WO2021254397A1

WO2021254397A1 - Network security detection method and system, and device and controller

Info

Publication number: WO2021254397A1
Application number: PCT/CN2021/100383
Authority: WO
Inventors: 张镇伟
Original assignee: 华为技术有限公司
Priority date: 2020-06-17
Filing date: 2021-06-16
Publication date: 2021-12-23
Also published as: CN113810348A; CN113810348B

Abstract

Disclosed are a network security detection method and system, and a device and a controller, wherein same are for improving network security and belong to the technical field of communications. The method comprises: a controller receiving the security detection performance of a plurality of detection devices in a network; and according to the security detection performance of the plurality of detection devices, issuing a first traffic guiding policy to a device, to be processed, in an access device, wherein the first traffic guiding policy is used for instructing the device to be processed to establish a traffic guiding tunnel with at least one of the plurality of detection devices. According to the security detection performance of a detection device in a network, a controller guides, by means of a traffic guiding policy, traffic of an access device to the detection device so as to perform detection, such that security resources in the entire network can be automatically allocated, thereby preventing missing traffic detection caused by the service degradation of a network device.

Description

Network security detection method, system, equipment and controller

This application claims the priority of a Chinese patent application filed on June 17, 2020 with the application number 202010553314.X and the application title "Network security detection method, system, equipment and controller", the entire content of which is incorporated by reference In this application.

Technical field

This application relates to the field of communication technology, and in particular to a network security detection method, system, device, and controller.

Background technique

With the development of network technology, the technology of network attacks is also changing with each passing day. Security detection of traffic transmitted in the network is an important means to improve network defense capabilities.

Generally, two methods are used for security detection. The first is to deploy a firewall device with security functions in the egress area. The security detection is performed by diverting traffic from the core switch to the firewall, and then the detected traffic is injected back from the firewall to the core switch. . The second is to deploy switch equipment with network security functions across the entire network to protect the entire network.

However, the first method above is limited by the processing performance of the firewall, and the second method is limited by the processing performance of the switch; when the traffic is large, only part of the traffic is transmitted to the firewall or switch for detection, resulting in undetected Traffic spreads in the network, threatening network security.

Summary of the invention

This application provides a network security detection method, system, equipment, and controller to automatically allocate security resources of the entire network to avoid traffic missed detection caused by service degradation of network equipment.

In the first aspect, this application provides a network security detection method, including: a controller receives the security detection performance of multiple detection devices in the network; Send a first diversion strategy; wherein, the first diversion strategy is used to instruct the device to be processed and at least one detection device of the plurality of detection devices to establish a drainage tunnel.

In the first aspect, the enterprise network architecture generally includes: egress firewall, core layer, convergence layer, and access layer. Threat defense points are set at the egress firewall, core layer, convergence layer, and access layer respectively, so that the entire network is safe. Defense function. Furthermore, network element devices with security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment, and network elements that do not have security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment. The meta device serves as the access device. All detection devices and access devices are in communication with the controller, and the controller receives the safety detection performance of multiple detection devices in the network. The security detection performance is used to characterize the ability of the detection device to perform security detection on data, including the amount of data processed and the type of data processed. The controller issues the first drainage strategy to the device to be processed in the access device according to the safety detection performance of the detection device, so that the device to be processed in the access device establishes a drainage tunnel with at least one detection device. The data output by the device to be processed is sent through the drainage tunnel to at least one detection device for safety detection. This makes full use of the deployment function of the controller, so that the controller can divert the traffic of the access device to the detection device for detection according to the security detection performance of the detection device in the network, and realize the automatic deployment of the security resources of the entire network to avoid Missed traffic detection due to service degradation of network equipment.

Optionally, the first drainage strategy in the network security detection method provided by this application further includes: a correspondence between a data type and a detection device capable of detecting the data type; the first drainage strategy is also used for Instruct the device to be processed to send traffic belonging to the data type to the detection device capable of detecting the data type via the drainage tunnel.

In a possible implementation of the first aspect, because different detection devices in the network can detect different data types, the controller first needs to obtain the type of data in the device to be processed, and then finds that it is capable of detecting the data type The ability of testing equipment. Finally, the first diversion strategy is generated to instruct the device to be processed to send the data type traffic to the detection device capable of detecting the corresponding data type via the diversion tunnel for security detection. In this way, the flow of the device to be processed can be drained and detected according to the data type, and the detection performance of different detection devices in the network can be fully utilized to meet the detection requirements of more data types.

