WO2016177156A1 - 流量的处理方法、装置及系统 - Google Patents

流量的处理方法、装置及系统 Download PDF

Info

Publication number
WO2016177156A1
WO2016177156A1 PCT/CN2016/076903 CN2016076903W WO2016177156A1 WO 2016177156 A1 WO2016177156 A1 WO 2016177156A1 CN 2016076903 W CN2016076903 W CN 2016076903W WO 2016177156 A1 WO2016177156 A1 WO 2016177156A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
traffic monitoring
management platform
threshold
alarm
Prior art date
Application number
PCT/CN2016/076903
Other languages
English (en)
French (fr)
Inventor
杨斌
刘志军
王国俊
贺镇海
陈宁
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016177156A1 publication Critical patent/WO2016177156A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, an apparatus, and a system for processing traffic.
  • the DDOS abnormal traffic attack mainly refers to the hacker using a large number of zombie hosts on the Internet that can be controlled to launch a massive attack on the target system.
  • the main attack methods are Transmission Control Protocol (TCP) flood attack, SYN (Synchronous) semi-connected attack, Domain Name System (DNS) amplification attack, and Hypertext Transfer protocol (HyperText Transfer). Protocol, referred to as HTTP) flood attack.
  • TCP Transmission Control Protocol
  • SYN Synchronous
  • DNS Domain Name System
  • HTTP Hypertext Transfer protocol
  • any protection technology can only reduce the impact of the attack on its own services and services through mitigation techniques, and to ensure the normal operation of the service to a certain extent. Run, but can not completely avoid the impact of DDOS attacks on the system.
  • a DDOS-protected service system if it detects that it is attacked by DDOS, it can trigger a routing policy, direct the request traffic to a professional traffic cleaning device, and complete the traffic request for specific traffic through statistics and analysis of the traffic cleaning device. Filtering and cleaning, when the attack is over, stop the routing policy and let the access request return to the business system normally.
  • the attack request is from a distributed attack
  • the system cannot completely avoid the impact of the access request on the system service.
  • the network may be congested unless the system bypasses all access requests to the traffic cleaning device.
  • traffic cleaning equipment is usually professional equipment, and the price is relatively high.
  • distributed traffic cleaning systems need to be considered.
  • the system is attacked, it needs to be The user's request message is bypassed to the traffic cleaning device, which affects the user's normal access request. Deploying such a system is not only costly, but also causes a decline in the overall performance of the system and affects the user experience.
  • the embodiment of the invention provides a method, a device and a system for processing a traffic, so as to solve at least the problem that the system cleaning device is used for processing when the system device is attacked by an abnormal traffic in the related technology.
  • a method for processing a traffic including: a traffic monitoring management platform, sends configuration information to a traffic monitoring client configured on a service host, where the configuration information is carried in a predetermined The alarm threshold indicating the traffic status in the time; the traffic monitoring management platform receives the alarm information reported by the traffic monitoring client and the current number of requested links of the service host, where the alarm information is used to indicate the reservation
  • the traffic monitoring client monitors that the traffic threshold of the service host exceeds the alarm threshold, and the traffic monitoring management platform triggers execution of traffic protection for the service host according to the number of requested links and the alarm information.
  • the alarm threshold includes: a normal operation alarm threshold and an abnormal alarm threshold.
  • the traffic monitoring management platform triggers execution of a traffic protection policy for the service host according to the number of the requested links and the alarm information, including: The traffic monitoring management platform performs an analysis and monitoring operation on the number of the requested links; the traffic monitoring management platform sends an alarm message carrying the analysis and monitoring results to the administrator of the service host.
  • the traffic monitoring management platform triggers execution of a traffic protection policy for the service host according to the number of the requested links and the alarm information, including: the traffic The monitoring management platform obtains the number of request links of other service hosts under the traffic monitoring management platform except the service host; and the traffic monitoring management platform determines whether the number of requested links of the service host exceeds that of other service hosts.
  • the equalization alarm threshold ratio when the determination result is yes, the traffic monitoring management platform sends an alarm message to the administrator of the service host and sends a first instruction to the traffic monitoring client, where the first instruction is used The operation of starting the software firewall, closing the service, and the port is triggered by triggering the traffic monitoring client.
  • the method further includes: when the determination result is no, the traffic monitoring management platform continues to obtain the request link of the traffic monitoring client; and the traffic monitoring management platform continues according to a preset filtering algorithm. Obtaining the address of the requested link for statistically filtering out the dangerous address information; determining, by the traffic monitoring management platform, that the dangerous address information matches the address information stored in the local blacklist, or the request link that continues to be acquired exceeds the single link request And the traffic monitoring management platform sends an alarm message to the administrator of the service host, and sends a second instruction to the traffic monitoring client, where the second instruction is used to indicate that the traffic monitoring client is triggered. Start the software firewall.
  • a method for processing a traffic including: a traffic monitoring client configured on a service host receives configuration information sent by a traffic monitoring management platform, where the configuration information carries An alarm threshold indicating a traffic status in a predetermined time; the traffic monitoring client compares a traffic threshold of the service host in the predetermined time with the alarm threshold; and the traffic monitoring client sends the management threshold to the management platform Reporting the alarm information and the current number of request links of the service host, where the alarm information is used to indicate that the traffic monitoring client monitors that the traffic threshold of the service host exceeds the alarm threshold in the predetermined time; The traffic monitoring client receives a traffic protection policy for the service host performed by the traffic monitoring management platform according to the number of the requested links and the alarm information.
  • the alarm threshold includes: a normal operation alarm threshold and an abnormal alarm threshold.
  • the traffic monitoring client receives the traffic monitoring management platform to perform traffic protection on the service host according to the number of requested links and the alarm information.
  • the policy includes: when the traffic monitoring management platform determines that the number of request links of the service host exceeds an imbalance alarm threshold ratio of other service hosts, the traffic monitoring client receives the first instruction sent by the traffic monitoring management platform, The first instruction is used to trigger the operation of the traffic monitoring client to start a software firewall, shut down a service, and a port.
  • the traffic monitoring client receives the traffic monitoring management platform to perform traffic protection on the service host according to the number of requested links and the alarm information.
  • the policy includes: when the traffic monitoring management platform determines that the number of request links of the service host does not exceed the imbalance alarm threshold ratio of other service hosts, the traffic monitoring client receives the second instruction sent by the traffic monitoring management platform The second instruction is used to indicate that the traffic monitoring client is triggered to start a software firewall.
  • a traffic processing apparatus which is applied to a traffic monitoring management platform, and includes: a sending module, configured to send configuration information to a traffic monitoring client set on a service host, where The configuration information carries an alarm threshold indicating a traffic status in a predetermined time; the first receiving module is configured to receive the alarm information reported by the traffic monitoring client and the current number of requested links of the service host, where The alarm information is used to indicate that the traffic monitoring client monitors that the traffic threshold of the service host exceeds the alarm threshold in the predetermined time; the execution module is configured to set the number of links and the alarm information according to the request Triggering a traffic protection policy for the service host.
  • the alarm threshold includes: a normal operation alarm threshold and an abnormal alarm threshold.
  • the execution module includes: an execution unit configured to perform an analysis and monitoring operation on the requested link number; and a sending unit configured to send and carry Analyze and monitor the alarm message of the monitoring result to the administrator of the service host.
  • the execution module includes: a first acquiring unit, configured to acquire other service hosts under the traffic monitoring management platform except the service host The number of request links; the determining unit is configured to determine whether the number of request links of the service host exceeds an imbalance alarm threshold ratio of other service hosts; and the first sending unit is configured to: when the determination result is yes, to the service host The administrator sends an alert message and sends a first command to the traffic monitoring client, where the first command is used to trigger the traffic monitoring client to perform an operation of starting a software firewall, shutting down a service, and a port.
  • the execution module further includes: a second obtaining unit, configured to continue to obtain a request link of the traffic monitoring client when the determination result is no; and the filtering unit is configured to perform a screening algorithm according to a preset setting Continuing to obtain the address of the request link for statistically filtering out the dangerous address information; the second sending unit is configured to determine, at the traffic monitoring management platform, that the dangerous address information matches the address information stored in the local blacklist, or the continuation When the obtained request link exceeds the single link request threshold, the alarm message is sent to the administrator of the service host, and the second instruction is sent to the traffic monitoring client, where the second instruction is used to indicate that the traffic is triggered.
  • the monitoring client starts the software firewall.
  • a traffic processing apparatus which is applied to a traffic monitoring client side that is disposed on a service host, and includes: a second receiving module configured to receive a configuration sent by the traffic monitoring management platform The information, wherein the configuration information carries an alarm threshold indicating a traffic status in a predetermined time, the alarm threshold includes: a normal operation alarm threshold and an abnormal alarm threshold; and a comparison module configured to set the predetermined time
  • the traffic threshold of the service host is compared with the alarm threshold; the reporting module is configured to report the alarm information and the current number of requested links of the service host to the management platform when the traffic threshold exceeds the alarm threshold.
  • the alarm information is used to indicate that the traffic monitoring client monitors that the traffic threshold of the service host exceeds the alarm threshold in the predetermined time; the third receiving module is configured to receive the traffic monitoring management platform. Traffic to the service host performed according to the number of requested links and the alarm information Protection policies.
  • the alarm threshold includes: a normal operation alarm threshold and an abnormal alarm threshold.
  • the third receiving module is further configured to determine, on the traffic monitoring management platform, that the number of request links of the service host exceeds that of other service hosts. And receiving, by the traffic monitoring management platform, the first instruction sent by the traffic monitoring management platform, where the first instruction is used to trigger the traffic monitoring client to perform an operation of starting a software firewall, shutting down a service, and a port.
  • the third receiving module is further configured to determine, on the traffic monitoring management platform, that the number of request links of the service host does not exceed that of other service hosts.
  • the second instruction sent by the traffic monitoring management platform is received when the alarm threshold is equalized, wherein the second instruction is used to trigger the traffic monitoring client to start the software firewall.
  • a traffic processing system includes a traffic monitoring management platform and a traffic monitoring client disposed on the service host; wherein the traffic monitoring management platform includes the foregoing application.
  • the processing device for the traffic on the traffic monitoring management platform side, the traffic monitoring client includes a processing device applied to the traffic of the traffic monitoring client side set on the service host.
  • a computer storage medium is further provided, and the computer storage medium may store an execution instruction for executing a processing method of the traffic in the foregoing embodiment.
  • the traffic monitoring management platform is used to send configuration information to the traffic monitoring client that is set on the service host, and the configuration information carries an alarm threshold indicating the traffic state in a predetermined time, in the traffic monitoring client.
  • the traffic monitoring management platform receives the alarm information indicating that the traffic monitoring threshold of the traffic monitoring client exceeds the alarm threshold and the number of requesting links reported by the traffic monitoring client, and traffic monitoring.
  • the management platform performs the traffic protection policy for the service host according to the alarm information and the number of the request link.
  • the traffic monitoring management platform performs the traffic protection policy for the service host when the current traffic is abnormal, and the user requests the message.
  • FIG. 1 is a flow chart 1 of a method for processing traffic according to an embodiment of the present invention.
  • FIG. 2 is a second flowchart of a method for processing traffic according to an embodiment of the present invention.
  • FIG. 3 is a structural block diagram 1 of a processing device for traffic according to an embodiment of the present invention.
  • FIG. 4 is a block diagram 2 of a structure of a traffic processing apparatus according to an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of a processing system for traffic according to an embodiment of the present invention.
  • FIG. 6 is a structural block diagram of a system for monitoring and mitigating abnormal traffic according to an alternative embodiment of the present invention.
  • FIG. 7 is a flowchart of a system for delivering configuration parameters and a heartbeat keep-alive of a system and a terminal according to an alternative embodiment of the present invention.
  • FIG. 8 is a flowchart of a process after the traffic monitoring client monitors that the traffic of the current device exceeds the normal operational alarm threshold delivered by the traffic monitoring management platform according to an alternative embodiment of the present invention
  • FIG. 9 is a flowchart of a booting policy for requesting traffic exceeding a critical alarm traffic for a single device without exceeding a load balancing threshold according to an alternative embodiment of the present invention.
  • FIG. 10 is a flow chart of a policy for initiating a masking of a single device that requests traffic exceeding an abnormal alarm traffic does not exceed a load balancing threshold according to an alternative embodiment of the present invention.
  • FIG. 1 is a flowchart 1 of a method for processing traffic according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps:
  • Step S102 The traffic monitoring management platform sends configuration information to the traffic monitoring client that is set on the service host, where the configuration information carries an alarm threshold indicating the traffic state within a predetermined time.
