Attack detection device, method, and apparatus

Abstract

Embodiments of the present application provide an attack detection device, method, and apparatus, which are used for solving the problems in the existing technology of the inability to scale a single CPU core to multiple cores, occupation of a large quantity of computing resources, and low processing efficiency. For each piece of NetFlow traffic, on the basis of a source IP and a destination IP in a five-tuple of the NetFlow traffic as well as a stored IP address range processed by each traffic-statistics CPU core, the NetFlow traffic is sent to a corresponding target traffic-statistics CPU core. Each traffic-statistics CPU core counts the number of packets and the number of bytes of NetFlow traffic for each IP address within the IP address range, and performs DDoS detection. The aggregation of NetFlow traffic for the same IP address and DDoS detection are directly completed in the traffic-statistics CPU core, so that there is no need to transmit the NetFlow traffic to a single CPU core for aggregation, thereby reducing the occupation of computing resources, improving processing efficiency, and further enabling core scaling.

Description

An attack detection device, method and apparatus

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411736881.3, filed on November 29, 2024, entitled "An Attack Detection Device, Method, Apparatus and Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This invention relates to the field of data processing technology, and in particular to an attack detection device, method, and apparatus. Background Technology

[0004] Figure 1 illustrates the current NetFlow traffic statistics and Distributed Denial of Service (DDoS) attack detection process. After receiving at least one data packet, the processor distributes the received packets sequentially to each Central Processing Unit (CPU) core for NetFlow parsing according to a packet-by-packet distribution rule. After parsing, the processor obtains the NetFlow traffic encapsulated in the data packet and its 5-tuple. The 5-tuple is then hashed, and based on the hash result, the corresponding NetFlow traffic is distributed to the corresponding traffic statistics CPU core. Each traffic statistics CPU core reconstructs the NetFlow traffic received from that CPU core, determining the number of packets and bytes for each NetFlow traffic in each preset period, and then identifies the source Internet Protocol (IP) protocol for each NetFlow traffic. The protocol (IP) and destination IP, along with the number of packets and bytes in each preset period, are sent to a single CPU core. The single CPU core aggregates the traffic based on the received information, calculates the total number of packets and bytes of all NetFlow traffic corresponding to each IP address in each statistical period, and performs DDoS detection for each IP address based on the total number of packets and bytes of all NetFlow traffic corresponding to that IP address in each statistical period.

[0005] However, since traffic aggregation and DDoS detection are performed using a single CPU core, there are performance bottlenecks such as the inability to expand the number of CPU cores and the large amount of computing resources consumed, resulting in low processing efficiency. Summary of the Invention

[0006] This application provides an attack detection device, method, and apparatus to solve the problems in the prior art where a single CPU core cannot be expanded, occupies a large amount of computing resources, and has low processing efficiency.

[0007] In a first aspect, embodiments of this application provide an attack detection device, the device including a processor, multiple parsing central processing unit (CPU) cores, and multiple traffic statistics CPU cores;

[0008] The processor is configured to receive each data packet to be analyzed that encapsulates NetFlow traffic with network detection function, and to send each data packet to be analyzed sequentially to each parsing CPU core.

[0009] Each of the parsing CPU cores is used to parse each received data packet to be analyzed, to obtain the encapsulated NetFlow traffic and the corresponding 5-tuple, packet number and byte number; for each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core;

[0010] Each traffic statistics CPU core is used to count the number of packets and bytes of NetFlow traffic for each IP address within the IP address range processed by that CPU core. Based on the number of packets and bytes of NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed.

[0011] Secondly, embodiments of this application provide an attack detection method, the method comprising:

[0012] Receive data packets to be analyzed, each encapsulated with NetFlow traffic;

[0013] The received data packets to be analyzed are parsed to obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count. For each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core in the attack detection device, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core. Each traffic statistics CPU core counts the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core. Based on the packet count and byte count of the NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed.

[0014] Thirdly, embodiments of this application also provide an attack detection device, the device comprising:

[0015] The receiving module is used to receive various data packets to be analyzed, which encapsulate NetFlow traffic.

[0016] The processing module is used to parse the received data packets to be analyzed, obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count; for each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core in the attack detection device, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core; each traffic statistics CPU core counts the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core, and performs distributed denial-of-service (DDoS) attack detection based on the packet count and byte count of the NetFlow traffic for each IP address.

[0017] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the attack detection method as described in any of the preceding claims.

[0018] In this embodiment, the attack detection device includes a processor, multiple parsing CPU cores, and multiple traffic statistics CPU cores. The processor receives data packets encapsulated with NetFlow traffic and sequentially sends each data packet to be analyzed to one of the parsing CPU cores. Each parsing CPU core parses the received data packets to obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count. For each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the stored IP address range processed by each traffic statistics CPU core, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core. Each traffic statistics CPU core... Each traffic statistics CPU core is used to count the number of packets and bytes of NetFlow traffic for each IP address within the IP address range it processes. Based on the number of packets and bytes of NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed. This allows multiple traffic statistics CPU cores to process NetFlow traffic within their respective IP address ranges. The aggregation of NetFlow traffic for the same IP address and DDoS detection are completed directly within the traffic statistics CPU core, eliminating the need to transfer the traffic to a single CPU core for aggregation. This reduces the computing resources occupied by each traffic statistics CPU core and improves processing efficiency. Furthermore, since each traffic statistics CPU core only processes NetFlow traffic within the IP address range corresponding to its own traffic statistics CPU core, it can be expanded to include more cores. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 is a schematic diagram of the current NetFlow traffic statistics and DDoS detection process;

[0021] Figure 2 is a schematic diagram of an attack detection device provided in an embodiment of this application;

[0022] Figure 3 is a schematic diagram of a DDoS detection process provided in an embodiment of this application;

[0023] Figure 4 is one of the schematic diagrams of the statistical period of NetFlow traffic provided in the embodiments of this application;

[0024] Figure 5 is a second schematic diagram of the statistical period of NetFlow traffic provided in an embodiment of this application;

[0025] Figure 6 is a schematic diagram of the current NetFlow traffic restoration method;

[0026] Figure 7 is a schematic diagram of an attack detection process provided in an embodiment of this application;

[0027] Figure 8 is a schematic diagram of an attack detection process provided in an embodiment of this application;

[0028] Figure 9 is a schematic diagram of an attack detection device provided in an embodiment of this application;

[0029] Figure 10 is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives and implementation methods of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the exemplary embodiments described are only some embodiments of this application, and not all embodiments.

