Attack detection method, apparatus, device, medium, and program product

Abstract

The application relates to an attack detection method, device, equipment, medium and program product, and is applied to a data processing unit. The method comprises the following steps: firstly, forwarding a received message to a first extensible subfunction through a virtual network bridge and entering the message into a plurality of preset hardware pipes through the first extensible subfunction; then, matching and forwarding the message according to each hardware pipe, and determining a transmission control protocol (TCP) synchronization message; finally, obtaining a TCP synchronization message statistical value of a target internet protocol (IP) address to which the TCP synchronization message belongs, obtaining a total TCP message value of the target IP address through the hardware pipe, obtaining a synchronization message ratio of the target IP address based on a ratio of the TCP synchronization message statistical value and the total TCP message value, and determining that the TCP synchronization message is an attack message if the synchronization message ratio is greater than or equal to a preset ratio threshold. The method can reduce detection delay and improve attack detection efficiency.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an attack detection method, apparatus, device, medium, and program product. Background Technology

[0002] With the development of cloud services, cloud service providers face the significant challenge of Distributed Denial of Service (DDoS) attacks. One common technique in DDoS attacks is the TCP SYN (Transmission Control Protocol Synchronize) flood attack. Attackers use multiple distributed hosts to simultaneously send a large number of TCP SYN requests with forged source IPs (Internet Protocol) to the target server, exhausting the target server's bandwidth or system resources, preventing legitimate connections from being established, and causing normal users to be unable to obtain services.

[0003] Traditional technologies typically use rule-based or machine learning methods to centrally analyze packets from target servers. However, this approach relies on the target server's CPU (Central Processing Unit) for analysis and decision-making, resulting in high detection latency and low detection efficiency. Summary of the Invention

[0004] Therefore, it is necessary to provide an attack detection method, apparatus, equipment, medium, and program product that can improve detection efficiency in response to the above-mentioned technical problems.

[0005] Firstly, this application provides an attack detection method applied to a data processing unit, the method comprising:

[0006] The received message is forwarded to the first expandable sub-function through the virtual bridge, and then enters multiple preset hardware channels through the first expandable sub-function.

[0007] The messages are matched and forwarded according to the hardware pipes, and the Transmission Control Protocol (TCP) synchronization messages are determined.

[0008] Obtain the TCP synchronization packet statistics for the target Internet Protocol IP address to which the TCP synchronization packet belongs, and obtain the total number of TCP packets for the target IP address through a hardware pipe;

[0009] The ratio of synchronization packets to the total number of TCP packets is used to obtain the synchronization packet ratio of the target IP address.

[0010] If the synchronization message ratio is greater than or equal to a preset ratio threshold, then the TCP synchronization message is determined to be an attack message.

[0011] In one embodiment, the hardware pipes include a blacklist pipe and a control pipe. The hardware pipes match and forward packets, and determine the Transmission Control Protocol (TCP) synchronization packets, including:

[0012] The blacklist pipeline matches packets based on a preset matching rule table, forwards unmatched packets to the control pipeline, and discards successfully matched packets.

[0013] The control pipe matches the received unmatched messages according to the synchronization flag, and determines the TCP synchronization message based on the matching result.

[0014] In one embodiment, the hardware pipeline further includes a counter pipeline and a synchronization pipeline, and the method further includes:

[0015] The control pipe forwards packets that match non-TCP types to the second expandable sub-function, packets that match TCP normal types to the counter pipe, and packets that match TCP synchronization types and do not exceed the rate limit threshold are identified as TCP synchronization packets and forwarded to the synchronization pipe.

[0016] In one embodiment, the hardware pipe also includes a synchronization miss pipe, and the method further includes:

[0017] The TCP synchronization message is matched against a preset list of IP addresses using a synchronization pipe. If no match is found, the TCP synchronization message is forwarded to the synchronization miss pipe. If a match is found, a first metadata value is written to the TCP synchronization message, and the TCP synchronization message carrying the first metadata value is forwarded to the processor. The preset list of IP addresses includes IP addresses with established TCP connections.

[0018] In one embodiment, the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs are obtained, and the total number of TCP packets of the target IP address is obtained through a hardware pipe, including:

[0019] The TCP synchronization packet statistics for the target IP address are obtained based on the first metadata value of the received TCP synchronization packet, and the total number of TCP packets for the target IP address is obtained through the counter pipe.

[0020] In one embodiment, the method further includes:

[0021] The second metadata value is written into the received TCP synchronization message through the synchronization miss pipe, and the TCP synchronization message carrying the second metadata value is forwarded to the processor;

[0022] The target IP address of the TCP synchronization message carrying the second metadata value is sent to the synchronization pipe and counter pipe to update the IP address list.