  • step S104 the traffic monitoring management platform receives the alarm information reported by the traffic monitoring client and the current number of request links of the service host, where the alarm information is used to indicate that the traffic monitoring threshold monitored by the traffic monitoring client exceeds the alarm threshold within a predetermined time. ;
  • Step S106 The traffic monitoring management platform triggers execution of a traffic protection policy for the service host according to the number of requested links and the alarm information.
  • the traffic monitoring management platform is used to send configuration information to the traffic monitoring client set on the service host, and the configuration information carries an alarm threshold indicating the traffic state within a predetermined time, and the traffic monitoring client is in the traffic monitoring client.
  • the traffic monitoring management platform receives the alarm information indicating that the traffic monitoring threshold that the traffic monitoring client monitors the service host exceeds the alarm threshold, and the number of request links reported by the traffic monitoring client.
  • the monitoring and management platform performs the traffic protection policy for the service host according to the alarm information and the number of the requested link lines. In this embodiment, the traffic monitoring management platform performs the traffic protection policy for the service host when the current traffic is abnormal.
  • the problem of the message is solved, and the problem that the system cleaning device needs to be processed by the traffic cleaning device when the system device is attacked by the abnormal traffic in the related art is solved, and the traffic cleaning device is relatively high in cost and the overall cost of the system is also large, and the implementation is adopted.
  • Example of the program can reach the festival The effect of cost.
  • the alarm thresholds involved in this embodiment may be: a normal operation alarm threshold and an abnormal alarm threshold.
  • the following description is made in combination with the alarm threshold; when the traffic threshold exceeds the normal operation alarm threshold and the abnormal alarm threshold is not exceeded, that is, the normal operation alarm threshold is smaller than the abnormal alarm threshold, which is involved in step 106 of this embodiment.
  • the traffic monitoring management platform triggers the traffic protection policy for the service host according to the number of request links and the alarm information, which can be implemented as follows:
  • Step S11 the traffic monitoring management platform performs an analysis and monitoring operation on the number of requested links
  • Step S12 The traffic monitoring management platform sends an alarm message carrying the analysis and monitoring result to the administrator of the service host.
  • the traffic monitoring management platform performs the analysis and monitoring operation on the number of requested links, and sends the alarm to the service host in the form of an alarm message, when the traffic threshold exceeds the normal operation alarm threshold and the abnormal alarm threshold is not exceeded.
  • the administrator notifies the current status of the traffic of the business host.
  • the traffic monitoring management platform involved in the step S106 of the embodiment triggers the traffic protection policy for the service host according to the number of the requested links and the alarm information, which can be implemented as follows:
  • Step S21 The traffic monitoring management platform obtains the number of request links of other service hosts under the traffic monitoring management platform other than the service host;
  • Step S22 The traffic monitoring management platform determines whether the number of request links of the service host exceeds the imbalance alarm threshold ratio of other service hosts;
  • Step S23 When the determination result is yes, the traffic monitoring management platform sends an alarm message to the administrator of the service host and sends a first instruction to the traffic monitoring client, where the first instruction is used to trigger the traffic monitoring client to execute the startup software firewall. , shut down the operation of the service and port.
  • Step S24 When the determination result is no, the traffic monitoring management platform continues to obtain the request link of the traffic monitoring client;
  • Step S25 The traffic monitoring management platform performs statistical filtering of the dangerous address information on the address of the request link that is continuously acquired according to the preset setting filtering algorithm;
  • Step S26 The traffic monitoring management platform sends an alarm message to the administrator of the service host when the traffic monitoring management platform determines that the dangerous address information matches the address information stored in the local blacklist, or the request link that continues to be acquired exceeds the single link request threshold. And sending a second instruction to the traffic monitoring client, where the second instruction is used to trigger the traffic monitoring client to start the software firewall.
  • the traffic protection policy is executed in two scenarios, and the number of requested links of the service host exceeds the imbalance alarm threshold of other service hosts.
  • the service host receives a serious abnormal traffic attack. Therefore, the traffic monitoring management platform sends a stop service command to the traffic monitoring client, that is, shuts down all external service ports, and starts a software firewall to block the access request; If the number of requesting links of the host does not exceed the ratio of the unbalanced alarm thresholds of other service hosts, the service host can also use the defense policy to prevent abnormal traffic attacks. Therefore, the traffic monitoring management platform delivers the enabling software to the service host. Firewall directives to increase ACL access control policies.
  • the access request received by the service host is sent to each service device through the load balancing device (hardware F5 or dynamic load balancing of the service management platform), no matter what method is adopted, the purpose is to Ensure that the load on each business host is balanced. If the access traffic of a service host far exceeds that of other service hosts, you need to consider whether the device is attacked because the traffic of each service host is balanced under normal conditions.
  • FIG. 2 is a second flowchart of a method for processing traffic according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:
  • Step S202 the traffic monitoring client configured on the service host receives the configuration information sent by the traffic monitoring management platform, where the configuration information carries an alarm threshold indicating the traffic state within a predetermined time;
  • Step S204 The traffic monitoring client compares the traffic threshold of the service host with the alarm threshold in a predetermined time
  • step S206 the traffic monitoring client reports the alarm information and the current number of request links of the service host to the management platform, where the alarm information is used to indicate that the traffic monitoring threshold monitored by the traffic monitoring client to the service host exceeds the alarm threshold within a predetermined time.
  • Step S208 The traffic monitoring client receives a traffic protection policy for the service host performed by the traffic monitoring management platform according to the number of requested links and the alarm information.
  • the traffic monitoring client configured on the service host compares the traffic threshold value of the service host to the traffic controller and the alarm threshold value carried in the configuration information sent by the traffic monitoring management platform.
  • the traffic monitoring client reports the alarm information and the current number of request links of the service host to the management platform, and the traffic monitoring client receives the traffic performed by the traffic monitoring management platform according to the number of requested links and the alarm information.
  • the traffic protection policy of the host to reduce the attack of abnormal traffic on the service host.
  • the alarm thresholds involved in this embodiment may be: a normal operation alarm threshold and an abnormal alarm threshold.
  • the manner in which the traffic monitoring client receives the traffic protection policy for the service host according to the number of the requested links and the alarm information in the step S208 of the embodiment can be implemented as follows:
  • the traffic monitoring management platform determines that the number of request links of the service host exceeds the imbalance alarm threshold ratio of other service hosts
  • the traffic monitoring client receives the first instruction sent by the traffic monitoring management platform, where the first instruction is used to trigger the traffic monitoring client.
  • the terminal performs the operation of starting the software firewall, shutting down the service and the port.
  • the traffic monitoring client receiving the traffic monitoring management platform in step S208 according to the number of the requested links and the alarm information to implement the traffic protection policy for the service host can be implemented as follows:
  • the traffic monitoring management platform determines that the number of request links of the service host does not exceed the imbalance alarm threshold ratio of the other service hosts, the traffic monitoring client receives the second command sent by the traffic monitoring management platform, where the second instruction is used to indicate the triggered traffic.
  • the monitoring client starts the software firewall.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a flow processing device is also provided in the embodiment, and the device is used to implement the above-mentioned embodiments and preferred embodiments, and the detailed description thereof has been omitted.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 3 is a block diagram of a structure of a traffic processing device according to an embodiment of the present invention.
  • the device is applied to a traffic monitoring management platform.
  • the device includes: a sending module 32, configured to be disposed on a service host.
  • the traffic monitoring client sends the configuration information, where the configuration information carries an alarm threshold indicating the traffic status in a predetermined time.
  • the first receiving module 34 is coupled to the sending module 32 and configured to receive the alarm information reported by the traffic monitoring client.
  • the executing module 36 is coupled with the first receiving module 34, and is configured to be The traffic protection policy for the service host is triggered according to the number of requested links and the alarm information.
  • the alarm thresholds involved in this embodiment may be: a normal operation alarm threshold and an abnormal alarm threshold.
  • the execution module 36 includes: an execution unit configured to perform an analysis and monitoring operation on the number of requested links; and a sending unit coupled to the execution unit and configured to send and carry Analyze and monitor the alarm message to the administrator of the service host.
  • the executing module 36 includes: a first acquiring unit, configured to acquire a number of request links of other service hosts under the traffic monitoring management platform except the service host; and a determining unit, And the first An acquiring unit coupling connection is configured to determine whether the number of request links of the service host exceeds an imbalance alarm threshold ratio of other service hosts; the first sending unit is coupled with the determining unit, and is configured to send to the service host when the determination result is yes
  • the administrator sends an alert message and sends a first command to the traffic monitoring client, where the first command is used to trigger the traffic monitoring client to perform the operation of starting the software firewall, shutting down the service, and the port.
  • the second obtaining unit is coupled to the determining unit, and is configured to continue to obtain the request link of the traffic monitoring client when the determining result is no;
  • the filtering unit is configured to perform the address of the request link that continues to be acquired according to the preset setting filtering algorithm.
  • the second sending unit is coupled to the second obtaining unit, and is configured to determine that the dangerous address information is matched with the address information stored in the local blacklist in the traffic monitoring management platform, or the request link that continues to be acquired exceeds
  • the administrator sends an alarm message to the administrator of the service host, and sends a second instruction to the traffic monitoring client, where the second instruction is used to trigger the traffic monitoring client to start the software firewall.
  • FIG. 4 is a block diagram 2 of a structure of a traffic processing device according to an embodiment of the present invention.
  • the device is applied to a traffic monitoring client side disposed on a service host.
  • the device includes: a second receiving module 42.
  • the configuration information sent by the traffic monitoring and management platform is received, wherein the configuration information carries an alarm threshold indicating a traffic status within a predetermined time, and the comparison module 44 is coupled to the second receiving module 42 and configured to be a service host within a predetermined time.
  • the traffic threshold is compared with the alarm threshold; the reporting module 46 is coupled to the comparison module 44, and is configured to report the alarm information and the current number of request links of the service host to the management platform when the traffic threshold exceeds the alarm threshold, wherein the alarm information
  • the third receiving module 48 is coupled to the reporting module 46 and configured to receive the traffic monitoring management platform according to the number of requested links and the alarm information, and is used to indicate that the traffic monitoring threshold monitored by the traffic monitoring client exceeds the alarm threshold. Traffic protection policy for business hosts.
  • the alarm threshold includes: a normal operation alarm threshold and an abnormal alarm threshold.
  • the third receiving module is further configured to receive the traffic monitoring and management platform when the traffic monitoring management platform determines that the number of request links of the service host exceeds the imbalance alarm threshold ratio of other service hosts.
  • the third receiving module is further configured to receive the traffic monitoring management when the traffic monitoring management platform determines that the number of request links of the service host does not exceed the imbalance alarm threshold ratio of other service hosts.
  • FIG. 5 is a structural block diagram of a traffic processing system according to an embodiment of the present invention. As shown in FIG. 5, the system includes the traffic monitoring management platform involved in the foregoing embodiment and a traffic monitoring client disposed on the service host.
  • FIG. 6 is a structural block diagram of a system for monitoring and mitigating abnormal traffic according to an alternative embodiment of the present invention. As shown in FIG. The system includes at least a traffic monitoring service management platform, a traffic monitoring client, and a message interface module, where:
  • the traffic monitoring service management platform is mainly used to define the normal operation alarm thresholds for traffic monitoring within a certain period of time.
  • the normal alarm threshold and the imbalance alarm threshold ratio are sent to the traffic client through the message interface module to the normal operational flow alarm threshold, the abnormal traffic alarm threshold, and the alarm interval.
  • the monitoring of the traffic monitoring client is performed on a regular basis, and the current link summary reported by the traffic monitoring client deployed on the service host is collected and processed, and the alarm information reported by the traffic monitoring client is received, including but not limited to the source of the request.
  • the address, the destination address, the source port, the destination port, and the protocol type are used to determine the basic situation of the current traffic, and the information is statistically analyzed and analyzed according to a certain algorithm, and compared with the history and blacklist retained by the system. To confirm whether to notify the traffic monitoring client to enable the software firewall (IPTable) and set the firewall protection policy.
  • IPTable software firewall
