CN101453389A - Flow monitoring method and system - Google Patents

Flow monitoring method and system Download PDF

Info

Publication number
CN101453389A
CN101453389A CNA2008102269036A CN200810226903A CN101453389A CN 101453389 A CN101453389 A CN 101453389A CN A2008102269036 A CNA2008102269036 A CN A2008102269036A CN 200810226903 A CN200810226903 A CN 200810226903A CN 101453389 A CN101453389 A CN 101453389A
Authority
CN
China
Prior art keywords
abnormal data
data stream
flow
router
couple
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CNA2008102269036A
Other languages
Chinese (zh)
Inventor
刘惠明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Joint Network Communication Group Co Ltd
Beijing Telecom Planning and Designing Institute Co Ltd
Original Assignee
CHINA NETWORK COMMUNICATIONS GROUP Corp
Beijing Telecom Planning and Designing Institute Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by CHINA NETWORK COMMUNICATIONS GROUP Corp, Beijing Telecom Planning and Designing Institute Co Ltd filed Critical CHINA NETWORK COMMUNICATIONS GROUP Corp
Priority to CNA2008102269036A priority Critical patent/CN101453389A/en
Publication of CN101453389A publication Critical patent/CN101453389A/en
Pending legal-status Critical Current

Links

Images

Abstract

The invention discloses a method and a system for flow rate monitoring. The method comprises: a router adds packet identifiers in data packets in data flows passing through; a flow rate monitoring device monitors the flow rates of data flows entering or leaving a system under protection in real time and extracts an abnormal data flow sample from the abnormal data flows when monitoring the abnormal data flows and sends the abnormal data flow sample to a flow rate management server; the flow rate management server analyzes and processes the abnormal data flow sample and positions access routers of the abnormal data flows according to the packet identifiers in the data packets of the abnormal data flow sample; and the access routers process the abnormal data flows according to control commands sent by the flow rate management server. The system comprises routers, the flow rate monitoring device and the flow rate management server. The method and the system use the packet identifiers to trace the sources of the abnormal data flows and process the abnormal data flows in the access routers through which the abnormal data flow pass, realize the control and blockage of the sources of the abnormal data flows and can effectively handle DDoS attack.