[0031] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0032] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0033] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0034] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0035] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0036] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be obtained based on the above teachings. The selection and description of the above embodiments are for the purpose of better explaining the principles and practical applications, thereby enabling those skilled in the art to better utilize the described embodiments and various different variations of embodiments suitable for specific use considerations.

[0037] This application provides an attack detection device, method, and apparatus. The attack detection device includes a processor, multiple parsing central processing unit (CPU) cores, and multiple traffic statistics CPU cores. The processor is used to receive data packets encapsulated with NetFlow traffic and send each data packet to be analyzed sequentially to each parsing CPU core. Each parsing CPU core is used to parse the received data packets to obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count. For each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the stored IP address range processed by each traffic statistics CPU core, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core. Each traffic statistics CPU core is used to count the number of packets and bytes of NetFlow traffic for each IP address within the IP address range processed by that CPU core. Based on the number of packets and bytes of NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed. This allows multiple traffic statistics CPU cores to process NetFlow traffic within their respective IP address ranges. The aggregation of NetFlow traffic and DDoS detection for the same IP address can be completed directly within the traffic statistics CPU core, eliminating the need to transfer the traffic to a single CPU core for aggregation. This reduces the computing resources occupied by each traffic statistics CPU core and improves processing efficiency. Furthermore, since each traffic statistics CPU core only processes NetFlow traffic within the IP address range corresponding to that CPU core, it can be expanded.

[0038] Example 1:

[0039] Figure 2 is a schematic diagram of an attack detection device provided in an embodiment of this application. The attack detection device includes a processor 201, multiple parsing central processing unit (CPU) cores 202, and multiple traffic statistics CPU cores 203.

[0040] Processor 201 is used to receive each data packet to be analyzed that encapsulates NetFlow traffic, and send each data packet to be analyzed sequentially to each parsing CPU core 202;

[0041] Each parsing CPU core 202 is used to parse the received data packets to be analyzed, and obtain the encapsulated NetFlow traffic and the corresponding five-tuple, packet number and byte number; for each NetFlow traffic, based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core 203, the target traffic statistics CPU core 203 corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core 203;

[0042] Each traffic statistics CPU core 203 is used to count the number of packets and bytes of NetFlow traffic for each IP address within the IP address range processed by the traffic statistics CPU core 203. Based on the number of packets and bytes of NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed.

[0043] Processor 201 receives each data packet to be analyzed via a high-performance multi-queue Data Plane Development Kit (DPDK). The data packets to be analyzed can be User Datagram Protocol (UPD) packets, which encapsulate NetFlow traffic.

[0044] After receiving the data packet to be analyzed, as shown in Figure 3, a schematic diagram of the DDoS detection process, the processor 201 adopts a packet-by-packet distribution rule to send each data packet to be analyzed sequentially to each parsing CPU core 202 in order to improve parsing efficiency.

[0045] Each parsing CPU core 202 uses NetFlow v5 or NetFlow v9 tools to parse the data packets to be analyzed sent to the NetFlow parsing module, and obtains the NetFlow traffic encapsulated in each data packet, as well as the NetFlow traffic's 5-tuple, packet count, and byte count fields.

[0046] The five-tuple of NetFlow traffic includes source IP, destination IP, protocol, source port, and destination port; the NetFlow parsing module can be a CPU core used for NetFlow parsing, etc., which is not limited here.

[0047] In one possible implementation, in the embodiments of this application, each parsing CPU core 202 stores the IP address range processed by each traffic statistics CPU core 203. A traffic statistics CPU core 203 is used for summarizing NetFlow traffic and DDoS detection for one or more IP addresses, and a traffic statistics CPU core 203 corresponds to one or more IP address ranges. An IP address range contains one or more IP addresses, and the IP address ranges corresponding to each traffic statistics CPU core 203 do not overlap.

[0048] Therefore, after obtaining the five-tuple of each parsed NetFlow traffic, as shown in Figure 3, each parsing CPU core 202 determines the target traffic statistics CPU core 203 corresponding to each NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core 203. The NetFlow traffic and the source IP and destination IP, packet count, and byte count in the corresponding five-tuple are then sent to the target traffic statistics CPU core 203.

[0049] In another possible implementation, in the embodiments of this application, each parsing CPU core 202 stores a hash value corresponding to any IP address within the IP address range processed by each traffic statistics CPU core 203.

[0050] Therefore, after obtaining the five-tuple of each parsed NetFlow traffic, each parsing CPU core 202 hashes the source IP and destination IP in the five-tuple of each NetFlow traffic to determine the target hash value corresponding to the source IP and destination IP of the NetFlow traffic. Based on the target hash value corresponding to the source IP and destination IP of the NetFlow traffic, and the hash value corresponding to any IP address within the IP address range processed by each traffic statistics CPU core 203, the target traffic statistics CPU core 203 corresponding to the NetFlow traffic is determined, and the NetFlow traffic and the source IP and destination IP, packet count, and byte count in the corresponding five-tuple are sent to the target traffic statistics CPU core 203.

[0051] After receiving NetFlow traffic and the source and destination IPs, packet counts, and byte counts in the corresponding 5-tuple, each target traffic statistics CPU core 203, for each IP address within the IP address range processed by the target traffic statistics CPU core 203, determines at least one NetFlow traffic corresponding to that IP address based on the source and destination IPs in the 5-tuples of the NetFlow traffic received by the target traffic statistics CPU core 203; and counts the packet counts and byte counts of each NetFlow traffic corresponding to that IP address to determine the total number of packets and bytes of all NetFlow traffic corresponding to that IP address; and determines whether the total number of packets of all NetFlow traffic corresponding to that IP address exceeds a first preset number of packets, or whether the total number of bytes of all NetFlow traffic corresponding to that IP address exceeds a first preset number of bytes. If so, it is determined that the IP address is under DDoS attack.

[0052] In this embodiment, multiple traffic statistics CPU cores process NetFlow traffic within their respective IP address ranges. The aggregation of NetFlow traffic for the same IP address and DDoS detection are performed directly within the traffic statistics CPU core, eliminating the need to transfer the traffic to a single CPU core for aggregation. This reduces the computational resources occupied by each traffic statistics CPU core, improves processing efficiency, and allows for further expansion of the CPU core since each traffic statistics CPU core only processes NetFlow traffic within the IP address range corresponding to that core.