Optionally, the network security detection method provided by the present application further includes: determining the at least one detection device according to the amount of data passed on the device to be processed and the security detection capabilities of multiple detection devices, wherein the at least one detection device The sum of the security detection capabilities meets the detection of the data passed on the device to be processed.

In a possible implementation of the first aspect, since different detection devices in the network can detect different amounts of data, when the traffic of the device to be processed is large, it may be necessary to deploy multiple detection devices to perform the traffic of the device to be processed. Safety inspection. At this time, the controller determines the detection device that establishes a drainage tunnel with the device to be processed based on the amount of data passed on the device to be processed and the safety detection capabilities of the multiple detection devices. Therefore, it is possible to perform drainage detection on the traffic of the device to be processed according to the amount of data to be processed, and make full use of the detection performance of different detection devices in the network to meet the detection requirements of higher data volume.

Optionally, the network security detection method provided by the present application further includes: when the amount of data passing on the device to be processed increases, so that the sum of the security detection capabilities of the at least one detection device cannot meet the requirements on the device to be processed. When the passed data is detected, a second drainage strategy is sent to one or more detection devices in the at least one detection device; the second drainage strategy is used to instruct one or more detection devices and the at least one detection device Establish a drainage tunnel with other detection equipment.

In a possible implementation of the first aspect, the traffic output by the device to be processed is a variable value. When the amount of data passing on the device to be processed increases, and the total amount of security detection capabilities of the detection devices currently established for the drainage tunnel cannot be When the detection of data passing on the device to be processed is satisfied, the controller will send the second drainage strategy to the detection device that has established a drainage tunnel with the device to be processed, and/or the remaining detection devices that have not established a drainage tunnel with the device to be processed, So that the traffic is sent to more testing equipment for safety testing. Therefore, it can adapt to the dynamic change of the flow, so that the scheduled detection device can always meet the flow detection requirements of the device to be processed, and the detection efficiency is improved.

In a second aspect, the present application provides a network security detection method, the method includes: an access device sends a data type and/or a data amount to a controller; receiving a first drainage strategy from the controller; wherein, the The first drainage strategy is related to the data type and/or data volume; according to the first drainage strategy, a drainage tunnel is established with at least one detection device; and data is sent to the detection device through the drainage tunnel.

In the second aspect, the enterprise network architecture generally includes: egress firewall, core layer, convergence layer, and access layer. Threat defense points are set at the egress firewall, core layer, convergence layer, and access layer respectively, so that the entire network is safe. Defense function. Furthermore, network element devices with security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment, and network elements that do not have security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment. The meta device serves as the access device. All detection equipment and access equipment are in communication connection with the controller, and the access equipment sends the data type and/or data volume to the controller, and according to the first drainage strategy sent by the controller, connects the equipment to be processed in the equipment Establish a drainage tunnel with at least one detection device. The data output by the device to be processed is sent through the drainage tunnel to at least one detection device for safety detection. This makes full use of the deployment function of the controller, so that the controller can divert the traffic of the access device to the detection device for detection according to the data type and/or data volume through a drainage strategy, so as to realize the automatic deployment of the security resources of the entire network and avoid the network Missed traffic detection caused by equipment service degradation.

In a third aspect, the present application provides a network security detection method, the method includes: when the detection capability of the detection device does not meet the detection requirement for the data from the first drainage tunnel, the detection device receives the drainage flow sent by the controller Strategy; The detection device establishes a second drainage tunnel with another detection device according to the drainage strategy, and sends data beyond the detection capability of the detection device to the other detection device using the second drainage tunnel.

In the third aspect, the enterprise network architecture generally includes: egress firewall, core layer, convergence layer, and access layer. Threat defense points are set at the egress firewall, core layer, convergence layer, and access layer respectively, so that the entire network is safe. Defense function. Furthermore, network element devices with security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment, and network elements that do not have security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment. The meta device serves as the access device. All detection devices and access devices are in communication with the controller. When the detection capability of the detection device does not meet the detection requirements for the data from the first drainage tunnel, the detection device receives the drainage strategy sent by the controller and communicates with another detection device. The device establishes a second drainage tunnel, so that traffic that exceeds the performance of the detection device is transmitted to another detection device for detection via the second drainage tunnel. Therefore, it can adapt to the dynamic change of the flow, so that the scheduled detection device can always meet the flow detection requirements of the device to be processed, and the detection efficiency is improved.