[0023] In one embodiment, the hardware pipeline further includes a root pipeline, and the method further includes:

[0024] The root pipe performs protocol matching on the packets forwarded by the first extensible sub-function based on the packet protocol. If the protocol match is successful, the packet is forwarded to the blacklist pipe. If the protocol match is unsuccessful, the packet is discarded.

[0025] In one embodiment, after determining that a TCP synchronization message is an attack message if the synchronization message ratio is greater than or equal to a preset ratio threshold, the method further includes:

[0026] If the TCP synchronization message is an attack message, the target IP address will be sent to the blacklist pipeline to update the matching rule table.

[0027] In one embodiment, the method further includes:

[0028] If the synchronization message ratio is less than the preset ratio threshold, the TCP synchronization message of the target IP address will be forwarded to the second expandable sub-function.

[0029] Secondly, this application also provides an attack detection device deployed in a data processing unit, the device comprising:

[0030] The forwarding module is used to forward the received packets to the first expandable sub-function through the virtual bridge, and then to multiple preset hardware pipes through the first expandable sub-function.

[0031] The first determining module is used to match and forward messages according to each hardware pipe, and to determine the Transmission Control Protocol (TCP) synchronization message;

[0032] The acquisition module is used to obtain the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and to obtain the total number of TCP packets of the target IP address through hardware pipes;

[0033] The calculation module is used to obtain the synchronization packet ratio of the target IP address based on the ratio of the TCP synchronization packet statistics to the total number of TCP packets.

[0034] The second determination module is used to determine that if the synchronization message ratio is greater than or equal to a preset ratio threshold, the TCP synchronization message is an attack message.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any of the first aspects above.

[0036] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the first aspects above.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in any of the first aspects above.

[0038] The aforementioned attack detection methods, devices, equipment, media, and program products are applied to a data processing unit. First, received packets are forwarded to a first expandable sub-function via a virtual bridge, and then enter multiple preset hardware pipes. Next, packets are matched and forwarded according to each hardware pipe, identifying Transmission Control Protocol (TCP) synchronization packets. Finally, the TCP synchronization packet statistics for the target Internet Protocol (IP) address to which the TCP synchronization packet belongs are obtained, and the total number of TCP packets for the target IP address is obtained through the hardware pipes. The synchronization packet ratio for the target IP address is calculated based on the ratio of the TCP synchronization packet statistics to the total number of TCP packets. If the synchronization packet ratio is greater than or equal to a preset ratio threshold, the TCP synchronization packet is determined to be an attack packet. In this way, attack detection is offloaded to the data processing unit. Packet matching and forwarding are implemented through the hardware pipes of the data processing unit, and the determination of whether a packet is an attack packet is based on the synchronization packet ratio of the target IP address. This eliminates the need for the target server's CPU to participate in analysis and decision-making, making the judgment method simple and efficient, reducing detection latency, and thus improving attack detection efficiency. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a diagram illustrating the application environment of an attack detection method in one embodiment;

[0041] Figure 2 This is a flowchart illustrating an attack detection method in one embodiment;

[0042] Figure 3 This is a flowchart illustrating the TCP synchronization message determination steps in one embodiment;

[0043] Figure 4 This is a schematic diagram of the hardware and software architecture and packet flow of an attack detection method in one embodiment;

[0044] Figure 5 This is a structural block diagram of an attack detection device in one embodiment;

[0045] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0047] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0048] The attack detection method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, the data processing unit 102 is communicatively connected to the target server 104. The data processing unit 102 can be a new type of programmable processor specifically designed for data centers. By offloading network, storage, virtualization, and security tasks through hardware, it reduces the CPU burden on the target server 104 and improves its efficiency. The target server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0049] In one exemplary embodiment, such as Figure 2 As shown, an attack detection method is provided, which can be applied to... Figure 1 The following explanation is based on the data processing unit in the example, including steps 201 to 205. Wherein:

[0050] Step 201: The received message is forwarded to the first scalable sub-function through the virtual bridge, and then enters multiple preset hardware pipes through the first scalable sub-function.

[0051] The virtual bridge can be an OVS (Open vSwitch) bridge running on the data processing unit, used to connect different network ports and forward data packets according to rules. The first scalable sub-function is SF1 (Scalable Function). SF is a lightweight PCIe instance that can be generated on demand and allocated independently in the data processing unit. SF has its own queue and BAR (Base Address Register) space.

[0052] When a packet enters the data processing unit through the network-side physical port (i.e., the external network) or the target server-side virtual port (i.e., the target server's CPU), the OVS bridge forwards the received packet to the first expandable sub-function according to preset rules. This means the packet enters the dedicated queue of the first expandable sub-function. The first expandable sub-function serves as the entry point for multiple preset hardware pipes. Therefore, packets enter multiple hardware pipes for processing through the first expandable sub-function, completely offloading the packet to the data processing unit, eliminating the need for processing on the target server's CPU side. Because the first expandable sub-function has a dedicated queue, the packet traffic entering the hardware pipes can be controlled through this dedicated queue, avoiding sudden traffic interference and thus ensuring the stability of the hardware pipe processing.