Description

Flow monitoring method and system
Technical field
The present invention relates to the network traffics monitoring technology, particularly a kind of flow monitoring method and system.
Background technology
When the Internet constantly develops, hacking technique is also in continuous development, utilize the implantation of back door software, increasing broadband user has become " puppet's machine " of helping make it from bad to worse, puppet's network is more and more huger, being difficult to of the luring of economic interests, attack source traces, and increasing hacker is made a desperate move, and attacks as the only magic weapon of getting rich utilizing the puppet networking to start.These factors all cause distributed denial of service (the Distributed Denial of Service in the network; Hereinafter to be referred as: DDoS) attack is more and more frequent, scale is increasing, and these ddos attacks not only cause the paralysis of target customer's server, network, but also the safety of operator's metropolitan area network is arrived in serious threat, and causes the extensive concern of the whole society.
At this situation, owing to can't realize therefore, can't controlling or shutoff to the source of data flow to the tracing to the source of packet.At present, flow monitoring and control system are deployed in key network outlet or protected system leading portion mostly, dispose usually and disperse, and can only realize monitoring and control to partial discharge, can't realize monitoring and control to the whole network flow.Comprise at the normal counter-measure of abnormal data circulation: black hole route and flow cleaning etc.
The black hole route by path black hole is set, is incorporated into path black hole with attack data flow such as DDoS, prevents that super-flow from influencing network and normally moving, and has made full use of the bag forwarding capability of router, and is little to the system load influence.
Flow cleaning is set up Border Gateway Protocol equity (Border Gateway Protocol Peer between flow cleaning equipment and the egress router; Hereinafter to be referred as: relation BGP Peer), in case the flow monitoring monitoring of equipment goes out the attack or the abnormal data stream in certain zone, flow monitoring equipment starts flow cleaning equipment with automatic or manual to be protected zone under fire, and flow cleaning equipment will be initiated Border Gateway Protocol (Border Gateway Protocol; Hereinafter to be referred as: BGP) route announcement, to revise and point to the route in zone under fire in the egress router, then point to flow cleaning equipment, abnormal data stream will be introduced into flow cleaning equipment and clean, and unaffected to other regional normal flow.
But in above-mentioned counter-measure, the black hole route is the filtration to destination address, and the flow that directly causes going to destination address abandons, and makes destination address unavailable; Flow cleaning is also to be based on destination address, can't realize the tracing to the source of flow, location and shutoff.
Summary of the invention
The purpose of this invention is to provide a kind of flow monitoring method and system,, realize flow monitoring and defence initiatively to solve the problem that to trace to the source to flow.
For achieving the above object, the invention provides a kind of flow monitoring method, comprising:
Step 100, router add the bag sign to the data packets in data flows of process;
Step 200, flow monitoring equipment are monitored in real time to the flow of the turnover data flow of protected system, when monitoring abnormal data stream, from described abnormal data stream, extract abnormal data stream sample, and described abnormal data stream sample is sent to the traffic management server;
Step 300, described traffic management server receive the abnormal data stream sample that described flow monitoring equipment sends, described abnormal data stream sample is carried out analyzing and processing, according to the bag mark of packet in the described abnormal data stream sample, locate the couple in router of described abnormal data stream;
Step 400, described couple in router are handled abnormal data stream according to the control command that described traffic management server sends.
The present invention also provides a kind of flow monitoring system, comprising:
An above router is used for the packet of process is added the bag mark, and a described above router comprises and be used to receive control command, the couple in router that abnormal data stream is handled;
Flow monitoring equipment is used for the flow of the turnover data flow of protected system is monitored in real time, when monitoring abnormal data stream, extracts abnormal data stream sample from described abnormal data stream, and sends described abnormal data stream sample;
The traffic management server, be used to receive the described abnormal data stream sample that described flow monitoring equipment sends, described abnormal data stream sample is carried out analyzing and processing, bag mark according to packet in the described abnormal data stream sample, locate the couple in router of described abnormal data stream, sending controling instruction.
The present invention is by providing a kind of flow monitoring method and system, utilize the bag labelling technique that abnormal data stream is traced to the source, couple in router in abnormal data stream process is handled it, has realized the source of abnormal data stream is controlled and shutoff, can tackle ddos attack effectively.
Description of drawings
Fig. 1 is the flow chart of flow monitoring method first embodiment of the present invention;
Fig. 2 is the flow chart of flow monitoring method second embodiment of the present invention;
Fig. 3 is the flow chart of flow monitoring method the 3rd embodiment of the present invention;
Fig. 4 is the system block diagram of flow monitoring system first embodiment of the present invention;
Fig. 5 is the system block diagram of flow monitoring system second embodiment of the present invention.
Description of reference numerals:
1-router; 2-flow monitoring equipment; 3-traffic management server;
4-flow cleaning equipment; 11-couple in router; 111-limiting unit;
112-retransmission unit.
Embodiment
Below by drawings and Examples, technical scheme of the present invention is described in further detail.
Fig. 1 is the flow chart of flow monitoring method first embodiment of the present invention.As shown in Figure 1, flow monitoring method of the present invention comprises:
Step 100, router add the bag sign to the data packets in data flows of process;
Step 200, flow monitoring equipment are monitored in real time to the flow of the turnover data flow of protected system, when monitoring abnormal data when stream, extract abnormal data stream sample from abnormal data stream, and abnormal data is flowed sample send to the traffic management server;
Step 300, traffic management server receive the abnormal data stream sample that flow monitoring equipment sends, and abnormal data stream sample is carried out analyzing and processing, according to the bag mark of packet in the abnormal data stream sample, the couple in router of location abnormal data stream;
Step 400, couple in router are handled abnormal data stream according to the control command that the traffic management server sends.
Wherein, in step 200,, therefore, need only therefrom extract partial data stream and flow sample, it be carried out subsequent analysis handle as abnormal data because the flow of the abnormal data that monitors stream is quite big.
In the step 300, the traffic management server carries out analyzing and processing to abnormal data stream sample, comprising: the traffic management server obtains the bag sign of packet in the abnormal data stream sample; And the traffic management server obtains the type of abnormal data stream.The traffic management server obtains the bag sign of packet from abnormal data stream sample, and then locatees the couple in router of this abnormal data stream; The traffic management server obtains its type from abnormal data stream, so that couple in router is handled the abnormal data stream of same type.
Flow monitoring method embodiment of the present invention, utilize the bag labelling technique that abnormal data stream is traced to the source, in the couple in router of abnormal data stream process, it is handled, realized the source of abnormal data stream is controlled and shutoff, can tackle ddos attack effectively.
Fig. 2 is the flow chart of flow monitoring method second embodiment of the present invention.As shown in Figure 2, on the basis of above-mentioned first embodiment, the step 400 of present embodiment is specially:
