WO2008141548A1

WO2008141548A1 - A method and device of preventing attack for network equipment

Info

Publication number: WO2008141548A1
Application number: PCT/CN2008/070548
Authority: WO
Inventors: Zhiwang Zhao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-05-17
Filing date: 2008-03-20
Publication date: 2008-11-27
Also published as: CN101060531A; CN101060531B

Abstract

The invention provides a method and device of preventing attack for network equipment, and solves the problem that current communication network could not intelligently prevent attack. The method comprises obtaining a packet losing information of a flow overload, a resource information, a resource security information, and a flow restriction threshold of a network equipment. The flow restriction threshold of a service message is adjusted correspondingly based on the packet losing information of a flow overload and the comparative result of the resource information with the resource security information. Under the condition that the system resource is limited, the method and equipment adopt intelligent adjustment measures to increase the flow restriction threshold dynamically, thus improving the capacity of the network equipment to realize the best service disposing capacity. And under the condition that the system resource is overloaded, the method and equipment adopt intelligent prevention measures to decrease the flow restriction threshold dynamically, thus reaching the purpose of protecting equipment.

Description

Method and device for network device attack prevention

The present invention relates to the field of communications, and in particular, to a method and apparatus for implementing intelligent attack defense of a network device. Background technique

Denial of Service (DoS) is broadly defined as any attack that causes a server to fail to provide services. The most common DoS attack is to use a large number of service requests to consume too many service resources, causing the service to be overloaded and unable to respond to other requests. These service resources include network bandwidth, file system space capacity, open processes, or connections. Because any resource has certain limitations, no matter how fast the computer is processed, how much memory capacity is, and how high the bandwidth is connected to the Internet, the consequences of such an attack cannot be avoided. Another common DOS attack is to cause the host that provides the service resource to respond incorrectly by tricking the spoof and so on, thereby stopping the service or even crashing.

The Distributed Denial of DDoS (D s t r ibuted Denia l of Servi ce) is an enhanced form of DoS attack. A DoS attack launches an attack on a target connected to the Internet, consuming the resources of the target host or the network, thereby interfering with or completely preventing the service to legitimate users. The DDoS attack uses a large number of distributed hosts to perform single or multiple targets. attack.

For DOS attacks and DDoS attacks, network devices usually use the traffic limit (limit the number of bytes of packets sent to the device per unit time) to prevent DOS attacks.

The traffic limiting function of the network device is to protect the device by limiting the size of the data stream sent in a unit time. However, simply using the traditional manual setting of the traffic limiting function for network device protection has the following disadvantages: Once the limited traffic value After the setting, the network device cannot be intelligently adjusted dynamically, which may result in waste of network device resources. For example, a network device could have been The maximum traffic of the packets of the protocol packets of the IMBps is processed. However, for the sake of security, only the traffic limit of 512 KBps is set for the protocol packets. As a result, the traffic of the protocol packets reaches 512 KBps, and packet loss occurs. The processing performance and specifications of the device are degraded. In addition, if the packet traffic is set unreasonably, overloading the network device under a large traffic attack may cause the network device service to be abnormal or even embarrassing. SUMMARY OF THE INVENTION The problem of being unable to intelligently guard against attacks in the network.

One embodiment of the present invention to solve the above technical problems is:

A network device attack defense method includes: acquiring traffic overload packet loss information of a network device, resource information of a network device, a resource security threshold of the network device, and a traffic restriction threshold of the network device; The result of comparing the resource information with the resource security threshold dynamically adjusts the traffic restriction threshold of the service packet flow.

Another embodiment of the present invention is directed to: an apparatus for preventing attacks, comprising: an information acquiring module, configured to acquire traffic overload packet loss information of a network device, resource information of a network device, and a resource security threshold of the network device. And a traffic limiting threshold of the network device; the information processing module is configured to analyze the information acquired by the information acquiring module, and dynamically adjust the traffic limiting threshold of the network device according to the analysis result.

Compared with the prior art, the technical solution provided by the embodiment of the present invention adopts an intelligent adjustment measure, which can dynamically increase the traffic limit threshold on the device when the system resources are not occupied, and intelligently improve the performance of the device, so that the device The performance of the processing business is optimal. As shown in the smart defense, you can dynamically adjust the threshold for sending traffic restrictions on the device when the system resources are overloaded, so as to protect the device. Through the use of the method and the device, on the one hand, the processing performance of the device can be intelligently improved, and on the other hand, the attack defense performance of the device can be intelligently improved. DRAWINGS

FIG. 1 is a flowchart of a method for implementing network device attack defense according to an embodiment of the present invention; FIG. 2 is a structural block diagram of an apparatus for implementing network device attack defense according to another embodiment of the present invention. 1 is a flow chart of a method for implementing network device attack defense according to an embodiment of the present invention. The method includes:

Obtain the maximum traffic value of the network device, the resource information of the network device, and the resource security threshold of the network device.