  • the traffic monitoring client is installed on the service host of the distributed system to monitor and obtain the traffic information requested from the local device, and record the source address, destination address, source port, destination port, and protocol type requested from the local device. And reporting to the traffic monitoring service management platform through the message interface module, and updating the alarm threshold and the alarm interval period sent by the traffic monitoring service management platform.
  • the traffic monitoring client periodically reports the current traffic summary information to the traffic monitoring management platform.
  • the request traffic sent by the traffic monitoring management platform exceeds the normal operational alarm threshold for a period of time
  • the traffic monitoring client manages the traffic monitoring service.
  • the alarm information and the request link are reported on the platform.
  • the traffic monitoring client reports the abnormal alarm and the current request to the traffic monitoring service management platform, and waits for the traffic monitoring service management platform to prevent and control. Directives and execute firewall policy commands issued by the management platform.
  • the message interface module including the traffic monitoring service management platform, reports the parameters of the traffic monitoring client, the firewall control command issuing interface, and the access link information of the traffic monitoring client to the traffic monitoring service management platform.
  • the steps of the method include:
  • Step S302 The system administrator maintains the normal operation alarm threshold and the abnormal traffic alarm threshold on the traffic monitoring service management platform, and sends the traffic monitoring client to the traffic monitoring client, which is not updated periodically, and starts the survival monitoring and traffic monitoring of the traffic monitoring client.
  • the client accepts and saves the normal operation alarm threshold and the abnormal traffic alarm threshold issued by the traffic monitoring management platform, and reports the current client survival status according to the request of the traffic monitoring management platform;
  • Step S304 The traffic monitoring client monitors the currently requested access traffic, and periodically reports the traffic summary statistics to the management platform.
  • the traffic information is immediately reported to the traffic monitoring service management platform, and the current request link is reported, and the traffic monitoring management platform receives the traffic.
  • the traffic monitoring management platform After monitoring the alarm information reported by the client, initiate analysis and monitoring of the request link of the device, and send an alarm message to the device administrator.
  • Step S306 The traffic monitoring client continues to monitor the currently requested access traffic.
  • the traffic monitoring client When the current request traffic exceeds the abnormal traffic alarm threshold sent by the traffic monitoring management platform within a certain period of time, the traffic monitoring client immediately starts reporting to the traffic monitoring service management platform.
  • the traffic monitoring management platform receives the alarm information reported by the traffic monitoring client, first starts the load balancing situation analysis, analyzes the request status of other devices, and finds that the number of requested links of the current device exceeds other The device's unbalanced alarm threshold ratio immediately sends a stop service command to the device, closes all external service ports, starts a software firewall to block access requests, and sends a service exception alert message to the device administrator.
  • the traffic monitoring client After the traffic monitoring client receives the anti-control command, it immediately starts the shutdown service, port operation, and starts.
  • the IP Table shields outside access.
  • Step S308 If the number of requested links of the current device does not exceed the imbalance alarm threshold of the other device, the traffic monitoring management platform immediately starts analysis and statistics of abnormal traffic, obtains the request link information after the abnormal traffic access alarm, and analyzes the request link.
  • the source address and the destination port are counted according to the system's pre-defined filtering algorithm.
  • the source address and the destination port are matched according to the system-defined blacklist. If the source address is found in the blacklist or the source address.
  • the access request exceeds the system-defined single-link request threshold, the software firewall command is immediately sent to the device, and the ACL access control policy is added to block all access requests of the source address; the traffic monitoring client immediately receives the command. Start the software table (IP Table) and block all access to the link to mitigate the impact of the abnormal attack on the system, and continue to monitor the system's request link until the system access traffic returns to normal.
  • IP Table software table
  • step S302 it can be implemented as follows
  • Step S31 The system administrator maintains basic information on the system, including a normal operation alarm threshold and an abnormal traffic alarm threshold, and an interval period of each alarm threshold, and defines an imbalance alarm threshold ratio;
  • Step S32 The traffic monitoring management platform sends a heartbeat message to the traffic monitoring client for survival monitoring, and the traffic monitoring client periodically reports the current state according to the platform request.
  • Step S33 If the traffic monitoring management platform finds that the heartbeat of the traffic monitoring client is abnormal, immediately sends an alert SMS alert to the device administrator.
  • step S304 it can be implemented as follows:
  • Step S41 The traffic monitoring client monitors the current request traffic, and periodically reports the current traffic situation summary information (excluding the request detailed information) to the traffic monitoring management platform;
  • Step S42 When the traffic monitoring client finds that the current request traffic exceeds the normal operation alarm threshold defined by the traffic monitoring service management platform within a certain period of time, immediately starts to report the alarm information to the traffic monitoring service management platform and reports the current request link. Including the source address, destination address, source port, destination port, and protocol type of the request;
  • Step S43 After receiving the alarm information reported by the traffic monitoring client, the traffic monitoring management platform starts sending an alarm message to the device administrator.
  • step S306 it can be implemented as follows:
  • Step S51 The traffic monitoring client monitors the currently requested access traffic, and when the current request traffic exceeds the abnormal traffic alarm threshold sent by the traffic monitoring management platform, the traffic monitoring service management platform is reported to report the abnormality.
  • the alarm information and the current request link information including the source address, destination address, and port access type of the current access link;
  • Step S52 After receiving the alarm information reported by the traffic monitoring client, the traffic monitoring management platform first starts the load balancing situation analysis, analyzes the request situation of other devices, and finds that the number of requested links of the current device exceeds the imbalance alarm valve with other devices. The value ratio immediately sends a stop service command to the device, closes all external service ports, starts a software firewall to block access requests, and sends a service exception alert message to the device administrator.
  • Step S53 The traffic monitoring client immediately starts the shutdown service and the port operation after receiving the anti-control command, and starts the software table (IP Table) to block external access.
  • IP Table software table
  • step S308 it can be implemented as follows:
  • Step S61 The traffic monitoring management platform determines that if the number of requested links of the current device does not exceed the imbalance alarm threshold of the other device, the analysis and statistics of the abnormal traffic are started, and the request link information after the abnormal traffic access alarm is obtained, and the analysis request is analyzed.
  • Step S62 The traffic monitoring management platform performs statistics on the source address and the destination port according to the pre-defined filtering algorithm of the system, and matches the source address according to the blacklist defined by the system. If the source address is found in the blacklist or the source address If the access request exceeds the system-defined single-link request threshold, the software firewall command is immediately sent to the device, and the ACL access control policy is added to block all access requests of the source address.
  • Step S63 After receiving the instruction, the traffic monitoring client starts the software table (IP Table) to block all accesses of the link to alleviate the impact of the abnormal attack on the system, and continues to monitor the system request link until the system accesses. The traffic is back to normal.
  • IP Table software table
  • a system and method for abnormal traffic monitoring and mitigation is implemented, which can defend against external attacks by dynamically enabling the software firewall provided by the system itself when the system traffic is abnormal or the system is attacked by an external DDOS. Effectively reduce the impact of external attacks on the system. And the system realizes the protection against external attacks through the software system, and can be applied to large CDN, video and other websites, reducing the hardware input cost and enhancing the protection ability of the system.
  • FIG. 7 is a flowchart of a system for delivering configuration parameters and a heartbeat keep-alive of a system and a terminal according to an alternative embodiment of the present invention. As shown in FIG. 7, the process includes:
  • Step S701 the operator defines an alarm threshold value, a time and an unbalanced alarm threshold value in the flow monitoring management platform;
  • Step S702 the traffic monitoring management platform saves the parameter configuration
  • Step S703 The traffic monitoring management platform delivers configuration parameters to the traffic monitoring client through the interface device.
  • Step S704 the traffic monitoring client saves configuration parameter information.
  • Step S705 The traffic monitoring management platform sends a heartbeat keep-alive request to the traffic monitoring client.
  • Step S706 The traffic monitoring client returns a heartbeat keep-alive response to the traffic monitoring management platform.
  • FIG. 8 is a flowchart of a process after the traffic monitoring client monitors that the traffic of the current device exceeds the normal operational alarm threshold sent by the traffic monitoring management platform according to an alternative embodiment of the present invention, as shown in FIG. The steps include:
  • Step S801 The traffic monitoring client periodically reports the current traffic summary information to the traffic monitoring management platform.
  • Step S802 the traffic monitoring management platform saves the traffic information.
  • Step S803 the traffic monitoring client compares the current traffic with the normal operating threshold
  • Step S804 when the normal operation threshold is exceeded, the traffic monitoring management platform is alerted;
  • Step S805 the traffic monitoring management platform saves the alarm information, and starts the monitoring process to monitor;
  • step S806 the traffic monitoring management platform sends an alert message to the system administrator.
  • the traffic monitoring management platform first determines whether the traffic abnormality of the device is abnormally high, to determine whether the external access traffic is for the device.
  • the traffic monitoring management platform sends out the service to the traffic monitoring client to stop the service, start the software firewall, and other related measures to prevent the system from being further attacked.
  • the request traffic exceeds the abnormal alarm traffic.
  • the access traffic of the single device does not exceed the load balancing threshold startup shielding policy flowchart. As shown in FIG. 9, the steps of the process include:
  • Step S901 the traffic monitoring client periodically monitors the current request traffic access situation
  • Step S902 When the traffic of the current device exceeds the abnormal alarm traffic threshold, immediately notify the traffic monitoring management platform of the traffic;
  • Step S903 the traffic monitoring management platform compares the traffic load of the current device with other devices
  • Step S904 when it is found that the traffic of the device exceeds the load balancing threshold, it is ready to issue a shielding policy to the device;
  • Step S905 The traffic monitoring management platform sends an access screening policy to the traffic monitoring client, notifying the service client to close the port and the service, and starting the software firewall;
  • step S906 the traffic monitoring management platform sends an alert message to the system administrator.
  • the traffic monitoring management platform excludes the prevention and control process after the current device traffic does not exceed the abnormal traffic alarm threshold.
  • the traffic monitoring management platform collects the request address according to the screening algorithm defined by the system in advance, filters out the dangerous address information, and then continues to filter out the address exceeding the single link request threshold, and compares with the blacklist address retained in the system, and filters
  • the address information to be masked is sent, and the traffic monitoring client is sent a startup software firewall to increase the ACL policy to block the instructions of the addresses.
  • FIG. 10 is an access flow of the single device requesting the traffic exceeding the abnormal alarm traffic according to an optional embodiment of the present invention. Did not exceed the load balancing threshold to start
  • the shielding policy flow chart is shown in Figure 10. The steps of the process include:
  • Step S1001 The traffic monitoring management platform collects statistics on the current access link, and obtains the source and destination ports of the request link;
  • Step S1002 The traffic monitoring management platform performs statistics on the request address according to a pre-defined screening algorithm, and filters out dangerous address information;
  • Step S1003 The traffic monitoring management platform analyzes the dangerous address according to the blacklist reserved by the system
  • Step S1004 The traffic monitoring management platform filters out an address that exceeds a single link request threshold or an address that is blacklisted;
  • Step S1005 The traffic monitoring management platform sends an access screening policy to the traffic monitoring client, informing the client to start the software firewall, and adding an ACL policy to block the abnormal request source address;
  • Step S1006 The traffic monitoring client starts the software firewall according to the prevention and control policy of the management platform, and adds an ACL policy.
  • step S1007 the traffic monitoring management platform sends a severe alarm message to the system administrator.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • step S1 the traffic monitoring management platform sends configuration information to the traffic monitoring client that is set on the service host, where the configuration information carries an alarm threshold indicating the traffic state within a predetermined time;
  • step S2 the traffic monitoring management platform receives the alarm information reported by the traffic monitoring client and the current number of request links of the service host, where the alarm information is used to indicate that the traffic monitoring threshold monitored by the traffic monitoring client exceeds the alarm threshold within a predetermined time. ;
  • step S3 the traffic monitoring management platform triggers the execution of the traffic protection policy for the service host according to the number of the requested links and the alarm information.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the traffic monitoring management platform monitors the current traffic abnormality
  • the traffic protection policy for the service host is executed, and the user request message has no impact, and the system device is affected by the abnormal traffic in the related technology.
  • the attack is performed, the flow cleaning device is used for processing, and the flow cleaning device is relatively high in cost, and the overall system cost is also large, and the solution of the present invention can achieve cost saving effect.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明提供了一种流量的处理方法、装置及系统，其中该方法包括：流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，其中，配置信息中携带有在预定时间内指示流量状态的告警阈值；流量监控管理平台接收流量监控客户端上报的告警信息和业务主机当前的请求链接数，其中，告警信息用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值；流量监控管理平台依据请求链接数和告警信息触发执行对业务主机的流量防护策略。通过本发明，解决了相关技术中系统设备受到异常流量攻击时，采用流量清洗设备进行处理的问题，达到了节约成本的效果。