Step 401, couple in router receive the control command that the traffic management server sends, and according to predetermined policy the data flow of same type are limited processing.
When the traffic management server according to abnormal data stream sample in the bag mark location of packet during to the couple in router of this abnormal data stream, send the control command that restriction is handled to this couple in router.When couple in router receives this control command, the abnormal data stream of same type is limited processing.Can be according to predetermined policy, according to factors such as the type of abnormal data stream, flows, carry out in various degree restriction or blocking processing etc.
Fig. 3 is the flow chart of flow monitoring method the 3rd embodiment of the present invention.As shown in Figure 3, on the basis of above-mentioned first embodiment, the step 400 of present embodiment also can for:
Step 402, couple in router receive the control command that the traffic management server sends, and flow cleaning equipment is issued in the abnormal data circulation;
Step 403, flow cleaning equipment receive the control command that the traffic management server sends, and clean the abnormal data stream that couple in router is transmitted, and the data flow after cleaning is sent to protected system.
When the traffic management server according to abnormal data stream sample in the bag mark location of packet during to the couple in router of this abnormal data stream, send the control command of clean to this couple in router and flow cleaning equipment.When couple in router receives this control command, flow cleaning equipment is issued in the abnormal data circulation of same type.Flow cleaning equipment cleans abnormal data stream, and the data flow after will cleaning sends to protected system.
Bag mark in the foregoing description can be in probability mark, certainty mark or the self adaptation mark any one.Wherein, probability is labeled as router with the bag mark of certain probability to the data packets in data flows adding of process; Certainty is labeled as the bag mark of router to the data packets in data flows adding of each process; Self adaptation is labeled as the bag mark that router adds the data packets in data flows of process adaptively.
Flow monitoring method embodiment of the present invention, utilize the bag labelling technique that abnormal data stream is traced to the source, in the couple in router of abnormal data stream process, limit it processing or it is forwarded to flow cleaning equipment, realized the source of abnormal data stream is controlled and shutoff, can tackle ddos attack effectively.
Fig. 4 is the system block diagram of flow monitoring system first embodiment of the present invention.As shown in Figure 4, flow monitoring system of the present invention comprises: above router, flow monitoring equipment 2 and a traffic management server 3, in the present embodiment, an above router specifically comprises router one and couple in router 11.Need to prove that an above router can be specially couple in router in the flow monitoring system of the present invention, also can comprise couple in router and more than one other routers.
Router one is used for the packet of process is added the bag mark, router one can add the bag mark to the data packets in data flows of process with certain probability, also can add the bag mark, can also wrap mark to the data packets in data flows adding of process adaptively to the data packets in data flows of each process.The couple in router 11 that data flow is linked into flow monitoring system is used to receive the control command that traffic management server 3 sends, and abnormal data stream is handled, and couple in router 11 also can add the bag mark to data packets in data flows; Flow monitoring equipment 2 is used for the flow of the turnover data flow of protected system is monitored in real time, when monitoring abnormal data when stream, extracts abnormal data stream sample from abnormal data stream, and abnormal data is flowed sample sends to traffic management server 3; Traffic management server 3 is used to receive the abnormal data stream sample that flow monitoring equipment 2 sends, abnormal data stream sample is carried out analyzing and processing, according to the bag mark of packet in the abnormal data stream sample, the couple in router 11 of location abnormal data stream, sending controling instruction.
Wherein, couple in router 11 can comprise limiting unit 111, and limiting unit 111 is used for according to predetermined policy data stream being limited processing.
Router one adds the bag mark to the packet of process.The flow of the turnover data flow of 2 pairs of protected systems of flow monitoring equipment is monitored in real time; when monitoring abnormal data stream; from abnormal data stream, extract abnormal data stream sample; and send to traffic management server 3; traffic management server 3 arrives the couple in router 11 that this abnormal data flows according to the bag mark location of packet in the abnormal data stream sample, sends the control command that restriction is handled to this couple in router 11.When couple in router 11 received this control command, the abnormal data stream of 111 pairs of same types of limiting unit limited processing.Can be according to predetermined policy, according to factors such as the type of abnormal data stream, flows, carry out in various degree restriction or blocking processing etc.
The embodiment of the invention utilizes the bag labelling technique that abnormal data stream is traced to the source, and the couple in router that flows process at abnormal data limits it processing, has realized the source of abnormal data stream is controlled and shutoff, can tackle ddos attack effectively.
Fig. 5 is the system block diagram of flow monitoring system second embodiment of the present invention.As shown in Figure 5, on the basis of technique scheme, couple in router 11 also can comprise retransmission unit 112, and retransmission unit 112 is used to transmit abnormal data stream.In the present embodiment; flow monitoring system also comprises flow cleaning equipment 4; flow cleaning equipment 4 is used to receive the control command that traffic management server 3 sends; the abnormal data stream that the retransmission unit 112 of cleaning couple in router 11 is transmitted sends to protected system with the data flow after cleaning.
When traffic management server 3 according to abnormal data stream sample in the bag mark location of packet during to the couple in router 11 of this abnormal data stream, send the control command of clean to this couple in router 11 and flow cleaning equipment 4.When couple in router 11 received this control command, retransmission unit 112 was issued flow cleaning equipment 4 with the abnormal data circulation of same type.4 pairs of abnormal data streams of flow cleaning equipment clean, and the data flow after will cleaning sends to protected system.
The embodiment of the invention, utilize the bag labelling technique that abnormal data stream is traced to the source, the couple in router of abnormal data stream process is forwarded to flow cleaning equipment with it, has realized the source of abnormal data stream is controlled and shutoff, can tackle ddos attack effectively.
In above-mentioned flow monitoring system embodiment, couple in router and flow monitoring equipment are positioned at bearer network; The traffic management server is positioned at the flow scheduling layer; Flow cleaning equipment is positioned at the flow execution level.
The present invention is by providing a kind of flow monitoring method and system, utilize the bag labelling technique that abnormal data stream is traced to the source, in the couple in router of abnormal data stream process, limit it processing or it is forwarded to flow cleaning equipment, realized the source of abnormal data stream is controlled and shutoff, can successfully manage ddos attack; Simultaneously, make up flow scheduling layer and the flow monitoring system that the flow execution level separates, avoided a large amount of abnormal flows passing through and spread in core network,, realized the unified monitoring of network and dispatch the control of data distributions, centralized Analysis.
It should be noted that at last: above embodiment is only in order to technical scheme of the present invention to be described but not limit it, although the present invention is had been described in detail with reference to preferred embodiment, those of ordinary skill in the art is to be understood that: it still can make amendment or be equal to replacement technical scheme of the present invention, and these modifications or be equal to replacement and also can not make amended technical scheme break away from the spirit and scope of technical solution of the present invention.

