thread, the aging operation complexity is always O(1) and the time consumption is constant, regardless of the amount of SYN FLOOD attack traffic. This completely solves the problem of CPU load increasing linearly with attack traffic caused by traditional linked list traversal. At the same time, the temporary cache table only stores core information and invalid entries are quickly cleaned up in batches, which greatly reduces memory usage and prevents the device from being paralyzed due to resource exhaustion.

[0030] 3. High reliability and anti-interference: The time wheel is driven by an internal logic counter, which completely decouples the system's absolute time and is immune to logic errors caused by operating system clock jumps (NTP synchronization, manual modification). This ensures that the aging mechanism operates stably under SYN FLOOD attack scenarios, continuously playing a mitigating role and ensuring the normal operation of the equipment. Attached Figure Description

[0031] Figure 1 This is a structural framework diagram of the two-stage flow meter device supporting SYN FLOOD protection according to the present invention.

[0032] Figure 2 This is the overall flowchart of the two-stage flow table method for supporting SYN FLOOD protection in this invention.

[0033] Figure 3 This is a flowchart illustrating the specific process of time wheel aging. Detailed Implementation

[0034] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0035] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0036] The purpose of this invention is to provide a two-stage flow table establishment method supporting SYN FLOOD protection. Through a two-stage design of "temporary table caching + formal table establishment," and using "SYN+ACK pairing" as the sole trigger condition for formal flow table establishment, it utilizes a "time wheel + hash table" to achieve efficient aging of invalid SYN temporary table entries. When a SYN FLOOD attack occurs, it effectively reduces the occupation of invalid flow tables, lowers CPU load, achieves efficient mitigation of SYN FLOOD attacks, and ensures the normal establishment of legitimate connections. Figure 2 As shown, the specific steps include:

[0037] Step 1: Message Reception and Preliminary Processing

[0038] The network device receives TCP packets sent by the client in real time and parses the TCP header flags: if it is identified as a SYN packet (SYN=1, ACK=0), it does not directly establish a formal flow table (to avoid invalid SYN packets occupying formal flow table resources), but extracts its core characteristics (source IP, destination IP, destination port) and enters it into the preset SYN temporary cache table (first-stage flow table), and proceeds to step 2 for caching and aging management; if it is identified as an ACK packet (SYN=0, ACK=1), it is used as input for pairing verification and proceeds to step 4; if it is identified as other packets, it is processed according to the normal process (i.e., subsequent business processing such as security detection and routing forwarding).

[0039] Step 2: Storage and Aging Management of SYN Temporary Cache Tables

[0040] The SYN temporary cache table adopts a "time wheel + hash table" storage structure, balancing storage efficiency and aging management efficiency. Its core function is to temporarily cache SYN packet information and efficiently age and clean up invalid packets (forged SYN packets), providing support for subsequent SYN+ACK pairing detection and the establishment of formal flow tables. The specific design is as follows:

[0041] (1) Design of SYN temporary cache table

[0042] Key-value design: The triplet of "source IP + destination IP + destination port" in the SYN packet is used as the unique hash key. Compared with the five-tuple, the triplet can better aggregate SYN FLOOD attack traffic targeting the same service in the SYN phase, and reduce the amount of computation, improving caching and query efficiency.

[0043] Hash Algorithm: The hash value of the key is calculated using the CRC algorithm (preferably CRC32). The CRC algorithm has the advantages of fast calculation speed, acceleration by utilizing dedicated CPU instruction sets, and low resource consumption, which greatly reduces the CPU usage of hash calculation under high concurrency.

[0044] Storage Structure: The core information of SYN packets is stored in the bucket linked list corresponding to the SYN temporary cache table. Specific storage information includes the source IP (sip), destination IP (dip), destination port (sport), and the associated time wheel bucket index. The table entry is then added to the corresponding position in the time wheel for subsequent aging and cleanup. When a SYN FLOOD attack occurs, a large number of forged SYN packets are stored in this temporary cache table, without consuming resources from the formal flow table, thus minimizing memory consumption.