[0053] Example 2:

[0054] In order to accurately summarize NetFlow traffic, based on the above embodiments, in this embodiment of the application, each traffic statistics CPU core 203 is specifically used to determine the statistical period of each NetFlow traffic based on the start and end times of the NetFlow traffic corresponding to the IP address for any IP address within the IP address range processed by the traffic statistics CPU core 203. Based on the statistical period of each NetFlow traffic and the number of packets and bytes of each NetFlow traffic corresponding to the IP address, the target number of packets and target number of bytes of all NetFlow traffic corresponding to the IP address in each statistical period is determined.

[0055] In this embodiment, each target traffic statistics CPU core 203, for any IP address within the IP address range processed by the target traffic statistics CPU core 203, determines the statistical period for each NetFlow traffic based on the start and end times carried by each NetFlow traffic corresponding to that IP address, as well as the start and end times of each statistical period. The duration of each statistical period is the same; for example, the duration of each statistical period is 5 seconds.

[0056] For any NetFlow traffic corresponding to the IP address, the first duration of each statistical period occupied by the NetFlow traffic is determined based on the statistical period occupied by the NetFlow traffic, the start time and the end time of each statistical period, and the ratio of the first duration of each statistical period occupied by the NetFlow traffic to the total duration corresponding to the start time and end time of the NetFlow traffic is determined. Based on the ratio of the first duration of each statistical period occupied by the NetFlow traffic to the total duration, and the number of packets and bytes of the NetFlow traffic, the number of target sub-packets and the number of target sub-bytes of the NetFlow traffic in each statistical period are determined.

[0057] For each statistical period, based on the number of target sub-packets and target sub-bytes of each NetFlow traffic corresponding to the IP address within that statistical period, determine the number of target packets and target bytes of all NetFlow traffic corresponding to the IP address within that statistical period.

[0058] In one possible implementation, for any IP address, after obtaining the number of target packets and the number of target bytes corresponding to all NetFlow traffic for that IP address in each statistical period, it is determined whether the number of target packets for that IP address exceeds a first preset number or the number of target bytes exceeds a second preset number in any statistical period. If so, it is determined that the IP address is under DDoS attack.

[0059] In this embodiment of the application, the number of target packets and the number of target bytes of all NetFlow traffic corresponding to each IP address are counted in each statistical period, so as to facilitate accurate summarization of NetFlow traffic.

[0060] Example 3:

[0061] Based on the above embodiments, in this embodiment, each traffic statistics CPU core 203 is specifically used to determine, for any NetFlow traffic corresponding to the IP address, whether the start time and end time carried in the NetFlow traffic are within the same statistical period. If so, the statistical period is determined to be the statistical period occupied by the NetFlow traffic. If not, when the statistical periods where the start time and end time are located are adjacent, the adjacent statistical period is determined to be the statistical period occupied by the NetFlow traffic. If the statistical periods where the start time and end time are located are not adjacent, the statistical periods where the start time and end time are located and the statistical period between these two statistical periods are all determined to be the statistical period occupied by the NetFlow traffic.

[0062] In this embodiment of the application, for any NetFlow traffic corresponding to the IP address, it is determined whether the start time and end time carried in the NetFlow traffic are within the same statistical period. If so, the statistical period is determined to be the statistical period occupied by the NetFlow traffic, and the statistical period occupied by the NetFlow traffic is determined to be one.

[0063] For example, as shown in Figure 4, which illustrates one of the statistical periods occupied by NetFlow traffic, the start time of this NetFlow traffic is 10:30:11 and the end time is 10:30:13. The statistical periods are [10:30:05, 10:30:10], [10:30:10, 10:30:15], [10:30:15, 10:30:20], [10:30:20, 10:30:25], and [10:30:25, 10:30:30]. By determining that the start and end times carried in this NetFlow traffic are all within the same statistical period [10:30:10, 10:30:15], the statistical period [10:30:10, 10:30:15] is determined as the statistical period occupied by this NetFlow traffic, and the statistical period occupied by this NetFlow traffic is determined to be one.

[0064] If the start and end times carried in the NetFlow traffic are not within the same statistical period, then the first statistical period containing the start time of the NetFlow traffic and the second statistical period containing the end time of the NetFlow traffic are determined. It is then determined whether the first and second statistical periods are adjacent. If they are adjacent, then the two adjacent statistical periods are determined as the statistical periods occupied by the NetFlow traffic, that is, the first statistical period containing the start time of the NetFlow traffic and the second statistical period containing the end time of the NetFlow traffic are determined as the statistical periods occupied by the NetFlow traffic. If they are not adjacent, then the first statistical period, the second statistical period, and the statistical period located between the first and second statistical periods are all determined as the statistical periods occupied by the NetFlow traffic, and it is determined that there are multiple statistical periods occupied by the NetFlow traffic.

[0065] For example, as shown in Figure 5, which illustrates the second statistical period of NetFlow traffic, the start time of this NetFlow traffic is 10:30:12 and the end time is 10:30:22. The statistical periods are [10:30:05, 10:30:10], [10:30:10, 10:30:15], [10:30:15, 10:30:20], [10:30:20, 10:30:25], and [10:30:25, 10:30:30]. It is determined that the start and end times carried in this NetFlow traffic are not in the same statistical period, and that the start time of this NetFlow traffic is within the statistical period [10:30:10, 10:30:15]. The end time of the tFlow traffic falls within the statistical period [10:30:20, 10:30:25]. Since the statistical period where the start time is located [10:30:10, 10:30:15] and the statistical period where the end time is located [10:30:20, 10:30:25] are not adjacent, the statistical period where the start time of the NetFlow traffic is located [10:30:10, 10:30:15], the statistical period where the end time is located [10:30:20, 10:30:25], and the statistical period [10:30:15, 10:30:20] between these two statistical periods are all determined as the statistical periods occupied by the NetFlow traffic, and it is determined that the NetFlow traffic occupies multiple statistical periods.

[0066] Example 4:

[0067] To further accurately summarize NetFlow traffic, based on the above embodiments, in this embodiment, each traffic statistics CPU core 203 is specifically used for any NetFlow traffic. If the statistical period occupied by the NetFlow traffic is one, the number of packets and bytes corresponding to the NetFlow traffic are determined as the target sub-packet number and target sub-byte number within the statistical period. If the statistical period occupied by the NetFlow traffic is multiple, the time period occupied by the NetFlow traffic is determined according to the start time and end time of the NetFlow traffic. Based on the length of the time period within each statistical period and the number of packets and bytes of the NetFlow traffic, the target sub-packet number and target sub-byte number of the NetFlow traffic within each statistical period are determined.

