Attack detection method and apparatus, and NP chip

Abstract

An attack detection method and apparatus, and an NP chip, belonging to the technical field of networks. In the method, after an NP chip receives a first data flow, the NP chip detects whether the first data flow is a DDoS attack flow; and the NP chip intercepts the first data flow when the first data flow is a DDoS attack flow. In the present application, an NP chip detects a DDoS attack flow and intercepts the DDoS attack flow, thereby achieving high detection efficiency.

Description

Attack detection method and device, and NP chip

[0001] The present application claims priority to the Chinese patent application No. 202411337728.3, filed on September 24, 2024, and entitled "Attack detection method and device, and NP chip", the entire content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of network technology, and in particular to an attack detection method and device, and a network processor (NP) chip. BACKGROUND

[0003] Distributed denial-of-service (DDoS) attack is an important network attack, which uses client / server technology to combine multiple devices to attack the same device. With the complexity of the network, DDoS attacks are becoming more and more serious. How to quickly detect DDoS attacks for defense has become an important challenge in the field of network security.

[0004] In the current DDoS attack detection scheme, the network device replicates the received packet and sends the replicated packet to the analysis device. The analysis device detects whether a DDoS attack occurs according to the packet sent by the network device. In the case where it is determined that a DDoS attack occurs, the analysis device determines the DDoS attack source and sends the information of the DDoS attack source to the network device. The network device intercepts the packet from the DDoS attack source according to the information of the DDoS attack source.

[0005] However, the current DDoS attack detection scheme needs to interact between the network device and the analysis device, resulting in low efficiency of detecting DDoS attacks. SUMMARY

[0006] The present application provides an attack detection method and device, and an NP chip. The technical scheme of the present application is as follows.

[0007] In a first aspect, an attack detection method is provided, which includes: an NP chip receiving a first data stream; the NP chip detecting whether the first data stream is a DDoS attack stream; and the NP chip intercepting the first data stream in the case where the first data stream is a DDoS attack stream.

[0008] The technical scheme provided by the present application detects the DDoS attack stream by the NP chip and intercepts the DDoS attack stream. The process of detecting the DDoS attack stream does not need to interact between the network device and the analysis device, so the efficiency of detecting the DDoS attack stream is high.

[0009] Optionally, the NP chip determines whether the first data flow is a DDoS attack flow by: the NP chip counting classifications of a plurality of packets by using a hash algorithm, the plurality of packets being packets in traffic received by the NP chip, the traffic including the first data flow; and the NP chip determining whether the first data flow is a DDoS attack flow according to the classification results of the plurality of packets.

[0010] The application provides a scheme for counting packet classifications, which counts packet classifications by using a hash algorithm by an NP chip, simplifies the process of counting packet classifications, and thus simplifies the process of determining whether the first data flow is a DDoS attack flow according to the classification results.

[0011] Optionally, the NP chip determines whether the first data flow is a DDoS attack flow according to the classification results of the plurality of packets by: the NP chip obtaining source internet protocol (IP) address entropy of the plurality of packets and destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets; and the NP chip determining whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets. The source IP address entropy of the plurality of packets is information entropy of source IP addresses of the plurality of packets, and the destination IP address entropy of the plurality of packets is information entropy of destination IP addresses of the plurality of packets.

[0012] The application provides a scheme for obtaining IP address entropy, which counts classifications of a plurality of packets by using a hash algorithm by an NP chip, and obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets, simplifies the process of obtaining the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets, and thus simplifies the process of determining whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

[0013] Optionally, the NP chip obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets by: the NP chip obtaining the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets by using a function fitting algorithm.

[0014] The application provides a scheme for obtaining IP address entropy, wherein a NP chip is utilized to count the classification of a plurality of messages by using a hash algorithm, and source IP address entropy of the plurality of messages and destination IP address entropy of the plurality of messages are obtained by using a function fitting algorithm according to the classification results of the plurality of messages, so that the process of obtaining the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages is simplified, and thus the process of determining whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages is simplified.

[0015] Optionally, the NP chip detects whether the first data flow is a DDoS attack flow, including that the NP chip obtains source IP address entropy of a plurality of messages and destination IP address entropy of the plurality of messages, the plurality of messages being messages in a flow received by the NP chip, the flow including the first data flow; and the NP chip determines whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages.

[0016] Optionally, the NP chip obtains source IP address entropy of a plurality of messages and destination IP address entropy of the plurality of messages, including that the NP chip obtains the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages by using a function fitting algorithm.

[0017] The technical scheme provided by the application can simplify the process of obtaining source IP address entropy of a plurality of messages and destination IP address entropy of the plurality of messages by using a function fitting algorithm by the NP chip, so as to simplify the process of determining whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages.

[0018] Optionally, the NP chip obtains source IP address entropy of a plurality of messages and destination IP address entropy of the plurality of messages, including that the NP chip obtains the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages by using an incremental calculation method.

[0019] The technical scheme provided in the application can reduce the time consumption of the whole detection process, save the computing resources of the NP chip, and will not affect the forwarding efficiency of the NP chip. For example, the NP chip uses a hash algorithm to count the classification of the plurality of packets, and according to the classification result of the plurality of packets, uses a function fitting algorithm to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by means of incremental calculation. In this way, the process of counting the classification of the plurality of packets can be simplified, and the process of obtaining the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets can be simplified. Moreover, the NP chip uses the function fitting algorithm to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by means of incremental calculation, which can reduce the time consumption of the whole detection process, save the computing resources of the NP chip, and will not affect the forwarding efficiency of the NP.

[0020] Optionally, the NP chip determines whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets, including: the NP chip determines whether a DDoS attack occurs according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets; and the NP chip determines whether the first data flow is a DDoS attack flow in the case of the occurrence of the DDoS attack.

[0021] Optionally, the NP chip determines whether a DDoS attack occurs according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets, including: the NP chip determines that a DDoS attack occurs in the case that the source IP address entropy of the plurality of packets is greater than a first threshold value and / or the destination IP address entropy of the plurality of packets is less than a second threshold value.

[0022] Optionally, the plurality of packets are packets in a first window, and the first window is a time window or a length window.

[0023] Optionally, the NP chip includes a DDoS detection unit; the DDoS detection unit is configured to: detect whether the first data flow is a DDoS attack flow; and intercept the first data flow in the case that the first data flow is a DDoS attack flow.

[0024] Optionally, the NP chip comprises a DDoS detection unit and an intercepting unit; the DDoS detection unit is configured to: detect whether the first data flow is a DDoS attack flow; and in a case where the first data flow is a DDoS attack flow, send information of the first data flow to the intercepting unit; the intercepting unit is configured to: generate an access control list (ACL) entry according to the information of the first data flow; and intercept the first data flow according to the ACL entry. The ACL entry comprises information of the first data flow and action information, and the action information is used to indicate an intercepting action.

[0025] In a second aspect, an attack detection apparatus is provided, which is applied to an NP chip and comprises at least one function module configured to perform the method provided in the first aspect or any possible implementation manner of the first aspect. The at least one function module can be implemented based on software, hardware or a combination of software and hardware, and the at least one function module can be combined or split based on specific implementation.

[0026] In a third aspect, an NP chip is provided, which comprises the attack detection apparatus provided in the second aspect.

[0027] In a fourth aspect, a network device is provided, which comprises the NP chip provided in the third aspect.

[0028] In a fifth aspect, a computer readable storage medium is provided, which stores a computer program. The computer program is executed to implement the attack detection method provided in the first aspect or any possible implementation manner of the first aspect.

[0029] In a sixth aspect, a computer program product is provided, which comprises a program or code. The program or code is executed to implement the attack detection method provided in the first aspect or any possible implementation manner of the first aspect.

[0030] In a seventh aspect, a chip is provided, which comprises a programmable logic circuit and / or program instructions. The chip is used to implement the attack detection method provided in the first aspect or any possible implementation manner of the first aspect when the chip is running. The chip is an NP chip.

[0031] The technical effects of the second aspect to the seventh aspect can refer to the technical effects of the first aspect and the possible implementation manners thereof, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0032] FIG. 1 is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0033] FIG. 2 is a flowchart of an attack detection method provided by an embodiment of the present application;

[0034] FIG. 3 is a curve of source IP address average entropy and a curve of a source IP address entropy threshold according to an embodiment of the present application;

[0035] FIG. 4 is a curve of destination IP address average entropy and a curve of a destination IP address entropy threshold according to an embodiment of the present application;

[0036] FIG. 5 is a schematic diagram of an NP chip according to an embodiment of the present application;

[0037] FIG. 6 is a schematic diagram of another NP chip according to an embodiment of the present application;

[0038] FIG. 7 is a schematic diagram of an attack detection apparatus according to an embodiment of the present application;

[0039] FIG. 8 is a schematic diagram of a network device according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] The embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0041] A distributed denial-of-service (DDoS) attack is an important network attack, which combines multiple devices to attack the same device by means of client / server technology. With the complication of the network, the DDoS attack is becoming more and more serious.

[0042] The DDoS attack generally has a short and fast trend, and is characterized by rapid rise and rapid decline of attack traffic. Attackers use “blitzkrieg” to reduce attack costs. If the detection of the DDoS attack is time-consuming and inefficient, it will lead to the failure to defend the DDoS attack in time, which is easy to cause network security problems. Therefore, how to quickly and efficiently detect the DDoS attack for defense has become an important challenge in the field of network security.

[0043] In the current scheme for detecting the DDoS attack, a network device replicates a received packet and sends the replicated packet to an analysis device. The analysis device detects whether a DDoS attack occurs according to the packet sent by the network device. In the case where it is determined that the DDoS attack occurs, the analysis device determines a DDoS attack source and sends information of the DDoS attack source to the network device. The network device intercepts a packet from the DDoS attack source according to the information of the DDoS attack source. For example, the network device generates an access control list (ACL) entry according to the information of the DDoS attack source, the ACL entry including the information of the DDoS attack source and action information for indicating an interception action, and the network device intercepts the packet from the DDoS attack source according to the ACL entry.

[0044] However, the current DDoS attack detection scheme needs the network device to interact with the analysis device, which results in a long detection time and low detection efficiency, and further results in the inability to defend against DDoS attacks in time. In addition, it can cause the network device to be unable to update the ACL table item in time, which can affect normal services. For example, a certain device is hijacked to implement a DDoS attack. After the network device identifies the certain device as a DDoS attack source, it generates an ACL table item based on the information of the certain device and intercepts the packet from the certain device according to the ACL table item. Subsequently, the certain device is no longer hijacked to implement a DDoS attack. Since the network device takes a long time to detect DDoS attacks, the network device cannot identify the certain device as a normal device in time, so it cannot update the ACL table item in time. The network device still intercepts the packet from the certain device according to the ACL table item, which can cause the normal service packet to be intercepted, affecting normal services.

[0045] The present application provides an attack detection scheme, which detects DDoS attacks by a network processor (NP) chip in a network device. The detection process does not need the network device to interact with the analysis device, so the detection time is short and the detection efficiency is high.

[0046] The technical scheme of the embodiments of the present application is introduced below. First, the application scenario of the embodiments of the present application is introduced.

[0047] The application scenario of the embodiments of the present application includes a communication network and a plurality of devices accessing the communication network. The communication network is used for forwarding packets between the plurality of devices to realize communication of the plurality of devices.

[0048] Among them, the plurality of devices accessing the communication network can include user devices, service devices, etc. The user device can include a mobile phone, a tablet computer, a notebook computer, a desktop computer, a smart television, an Internet of Things (IoT) device, etc. User terminal, it can also include client provider edge (CPE) device, etc. Enterprise terminal (terminal for external communication of enterprises). The service device can include a server and a virtual machine (VM), a container, etc. created in the server based on virtualization technology.