In a fourth aspect, the present application provides a controller, including:

The receiving module is used to receive the security detection performance of multiple detection devices in the network;

The processing module is configured to issue a first drainage strategy to the device to be processed in the access device according to the security detection performance of the detection device; wherein, the first drainage strategy is used to instruct the device to be processed and the device to be processed At least one of the multiple detection devices establishes a drainage tunnel.

Optionally, the first drainage strategy further includes: a correspondence between a data type and a detection device capable of detecting the data type;

The first diversion strategy is also used to instruct the detection device to send traffic belonging to the data type to the detection device capable of detecting the data type via the diversion tunnel.

Optionally, the processing module is further used for:

The at least one detection device is determined according to the amount of data passed on the device to be processed and the security detection capabilities of multiple detection devices, where the sum of the security detection capabilities of the at least one detection device meets the requirements for passing on the device to be processed Data detection.

Optionally, the processing module is further used for:

When the amount of data passing on the device to be processed increases, so that the sum of the security detection capabilities of the at least one detection device cannot meet the detection of the data passing on the device to be processed, send the data to the at least one detection device One or more detection devices in the send a second diversion strategy; the second diversion strategy is used to instruct one or more detection devices to establish a diversion tunnel with other detection devices other than the at least one detection device.

In a fifth aspect, this application provides an access device, including:

The sending module is used to send the data type and/or data amount to the controller;

A receiving module, configured to receive a first drainage strategy from the controller; wherein the first drainage strategy is related to the data type and/or data volume;

A processing module, configured to establish a drainage tunnel with at least one detection device according to the first drainage strategy;

The sending module is configured to send data to the detection device through the drainage tunnel.

In a sixth aspect, this application provides a detection device, including:

The receiving module is used to receive the drainage strategy sent by the controller when the detection capability of the detection device does not meet the detection requirement for the data from the first drainage tunnel;

The processing module is configured to establish a second drainage tunnel with another detection device according to the drainage strategy, and send data beyond the detection capability of the detection device to the another detection device using the second drainage tunnel.

In a seventh aspect, the present application provides a network security detection system, the system includes: a controller, an access device, and a detection device; wherein:

The controller is configured to execute the method according to any one of the first aspect;

The access device is used to execute the method described in the second aspect;

The detection device is used to perform the method as described in the third aspect.

In an eighth aspect, the present application provides a readable storage medium on which a computer program is stored; when the computer program is executed, the method described in the present application in the first aspect is implemented.

In a ninth aspect, the present application provides a program product, the program product includes a computer program, the computer program is stored in a readable storage medium, and at least one processor of a communication device can read all data from the readable storage medium. The computer program is executed by the at least one processor to enable the device to implement any of the methods described in the present application in the first aspect.

The network security detection method, system, device, and controller provided in this application, the controller receives the security detection performance of multiple detection devices in the network; according to the security detection performance of the detection device, downloads the device to be processed in the access device Send a first diversion strategy; wherein, the first diversion strategy is used to instruct the device to be processed and at least one detection device of the plurality of detection devices to establish a drainage tunnel. According to the security detection performance of the detection equipment in the network, the controller diverts the traffic of the access device to the detection device for detection through a diversion strategy, so that it can automatically allocate the security resources of the entire network to avoid traffic missed detection caused by the degradation of network equipment services.

Description of the drawings

FIG. 1 is a schematic diagram of a network security defense architecture provided by an embodiment of this application;

FIG. 2 is a first schematic flowchart of a network security detection method provided by an embodiment of this application;

FIG. 3 is a second schematic flowchart of a network security detection method provided by an embodiment of this application;

4 is a schematic diagram 1 of signaling interaction of a network security detection method provided by an embodiment of this application;

FIG. 5 is a second schematic diagram of signaling interaction of a network security detection method provided by an embodiment of this application;

FIG. 6 is a first structural diagram of a controller provided by an embodiment of the application;

FIG. 7 is a schematic structural diagram of an access device provided by an embodiment of this application;

FIG. 8 is a schematic structural diagram of a detection device provided by an embodiment of the application;

FIG. 9 is a schematic structural diagram of a switch device provided by an embodiment of this application;

FIG. 10 is a second structural diagram of a controller provided by an embodiment of this application.

detailed description

The technical solution in this application will be described below in conjunction with the accompanying drawings.

