WO2016041346A1

WO2016041346A1 - Network data traffic control method and device

Info

Publication number: WO2016041346A1
Application number: PCT/CN2015/076484
Authority: WO
Inventors: 黎重; 张武; 李辉
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-09-19
Filing date: 2015-04-13
Publication date: 2016-03-24
Also published as: CN105490954A

Abstract

A network data traffic control method and device, the method comprising: receiving a network packet; according to the currently received network packet, updating the total traffic received by a network system and the traffic of a flow entry in a flow table corresponding to the currently received network packet; if the relationship between the total traffic received by the network system and a preset maximum threshold for system traffic, and the relationship between the traffic of a selected flow entry in the flow table and a preset maximum threshold for the traffic of the flow entry meet predetermined requirements, then adding the selected flow entry to a blacklist; processing packets corresponding to the flow entry added to the blacklist in a predetermined manner.

Description

Method and device for controlling network data traffic

Technical field

This paper relates to the field of network communication flow control technology, and in particular, to a method and device for controlling network data traffic.

Background technique

With the rapid development of the network, the traffic that the network system needs to process has become larger and larger, and the stability of the system decreases with the increase of traffic. In particular, for a network system that does not adopt any flow control mechanism, the abnormally large amount of traffic exceeds the load that can be withstood by the system design at the beginning of the system, and some abnormal phenomena may occur in the system, for example, the system operation efficiency may be seriously degraded, and further A serious problem that causes network congestion.

Related technologies include more flow control methods. For example, a leaky bucket algorithm can be used to perform traffic shaping and rate limiting on data flowing into the system using a buffer and a "leaked bucket". That is, in the case that the received message speed is too fast, the buffer is buffered, and then the buffer message is sent at a uniform speed under the control of the leaky bucket. However, this method lacks effective filtering means for abnormal messages, and the implementation algorithm is also complicated. Taking the method of flow control through the target-oriented network as an example, the traffic analysis unit performs network data sample statistics on the received message, and extracts the abnormal traffic filtering rule applied to the target host by using the TCP/IP protocol header field value as an item. Through this rule, traffic control is performed on network packets sent to the target host.

However, in the above related art, there is the following problem: the statistics of the message are only classified according to the Transmission Control Protocol (TCP), the User Data Packet Protocol (UDP), and the Internet Control Message Protocol (ICMP), and the control granularity is relatively large, and is adopted. After the policy is controlled, the packets from all sources of the target host are processed in the same way, and the source of abnormal traffic cannot be effectively monitored.

Summary of the invention

The embodiment of the invention provides a method and a device for controlling network data traffic, which can effectively monitor the source of abnormal traffic and achieve effective control of abnormal traffic.

According to an embodiment of the present invention, a method for controlling network data traffic is provided, the method comprising: receiving a network packet; and receiving, according to the currently received network packet, a total traffic received by the network system and a current flow table and a current flow table. The traffic of the flow entry corresponding to the received network packet is updated; if the total traffic received by the network system is related to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is If the relationship between the maximum traffic thresholds of the flow entries is consistent with the predetermined requirements, the selected flow entries are blacklisted. The packets corresponding to the flow entries in the blacklist are in the predetermined manner. deal with.

Optionally, the method further includes: selecting the recorded flow entry from the blacklist; if the traffic of the selected flow entry is less than a maximum traffic threshold of the preset flow entry, and the total received by the network system If the sum of the traffic and the traffic of the selected flow entry is less than or equal to the preset maximum threshold of the system traffic, the selected flow entry is removed from the blacklist.

Optionally, updating, according to the currently received network packet, the total traffic received by the network system and the traffic of the flow entry corresponding to the currently received network packet in the flow table, including: according to the currently received network The packet obtains the corresponding flow entry in the flow table. The flow entry is matched with the blacklist. If the flow entry is in the blacklist, the flow entry in the flow table is updated according to the currently received network packet. If the flow entry is not in the blacklist, the total traffic received by the network system and the traffic of the flow entry in the flow table are updated according to the currently received network packet.