[0049] The communication network can be a data center network (DCN), a metropolitan area network, a wide area network, a backbone network, or a campus network, etc. The network device can be a switch, a router, a virtual switch, or a virtual router, etc. The virtual switch can be a node with switching function created in a physical switch based on virtualization technology. The virtual router can be a node with routing function created in a physical router based on virtualization technology. The network device can also be referred to as a forwarding device. The network device includes an NP chip, and the NP chip performs packet forwarding. In the embodiments of the present application, the NP chip can also detect DDoS attacks.

[0050] As an example, refer to FIG. 1, which shows a schematic diagram of an application scenario provided by the embodiments of the present application. The application scenario includes a communication network 10 and devices 201-205 connected to the communication network 10. The communication network 10 includes network devices 101-103. The network devices 101-103 are used for packet forwarding between the devices 201-205 to realize communication of the devices 201-205. The network devices 101-103 each include an NP chip, and the NP chip performs packet forwarding. In the embodiments of the present application, the NP chip can also detect DDoS attacks.

[0051] It should be noted that the application scenario shown in FIG. 1 is only used for example and does not limit the technical solutions of the present application. In the implementation process, the application scenario of the embodiments of the present application can include more or fewer devices than those shown in FIG. 1. The number of network devices in the application scenario, the number of devices connected to the communication network, and the connection relationship between the devices can be configured as needed, and the embodiments of the present application do not limit them.

[0052] The above is the introduction of the application scenario of the present application. The following introduces the method embodiments of the present application.

[0053] Refer to FIG. 2, which shows a flowchart of an attack detection method provided by the embodiments of the present application. The attack detection method is performed by an NP chip, which can be an NP chip in any network device in a communication network. For example, in FIG. 1, the NP chip can be an NP chip in any of the network devices 101-103. Referring to FIG. 2, the attack detection method includes the following steps S201-S203.

[0054] S201. The NP chip receives a first data stream.

[0055] In specific embodiments, the NP chip receives traffic, and the traffic includes the first data stream.

[0056] S202. The NP chip detects whether the first data stream is a DDoS attack stream.

[0057] The NP chip obtains a plurality of packets in the traffic received by the NP chip, the traffic received by the NP chip comprising the first data flow, the plurality of packets comprising packets of the first data flow. The NP chip detects whether the first data flow is a DDoS attack flow according to the plurality of packets. The plurality of packets are packets in a first window, the first window being a time window or a length window. The time window is a window defined according to time, and the time window has a fixed time length. The length window is a window defined according to the number of packets, and the number of packets in the length window is fixed.

[0058] In an optional embodiment, the NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets, and determines whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

[0059] In an optional embodiment, the NP chip counts the classification of the plurality of packets, and determines whether the first data flow is a DDoS attack flow according to the classification result of the plurality of packets.

[0060] In a specific embodiment, the NP chip counts the classification of the plurality of packets, obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets according to the classification result of the plurality of packets, and determines whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

[0061] The source IP address entropy of the plurality of packets is information entropy of source IP addresses of the plurality of packets, and the destination IP address entropy of the plurality of packets is information entropy of destination IP addresses of the plurality of packets. In the embodiments of the present application, the NP chip can count the classification of the plurality of packets according to the source IP addresses of the plurality of packets, and the NP chip can count the classification of the plurality of packets according to the destination IP addresses of the plurality of packets. The classification result of the plurality of packets can comprise the classification result of the plurality of packets counted according to the source IP addresses and the classification result of the plurality of packets counted according to the destination IP addresses. The NP chip obtains the source IP address entropy of the plurality of packets according to the classification result of the plurality of packets counted according to the source IP addresses, and obtains the destination IP address entropy of the plurality of packets according to the classification result of the plurality of packets counted according to the destination IP addresses.

[0062] In an optional embodiment, the classification result of the plurality of packets according to the source IP address statistics includes a number of at least one category and a number of packets in each of the at least one category, and the classification result of the plurality of packets according to the destination IP address statistics includes a number of at least one category and a number of packets in each of the at least one category. For the convenience of distinction, the classification of the plurality of packets according to the source IP address statistics is referred to as source classification, and the classification of the plurality of packets according to the destination IP address statistics is referred to as destination classification. The at least one source category is all the categories according to the source IP address statistics, and the at least one destination category is all the categories according to the destination IP address statistics. The NP chip obtains the source IP address entropy of the plurality of packets according to the number of the at least one source category and the number of packets in each of the at least one source category. The NP chip obtains the destination IP address entropy of the plurality of packets according to the number of the at least one destination category and the number of packets in each of the at least one destination category.

[0063] In an optional embodiment, the NP chip uses a hash algorithm to perform the classification of the plurality of packets. In a specific embodiment, the NP chip uses the hash algorithm to perform the classification of the plurality of packets according to the source IP address of the plurality of packets, and the NP chip uses the hash algorithm to perform the classification of the plurality of packets according to the destination IP address of the plurality of packets. The classification result of the plurality of packets includes the classification result of the plurality of packets according to the source IP address using the hash algorithm, and the classification result of the plurality of packets according to the destination IP address using the hash algorithm. In the classification result of the plurality of packets according to the source IP address using the hash algorithm, the packets with the same hash value of the source IP address belong to the same category (i.e., source category), and the packets with different hash values of the source IP address belong to different categories (i.e., source categories). In the classification result of the plurality of packets according to the destination IP address using the hash algorithm, the packets with the same hash value of the destination IP address belong to the same category (i.e., destination category), and the packets with different hash values of the destination IP address belong to different categories (i.e., destination categories). In a specific embodiment, for each packet in the plurality of packets, after receiving the packet, the NP chip uses the hash algorithm to perform the classification of the packet according to the source IP address of the packet, and the NP chip uses the hash algorithm to perform the classification of the packet according to the destination IP address of the packet.

[0064] In a specific embodiment, the NP chip utilizes a hash algorithm to count the categories of the plurality of packets according to the source IP addresses of the plurality of packets. The NP chip determines at least one first counting bucket, the at least one first counting bucket one-to-one corresponding to at least one hash value, each first counting bucket being used to count the packets whose hash values of the source IP addresses are equal to the hash value corresponding to the each first counting bucket (i.e., the at least one first counting bucket one-to-one corresponding to at least one source category, each first counting bucket being used to count the packets of the corresponding source category), the NP chip counts the plurality of packets according to the source IP addresses of the plurality of packets by using the at least one first counting bucket, and the NP chip determines the category results of the plurality of packets according to the counting results of the plurality of packets by using the at least one first counting bucket (i.e., the category results of the plurality of packets counted by utilizing the hash algorithm according to the source IP addresses of the plurality of packets). In a specific embodiment, for each packet in the plurality of packets: after the NP chip receives the packet, the NP chip obtains the hash value of the source IP address of the packet; the NP chip determines the first counting bucket in the at least one first counting bucket, the corresponding hash value of which is equal to the hash value of the source IP address of the packet; and the NP chip counts the packet by using the first counting bucket, the corresponding hash value of which is equal to the hash value of the source IP address of the packet. In a specific embodiment, the NP chip adds 1 to the counting value of the first counting bucket, the corresponding hash value of which is equal to the hash value of the source IP address of the packet, so as to count the packet by using the first counting bucket, the corresponding hash value of which is equal to the hash value of the source IP address of the packet. After the NP chip counts the plurality of packets according to the source IP addresses of the plurality of packets by using the at least one first counting bucket, the NP chip determines the number of the at least one first counting bucket as the number of the source categories of the plurality of packets counted according to the source IP addresses of the plurality of packets; and the NP chip determines the counting value of each first counting bucket in the at least one first counting bucket as the number of the packets of the source category corresponding to the each first counting bucket in the plurality of packets counted according to the source IP addresses.

[0065] In specific embodiments, the NP chip utilizes a hash algorithm to count the classification of the plurality of packets according to the destination IP addresses of the plurality of packets. The NP chip determines at least one second counting bucket, the at least one second counting bucket one-to-one corresponds to at least one hash value, each second counting bucket is used to count the packets whose hash value of the destination IP address is equal to the hash value corresponding to the each second counting bucket (i.e., the at least one second counting bucket one-to-one corresponds to at least one destination category, each second counting bucket is used to count the packets of the corresponding destination category), the NP chip counts the plurality of packets according to the destination IP addresses of the plurality of packets by using the at least one second counting bucket, and the NP chip determines the classification result of the plurality of packets according to the counting result of the plurality of packets by using the at least one second counting bucket (i.e., the classification result of the plurality of packets counted by using the hash algorithm according to the destination IP addresses of the plurality of packets). In specific embodiments, for each packet in the plurality of packets: after the NP chip receives the packet, the NP chip obtains the hash value of the destination IP address of the packet; the NP chip determines the second counting bucket in the at least one second counting bucket, the corresponding hash value of which is equal to the hash value of the destination IP address of the packet; and the NP chip counts the packet by using the second counting bucket, the corresponding hash value of which is equal to the hash value of the destination IP address of the packet. In specific embodiments, the NP chip adds 1 to the counting value of the second counting bucket, the corresponding hash value of which is equal to the hash value of the destination IP address of the packet, so as to count the packet by using the second counting bucket, the corresponding hash value of which is equal to the hash value of the destination IP address of the packet. After the NP chip counts the plurality of packets according to the destination IP addresses of the plurality of packets by using the at least one second counting bucket, the NP chip determines the number of the at least one second counting bucket as the number of the destination categories of the plurality of packets counted according to the destination IP addresses of the plurality of packets; and the NP chip determines the counting value of each second counting bucket in the at least one second counting bucket as the number of the packets of the destination category corresponding to the each second counting bucket in the plurality of packets counted according to the destination IP addresses.

[0066] In the embodiments of the present application, the NP chip uses a hash algorithm to count the classification of the plurality of messages. In the scheme of using the hash algorithm to count the classification of the plurality of messages, the NP chip counts the messages with the same hash value of the source IP address into the same source category, counts the messages with different hash values of the source IP address into different source categories, counts the messages with the same hash value of the destination IP address into the same destination category, and counts the messages with different hash values of the destination IP address into different destination categories. The NP chip can also use other algorithms to count the classification of the plurality of messages. For example, the NP chip uses other algorithms to count the classification of the plurality of messages according to the source IP addresses of the plurality of messages, counts the messages with the same source IP address into the same source category, and counts the messages with different source IP addresses into different source categories; and the NP chip uses other algorithms to count the classification of the plurality of messages according to the destination IP addresses of the plurality of messages, counts the messages with the same destination IP address into the same destination category, and counts the messages with different destination IP addresses into different destination categories. In specific embodiments, for each message in the plurality of messages, after receiving the message, the NP chip records the source IP address of the message and the destination IP address of the message (regardless of whether the NP chip has recorded the same source IP address as the source IP address of the message, the NP chip records the source IP address of the message; regardless of whether the NP chip has recorded the same destination IP address as the destination IP address of the message, the NP chip records the destination IP address of the message). After recording the source IP addresses of the plurality of messages, the NP chip performs a deduplication counting process on the plurality of messages according to the source IP addresses of the plurality of messages to obtain the classification result of the plurality of messages counted according to the source IP addresses of the plurality of messages. After recording the destination IP addresses of the plurality of messages, the NP chip performs a deduplication counting process on the plurality of messages according to the destination IP addresses of the plurality of messages to obtain the classification result of the plurality of messages counted according to the destination IP addresses of the plurality of messages. In specific embodiments, the NP chip performs a deduplication counting process on the plurality of messages according to the source IP addresses of the plurality of messages, including: the NP chip counts the messages with the same source IP address in the plurality of messages into the same source category, counts the messages with different source IP addresses into different source categories, and determines the number of messages of each source category according to the source IP addresses of the plurality of messages.The NP chip performs deduplication counting processing on the plurality of packets according to the destination IP addresses of the plurality of packets, including: the NP chip counts packets with the same destination IP address in the plurality of packets as the same destination category, and counts packets with different destination IP addresses as different destination categories according to the destination IP addresses of the plurality of packets, and the NP chip determines the number of packets of each destination category according to the destination IP addresses of the plurality of packets. Compared with counting the classification of the plurality of packets according to whether the IP addresses are the same (that is, counting the classification of the plurality of packets according to whether the source IP addresses are the same, and counting the classification of the plurality of packets according to whether the destination IP addresses are the same), in the scheme of counting the classification of the plurality of packets by using the hash algorithm, the NP chip does not need to record the source IP addresses of the plurality of packets and the destination IP addresses of the plurality of packets, and does not need to perform deduplication counting processing on the plurality of packets, thereby saving the storage resources and computing resources of the NP chip.