Figure 1 is a schematic diagram of a network security defense architecture provided by an embodiment of this application; as shown in Figure 1, it includes: egress firewall, core layer, convergence layer, and access layer, which are respectively located at the egress firewall, core layer, convergence layer, and Threat defense points are set at the access layer to enable the entire network to have security defense functions. Furthermore, network element devices with security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment, and network elements that do not have security detection performance in the egress firewall, core layer, convergence layer, and access layer are used as detection equipment. The meta device serves as the access device. All detection devices and access devices are in communication with the controller, and the controller receives the safety detection performance of multiple detection devices in the network. The security detection performance is used to characterize the ability of the detection device to perform security detection on data, including the amount of data processed and the type of data processed. The controller issues the first drainage strategy to the device to be processed in the access device according to the safety detection performance of the detection device, so that the device to be processed in the access device establishes a drainage tunnel with at least one detection device. The data output by the device to be processed is sent through the drainage tunnel to at least one detection device for safety detection. This makes full use of the deployment function of the controller, so that the controller can divert the traffic of the access device to the detection device for detection according to the security detection performance of the detection device in the network, and realize the automatic deployment of the security resources of the entire network to avoid Missed traffic detection due to service degradation of network equipment.

FIG. 2 is a schematic flowchart 1 of a network security detection method provided by an embodiment of this application; as shown in FIG. 2, the method in this embodiment may include:

S101. The controller receives the safety detection performance of multiple detection devices in the network.

Exemplarily, the network security detection method in this embodiment is applicable to a local area network scenario such as an industrial park network or an enterprise network. Taking an enterprise network as an example, the enterprise network includes multiple network element devices, and these network element devices may be switches, firewalls, and so on. In order to facilitate the distinction, the network element device with its own security detection capability is called the detection device, and the network element device that does not have the security detection capability or has limited security detection capability and needs to rely on other detection devices for security detection is called the access device. All access devices and detection devices in the network are connected to the controller in communication. In step S101, the controller receives the safety detection performance of multiple detection devices in the network. For example, Table 1 shows the safety detection performance of the detection equipment named xxx and yyy; Table 2 shows the safety detection performance of different data types.

Table 1

检测设备Testing Equipment	安全检测性能Safety detection performance
xxxxxx	40Gbps40Gbps
yyyyyy	10Gbps10Gbps

Table 2

As shown in Table 1 and Table 2, the safety detection performance of different detection equipment in the network is different. Therefore, after the network is built, the controller needs to obtain the safety detection performance of each detection equipment in the network to facilitate subsequent deployment of the inspection equipment .

S102: According to the safety detection performance of the multiple detection devices, issue a first drainage strategy to the device to be processed in the access device.

Exemplarily, in step S102, the first diversion strategy is used to instruct the device to be processed to establish a diversion tunnel with at least one detection device among the multiple detection devices. The controller issues the first drainage strategy to the device to be processed in the access device according to the safety detection performance of the detection device, so that the device to be processed in the access device establishes a drainage tunnel with at least one detection device. The data output by the device to be processed is sent through the drainage tunnel to at least one detection device for safety detection. This makes full use of the deployment function of the controller, so that the controller can divert the traffic of the access device to the detection device for detection according to the security detection performance of the detection device in the network, and realize the automatic deployment of the security resources of the entire network to avoid Missed traffic detection due to service degradation of network equipment.

It should be noted that the number of detection devices that establish drainage tunnels with the device to be processed is not limited in this embodiment.

In an optional implementation manner, the first drainage strategy issued by the controller to the device to be processed may include a correspondence between a data type and a detection device capable of detecting the data type. According to the first drainage strategy, the to-be-processed device diverts data of different data types to a detection device capable of detecting data types for safety detection.

Exemplarily, referring to Table 1, when the data output by the device to be processed has only one general type of data, that is, any detection device can perform detection, it can be based on the amount of data passed on the device to be processed and the safety of multiple detection devices. The detection capability determines at least one detection device, wherein the sum of the safety detection capabilities of the at least one detection device meets the detection of the data passed on the device to be processed.

Exemplarily, referring to Table 2, when the data output by the device to be processed includes different types of data, at this time, it is necessary to select multiple detection devices according to the data type to perform safety detection on the data output by the device to be processed.

In another optional implementation manner, when the amount of data passing on the device to be processed increases, so that the sum of the safety detection capabilities of at least one detection device cannot meet the detection of the data passing on the device to be processed, the at least one detection device One or more detection devices in the device send a second diversion strategy; the second diversion strategy is used to instruct one or more detection devices to establish a diversion tunnel with at least one detection device other than the at least one detection device.