Description

流量的处理方法、装置及系统 技术领域
本发明涉及通信领域，具体而言，涉及一种流量的处理方法、装置及系统。
背景技术
目前，针对互联网业务的异常攻击层出不穷。而互联网业务的网站作为一个开放性的公众服务网络，一般都是基于分布式或者集群式在公网部署，面临着众多的安全威胁。异常流量作为一种重要的威胁严重影响着互联网业务的安全平稳运营，其中，主要是针对分布式拒绝服务(Distributed Denial of Service，简称为DDoS)攻击。攻击流量大量挤占通信网络资源，极易造成网络不稳定和链路堵塞；同时商业利益的驱使，使得针对特定商业目标的异常流量攻击有愈演愈烈之势，对网络安全构成了严峻的挑战。有效遏制异常流量，缓解网络运营压力，成为运营商以及互联网业务提供商面对的一项十分紧迫的任务。
DDOS的异常流量的攻击主要是指黑客利用能够被控制的互联网上大量的僵尸主机，对目标系统发起海量的攻击。目前主要的几种攻击手段是传输控制协议(Transmission Control Protocol简称为TCP)洪水攻击、SYN(synchronous)半连接攻击、域名系统(Domain Name System简称为DNS)放大攻击以及超文本传输协议(HyperText Transfer Protocol，简称为HTTP)洪水攻击。
在现有的针对DDOS攻击的防护技术中，如果在DDOS攻击已经发生的情况下，任何防护技术都只能通过缓解技术来减少攻击对自身业务和服务的影响，在一定程度上保障业务的正常运行，但是都无法完全避免DDOS攻击对系统的影响。例如，部署了DDOS防护的业务服务系统，如果检测到自身被DDOS攻击了，可以引发路由策略，把请求流量引向专业的流量清洗设备，通过流量清洗设备的统计与分析，完成对特定请求流量的过滤与清洗，等攻击结束了，再停止路由策略，让访问请求正常返回业务系统。但是如果攻击请求是来自分布式的攻击，系统就无法完全避免这种访问请求对系统业务的影响，情况严重时甚至造成网络拥塞，除非系统把所有的访问请求都旁路到流量清洗设备。但是流量清洗设备通常都是专业设备，而且价格比较高，且对于超大型的互联网应用(如视频业务、互联网加速业务)，还需要考虑分布式流量清洗系统，在系统受到攻击的时候，需要把用户的请求消息旁路到流量清洗设备，从而会对用户正常的访问请求造成影响。部署这样一套系统不但造价高，而且会造成系统整体性能的下降，影响用户的体验。
针对相关技术中系统设备受到异常流量攻击时，采用流量清洗设备进行处理的问题，目前尚未有有效的解决方案。
发明内容
本发明实施例提供了一种流量的处理方法、装置及系统，以至少解决相相关技术中系统设备受到异常流量攻击时，采用流量清洗设备进行处理的问题。
根据本发明实施例的一个方面，提供了一种流量的处理方法，包括：流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值；所述流量监控管理平台接收所述流量监控客户端上报的告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；所述流量监控管理平台依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略。
可选地，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
可选地，在所述流量阈值超过所述正常运营告警阈值时，所述流量监控管理平台依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略包括：所述流量监控管理平台执行对所述请求链接数进行分析与监控操作；所述流量监控管理平台发送携带有分析与监控结果的告警短信到所述业务主机的管理员。
可选地，在所述流量阈值超过所述异常告警阈值时，所述流量监控管理平台依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略包括：所述流量监控管理平台获取除所述业务主机之外的所述流量监控管理平台下的其他业务主机的请求链接数；所述流量监控管理平台判断所述业务主机的请求链接数是否超过其他业务主机的不均衡告警阈值比例；在判断结果为是时，所述流量监控管理平台向所述业务主机的管理员发送告警短信以及向所述流量监控客户端发送第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
可选地，所述方法还包括：在判断结果为否时，所述流量监控管理平台继续获取所述流量监控客户端的请求链接；所述流量监控管理平台根据预设设定的筛选算法对继续获取的请求链接的地址进行统计筛选出危险地址信息；在所述流量监控管理平台判定所述危险地址信息与本地黑名单中存储的地址信息匹配，或所述继续获取的请求链接超出单链接请求阈值时，所述流量监控管理平台向所述业务主机的管理员发送告警短信，并向所述流量监控客户端发送第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
根据本发明实施例的另一个方面，提供了一种流量的处理方法，包括：设置在业务主机上的流量监控客户端接收流量监控管理平台发送的配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值；所述流量监控客户端将所述预定时间内所述业务主机的流量阈值与所述告警阈值进行比较；所述流量监控客户端向所述管理平台上报告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；所述流量监控客户端接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行的对所述业务主机的流量防护策略。
可选地，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
可选地，在所述流量阈值超过所述异常告警阈值时，所述流量监控客户端接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行对所述业务主机的流量防护策略包括：在所述流量监控管理平台确定所述业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，所述流量监控客户端接收所述流量监控管理平台发送的第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
可选地，在所述流量阈值超过所述异常告警阈值时，所述流量监控客户端接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行对所述业务主机的流量防护策略包括：在所述流量监控管理平台确定所述业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，所述流量监控客户端接收所述流量监控管理平台发送的第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
根据本发明实施例的再一个方面，提供了一种流量的处理装置，应用于流量监控管理平台侧，包括：发送模块，设置为向设置在业务主机上的流量监控客户端发送配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值；第一接收模块，设置为接收所述流量监控客户端上报的告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；执行模块，设置为依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略。
可选地，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
可选地，在所述流量阈值超过所述正常运营告警阈值时，所述执行模块包括：执行单元，设置为执行对所述请求链接数进行分析与监控操作；发送单元，设置为发送携带有分析与监控结果的告警短信到所述业务主机的管理员。
可选地，在所述流量阈值超过所述异常告警阈值时，所述执行模块包括：第一获取单元，设置为获取除所述业务主机之外的所述流量监控管理平台下的其他业务主机的请求链接数；判断单元，设置为判断所述业务主机的请求链接数是否超过其他业务主机的不均衡告警阈值比例；第一发送单元，设置为在判断结果为是时，向所述业务主机的管理员发送告警短信以及向所述流量监控客户端发送第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
可选地，所述执行模块还包括：第二获取单元，设置为在判断结果为否时，继续获取所述流量监控客户端的请求链接；筛选单元，设置为根据预设设定的筛选算法对继续获取的请求链接的地址进行统计筛选出危险地址信息；第二发送单元，设置为在所述流量监控管理平台判定所述危险地址信息与本地黑名单中存储的地址信息匹配，或所述继续获取的请求链接超出单链接请求阈值时，向所述业务主机的管理员发送告警短信，并向所述流量监控客户端发送第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
根据本发明实施例的再一个方面，提供了一种流量的处理装置，应用于设置在业务主机上的流量监控客户端侧，包括：第二接收模块，设置为接收流量监控管理平台发送的配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值，所述告警阈值包括：正常运营告警阈值、异常告警阈值；比较模块，设置为将所述预定时间内所述业务主机的流量阈值与所述告警阈值进行比较；上报模块，设置为在所述流量阈值超过所述告警阈值时，向所述管理平台上报告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；第三接收模块，设置为接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行的对所述业务主机的流量防护策略。
可选地，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
可选地，在所述流量阈值超过所述异常告警阈值时，所述第三接收模块，还设置为在所述流量监控管理平台确定所述业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，接收所述流量监控管理平台发送的第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
可选地，在所述流量阈值超过所述异常告警阈值时，所述第三接收模块，还设置为在所述流量监控管理平台确定所述业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，接收所述流量监控管理平台发送的第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
根据本发明实施例的又一个方面，提供了一种流量的处理系统，所述系统包括流量监控管理平台和设置在业务主机上的流量监控客户端；其中，所述流量监控管理平台包括上述应用于流量监控管理平台侧的流量的处理装置，所述流量监控客户端包括应用于设置在业务主机上的流量监控客户端侧的流量的处理装置。
在本发明实施例中，还提供了一种计算机存储介质，该计算机存储介质可以存储有执行指令，该执行指令用于执行上述实施例中的流量的处理方法。
在本发明实施例中，采用流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，而该配置信息中携带有在预定时间内指示流量状态的告警阈值，在流量监控客户端接收到该告警阈值后，该流量监控管理平台接收用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值的告警信息以及流量监控客户端上报的请求链接数，流量监控管理平台根据该告警信息和请求链接数行对业务主机的流量防护策略，可见在发明中流量监控管理平台在监控到当前流量异常时，执行对业务主机的流量防护策略，对用户请求消息的无影响，解决了相关技术中系统设备受到异常流量攻击时，采用流量清洗设备进行处理的问题，而该流量清洗设备都是造价比较高，系统整体成本也很大，而采用本发明的方案能达到节约成本的效果。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的流量的处理方法流程图一；
图2是根据本发明实施例的流量的处理方法流程图二；
图3是根据本发明实施例的流量的处理装置结构框图一；