[0068] Currently, when calculating the number of packets and bytes in NetFlow traffic across different statistical periods, a sliding window is typically used to reconstruct the data on the time axis. The reconstruction ratio of this sliding window is usually a fixed ratio or determined according to a statistical distribution such as a normal distribution. Figure 6 illustrates the current NetFlow traffic reconstruction method. In the current statistical period corresponding to the received NetFlow traffic, 50% of the packet and byte counts are reconstructed; in the preceding and following statistical periods, 20% are reconstructed respectively; and in the periods preceding the preceding period and following the following period, 5% are reconstructed respectively. However, using a fixed ratio without considering the start and end times of the NetFlow traffic can introduce errors. Using a reconstruction ratio determined by a statistical distribution such as a normal distribution makes it difficult to accurately determine the proportions for each statistical period, resulting in poor accuracy in NetFlow traffic reconstruction. Therefore, in order to improve the accuracy of NetFlow traffic restoration, in this embodiment of the application, the proportion of NetFlow traffic in each statistical period is determined by combining the start time and end time of NetFlow traffic. The process of NetFlow traffic restoration provided by this application is described below.

[0069] In this embodiment of the application, for any NetFlow traffic corresponding to the IP address, if the statistical period occupied by the NetFlow traffic is one, the number of packets corresponding to the NetFlow traffic is determined as the target sub-packet number within the statistical period, and the number of bytes corresponding to the NetFlow traffic is determined as the target sub-byte number within the statistical period.

[0070] Taking Figure 4 as an example, the number of packets and bytes of the NetFlow traffic is 100. Since the statistical period occupied by the NetFlow traffic is one [10:30:10, 10:30:15], in this embodiment, the number of packets corresponding to the NetFlow traffic, 100, is determined as the target sub-packet number within the statistical period [10:30:10, 10:30:15], and the number of bytes corresponding to the NetFlow traffic, 5000, is determined as the target sub-byte number within the statistical period [10:30:10, 10:30:15].

[0071] In this embodiment, for any NetFlow traffic corresponding to the IP address, if the statistical period occupied by the NetFlow traffic is multiple, the time period occupied by the NetFlow traffic is determined according to the start time and end time of the NetFlow traffic; the length of the time period occupied by the NetFlow traffic within each statistical period is determined according to the time period occupied by the NetFlow traffic and the start time and end time of each statistical period occupied by the NetFlow traffic; for each statistical period occupied by the NetFlow traffic, the product of the ratio of the length of the time period within the statistical period to the length of the time period, the number of packets and the number of bytes of the NetFlow traffic is determined as the target number of sub-packets of the NetFlow traffic within the statistical period, and the product of the ratio and the number of bytes of the NetFlow traffic is determined as the target number of sub-bytes of the NetFlow traffic within the statistical period.

[0072] If the product of the ratio and the number of messages is not an integer, or the product of the ratio and the number of bytes is not an integer, then rounding or integer rounding can be used to determine the integer product of the ratio and the number of messages or the integer product of the ratio and the number of bytes.

[0073] In one possible implementation, if the NetFlow traffic occupies two statistical periods, then for the statistical period in which the start time of the NetFlow traffic is located, the length of the time period occupied by the NetFlow traffic within that statistical period is determined by the difference between the end time of the statistical period and the start time of the NetFlow traffic, based on the end time of the statistical period in which the start time of the NetFlow traffic is located; for the statistical period in which the end time of the NetFlow traffic is located, the length of the time period occupied by the NetFlow traffic within that statistical period is determined by the difference between the end time of the NetFlow traffic and the start time of the statistical period, based on the start time of the statistical period in which the end time of the NetFlow traffic is located.

[0074] In another possible implementation, if the NetFlow traffic occupies more than two statistical periods, then for the statistical period in which the start time of the NetFlow traffic is located, the length of the time period occupied by the NetFlow traffic within that statistical period is determined by the difference between the end time of the statistical period and the start time of the NetFlow traffic, based on the end time of the statistical period in which the end time of the NetFlow traffic is located; for the statistical period in which the end time of the NetFlow traffic is located, the length of the time period occupied by the NetFlow traffic within that statistical period is determined by the difference between the end time of the NetFlow traffic and the start time of the statistical period, based on the start time of the statistical period in which the end time of the NetFlow traffic is located; for each statistical period between these two statistical periods, the length of that statistical period is determined as the length of the time period occupied by the NetFlow traffic within that statistical period.

[0075] Taking Figure 5 as an example, the NetFlow traffic has 100 packets and 5000 bytes. Since the statistical periods occupied by this NetFlow traffic are three: [10:30:10, 10:30:15], [10:30:15, 10:30:20], and [10:30:20, 10:30:25], for the statistical period [10:30:10, 10:30:15], based on the start time of the NetFlow traffic (10:30:12) and the end time of the statistical period (10:30:15), the length of the time segment occupied by this NetFlow traffic within the statistical period is determined to be 3 seconds. Furthermore, the duration of this NetFlow traffic within the statistical period is determined to be... The ratio of the length of the time period occupied by the tFlow traffic within the statistical period to the length of the time period is 3 / 10. The product of this ratio (3 / 10) and the number of packets (100) of the NetFlow traffic (30) is determined as the target number of sub-packets of the NetFlow traffic within the statistical period. The product of this ratio (3 / 10) and the number of bytes (5000) of the NetFlow traffic (1500) is determined as the target number of sub-bytes of the NetFlow traffic within the statistical period. For the statistical period [10:30:15, 10:30:20], the length of the statistical period, i.e., 5 seconds, is determined as the time period occupied by the NetFlow traffic within the statistical period. The length of the period within the statistical period is calculated, and the ratio of the length of the time period occupied by the NetFlow traffic within the statistical period to the time period is determined to be 5 / 10. The product of this ratio (5 / 10) and the number of packets (100) of the NetFlow traffic (50) is determined as the target number of sub-packets of the NetFlow traffic within the statistical period. The product of this ratio (5 / 10) and the number of bytes (5000) of the NetFlow traffic (2500) is determined as the target number of sub-bytes of the NetFlow traffic within the statistical period. For the statistical period [10:30:20, 10:30:25], the end time of the NetFlow traffic is 10:30. Given :22 and the start time of the statistical period 10:30:20, the length of the time period occupied by the NetFlow traffic within the statistical period is determined to be 2 seconds, and the ratio of the length of the time period occupied by the NetFlow traffic within the statistical period to the time period is determined to be 2 / 10. The product of the ratio (2 / 10) and the number of packets (100) of the NetFlow traffic (20) is determined as the target number of sub-packets of the NetFlow traffic within the statistical period, and the product of the ratio (2 / 10) and the number of bytes (5000) of the NetFlow traffic (1000) is determined as the target number of sub-bytes of the NetFlow traffic within the statistical period.