[0045] (2) Time wheel design

[0046] The core function of the time wheel is to efficiently age invalid entries in the SYN temporary cache table (SYN message entries that failed to pair successfully, i.e., forged message entries in a SYN FLOOD attack), avoiding memory exhaustion and excessive CPU load caused by a large accumulation of invalid entries under a SYN FLOOD attack. Its association logic with the SYN temporary cache table and the deployment method of the aging thread are clearly defined as follows:

[0047] ① Association logic with the SYN temporary cache table:

[0048] The time wheel adopts a circular multi-bucket structure, with each bucket corresponding to a fixed time slice precision (e.g., 100 milliseconds), which can be adjusted according to the actual network environment. The total coverage must be greater than a preset aging threshold (e.g., 2 seconds). The system maintains a global atomic variable (global_current_tick), which is automatically incremented by 1 by the aging thread after each time slice. Each entry in the SYN temporary cache table establishes a bidirectional association with the corresponding bucket of the time wheel upon storage, as follows:

[0049] 1. Obtain the SYN packet reception time T0 and the preset aging threshold T. timeout For example, 2 seconds).

[0050] 2. Calculate the theoretical maturity time of this item: T expire = T0 + T timeout .

[0051] 3. Calculate the time wheel bucket index: Index = (T expire / time slice_granularity ) % N, where N is the total number of buckets in the time wheel, time slice_granularity For time slice precision.

[0052] 4. Store the pointer to the SYN temporary cache entry into the linked list of the Index bucket of the time wheel, and at the same time record the time wheel bucket index time_wheel_index associated with it inside the SYN temporary cache entry.

[0053] This bidirectional association ensures both fast querying of the SYN temporary cache table and batch aging of SYN temporary cache entries through a time wheel. When an entry needs to be deleted early (e.g., a SYN+ACK hit, indicating a valid connection), the corresponding position in the time wheel can be directly located through the time wheel bucket index recorded in the SYN temporary cache entry, allowing for quick removal of the pointer without traversal searching. When an entry expires without a matching (i.e., an invalid SYN packet or a SYN FLOOD attack packet), it is cleaned up in batches by the time wheel to prevent accumulation.

[0054] ②Aging thread:

[0055] The packet sending and receiving module is a core module of the network device, and its processing efficiency must be prioritized. To avoid aging operations consuming packet sending and receiving resources, a separate aging thread is used, completely decoupled from the packet sending and receiving module and not embedded in it. The aging thread is bound to an independent CPU core, while the packet sending and receiving thread is bound to other cores. This CPU core binding avoids resource contention and cache line conflicts. The aging thread is set to real-time priority (SCHED_FIFO) to ensure that the timer rotates on time, avoiding timeout cleanup delays that could lead to temporary table bloat, and further alleviating the pressure caused by SYN FLOOD attacks.

[0056] The aging thread employs a lock-free design, and the time wheel bucket linked list uses a lock-free RCU (Read-Copy-Update) mechanism. The send / receive thread does not need to lock when reading the SYN temporary cache table, and the aging thread uses atomic operations for deletion, ensuring concurrency safety. The aging thread uses an independent logical counter to drive the time wheel's rotation, periodically woken up by a high-precision timer at fixed time slices (the same as the time wheel, such as 100ms). Each wake-up only requires incrementing the internal logical pointer and locating the current time wheel bucket index through modulo operations, avoiding the overhead and clock jump risk of frequently obtaining the system's absolute time. Figure 3 As shown, the specific process is as follows:

[0057] 1. Pointer advance: When a thread is woken up, the internal logical counter Tick (i.e., the global atomic variable (global_current_tick)) is incremented by 1, and the current bucket index Index = Tick % N is calculated.