[0067] The NP chip obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets. In specific embodiments, the NP chip obtains the source IP address entropy of the plurality of packets according to the classification results of the plurality of packets counted according to the source IP addresses; and the NP chip obtains the destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets counted according to the destination IP addresses. In specific embodiments, the NP chip obtains the source IP address entropy of the plurality of packets by using an information entropy calculation formula according to the number of the plurality of packets and the classification results of the plurality of packets counted according to the source IP addresses; and the NP chip obtains the destination IP address entropy of the plurality of packets by using the information entropy calculation formula according to the number of the plurality of packets and the classification results of the plurality of packets counted according to the destination IP addresses. In specific embodiments, the classification results of the plurality of packets counted according to the source IP addresses include the number of at least one source category and the number of packets in each source category in the at least one source category, and the NP chip substitutes the number of the plurality of packets, the number of the at least one source category, and the number of packets in each source category in the at least one source category into the information entropy calculation formula to obtain the source IP address entropy of the plurality of packets. The classification results of the plurality of packets counted according to the destination IP addresses include the number of at least one destination category and the number of packets in each destination category in the at least one destination category, and the NP chip substitutes the number of the plurality of packets, the number of the at least one destination category, and the number of packets in each destination category in the at least one destination category into the information entropy calculation formula to obtain the destination IP address entropy of the plurality of packets.

[0068] For example, the information entropy calculation formula is:

[0069] wherein H(X) represents information entropy, m represents the number of the plurality of messages, N represents the number of categories of the plurality of messages, f x represents the number of messages of each category. The categories of the plurality of messages can be source categories or destination categories. In the case of calculating the source IP address entropy of the plurality of messages, N represents the number of source categories of the plurality of messages, f x represents the number of messages of each source category. In the case of calculating the destination IP address entropy of the plurality of messages, N represents the number of destination categories of the plurality of messages, f x represents the number of messages of each destination category.

[0070] In an optional embodiment, the NP chip obtains the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages by using a function fitting algorithm. In a specific embodiment, the NP chip obtains the source IP address entropy of the plurality of messages and the destination IP address entropy of the plurality of messages by using a function fitting algorithm according to the classification results of the plurality of messages. In a specific embodiment, the NP chip obtains the source IP address entropy of the plurality of messages by using a function fitting algorithm according to the classification results of the plurality of messages counted according to source IP addresses; the NP chip obtains the destination IP address entropy of the plurality of messages by using a function fitting algorithm according to the classification results of the plurality of messages counted according to destination IP addresses.

[0071] In a specific embodiment, the classification results of the plurality of messages counted according to source IP addresses include the number of at least one source category and the number of messages of each source category in the at least one source category, the NP chip obtains the log value (i.e. log2(f x )) corresponding to the number of messages of each source category in the at least one source category by using a function fitting algorithm, and the NP chip substitutes the number of the plurality of messages, the number of the at least one source category, the number of messages of each source category in the at least one source category, and the log value (i.e. log2(f x )) corresponding to the number of messages of each source category in the at least one source category into the above information entropy calculation formula to obtain the source IP address entropy of the plurality of messages. The classification results of the plurality of messages counted according to destination IP addresses include the number of at least one destination category and the number of messages of each destination category in the at least one destination category, the NP chip obtains the log value (i.e. log2(f x )) corresponding to the number of messages of each destination category in the at least one destination category by using a function fitting algorithm, and the NP chip substitutes the number of the plurality of messages, the number of the at least one destination category, the number of messages of each destination category in the at least one destination category, and the log value (i.e. log2(f xThe destination IP address entropy of the plurality of packets is calculated by substituting the above information entropy calculation formula.

[0072] In an optional embodiment, the NP chip comprises a log table, the log table comprising a plurality of quantities and log values corresponding to the plurality of quantities (i.e. log2(f x ), the log table being constructed in advance according to a plurality of quantities and log values corresponding to the plurality of quantities (i.e. log2(f x ), the log table being constructed in advance according to a plurality of quantities and log values corresponding to the plurality of quantities (i.e. log2(f x ), the log value corresponding to each quantity in the log table being obtained in advance by log calculation on the quantity by a function fitting algorithm. For each source category in the at least one source category: the NP chip looks up the log value according to the quantity of packets of the source category to obtain the log value corresponding to the quantity of packets of the source category (i.e. log2(f x ). For each destination category in the at least one destination category: the NP chip looks up the log value according to the quantity of packets of the destination category to obtain the log value corresponding to the quantity of packets of the destination category (i.e. log2(f x ).

[0073] In an optional embodiment, the NP chip obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by incremental calculation. In a specific embodiment, the NP chip counts the classification of the plurality of packets, and the NP chip obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by incremental calculation according to the classification result of the plurality of packets. In a specific embodiment, the NP chip counts the classification of the plurality of packets according to the source IP address of the plurality of packets, and the NP chip obtains the source IP address entropy of the plurality of packets by incremental calculation according to the classification result of the plurality of packets counted according to the source IP address. In addition, the NP chip counts the classification of the plurality of packets according to the destination IP address of the plurality of packets, and the NP chip obtains the destination IP address entropy of the plurality of packets by incremental calculation according to the classification result of the plurality of packets counted according to the destination IP address.

[0074] For the convenience of description, an intermediate value S and an intermediate value W are defined, W = f x × log2(f x ). In the following description, for the convenience of distinction, the intermediate value S involved in the process of obtaining the source IP address entropy is referred to as intermediate value S S , the intermediate value W involved in the process of obtaining the source IP address entropy is referred to as intermediate value W S , the intermediate value S involved in the process of obtaining the destination IP address entropy is referred to as intermediate value S DThe intermediate value W involved in the process of obtaining the entropy of the destination IP address is referred to as the intermediate value W D .

[0075] In specific embodiments, the NP chip counts the categories of the plurality of packets according to the source IP addresses of the plurality of packets, and the NP chip obtains the source IP address entropy of the plurality of packets by means of incremental calculation according to the category results of the plurality of packets counted according to the source IP addresses. In specific embodiments, after the NP chip receives a first packet in the plurality of packets, the NP chip counts the category of the first packet according to the source IP address of the first packet to determine the source category of the first packet (for example, the source category of the first packet is referred to as the first source category). The NP chip determines the number f x (for example, the plurality of packets are packets in a first window, and the NP chip determines the number f x of packets belonging to the first window and having the first source category that have been received by the NP chip). x The NP chip determines the intermediate value W S corresponding to the first packet according to the number f S The NP chip determines the incremental value U S corresponding to the first packet according to the intermediate value W S corresponding to the first packet and the intermediate value W S corresponding to the second packet. For example, the NP chip determines the difference between the intermediate value W S corresponding to the first packet and the intermediate value W S corresponding to the second packet as the incremental value U S corresponding to the first packet. The NP chip determines the sum of the intermediate value S S corresponding to the third packet and the incremental value U S corresponding to the first packet as the intermediate value S S corresponding to the first packet. For example, the NP chip determines the difference between the intermediate value W S corresponding to the first packet and the intermediate value W SThe second message is a message received by the NP chip before receiving the first message. The second message belongs to the plurality of messages (e.g., the plurality of messages are within a first window, and the second message belongs to the first window), and it is the previous message received by the NP chip whose source type is the first source type. The third message is a message received by the NP chip before receiving the first message. The third message belongs to the plurality of messages (e.g., the plurality of messages are within a first window, and the third message belongs to the first window), and it is the previous message received by the NP chip. It can be understood that the second and third messages may be the same message or different messages. The first message can be any one of the plurality of messages. If the first message is the first message among the plurality of messages (i.e., the first message received by the NP chip belonging to the plurality of messages), neither the second nor the third message exists, and the intermediate value W corresponding to the second message... S The value is 0, and the intermediate value S corresponding to the third message is 0. S The increment value U corresponding to the first message is 0. S The intermediate value W corresponding to the first message S Equal, the intermediate value S corresponding to the first message S Intermediate value W corresponding to the first message S Equal. For example, after the NP chip receives the first message, the NP chip determines that the number of messages it has received that belong to the multiple messages and whose source type is the first source type is 6, and the NP chip determines the median value W corresponding to the first message. S The intermediate value W corresponding to the second message is 6×log26. S The value is 5 × log25 (the second message is the previous message received by the NP chip that belongs to the multiple messages and whose source type is the first source type. Therefore, after the NP chip receives the second message, the number of messages that the NP chip has received that belong to the multiple messages and whose source type is the first source type is 5). The NP chip uses the intermediate value W corresponding to the first message. S The intermediate value W corresponding to the second message S Determine the increment value U corresponding to the first message S The value is 6×log26-5×log25. The NP chip uses the intermediate value S corresponding to the third message. S The incremental value U corresponding to the first message S Determine the intermediate value S corresponding to the first message S For: the intermediate value S corresponding to the third message S The sum of 6×log26-5×log25. The NP chip can use a scheme similar to the first message to obtain the intermediate value S corresponding to each of the multiple messages. SThe NP chip obtains the intermediate value S corresponding to the last message among the multiple messages. S Then, the NP chip sets the number of multiple messages and the median value S corresponding to the last message. S Substituting the information entropy calculation formula above, the source IP address entropy of the multiple packets is obtained (the NP chip uses the intermediate value S corresponding to the last packet). S Replace the summation part in the above information entropy calculation formula).