Optionally, the corresponding flow entry is obtained in the flow table according to the currently received network packet, and the method includes: searching, according to the header information of the currently received network packet, the corresponding flow entry in the flow table; If the corresponding flow entry exists in the table, the flow entry corresponding to the currently received network packet is obtained. If the flow entry does not exist in the flow table, create a new one in the flow table and the currently received network. The flow entry corresponding to the packet.

Optionally, if the relationship between the total traffic received by the network system and the preset maximum threshold of the system traffic, and the relationship between the selected traffic in the flow table and the maximum traffic threshold of the preset flow entry are consistent with the predetermined If required, the selected flow entry will be blacklisted, including:

If the total traffic received by the network system is less than the preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the maximum traffic threshold of the preset flow entry, the selected flow table is selected. The item is added to the blacklist. If the total traffic received by the network system is greater than or equal to the preset maximum system traffic threshold, and the traffic of the selected flow entry in the flow table is greater than the preset flow. The maximum traffic threshold of the entry adds the selected flow entry to the blacklist and subtracts the traffic of the blacklisted flow entry from the total traffic received by the network system; and/or if in the flow table If the traffic of all the flow entries does not exceed the maximum traffic threshold of the flow entry, the traffic entry with the largest traffic in the flow table is blacklisted and the traffic is subtracted from the total traffic received by the network system. The traffic of the entry.

According to another embodiment of the present invention, there is provided an apparatus for controlling network data traffic, the apparatus comprising: a receiving module configured to receive a network message; and an updating module configured to access the network according to the currently received network message The total traffic received by the system and the traffic of the flow entry corresponding to the currently received network packet are updated in the flow table; the analysis module is set to the total traffic received by the network system and the preset maximum threshold of the system traffic. And the relationship between the traffic of the flow entry selected in the flow table and the maximum traffic threshold of the preset flow entry meets the predetermined requirements, and the selected flow entry is blacklisted; the processing module The packet corresponding to the flow entry in the blacklist is set to be processed in a predetermined manner.

Optionally, the device further includes: a selecting module, configured to select the recorded flow entry from the blacklist; and removing the module, if the traffic of the selected flow entry is less than a preset flow entry The maximum flow threshold, and the sum of the total traffic received by the network system and the traffic of the selected flow entry is less than or equal to the preset maximum threshold of the system traffic, and the selected flow entry is removed from the blacklist.

Optionally, the updating module includes: an obtaining unit, configured to obtain a corresponding flow entry in the flow table according to the currently received network packet; and the matching unit is configured to match the obtained flow entry with the blacklist; The first update unit is configured to: if the flow entry is in the blacklist, update the traffic of the flow entry in the flow table according to the currently received network packet; and the second update unit is configured to: if the flow entry is not in the blacklist, The total traffic received by the network system and the traffic of the flow entries in the flow table are updated according to the currently received network packet.

Optionally, the obtaining unit includes: a searching unit, configured to search for a corresponding flow entry in the flow table according to the header information of the currently received network packet; and the first acquiring unit is configured to: if the flow table has a corresponding If the flow entry is obtained, the flow entry corresponding to the currently received network packet is obtained. The second acquisition unit is configured to: if the flow table does not have a corresponding flow entry, create a new one in the flow table and receive the current flow The flow entry corresponding to the network packet.

Optionally, the analyzing module includes: a first analyzing unit, configured to be received by the network system If the total traffic is smaller than the preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the maximum traffic threshold of the flow entry, the selected flow entry is added to the blacklist. The second analyzing unit is configured to: if the total traffic received by the network system is greater than or equal to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the traffic of the preset flow entry. The threshold is added to the blacklist of the selected flow entry, and the traffic of the blacklisted flow entry is subtracted from the total traffic received by the network system. The third analysis unit is set to be all if the flow table is If the traffic of the flow entry does not exceed the maximum traffic threshold of the flow entry, the flow entry with the largest traffic in the flow table is blacklisted and the flow table is subtracted from the total traffic received by the network system. The traffic of the item.