图4是根据本发明实施例的流量的处理装置结构框图二；
图5是根据本发明实施例的流量的处理系统的结构框图；
图6是根据本发明可选实施例的针对异常流量的监控与缓解的系统的结构框图；
图7是根据本发明可选实施例的系统下发配置参数及系统与终端的心跳保活流程图；
图8是根据本发明可选实施例的当流量监控客户端监控到当前设备的流量超过流量监控管理平台下发的正常运营告警阀值之后的处理流程图；
图9是根据本发明可选实施例的请求流量超过异常告警流量单台设备的访问流量没超过负载均衡阀值启动屏蔽策略流程图；
图10是根据本发明可选实施例的请求流量超过异常告警流量单台设备的访问流量没超过负载均衡阀值启动屏蔽策略流程图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在本实施例中提供了一种流量的处理方法，图1是根据本发明实施例的流量的处理方法流程图一，如图1所示，该流程包括如下步骤：
步骤S102，流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，其中，配置信息中携带有在预定时间内指示流量状态的告警阈值；
步骤S104，流量监控管理平台接收流量监控客户端上报的告警信息和业务主机当前的请求链接数，其中，告警信息用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值；
步骤S106，流量监控管理平台依据请求链接数和告警信息触发执行对业务主机的流量防护策略。
通过上述步骤S102至步骤S106，采用流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，而该配置信息中携带有在预定时间内指示流量状态的告警阈值，在流量监控客户端接收到该告警阈值后，该流量监控管理平台接收用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值的告警信息以及流量监控客户端上报的请求链接数，流量监控管理平台根据该告警信息和请求链接数行对业务主机的流量防护策略，可见在本实施例中流量监控管理平台在监控到当前流量异常时，执行对业务主机的流量防护策略，对用户请求消息的无影响，解决了相关技术中系统设备受到异常流量攻击时，需要采用流量清洗设备进行处理的问题，而该流量清洗设备都是造价比较高，系统整体成本也很大，而采用本实施例的方案能够达到节约成本的效果。
对于本实施例中涉及到的告警阈值可以是：正常运营告警阈值、异常告警阈值。下面将结合该告警阈值的不同进行相应的描述；在流量阈值超过正常运营告警阈值，且没有超过异常告警阈值时，也就是说正常运营告警阈值小于异常告警阈值，本实施例步骤106中涉及到的流量监控管理平台依据请求链接数和告警信息触发执行对业务主机的流量防护策略的方式，可以通过如下方式来实现：
步骤S11，流量监控管理平台执行对请求链接数进行分析与监控操作；
步骤S12，流量监控管理平台发送携带有分析与监控结果的告警短信到业务主机的管理员。
通过该步骤S11和步骤S12可知，在在流量阈值超过正常运营告警阈值且没有超过异常告警阈值时，流量监控管理平台执行对请求链接数进行分析与监控操作，并以告警短信的形式向业务主机的管理员通知当前业务主机的流量的状态。
而在流量阈值超过异常告警阈值时，本实施例步骤S106中涉及到的流量监控管理平台依据请求链接数和告警信息触发执行对业务主机的流量防护策略的方式，可以通过如下方式来实现：
步骤S21：流量监控管理平台获取除业务主机之外的流量监控管理平台下的其他业务主机的请求链接数；
步骤S22：流量监控管理平台判断业务主机的请求链接数是否超过其他业务主机的不均衡告警阈值比例；
步骤S23：在判断结果为是时，流量监控管理平台向业务主机的管理员发送告警短信以及向流量监控客户端发送第一指令，其中，第一指令用于触发流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
步骤S24：在判断结果为否时，流量监控管理平台继续获取流量监控客户端的请求链接；
步骤S25：流量监控管理平台根据预设设定的筛选算法对继续获取的请求链接的地址进行统计筛选出危险地址信息；
步骤S26：在流量监控管理平台判定危险地址信息与本地黑名单中存储的地址信息匹配，或继续获取的请求链接超出单链接请求阈值时，流量监控管理平台向业务主机的管理员发送告警短信，并向流量监控客户端发送第二指令，其中，第二指令用于指示触发流量监控客户端启动软件防火墙。
对于上述步骤S21至步骤S26可知，在当前业务主机的流量超过了异常告警阈值时，分两种场景执行相应的流量防护策略，在业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，说明此时业务主机收到了严重的异常流量攻击，因此该流量监控管理平台向流量监控客户端发送停止服务指令，也就是关闭一切对外服务端口，并启动软件防火墙屏蔽访问请求；而在业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，说明此时业务主机还可以通过自身的防御策略来阻止异常流量的攻击，因此该流量监控管理平台向业务主机下发启用软件防火墙的指令，来增加ACL访问控制策略。
需要说明的是，正常情况下，业务主机承受的访问请求是通过负载均衡设备(硬件F5或者是业务管理平台动态负载均衡)下发给每台业务设备的，不管采用什么方式，其目的是为了确保每台业务主机上的负载是均衡的。如果某一台业务主机的访问流量远远超过其他业务主机，这个就需要考虑这台设备是否被攻击了，因为正常情况下各业务主机的访问流量都是均衡的。不均衡告警阈值就是当前业务主机流量与其他业务主机流量总量的比值。举例来说，目前有10台主机，目前总体访问流量为100线，那平均到每台设备上的访问流量应该在10线上下，每台设备的不均衡告警阀值都在10％左右，如果某台业务主机流量异常增加到200线，那这台业务主机的不均衡告警阀值就是200/100*100％＝200％。
图2是根据本发明实施例的流量的处理方法流程图二，如图2所示，该流程包括如下步骤：
步骤S202，设置在业务主机上的流量监控客户端接收流量监控管理平台发送的配置信息，其中，配置信息中携带有在预定时间内指示流量状态的告警阈值；
步骤S204，流量监控客户端将预定时间内业务主机的流量阈值与告警阈值进行比较；
步骤S206，流量监控客户端向管理平台上报告警信息和业务主机当前的请求链接数，其中，告警信息用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值。
步骤S208，流量监控客户端接收流量监控管理平台依据请求链接数和告警信息执行的对业务主机的流量防护策略。
在本实施例的上述步骤S202至步骤S208中，设置在业务主机上的流量监控客户端将监控到业务主机预定时间内的流量阈值与流量监控管理平台发送的配置信息中携带的告警阈值进行比较，在流量阈值超过告警阈值时，流量监控客户端向管理平台上报告警信息和业务主机当前的请求链接数，进而流量监控客户端接收流量监控管理平台依据请求链接数和告警信息执行的对业务主机的流量防护策略，以减少异常流量对业务主机的攻击。
对于本实施例中涉及到的告警阈值可以是：正常运营告警阈值、异常告警阈值。
而在流量阈值超过异常告警阈值时，本实施例步骤S208中的流量监控客户端接收流量监控管理平台依据请求链接数和告警信息执行对业务主机的流量防护策略的方式可以通过如下方式来实现：在流量监控管理平台确定业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，流量监控客户端接收流量监控管理平台发送的第一指令，其中，第一指令用于触发流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
而在流量阈值超过异常告警阈值时，本实施例中步骤S208的流量监控客户端接收流量监控管理平台依据请求链接数和告警信息执行对业务主机的流量防护策略的方式可以通过如下方式来实现：在流量监控管理平台确定业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，流量监控客户端接收流量监控管理平台发送的第二指令，其中，第二指令用于指示触发流量监控客户端启动软件防火墙。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
在本实施例中还提供了一种流量的处理装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图3是根据本发明实施例的流量的处理装置结构框图一，该装置应用于流量监控管理平台侧，如图3所示，该装置包括：发送模块32，设置为向设置在业务主机上的流量监控客户端发送配置信息，其中，配置信息中携带有在预定时间内指示流量状态的告警阈值；第一接收模块34，与发送模块32耦合连接，设置为接收流量监控客户端上报的告警信息和业务主机当前的请求链接数，其中，告警信息用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值；执行模块36，与第一接收模块34耦合连接，设置为依据请求链接数和告警信息触发执行对业务主机的流量防护策略。
对于本实施例中涉及到的告警阈值可以是：正常运营告警阈值、异常告警阈值。
可选地，在流量阈值超过正常运营告警阈值时，该执行模块36包括：执行单元，设置为执行对请求链接数进行分析与监控操作；发送单元，与执行单元耦合连接，设置为发送携带有分析与监控结果的告警短信到业务主机的管理员。
可选地，在流量阈值超过异常告警阈值时，该执行模块36包括：第一获取单元，设置为获取除业务主机之外的流量监控管理平台下的其他业务主机的请求链接数；判断单元，与第 一获取单元耦合连接，设置为判断业务主机的请求链接数是否超过其他业务主机的不均衡告警阈值比例；第一发送单元，与判断单元耦合连接，设置为在判断结果为是时，向业务主机的管理员发送告警短信以及向流量监控客户端发送第一指令，其中，第一指令用于触发流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
第二获取单元，与判断单元耦合连接，设置为在判断结果为否时，继续获取流量监控客户端的请求链接；筛选单元，设置为根据预设设定的筛选算法对继续获取的请求链接的地址进行统计筛选出危险地址信息；第二发送单元，与第二获取单元耦合连接，设置为在流量监控管理平台判定危险地址信息与本地黑名单中存储的地址信息匹配，或继续获取的请求链接超出单链接请求阈值时，向业务主机的管理员发送告警短信，并向流量监控客户端发送第二指令，其中，第二指令用于指示触发流量监控客户端启动软件防火墙。
图4是根据本发明实施例的流量的处理装置结构框图二，该装置应用于设置在业务主机上的流量监控客户端侧，如图4所示，该装置包括：第二接收模块42，设置为接收流量监控管理平台发送的配置信息，其中，配置信息中携带有在预定时间内指示流量状态的告警阈值，比较模块44，与第二接收模块42耦合连接，设置为将预定时间内业务主机的流量阈值与告警阈值进行比较；上报模块46，与比较模块44耦合连接，设置为在流量阈值超过告警阈值时，向管理平台上报告警信息和业务主机当前的请求链接数，其中，告警信息用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值；第三接收模块48，与上报模块46耦合连接，设置为接收流量监控管理平台依据请求链接数和告警信息执行的对业务主机的流量防护策略。
可选地，告警阈值包括：正常运营告警阈值、异常告警阈值。
可选地，在流量阈值超过异常告警阈值时，第三接收模块，还设置为在流量监控管理平台确定业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，接收流量监控管理平台发送的第一指令，其中，第一指令用于触发流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
可选地，在流量阈值超过异常告警阈值时，第三接收模块，还设置为在流量监控管理平台确定业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，接收流量监控管理平台发送的第二指令，其中，第二指令用于指示触发流量监控客户端启动软件防火墙。
图5是根据本发明实施例的流量的处理系统的结构框图，如图5所示，该系统包括上述实施例中涉及到的流量监控管理平台和以及设置在业务主机上的流量监控客户端。
下面结合本发明实施例的可选实施例对本发明进行举例说明；