[0053] Step 202: Match and forward the messages according to each hardware pipe, and determine the Transmission Control Protocol (TCP) synchronization message.

[0054] Each hardware pipeline is a series of "match-action" processing pipelines pre-built in the hardware acceleration engine of the data processing unit via the DOCA Flow API (DOCA Flow Application Programming Interface). Each hardware pipeline consists of several hardware rules used to perform operations such as classification, counting, rate limiting, or forwarding on specific types of packets. Each hardware pipeline runs on the data path accelerator of the data processing unit, isolated from the processor of the data processing unit and the CPU of the target server, thus enabling the processing of massive numbers of packets at line speed without introducing additional latency.

[0055] The packets received from the first scalable sub-function are matched and forwarded according to the preset rules of each hardware pipe. TCP synchronization packets of type TCP synchronization are filtered out, that is, TCP packets with the SYN flag set to 1. Thus, TCP SYN flood attack detection can be performed based on TCP synchronization packets.

[0056] Step 203: Obtain the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and obtain the total number of TCP packets of the target IP address through the hardware pipe.

[0057] After each TCP synchronization packet is filtered out in the hardware pipeline, it is forwarded to the processor of the data processing unit for processing. The processor determines the IP address to which the TCP synchronization packet belongs based on the received TCP synchronization packet, and counts the TCP synchronization packets received for each IP address to obtain the number of TCP synchronization packets for different IP addresses.

[0058] For the currently received TCP synchronization message, determine the target IP address to which the TCP synchronization message belongs, and thus obtain the TCP synchronization message statistics for the target IP address.

[0059] The total number of TCP packets can include the number of TCP synchronization packets sent to the target IP address and the number of TCP normal packets. TCP normal packets are those where the SYN flag is set to 0. By counting all TCP packets through a hardware pipe, the number of TCP packets for different IP addresses can be obtained, thus enabling the acquisition of the total number of TCP packets for the target IP address.

[0060] Step 204: Obtain the synchronization packet ratio of the target IP address based on the ratio of the TCP synchronization packet statistics to the total number of TCP packets.

[0061] In normal business traffic, the proportion of TCP sync packets used to establish new TCP connections is typically low, such as below 5%-10% of the total TCP packets. However, in a TCP SYN flood attack, attackers send a massive number of TCP sync packets with forged target IP addresses, causing the proportion of TCP sync packets to surge dramatically. This exhausts the target server's bandwidth or system resources, preventing legitimate connections from being established and thus depriving normal users of service. Therefore, the ratio of TCP sync packets to the target IP address can be used to determine whether a TCP SYN flood attack has occurred.

[0062] The synchronization packet ratio of the target IP address is calculated based on the ratio of the TCP synchronization packet statistics corresponding to the target IP address to the total number of TCP packets obtained above, as shown below.

[0063] Synchronization message ratio = TCP synchronization message statistics / total number of TCP messages.

[0064] Step 205: If the synchronization message ratio is greater than or equal to the preset ratio threshold, then the TCP message is determined to be an attack message.

[0065] If the synchronization message ratio is greater than or equal to a preset ratio threshold, meaning that too many TCP synchronization messages are currently being sent by the target IP address, there may be a large number of attackers spoofing the target IP address. In this case, the TCP message is determined to be an attack message and can be discarded.

[0066] If the synchronization message ratio is less than a preset ratio threshold, the TCP synchronization message is considered a normal synchronization data packet. In this case, the TCP synchronization message is forwarded to the sending queue of the second expandable sub-function, which then forwards it to the target server for processing. SF2 can directly forward messages to the network-side P0 via other single hardware pipes, bypassing any CPU and ensuring return line speed.

[0067] In the above embodiments, applied to the data processing unit, firstly, the received packets are forwarded to a first expandable sub-function via a virtual bridge, and then enter multiple preset hardware pipes through the first expandable sub-function. Next, packets are matched and forwarded according to each hardware pipe, and Transmission Control Protocol (TCP) synchronization packets are identified. Finally, the TCP synchronization packet statistics value of the target Internet Protocol (IP) address to which the TCP synchronization packet belongs is obtained, and the total number of TCP packets for the target IP address is obtained through the hardware pipes. Based on the ratio of the TCP synchronization packet statistics value to the total number of TCP packets, the synchronization packet ratio of the target IP address is obtained. If the synchronization packet ratio is greater than or equal to a preset ratio threshold, the TCP synchronization packet is determined to be an attack packet. In this way, attack detection is offloaded to the data processing unit. Packet matching and forwarding are implemented through the hardware pipes of the data processing unit, and the determination of whether a packet is an attack packet is based on the synchronization packet ratio of the target IP address. This eliminates the need for the target server's CPU to participate in analysis and decision-making, making the judgment method simple and efficient, reducing detection latency, and thus improving attack detection efficiency.