The embodiment of the invention further provides a computer readable storage medium storing program instructions, which can be implemented when the program instructions are executed.

The embodiment of the invention solves the problem that the network system of the related art is insufficient for a large amount of traffic processing, and realizes the effect of network traffic control by the cooperation of the flow entry processing and the blacklist processing; and can better identify the abnormal traffic source without affecting The network system handles normal traffic.

In the embodiment of the present invention, the abnormal system traffic can be monitored and added to the blacklist, and when the flow entry returns to normal, the network system can also remove the flow entry from the blacklist again, thereby receiving each The network packets that are sent to the network system can be handled reasonably.

BRIEF abstract

1 is a flowchart of a method for controlling network data traffic according to an embodiment of the present invention;

2 is a flowchart of updating traffic according to a current network packet according to an embodiment of the present invention;

3 is a flowchart of a method for obtaining a current flow entry corresponding to a network packet in a flow table according to an embodiment of the present invention;

4 is an application diagram of a method for controlling network data traffic according to an embodiment of the present invention;

FIG. 5 is a second application diagram of a method for controlling network data traffic according to an embodiment of the present invention; and FIG.

FIG. 6 is a schematic structural diagram of an apparatus for controlling network data traffic according to an embodiment of the present invention.

Embodiments of the invention

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided so that this disclosure will be more fully understood and the scope of the disclosure will be fully disclosed.

Embodiment 1

FIG. 1 is a flowchart of a method for controlling network data traffic according to an embodiment of the present invention, where the method includes the following steps:

Step 101: Receive a network packet.

The format of the network packet may be a Transmission Control Protocol (TCP) packet, a User Datagram Protocol (UDP) packet, or an Internet Control Message Protocol (ICMP) packet. It can be understood that, in this embodiment, The type of network message is not limited.

Step 102: Update, according to the currently received network packet, the total traffic received by the network system and the traffic of the flow entry corresponding to the currently received network packet in the flow table.

Total flow therethrough, may be provided a network system receives as R _m, in particular the initial stage of the network system receives a total flow rate R _m may be set to zero; wherein the network system receives the total flow and the current received network packets For the implementation of updating the traffic of the flow entry corresponding to the text, see Figure 2, including:

Step 201: Obtain a corresponding flow entry in the flow table according to the currently received network packet.

The implementation of obtaining the corresponding flow entry in the flow table according to the currently received network packet, as shown in FIG. 3, includes:

Step 301: Search for a corresponding flow entry in the flow table according to the header information of the currently received network packet. The header information of the network packet may be: a quintuple of the network packet (the source host IP address, Destination host IP address, source host port number, destination host port number, and protocol type);

Step 302: If a flow entry exists in the flow table, the flow entry corresponding to the currently received network packet is obtained.

Step 303: If the corresponding flow entry does not exist in the flow table, create a flow entry corresponding to the currently received network packet in the flow table.

FIG. 3 is described below. First, a flow entry is recorded in the flow table, and the flow size information of the recorded flow entry is marked as F _s1 , F _s2 ... F _sn ; the currently received network packet The traffic of the corresponding flow entry is F _sx , and if the current flow entry corresponding to the network packet matches the flow entry recorded in the flow table, the value of the corresponding F _sx is F. Any one of _s1 , F _s2 ... F _sn ; if it cannot be matched, then a new flow entry corresponding to the current network packet is created in the flow table, and the corresponding F _sx is not F _s1 . Any of F _s2 ... F _sn , F _sx may be smaller than F _s1 or larger than F _sn .

Continuing to refer to FIG. 2, step 202, matching the obtained flow entry with the blacklist;

The blacklist records the flow entries of the network system that have abnormal traffic within a certain period of time (for example, 20 ms).

