WO2016201996A1

WO2016201996A1 - Method of adaptively blocking network attack and device utilizing same

Info

Publication number: WO2016201996A1
Application number: PCT/CN2016/073642
Authority: WO
Inventors: 惠卫锋
Original assignee: 华为技术有限公司
Priority date: 2015-06-17
Filing date: 2016-02-05
Publication date: 2016-12-22
Also published as: CN104954376A; CN104954376B

Abstract

The present invention discloses a method of adaptively blocking a network attack and a device utilizing the same. The method comprises: matching a node arranged in a chronological order of passage of a message received from a port and a node of passage of a message having a same service type as the message received from the port and delivered through a network element system for a first time so as to obtain a matching degree of paths; determining, according to the matching degree, whether the received message is abnormal; and if so, reducing allowable accessed data traffic of the port receiving the message. As a consequence, the embodiment of the invention can adaptively block a network attach from an abnormal message, reducing lengthy and complicated operational steps of manually configuring a firewall, and effectively enhancing dynamic recognition and a blocking result of a network attack.

Description

Adaptive anti-attack method and device

This application claims the priority of the Chinese Patent Application filed on June 17, 2015, the Chinese Patent Application No. CN201510337388.9, entitled "An Adaptive Anti-Attack Method and Apparatus", the entire contents of which are incorporated by reference. In this application.

Technical field

The present invention relates to the field of communication security technologies, and in particular, to an adaptive anti-attack method and apparatus.

Background technique

In a telecommunication device, different network elements are implemented by devices, ports, such as routers, switches, Fast Ethernet (FE) interfaces, and Gigabit Ethernet (GE) interfaces. Interoperability provides users with a variety of telecommunications services. With the continuous integration of IT and CT networks, the situation of external abnormal packet attacks on the telecom network is constantly appearing, which causes problems such as board reset and service congestion.

A common network attack defense solution is to deploy a firewall at the NE portal. The access data packets are identified by the firewall's preset policy. Packets that meet the preset policy are allowed to access the network. Packets that do not meet the preset policy are discarded. The preset policy needs to be manually configured and generated, and the flexibility of the service change scenario is insufficient. Because the firewall unit is independent of the service unit and does not have the ability to identify and analyze the service type, the ability to identify the abnormal service packets of the "smart design" is weak. For this type of attack behavior, the firewall passes the abnormal traffic. Techniques such as behavior and fragmentation message recognition can only achieve partial protection. Therefore, how to eliminate the cumbersome operation links of manually configuring the firewall and effectively improve the dynamic identification and interception effect of the network attack is a problem that needs to be solved currently.

Summary of the invention

The invention provides an adaptive anti-attack method and device, which can adaptively defend against abnormal packets and effectively improve the dynamic identification and interception effect of network attacks.

In a first aspect, an adaptive anti-attack method is provided, including:

Receiving a second packet from the first port of the network element system, where the network element system includes at least one port, The first port is one of the at least one port, and the network element system internally includes a plurality of nodes;

Acquiring, according to the service type of the second packet, a first path that is stored in advance, where the first path is path information that is experienced in the network element system when the first packet passes through the network element system, The first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is the same as all the service types of the second packet. The packet passing the network element system for the first time in the packet of the service type and passing through the network element system;

Obtaining a second path, where the second path is path information that is performed inside the network element system when the second packet passes the network element system, and the second path includes the second packet At least one node that passes through the network element system in chronological order;

Matching each node included in the first path with a corresponding node included in the second path to obtain a first matching degree of the second path and the first path;

Comparing the first matching degree with the first set threshold, if the first matching degree is lower than the first set threshold, determining that the second packet is an abnormal packet, the first Setting the threshold is set according to the tolerance of the service type to the bit error rate or the communication delay;

And determining that the second packet is an abnormal packet, and reducing the allowed access traffic of the first port.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the at least one node included in the first path and the at least one node included in the second path are respectively sorted in a chronological order. Then, nodes located in the first path and having the same order in the second path correspond to each other.

In conjunction with the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the first set threshold is in a range of 60% to 70%.