本可选实施例提供了一种针对异常流量的监控与缓解的系统，图6是根据本发明可选实施例的针对异常流量的监控与缓解的系统的结构框图，如图6所示，该系统至少包括流量监控业务管理平台、流量监控客户端以及消息接口模块，其中：
流量监控业务管理平台，主要用于定义一定时间段内的流量监控正常运营告警阀值、异 常告警阀值以及不均衡告警阀值比例，并通过消息接口模块把正常运营流量告警阀值、异常流量告警阀值及告警间隔时段下发给流量客户端。定期对流量监控客户端进行存活监测，以及定期收集、处理业务主机上部署的流量监控客户端上报的当前的链接汇总情况，并接收流量监控客户端上报的告警信息，包括但不限于请求的源地址、目的地址、源端口、目的端口以及协议类型，以确定当前流量的基本情况，并且及时对这些信息进行统计、分析，根据一定的算法，与系统保留的历史记录及黑名单进行比对，以确认是否通知流量监控客户端启用软件防火墙(IPTable)以及设置防火墙防护策略。
流量监控客户端，是指安装在分布式系统的业务主机上，用于监控、获取向本机请求的流量信息，记录向本机请求的源地址、目的地址、源端口、目的端口以及协议类型，并通过消息接口模块上报给流量监控业务管理平台，并且更新流量监控业务管理平台下发的告警阀值及告警间隔时段。流量监控客户端定期向流量监控管理平台上报当前流量情况汇总信息，当根据流量监控管理平台下发的一段时间段内的请求流量超过正常运营告警阀值时，流量监控客户端向流量监控业务管理平台上报告警信息以及请求链接情况；当请求流量超过异常流量告警阀值时，流量监控客户端向流量监控业务管理平台上报异常告警及当前请求的链接，并且等待流量监控业务管理平台的防控指令，并执行管理平台下发的防火墙策略指令。
消息接口模块，包括流量监控业务管理平台向流量监控客户端的参数、防火墙控制指令下发接口以及流量监控客户端向流量监控业务管理平台的访问链接信息上报两个接口。
结合本实施例中该系统的模块，对本可选实施例中针对异常流量的监控与缓解的方法进行相应的描述，该方法的步骤包括：
步骤S302：系统管理员在流量监控业务管理平台上维护正常运营告警阀值以及异常流量告警阀值，下发给流量监控客户端并不定期更新，并且启动对流量监控客户端的存活监控，流量监控客户端接受并保存流量监控管理平台下发的正常运营告警阀值以及异常流量告警阀值，并根据流量监控管理平台的请求上报当前客户端存活状态；
步骤S304：流量监控客户端监控当前请求的访问流量情况，定期向管理平台上报流量汇总统计信息。当发现当前请求流量在一定时间段内超过流量监控业务管理平台定义的正常运营告警阀值，立即启动向流量监控业务管理平台上报告警信息并且上报当前请求链接情况，流量监控管理平台接受到流量监控客户端上报的告警信息之后，启动对这台设备请求链接的分析与监控，并且向设备管理员发送告警短信；
步骤S306：流量监控客户端继续监控当前请求的访问流量情况，当发现当前请求流量在一定时间段内超过流量监控管理平台下发的异常流量告警阀值时，立即启动向流量监控业务管理平台上报异常告警信息及当前请求链接情况，流量监控管理平台接收到流量监控客户端上报的告警信息之后，首先启动负载均衡情况分析，分析其他设备的请求情况，当发现当前设备的请求链接数超过与其他设备的不均衡告警阀值比例，立即向这台设备下发停止服务指令，关闭一切对外服务端口，启动软件防火墙屏蔽访问请求，并且向设备管理员发送服务异常告警短信。流量监控客户端接收到防控指令之后立即启动关闭服务、端口操作，并且启动 软件防火墙(IP Table)屏蔽外界访问。
步骤S308：如当前设备的请求链接数没有超过与其他设备的不均衡告警阀值，流量监控管理平台随即启动对异常流量的分析与统计，获取异常流量访问告警之后的请求链接信息，分析请求链接的源地址以及目的端口，根据系统预先定义的筛选算法对源地址以及目的端口进行统计，并且根据系统定义的黑名单与访问源地址进行匹配，如果发现源地址在黑名单内，或者源地址的访问请求超过系统定义的单链接请求阀值，立即向这台设备下发启用软件防火墙指令，增加ACL访问控制策略，屏蔽该源地址的一切访问请求；流量监控客户端接收到该指令之后，立即启动软件防火墙(IP Table)并且屏蔽该链接的一切访问，以缓解因异常攻击对系统造成的影响，并继续监控系统的请求链接直至系统访问流量恢复正常。
对于上述步骤S302可以通过如下方式来实现
步骤S31：系统管理员在系统上维护基础信息，包括正常运营告警阀值以及异常流量告警阀值以及每种告警阀值的间隔时段，定义不均衡告警阀值比例；
步骤S32：流量监控管理平台向流量监控客户端发送心跳消息进行存活监控，流量监控客户端根据平台请求定期上报当前状态；
步骤S33：流量监控管理平台如果发现流量监控客户端心跳异常，立即向设备管理员发送告警短信提醒。
对于上述步骤S304可以通过如下方式来实现：
步骤S41：流量监控客户端监控当前请求流量，定期向流量监控管理平台上报当前流量情况汇总信息(不含请求详细信息)；
步骤S42：当流量监控客户端发现当前请求流量在一定时间段内超过流量监控业务管理平台定义的正常运营告警阀值，立即启动向流量监控业务管理平台上报告警信息并且上报当前请求链接情况，包括请求的源地址、目的地址、源端口、目的端口以及协议类型；
步骤S43：流量监控管理平台接受到流量监控客户端上报的告警信息之后，启动对这向设备管理员发送告警短信；
对于上述步骤S306可以通过如下方式来实现：
步骤S51：流量监控客户端监控当前请求的访问流量情况，当发现当前请求流量在一定时间段内超过流量监控管理平台下发的异常流量告警阀值时，立即启动向流量监控业务管理平台上报异常告警信息及当前请求链接情况，包括当前访问链接的源地址、目的地址、端口访问类型等信息；
步骤S52：流量监控管理平台接收到流量监控客户端上报的告警信息之后，首先启动负载均衡情况分析，分析其他设备的请求情况，当发现当前设备的请求链接数超过与其他设备的不均衡告警阀值比例，立即向这台设备下发停止服务指令，关闭一切对外服务端口，启动软件防火墙屏蔽访问请求，并且向设备管理员发送服务异常告警短信。
步骤S53：流量监控客户端接收到防控指令之后立即启动关闭服务、端口操作，并且启动软件防火墙(IP Table)屏蔽外界访问。
对于上述步骤S308可以通过如下方式来实现：
步骤S61：流量监控管理平台判断如当前设备的请求链接数没有超过与其他设备的不均衡告警阀值，则启动对异常流量的分析与统计，获取异常流量访问告警之后的请求链接信息，分析请求链接的源地址以及目的端口；
步骤S62：流量监控管理平台根据系统预先定义的筛选算法对源地址以及目的端口进行统计，并且根据系统定义的黑名单与访问源地址进行匹配，如果发现源地址在黑名单内，或者源地址的访问请求超过系统定义的单链接请求阀值，立即向这台设备下发启用软件防火墙指令，增加ACL访问控制策略，屏蔽该源地址的一切访问请求；
步骤S63：流量监控客户端接收到该指令之后，立即启动软件防火墙(IP Table)，屏蔽该链接的一切访问，以缓解因异常攻击对系统造成的影响，并继续监控系统的请求链接直至系统访问流量恢复正常。
采用本可选实施例，实现了一种针对异常流量监控与缓解的系统和方法，可以在系统流量异常或者系统受到外部DDOS攻击时可以通过动态启用系统自身提供的软件防火墙，来抵御外部的攻击，有效减少外部攻击对系统的影响。并且系统是通过软件系统实现了对外部攻击的防护，可以应用在大型CDN、视频等网站，减少硬件投入成本，增强系统的防护能力。
与目前通用的DDOS攻击防护策略相比，目前针对DDOS攻击的防护大多数是通过专业的流量清洗设备，并且在路由器上或者防火墙上做相应的策略把请求消息旁路到流量清洗设备，由流量清洗设备对请求流量进行过滤。这样的方式，对小型局点来说问题不大，但是对于大型网站，这样的处理方式不但极大增加了系统的成本，而且系统的性能也会受到影响。
下面结合附图和具体实施例对可选实施例对本可选实施例进行详细的说明。
实施例1
图7是根据本发明可选实施例的系统下发配置参数及系统与终端的心跳保活流程图，如图7所示，该流程包括：
步骤S701，操作员在流量监控管理平台定义告警阀值，时间及不均衡告警阀值等参数；
步骤S702，流量监控管理平台保存参数配置；
步骤S703，流量监控管理平台通过接口机向流量监控客户端下发配置参数；
步骤S704，流量监控客户端保存配置参数信息；
步骤S705，流量监控管理平台向流量监控客户端发送心跳保活请求；
步骤S706，流量监控客户端向流量监控管理平台返回心跳保活响应。
实施例2
图8是根据本发明可选实施例的当流量监控客户端监控到当前设备的流量超过流量监控管理平台下发的正常运营告警阀值之后的处理流程图，如图8所示，该流程的步骤包括：
步骤S801，流量监控客户端定期向流量监控管理平台上报当前流量汇总信息；
步骤S802，流量监控管理平台保存流量信息；
步骤S803，流量监控客户端比较当前流量与正常运营阀值；
步骤S804，当超过正常运营阀值，向流量监控管理平台告警；
步骤S805，流量监控管理平台保存告警信息，并启动监控进程进行监控；
步骤S806，流量监控管理平台向系统管理员发送告警短信。
实施例3
该实施例为当前设备的流量在超过异常运营告警阀值之后，流量监控管理平台首先判断这台设备的流量异常是否是异常流量偏高，以确定外部的访问流量是否是针对这台设备。当这台设备的请求流量超过其他设备的负载均衡阀值时，流量监控管理平台向流量监控客户端下发停止服务、启动软件防火墙等相关措施以避免系统被进一步攻击之后导致瘫痪，图9是根据本发明可选实施例的请求流量超过异常告警流量单台设备的访问流量没超过负载均衡阀值启动屏蔽策略流程图，如图9所示，该流程的步骤包括：
步骤S901，流量监控客户端定期监控当前请求流量访问情况；
步骤S902，当当前设备的流量超过异常告警流量阀值时，立即向流量监控管理平台告警；
步骤S903，流量监控管理平台比较当前设备与其他设备流量负载情况；
步骤S904，当发现这台设备流量超越负载均衡阀值，开始准备向这台设备下发屏蔽策略；
步骤S905，流量监控管理平台向流量监控客户端发送访问屏蔽策略，通知业务客户端关闭端口、服务，启动软件防火墙；
步骤S906，流量监控管理平台向系统管理员发送告警短信。
实施例4
该为当前设备的流量在超过异常运营告警阀值之后，流量监控管理平台在排除了当前设备的流量没有超过异常流量告警阀值之后的防控流程。流量监控管理平台根据系统事先定义的筛选算法对请求地址进行统计，筛选出危险地址信息，继而继续筛选出超过单链接请求阀值的地址，并且与系统中保留的黑名单地址进行比对，过滤出需要屏蔽的地址信息，并且给流量监控客户端发送启动软件防火墙，增加ACL策略屏蔽这些地址的指令，图10是根据本发明可选实施例的请求流量超过异常告警流量单台设备的访问流量没超过负载均衡阀值启动 屏蔽策略流程图，如图10所示，该流程的步骤包括：
步骤S1001，流量监控管理平台统计当前访问链接情况，获取请求链接源地址及目的端口；
步骤S1002，流量监控管理平台根据事先定义的筛选算法对请求地址进行统计，筛选出危险地址信息；
步骤S1003，流量监控管理平台根据系统保留的黑名单对危险地址进行分析；
步骤S1004，流量监控管理平台筛选出请求超出单链接请求阀值的地址或者是在黑名单的地址；
步骤S1005，流量监控管理平台向流量监控客户端发送访问屏蔽策略，通知客户端启动软件防火墙，增加ACL策略屏蔽异常请求源地址；
步骤S1006，流量监控客户端根据管理平台的防控策略启动软件防火墙，增加ACL策略；
步骤S1007，流量监控管理平台向系统管理员发送严重告警短信。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述模块分别位于多个处理器中。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
步骤S1，流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，其中，配置信息中携带有在预定时间内指示流量状态的告警阈值；
步骤S2，流量监控管理平台接收流量监控客户端上报的告警信息和业务主机当前的请求链接数，其中，告警信息用于指示在预定时间内流量监控客户端监控到业务主机的流量阈值超过告警阈值；
步骤S3，流量监控管理平台依据请求链接数和告警信息触发执行对业务主机的流量防护策略。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
在发明实施例流量的处理过程中，在流量监控管理平台在监控到当前流量异常时，执行对业务主机的流量防护策略，对用户请求消息的无影响，解决了相关技术中系统设备受到异常流量攻击时，采用流量清洗设备进行处理的问题，而该流量清洗设备都是造价比较高，系统整体成本也很大，而采用本发明的方案能达到节约成本的效果。