Step 203: If the flow entry is in the blacklist, update the traffic of the flow entry in the flow table according to the currently received network packet.

If the current flow entry corresponding to the network packet is in the blacklist, the traffic F _sx of the flow entry corresponding to the currently received network packet is recorded in the flow table.

Step 204: If the flow entry is not in the blacklist, update the total traffic received by the network system and the traffic of the flow entry in the flow table according to the currently received network packet.

If the current flow entry corresponding to the network packet is not in the blacklist, the traffic F _sx of the current flow entry corresponding to the received network packet is recorded in the flow table, and the current receiving is simultaneously received. The traffic F _sx of the flow entry corresponding to the received network packet is increased within the total traffic R _m received by the network system.

Continuing to refer to FIG. 1, step 103, if the total traffic received by the network system is related to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table and the traffic of the preset flow entry. If the relationship between the maximum thresholds meets the predetermined requirements, the selected flow entries are blacklisted;

Which can be set system flow maximum threshold value T _m, the flow rate of the flow entry maximum threshold value T _s; wherein the system maximum flow threshold flow T _m and the flow entry maximum threshold value T _s may be a network system, the network packets in accordance with Processing capacity, set up.

Wherein, step 103 includes:

If the network system receives a total flow rate R _m is less than the system maximum flow threshold T _m is set in advance, and the flow table selected flow rate F _sx flow table entry is greater than a predetermined flow rate of the flow entry maximum threshold value T _s , the selected flow entry is added to the blacklist;

If the network system receives a total flow rate R _m greater than or equal to the system maximum flow threshold T _m is set in advance, and the flow table selected flow rate F _sx flow table entry is greater than a predetermined flow rate set in the flow entry maximum threshold value T _s , the selected flow entry is blacklisted, and the traffic F _{sx of the} blacklisted flow entry is subtracted from the total traffic R _m received by the network system; and/or

If the traffic of all the flow entries in the flow table does not exceed the maximum traffic threshold T _s of the flow entry, the traffic entry with the largest traffic in the flow table is blacklisted and received from the network system. The flow rate F _{sn of} the flow entry is subtracted from the flow R _m .

Step 104: The packet corresponding to the flow entry in the blacklist is processed in a predetermined manner.

The predetermined manner of processing may be that the upper layer is notified by the flow control module, and the upper layer may directly forward the packet according to specific application requirements, or may directly discard or perform other processing.

In the embodiment of the present invention, the problem that the related technology is insufficient for a large amount of traffic processing is solved, and the effect of the network flow control is realized by the cooperation of the flow entry processing and the blacklist processing; and the invention can better identify the abnormal traffic source. And does not affect the processing of normal traffic by the network system.

In the embodiment of the present invention, the traffic of the abnormal network system can be monitored and added to the blacklist, and when the flow entry is restored to normal, the network system can also remove the flow entry from the blacklist again, thus The network system received can receive reasonable network processing.

The selected flow entry is selected from the blacklist.

If the traffic of the selected flow entry is smaller than the maximum traffic threshold of the preset flow entry, and the sum of the total traffic received by the network system and the traffic of the selected flow entry is less than or equal to the preset maximum system traffic. Threshold, the selected flow entry is removed from the blacklist.

FIG. 4 is a schematic diagram of an application diagram of a method for controlling network data traffic according to an embodiment of the present invention, where the application map may correspond to three implementation scenarios.

scene one

First, the system traffic maximum threshold T _m = 10M, and the flow entry maximum threshold T _s =1 M;

The implementation of the scenario 1 includes the following steps:

Step 401, the network system checks the received total flow rate R _m;

At this time, if the total traffic R _m (such as R _m = 9M) received by the network system is less than the set system traffic maximum threshold, proceed to step 402;

Step 402: Check the traffic of the flow entry.

If the traffic of the flow entry corresponding to the incoming network packet (such as F _sx = 2M) is greater than the maximum traffic threshold of the flow entry, proceed to step 403;

Step 403: Add a flow entry with a traffic greater than T _s to the blacklist.