[0058] 2. Batch Deletion: Traverse all entry pointers within the bucket corresponding to the Index. Since entries were already positioned according to relative timeouts during insertion, all entries falling into the current bucket are considered expired. No secondary time difference verification is needed; the deletion operation is performed directly, removing the pointer reference of the entry from the linked list of the time wheel bucket. At this point, the time wheel no longer holds the index of the entry, but the data structure of the entry itself is still retained in the SYN temporary cache table (Hash table).

[0059] 3. Resource release: Synchronously clear the corresponding entries in the SYN temporary cache table (Hash table) and the time wheel pointer to release memory.

[0060] 4. Idle Optimization: If the current bucket is empty, skip directly and the thread immediately enters sleep mode to wait for the next cycle.

[0061] In this way, no matter how many invalid entries are brought by the SYN FLOOD attack, the complexity of each aging operation is O(1), and the time consumption is constant, which completely solves the problem of excessive aging load and memory accumulation under SYN FLOOD attack and achieves attack mitigation.

[0062] Step 3: SYN+ACK pairing detection

[0063] Network devices continuously monitor ACK packets, extract ACK packet characteristics, calculate hash values ​​using the CRC32 algorithm, and query the SYN temporary cache table. If a match is found, it indicates that the connection corresponding to the SYN packet is a legitimate connection (not a forged packet from a SYN FLOOD attack), completing the core verification before the three-way handshake, and proceeding to step 4; if the match fails (a forged packet from a SYN FLOOD attack, with no corresponding ACK packet), the ACK packet is processed according to the normal procedure (i.e., subsequent business processing such as security checks and routing forwarding), and the corresponding SYN temporary table entry is subsequently cleaned up by the aging thread.

[0064] Step 4: Flow table creation and resource cleanup

[0065] If a successful SYN+ACK pairing is detected, the connection is considered legitimate. The network device will establish a formal flow table (second-stage flow table) based on the combined information of the SYN and ACK packets (source IP, destination IP, source port, destination port, protocol) for subsequent legitimate data forwarding. Simultaneously, it will use a time-wheel bucket index to locate and delete the corresponding entry in the SYN temporary cache table, efficiently releasing resources. It is worth noting that this temporary caching mechanism retains complete SYN packet characteristics and context information, not only for connection status confirmation but also providing a standardized data interface and expansion capabilities for potentially future SYN-based deep service detection (such as fingerprinting and abnormal behavior analysis). This allows for rapid loading of detection logic without the need to re-capture or parse packets, enabling a smooth evolution of service capabilities.

[0066] If no ACK packet matches the corresponding SYN temporary cache entry (i.e., to deal with forged packets in SYN FLOOD attacks), the aging thread will clean it up in batches according to a preset period. This process does not occupy formal flow table resources, which effectively alleviates the attack pressure and ensures that the underlying detection framework can still maintain its ability to support future new detection services when facing high-concurrency forged requests.

[0067] Specifically, to implement the above method, the present invention also proposes an apparatus, such as... Figure 1 As shown, it includes the following functional modules, which work together:

[0068] 1. Message Reception and Identification Module: Receives TCP messages in real time, identifies message types (with a focus on SYN and ACK messages), extracts the core features of SYN messages to support subsequent temporary table storage, and processes non-SYN and non-ACK messages according to the conventional process.

[0069] 2. SYN Temporary Cache Table Module: This module incorporates a "time wheel + hash table" structure, serving as the first stage (temporary cache stage) of the two-stage flow table. It is responsible for the rapid storage and retrieval of SYN packet information, as well as the bidirectional association maintenance with the time wheel. It only temporarily caches SYN packet information and does not establish a formal flow table. It receives instructions from the pairing detection module to delete successfully paired entries and receives instructions from the aging management module to batch delete expired and invalid entries, preventing the accumulation of invalid entries.

[0070] 3. Pairing Detection Module: Receives subsequent handshake ACK messages, calculates the hash value using the CRC algorithm, queries the SYN temporary cache table, and verifies the legality of the SYN message; if a match is successful, it sends a flow creation command to the flow table creation module and a deletion command to the SYN temporary cache table module, completing the switch from the temporary table to the formal table.