Claims (10)

1, a kind of flow monitoring method is characterized in that, comprising:
Step 100, router add the bag sign to the data packets in data flows of process;
Step 200, flow monitoring equipment are monitored in real time to the flow of the turnover data flow of protected system, when monitoring abnormal data stream, from described abnormal data stream, extract abnormal data stream sample, and described abnormal data stream sample is sent to the traffic management server;
Step 300, described traffic management server receive the abnormal data stream sample that described flow monitoring equipment sends, described abnormal data stream sample is carried out analyzing and processing, according to the bag mark of packet in the described abnormal data stream sample, locate the couple in router of described abnormal data stream;
Step 400, described couple in router are handled abnormal data stream according to the control command that described traffic management server sends.
2, flow monitoring method according to claim 1 is characterized in that, described in the step 300 described abnormal data stream sample is carried out analyzing and processing, comprising:
Obtain the bag mark of packet in the described abnormal data stream sample; And
Obtain the type of described abnormal data stream sample.
3, flow monitoring method according to claim 2 is characterized in that, described step 400 comprises:
Step 401, described couple in router receive the control command that described traffic management server sends, and according to predetermined policy the data flow of same type are limited processing.
4, flow monitoring method according to claim 1 and 2 is characterized in that, described step 400 comprises:
Step 402, described couple in router receive the control command that described traffic management server sends, and flow cleaning equipment is issued in described abnormal data circulation;
Step 403, described flow cleaning equipment receive the control command that described traffic management server sends, and clean the abnormal data stream that described couple in router is transmitted, and the data flow after cleaning is sent to described protected system.
5, flow monitoring method according to claim 1 and 2 is characterized in that, described bag is labeled as probability mark, certainty mark or self adaptation mark.
6, a kind of flow monitoring system is characterized in that, comprising:
An above router is used for the packet of process is added the bag mark, and a described above router comprises and be used to receive control command, the couple in router that abnormal data stream is handled;
Flow monitoring equipment is used for the flow of the turnover data flow of protected system is monitored in real time, when monitoring abnormal data stream, extracts abnormal data stream sample from described abnormal data stream, and sends described abnormal data stream sample;
The traffic management server, be used to receive the described abnormal data stream sample that described flow monitoring equipment sends, described abnormal data stream sample is carried out analyzing and processing, bag mark according to packet in the described abnormal data stream sample, locate the couple in router of described abnormal data stream, sending controling instruction.
7, flow monitoring system according to claim 6 is characterized in that, described couple in router comprises: limiting unit is used for according to predetermined policy data stream being limited processing.
8, flow monitoring system according to claim 6 is characterized in that, described couple in router comprises: retransmission unit is used to transmit described abnormal data stream.
9, flow monitoring system according to claim 8 is characterized in that, also comprises:
Flow cleaning equipment is used to receive the control command that described traffic management server sends, and cleans the abnormal data stream that the retransmission unit of described couple in router is transmitted, and the data flow after cleaning is sent to described protected system.
10, flow monitoring system according to claim 9 is characterized in that, described couple in router and described flow monitoring equipment are positioned at bearer network; Described traffic management server is positioned at the flow scheduling layer; Described flow cleaning equipment is positioned at the flow execution level.
CNA2008102269036A 2008-11-19 2008-11-19 Flow monitoring method and system Pending CN101453389A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CNA2008102269036A CN101453389A (en) 2008-11-19 2008-11-19 Flow monitoring method and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CNA2008102269036A CN101453389A (en) 2008-11-19 2008-11-19 Flow monitoring method and system