With reference to the first aspect, the first possible implementation manner of the first aspect, or the second possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, the first in the self-network element system Before the port receives the second packet, the method further includes:

Receiving the first packet from any port of the network element system;

Obtaining the experience experienced in the network element system when the first packet passes through the network element system a first path and storing the first path.

With reference to the first aspect or the first possible implementation of the first aspect to any one of the possible implementations of the third possible implementation of the first aspect, in a fourth possible implementation of the first aspect, the Each of the nodes included in the first path is matched with a corresponding node that is included in the second path, to obtain a first matching degree of the second path and the first path, and specifically includes:

Matching each node included in the first path with a corresponding node included in the second path to determine whether each node included in the first path is the same as a corresponding node included in the second path, And acquiring a first matching degree of the second path and the first path.

With reference to the first aspect or the first possible implementation of the first aspect to any one of the third possible implementation manners of the first aspect, in a fifth possible implementation manner of the first aspect, A path includes n1 nodes,

After the obtaining the pre-stored first path, the method further includes:

Obtaining traffic of each of the n1 nodes included in the first path.

In conjunction with the fifth possible implementation of the first aspect, in a sixth possible implementation manner of the first aspect, the second path includes n2 nodes,

After the obtaining the second path, the method further includes:

Obtaining traffic of each of the n2 nodes included in the second path.

With reference to the sixth possible implementation manner of the first aspect, in a seventh possible implementation manner of the first aspect, the performing the node included in the first path and the corresponding node included in the second path respectively The matching, to obtain the first matching degree of the second path and the first path, specifically includes:

Matching the traffic of each of the n2 nodes with the traffic of the corresponding node of the n1 nodes, respectively, to determine whether the traffic distribution of the n2 nodes is the same as the traffic distribution of the n1 nodes, And acquiring a first matching degree of the second path and the first path.

With reference to the fifth possible implementation manner of the first aspect, in an eighth possible implementation manner of the first aspect, after the acquiring the traffic of each of the n1 nodes included in the first path, The method also includes:

The traffic of each node in the n1 nodes is separately normalized by using the following formula:

Where f _x is the traffic of node x after normalization, x ranges from 1 to n1, and F _x is the traffic of node x.

The maximum value of the traffic of the n1 nodes.

With reference to the sixth possible implementation manner of the first aspect, in a ninth possible implementation manner of the first aspect, after the acquiring the traffic of each of the n2 nodes included in the second path, The method also includes:

The traffic of each of the n2 nodes is normalized by the following formula:

With reference to the first aspect or the first possible implementation of the first aspect to any one of the possible implementations of the ninth possible implementation of the first aspect, in a tenth possible implementation manner of the first aspect, When the second packet is determined to be an abnormal packet, the allowed access traffic of the first port is reduced, which specifically includes:

When the second packet is determined to be an abnormal packet, the allowed access traffic of the first port is reduced to a first reduced value, and the first reduced value is the second packet passing through the second packet. In the process of the first port, the maximum value of the actual access traffic of the first port is the product of the first ratio, wherein the first reduction value is not lower than the preset minimum of the first port. The access rate is allowed to be allowed, and the first ratio value ranges from 1/5 to 1/2.

With reference to the first aspect or the first possible implementation of the first aspect to any one of the possible implementations of the tenth possible implementation of the first aspect, in an eleventh possible implementation manner of the first aspect, After the determining that the second packet is an abnormal packet, the method further includes:

Receiving a third message from the first port;

Obtaining a third path, where the third path is path information that is performed inside the network element system when the third packet passes through the network element system, and the third path includes the third packet At least one node that passes through the network element system in chronological order.

In conjunction with the eleventh possible implementation manner of the first aspect, in a twelfth possible implementation manner of the first aspect, the method further includes:

And each of the nodes included in the third path is matched with a corresponding node included in the first path, where the service type of the third packet is the same as the service type of the first packet, Obtaining a second matching degree of the third path and the first path; or

If the service type of the third packet is the same as the service type of the fourth packet, the fourth path is obtained, where the fourth path is when the fourth packet passes the network element system. The path information that is experienced in the network element system, where the fourth path includes at least one node that the fourth packet passes in time sequence in the network element system, and the fourth packet is All the packets having the same service type as the service type of the third packet and passing through the network element system, the packets passing through the network element system for the first time; and each of the third paths is included The nodes respectively match the corresponding nodes included in the fourth path to obtain the second matching degree of the third path and the fourth path.