In this embodiment, the traffic output by the device to be processed is a variable value. When the amount of data passing on the device to be processed increases, and the sum of the security detection capabilities of the detection devices currently establishing drainage tunnels cannot meet the requirements of the data passing on the device to be processed During the detection, the controller will send the second diversion strategy to the detection devices that have established a drainage tunnel with the device to be processed, and/or the remaining detection devices that have not established a drainage tunnel with the device to be processed, so that the traffic is sent to more The testing equipment for safety testing. Therefore, it can adapt to the dynamic change of the flow, so that the scheduled detection device can always meet the flow detection requirements of the device to be processed, and the detection efficiency is improved.

FIG. 3 is a schematic diagram of the second flow of a network security detection method provided by an embodiment of this application; as shown in FIG. 3, the method in this embodiment may include:

S201. The controller receives the safety detection performance of multiple detection devices in the network.

Exemplarily, the network security detection method in this embodiment is applicable to a local area network scenario such as an industrial park network or an enterprise network. Taking an enterprise network as an example, the enterprise network includes multiple network element devices, and these network element devices may be switches, firewalls, and so on. In order to facilitate the distinction, the network element device with its own security detection capability is called the detection device, and the network element device that does not have the security detection capability or has limited security detection capability and needs to rely on other detection devices for security detection is called the access device. All access devices and detection devices in the network are connected to the controller in communication. In step S201, the controller receives the safety detection performance of multiple detection devices in the network.

S202. The access device sends the data type and/or data amount to the controller.

Exemplarily, in step S202, the access device sends the data type and/or data amount to the controller, so as to facilitate the controller to formulate the first drainage strategy according to the data type and/or data amount. The first diversion strategy is used to instruct the device to be processed to establish a diversion tunnel with at least one of the multiple detection devices.

S203. The controller issues a first drainage strategy to the device to be processed in the access device according to the safety detection performance of the multiple detection devices.

Exemplarily, in step S203, the controller issues a first drainage strategy to the device to be processed in the access device according to the safety detection performance of the detection device, so that the device to be processed in the access device and at least one detection device Establish drainage tunnels. The data output by the device to be processed is sent through the drainage tunnel to at least one detection device for safety detection.

S204. The access device receives the first diversion strategy from the controller.

Exemplarily, in step S204, the device to be processed (one or more of the access devices) receives a first drainage strategy sent by the controller, and the first drainage strategy includes: a data type and a data type capable of detecting the data type. Correspondence between testing equipment. The first diversion strategy is also used to instruct the device to be processed to send traffic belonging to the data type to the detection device capable of detecting the data type via the diversion tunnel.

S205. The access device establishes a diversion tunnel with at least one detection device according to the first diversion strategy.

Exemplarily, in step S205, the device to be processed establishes a drainage tunnel with at least one detection device according to the first drainage strategy. Among them, the amount of data passing through the device to be processed matches the safety monitoring performance of the detection device that establishes the drainage tunnel. That is, the sum of the safety detection capabilities of the detection equipment meets the detection of the data passed on the processing equipment.

S206. The access device sends data to the detection device through the drainage tunnel.

Exemplarily, in step S206, the device to be processed sends the corresponding data to the detection device through the drainage tunnel for safety detection. This makes full use of the deployment function of the controller, so that the controller can divert the traffic of the access device to the detection device for detection according to the data type and/or data volume through a drainage strategy, so as to realize the automatic deployment of the security resources of the entire network and avoid the network Missed traffic detection caused by equipment service degradation.

Optionally, the method in this embodiment may further include:

S207: When the detection capability of the detection device does not meet the detection requirement for the data from the first drainage tunnel, the detection device receives the drainage strategy sent by the controller.

Exemplarily, when the detection capability of the detection device does not meet the detection requirements for data from the first drainage tunnel, the detection device receives the drainage strategy sent by the controller, and establishes a second drainage tunnel with another detection device, so that the detection device exceeds the detection device. The performance traffic is transmitted to another detection device for detection through the second drainage tunnel.

S208. The detection device establishes a second drainage tunnel with another detection device according to the drainage strategy, and sends data beyond the detection capability of the detection device to the other detection device through the second drainage tunnel.

Exemplarily, the number of established drainage tunnels is not limited in this embodiment. When the data carrying capacity exceeds a preset threshold, any detection device can transmit the excess data to other detection devices through the second drainage tunnel for case detection. Therefore, it can adapt to the dynamic change of the traffic, so that the scheduled detection device can always meet the traffic detection requirements of the device to be processed (one or more of the access devices), and the detection efficiency is improved.

FIG. 4 is a schematic diagram 1 of signaling interaction of a network security detection method provided by an embodiment of this application. As shown in FIG. 4, the method in this embodiment may include:

S301. The detection device reports the safety detection performance to the controller.