Publications (1)

Publication Number Publication Date
CN101453389A true CN101453389A (en) 2009-06-10

Family

ID=40735418

Family Applications (1)

Application Number Title Priority Date Filing Date
CNA2008102269036A Pending CN101453389A (en) 2008-11-19 2008-11-19 Flow monitoring method and system

Country Status (1)

Country Link
CN (1) CN101453389A (en)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102111394A (en) * 2009-12-28 2011-06-29 成都市华为赛门铁克科技有限公司 Network attack protection method, equipment and system
CN103493455A (en) * 2011-04-19 2014-01-01 微软公司 Global flow management using modified hostname
CN105763351A (en) * 2014-12-17 2016-07-13 华为技术有限公司 Method for deploying value added service, forwarding equipment, detection equipment, and management equipment
CN105959334A (en) * 2016-07-20 2016-09-21 上海携程商务有限公司 DDos attack automatic defense system and method
CN106209461A (en) * 2016-07-15 2016-12-07 中国联合网络通信集团有限公司 A kind of flow processing method and device
WO2017063198A1 (en) * 2015-10-16 2017-04-20 华为技术有限公司 Data transmission method, device and system
CN106921505A (en) * 2015-12-25 2017-07-04 中国移动通信集团吉林有限公司 A kind of data handling system and method
CN109688129A (en) * 2018-12-24 2019-04-26 中电福富信息科技有限公司 A kind of web site emergence treating method
CN109995714A (en) * 2017-12-29 2019-07-09 中移(杭州)信息技术有限公司 A kind of methods, devices and systems for disposing flow
WO2020088598A1 (en) * 2018-11-02 2020-05-07 华为技术有限公司 Method and device for determining category information