[0068] In one embodiment, the hardware pipeline includes a root pipeline, which performs protocol matching on the packets forwarded by the first extensible sub-function based on the packet protocol. If the protocol matching is successful, the packet is forwarded to the blacklist pipeline; if the protocol matching is unsuccessful, the packet is discarded.

[0069] The root pipe is used for initial protocol screening, filtering packets that conform to the IPv4 protocol. Packets forwarded by the first extensible subfunction enter the root pipe. Based on the packet protocol, the root pipe performs protocol matching on the Ethernet type field of the received packet. For example, the EtherType field corresponds to 0x0800 for the IPv4 protocol. By matching whether the EtherType field is 0x0800, it can be determined whether the received packet is an IPv4 protocol packet. If the protocol match is successful, meaning the received packet is an IPv4 protocol packet, the packet is forwarded to the blacklist pipe for further screening. If the protocol match fails, meaning the received packet is not an IPv4 protocol packet, the packet is discarded.

[0070] In one embodiment, the hardware pipes include a blacklist pipe and a control pipe. The steps for matching and forwarding packets according to each hardware pipe, and determining the Transmission Control Protocol (TCP) synchronization packet, are as follows: Figure 3 As shown, it may include:

[0071] Step 301: The blacklist pipe matches the packets based on a preset matching rule table, forwards unmatched packets to the control pipe, and discards the matched packets.

[0072] The pre-defined matching rule table can include multiple blacklisted IP addresses that pose a risk of sending attack packets. These blacklisted IP addresses can be identified and recorded from historical attack detections or detected and pre-configured through other methods. The blacklist pipeline matches the IP addresses of packets against the matching rule table. If a match is found (i.e., the IP address of the packet exists in the matching rule table), the packet is likely malicious and can be discarded without being reported to the data processing unit's processor or the target server. If no match is found (i.e., the IP address of the packet does not exist in the matching rule table), the packet is forwarded to the control pipeline for further matching.

[0073] Step 302: The received unmatched messages are matched according to the synchronization flag bit through the control pipe, and the TCP synchronization message is determined according to the matching result.

[0074] The control pipe is used to detect whether received packets that failed to match a blacklisted packet are TCP synchronization packets. The control pipe matches received unmatched packets based on the L4 (Transport Layer) protocol, reading the protocol number field in the IP address header of the received unmatched packet and determining whether the packet is a TCP packet based on the value of this field. If so, it further checks the SYN flag in the TCP header and determines whether the TCP packet is a TCP synchronization packet based on the value of the SYN flag.

[0075] For example, the hardware pipeline also includes a counter pipeline and a synchronization pipeline. The control pipeline forwards packets with matching results of non-TCP type to the second extensible sub-function, forwards packets with matching results of TCP normal type to the counter pipeline, and identifies packets with matching results of TCP synchronization type that do not exceed the rate limit threshold as TCP synchronization packets and forwards the TCP synchronization packets to the synchronization pipeline.

[0076] The control pipe reads the protocol number field from the IP address header of the received packet. If this field value is 6, it indicates that the L4 protocol of the packet is TCP, meaning the packet is a TCP type. It then reads the SYN flag in the TCP header. If SYN=1, the packet is determined to be a TCP synchronization type. If the number of packets forwarded by the control pipe does not exceed the rate limit configured for the control pipe, the packet is identified as a TCP synchronization packet and forwarded to the synchronization pipe. The synchronization pipe further determines whether the TCP synchronization packet is a flood attack packet. The rate limit can be configured to a maximum of 250k packets per second.

[0077] If SYN=0, the matching result indicates that the packet is a normal TCP type. The normal TCP type packet is forwarded to the counter pipe for counting and forwarding only. If the protocol number field value is not 6, meaning the L4 protocol of the packet is not TCP, and the packet is a non-TCP type, the non-TCP type packet is forwarded to the second extensible sub-function, bypassing the data processing unit's processor and directly forwarded to the target server without attack detection.

[0078] The system uses a counter pipe to count received TCP packets of the same type. It matches the packet's IP address against a pre-defined list of IP addresses in the counter pipe. This list can include IP addresses with established TCP connections. If a match is found, the hardware counter is updated by incrementing the total number of TCP packets corresponding to that IP address, and the packet is forwarded to the target server. If a match is not found, meaning the packet's IP address does not exist in the list of IP addresses with established TCP connections (i.e., no valid TCP connection has been established at that IP address), the packet is discarded.