[0076] In a specific embodiment, the NP chip classifies the multiple packets according to their destination IP addresses. Based on the classification results of the multiple packets according to their destination IP addresses, the NP chip obtains the destination IP address entropy of the multiple packets through incremental calculation. In a specific embodiment, after receiving the first packet from the multiple packets, the NP chip classifies the first packet according to its destination IP address to determine the destination category of the first packet (for example, the destination category of the first packet is referred to as the first destination category). The NP chip determines the number f of packets that it has received that belong to the multiple packets and whose destination category is the first destination category. x (For example, if the multiple messages are messages within the first window, the NP chip determines the number f of messages f that the NP chip has received that belong to the first window and have a destination category of the first destination category.) x The NP chip determines the number of packets (f) that it has received that belong to the multiple packets and whose destination category is the first destination category. x Determine the intermediate value W corresponding to the first message. D The NP chip uses the intermediate value W corresponding to the first message. D The intermediate value W corresponding to the fourth message D Determine the increment value U corresponding to the first message D The NP chip uses the intermediate value S corresponding to the third message. D The incremental value U corresponding to the first message D Determine the intermediate value S corresponding to the first message D For example, the NP chip will use the intermediate value W corresponding to the first message. D The intermediate value W corresponding to the fourth message D The difference is determined as the increment value U corresponding to the first message. D The NP chip will use the intermediate value S corresponding to the third message. D Incremental value U corresponding to the first message D The sum is determined as the intermediate value S corresponding to the first message. DThe fourth message is a message received by the NP chip before the first message is received, the fourth message belongs to the plurality of messages (e.g., the plurality of messages are messages within the first window, and the fourth message belongs to the first window), and the fourth message is the last message received by the NP chip with the first destination category. The third message is a message received by the NP chip before the first message is received, the third message belongs to the plurality of messages (e.g., the plurality of messages are messages within the first window, and the third message belongs to the first window), and the third message is the last message received by the NP chip. It can be understood that the fourth message and the third message can be the same message or can not be the same message. The first message can be any one of the plurality of messages. In the case that the first message is the first message of the plurality of messages (i.e., the first message received by the NP chip belongs to the plurality of messages), the fourth message and the third message do not exist, the intermediate value W D corresponding to the fourth message is 0, the intermediate value S D corresponding to the third message is 0, the increment value U D corresponding to the first message is equal to the intermediate value W D corresponding to the first message, the intermediate value S D corresponding to the first message is equal to the intermediate value W D corresponding to the first message. For example, after the NP chip receives the first message, the NP chip determines that the number of messages received by the NP chip and belonging to the plurality of messages and having the first destination category is 8, the NP chip determines that the intermediate value W D corresponding to the first message is 8xlog28, the intermediate value W D corresponding to the fourth message is 7xlog27 (the fourth message is the last message received by the NP chip and belonging to the plurality of messages and having the first destination category, so that after the NP chip receives the fourth message, the number of messages received by the NP chip and belonging to the plurality of messages and having the first destination category is 7), the NP chip determines the increment value U D corresponding to the first message according to the intermediate value W D corresponding to the first message and the intermediate value W D corresponding to the fourth message. The NP chip determines the intermediate value S D corresponding to the first message according to the intermediate value S D corresponding to the third message and the increment value U D corresponding to the first message. The intermediate value S D corresponding to the third message is the sum of 8xlog28-7xlog27. The NP chip can use a similar scheme to the first message to obtain the intermediate value S DThe NP chip obtains the intermediate value S corresponding to the last packet in the plurality of packets D Then, the NP chip substitutes the number of the plurality of packets and the intermediate value S corresponding to the last packet in the plurality of packets into the information entropy calculation formula to obtain the source IP address entropy of the plurality of packets (the NP chip uses the intermediate value S corresponding to the last packet in the plurality of packets to substitute the summation part in the information entropy calculation formula). D Then, the NP chip substitutes the number of the plurality of packets and the intermediate value S corresponding to the last packet in the plurality of packets into the information entropy calculation formula to obtain the source IP address entropy of the plurality of packets (the NP chip uses the intermediate value S corresponding to the last packet in the plurality of packets to substitute the summation part in the information entropy calculation formula). D Then, the NP chip substitutes the number of the plurality of packets and the intermediate value S corresponding to the last packet in the plurality of packets into the information entropy calculation formula to obtain the source IP address entropy of the plurality of packets (the NP chip uses the intermediate value S corresponding to the last packet in the plurality of packets to substitute the summation part in the information entropy calculation formula).

[0077] In an optional embodiment, the NP chip uses a hash algorithm to count the classification of the plurality of packets, and the NP chip obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by means of incremental calculation according to the classification result of the plurality of packets. In a specific embodiment, the NP chip uses a hash algorithm to count the classification of the plurality of packets according to the source IP address of the plurality of packets, and the NP chip obtains the source IP address entropy of the plurality of packets by means of incremental calculation according to the classification result of the plurality of packets counted according to the source IP address. In addition, the NP chip uses a hash algorithm to count the classification of the plurality of packets according to the destination IP address of the plurality of packets, and the NP chip obtains the destination IP address entropy of the plurality of packets by means of incremental calculation according to the classification result of the plurality of packets counted according to the destination IP address.

[0078] In specific embodiments, the NP chip utilizes a hash algorithm to count the categories of the plurality of packets according to the source IP addresses of the plurality of packets, and the NP chip obtains the source IP address entropy of the plurality of packets by means of incremental calculation according to the counting results of the plurality of packets according to the source IP addresses. In specific embodiments, after the NP chip receives a first packet in the plurality of packets, the NP chip obtains the hash value of the source IP address of the first packet. The NP chip determines a first counting bucket corresponding to the hash value equal to the hash value of the source IP address of the first packet in the at least one first counting bucket (for example, the first counting bucket corresponding to the hash value equal to the hash value of the source IP address of the first packet is referred to as a target first counting bucket, and the source category corresponding to the target first counting bucket is a first source category). The NP chip adds 1 to the counting value of the target first counting bucket according to the hash value of the source IP address of the first packet to count the first packet by means of the target first counting bucket. The NP chip determines the counting value of the target first counting bucket after counting the first packet by means of the target first counting bucket (that is, the counting value of the target first counting bucket after adding 1 to the counting value of the target first counting bucket according to the hash value of the source IP address of the first packet), and the NP chip determines the counting value of the target first counting bucket before counting the first packet by means of the target first counting bucket (that is, the counting value of the target first counting bucket before adding 1 to the counting value of the target first counting bucket according to the hash value of the source IP address of the first packet). The NP chip determines the intermediate value W S corresponding to the first packet according to the counting value of the target first counting bucket after counting the first packet by means of the target first counting bucket. The NP chip determines the intermediate value W S corresponding to the second packet according to the counting value of the target first counting bucket before counting the first packet by means of the target first counting bucket. The NP chip determines the incremental value U S corresponding to the first packet according to the intermediate value W S corresponding to the first packet and the intermediate value W S corresponding to the second packet. The NP chip determines the intermediate value S S corresponding to the first packet according to the intermediate value S S corresponding to the third packet and the incremental value U S corresponding to the first packet. For example, the NP chip determines the difference between the intermediate value W S corresponding to the first packet and the intermediate value W S corresponding to the second packet as the incremental value U S corresponding to the first packet, and the NP chip determines the sum of the intermediate value S S corresponding to the third packet and the incremental value U S corresponding to the first packet as the intermediate value S SThe second message is a message received by the NP chip before receiving the first message. The second message belongs to the plurality of messages, and it is the previous message received by the NP chip with a source class of the first source class (i.e., the second message is the previous message received by the NP chip whose source IP address hash value is equal to the hash value of the source IP address of the first message; the second message is the previous message counted by the target first counting bucket before the NP chip counts the first message using the target first counting bucket). The third message is a message received by the NP chip before receiving the first message. The third message belongs to the plurality of messages, and it is the previous message received by the NP chip. The first message can be any one of the plurality of messages. If the first message is the first message among the plurality of messages, neither the second nor the third message exists; the count value of the target first counting bucket is 0 before counting the first message using the target first counting bucket, and the intermediate value W corresponding to the second message... S The value is 0, and the intermediate value S corresponding to the third message is 0. S The increment value U corresponding to the first message is 0. S Intermediate value W corresponding to the first message S Equal, the intermediate value S corresponding to the first message S Intermediate value W corresponding to the first message S They are equal. For example, after the NP chip uses the target first counter to count the first packet, the count value of the target first counter is 6. Before the NP chip uses the target first counter to count the first packet, the count value of the target first counter is 5. The NP chip determines the intermediate value W corresponding to the first packet. S The intermediate value W corresponding to the second message is 6×log26. S The value is 5×log25, and the NP chip uses the intermediate value W corresponding to the first message. S The intermediate value W corresponding to the second message S Determine the increment value U corresponding to the first message S The value is 6×log26-5×log25. The NP chip uses the intermediate value S corresponding to the third message. S The incremental value U corresponding to the first message S Determine the intermediate value S corresponding to the first message S For: the intermediate value S corresponding to the third message S The sum of 6×log26-5×log25. The NP chip can use a scheme similar to the first message to obtain the intermediate value S corresponding to each of the multiple messages. S The NP chip obtains the intermediate value S corresponding to the last message among the multiple messages. S Then, the NP chip sets the number of multiple messages and the median value S corresponding to the last message. SSubstitute the information entropy calculation formula above to obtain the source IP address entropy of the multiple packets.

[0079] In a specific embodiment, the NP chip uses a hash algorithm to classify the multiple packets according to their destination IP addresses. Based on the classification results of the multiple packets according to their destination IP addresses, the NP chip obtains the destination IP address entropy of the multiple packets through incremental calculation. In a specific embodiment, after receiving the first packet from the multiple packets, the NP chip obtains the hash value of the destination IP address of the first packet. The NP chip determines the second counting bucket whose hash value is equal to the hash value of the destination IP address of the first packet (for example, the second counting bucket whose hash value is equal to the hash value of the destination IP address of the first packet is called the target second counting bucket, and the destination category corresponding to the target second counting bucket is the first destination category). The NP chip increments the count value of the target second counting bucket by 1 according to the hash value of the destination IP address of the first packet, so as to count the first packet using the target second counting bucket. The NP chip determines the count value of the target second counter bucket after counting the first packet using the target second counter bucket (that is, the count value of the target second counter bucket after incrementing the count value of the target second counter bucket by 1 based on the hash value of the destination IP address of the first packet), and the count value of the target second counter bucket before counting the first packet using the target second counter bucket (that is, the count value of the target second counter bucket before incrementing the count value of the target second counter bucket by 1 based on the hash value of the destination IP address of the first packet). Based on the count value of the target second counter bucket after counting the first packet using the target second counter bucket, the NP chip determines the intermediate value W corresponding to the first packet. D The NP chip determines the intermediate value W corresponding to the fourth message based on the count value of the target second counter bucket before counting the first message using the target second counter bucket. D The NP chip uses the intermediate value W corresponding to the first message. D The intermediate value W corresponding to the fourth message D Determine the increment value U corresponding to the first message D The NP chip uses the intermediate value S corresponding to the third message. D The incremental value U corresponding to the first message D Determine the intermediate value S corresponding to the first message D For example, the NP chip will use the intermediate value W corresponding to the first message. D The intermediate value W corresponding to the fourth message D The difference is determined as the increment value U corresponding to the first message. D The NP chip will use the intermediate value S corresponding to the third message. D Incremental value U corresponding to the first messageD and the intermediate value S corresponding to the first packet is determined as the sum of the intermediate value W corresponding to the fourth packet and the intermediate value S corresponding to the third packet D . Wherein, the fourth packet is a packet received by the NP chip before the first packet is received, the fourth packet belongs to the plurality of packets, and the fourth packet is the last packet received by the NP chip with a destination category of the first destination category (i.e., the fourth packet is the last packet received by the NP chip with a hash value of a destination IP address equal to a hash value of a destination IP address of the first packet, and the fourth packet is the last packet counted by the target second counting bucket before the first packet is counted by the target second counting bucket). The third packet is a packet received by the NP chip before the first packet is received, the third packet belongs to the plurality of packets, and the third packet is the last packet received by the NP chip. The first packet can be any one of the plurality of packets. In the case that the first packet is the first packet of the plurality of packets, the fourth packet and the third packet do not exist, the counting value of the target second counting bucket before the first packet is counted by the target second counting bucket is 0, the intermediate value W corresponding to the fourth packet is 0, the intermediate value S corresponding to the third packet is 0, and the increment value U corresponding to the first packet is equal to the intermediate value W corresponding to the first packet, the intermediate value S corresponding to the first packet is equal to the intermediate value W corresponding to the first packet. For example, the counting value of the target second counting bucket after the first packet is counted by the target second counting bucket is 8, the counting value of the target second counting bucket before the first packet is counted by the target second counting bucket is 7, the NP chip determines the intermediate value W corresponding to the first packet as 8xlog28, the intermediate value W corresponding to the fourth packet is 7xlog27, the NP chip determines the increment value U corresponding to the first packet as 8xlog28-7xlog27 according to the intermediate value W corresponding to the first packet and the intermediate value W corresponding to the fourth packet, and the NP chip determines the intermediate value S corresponding to the first packet as the sum of the intermediate value S corresponding to the third packet and 8xlog28-7xlog27 according to the intermediate value S corresponding to the third packet and the increment value U corresponding to the first packet. The NP chip can obtain the intermediate value S corresponding to each packet of the plurality of packets by using a similar scheme as the first packet, and the NP chip obtains the intermediate value S corresponding to the last packet of the plurality of packets. D D D D D D D D D D D D D D D D D ​​​​​​​​​​​​​​​​Afterwards, the NP chip calculates the number of the plurality of packets and the intermediate value S corresponding to the last packet D The information entropy calculation formula is substituted to calculate the destination IP address entropy of the plurality of packets.