At this point, return to step 402 to check the flow of other flow entries, if there is no flow entry greater than T _s , proceed to step 407;

Continuing with step 407, the flow entry flow and the total traffic received by the network system are cleared;

At this time, the abnormal traffic in this period of time is controlled, and then the timer is restarted, and the monitoring of the abnormal traffic in the next period is re-entered.

Scene two

The implementation of the scenario 2 includes the following steps:

Step 401, the network system checks the received total flow rate R _m;

At this time, if the total traffic R _m (such as R _m = 13M) received by the network system is greater than the set system traffic maximum threshold, proceed to step 404;

Step 404: Check the traffic of the flow entry.

If the traffic of the flow entry corresponding to the incoming network packet (such as F _s1 = 2M) is greater than the maximum traffic threshold of the flow entry, proceed to step 405;

Step 405: Add a flow entry with a traffic greater than T _s to the blacklist.

Next, received from the network system to the total flow volume flow by subtracting the R _m entries blacklisted, continues with step 407;

Scene three

The specific implementation of the scenario 2 includes the following steps:

Step 401, the network system checks the received total flow rate R _m;

Step 404: Check the traffic of the flow entry.

If the traffic of the flow entry corresponding to the incoming network packet is smaller than the maximum traffic threshold of the flow entry, proceed to step 406;

Step 406: Add a flow entry with the largest traffic flow in the flow table to the blacklist.

Next, subtracting the flow rate F _{sn of} the flow entry from the total traffic R _m received by the network system, _proceeding to step 407;

Step 407, the flow of the flow entry and the total traffic received by the network system are cleared;

FIG. 5 is a second application diagram of a method for controlling network data traffic according to an embodiment of the present invention, where the application diagram corresponds to an implementation scenario.

First, in the initial stage, the system traffic maximum threshold T _m = 10M is set, and the flow entry maximum flow threshold T _s =1M.

The implementation of the scenario includes the following steps:

Step 501, checking the total flow rate R _m received by the system (such as R _m = 9M);

Step 502: Check the traffic F _km of the flow entry in the blacklist.

At this time, if the traffic F _sm (such as F _sm =0.5M) of the first-class entry in the blacklist is less than T _s , the sum of the total traffic R _m received by the system and the traffic F _sm of the first-class entry in the blacklist is also If it is less than or equal to T _m , proceed to step 503;

Step 503, the flow entry of the flow entry is smaller than the flow threshold of the flow entry, and the flow entry is removed from the blacklist.

In step 504, the flow entry flow and the total traffic received by the network system are cleared.

Embodiment 2

Corresponding to the method for controlling network data traffic in the first embodiment, the embodiment of the present invention further provides a device for controlling network data traffic. As shown in FIG. 6, the device 60 includes:

The receiving module 61 is configured to receive a network packet;

The update module 62 is configured to update, according to the currently received network packet, the total traffic received by the network system and the traffic of the flow entry corresponding to the currently received network packet in the flow table;

The analyzing module 63 is configured to: if the total traffic received by the network system is related to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table and the preset flow entry If the relationship between the maximum traffic thresholds meets the predetermined requirements, the selected flow entries are blacklisted;

The processing module 64 is configured to process the packet corresponding to the flow entry in the blacklist in a predetermined manner.

The predetermined manner may be that the upper layer is notified by the flow control module, and the upper layer may directly forward the packet according to the application requirement, or may directly discard or perform other processing.

Optionally, the device 60 further includes: a selecting module, configured to select the recorded flow entry from the blacklist; and removing the module, if the traffic of the selected flow entry is less than a preset flow entry The maximum flow threshold is set, and the sum of the total traffic received by the network system and the traffic of the selected flow entry is less than or equal to the preset maximum threshold of the system traffic, and the selected flow entry is removed from the blacklist.