[0079] In one embodiment, the hardware pipe further includes a synchronization miss pipe, and the method further includes: matching the target IP address of the TCP synchronization packet with a preset IP address list through the synchronization pipe; if the match fails, forwarding the TCP synchronization packet to the synchronization miss pipe; if the match succeeds, writing a first metadata value to the TCP synchronization packet, and forwarding the TCP synchronization packet carrying the first metadata value to the processor; the preset IP address list includes IP addresses with established TCP connections.

[0080] The synchronization channel matches the target IP address of the TCP synchronization packet with a preset IP address list. If a match is unsuccessful (meaning no TCP synchronization packet sent by the target IP address has been received yet), the TCP synchronization packet is forwarded to the synchronization miss channel. If a match is successful, a first metadata value is written to the TCP packet. This first metadata value is a pointer to the record of the target IP address in the processor memory of the data processing unit. Then, the TCP synchronization packet carrying the first metadata value is forwarded to the processor, which calculates the synchronization packet ratio.

[0081] The system writes a second metadata value to the received TCP synchronization message via the synchronization miss pipe, forwards the TCP synchronization message carrying the second metadata value to the processor, and sends the destination IP address of the TCP synchronization message carrying the second metadata value to the synchronization pipe and the counter pipe to update the IP address list.

[0082] The second metadata value can be 0. The TCP synchronization message carrying the second metadata value is forwarded to the processor via the synchronization miss pipe. Upon receiving the TCP synchronization message with the second metadata value, the processor determines that the metadata matches the second metadata value and creates a new IP record based on the target IP address to which the TCP synchronization message belongs. The target IP address is then sent to the synchronization pipe and the counter pipe, and added to their IP address lists. This allows the synchronization pipe and the counter pipe to recognize subsequent TCP synchronization messages sent from that target IP address.

[0083] In one embodiment, obtaining the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and obtaining the total number of TCP packets of the target IP address through a hardware pipe, includes: obtaining the TCP synchronization packet statistics of the target IP address based on the first metadata value of the received TCP synchronization packet, and obtaining the total number of TCP packets of the target IP address through a counter pipe.

[0084] The processor of the data processing unit receives the TCP synchronization message carrying the first metadata value sent by the synchronization pipe, obtains the target IP address record to which the TCP synchronization message belongs based on the first metadata value, accumulates the TCP synchronization message statistics of the current target IP address record to obtain the TCP synchronization message statistics, obtains the total number of TCP messages of the target IP address through the counter pipe, and calculates the synchronization message ratio of the target IP address based on the ratio of the TCP synchronization message statistics to the total number of TCP messages.

[0085] If a TCP synchronization packet is identified as an attack packet, the target IP address is sent to the blacklist channel to update the matching rule table. As mentioned above, if the synchronization packet ratio is greater than or equal to a preset ratio threshold, the TCP synchronization packet is determined to be an attack packet. Therefore, the TCP synchronization packet is discarded, and the target IP address is sent to the blacklist channel. The blacklist channel adds the target IP address to the matching rule table, so any subsequent packets received with that target IP address can be directly discarded.

[0086] For example, the processor cleans up records that have not been matched for a long time in the matching list of each hardware pipe according to a preset cycle, cleans up IP addresses that have not been matched successfully for a long time in the matching rule table of the blacklist pipe, and cleans up IP addresses that have not been matched successfully for a long time in the IP address list of the counter pipe and the synchronization pipe. By automatically cleaning up IP addresses that have not been used for a long time, the number of entries in each matching list is reduced, thereby freeing up the hardware resources of each hardware pipe.

[0087] In the embodiments of this application, such as Figure 4 As shown, a hardware and software architecture and packet flow diagram of an attack detection method are provided.

[0088] ① Data packets (messages) enter the physical port P0 of the data processing unit and enter the root pipe through the first expandable sub-function SF1. Data packets with the IPv4 protocol type are forwarded to the blacklist pipe through the root pipe, while non-IPv4 data packets are discarded.

[0089] ② The blacklist pipeline matches data according to the matching rule table. Data packets that match the blacklist IP address in the matching rule table (i.e., the source address is matched) are discarded, while other data packets that do not match are forwarded to the control pipeline.