[0071] 4. Flow table establishment module: As the second stage (formal forwarding stage) of the two-phase flow table, it only receives flow establishment instructions from the pairing detection module, establishes formal flow tables based on the complete five-tuple of the TCP connection, and uses them for the forwarding of subsequent legitimate data. It does not receive flow establishment requests from individual SYN packets.

[0072] 5. Aging Management Module: Deploy an independent aging thread, bind it to a dedicated CPU core and set the SCHED_FIFO real-time priority. Use the RCU lock-free mechanism to drive the time wheel to rotate. After periodically waking up according to the preset time slice precision, locate the current bucket of the time wheel through the logic counter and perform a batch expired table entry deletion operation with O(1) complexity. Simultaneously clean up the Hash table and the data associated with the time wheel. Do not compete with the packet sending and receiving module for CPU resources. In the event of a SYN FLOOD attack, quickly clean up a large number of invalid table entries to alleviate the pressure of resource occupation.

[0073] The present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the two-stage flow table establishment method for supporting SYN FLOOD protection as described above.

[0074] The present invention also provides a storage medium storing a computer program, which, when executed by a processor, implements the steps in the two-stage flow table establishment method for supporting SYN FLOOD protection as described above.

[0075] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the modules described above can be referred to the corresponding process in the aforementioned method implementation, and will not be repeated here.

[0076] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0077] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0078] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer system (which may be a personal computer, server, or network system, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A two-stage flow table establishment method supporting SYN FLOOD protection, characterized in that, include, Receive TCP packets in real time and identify packet types: If it is identified as a SYN packet, its features are extracted. And record it into the preset SYN temporary cache table; If the packet is identified as an ACK packet, it is matched with all entries in the SYN temporary cache table. If the matching is successful, the connection corresponding to the matched SYN packet is a valid connection, and a formal flow table is established based on the SYN packet and the ACK packet.

2. The method for establishing as described in claim 1, characterized in that, The SYN temporary cache table adopts a storage structure of "time wheel + hash table".

3. The method for establishing as described in claim 2, characterized in that, The SYN temporary cache table specifically includes, Use the characteristics of the SYN packet as a unique hash key and calculate the hash value of that key; Store the characteristics of the SYN message and the associated time wheel bucket index into the bucket linked list corresponding to the SYN temporary cache table.

4. The method for establishing as described in claim 2, characterized in that, The time wheel adopts a ring-shaped multi-bucket structure, with each bucket corresponding to a fixed time slice precision; the pointer of each entry in the SYN temporary cache table is stored in the linked list of the Index-th bucket of the time wheel, and the index of the associated time wheel bucket is recorded inside the SYN temporary cache entry. Time wheel bucket index Index = (T expire / time slice_granularity ) %(N), T expire The theoretical expiration time of the entry, time slice_granularity Where N is the time slice precision and N is the total number of barrels in the time wheel.

5. The method for establishing as described in claim 4, characterized in that, The theoretical expiration time of the entry is T. expire = T0+ T timeout T0 is the reception time of the SYN packet, T timeout This is the preset aging threshold.

6. The method for establishing as described in claim 2, characterized in that, It also includes, While establishing the formal flow table based on SYN and ACK packets, the corresponding entries in the SYN temporary cache table are located and deleted using the time wheel bucket index.

7. The method for establishing as described in claim 2, characterized in that, It also includes, If no ACK message successfully matches an entry in the SYN temporary cache table, the aging thread will clean up the SYN temporary cache table in batches according to a preset period.

8. The method for establishing as described in claim 7, characterized in that, The aging thread uses an independent logic counter to drive the time wheel to rotate, specifically including... Within a preset period, the aging thread is woken up, the logical counter Tick is incremented by 1, and the current bucket index Index is calculated. current =Tick % N, where N is the total number of buckets in the time wheel; Traversing the index current Perform a delete operation on all entries within the corresponding bucket.

9. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the establishment method as described in claims 1 to 8.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the establishment method as described in claims 1 to 8.

Images