[0076] In this embodiment, the proportion of NetFlow traffic in each statistical period is determined by combining the start and end times of NetFlow traffic. This does not involve complex calculations, is simple and practical, and can more accurately count the proportion of NetFlow traffic in each statistical period, making it easier to further summarize the NetFlow traffic in each statistical period more accurately.

[0077] Example 5:

[0078] Based on the above embodiments, in this embodiment, each parsing CPU core 202 is further configured to count the number of NetFlow traffic corresponding to the same source IP or the same destination IP based on the source IP and destination IP in the five-tuple of each NetFlow traffic; for each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number; if not, for the NetFlow traffic of that source IP or destination IP, continue to execute the step of determining the target traffic statistics CPU core 203 corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core 203.

[0079] In this embodiment of the application, after obtaining the quintuple of each NetFlow traffic after parsing, the number of NetFlow traffic corresponding to the same source IP and the number of NetFlow traffic corresponding to the same destination IP are counted according to the source IP and destination IP in the quintuple of each NetFlow traffic.

[0080] For each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number. If not, determine that each NetFlow traffic corresponding to that IP address is a non-top NetFlow traffic.

[0081] For each non-top NetFlow traffic, the next step is to determine the target traffic statistics CPU core 203 corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core 203.

[0082] Example 6:

[0083] In order to avoid exceeding the processing capacity of a single traffic statistics CPU core, based on the above embodiments, the device in this application embodiment also includes a main CPU core;

[0084] Each parsing CPU core 202 is also used to determine the NetFlow traffic of the source IP or destination IP as top NetFlow traffic if the amount of NetFlow traffic of the source IP or destination IP is greater than a preset amount, and to distribute each top NetFlow traffic to each traffic statistics CPU core 203.

[0085] Each traffic statistics CPU core 203 is also used to count the number of packets and bytes of each top NetFlow traffic received by the traffic statistics CPU core 203 corresponding to the source IP or destination IP, and send the number of packets and bytes of each top NetFlow traffic in the traffic statistics CPU core 203 and the corresponding IP address information to the main CPU core.

[0086] The main CPU core is used to count the number of packets and bytes of each top NetFlow traffic sent by CPU core 203, as well as the corresponding IP address information, and to count the total number of packets and bytes of each top NetFlow traffic corresponding to that IP address. Based on the total number of packets and bytes, DDoS detection is performed.

[0087] If the parsing CPU core 202 determines that the total number of NetFlow traffic corresponding to a certain source IP or destination IP is greater than a preset number, then each NetFlow traffic corresponding to that source IP or destination IP is determined as top NetFlow traffic. Since the number of top NetFlow traffic corresponding to the same IP address is large, it usually exceeds the processing capacity of a single traffic statistics CPU core. Therefore, in this embodiment, each top NetFlow traffic is distributed according to the rule of flow-by-flow distribution, that is, each top NetFlow traffic is sequentially distributed to each traffic statistics CPU core 203.

[0088] After receiving top NetFlow traffic from IPs outside the range processed by that traffic statistics CPU core 203, each traffic statistics CPU core 203 counts the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or the same destination IP received by that traffic statistics CPU core 203 in each statistical period, and sends the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or the same destination IP in each statistical period, as well as the corresponding IP address information, to the main CPU core.

[0089] The process of calculating the number of packets and bytes of all top NetFlow traffic received by the traffic statistics CPU core 203 corresponding to the same source IP or the same destination IP in each statistical period is the same as the process of summarizing NetFlow traffic in each statistical period provided in the above embodiment, and will not be described again here.

[0090] After receiving the number of packets and bytes of all top NetFlow traffic corresponding to the same IP address in each statistical period from each traffic statistics CPU core 203, the main CPU core synchronously calculates the total number of packets and bytes of all top NetFlow traffic sent by each traffic statistics CPU core 203 for the corresponding IP address in each statistical period, based on the IP address corresponding to the top NetFlow traffic sent by each traffic statistics CPU core 203 and the number of packets and bytes in each statistical period.

[0091] In one possible implementation, the main CPU core determines whether the total number of packets of all top NetFlow traffic corresponding to the same IP address exceeds a second preset number of packets, or whether the total number of bytes of all top NetFlow traffic corresponding to the same IP address exceeds a second preset number of bytes. If so, it is determined that the IP address is under DDoS attack.

[0092] In another possible implementation, the main CPU core determines whether the number of target packets or the number of target bytes for all top NetFlow traffic corresponding to the same IP address exceeds a third preset number or a fourth preset number within any statistical period. If so, it determines that the IP address is under DDoS attack.

[0093] In this embodiment of the application, by identifying a large number of top NetFlow traffic corresponding to the same IP address, the top NetFlow traffic is distributed to each traffic statistics CPU core for initial statistics, and then the statistics results are sent to the main CPU core for final aggregation, thus avoiding exceeding the processing capacity of a single traffic statistics CPU core.

[0094] Example 7:

[0095] In order to ensure that each traffic statistics CPU core can achieve optimal performance, based on the above embodiments, in this embodiment of the application, each parsing CPU core 202 is specifically used to obtain the amount of top NetFlow traffic that each traffic statistics CPU core 203 can handle; determine the proportion of top NetFlow traffic to be distributed to each traffic statistics CPU core 203 based on the amount of top NetFlow traffic that each traffic statistics CPU core 203 can handle; and distribute each top NetFlow traffic based on the proportion of top NetFlow traffic of each traffic statistics CPU core 203.