In conjunction with the twelfth possible implementation of the first aspect, in a thirteenth possible implementation manner of the first aspect, the method further includes:

If the second matching degree is lower than or equal to the first set threshold, reducing the allowed access traffic of the first port to a second reduced value, and the second reduced value is the The process of the third packet passing through the first port, the product of the maximum value of the actual access traffic of the first port and the second ratio value, wherein the second reduction value is not lower than the preset The minimum allowable access traffic of the first port is in the range of 1/5 to 1/2.

In conjunction with the twelfth possible implementation of the first aspect, in a fourteenth possible implementation manner of the first aspect, the method further includes:

If the second matching degree is higher than the second set threshold, increasing the allowed access traffic of the first port to a first increased value, and the first increasing value is the third The maximum value of the actual value of the actual access traffic of the first port and the third ratio value during the process of the packet passing through the first port, where the first increase value is not higher than the preset maximum allowable value. Accessing the traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold is in a range of 70% to 80%, and the value of the third ratio is The range is 2 to 5.

In a second aspect, an adaptive anti-attack device is provided, which is applied to a network element system, and the device includes:

a first receiving unit, configured to receive a second packet from a first port of the network element system, where the network element system includes at least one port, where the first port is one of the at least one port, and The network element system includes multiple nodes inside;

a first acquiring unit, configured to acquire a pre-stored first path according to a service type of the second packet, where the first path is when the first packet passes the network element system, and the network element system Path information that is internally experienced, the first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is all having the second The packet of the service type of the same type of the packet and the packet passing through the network element system passes through the packet of the network element system for the first time;

a second acquiring unit, configured to acquire a second path, where the second path is path information that is experienced inside the network element system when the second packet passes through the network element system, where the second path includes At least one node that the second packet passes in the order of time in the network element system;

a first matching unit, configured to match each node included in the first path with a corresponding node included in the second path, to obtain a first matching degree of the second path and the first path ;

a comparing unit, configured to compare the first matching degree with a first set threshold, and if the first matching degree is lower than the first set threshold, determining that the second packet is an abnormal packet The first set threshold is set according to the tolerance of the service type to the bit error rate or the communication delay;

And in the case that the comparing unit determines that the second packet is an abnormal packet, the adjusting unit is configured to reduce the allowed access traffic of the first port.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the at least one node included in the first path and the at least one node included in the second path are respectively sorted in a chronological order. Then, nodes located in the first path and having the same order in the second path correspond to each other.

In combination with the second aspect or the first possible implementation of the second aspect, the second In an implementation manner, the first set threshold value ranges from 60% to 70%.

With reference to the second aspect, the first possible implementation of the second aspect, or the second possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the device further includes:

a third receiving unit, configured to receive the first packet from any port of the network element system;

And a seventh acquiring unit, configured to acquire the first path that is experienced inside the network element system when the first packet passes through the network element system, and perform storage processing on the first path.

With reference to the second aspect or the first possible implementation of the second aspect to any one of the third possible implementation manners of the second aspect, in a fourth possible implementation manner of the second aspect, the first The matching unit is specifically used to:

With reference to the second aspect, or the first possible implementation of the second aspect, to any one of the possible implementations of the third possible implementation of the second aspect, in a fifth possible implementation manner of the second aspect, A path includes n1 nodes,

Then the device further comprises:

And a third acquiring unit, configured to acquire traffic of each of the n1 nodes included in the first path.

With reference to the fifth possible implementation of the second aspect, in a sixth possible implementation manner of the second aspect, the second path includes n2 nodes,

Then the device further comprises:

And a fourth acquiring unit, configured to acquire traffic of each of the n2 nodes included in the second path.