[0080] In an optional embodiment, the NP chip uses a hash algorithm to count the classification of the plurality of packets, and according to the classification result of the plurality of packets, the NP chip uses a function fitting algorithm to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by incremental calculation. In a specific embodiment, the NP chip uses a hash algorithm to count the classification of the plurality of packets according to the source IP address of the plurality of packets, and according to the classification result of the plurality of packets counted according to the source IP address, the NP chip uses a function fitting algorithm to obtain the source IP address entropy of the plurality of packets by incremental calculation. In addition, the NP chip uses a hash algorithm to count the classification of the plurality of packets according to the destination IP address of the plurality of packets, and according to the classification result of the plurality of packets counted according to the destination IP address, the NP chip uses a function fitting algorithm to obtain the destination IP address entropy of the plurality of packets by incremental calculation.

[0081] In a specific embodiment, the NP chip uses a hash algorithm to count the classification of the plurality of packets according to the source IP address of the plurality of packets, and according to the classification result of the plurality of packets counted according to the source IP address, the NP chip uses a function fitting algorithm to obtain the source IP address entropy of the plurality of packets by incremental calculation. In a specific embodiment, after the NP chip receives the first packet in the plurality of packets, the NP chip obtains the hash value of the source IP address of the first packet. The NP chip determines the first counting bucket corresponding to the hash value equal to the hash value of the source IP address of the first packet in the at least one first counting bucket (for example, the first counting bucket corresponding to the hash value equal to the hash value of the source IP address of the first packet is called the target first counting bucket, and the source category corresponding to the target first counting bucket is the first source category). The NP chip adds 1 to the counting value of the target first counting bucket according to the hash value of the source IP address of the first packet to count the first packet by using the target first counting bucket. The NP chip determines the counting value of the target first counting bucket after counting the first packet by using the target first counting bucket (that is, the counting value of the target first counting bucket after adding 1 to the counting value of the target first counting bucket according to the hash value of the source IP address of the first packet), and the NP chip determines the counting value of the target first counting bucket before counting the first packet by using the target first counting bucket (that is, the counting value of the target first counting bucket before adding 1 to the counting value of the target first counting bucket according to the hash value of the source IP address of the first packet). The NP chip determines the log value corresponding to the counting value of the target first counting bucket after counting the first packet by using the target first counting bucket by a function fitting algorithm (that is, log2(fx ), and further determines the intermediate value W corresponding to the first packet according to the count value and the log value (i.e. log2(f x ) corresponding to the count value. S The NP chip determines the log value (i.e. log2(f x ) corresponding to the count value before the target first count bucket is used to count the first packet according to the count value of the target first count bucket, and further determines the intermediate value W corresponding to the second packet according to the count value and the log value (i.e. log2(f x ) corresponding to the count value. S The NP chip determines the intermediate value W S corresponding to the first packet and the intermediate value W S corresponding to the second packet. S The NP chip determines the intermediate value S S corresponding to the first packet according to the intermediate value S S corresponding to the third packet and the increment value U S corresponding to the first packet. For example, the NP chip determines the increment value U S corresponding to the first packet as the difference between the intermediate value W S corresponding to the first packet and the intermediate value W S corresponding to the second packet, and determines the intermediate value S S corresponding to the first packet as the sum of the intermediate value S S corresponding to the third packet and the increment value U S corresponding to the first packet. The second packet is a packet received by the NP chip before the first packet is received, the second packet belongs to the plurality of packets, and the second packet is the last packet received by the NP chip with the first source category (i.e. the second packet is the last packet received by the NP chip with the hash value of the source IP address equal to the hash value of the source IP address of the first packet, and the second packet is the last packet counted by the target first count bucket before the target first count bucket is used to count the first packet). The third packet is a packet received by the NP chip before the first packet is received, the third packet belongs to the plurality of packets, and the third packet is the last packet received by the NP chip. The first packet can be any one of the plurality of packets. In the case that the first packet is the first packet of the plurality of packets, the second packet and the third packet do not exist, the count value of the target first count bucket before the target first count bucket is used to count the first packet is 0, the intermediate value W S corresponding to the second packet is 0, the intermediate value S S corresponding to the third packet is 0, and the increment value U S corresponding to the first packet is equal to the intermediate value WS equal, the intermediate value S corresponding to the first message S equal, the intermediate value W corresponding to the first message S equal. For example, the NP chip determines that the count value of the target first counting bucket is 6 after counting the first message by using the target first counting bucket, and the count value of the target first counting bucket is 5 before counting the first message by using the target first counting bucket. The NP chip determines the log value "log26" corresponding to the count value "6" by using the function fitting algorithm, and determines the intermediate value W corresponding to the first message according to the count value "6" and the log value "log26" corresponding to the count value "6". S The NP chip determines the log value "log25" corresponding to the count value "5" by using the function fitting algorithm, and determines the intermediate value W corresponding to the second message according to the count value "5" and the log value "log25" corresponding to the count value "5". S The NP chip determines the intermediate value S corresponding to the first message according to the intermediate value W corresponding to the first message S and the intermediate value W corresponding to the second message S determines the increment value U corresponding to the first message S The NP chip determines the intermediate value S corresponding to the first message according to the intermediate value S corresponding to the third message S and the increment value U corresponding to the first message S determines the intermediate value S corresponding to the first message S The NP chip determines the intermediate value S corresponding to the first message according to the intermediate value S corresponding to the third message S and the sum of 6*log26-5*log25. The NP chip can use a similar scheme as the first message to obtain the intermediate value S corresponding to each message in the plurality of messages S The NP chip obtains the intermediate value S corresponding to the last message in the plurality of messages S After that, the NP chip substitutes the number of the plurality of messages and the intermediate value S corresponding to the last message S into the above information entropy calculation formula to calculate the source IP address entropy of the plurality of messages.

[0082] In specific embodiments, the NP chip utilizes a hash algorithm to count the categories of the plurality of packets according to the destination IP addresses of the plurality of packets. According to the counting results of the plurality of packets according to the destination IP addresses, the NP chip utilizes a function fitting algorithm to obtain the destination IP address entropy of the plurality of packets by means of incremental calculation. In specific embodiments, after the NP chip receives a first packet in the plurality of packets, the NP chip obtains the hash value of the destination IP address of the first packet. The NP chip determines a second counting bucket corresponding to the hash value equal to the hash value of the destination IP address of the first packet in the at least one second counting bucket (for example, the second counting bucket corresponding to the hash value equal to the hash value of the destination IP address of the first packet is referred to as a target second counting bucket, and the destination category corresponding to the target second counting bucket is a first destination category). The NP chip adds 1 to the counting value of the target second counting bucket according to the hash value of the destination IP address of the first packet, so as to count the first packet by means of the target second counting bucket. The NP chip determines the counting value of the target second counting bucket after counting the first packet by means of the target second counting bucket (that is, the counting value of the target second counting bucket after adding 1 to the counting value of the target second counting bucket according to the hash value of the destination IP address of the first packet), and the NP chip determines the counting value of the target second counting bucket before counting the first packet by means of the target second counting bucket (that is, the counting value of the target second counting bucket before adding 1 to the counting value of the target second counting bucket according to the hash value of the destination IP address of the first packet). According to the counting value of the target second counting bucket after counting the first packet by means of the target second counting bucket, the NP chip determines the log value (that is, log2(f x )) corresponding to the counting value by means of the function fitting algorithm, and further determines the intermediate value W x corresponding to the first packet according to the counting value and the log value (that is, log2(f D ) corresponding to the counting value. According to the counting value of the target second counting bucket before counting the first packet by means of the target second counting bucket, the NP chip determines the log value (that is, log2(f x )) corresponding to the counting value by means of the function fitting algorithm, and further determines the intermediate value W x corresponding to the fourth packet according to the counting value and the log value (that is, log2(f D ) corresponding to the counting value. According to the intermediate value W D corresponding to the first packet and the intermediate value W D corresponding to the fourth packet, the NP chip determines the incremental value U D corresponding to the first packet. According to the intermediate value S D corresponding to the third packet and the incremental value U D corresponding to the first packet, the NP chip determines the intermediate value S DFor example, the NP chip will use the intermediate value W corresponding to the first message. D The intermediate value W corresponding to the fourth message D The difference is determined as the increment value U corresponding to the first message. D The NP chip will use the intermediate value S corresponding to the third message. D Incremental value U corresponding to the first message D The sum is determined as the intermediate value S corresponding to the first message. D The fourth message is a message received by the NP chip before receiving the first message. The fourth message belongs to the plurality of messages and is the previous message received by the NP chip with a destination category of the first destination category (i.e., the fourth message is the previous message received by the NP chip whose destination IP address hash value is equal to the hash value of the destination IP address of the first message; the fourth message is the previous message counted by the target second counting bucket before the NP chip counts the first message using the target second counting bucket). The third message is a message received by the NP chip before receiving the first message. The third message belongs to the plurality of messages and is the previous message received by the NP chip. The first message can be any one of the plurality of messages. If the first message is the first message among the plurality of messages, neither the fourth nor the third message exists. Before counting the first message using the target second counting bucket, the count value of the target second counting bucket is 0, and the intermediate value W corresponding to the fourth message... D The value is 0, and the intermediate value S corresponding to the third message is 0. D The increment value U corresponding to the first message is 0. D Intermediate value W corresponding to the first message D Equal, the intermediate value S corresponding to the first message D Intermediate value W corresponding to the first message D They are equal. For example, after the NP chip uses the target second counting bucket to count the first packet, the count value of the target second counting bucket is 8. Before the NP chip uses the target second counting bucket to count the first packet, the count value of the target second counting bucket is 7. The NP chip determines the log value "log28" corresponding to the count value "8" through a function fitting algorithm. The NP chip determines the intermediate value W corresponding to the first packet based on the count value "8" and the log value "log28" corresponding to the count value "8". D The value is 8 × log28. The NP chip determines the log value "log27" corresponding to the count value "7" using a function fitting algorithm. Based on the count value "7" and its corresponding log value "log27", the NP chip determines the intermediate value W corresponding to the fourth message. D The value is 7 × log27. The NP chip uses the intermediate value W corresponding to the first message. D The intermediate value W corresponding to the fourth messageD Determine the increment value U corresponding to the first message D The value is 8×log28-7×log27. The NP chip uses the intermediate value S corresponding to the third message. D The incremental value U corresponding to the first message D Determine the intermediate value S corresponding to the first message D The intermediate value S corresponding to the third message D The sum of 8×log28-7×log27. The NP chip can use a scheme similar to the first message to obtain the intermediate value S corresponding to each of the multiple messages. D The NP chip obtains the intermediate value S corresponding to the last message among the multiple messages. D Then, the NP chip sets the number of multiple messages and the median value S corresponding to the last message. D Substitute the values ​​into the above information entropy calculation formula to obtain the destination IP address entropy of the multiple packets.