[0096] In this embodiment of the application, each parsing CPU core 202 obtains the amount of top NetFlow traffic that each traffic statistics CPU core 203 can handle, and for each traffic statistics CPU core 203, based on the amount of top NetFlow traffic that the traffic statistics CPU core 203 can handle and the total amount of top NetFlow traffic that all traffic statistics CPU cores 203 can handle, determines the proportion of top NetFlow traffic diverted to the traffic statistics CPU core 203 as the ratio of the amount of top NetFlow traffic that the traffic statistics CPU core 203 can handle to the total amount of top NetFlow traffic that all traffic statistics CPU cores 203 can handle.

[0097] After determining the proportion of top NetFlow traffic to be distributed to each traffic statistics CPU core 203, the actual amount of top NetFlow traffic processed by each traffic statistics CPU core 203 is determined based on the proportion of top NetFlow traffic that each traffic statistics CPU core 203 can handle and the total number of top NetFlows. Based on the actual amount of top NetFlow traffic processed by each traffic statistics CPU core 203, all the above-mentioned top NetFlow traffic is distributed.

[0098] In this embodiment, traffic is distributed according to the proportion of top NetFlow traffic that each traffic statistics CPU core can handle, so that each traffic statistics CPU core can achieve optimal performance.

[0099] The above embodiments are illustrated below with a specific example. Referring to Figure 7, which shows a schematic diagram of the attack detection process, the process includes the following steps:

[0100] Step 1: The processor receives each data packet to be analyzed through DPDK high-performance multi-queue, and sends each data packet to be analyzed sequentially to the parsing CPU core using a packet-by-packet distribution rule.

[0101] Step 2: Each parsing CPU core uses NetFlow v5 or NetFlow v9 tools to perform NetFlow parsing on the data packets to be analyzed sent to that parsing CPU core, and obtains the NetFlow traffic encapsulated in each data packet, as well as the corresponding 5-tuple, packet number, and byte number.

[0102] Furthermore, based on the source IP and destination IP in the 5-tuple of each NetFlow traffic, the number of NetFlow traffic corresponding to the same source IP or the same destination IP is counted. For each source IP or destination IP, it is determined whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number. If so, each NetFlow traffic corresponding to that IP address is determined to be top NetFlow traffic; otherwise, each NetFlow traffic corresponding to that IP address is determined to be non-top NetFlow traffic.

[0103] For top NetFlow traffic, the proportion of top NetFlow traffic to be distributed to each traffic statistics CPU core is determined based on the amount of top NetFlow traffic that each traffic statistics CPU core can handle and the total amount of top NetFlow traffic that all traffic statistics CPU cores can handle. Based on the proportion of top NetFlow traffic distributed to each traffic statistics CPU core and the total amount of top NetFlow traffic, the amount of top NetFlow traffic that each traffic statistics CPU core actually handles is determined. Based on the amount of top NetFlow traffic that each traffic statistics CPU core actually handles, the above-mentioned top NetFlow traffic is distributed and sent to each traffic statistics CPU core in sequence according to the flow-by-flow distribution rule.

[0104] For each non-top NetFlow traffic, the source IP and destination IP in the five-tuple of the non-top NetFlow traffic are hashed to determine the target hash value corresponding to the source IP (Session Initiation Protocol, SIP) and destination IP (Destination Initiation Protocol, DIP) of the non-top NetFlow traffic. The target hash value corresponding to the source IP and destination IP of the non-top NetFlow traffic is matched with the hash value corresponding to any IP address in the stored range of IP addresses processed by each CPU core to determine the target traffic statistics CPU core corresponding to the non-top NetFlow traffic, and the non-top NetFlow traffic is sent to the target traffic statistics CPU core.

[0105] Step 3: For each target traffic statistics CPU core, for each IP address within the IP address range processed by the target traffic statistics CPU core, count the number of target packets and the number of target bytes of all non-top NetFlow traffic corresponding to the IP address in each statistical period; determine whether the number of target packets corresponding to the IP address exceeds the first preset number or the number of target bytes exceeds the second preset number in any statistical period. If so, determine that the IP address is under DDoS attack.

[0106] Specifically, after receiving top NetFlow traffic from IPs outside the scope of its processing, each traffic statistics CPU core counts the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or destination IP received by that traffic statistics CPU core within each statistical period, and then sends the number of packets and bytes of all top NetFlow traffic corresponding to the same source IP or destination IP, along with the corresponding IP address information, from that traffic statistics CPU core to the main CPU core. After receiving the number of packets and bytes of all top NetFlow traffic corresponding to the same IP address from each traffic statistics CPU core within each statistical period, the main CPU core synchronously calculates the total number of packets and bytes of all top NetFlow traffic sent by each traffic statistics CPU core corresponding to the IP address within each statistical period, based on the IP address corresponding to the top NetFlow traffic sent by each traffic statistics CPU core and the number of packets and bytes within each statistical period. It then determines whether the total number of packets of all top NetFlow traffic corresponding to the same IP address exceeds a second preset number of packets, or whether the total number of bytes of all top NetFlow traffic corresponding to the same IP address exceeds a second preset number of bytes. If so, it determines that the IP address is under DDoS attack.

[0107] Example 8:

[0108] Based on the same concept and the above embodiments, this application provides an attack detection method. Figure 8 is a schematic diagram of an attack detection process provided by this application, which includes:

[0109] S801: Receives data packets to be analyzed that are encapsulated with NetFlow traffic.

[0110] The attack detection method provided in this application is applied to the parsing CPU core in the attack detection device shown in the above embodiments.

[0111] The CPU core receives data packets containing NetFlow traffic sent by the processor in the attack detection device to the CPU core for analysis.

[0112] S802: Parse the received data packets to be analyzed to obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count; for each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the stored attack detection device, determine the target traffic statistics CPU core corresponding to the NetFlow traffic, and send the NetFlow traffic to the target traffic statistics CPU core; enable each traffic statistics CPU core to count the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core, and perform distributed denial-of-service (DDoS) attack detection based on the packet count and byte count of the NetFlow traffic for each IP address.

[0113] The parsing process, as well as the process of statistical analysis and DDoS detection of NetFlow traffic, can be found in the above embodiments and will not be repeated here.

[0114] In this embodiment, multiple traffic statistics CPU cores process NetFlow traffic within their respective IP address ranges. The aggregation of NetFlow traffic for the same IP address and DDoS detection are performed directly within the traffic statistics CPU core, eliminating the need to transfer the traffic to a single CPU core for aggregation. This reduces the computational resources occupied by each traffic statistics CPU core, improves processing efficiency, and allows for further expansion of the CPU core since each traffic statistics CPU core only processes NetFlow traffic within the IP address range corresponding to that core.