S302. The controller generates a first-level drainage strategy according to the safety detection performance of the detection equipment in the network.

S303. The controller issues a first-level diversion strategy to the access device.

S304. The access device establishes a drainage tunnel with at least one detection device according to the first-level drainage strategy.

S305. The access device sends the traffic to the detection device through the drainage tunnel.

S306. The detection device performs safety detection on the flow.

S307. The detection device feeds back the detection result to the access device.

S308. The access device performs traffic blocking according to the detection result.

S309. When the traffic of the access device increases and the detection device cannot meet the current detection requirement, the controller issues a secondary drainage strategy to the detection device.

S310. The detection device establishes a drainage tunnel with other detection devices according to the secondary drainage strategy.

S311. The inspection device sends the traffic exceeding the inspection capability to other inspection devices.

S312. Other detection devices perform security detection on the traffic.

S313. The other detection device forwards the detection result to the access device through the detection device.

S314. The access device performs traffic blocking according to the detection result.

In this embodiment, the controller generates a first-level diversion strategy according to the safety detection performance of the detection device in the network, and then the access device establishes a diversion tunnel with the detection device according to the first-level diversion strategy. When the traffic of the access device rises and the detection device that has established a drainage tunnel cannot meet the current detection requirements of the access device, the controller issues a secondary drainage strategy to the detection device so that the detection device sends the traffic beyond the detection capability to Other testing equipment, assisted by other testing equipment for flow detection. The detection device feeds back the traffic detection result to the access device. When the detection result is a threat, the access device blocks the corresponding traffic, thereby maintaining the security of the entire network.

In this embodiment, the number of drainage tunnels is not limited. When the data carrying capacity exceeds the preset threshold, any detection device can transmit the excess data to other detection devices through the second drainage tunnel for safety detection. Therefore, it can adapt to the dynamic change of the traffic, so that the scheduled detection device can always meet the traffic detection requirements of the device to be processed (one or more of the access devices), and the detection efficiency is improved.

Figure 5 is a second schematic diagram of signaling interaction of a network security detection method provided by an embodiment of this application. As shown in Figure 5, the method in this embodiment may include:

S401. The detection device reports the safety detection performance to the controller.

S402. The controller generates a first-level drainage strategy according to the safety detection performance of the detection equipment in the network.

S403: The controller issues a first-level diversion strategy to the access device.

S404. The access device establishes a drainage tunnel with at least one detection device according to the first-level drainage strategy.

S405. The access device sends the traffic to the detection device through the drainage tunnel.

S406. The detection device performs safety detection on the flow.

S407. The detection device feeds back the detection result to the access device.

S408. The access device performs traffic blocking according to the detection result.

S409. When the traffic of the access device increases and the detection device cannot meet the current detection requirement, the controller issues a secondary drainage strategy to the access device.

S410. The access device establishes a drainage tunnel with other detection devices according to the secondary drainage strategy.

S411. The access device sends the traffic exceeding the detection capability of the detection device to other detection devices.

S412. Other detection devices perform security detection on the traffic.

S413. The other detection equipment sends the detection result to the access device.

S414. The access device performs traffic blocking according to the detection result.

In this embodiment, the controller generates a first-level diversion strategy according to the safety detection performance of the detection device in the network, and then the access device establishes a diversion tunnel with the detection device according to the first-level diversion strategy. When the traffic of the access device increases and the detection device that has established a drainage tunnel cannot meet the current detection requirements of the access device, the controller issues a secondary drainage strategy to the access device so that the access device will exceed the detection device's detection The capacity of the flow is sent to other detection equipment, and the other detection equipment assists in the flow detection. The detection device feeds back the traffic detection result to the access device. When the detection result is a threat, the access device blocks the corresponding traffic, thereby maintaining the security of the entire network.

The number of established drainage tunnels is not limited in this embodiment. When the data carrying capacity of the detection device exceeds a preset threshold, the access device can transmit the excess data to other detection devices through the second drainage tunnel for safety detection. Therefore, it can adapt to the dynamic change of the traffic, so that the scheduled detection device can always meet the traffic detection requirements of the device to be processed (one or more of the access devices), and the detection efficiency is improved.

FIG. 6 is a first structural diagram of a controller provided by an embodiment of the application. As shown in FIG. 6, the controller may include:

The receiving module 61 is used to receive the security detection performance of multiple detection devices in the network;

The processing module 62 is configured to issue a first drainage strategy to the device to be processed in the access device according to the security detection performance of the multiple detection devices; wherein the first drainage strategy is used to instruct the device to be processed and the multiple detection devices At least one of the detection devices establishes a drainage tunnel.