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102111394B (en) * 2009-12-28 2015-03-11 华为数字技术(成都)有限公司 Network attack protection method, equipment and system
US9088607B2 (en) 2009-12-28 2015-07-21 Huawei Digital Technologies (Cheng Du) Co., Limited Method, device, and system for network attack protection
CN102111394A (en) * 2009-12-28 2011-06-29 成都市华为赛门铁克科技有限公司 Network attack protection method, equipment and system
CN103493455A (en) * 2011-04-19 2014-01-01 微软公司 Global flow management using modified hostname
CN105763351B (en) * 2014-12-17 2019-09-03 华为技术有限公司 Dispose method, forwarding device, detection device and the management equipment of value-added service
CN105763351A (en) * 2014-12-17 2016-07-13 华为技术有限公司 Method for deploying value added service, forwarding equipment, detection equipment, and management equipment
CN107005538B (en) * 2015-10-16 2020-06-30 德正远(青岛)新能源科技有限公司 Data transmission method, device and system
WO2017063198A1 (en) * 2015-10-16 2017-04-20 华为技术有限公司 Data transmission method, device and system
CN107005538A (en) * 2015-10-16 2017-08-01 华为技术有限公司 The methods, devices and systems of data transfer
CN106921505B (en) * 2015-12-25 2019-10-18 中国移动通信集团吉林有限公司 A kind of data processing system and method
CN106921505A (en) * 2015-12-25 2017-07-04 中国移动通信集团吉林有限公司 A kind of data handling system and method
CN106209461B (en) * 2016-07-15 2019-04-16 中国联合网络通信集团有限公司 A kind of flow processing method and device
CN106209461A (en) * 2016-07-15 2016-12-07 中国联合网络通信集团有限公司 A kind of flow processing method and device
CN105959334B (en) * 2016-07-20 2019-09-24 上海携程商务有限公司 The automatic defense and method of ddos attack
CN105959334A (en) * 2016-07-20 2016-09-21 上海携程商务有限公司 DDos attack automatic defense system and method
CN109995714A (en) * 2017-12-29 2019-07-09 中移(杭州)信息技术有限公司 A kind of methods, devices and systems for disposing flow
CN109995714B (en) * 2017-12-29 2021-10-29 中移(杭州)信息技术有限公司 Method, device and system for handling traffic
WO2020088598A1 (en) * 2018-11-02 2020-05-07 华为技术有限公司 Method and device for determining category information
CN111148105A (en) * 2018-11-02 2020-05-12 华为技术有限公司 Method and device for determining category information
CN109688129A (en) * 2018-12-24 2019-04-26 中电福富信息科技有限公司 A kind of web site emergence treating method

Similar Documents

Publication Publication Date Title
CN101453389A (en) Flow monitoring method and system
Sahay et al. ArOMA: An SDN based autonomic DDoS mitigation framework
JP4634456B2 (en) Method and system for security of network traffic
JP5411134B2 (en) Method and mechanism for port redirection in a network switch
JP4547340B2 (en) Traffic control method, apparatus and system
US7987493B1 (en) Method and system for mitigating distributed denial of service attacks using centralized management
US9166990B2 (en) Distributed denial-of-service signature transmission
US10986018B2 (en) Reducing traffic overload in software defined network
Huang et al. Countering denial-of-service attacks using congestion triggered packet sampling and filtering
CN101106518A (en) Service denial method for providing load protection of central processor
KR100523483B1 (en) The system and method of malicious traffic detection and response in network
Sahay et al. Adaptive policy-driven attack mitigation in SDN
CN103747026A (en) Alarm method and alarm device of openflow flow table
KR101352553B1 (en) Method and System for DDoS Traffic Detection and Traffic Mitigation using Flow Statistic
JP2006067078A (en) Network system and attack defense method
KR20060061571A (en) Apparatus for abnormal traffic control and method thereof
JP4279324B2 (en) Network control method
KR20060130892A (en) Ddos detection and packet filtering scheme
CN109104437B (en) Routing domain, method and device for processing IP message in routing domain
KR20100055146A (en) Method for preventing leakage of internal information using messenger and network contents security system thereof
Bauer et al. Earlydrop: A trade-off driven ddos defense mechanism for software-defined infrastructures
Veena et al. Detection and mitigation of security attacks using real time SDN analytics
WO2023222028A1 (en) Network programming technology processing method and system, and storage medium
CN103856455A (en) Method and system for protecting computer network against data flood attack
US20050086524A1 (en) Systems and methods for providing network security with zero network footprint

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
ASS Succession or assignment of patent right

Owner name: CHINA LINKED NETWORK COMMUNICATION GROUP CO.,LTD.

Free format text: FORMER OWNER: CHINA NETWORK COMMUNICATIONS GROUP CORPORATION

Effective date: 20090605

C41 Transfer of patent application or patent right or utility model
TA01 Transfer of patent application right

Effective date of registration: 20090605

Address after: 21, Finance Street, Xicheng District, Beijing, zip code: 100000

Applicant after: China Joint Network Communication Group Co., Ltd.

Co-applicant after: Beijing Telecom Planning & Designing Institute Co., Ltd.

Address before: Zip code 100000, 21 Finance Street, Xicheng District, Beijing.

Applicant before: China Network Communication Group Corporation

Co-applicant before: Beijing Telecom Planning & Designing Institute Co., Ltd.

C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C02 Deemed withdrawal of patent application after publication (patent law 2001)
WD01 Invention patent application deemed withdrawn after publication

Open date: 20090610