[0115] Based on the above embodiments, in this embodiment, before determining the target traffic statistics CPU core corresponding to the NetFlow traffic according to the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the stored attack detection device, the method further includes:

[0116] Based on the source IP and destination IP in the five-tuple of each NetFlow traffic, count the number of NetFlow traffic corresponding to the same source IP or the same destination IP respectively;

[0117] For each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number. If not, for the NetFlow traffic of that source IP or destination IP, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core.

[0118] To avoid exceeding the processing capacity of a single traffic statistics CPU core, based on the above embodiments, in this embodiment, if the amount of NetFlow traffic from the source IP or destination IP exceeds a preset amount, the method further includes:

[0119] The NetFlow traffic from the source IP or destination IP is identified as the top NetFlow traffic, and each top NetFlow traffic is distributed to a different traffic statistics CPU core.

[0120] Control each traffic statistics CPU core, count the number of packets and bytes of each top NetFlow traffic corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow traffic in the traffic statistics CPU core and the corresponding IP address information to the main CPU core;

[0121] The main CPU core controls the number of packets and bytes of each top NetFlow traffic sent by the CPU core according to each traffic statistics CPU core, as well as the corresponding IP address information. It then calculates the total number of packets and bytes of each top NetFlow traffic corresponding to that IP address, and performs DDoS detection based on the total number of packets and bytes.

[0122] To ensure optimal performance for each traffic statistics CPU core, based on the above embodiments, this embodiment distributes top NetFlow traffic to each traffic statistics CPU core, including:

[0123] Obtain the amount of top NetFlow traffic that each traffic statistics CPU core can process;

[0124] Based on the amount of top NetFlow traffic that each traffic statistics CPU core can handle, determine the proportion of top NetFlow traffic that is diverted to each traffic statistics CPU core;

[0125] Based on the proportion of top NetFlow traffic for each traffic statistics CPU core, the top NetFlow traffic is distributed.

[0126] Example 9:

[0127] Based on the same concept and the above embodiments, this application provides an attack detection device. Figure 9 is a schematic diagram of the structure of an attack detection device provided in this application. As shown in Figure 9, the device includes:

[0128] The receiving module 901 is used to receive various data packets to be analyzed, which encapsulate NetFlow traffic;

[0129] The processing module 902 is used to parse the received data packets to be analyzed, obtain the encapsulated NetFlow traffic and the corresponding five-tuple, packet count, and byte count; for each NetFlow traffic, based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the stored attack detection device, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core; each traffic statistics CPU core counts the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core, and performs distributed denial-of-service (DDoS) attack detection based on the packet count and byte count of the NetFlow traffic for each IP address.

[0130] In one possible implementation, the processing module 902 is further configured to, before determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the stored attack detection device, count the number of NetFlow traffic corresponding to the same source IP or the same destination IP based on the source IP and destination IP in the five-tuple of each NetFlow traffic; for each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number; if not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core for the NetFlow traffic of that source IP or destination IP.

[0131] In one possible implementation, the processing module 902 is further configured to: if the number of NetFlow traffic from the source IP or destination IP exceeds a preset number, determine the NetFlow traffic from the source IP or destination IP as top NetFlow traffic and distribute each top NetFlow traffic to each traffic statistics CPU core; control each traffic statistics CPU core to count the number of packets and bytes of each top NetFlow traffic corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow traffic in the traffic statistics CPU core, along with the corresponding IP address information, to the main CPU core; control the main CPU core to count the total number of packets and bytes of each top NetFlow traffic corresponding to the IP address based on the number of packets and bytes of each top NetFlow traffic sent by each traffic statistics CPU core and the corresponding IP address information, and perform DDoS detection based on the total number of packets and bytes.

[0132] In one possible implementation, the processing module 902 is specifically used to obtain the amount of top NetFlow traffic that each traffic statistics CPU core can process; determine the proportion of top NetFlow traffic to be diverted to each traffic statistics CPU core based on the amount of top NetFlow traffic that each traffic statistics CPU core can process; and divert each top NetFlow traffic based on the proportion of top NetFlow traffic to each traffic statistics CPU core.

[0133] Example 10:

[0134] Based on the same technical concept, this application also provides an electronic device. Figure 10 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. As shown in Figure 10, it includes: a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004. The processor 1001, the communication interface 1002 and the memory 1003 communicate with each other through the communication bus 1004.

[0135] The memory 1003 stores a computer program. When the program is executed by the processor 1001, the processor 1001 performs the following steps:

[0136] Receive data packets to be analyzed, each encapsulated with NetFlow traffic;

[0137] The received data packets are parsed to obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count. For each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the attack detection device, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core. Each traffic statistics CPU core then counts the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core. Based on the packet count and byte count of the NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed.

[0138] In one possible implementation, the processor 1001 is further configured to, before determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core in the stored attack detection device, count the number of NetFlow traffic corresponding to the same source IP or the same destination IP based on the source IP and destination IP in the five-tuple of each NetFlow traffic; for each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number; if not, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the IP address range processed by each traffic statistics CPU core for the NetFlow traffic of that source IP or destination IP.

[0139] In one possible implementation, the processor 1001 is further configured to: if the number of NetFlow traffic from the source IP or destination IP exceeds a preset number, determine the NetFlow traffic from the source IP or destination IP as top NetFlow traffic and distribute each top NetFlow traffic to each traffic statistics CPU core; control each traffic statistics CPU core to count the number of packets and bytes of each top NetFlow traffic corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow traffic in the traffic statistics CPU core, along with the corresponding IP address information, to the main CPU core; control the main CPU core to count the total number of packets and bytes of each top NetFlow traffic corresponding to the IP address based on the number of packets and bytes of each top NetFlow traffic sent by each traffic statistics CPU core and the corresponding IP address information, and perform DDoS detection based on the total number of packets and bytes.

[0140] In one possible implementation, the processor 1001 is specifically configured to obtain the amount of top NetFlow traffic that each traffic statistics CPU core can process; determine the proportion of top NetFlow traffic to be diverted to each traffic statistics CPU core based on the amount of top NetFlow traffic that each traffic statistics CPU core can process; and divert each top NetFlow traffic based on the proportion of top NetFlow traffic to each traffic statistics CPU core.

[0141] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0142] The communication interface 1002 is used for communication between the above-mentioned electronic device and other devices.