Optionally, the first diversion strategy further includes: the correspondence between the data type and the detection device capable of detecting the data type; the first diversion strategy is also used to instruct the detection device to send traffic belonging to the data type to the Testing equipment capable of detecting data types.

Optionally, the processing module 62 is further configured to: determine at least one detection device according to the amount of data passed on the device to be processed and the safety detection capabilities of multiple detection devices, where the sum of the safety detection capabilities of the at least one detection device meets the requirements for the processing Detection of data passed on the device.

Optionally, the processing module 62 is further configured to: when the amount of data passing on the device to be processed increases, so that the sum of the safety detection capabilities of the at least one detection device cannot meet the detection of the data passing on the device to be processed, to at least one detection device One or more detection devices in the device send a second diversion strategy; the second diversion strategy is used to instruct one or more detection devices to establish a diversion tunnel with at least one detection device other than the at least one detection device.

The controller in this embodiment can execute the methods shown in Figs. 2 to 5, and for the specific implementation process and implementation principles, refer to the content of the method descriptions shown in Figs. 2 to 5, which will not be repeated here.

FIG. 7 is a schematic structural diagram of an access device provided by an embodiment of the application. As shown in FIG. 7, the access device may include:

The sending module 71 is used to send the data type and/or data amount to the controller;

The receiving module 72 is configured to receive the first drainage strategy from the controller; where the first drainage strategy is related to the data type and/or the data volume;

The processing module 73 is configured to establish a drainage tunnel with at least one detection device according to the first drainage strategy;

The sending module 71 is used to send data to the detection device through the drainage tunnel.

FIG. 8 is a schematic structural diagram of a detection device provided by an embodiment of the application. As shown in FIG. 8, the detection device may include:

The receiving module 81 is configured to receive the drainage strategy sent by the controller when the detection capability of the detection device does not meet the detection requirement for the data from the first drainage tunnel;

The processing module 82 is configured to establish a second drainage tunnel with another detection device according to the drainage strategy, and send data beyond the detection capability of the detection device to another detection device through the second drainage tunnel.

The controller in this embodiment can execute the methods shown in FIGS. 2 to 5, and for the specific implementation process and implementation principles, please refer to the description of the method shown in FIGS. 3 to 5, which will not be repeated here.

FIG. 9 is a schematic structural diagram of a switch device provided by an embodiment of the application. As shown in FIG. 9, the switch device in this embodiment may include: a network interface 91, a processor 92, a memory 93, and a network forwarding chip 94. When the switch device has data security detection performance, it can be used as a detection device. When the switch device does not have data security detection performance, or its own data security detection performance cannot meet its own data detection requirements, the switch device can be used as an access device. It should be noted that this embodiment does not limit the specific internal architecture of the switch device, and some switch devices may not be provided with a network forwarding chip, but the processor directly performs data forwarding.

Fig. 10 is a second structural schematic diagram of a controller provided by an embodiment of the application. As shown in Fig. 10, the controller in this embodiment may include: a processor 1001, a memory 1002, an input device 1003, and an output device 1004. The device 1001 communicates with the memory 1002, the input device 1003, and the output device 1004 through a bus 1005. In addition, the controller can also be deployed in the form of a physical server or a virtual machine, and this embodiment does not limit the architecture of the controller.

An embodiment of the present application also provides a network security detection system, which includes: a controller, an access device, and a detection device; wherein: the controller is used to execute the method shown in FIG. 2; the access device is used to execute the method shown in FIG. The method shown; the detection device is used to perform the method shown in Figure 3. For its specific implementation process and implementation principle, please refer to the content of the method description shown in Figures 2 to 5, which will not be repeated here.

The embodiment of the present application provides a computer-readable storage medium, and the computer-readable storage medium stores instructions. When the instructions are executed, the computer executes the method performed by the terminal device in the foregoing embodiment of the present application.

The embodiment of the present application provides a computer-readable storage medium, and the computer-readable storage medium stores instructions. When the instructions are executed, the computer executes the method performed by the network device in the foregoing embodiment of the present application.

In the several embodiments provided in this application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are merely illustrative, for example, the division of units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored, or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.

It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation. The functional modules in the embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module. The above-mentioned integrated modules can be implemented in the form of hardware or software function modules.