[0090] ③ Layered matching is performed through the control pipe, forwarding data packets to the SYN pipe (synchronization pipe), TCP counter pipe (counter pipe), and the second extensible sub-function SF2. If the L4 protocol of the data packet is not TCP, the control pipe forwards the data packet to the second extensible sub-function SF2 for direct delivery to the target server. If the L4 protocol of the data packet is TCP, the SYN flag is 1, and the number of SYN packets does not exceed the rate limit threshold, the data packet is forwarded to the SYN pipe. If the L4 protocol of the data packet is TCP, and the SYN flag is 0, the data packet is forwarded to the TCP counter pipe. The TCP counter pipe matches the source IP address of the data packet against the IP address list. If a match is found, the data packet counter is updated, and the data packet is forwarded to the target server. If no match is found, the data packet is discarded.

[0091] ④ Through the SYN pipe, if the IP address list contains an entry matching the source IPv4 address of the data packet, a first metadata value is written to the data packet before redirecting it to the processor (ARM) of the data processing unit. This metadata value is assigned a specific value by the ARM for each source IPv4 address and points to a memory location storing relevant IP information (the number of SYN packets, the entry ID of the SYN pipe, the TCP counter pipe, and the blacklist pipe). If the IP address list does not contain an entry matching the source IPv4 address of the data packet (i.e., a miss), the data packet is forwarded to the SYN miss pipe (synchronization miss pipe). Through the synchronization miss pipe, a second metadata value, 0, is written to the data packet's metadata, and then the data packet is redirected to the ARM. The synchronization pipe and synchronization miss pipe can assign metadata information to the data packet, which can be accessed by the application and can therefore be considered as a connection point between the ARM and the offloaded hardware.

[0092] In the above embodiments, a rate-limiting threshold is set in the control pipeline, so the number of data packets processed by the processor of the data processing unit per second is fixed. Therefore, during a severe attack, the processor of the data processing unit will not be overloaded, and the maximum number of synchronization data packets per second arriving at the target server is also controlled, thereby preventing the target server from crashing.

[0093] Furthermore, a collaborative architecture is proposed, with the control plane on the ARM and the data plane on the hardware. The hardware pipeline is responsible for high-speed matching, counting, forwarding / dropping, while the ARM is responsible for state maintenance, attack judgment, and dynamic rule distribution. The synchronization packet ratio is used as the basis for attack judgment, which is simple, efficient, and does not require complex machine learning models, resulting in higher attack detection efficiency. By constructing a multi-level hardware pipeline chain (SF1 → root → blacklist → control → synchronization / counter / synchronization miss → SF2), fine-grained packet classification is achieved. Metadata fields are used to pass the hardware matching results to the ARM, achieving zero-copy state tracking.

[0094] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0095] Based on the same inventive concept, this application also provides an attack detection apparatus for implementing the attack detection method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more attack detection apparatus embodiments provided below can be found in the limitations of the attack detection method described above, and will not be repeated here.

[0096] In one exemplary embodiment, such as Figure 5 As shown, an attack detection device 500 is provided, deployed in a data processing unit, including: a forwarding module, a first determination module, an acquisition module, a calculation module, and a second determination module, wherein:

[0097] The forwarding module is used to forward the received packets to the first expandable sub-function through the virtual bridge, and then to multiple preset hardware pipes through the first expandable sub-function.

[0098] The first determining module is used to match and forward messages according to each hardware pipe, and to determine the Transmission Control Protocol (TCP) synchronization message;

[0099] The acquisition module is used to obtain the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and to obtain the total number of TCP packets of the target IP address through hardware pipes;

[0100] The calculation module is used to obtain the synchronization packet ratio of the target IP address based on the ratio of the TCP synchronization packet statistics to the total number of TCP packets.

[0101] The second determination module is used to determine that if the synchronization message ratio is greater than or equal to a preset ratio threshold, the TCP synchronization message is an attack message.

[0102] In one embodiment, the hardware pipe includes a blacklist pipe and a control pipe. The first determining module is specifically used to match packets based on a preset matching rule table through the blacklist pipe, forward unmatched packets to the control pipe, and discard successfully matched packets; and to match the received unmatched packets according to the synchronization flag bit through the control pipe, and determine the TCP synchronization packet based on the matching result.

[0103] In one embodiment, the hardware pipeline further includes a counter pipeline and a synchronization pipeline. The device also includes a second forwarding module, which forwards packets with matching results of non-TCP type to a second extensible sub-function via the control pipeline, forwards packets with matching results of TCP normal type to the counter pipeline, identifies packets with matching results of TCP synchronization type and not exceeding the rate limit threshold as TCP synchronization packets, and forwards the TCP synchronization packets to the synchronization pipeline.

[0104] In one embodiment, the hardware pipeline further includes a synchronization miss pipeline, and the device further includes a third forwarding module for matching the target IP address of the TCP synchronization message with a preset IP address list through the synchronization pipeline. If the match fails, the TCP synchronization message is forwarded to the synchronization miss pipeline. If the match succeeds, a first metadata value is written to the TCP synchronization message, and the TCP synchronization message carrying the first metadata value is forwarded to the processor. The preset IP address list includes IP addresses with established TCP connections.