In order to protect the network, the device will send the maximum traffic value for a certain type of service. After the actual traffic of the service packet reaches the set maximum traffic value, the device will temporarily stop protecting itself. Packets of this type of service are received, and the packets of the service are discarded. The discarded packets are counted, that is, the number of lost packets of the network device is counted and counted.

The resource information of the network device can usually be obtained through the resource management module of the network device. Generally, the network device includes a resource management module, and the resource management module is responsible for collecting information such as resource usage of the network device.

The resource security threshold of the network device includes at least two types of data: (1) the upper limit threshold of the network device packet loss caused by the network device's traffic limitation; (2) the network device resource occupation data, which mainly refers to the threshold of memory usage and CPU resource occupation. . The resource security threshold can be set by the system default or by the user.

Comprehensively analyze the traffic overload packet loss information of the network device and the resource information of the network device, and perform different processing according to the analysis result.

The network device periodically collects at least the following two types of information: traffic overload packet loss information and network device resource information of the network device. Since the network device sends the maximum traffic value for a certain type of service setting, After the actual traffic of the service class reaches the set maximum traffic value, the network device will not receive the packets of this type of service for the time being, and will discard the packets of the service. This type of packet is counted, that is, the number of packet loss of the network device is counted and counted. The discarded packet count value is also the traffic overload packet loss information. When the count value is not 0, it indicates that the traffic value of the service packet has reached the set maximum traffic value, that is, the traffic limit threshold set by the network device for the service text.

The network device adjusts the network device traffic limit threshold according to the above two types of information. The adjustment method is as follows:

a) If the network device does not have a packet loss event due to the network device's own traffic restriction, that is, the packet loss count value is 0, and the resource occupancy in the network device does not reach the resource security threshold, the network device remains The original traffic limit threshold is unchanged;

b) If the network device has a packet loss event due to the network device's own traffic restriction, that is, the packet loss count value is not Q, and the resource occupancy in the network device does not reach the resource security threshold, then the network device Increase the flow limit threshold;

c) If the network device does not have a packet loss event due to the network device's own traffic restriction, but the network device's resource usage exceeds the resource security threshold, the network device adjusts the traffic limit threshold; d) if the network device already has a cause The packet loss event occurs when the network device itself restricts traffic, and the resource usage in the network device exceeds the resource security threshold. At this time, the network device adjusts the traffic limit threshold.

In the process of adjusting the flow limit threshold of the network device in a) ~ d) above, the step value and the maximum adjustment value of the adjustment may be set by the system default or set by the user. Those skilled in the art can know from the above embodiments that one or a combination of the above adjustment methods a) to d) can also be selected as needed to form a similar technical solution. It can be implemented on the access device or on other devices.

As shown in FIG. 2, another embodiment of the present invention provides an apparatus for preventing an attack, and the apparatus package The information acquisition module and the information processing module, wherein:

An information obtaining module, configured to acquire a traffic restriction threshold of the network device, resource information of the network device, and a resource security threshold of the network device, and dynamic device traffic overload packet loss information and device resource occupation information, and send the obtained information To the information processing module;

The information processing module is configured to analyze information collected by the information collection module, and dynamically adjust the traffic restriction threshold of the network device according to the analysis result.

The information processing module adjusts the network device traffic limit threshold according to the information provided by the information acquisition module. The adjustment method is as follows:

Ά ' ) If the network device does not have a packet loss event due to the network device's own traffic restriction, that is, the packet loss count value is 0, and the resource occupancy in the network device does not reach the resource security threshold, then the network is maintained. The original traffic limit threshold of the device is unchanged.

If the network device has a packet loss event due to the network device's own traffic limitation, that is, the packet loss count value is not Q, and the resource occupancy in the network device does not reach the resource security threshold, then the traffic is increased. Limit threshold

If the network device does not have a packet loss event due to the network device's own traffic limitation, but the network device's resource usage exceeds the security threshold, adjust the traffic limit threshold at this time;

cT) If there is a packet loss event in the network device due to the network device's own traffic restriction, and the resource usage in the network device exceeds the resource security threshold, the traffic limit threshold is adjusted.

In the process of adjusting the flow limit threshold by the information processing module, the adjusted step value and the maximum adjustment value may be set by the system default or set by the user. Those skilled in the art can know from the above embodiments that one or more combinations of the above adjustment methods a) to d) can be selected as needed to form a similar technical solution.