[0143] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0144] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0145] Example 11:

[0146] Based on the same technical concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by an electronic device. When the program is run on the electronic device, it causes the electronic device to implement any of the above embodiments.

[0147] The aforementioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memory (NAND FLASH), solid-state drives (SSDs), etc.

[0148] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0149] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0150] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0151] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0152] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An attack detection device, characterized in that, The device includes a processor, multiple parsing central processing unit (CPU) cores, and multiple traffic statistics CPU cores; The processor is configured to receive each data packet to be analyzed that encapsulates NetFlow traffic with network detection function, and to send each data packet to be analyzed sequentially to each parsing CPU core. Each of the parsing CPU cores is used to parse the received data packets to be analyzed, and to obtain the encapsulated NetFlow traffic and the corresponding 5-tuple, packet number and byte number; For each NetFlow traffic, based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the saved range of IP addresses processed by each traffic statistics CPU core, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core. Each traffic statistics CPU core is used to count the number of packets and bytes of NetFlow traffic for each IP address within the IP address range processed by that CPU core. Based on the number of packets and bytes of NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed.

2. The device according to claim 1, characterized in that, Each traffic statistics CPU core is specifically used to determine the statistical period of each NetFlow traffic for any IP address within the IP address range processed by the traffic statistics CPU core, based on the start and end times carried by the NetFlow traffic corresponding to the IP address. Based on the statistical period occupied by each NetFlow traffic and the number of packets and bytes of each NetFlow traffic corresponding to the IP address, the target number of packets and target number of bytes of all NetFlow traffic corresponding to the IP address in each statistical period is determined.

3. The device according to claim 2, characterized in that, Each traffic statistics CPU core is specifically used to determine, for any NetFlow traffic corresponding to the IP address, whether the start time and end time carried in the NetFlow traffic are within the same statistical period. If so, the statistical period is determined to be the statistical period occupied by the NetFlow traffic. If not, when the statistical periods containing the start time and end time are adjacent, the adjacent statistical period is determined to be the statistical period occupied by the NetFlow traffic. If the statistical periods containing the start time and end time are not adjacent, the statistical periods containing the start time and end time, as well as the statistical periods between these two statistical periods, are all determined to be the statistical period occupied by the NetFlow traffic.

4. The device according to claim 3, characterized in that, Each traffic statistics CPU core is specifically used for any NetFlow traffic. If the statistical period occupied by the NetFlow traffic is one, then the number of packets and bytes corresponding to the NetFlow traffic are determined as the target sub-packets and target sub-bytes within that statistical period. If the statistical period occupied by the NetFlow traffic is multiple, then the time period occupied by the NetFlow traffic is determined according to the start time and end time of the NetFlow traffic. Based on the length of the time period within each statistical period and the number of packets and bytes of the NetFlow traffic, the target sub-packets and target sub-bytes of the NetFlow traffic within each statistical period are determined.

5. The device according to claim 1, characterized in that, Each of the parsing CPU cores is also used to count the number of NetFlow traffic corresponding to the same source IP or the same destination IP based on the source IP and destination IP in the five-tuple of each NetFlow traffic. For each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number. If not, for the NetFlow traffic of that source IP or destination IP, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core.

6. The device according to claim 5, characterized in that, The device also includes a main CPU core; Each of the parsing CPU cores is also used to determine the NetFlow traffic of the source IP or destination IP as top NetFlow traffic if the amount of NetFlow traffic of the source IP or destination IP is greater than a preset amount, and to distribute each top NetFlow traffic to each traffic statistics CPU core. Each traffic statistics CPU core is also used to count the number of packets and bytes of each top NetFlow traffic corresponding to the source IP or destination IP received by the traffic statistics CPU core, and send the number of packets and bytes of each top NetFlow traffic in the traffic statistics CPU core and the corresponding IP address information to the main CPU core. The main CPU core is used to count the number of packets and bytes of each top NetFlow traffic sent by the CPU core and the corresponding IP address information, count the total number of packets and bytes of each top NetFlow traffic corresponding to the IP address, and perform DDoS detection based on the total number of packets and bytes.

7. The device according to claim 6, characterized in that, Each of the parsing CPU cores is specifically used to obtain the amount of top NetFlow traffic that each traffic statistics CPU core can handle; and to determine the proportion of top NetFlow traffic that is diverted to each traffic statistics CPU core based on the amount of top NetFlow traffic that each traffic statistics CPU core can handle. Based on the top NetFlow traffic ratio of each traffic statistics CPU core, the top NetFlow traffic is split.

8. An attack detection method, characterized in that, Applied to attack detection equipment, the method includes: Receive data packets to be analyzed, each encapsulated with NetFlow traffic; The received data packets to be analyzed are parsed to obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count. For each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core in the attack detection device, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core. Each traffic statistics CPU core counts the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core. Based on the packet count and byte count of the NetFlow traffic for each IP address, distributed denial-of-service (DDoS) attack detection is performed.

9. The method according to claim 8, characterized in that, Before determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core in the attack detection device, the method further includes: Based on the source IP and destination IP in the five-tuple of each NetFlow traffic, count the number of NetFlow traffic corresponding to the same source IP or the same destination IP respectively; For each source IP or destination IP, determine whether the number of NetFlow traffic corresponding to that source IP or destination IP is greater than a preset number. If not, for the NetFlow traffic of that source IP or destination IP, continue to execute the step of determining the target traffic statistics CPU core corresponding to the NetFlow traffic based on the source IP and destination IP in the five-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core.

10. An attack detection device, characterized in that, The device includes: The receiving module is used to receive various data packets to be analyzed, which encapsulate NetFlow traffic. The processing module is used to parse the received data packets to be analyzed, obtain the encapsulated NetFlow traffic and its corresponding 5-tuple, packet count, and byte count; for each NetFlow traffic, based on the source IP and destination IP in the 5-tuple of the NetFlow traffic and the saved IP address range processed by each traffic statistics CPU core in the attack detection device, the target traffic statistics CPU core corresponding to the NetFlow traffic is determined, and the NetFlow traffic is sent to the target traffic statistics CPU core; each traffic statistics CPU core counts the packet count and byte count of the NetFlow traffic for each IP address within the IP address range processed by the target traffic statistics CPU core, and performs distributed denial-of-service (DDoS) attack detection based on the packet count and byte count of the NetFlow traffic for each IP address.

Images