[0083] In an optional embodiment, the NP chip determines whether the first data stream is a DDoS attack stream based on the source IP address entropy and the destination IP address entropy of the plurality of packets, including: the NP chip determines whether a DDoS attack has occurred based on the source IP address entropy and the destination IP address entropy of the plurality of packets; and the NP chip determines whether the first data stream is a DDoS attack stream if a DDoS attack has occurred.

[0084] In specific embodiments, the NP chip determines whether the source IP address entropy of the plurality of packets is greater than a first threshold value, and the NP chip determines whether the destination IP address entropy of the plurality of packets is less than a second threshold value; the NP chip determines that a DDoS attack occurs in a case that the source IP address entropy of the plurality of packets is greater than the first threshold value and / or the destination IP address entropy of the plurality of packets is less than the second threshold value, otherwise, the NP chip determines that a DDoS attack does not occur. For example, the NP chip determines that a DDoS attack occurs in a case that the source IP address entropy of the plurality of packets is greater than the first threshold value and the destination IP address entropy of the plurality of packets is less than the second threshold value; the NP chip determines that a DDoS attack does not occur in a case that the source IP address entropy of the plurality of packets is not greater than the first threshold value and / or the destination IP address entropy of the plurality of packets is not less than the second threshold value. It should be noted that information entropy is used to reflect the degree of disorder of information; the more chaotic and random the information is, the greater its information entropy is; on the contrary, the more concentrated and ordered the information is, the smaller its information entropy is. And the DDoS attack is a network attack implemented by multiple devices (i.e. source devices) on the same device (i.e. destination device), and the characteristics of the DDoS attack are: a large number of attack sources (i.e. source devices, including "dummies" of the attack party, etc.) send a large number of data to the same destination device to consume the resources (such as bandwidth resources) of the destination device, so as to achieve the effect of paralyzing the destination device. This situation of sending a large number of data by a large number of attack sources to the same destination device can be described as "many to one". Based on the characteristics of the DDoS attack, it can be determined that when a DDoS attack occurs, the source IP addresses of the plurality of packets received by the NP chip are relatively chaotic and random, and the destination IP addresses of the plurality of packets are relatively concentrated and ordered. Further combining the meaning of information entropy, it can be determined that when a DDoS attack occurs, the source IP address entropy of the plurality of packets received by the NP chip is relatively large, and the destination IP address entropy of the plurality of packets is relatively small. In the case that the source IP address entropy of the plurality of packets is greater than the first threshold value and the destination IP address entropy of the plurality of packets is less than the second threshold value, it indicates that the source IP address entropy of the plurality of packets is relatively large, the degree of disorder of the source IP addresses of the plurality of packets is relatively large, the source IP addresses of the plurality of packets are relatively chaotic and random, and it indicates that the destination IP address entropy of the plurality of packets is relatively small, the degree of disorder of the destination IP addresses of the plurality of packets is relatively small, the destination IP addresses of the plurality of packets are relatively concentrated and ordered, which is consistent with the characteristics of the DDoS attack. Therefore, in the embodiments of the present application, the NP chip determines that a DDoS attack occurs in the case that the source IP address entropy of the plurality of packets is greater than the first threshold value and the destination IP address entropy of the plurality of packets is less than the second threshold value, which can improve the accuracy of determining a DDoS attack.

[0085] In optional embodiments, the plurality of packets is packets in a first window, the first threshold is a source IP address entropy threshold corresponding to the first window, and the second threshold is a destination IP address entropy threshold corresponding to the first window. The first threshold can be determined by a sliding average of source IP address entropy of packets in historical windows, and the second threshold can be determined by a sliding average of destination IP address entropy of packets in the historical windows. In specific embodiments, the second window is a previous window of the first window, and the NP chip determines a source IP address average entropy corresponding to the second window and a destination IP address average entropy corresponding to the second window. The NP chip determines a source IP address average entropy corresponding to the first window according to the source IP address entropy of the plurality of packets in the first window and the source IP address average entropy corresponding to the second window, and determines the first threshold according to the source IP address average entropy corresponding to the first window. The NP chip determines a destination IP address average entropy corresponding to the first window according to the destination IP address entropy of the plurality of packets in the first window and the destination IP address average entropy corresponding to the second window, and determines the second threshold according to the destination IP address average entropy corresponding to the first window. In specific embodiments, the NP chip determines the source IP address average entropy corresponding to the first window as an average of the source IP address entropy of the plurality of packets in the first window and the source IP address average entropy corresponding to the second window, and determines the first threshold by floating the source IP address average entropy corresponding to the first window by a certain range. The NP chip determines the destination IP address average entropy corresponding to the first window as an average of the destination IP address entropy of the plurality of packets in the first window and the destination IP address average entropy corresponding to the second window, and determines the second threshold by sinking the destination IP address average entropy corresponding to the first window by a certain range. For example, the NP chip floats the source IP address average entropy corresponding to the first window by 1.2 times the source IP address average entropy to obtain the first threshold, and the NP chip sinks the destination IP address average entropy corresponding to the first window by 0.8 times the destination IP address average entropy to obtain the second threshold. The source IP address average entropy corresponding to the second window is an average of source IP address entropy of packets in the second window and source IP address average entropy corresponding to a third window, the destination IP address average entropy corresponding to the second window is an average of destination IP address entropy of packets in the second window and destination IP address average entropy corresponding to the third window, and the third window is a previous window of the second window. Further, the source IP address average entropy corresponding to the third window is an average of source IP address entropy of packets in the third window and source IP address average entropy corresponding to a fourth window, the destination IP address average entropy corresponding to the third window is an average of destination IP address entropy of packets in the third window and destination IP address average entropy corresponding to the fourth window, and the fourth window is a previous window of the third window.That is, the source IP address average entropy corresponding to the ith window is the average of the source IP address entropy of the plurality of messages in the ith window and the source IP address average entropy corresponding to the (i-1)th window; the destination IP address average entropy corresponding to the ith window is the average of the destination IP address entropy of the plurality of messages in the ith window and the destination IP address average entropy corresponding to the (i-1)th window. In the case of i=1, the source IP address average entropy corresponding to the ith window is the source IP address entropy of the plurality of messages in the ith window, and the destination IP address average entropy corresponding to the ith window is the destination IP address entropy of the plurality of messages in the ith window. Thus, the first threshold value is determined according to the source IP address entropy of the messages in the historical window by means of sliding average, and the second threshold value is determined according to the destination IP address entropy of the messages in the historical window by means of sliding average.

[0086] For example, FIG. 3 shows a graph of the curve of the source IP address average entropy corresponding to the window and the curve of the source IP address entropy threshold value (for example, the first threshold value described above) corresponding to the window. The horizontal axis (x-axis) in FIG. 3 represents the window, and the vertical axis (y-axis) represents the source IP address entropy. The curve Q0 S represents the curve of the source IP address average entropy corresponding to the window, and each position point on the curve Q0 S corresponds to a window and a source IP address average entropy. The curve Q1 S represents the curve of the source IP address entropy threshold value corresponding to the window, and each position point on the curve Q1 S corresponds to a window and a source IP address entropy threshold value. For example, the position point B on the curve Q0 S corresponds to the first window, and the position point A on the curve Q1 S corresponds to the first window. The coordinate value on the y-axis of the position point B is the source IP address average entropy corresponding to the first window, and the coordinate value on the y-axis of the position point A is the source IP address entropy threshold value corresponding to the first window. As can be seen from FIG. 3, the curve Q1 S is obtained by translating the curve Q0 S by a certain distance in the positive direction of the y-axis, and thus the source IP address entropy threshold value corresponding to any window is obtained by floating a certain range of the source IP address average entropy corresponding to the any window.

[0087] For example, FIG. 4 shows a graph of the curve of the destination IP address average entropy corresponding to the window and the curve of the destination IP address entropy threshold value (for example, the second threshold value described above) corresponding to the window. The horizontal axis (x-axis) in FIG. 4 represents the window, and the vertical axis (y-axis) represents the destination IP address entropy. The curve Q0 D represents the curve of the destination IP address average entropy corresponding to the window, and each position point on the curve Q0 D corresponds to a window and a destination IP address average entropy. The curve Q1 DThe curve Q1 represents the entropy threshold of the destination IP address corresponding to the window. D Each location point on the curve corresponds to a window and a destination IP address entropy threshold. For example, curve Q0 D Position point C and curve Q1 D Position point D corresponds to the first window. The y-coordinate of position point C is the average entropy of the destination IP address corresponding to the first window, and the y-coordinate of position point D is the entropy threshold of the destination IP address corresponding to the first window. Referring to Figure 4, curve Q1... D By adjusting the curve Q0 along the negative y-axis D The threshold for the destination IP address entropy corresponding to any window is obtained by shifting it by a certain distance. Therefore, the threshold for the destination IP address entropy corresponding to any window is obtained by subtracting a certain range from the average entropy of the destination IP address corresponding to any window.

[0088] If the NP chip determines that a DDoS attack has occurred based on the aforementioned multiple packets, the NP chip determines whether the first data stream is a DDoS attack stream. In a specific embodiment, the NP chip identifies the packets belonging to the first data stream from among the multiple packets, and then determines whether the first data stream is a DDoS attack stream based on these packets. For example, the NP chip determines the packets belonging to the first data stream based on the source IP address and destination IP address of the multiple packets.

[0089] In an optional embodiment, the aforementioned plurality of packets are packets within a first window, and the second window is the window preceding the first window. The NP chip determines whether the first data stream is a DDoS attack stream based on the packets belonging to the first data stream within the plurality of packets in the first window and the packets belonging to the first data stream within the plurality of packets in the second window. Specifically, in a concrete embodiment, the NP chip determines the number of packets belonging to the first data stream within the plurality of packets in the first window; the NP chip determines the number of packets belonging to the first data stream within the plurality of packets in the second window; the NP chip determines whether the number of packets belonging to the first data stream in the first window has increased compared to the number of packets belonging to the first data stream in the second window; if the number of packets belonging to the first data stream in the first window has increased compared to the number of packets belonging to the first data stream in the second window, the NP chip determines that the first data stream is a DDoS attack stream.