With reference to the sixth possible implementation of the second aspect, in a seventh possible implementation manner of the second aspect, the first matching unit is specifically configured to:

With reference to the fifth possible implementation of the second aspect, in an eighth possible implementation manner of the second aspect, the device further includes:

After the third obtaining unit acquires the traffic of each of the n1 nodes included in the first path,

The first normalization processing unit is configured to normalize the traffic of each of the n1 nodes by using the following formula:

The maximum value of the traffic of the n1 nodes.

In conjunction with the sixth possible implementation of the second aspect, in a ninth possible implementation manner of the second aspect, the device further includes:

After the fourth obtaining unit acquires the traffic of each of the n2 nodes included in the second path,

The second normalization processing unit is configured to normalize the traffic of each of the n2 nodes by using the following formula:

With reference to the second aspect or the first possible implementation of the second aspect to any one of the possible implementation manners of the ninth possible implementation manner of the second aspect, in the tenth possible implementation manner of the second aspect, the adjusting The unit is specifically used to:

With reference to the second aspect, or the first possible implementation of the second aspect, to any one of the possible implementations of the tenth possible implementation of the second aspect, in an eleventh possible implementation manner of the second aspect, The device also includes:

After the adjusting unit decreases the allowed access traffic of the first port,

a second receiving unit, configured to receive a third packet from the first port;

a fifth acquiring unit, configured to acquire a third path, where the third path is path information that is experienced inside the network element system when the third packet passes through the network element system, where the third path includes The third packet is at least one node that passes through the network element system in chronological order.

With reference to the eleventh possible implementation of the second aspect, in a twelfth possible implementation manner of the second aspect, the device further includes:

a second matching unit, configured to: each node included in the third path and the first path, respectively, if a service type of the third packet is the same as a service type of the first packet Corresponding nodes are matched to obtain a second matching degree of the third path and the first path; or

The device includes:

a sixth acquiring unit, configured to acquire a pre-stored fourth path, where the fourth path is the fourth packet, if the service type of the third packet is the same as the service type of the fourth packet When the network element system passes through the path information that is experienced in the network element system, the fourth path includes at least one node that the fourth packet passes in time sequence in the network element system. The fourth packet is a packet that passes through the network element system for the first time in all the packets that have the same service type as the service type of the third packet and that pass through the network element system;

The second matching unit is configured to match each node included in the third path with a corresponding node included in the fourth path, to obtain a second matching degree of the third path and the fourth path.

In conjunction with the twelfth possible implementation of the second aspect, in the thirteenth possible implementation manner of the second aspect, the adjusting unit is further configured to:

If the second matching degree is lower than or equal to the first set threshold, reducing the allowed access traffic of the first port to a second reduced value, and the second reduced value is the The maximum value of the actual access traffic of the first port and the second ratio during the process of the third packet passing through the first port And the second reduction value is not lower than a preset minimum allowed access traffic of the first port, and the second ratio value ranges from 1/5 to 1/2.

In conjunction with the twelfth possible implementation of the second aspect, in the fourteenth possible implementation manner of the second aspect, the adjusting unit is further configured to:

It can be seen that the adaptive anti-attack method and device provided by the embodiment of the present invention receive the second packet through the first port of the network element system, and obtain the pre-stored first path according to the service type of the second packet. The first path is a packet that passes through the network element system for the first time, and obtains a second path, in the packet that is the same as the service type of the first packet, and that passes through the network element system. The second path is path information that is experienced inside the network element system when the second packet passes through the network element system, and then each node included in the first path is respectively included with the second path. The node performs matching to obtain the first matching degree. The first matching degree and the first set threshold are compared to determine whether the second packet is an abnormal packet, and the second packet is determined to be an abnormal packet. , reducing the allowed access traffic of the first port. After the packet is obtained, the method can automatically determine whether the packet is an abnormal packet, and if the packet is an abnormal packet, reduce the allowed access traffic of the port that receives the packet. It achieves adaptive anti-attack on abnormal packets, eliminates the cumbersome operation of firewall manual configuration, and effectively improves the dynamic identification and interception effect of network attacks.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

FIG. 1 is a schematic flowchart of an adaptive attack defense method according to an embodiment of the present disclosure;

2 is a schematic diagram of an exemplary message vector path;