[0105] In one embodiment, the acquisition module is specifically used to obtain the TCP synchronization packet statistics of the target IP address based on the first metadata value of the received TCP synchronization packet, and to obtain the total number of TCP packets of the target IP address through a counter pipeline.

[0106] In one embodiment, the device further includes a first update module, configured to write a second metadata value to the received TCP synchronization message through the synchronization miss pipe, and forward the TCP synchronization message carrying the second metadata value to the processor; and send the target IP address to which the TCP synchronization message carrying the second metadata value belongs to the synchronization pipe and the counter pipe to update the IP address list.

[0107] In one embodiment, the hardware pipeline further includes a root pipeline, and the device further includes a fourth forwarding module for performing protocol matching on the packets forwarded by the first extensible sub-function based on the message protocol through the root pipeline. If the protocol matching is successful, the packet is forwarded to the blacklist pipeline; if the protocol matching is unsuccessful, the packet is discarded.

[0108] In one embodiment, the apparatus further includes a second update module for sending the target IP address to the blacklist pipeline to update the matching rule table if the TCP synchronization message is an attack message.

[0109] In one embodiment, the device further includes a fourth forwarding module, configured to forward TCP synchronization packets of the target IP address to a second scalable subfunction if the synchronization packet ratio is less than a preset ratio threshold.

[0110] Each module in the aforementioned attack detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0111] In one exemplary embodiment, a computer device is provided, which may be a data processing unit, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, and a communication interface. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements an attack detection method.

[0112] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0113] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: forwarding received packets to a first scalable sub-function via a virtual bridge, and then entering a plurality of preset hardware pipes through the first scalable sub-function; matching and forwarding packets according to each hardware pipe, and determining Transmission Control Protocol (TCP) synchronization packets; obtaining the TCP synchronization packet statistics value of the target Internet Protocol (IP) address to which the TCP synchronization packet belongs, and obtaining the total number of TCP packets of the target IP address through the hardware pipes; obtaining the synchronization packet ratio of the target IP address based on the ratio of the TCP synchronization packet statistics value to the total number of TCP packets; and determining the TCP synchronization packet as an attack packet if the synchronization packet ratio is greater than or equal to a preset ratio threshold.

[0114] In one embodiment, the hardware pipe includes a blacklist pipe and a control pipe. When the processor executes the computer program, it also performs the following steps: matching packets based on a preset matching rule table through the blacklist pipe, forwarding unmatched packets to the control pipe, and discarding successfully matched packets; matching received unmatched packets according to the synchronization flag bit through the control pipe, and determining TCP synchronization packets based on the matching result.

[0115] In one embodiment, the hardware pipe further includes a counter pipe and a synchronization pipe. When the processor executes the computer program, it also performs the following steps: forwarding packets with a matching result of non-TCP type to the second extensible sub-function through the control pipe, forwarding packets with a matching result of TCP normal type to the counter pipe, identifying packets with a matching result of TCP synchronization type and not exceeding the rate limit threshold as TCP synchronization packets, and forwarding the TCP synchronization packets to the synchronization pipe.

[0116] In one embodiment, the hardware pipe further includes a synchronization miss pipe, and the processor, when executing the computer program, also performs the following steps: matching the target IP address of the TCP synchronization packet with a preset IP address list through the synchronization pipe; if the match fails, forwarding the TCP synchronization packet to the synchronization miss pipe; if the match succeeds, writing a first metadata value to the TCP synchronization packet, and forwarding the TCP synchronization packet carrying the first metadata value to the processor; the preset IP address list includes IP addresses with established TCP connections.

[0117] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining the TCP synchronization packet statistics of the target IP address based on the first metadata value of the received TCP synchronization packet, and obtaining the total number of TCP packets of the target IP address through a counter pipe.

[0118] In one embodiment, when the processor executes the computer program, it further performs the following steps: writing a second metadata value to the received TCP synchronization message via the synchronization miss pipe, and forwarding the TCP synchronization message carrying the second metadata value to the processor; sending the destination IP address to which the TCP synchronization message carrying the second metadata value belongs to the synchronization pipe and the counter pipe to update the IP address list.

[0119] In one embodiment, the hardware pipeline further includes a root pipeline, and the processor, when executing the computer program, also performs the following steps: performing protocol matching on the packets forwarded by the first extensible sub-function through the root pipeline based on the message protocol; if the protocol matching is successful, forwarding the packet to the blacklist pipeline; if the protocol matching is unsuccessful, discarding the packet.

[0120] In one embodiment, when the processor executes the computer program, it also performs the following steps: if the TCP synchronization message is an attack message, the target IP address is sent to the blacklist pipe to update the matching rule table.