[0090] In a specific embodiment, the NP chip uses a hash algorithm to count the classification of the plurality of packets in the first window according to the source IP addresses of the plurality of packets, and the NP chip uses a hash algorithm to count the classification of the plurality of packets in the first window according to the destination IP addresses of the plurality of packets. In the process of using the hash algorithm to count the classification of the plurality of packets in the first window according to the source IP addresses of the plurality of packets, the NP chip uses the at least one first counting bucket to count the plurality of packets according to the source IP addresses of the plurality of packets. In the process of using the hash algorithm to count the classification of the plurality of packets in the first window according to the destination IP addresses of the plurality of packets, the NP chip uses the at least one second counting bucket to count the plurality of packets according to the destination IP addresses of the plurality of packets. Moreover, in the process of performing DDoS detection based on the plurality of packets in the second window, the NP chip uses a hash algorithm to count the classification of the plurality of packets in the second window according to the source IP addresses of the plurality of packets, and the NP chip uses a hash algorithm to count the classification of the plurality of packets in the second window according to the destination IP addresses of the plurality of packets. In the process of using the hash algorithm to count the classification of the plurality of packets in the second window according to the source IP addresses of the plurality of packets, the NP chip uses the at least one first counting bucket to count the plurality of packets according to the source IP addresses of the plurality of packets. In the process of using the hash algorithm to count the classification of the plurality of packets in the second window according to the destination IP addresses of the plurality of packets, the NP chip uses the at least one second counting bucket to count the plurality of packets according to the destination IP addresses of the plurality of packets. After the NP chip completes counting the plurality of packets in the second window, the NP chip clears the counting values of the at least one first counting bucket and the at least one second counting bucket, and then the NP chip performs DDoS detection based on the plurality of packets in the first window. After the NP chip determines the classification of the packets in the second window, the counting value of each first counting bucket in the at least one first counting bucket and the counting value of each second counting bucket in the at least one second counting bucket are determined. Moreover, after the NP chip determines the classification of the packets in the first window, the counting value of each first counting bucket in the at least one first counting bucket and the counting value of each second counting bucket in the at least one second counting bucket are determined. After the NP chip determines that, compared to the second window, the first counting bucket with a rising counting value and the second counting bucket with a rising counting value after counting the classification of the packets in the first window, the NP chip determines that the data flow (for example, the first data flow) corresponding to the source IP address of the first counting bucket with a rising counting value and the destination IP address of the second counting bucket with a rising counting value corresponds to a DDoS attack flow.

[0091] S203. The NP chip intercepts the first data flow in the case that the first data flow is a DDoS attack flow.

[0092] In one embodiment, the NP chip directly intercepts the first data stream in the case that the first data stream is a DDoS attack stream. In a specific embodiment, please refer to FIG. 5, which shows a schematic diagram of an NP chip provided by an embodiment of the present application, the NP chip comprising a DDoS detection unit, the DDoS detection unit being configured to detect whether the first data stream is a DDoS attack stream, and intercept the first data stream in the case that the first data stream is a DDoS attack stream. That is, S202 to S203 are performed by the DDoS detection unit. As shown in FIG. 5, the NP chip further comprises n forwarding units, n being a positive integer. The n forwarding units are connected in sequence, the n forwarding units correspond to n forwarding processes, and each forwarding unit is configured to perform forwarding processing of a corresponding process on a packet. The DDoS detection unit can be connected between any two forwarding units.

[0093] In another embodiment, the NP chip generates an ACL entry according to information of the first data stream in the case that the first data stream is a DDoS attack stream, and intercepts the first data stream according to the ACL entry. The ACL entry comprises information of the first data stream and action information; the information of the first data stream can comprise information of a DDoS attack source (for example, an IP address of a source end of the first data stream); and the action information is configured to indicate an intercepting action, and the ACL entry is configured to indicate intercepting the first data stream. In a specific embodiment, please refer to FIG. 6, which shows a schematic diagram of another NP chip provided by an embodiment of the present application, the NP chip comprising a DDoS detection unit and an intercepting unit, the DDoS detection unit being configured to detect whether the first data stream is a DDoS attack stream, and send information of the first data stream to the intercepting unit in the case that the first data stream is a DDoS attack stream. The intercepting unit is configured to generate the ACL entry according to the information of the first data stream, and intercept the first data stream according to the ACL entry. That is, S202 is performed by the DDoS detection unit, and S203 is performed by the intercepting unit. As shown in FIG. 6, the NP chip further comprises n forwarding units, n being a positive integer. The n forwarding units are connected in sequence, the n forwarding units correspond to n forwarding processes, and each forwarding unit is configured to perform forwarding processing of a corresponding process on a packet. The DDoS detection unit can be connected between any two forwarding units, the intercepting unit can be connected between any two forwarding units, and the DDoS detection unit is connected with the intercepting unit.

[0094] In an optional embodiment, in the ACL entry generated by the NP chip, the information of the first data flow is the IP address of the source end of the first data flow (i.e., the information of the DDoS attack source), and after the NP chip generates the ACL entry, the NP chip continues to detect the DDoS attack. In the detection process, when the NP chip determines that the source end of the first data flow changes to be a non-DDoS attack source, the NP chip updates the action information in the ACL entry, so that the ACL entry is used to instruct to forward the traffic from the source end to avoid affecting the normal service.

[0095] It should be noted that FIG. 5 and FIG. 6 take the DDoS detection unit connected between two forwarding units as an example. In actual application, the DDoS detection unit can also be connected before the forwarding unit 1, or the DDoS detection unit can also be connected after the forwarding unit n. In the case that the DDoS detection unit is connected before the forwarding unit 1, the DDoS detection unit detects the DDoS attack before the forwarding unit 1 performs the forwarding processing on the packet. In the case that the DDoS detection unit is connected after the forwarding unit n, the DDoS detection unit detects the DDoS attack after the forwarding unit n performs the forwarding processing on the packet. The embodiments of the present application do not limit the specific position of the DDoS detection unit.

[0096] In an optional embodiment, the DDoS detection unit includes a statistics subunit, an entropy calculation subunit, and a detection subunit. The statistics subunit is configured to count the categories of the plurality of packets (for example, count the categories of the plurality of packets by using a hash algorithm). The entropy calculation subunit is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets according to the category results of the plurality of packets. The statistics subunit is configured to determine whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

[0097] In an optional embodiment, in the case that the first data flow is a DDoS attack flow, the NP chip further reports DDoS attack information related to the first data flow to a central processing unit (CPU) in the network device where the NP chip is located, so that the CPU can present the DDoS attack information by means of a presentation component (for example, a display component) of the network device. The DDoS attack information can include but is not limited to: the information of the DDoS attack source (for example, the IP address of the source end of the first data flow), the information of the DDoS attack target (for example, the IP address of the destination end of the first data flow), the peak value of the DDoS attack traffic, etc., and the embodiments of the present application do not limit this.

[0098] In summary, the technical scheme provided by the embodiments of the present application detects and intercepts the DDoS attack flow by the NP chip. The process of detecting the DDoS attack flow does not need to interact with the network device and the analysis device, and thus the detection speed is fast, the detection time is short (the detection time can be reduced to milliseconds or even microseconds by the embodiments of the present application), the detection efficiency is high, and the traffic cost caused by the interaction between the network device and the analysis device can be avoided. Since the detection time of the NP chip is short, the NP chip can update the ACL table item in time according to the detection result, so as to avoid affecting the normal service.

[0099] The embodiments of the present application provide a scheme for classifying packets. The NP chip classifies a plurality of packets by using a hash algorithm, which can simplify the process of classifying the packets, and thus simplify the process of determining whether the first data flow is a DDoS attack flow according to the classification results of the plurality of packets.

[0100] The embodiments of the present application provide a scheme for obtaining IP address entropy. The NP chip obtains the source IP address entropy of a plurality of packets and the destination IP address entropy of the plurality of packets by using a function fitting algorithm, which can simplify the process of obtaining the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets. Further, the NP chip obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by incremental calculation. Compared with obtaining the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets after receiving all the packets in the plurality of packets, the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets can be obtained by incremental calculation during the process of receiving the plurality of packets by the NP chip (that is, the NP chip receives the plurality of packets and obtains the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets at the same time), and thus the detection time of the whole process can be reduced, the calculation resources of the NP chip can be saved, and the forwarding efficiency of the NP chip will not be affected.

[0101] The above is the introduction of the method embodiments of the present application. The device embodiments of the present application are introduced below. The device of the present application is used to execute the method of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments.

[0102] Please refer to FIG. 7, which shows a schematic diagram of an attack detection device 700 provided by the embodiments of the present application. The attack detection device 700 is applied to an NP chip. For example, the attack detection device 700 is an NP chip or a functional component in the NP chip. The NP chip is in a network device, which can be any network device in the application scenario shown in FIG. 1.

[0103] As shown in FIG. 7, the attack detection apparatus 700 comprises a receiving module 710, a detection module 720 and an intercepting module 730.

[0104] The receiving module 710 is configured to receive the first data stream.

[0105] The detection module 720 is configured to detect whether the first data stream is a DDoS attack stream.

[0106] The intercepting module 730 is configured to intercept the first data stream in the case that the first data stream is a DDoS attack stream.

[0107] The function implementation of the receiving module 710 can refer to the related description in S201, the function implementation of the detection module 720 can refer to the related description in S202, and the function implementation of the intercepting module 730 can refer to the related description in S203.

[0108] In an optional embodiment, the detection module 720 is configured to: count the classification of a plurality of packets by using a hash algorithm, the plurality of packets being the packets in the traffic received by the receiving module 710, the traffic comprising the first data stream; and determine whether the first data stream is a DDoS attack stream according to the classification result of the plurality of packets.

[0109] In an optional embodiment, the detection module 720 is configured to: obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets according to the classification result of the plurality of packets; and determine whether the first data stream is a DDoS attack stream according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

[0110] In an optional embodiment, the detection module 720 is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by using a function fitting algorithm according to the classification result of the plurality of packets.

[0111] In an optional embodiment, the detection module 720 is configured to: obtain the source IP address entropy of a plurality of packets and the destination IP address entropy of the plurality of packets, the plurality of packets being the packets in the traffic received by the receiving module 710, the traffic comprising the first data stream; and determine whether the first data stream is a DDoS attack stream according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

[0112] In an optional embodiment, the detection module 720 is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by using a function fitting algorithm.

[0113] In an optional embodiment, the detection module 720 is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets in an incremental calculation manner. In an optional embodiment, the detection module 720 is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets in an incremental calculation manner.

[0114] In an optional embodiment, the detection module 720 is configured to determine whether a DDoS attack occurs according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets, and determine whether the first data flow is a DDoS attack flow in the case where the DDoS attack occurs.

[0115] In an optional embodiment, the detection module 720 is configured to determine that a DDoS attack occurs in the case where the source IP address entropy of the plurality of packets is greater than a first threshold value and / or the destination IP address entropy of the plurality of packets is less than a second threshold value.

[0116] In an optional embodiment, the plurality of packets are packets in a first window, and the first window is a time window or a length window.

[0117] In an optional embodiment, the NP chip comprises a DDoS detection unit, and the DDoS detection unit comprises the detection module 720 and the interception module 730.

[0118] In an optional embodiment, the NP chip comprises a DDoS detection unit and an interception unit, the DDoS detection unit comprises the detection module 720, and the interception unit comprises the interception module 730; the detection module 720 is configured to detect whether the first data flow is a DDoS attack flow, and send information of the first data flow to the interception module 730 in the case where the first data flow is a DDoS attack flow; and the interception module 730 is configured to generate an ACL entry according to the information of the first data flow, and intercept the first data flow according to the ACL entry.

[0119] In summary, the technical scheme provided by the present application detects and intercepts a DDoS attack flow by using an NP chip, and the process of detecting a DDoS attack flow does not need to interact with a network device and an analysis device, so that the time consumption of detecting a DDoS attack flow is short and the efficiency is high.

[0120] It should be understood that the attack detection apparatus provided by the embodiments of the present application can also be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The attack detection method provided by the method embodiments can also be implemented by software. When the attack detection method provided by the method embodiments is implemented by software, each module in the attack detection apparatus can also be a software module.

[0121] Based on the same inventive concept, the embodiments of the present application provide an NP chip, which comprises the attack detection apparatus as shown in FIG. 7.

[0122] Based on the same inventive concept, the embodiments of the present application provide a network device, which comprises the NP chip.