The update module 62 includes:

The obtaining unit 621 is configured to obtain a corresponding flow entry in the flow table according to the currently received network packet. The obtaining unit 621 includes: a searching unit 6211, configured to flow according to the header information of the currently received network packet. Searching for the corresponding flow entry in the table; the first obtaining unit 6222 is configured to obtain a flow entry corresponding to the currently received network packet if the corresponding flow entry exists in the flow table; the second obtaining unit 6223, If the corresponding flow entry does not exist in the flow table, create a new flow entry corresponding to the currently received network packet in the flow table.

The matching unit 622 is configured to match the obtained flow entry with the blacklist.

The first update unit 623 is configured to: if the flow entry is in the blacklist, update the traffic of the flow entry in the flow table according to the currently received network packet;

The second update unit 624 is configured to: if the flow entry is not in the blacklist, update the total traffic received by the system and the traffic of the flow entry in the flow table according to the currently received network packet.

The analysis module 63 includes:

The first analyzing unit 631 is configured to: if the total traffic received by the network system is less than a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than a maximum traffic threshold of the preset flow entry. , the selected flow entry is added to the blacklist;

The second analyzing unit 632 is configured to: if the total traffic received by the network system is greater than or equal to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the traffic of the preset flow entry. The maximum threshold is used to add the selected flow entry to the blacklist and subtract the traffic of the blacklisted flow entry from the total traffic received by the network system.

The third analyzing unit 633 is configured to: if the flow rate of all flow entries in the flow table does not exceed the advance If the maximum traffic threshold of the flow entry is set, the traffic entry with the largest traffic in the flow table is added to the blacklist, and the traffic of the flow entry is subtracted from the total traffic received by the network system.

In the embodiment of the present invention, the problem that the related technology is insufficient for a large amount of traffic processing is solved, and the effect of the network flow control is realized by the cooperation of the flow entry processing and the blacklist processing; and the abnormal traffic source is better recognized at the same time. It does not affect the processing of normal traffic by the network system.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

All or part of the steps of the above embodiments may also be implemented using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or a plurality of modules or steps may be implemented as a single integrated circuit module. The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The embodiments of the present invention solve the problem that the related technologies are insufficient for a large amount of traffic processing, and implement the effect of network traffic control by the cooperation of the flow entry processing and the blacklist processing; and at the same time, the abnormal traffic source can be better identified without affecting The system handles normal traffic.

Claims

A method of controlling network data traffic, including:

Receiving network messages;

And updating, according to the currently received network packet, the total traffic received by the network system and the traffic of the flow entry corresponding to the currently received network packet in the flow table;

If the relationship between the total traffic received by the network system and the preset maximum threshold of the network system traffic, and the relationship between the traffic of the flow entry selected in the flow table and the maximum traffic threshold of the preset flow entry are consistent with the predetermined Requirements, the blacklist is selected for the selected flow entry;

The packets corresponding to the flow entries in the blacklist are processed in a predetermined manner.
The method of claim 1 further comprising:

Selecting the recorded flow entry from the blacklist;

If the traffic of the selected flow entry is smaller than the maximum traffic threshold of the preset flow entry, and the sum of the total traffic received by the network system and the traffic of the selected flow entry is less than or equal to the preset maximum system traffic. Threshold, the selected flow entry is removed from the blacklist.
The method according to claim 1, wherein the updating the total traffic received by the network system according to the currently received network packet and the traffic of the flow entry corresponding to the currently received network packet in the flow table is updated according to the currently received network packet. ,include:

Obtaining a corresponding flow entry in the flow table according to the currently received network packet;

Match the obtained flow entry with the blacklist.

If the flow entry is in the blacklist, the traffic of the flow entry in the flow table is updated according to the currently received network packet.