Claims (19)

  1. 一种流量的处理方法，包括：
    流量监控管理平台向设置在业务主机上的流量监控客户端发送配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值；
    所述流量监控管理平台接收所述流量监控客户端上报的告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；
    所述流量监控管理平台依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略。
  2. 根据权利要求1所述的方法，其中，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
  3. 根据权利要求2所述的方法，其中，在所述流量阈值超过所述正常运营告警阈值时，所述流量监控管理平台依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略包括：
    所述流量监控管理平台执行对所述请求链接数进行分析与监控操作；
    所述流量监控管理平台发送携带有分析与监控结果的告警短信到所述业务主机的管理员。
  4. 根据权利要求2所述的方法，其中，在所述流量阈值超过所述异常告警阈值时，所述流量监控管理平台依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略包括：
    所述流量监控管理平台获取除所述业务主机之外的所述流量监控管理平台下的其他业务主机的请求链接数；
    所述流量监控管理平台判断所述业务主机的请求链接数是否超过其他业务主机的不均衡告警阈值比例；
    在判断结果为是时，所述流量监控管理平台向所述业务主机的管理员发送告警短信以及向所述流量监控客户端发送第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
  5. 根据权利要求4所述的方法，其中，所述方法还包括：
    在判断结果为否时，所述流量监控管理平台继续获取所述流量监控客户端的请求链接；
    所述流量监控管理平台根据预设设定的筛选算法对继续获取的请求链接的地址进行统计筛选出危险地址信息；
    在所述流量监控管理平台判定所述危险地址信息与本地黑名单中存储的地址信息匹配，或所述继续获取的请求链接超出单链接请求阈值时，所述流量监控管理平台向所述业务主机的管理员发送告警短信，并向所述流量监控客户端发送第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
  6. 一种流量的处理方法，包括：
    设置在业务主机上的流量监控客户端接收流量监控管理平台发送的配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值；
    所述流量监控客户端将所述预定时间内所述业务主机的流量阈值与所述告警阈值进行比较；
    所述流量监控客户端向所述管理平台上报告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；
    所述流量监控客户端接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行的对所述业务主机的流量防护策略。
  7. 根据权利要求6所述的方法，其中，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
  8. 根据权利要求7所述的方法，其中，在所述流量阈值超过所述异常告警阈值时，所述流量监控客户端接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行对所述业务主机的流量防护策略包括：
    在所述流量监控管理平台确定所述业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，所述流量监控客户端接收所述流量监控管理平台发送的第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
  9. 根据权利要求8所述的方法，其中，在所述流量阈值超过所述异常告警阈值时，所述流量监控客户端接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行对所述业务主机的流量防护策略包括：
    在所述流量监控管理平台确定所述业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，所述流量监控客户端接收所述流量监控管理平台发送的第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
  10. 一种流量的处理装置，应用于流量监控管理平台侧，包括：
    发送模块，设置为向设置在业务主机上的流量监控客户端发送配置信息，其中，所述配置信息中携带有在预定时间内指示流量状态的告警阈值；
    第一接收模块，设置为接收所述流量监控客户端上报的告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；
    执行模块，设置为依据所述请求链接数和所述告警信息触发执行对所述业务主机的流量防护策略。
  11. 根据权利要求10所述的装置，其中，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
  12. 根据权利要求11所述的装置，其中，在所述流量阈值超过所述正常运营告警阈值时，所述执行模块包括：
    执行单元，设置为执行对所述请求链接数进行分析与监控操作；
    发送单元，设置为发送携带有分析与监控结果的告警短信到所述业务主机的管理员。
  13. 根据权利要求11所述的装置，其中，在所述流量阈值超过所述异常告警阈值时，所述执行模块包括：
    第一获取单元，设置为获取除所述业务主机之外的所述流量监控管理平台下的其他业务主机的请求链接数；
    判断单元，设置为判断所述业务主机的请求链接数是否超过其他业务主机的不均衡告警阈值比例；
    第一发送单元，设置为在判断结果为是时，向所述业务主机的管理员发送告警短信以及向所述流量监控客户端发送第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
  14. 根据权利要求13所述的装置，其中，所述执行模块还包括：
    第二获取单元，设置为在判断结果为否时，继续获取所述流量监控客户端的请求链接；
    筛选单元，设置为根据预设设定的筛选算法对继续获取的请求链接的地址进行统计筛选出危险地址信息；
    第二发送单元，设置为在所述流量监控管理平台判定所述危险地址信息与本地黑名单中存储的地址信息匹配，或所述继续获取的请求链接超出单链接请求阈值时，向所述业务主机的管理员发送告警短信，并向所述流量监控客户端发送第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
  15. 一种流量的处理装置，应用于设置在业务主机上的流量监控客户端侧，包括：
    第二接收模块，设置为接收流量监控管理平台发送的配置信息，其中，所述配置信 息中携带有在预定时间内指示流量状态的告警阈值，所述告警阈值包括：正常运营告警阈值、异常告警阈值；
    比较模块，设置为将所述预定时间内所述业务主机的流量阈值与所述告警阈值进行比较；
    上报模块，设置为在所述流量阈值超过所述告警阈值时，向所述管理平台上报告警信息和所述业务主机当前的请求链接数，其中，所述告警信息用于指示在所述预定时间内所述流量监控客户端监控到所述业务主机的流量阈值超过所述告警阈值；
    第三接收模块，设置为接收所述流量监控管理平台依据所述请求链接数和所述告警信息执行的对所述业务主机的流量防护策略。
  16. 根据权利要求15所述的装置，其中，所述告警阈值包括：正常运营告警阈值、异常告警阈值。
  17. 根据权利要求16所述的装置，其中，在所述流量阈值超过所述异常告警阈值时，
    所述第三接收模块，还设置为在所述流量监控管理平台确定所述业务主机的请求链接数超过其他业务主机的不均衡告警阈值比例时，接收所述流量监控管理平台发送的第一指令，其中，所述第一指令用于触发所述流量监控客户端执行启动软件防火墙、关闭服务和端口的操作。
  18. 根据权利要求17所述的装置，其中，在所述流量阈值超过所述异常告警阈值时，
    所述第三接收模块，还设置为在所述流量监控管理平台确定所述业务主机的请求链接数未超过其他业务主机的不均衡告警阈值比例时，接收所述流量监控管理平台发送的第二指令，其中，所述第二指令用于指示触发所述流量监控客户端启动软件防火墙。
  19. 一种流量的处理系统，所述系统包括流量监控管理平台和设置在业务主机上的流量监控客户端；其中，所述流量监控管理平台包括权利要求10至14任一项所述的装置，所述流量监控客户端包括权利要求15至18任一项所述的装置。
PCT/CN2016/076903 2015-07-16 2016-03-21 流量的处理方法、装置及系统 WO2016177156A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510421027.2A CN106713216B (zh) 2015-07-16 2015-07-16 流量的处理方法、装置及系统
CN201510421027.2 2015-07-16