[0123] Please refer to FIG. 8, which shows a schematic diagram of a network device 800 provided by the embodiments of the present application. The network device 800 can be any network device in the application scenario shown in FIG. 1. The network device 800 comprises a processor 802, a memory 804, an NP chip 806, a communication interface 808, and a bus 810. The processor 802, the memory 804, the NP chip 806, and the communication interface 808 are communicatively connected through the bus 810. The connection mode between the processor 802, the memory 804, the NP chip 806, and the communication interface 808 shown in FIG. 8 is only an example, and the processor 802, the memory 804, the NP chip 806, and the communication interface 808 can also be connected in a connection mode other than the bus 810.

[0124] The memory 804 is configured to store a computer program 8042, which can include instructions and data. The memory 804 can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, optical storage, and registers, etc.

[0125] The processor 802 can be a general-purpose processor, which can be a processor that reads and executes computer programs (such as the computer program 8042) stored in the memory (such as the memory 804) to perform specific steps and / or operations, and can use data stored in the memory (such as the memory 804) in the process of executing the above steps and / or operations. The general-purpose processor can be a central processing unit (CPU). The processor 802 can also be a special-purpose processor, which is a processor specially designed to perform specific steps and / or operations. The special-purpose processor can be a digital signal processor (DSP), an ASIC, or an FPGA, etc. The processor 802 can be a combination of multiple processors, such as a multi-core processor.

[0126] The NP chip 806, also known as a forwarding chip, is mainly used for packet forwarding. In the embodiments of the present application, the NP chip 806 is also used to detect DDoS attacks in the process of forwarding packets, and to process DDoS attack flows to defend against DDoS attacks. For example, the NP chip 806 includes an attack detection apparatus 700 as shown in FIG. 7 to detect DDoS attacks.

[0127] The communication interface 808 can include an input / output (I / O) interface, a physical interface, and a logical interface, etc. for realizing the interconnection of devices inside the network device 800, and for realizing the interconnection of the network device 800 with other devices. The physical interface can be a POS interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, etc. for realizing the interconnection of the network device 800 with other devices. The logical interface is an interface inside the network device 800, which can be used to realize the interconnection of devices inside the network device 800. It is easy to understand that the communication interface 808 can be used for the network device 800 to communicate with other devices, for example, the communication interface 808 is used for the sending and receiving of messages between the network device 800 and other devices.

[0128] The bus 810 can be any type of communication bus for realizing the interconnection of the processor 802, the memory 804, the NP chip 806, and the communication interface 808. For example, the bus 810 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 810 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is shown in FIG. 8, but it does not mean that there is only one bus or only one type of bus.

[0129] The above-mentioned devices in the network device 800 can be respectively arranged on independent chips from each other, or at least partially or entirely arranged on the same chip. Whether to arrange each device independently on different chips or to integrate on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above-mentioned devices.

[0130] The network device 800 shown in FIG. 8 is only exemplary, and in the implementation process, the network device 800 can also include other components, which are not listed one by one herein.

[0131] Based on the same inventive concept, the embodiments of the present application provide a computer readable storage medium, the computer readable storage medium stores a computer program, when the computer program is executed (for example, executed by the NP chip, the attack detection apparatus, etc.), all or part of the steps of the attack detection method provided by the method embodiment shown in FIG. 2 are realized.

[0132] Based on the same inventive concept, the embodiment of the present application provides a computer program product, which comprises a program or code, when the program or code is executed (for example, executed by the NP chip, the attack detection apparatus, etc.), all or part of the steps of the attack detection method provided by the method embodiment shown in FIG. 2 are implemented.

[0133] Based on the same inventive concept, the embodiment of the present application provides a chip, which comprises a programmable logic circuit and / or program instructions, and when the chip is running, all or part of the steps of the attack detection method provided by the method embodiment shown in FIG. 2 are implemented. The chip is an NP chip.

[0134] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product, which comprises one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a computer network or other programmable devices. The computer instructions can be stored in a computer readable storage medium of the computer, or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line) or wireless (for example, infrared, wireless, microwave, etc.). The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media, or semiconductor media (for example, solid state disk) and the like.

[0135] It should be understood that the term "at least one" in the present application means one or more, and the term "multiple" means two or more. In the present application, unless otherwise specified, the symbol " / " generally represents the meaning of or, for example, A / B can represent A or B. The term "and / or" in the present application is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent three cases of A alone, A and B together, and B alone. In addition, in order to clearly describe, the present application uses "first", "second", "third" and the like to distinguish the same items or similar items with basically the same function and role. Those skilled in the art can understand that "first", "second", "third" and the like do not limit the quantity and execution order.

[0136] The method embodiments and device embodiments provided by the embodiments of the present application can be mutually referred to, the order of the method embodiments can be adjusted, the operations can be increased or decreased according to the situation, any person skilled in the art can easily think of the changed method within the technical range disclosed by the present application, which should be covered in the protection range of the present application, therefore, it is not repeated.

[0137] In the corresponding embodiments provided by the present application, it should be understood that the disclosed apparatuses can be implemented in other manners. For example, the division of the apparatus embodiments is merely an example, and the division of the modules can be changed according to the actual needs. For example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, and can be electrical, or other forms. The modules described as separated components can or can not be physically separated, and the components described as modules can or can not be physical modules. They can be located in one place or distributed on a plurality of network devices. Some or all of the modules can be selected according to the actual needs to achieve the purposes of the embodiments of the present application.

[0138] The above describes only exemplary embodiments of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, which should be covered in the protection range of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An attack detection method characterized by, The method comprises: A network processor (NP) chip receives a first data stream; The NP chip detects whether the first data stream is a distributed denial of service (DDoS) attack stream; The NP chip intercepts the first data stream if the first data stream is a DDoS attack stream.

2. The method of claim 1, wherein, The NP chip detects whether the first data stream is a DDoS attack stream, comprising: The NP chip uses a hash algorithm to count the classification of a plurality of packets, wherein the plurality of packets are packets in traffic received by the NP chip, and the traffic includes the first data stream; The NP chip determines whether the first data stream is a DDoS attack stream according to the classification results of the plurality of packets.

3. The method of claim 2, wherein, The NP chip determines whether the first data stream is a DDoS attack stream according to the classification results of the plurality of packets, comprising: The NP chip obtains source Internet Protocol (IP) address entropy of the plurality of packets and destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets; The NP chip determines whether the first data stream is a DDoS attack stream according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

4. The method of claim 3, wherein, The NP chip obtains source Internet Protocol (IP) address entropy of the plurality of packets and destination IP address entropy of the plurality of packets according to the classification results of the plurality of packets, comprising: The NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets using a function fitting algorithm according to the classification results of the plurality of packets.

5. The method of claim 1, wherein, The NP chip detects whether the first data stream is a DDoS attack stream, comprising: The NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets, wherein the plurality of packets are packets in traffic received by the NP chip, and the traffic includes the first data stream; The NP chip determines whether the first data stream is a DDoS attack stream according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

6. The method of claim 5, wherein, The NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets, comprising: The NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets using a function fitting algorithm.

7. The method according to any one of claims 3-6, characterized in that, The NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets, comprising: The NP chip obtains source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets by incremental calculation.

8. The method according to any one of claims 3-7, characterized in that, The NP chip determines whether the first data stream is a DDoS attack stream according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets, comprising: The NP chip determines whether a DDoS attack occurs according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets; The NP chip determines whether the first data stream is a DDoS attack stream if a DDoS attack occurs.

9. The method of claim 8, wherein, The NP chip determines whether a DDoS attack occurs according to source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets, including: The NP chip determines that a DDoS attack occurs in a case where the source IP address entropy of the plurality of packets is greater than a first threshold value and / or the destination IP address entropy of the plurality of packets is less than a second threshold value.

10. The method of any one of claims 2-9, wherein: The plurality of packets are packets in a first window, and the first window is a time window or a length window.

11. The method according to any one of claims 1 to 10, characterized in that, The NP chip includes a DDoS detection unit; The DDoS detection unit is configured to: detect whether the first data flow is a DDoS attack flow; and intercept the first data flow in a case where the first data flow is a DDoS attack flow.

12. The method according to any one of claims 1 to 10, characterized in that, The NP chip includes a DDoS detection unit and an interception unit; The DDoS detection unit is configured to: detect whether the first data flow is a DDoS attack flow; and send information of the first data flow to the interception unit in a case where the first data flow is a DDoS attack flow. The interception unit is configured to: generate an access control list (ACL) entry according to the information of the first data flow; and intercept the first data flow according to the ACL entry.

13. An attack detection apparatus characterized by comprising: The attack detection apparatus is applied to a network processor (NP) chip, and the attack detection apparatus includes: A receiving module configured to receive a first data flow; A detection module configured to detect whether the first data flow is a distributed denial of service (DDoS) attack flow; An interception module configured to intercept the first data flow in a case where the first data flow is a DDoS attack flow.

14. The attack detection apparatus according to claim 13, characterized by, The detection module is configured to: count categories of a plurality of packets by using a hash algorithm, the plurality of packets being packets in traffic received by the receiving module, and the traffic including the first data flow; determine whether the first data flow is a DDoS attack flow according to a result of the counting of the categories of the plurality of packets.

15. The attack detection apparatus according to claim 14, characterized by The detection module is configured to: obtain source Internet Protocol (IP) address entropy of the plurality of packets and destination IP address entropy of the plurality of packets according to the result of the counting of the categories of the plurality of packets; determine whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

16. The attack detection apparatus according to claim 15, characterized by The detection module is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by using a function fitting algorithm according to the result of the counting of the categories of the plurality of packets.

17. The attack detection apparatus according to claim 13, characterized by The detection module is configured to: obtain source IP address entropy of the plurality of packets and destination IP address entropy of the plurality of packets, the plurality of packets being packets in traffic received by the receiving module, and the traffic including the first data flow; determine whether the first data flow is a DDoS attack flow according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets.

18. The attack detection apparatus according to claim 17, characterized by, The detection module is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by using a function fitting algorithm.

19. The attack detection apparatus according to any one of claims 15 to 18, characterized by, The detection module is configured to obtain the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets by means of incremental calculation.

20. The attack detection apparatus according to any one of claims 15 to 19, characterized by, The detection module is configured to: determine whether a DDoS attack occurs according to the source IP address entropy of the plurality of packets and the destination IP address entropy of the plurality of packets; in the case where a DDoS attack occurs, determine whether the first data flow is a DDoS attack flow.

21. The attack detection apparatus according to claim 20, wherein The detection module is configured to determine that a DDoS attack occurs in the case where the source IP address entropy of the plurality of packets is greater than a first threshold and / or the destination IP address entropy of the plurality of packets is less than a second threshold.

22. The attack detection apparatus according to any one of claims 14-21, wherein: the plurality of packets are packets in a first window, and the first window is a time window or a length window.

23. The attack detection apparatus according to any one of claims 13 to 22, characterized by The NP chip comprises a DDoS detection unit. The DDoS detection unit comprises the detection module and the interception module.

24. The attack detection apparatus according to any one of claims 13 to 22, characterized by, The NP chip comprises a DDoS detection unit and an interception unit, the DDoS detection unit comprises the detection module, and the interception unit comprises the interception module. The detection module is configured to: detect whether the first data flow is a DDoS attack flow; and in the case where the first data flow is a DDoS attack flow, send information of the first data flow to the interception module. The interception module is configured to: generate an access control list (ACL) entry according to the information of the first data flow; and intercept the first data flow according to the ACL entry.

25. A network processor (NP) chip, comprising: The attack detection apparatus according to any one of claims 13-24.

26. A network device, comprising: The NP chip according to claim 25.

27. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed to implement the attack detection method according to any one of claims 1-12.

28. A computer program product, characterised in that, The computer program product comprises a program or code, and the program or code is executed to implement the attack detection method according to any one of claims 1-12.

Images