If the flow entry is not in the blacklist, the total traffic received by the network system and the traffic of the flow entry in the flow table are updated according to the currently received network packet.
The method according to claim 3, wherein the obtaining the corresponding flow entry in the flow table according to the currently received network packet includes:

Finding a corresponding flow entry in the flow table according to the header information of the currently received network packet;

If the corresponding flow entry exists in the flow table, the flow entry corresponding to the currently received network packet is obtained;

If the corresponding flow entry does not exist in the flow table, create a new flow entry corresponding to the currently received network packet in the flow table.
The method according to claim 1, wherein the relationship between the total traffic received by the network system and a preset maximum threshold of system traffic, and the traffic of the selected flow entry in the flow table are preset. If the relationship between the maximum traffic thresholds of the flow entries meets the predetermined requirements, the selected flow entries are blacklisted, including:

If the total traffic received by the network system is less than the preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the maximum traffic threshold of the preset flow entry, the selected flow table is selected. Add items to the blacklist;

If the total traffic received by the network system is greater than or equal to the preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the maximum traffic threshold of the preset flow entry, the selected The flow entry is added to the blacklist and the traffic of the blacklisted flow entry is subtracted from the total traffic received by the network system; and/or

If the traffic of all the flow entries in the flow table does not exceed the maximum traffic threshold of the flow entry, the traffic entry with the largest traffic in the flow table is blacklisted and subtracted from the total traffic received by the system. The traffic to the flow entry.
A device for controlling network data traffic, comprising:

a receiving module, configured to receive a network packet;

The update module is configured to update, according to the currently received network packet, the total traffic received by the network system and the traffic of the flow entry corresponding to the currently received network packet in the flow table;

The analysis module is configured to: if the total traffic received by the network system is related to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table and the maximum traffic threshold of the preset flow entry If the relationship meets the predetermined requirements, the selected flow entry is blacklisted;

The processing module is configured to process the packet corresponding to the flow entry in the blacklist in a predetermined manner.
The apparatus of claim 6 further comprising:

Selecting a module, configured to select the recorded flow entry from the blacklist;

Remove the module, if the traffic of the selected flow entry is less than the preset flow entry The maximum flow threshold, and the sum of the total traffic received by the network system and the traffic of the selected flow entry is less than or equal to the preset maximum threshold of the system traffic, and the selected flow entry is removed from the blacklist.
The apparatus of claim 6 wherein said updating module comprises:

The obtaining unit is configured to obtain a corresponding flow entry in the flow table according to the currently received network packet;

The matching unit is configured to match the obtained flow entry with the blacklist.

The first update unit is configured to: if the flow entry is in the blacklist, update the traffic of the flow entry in the flow table according to the currently received network packet;

The second update unit is configured to: if the flow entry is not in the blacklist, update the total traffic received by the network system and the traffic of the flow entry in the flow table according to the currently received network packet.
The apparatus of claim 8, wherein the obtaining unit comprises:

The search unit is configured to search for a corresponding flow entry in the flow table according to the header information of the currently received network packet;

a first obtaining unit, configured to: if a corresponding flow entry exists in the flow table, obtain a flow entry corresponding to the currently received network packet;

The second obtaining unit is configured to create a flow entry corresponding to the currently received network packet in the flow table if the corresponding flow entry does not exist in the flow table.
The apparatus of claim 6 wherein said analyzing module comprises:

The first analyzing unit is configured to: if the total traffic received by the network system is less than a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than a maximum traffic threshold of the preset flow entry, Add the selected flow entry to the blacklist.

The second analyzing unit is configured to: if the total traffic received by the network system is greater than or equal to a preset maximum threshold of the system traffic, and the traffic of the selected flow entry in the flow table is greater than the traffic of the preset flow entry. The threshold is added to the blacklist of the selected flow entry, and the traffic of the blacklisted flow entry is subtracted from the total traffic received by the network system;

The third analysis unit is configured to add the flow entry with the largest flow rate in the flow table to the blacklist if the traffic of all the flow entries in the flow table does not exceed the maximum flow threshold of the flow entry. The traffic of the flow entry is subtracted from the total traffic received by the system.
A computer readable storage medium storing program instructions that, when executed, can implement the method of any of claims 1-5.