Publications (1)

Publication Number Publication Date
WO2016177156A1 true WO2016177156A1 (zh) 2016-11-10

Family

ID=57217450

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076903 WO2016177156A1 (zh) 2015-07-16 2016-03-21 流量的处理方法、装置及系统

Country Status (2)

Country Link
CN (1) CN106713216B (zh)
WO (1) WO2016177156A1 (zh)

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108366077A (zh) * 2018-04-23 2018-08-03 杭州奇治信息技术股份有限公司 裂变式防攻击网络接入系统
CN110532322A (zh) * 2019-08-20 2019-12-03 腾讯云计算（北京）有限责任公司 运维交互方法、系统、计算机可读存储介质及设备
CN111190798A (zh) * 2020-01-03 2020-05-22 苏宁云计算有限公司 一种业务数据监控警告装置及方法
CN111245782A (zh) * 2019-12-29 2020-06-05 航天信息股份有限公司广州航天软件分公司 一种对出入境自助受理设备进行智能监控的系统及方法
CN111522711A (zh) * 2020-04-17 2020-08-11 北京奇艺世纪科技有限公司 一种数据监控处理系统、方法、执行端、监控端及电子设备
CN112965836A (zh) * 2021-03-04 2021-06-15 北京百度网讯科技有限公司 服务控制方法、装置、电子设备及可读存储介质
CN113595784A (zh) * 2021-07-26 2021-11-02 招商银行股份有限公司 网络流量检测方法、装置、设备、存储介质及程序产品
CN114143822A (zh) * 2021-11-05 2022-03-04 阳光电源股份有限公司 流量管理方法、运营管理平台、充电桩及存储介质
CN114257552A (zh) * 2020-09-10 2022-03-29 中国移动通信集团广东有限公司 流量加速方法、装置及终端
CN114584455A (zh) * 2022-03-04 2022-06-03 吉林大学 一种基于企业微信的中小型高性能集群监控系统
WO2022238987A1 (en) * 2021-05-09 2022-11-17 Cytwist Ltd. A scenario-based cyber security system and method
CN115633197A (zh) * 2022-09-15 2023-01-20 海南乾唐视联信息技术有限公司 一种业务数据的分流系统、方法、装置、电子设备和介质
CN115776435A (zh) * 2022-10-24 2023-03-10 华能信息技术有限公司 一种基于api网关的预警方法
CN113595784B (zh) * 2021-07-26 2024-05-31 招商银行股份有限公司 网络流量检测方法、装置、设备、存储介质及程序产品

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108933736B (zh) * 2017-05-25 2023-11-14 中兴通讯股份有限公司 均衡负载处理方法、服务端、客户端和介质
CN108696713B (zh) * 2018-04-27 2021-08-24 苏州科达科技股份有限公司 码流的安全测试方法、装置及测试设备
CN108600024A (zh) * 2018-05-07 2018-09-28 苏州明上系统科技有限公司 一种无线网络管理系统
CN108881246A (zh) * 2018-06-27 2018-11-23 中国联合网络通信集团有限公司 一种容器安全防护的方法及装置
CN108540396A (zh) * 2018-07-11 2018-09-14 尚通(北京)科技发展有限公司 一种物联网流量控制方法、系统、终端及存储介质
CN109347762B (zh) * 2018-10-26 2023-05-05 平安科技（深圳）有限公司 跨地域出口流量调配方法、装置、计算机设备及存储介质
CN109450955B (zh) * 2018-12-30 2022-04-05 北京世纪互联宽带数据中心有限公司 一种基于网络攻击的流量处理方法及装置
CN110650060A (zh) * 2019-10-16 2020-01-03 中国联合网络通信集团有限公司 流量告警的处理方法、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003044635A1 (en) * 2001-11-16 2003-05-30 Cetacea Networks Corporation Method and system for detecting and disabling sources of network packet flooding
CN101175013A (zh) * 2006-11-03 2008-05-07 飞塔信息科技（北京）有限公司 一种拒绝服务攻击防护方法、网络系统和代理服务器
CN101938459A (zh) * 2010-06-22 2011-01-05 北京豪讯美通科技有限公司 全程全网安全协同防御系统
CN101969445A (zh) * 2010-11-03 2011-02-09 中国电信股份有限公司 防御DDoS和CC攻击的方法和装置
CN104392175A (zh) * 2014-11-26 2015-03-04 华为技术有限公司 一种云计算系统中云应用攻击行为处理方法、装置及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101820413B (zh) * 2010-01-08 2012-08-29 中国科学院软件研究所 一种网络安全最佳防护策略的选择方法
CN104243184B (zh) * 2013-06-06 2018-01-30 中国移动通信集团河北有限公司 一种告警信息的处理方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2003044635A1 (en) * 2001-11-16 2003-05-30 Cetacea Networks Corporation Method and system for detecting and disabling sources of network packet flooding
CN101175013A (zh) * 2006-11-03 2008-05-07 飞塔信息科技（北京）有限公司 一种拒绝服务攻击防护方法、网络系统和代理服务器
CN101938459A (zh) * 2010-06-22 2011-01-05 北京豪讯美通科技有限公司 全程全网安全协同防御系统
CN101969445A (zh) * 2010-11-03 2011-02-09 中国电信股份有限公司 防御DDoS和CC攻击的方法和装置
CN104392175A (zh) * 2014-11-26 2015-03-04 华为技术有限公司 一种云计算系统中云应用攻击行为处理方法、装置及系统

Cited By (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108366077A (zh) * 2018-04-23 2018-08-03 杭州奇治信息技术股份有限公司 裂变式防攻击网络接入系统
CN110532322A (zh) * 2019-08-20 2019-12-03 腾讯云计算（北京）有限责任公司 运维交互方法、系统、计算机可读存储介质及设备
CN110532322B (zh) * 2019-08-20 2024-04-30 腾讯云计算（北京）有限责任公司 运维交互方法、系统、计算机可读存储介质及设备
CN111245782A (zh) * 2019-12-29 2020-06-05 航天信息股份有限公司广州航天软件分公司 一种对出入境自助受理设备进行智能监控的系统及方法
CN111190798A (zh) * 2020-01-03 2020-05-22 苏宁云计算有限公司 一种业务数据监控警告装置及方法
CN111522711B (zh) * 2020-04-17 2023-05-05 北京奇艺世纪科技有限公司 一种数据监控处理系统、方法、执行端、监控端及电子设备
CN111522711A (zh) * 2020-04-17 2020-08-11 北京奇艺世纪科技有限公司 一种数据监控处理系统、方法、执行端、监控端及电子设备
CN114257552A (zh) * 2020-09-10 2022-03-29 中国移动通信集团广东有限公司 流量加速方法、装置及终端
CN114257552B (zh) * 2020-09-10 2023-11-21 中国移动通信集团广东有限公司 流量加速方法、装置及终端
CN112965836A (zh) * 2021-03-04 2021-06-15 北京百度网讯科技有限公司 服务控制方法、装置、电子设备及可读存储介质
CN112965836B (zh) * 2021-03-04 2024-04-23 北京百度网讯科技有限公司 服务控制方法、装置、电子设备及可读存储介质
WO2022238987A1 (en) * 2021-05-09 2022-11-17 Cytwist Ltd. A scenario-based cyber security system and method
CN113595784A (zh) * 2021-07-26 2021-11-02 招商银行股份有限公司 网络流量检测方法、装置、设备、存储介质及程序产品
CN113595784B (zh) * 2021-07-26 2024-05-31 招商银行股份有限公司 网络流量检测方法、装置、设备、存储介质及程序产品
CN114143822B (zh) * 2021-11-05 2023-08-15 阳光电源股份有限公司 流量管理方法、运营管理平台、充电桩及存储介质
CN114143822A (zh) * 2021-11-05 2022-03-04 阳光电源股份有限公司 流量管理方法、运营管理平台、充电桩及存储介质
CN114584455B (zh) * 2022-03-04 2023-06-30 吉林大学 一种基于企业微信的中小型高性能集群监控系统
CN114584455A (zh) * 2022-03-04 2022-06-03 吉林大学 一种基于企业微信的中小型高性能集群监控系统
CN115633197A (zh) * 2022-09-15 2023-01-20 海南乾唐视联信息技术有限公司 一种业务数据的分流系统、方法、装置、电子设备和介质
CN115776435A (zh) * 2022-10-24 2023-03-10 华能信息技术有限公司 一种基于api网关的预警方法
CN115776435B (zh) * 2022-10-24 2024-03-01 华能信息技术有限公司 一种基于api网关的预警方法

Also Published As

Publication number Publication date
CN106713216B (zh) 2021-02-19
CN106713216A (zh) 2017-05-24

Similar Documents

Publication Publication Date Title
WO2016177156A1 (zh) 流量的处理方法、装置及系统
US20160182542A1 (en) Denial of service and other resource exhaustion defense and mitigation using transition tracking
US10432650B2 (en) System and method to protect a webserver against application exploits and attacks
US8881259B2 (en) Network security system with customizable rule-based analytics engine for identifying application layer violations
AU2004282937B2 (en) Policy-based network security management
EP2974215B1 (en) Protecting networks from cyber attacks and overloading
TWI294726B (zh)
US9088607B2 (en) Method, device, and system for network attack protection
US20150256431A1 (en) Selective flow inspection based on endpoint behavior and random sampling
RU2480937C2 (ru) Система и способ уменьшения ложных срабатываний при определении сетевой атаки
TW201738796A (zh) 網路攻擊的防控方法、裝置及系統
CN112351012A (zh) 一种网络安全防护方法、装置及系统
US20190230116A1 (en) Distributed denial-of-service attack mitigation with reduced latency
US20160294871A1 (en) System and method for mitigating against denial of service attacks
JP2013175166A (ja) サービスの漸進劣化によりネットワーク保護を提供する方法およびシステム
US8918838B1 (en) Anti-cyber hacking defense system
JP2013525927A5 (zh)
CN109995794B (zh) 一种安全防护系统、方法、设备及存储介质
JP2010061660A (ja) 分散サービス拒否攻撃の防御方法および防御システム
TWI492090B (zh) 分散式阻斷攻擊防護系統及其方法
KR20120060655A (ko) 서버 공격을 탐지할 수 있는 라우팅 장치와 라우팅 방법 및 이를 이용한 네트워크
WO2018095375A1 (zh) 一种dns的防护方法、管理设备及域名解析服务器
US20180103057A1 (en) System and method for managing tiered blacklists for mitigating network attacks
KR20180000100A (ko) Sdn 기반의 마이크로 서버 관리 시스템에 대한 네트워크 공격 차단 시스템
Subbulakshmi et al. A unified approach for detection and prevention of DDoS attacks using enhanced support vector machines and filtering mechanisms

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16789150

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16789150

Country of ref document: EP

Kind code of ref document: A1