If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present application or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can A personal computer, a server, or a network device, etc.) or a processor (processor) executes all or part of the steps of the methods in the embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

In the foregoing embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website, computer, server, or data center through a cable (such as Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) to transmit to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, an optical disc), or a semiconductor medium (for example, a solid state drive (SSD)), and the like.

Claims

A network security detection method, characterized in that the method includes:

The controller receives the safety detection performance of multiple detection devices in the network;

According to the security detection performance of the multiple detection devices, a first drainage strategy is issued to the device to be processed in the access device; wherein, the first drainage strategy is used to instruct the device to be processed and the multiple detection devices At least one detection device in the device establishes a drainage tunnel.
The method of claim 1, wherein:

The first drainage strategy further includes: a correspondence between a data type and a detection device capable of detecting the data type;

The first diversion strategy is also used to instruct the device to be processed to send traffic belonging to the data type to the detection device capable of detecting the data type via the diversion tunnel.
The method according to claim 1 or 2, wherein the method further comprises:

The at least one detection device is determined according to the amount of data passed on the device to be processed and the security detection capabilities of multiple detection devices, where the sum of the security detection capabilities of the at least one detection device meets the requirements for passing on the device to be processed Data detection.
The method according to claim 3, wherein the method further comprises:

When the amount of data passing on the device to be processed increases, so that the sum of the security detection capabilities of the at least one detection device cannot meet the detection of the data passing on the device to be processed, send the data to the at least one detection device One or more detection devices in the send a second diversion strategy; the second diversion strategy is used to instruct one or more detection devices to establish a diversion tunnel with other detection devices other than the at least one detection device.
A network security detection method, characterized in that the method includes:

The access device sends the data type and/or data volume to the controller;

Receiving a first drainage strategy from the controller; wherein the first drainage strategy is related to the data type and/or data volume;

Establishing a drainage tunnel with at least one detection device according to the first drainage strategy;

Send data to the detection device through the drainage tunnel.
A network security detection method, characterized in that the method includes:

When the detection capability of the detection device does not meet the detection requirement for the data from the first drainage tunnel, the detection device receives the drainage strategy sent by the controller;

The detection device establishes a second drainage tunnel with another detection device according to the drainage strategy, and sends data beyond the detection capability of the detection device to the another detection device through the second drainage tunnel.
A controller, characterized in that it comprises:

The receiving module is used to receive the security detection performance of multiple detection devices in the network;

The processing module is configured to issue a first drainage strategy to the device to be processed in the access device according to the security detection performance of the multiple detection devices; wherein, the first drainage strategy is used to instruct the device to be processed and the device to be processed At least one detection device of the plurality of detection devices establishes a drainage tunnel.
The controller according to claim 7, wherein the first drainage strategy further comprises: a correspondence between a data type and a detection device capable of detecting the data type;

The first diversion strategy is also used to instruct the detection device to send traffic belonging to the data type to the detection device capable of detecting the data type via the diversion tunnel.
The controller according to claim 7 or 8, wherein the processing module is further configured to:

The at least one detection device is determined according to the amount of data passed on the device to be processed and the security detection capabilities of multiple detection devices, where the sum of the security detection capabilities of the at least one detection device meets the requirements for passing on the device to be processed Data detection.
The controller according to claim 9, wherein the processing module is further configured to:

When the amount of data passing on the device to be processed increases, so that the sum of the security detection capabilities of the at least one detection device cannot meet the detection of the data passing on the device to be processed, send the data to the at least one detection device One or more detection devices in the send a second diversion strategy; the second diversion strategy is used to instruct one or more detection devices to establish a diversion tunnel with other detection devices other than the at least one detection device.
An access device, characterized in that it comprises:

The sending module is used to send the data type and/or data amount to the controller;

A receiving module, configured to receive a first drainage strategy from the controller; wherein the first drainage strategy is related to the data type and/or data volume;

A processing module, configured to establish a drainage tunnel with at least one detection device according to the first drainage strategy;

The sending module is configured to send data to the detection device through the drainage tunnel.
A detection device, characterized in that it comprises:

The receiving module is used to receive the drainage strategy sent by the controller when the detection capability of the detection device does not meet the detection requirement for the data from the first drainage tunnel;

The processing module is configured to establish a second drainage tunnel with another detection device according to the drainage strategy, and send data beyond the detection capability of the detection device to the another detection device using the second drainage tunnel.
A network security detection system, characterized in that the system includes: a controller, an access device, and a detection device; wherein:

The controller is configured to execute the method according to any one of claims 1-4;

The access device is used to execute the method according to claim 5;

The detection device is used to execute the method according to claim 6.