[0121] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the synchronization message ratio is less than a preset ratio threshold, the TCP synchronization message of the target IP address is forwarded to the second extensible sub-function.

[0122] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above method embodiments.

[0123] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of any of the embodiments described above.

[0124] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0125] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0126] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0127] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An attack detection method, characterized in that, Applied to a data processing unit, the method includes: The received message is forwarded to the first scalable sub-function through a virtual bridge, and then enters multiple preset hardware pipes through the first scalable sub-function. The messages are matched and forwarded according to the hardware pipes described above, and the Transmission Control Protocol (TCP) synchronization messages are determined. Obtain the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and obtain the total number of TCP packets of the target IP address through the hardware pipe; The synchronization packet ratio of the target IP address is obtained by comparing the TCP synchronization packet statistics with the total number of TCP packets. If the synchronization message ratio is greater than or equal to a preset ratio threshold, then the TCP synchronization message is determined to be an attack message.

2. The method according to claim 1, characterized in that, The hardware pipes include blacklist pipes and control pipes. The process of matching and forwarding packets according to each of the hardware pipes, and determining the Transmission Control Protocol (TCP) synchronization packet, includes: The blacklist pipeline matches the packets based on a preset matching rule table, forwards unmatched packets to the control pipeline, and discards successfully matched packets. The control pipe matches the received unmatched messages according to the synchronization flag, and determines the TCP synchronization message based on the matching result.

3. The method according to claim 2, characterized in that, The hardware pipeline also includes a counter pipeline and a synchronization pipeline, and the method further includes: The control pipe forwards packets with a matching result of non-TCP type to the second expandable sub-function, packets with a matching result of TCP normal type to the counter pipe, and packets with a matching result of TCP synchronization type and not exceeding the rate limit threshold are identified as TCP synchronization packets and forwarded to the synchronization pipe.

4. The method according to claim 3, characterized in that, The hardware pipeline also includes a synchronization miss pipeline, and the method further includes: The synchronization pipe matches the target IP address of the TCP synchronization message with a preset IP address list. If the match fails, the TCP synchronization message is forwarded to the synchronization miss pipe. If the match succeeds, a first metadata value is written to the TCP synchronization message, and the TCP synchronization message carrying the first metadata value is forwarded to the processor. The preset IP address list includes IP addresses with established TCP connections.

5. The method according to claim 4, characterized in that, The step of obtaining the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and obtaining the total number of TCP packets of the target IP address through the hardware pipe, includes: The TCP synchronization packet statistics of the target IP address are obtained based on the first metadata value of the received TCP synchronization packet, and the total number of TCP packets of the target IP address is obtained through the counter pipe.

6. The method according to claim 4, characterized in that, The method further includes: The second metadata value is written into the received TCP synchronization message through the synchronization miss pipe, and the TCP synchronization message carrying the second metadata value is forwarded to the processor; The target IP address of the TCP synchronization message carrying the second metadata value is sent to the synchronization pipe and the counter pipe to update the IP address list.

7. The method according to any one of claims 2 to 6, characterized in that, The hardware pipeline also includes a root pipeline, and the method further includes: The root pipe performs protocol matching on the packets forwarded by the first extensible sub-function based on the packet protocol. If the protocol match is successful, the packet is forwarded to the blacklist pipe. If the protocol match is unsuccessful, the packet is discarded.

8. The method according to any one of claims 2 to 6, characterized in that, After determining that the TCP synchronization message is an attack message if the synchronization message ratio is greater than or equal to a preset ratio threshold, the method further includes: If the TCP synchronization message is an attack message, the target IP address is sent to the blacklist pipeline to update the matching rule table.

9. The method according to any one of claims 1 to 6, characterized in that, The method further includes: If the synchronization message ratio is less than the preset ratio threshold, the TCP synchronization message is forwarded to the second scalable sub-function.

10. An attack detection device, characterized in that, Deployed in a data processing unit, the device includes: The forwarding module is used to forward the received packets to the first expandable sub-function through the virtual bridge, and then enter multiple preset hardware pipes through the first expandable sub-function. The first determining module is used to match and forward the messages according to each of the hardware pipes, and to determine the Transmission Control Protocol (TCP) synchronization message; The acquisition module is used to acquire the TCP synchronization packet statistics of the target Internet Protocol IP address to which the TCP synchronization packet belongs, and to acquire the total number of TCP packets of the target IP address through the hardware pipe; The calculation module is used to obtain the synchronization packet ratio of the target IP address based on the ratio of the TCP synchronization packet statistics to the total number of TCP packets. The second determining module is used to determine that the TCP synchronization message is an attack message if the synchronization message ratio is greater than or equal to a preset ratio threshold.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images