The device described in the foregoing embodiment is applicable to a firewall, a router, a switch, a broadband access device, or may be used on other devices.

In the foregoing specific implementation manner of the present invention, when the traffic restriction threshold is raised or lowered, a weight or priority may be added, so that CAR (Car, Committed Acces s) is increased. Ra te , which refers to the committed access rate, is an access control. According to the agreement with the user, the data packet exceeding the committed rate is processed differently: when discarding or marking; also known as marking color), the service packet flow with higher weight or higher priority may be first adjusted. CAR, the CAR value of the service packet flow with a lower weight or lower priority is adjusted. If the value of the CAR is decreased, the CAR value of the service packet with a lower weight or lower priority is preferentially lowered. Finally, the CAR value of the service packet flow with a higher weight or a higher priority is adjusted. The weights or priorities can be set as needed.

Of course, the traffic restriction threshold of a specific service flow or a certain service packet may be directly adjusted according to the situation, so as to preferentially ensure the passage of service packets with higher priority or higher weight.

The system resources include CPU, memory, and other parts that may affect the traffic of the service.

The above-mentioned embodiments of the present invention adopt intelligent adjustment measures to dynamically increase the traffic threshold of the device when the system resources are not occupied, and intelligently improve the performance of the device to optimize the performance of the device processing service. The intelligent precautions can be used to dynamically limit the threshold for sending traffic to the device when the system resources are overloaded. Through the use of the method and the device, on the one hand, the processing performance of the device can be intelligently improved, and on the other hand, the attack defense performance of the device can be intelligently improved.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any technical person skilled in the art can disclose the technical scope of the present invention and the technical idea of the present invention. Variations or substitutions that are conceivable within the scope of the invention are intended to be included within the scope of the invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Claim

A method for defending a network device attack, which is characterized by:

Obtaining traffic overload packet loss information of the network device, resource information of the network device, a resource security threshold of the network device, and a traffic restriction threshold of the network device;

And dynamically adjusting the traffic restriction threshold of the service packet flow according to the comparison result of the traffic overload packet loss information, the resource information, and the resource security threshold.

The method according to claim 1, wherein the traffic restriction on the service packet flow is performed according to the comparison result of the traffic overload packet loss information, the resource information, and the resource security threshold. Dynamic adjustments to thresholds include:

If the network device resource occupation data does not reach the resource security threshold, if the network device does not have a packet loss event due to the network device's own traffic restriction, the original traffic restriction threshold remains unchanged; or if the network device has a cause The packet loss event occurs when the network device itself restricts traffic, and the traffic limit threshold is increased.

When the network device resource occupation data exceeds the resource security threshold, the traffic restriction threshold is reduced.

The method according to claim 1, wherein the resource security threshold comprises: a network device packet loss data upper threshold caused by a network device traffic restriction; or

Network device resource usage data upper threshold.

The method of claim 2, 3 or 4, wherein the network device resource occupation data upper threshold comprises a memory occupation threshold or a CPU resource occupation threshold.

The method according to claim 1, wherein the dynamic limit adjustment of the traffic limit threshold of the service packet flow is:

Set weights or priorities for a specific service flow or some service packets;

When the traffic limit threshold is increased, the service with higher weight or higher priority is first adjusted. The traffic limit threshold of the packet flow. When the traffic limit threshold is set to be smaller, the traffic limit threshold of the service packet flow with lower weight or lower priority is first adjusted.

7. The method of claim 1, wherein the adjusting is performed for all service message flows.

8. A device for preventing attacks, characterized in that it comprises:

An information obtaining module, configured to acquire traffic overload packet loss information of the network device, resource information of the network device, a resource security threshold of the network device, and a traffic limit threshold of the network device;

The information processing module is configured to analyze the information acquired by the information acquiring module, and dynamically adjust the traffic limiting threshold of the network device according to the analysis result.

The device according to claim 8, wherein the information processing module dynamically adjusts the traffic restriction threshold of the network device according to the analysis result, including:

The apparatus according to claim 8, wherein the information processing module dynamically adjusts the traffic restriction threshold of the network device according to the analysis result, including:

The apparatus according to claim 8, wherein the resource security threshold comprises: a network device packet loss data upper threshold caused by a traffic restriction of the network device; or

Network device resource usage data upper threshold.

The device according to claim 9, 10 or 11, wherein the network device resource occupation data upper threshold comprises a memory occupation threshold or a CPU resource occupation threshold.

3. Apparatus according to claim 8, wherein said apparatus is adapted for use in a firewall, router, switch or broadband access device.