3 is a schematic flowchart of another adaptive attack defense method according to an embodiment of the present invention;

Figure 4 is a schematic diagram of comparison of service packet attack defense effects;

FIG. 5 is a schematic flowchart diagram of still another adaptive attack defense method according to an embodiment of the present invention;

6 is an exemplary service node normalized traffic distribution diagram;

FIG. 7 is a schematic structural diagram of an adaptive anti-attack device according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of another adaptive attack defense device according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of still another adaptive anti-attack device according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In the prior art, the firewall unit is independent of the network element system, and does not have the ability to identify and analyze the service type. Therefore, the abnormal message recognition capability of the "smart design" camouflage is weak, and the adaptive anti-attack device of the present invention is involved. It is set in the NE system to monitor packets processed by each node in the NE system. The packet passes through any of the network element systems, and multiple nodes included in the network element system process the packets in sequence, and the packets received from the port are passed through the nodes in the network element system in time order. And the matching of the packets of the same type of the packet, and the packets passing through the network element system for the first time are matched, and the matching degree of the path is obtained, and the received packet is determined to be an abnormal packet according to the matching degree. If the packet is an abnormal packet, the device can reduce the allowed access traffic of the port that receives the packet, so as to achieve adaptive attack defense against abnormal packets, eliminate the cumbersome operation of the firewall manual configuration, and effectively improve the network attack. Dynamic recognition and interception effects.

The adaptive anti-attack method provided by the embodiment of the present invention is described in detail below with reference to FIG. 1 to FIG.

FIG. 1 is a schematic flowchart of an adaptive attack defense method according to an embodiment of the present invention, where the method includes the following steps:

Step S101: Receive a second packet from a first port of the network element system, where the network element system includes at least one port, the first port is one of the at least one port, and the network element system includes Multiple nodes.

The network element system in this embodiment may be any communication network element such as a router, a switch, or a mobility management entity (English: Mobility Management Entity, MME for short), and the network element system includes multiple ports, and the internal network includes multiple The node, the network element system can receive packets sent by other network element systems from any port, and the packets pass through one or more nodes in the network element system in turn, and each node processes the packets separately, and each node performs authentication. , analysis and other processing. The second packet here is generally a packet of the service type that is not passed through the network element system for the first time.

Step S102: Acquire a pre-stored first path according to the service type of the second packet, where the first path is a path that is experienced inside the network element system when the first packet passes through the network element system. The first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is all services that have the second packet. The packets passing through the NE system are passed through the packets of the NE system for the first time.

Before receiving the second packet, the network element system receives the first packet from any port of the network element system, and obtains the first packet when the first packet passes the network element system, in the network element system. The first path is internally processed, and the first path is stored, and the first packet is a packet that passes through the network element system for the first time. When there is a newly registered service, or when the attributes of the service are changed, for example, some configurations of the service are changed, or the version of the service is upgraded, when the packets pass through the service processing system, the type of the service changes, and The path of the processing node or the node that passes through the system may change. The path that the service packet passes through is re-learned. The packet is considered to be the first packet passing through the NE system. Therefore, when there is a new registration. When the service is changed, or the attribute of the service is changed, the path information that is learned in the network element system when the first packet passes through the network element system is triggered. The path includes the packet passing through the time in the network element system. One or more nodes. The path is classified into a network element system, a node, or a cloud server according to the type of service. Therefore, the first path of the packet of the service type can be obtained according to the service type of the second packet.

Figure 2 is a schematic diagram of the packet vector path. For each type of service packet, the network element system The internal processing of the system has the corresponding node processing. The packet of the A service type is taken as an example. After the normal packet enters the NE system, it needs to pass the authentication, registration, and hierarchical processing. The processing path is: CCU—> MDU—>MIU—>SIG—>CSU—>IFU, where CCU, MDU, MIU, SIG, CSU, and IFU are nodes inside the network element system; the processing path of B service type packets is: CCU— >CSU—>MIU—>MDU—>SIG—>IFU.

The message is modeled by the direction vector diagram as follows:

a _n+1 =p ₁ a _n +p ₂ a _n-1 +p ₃ a _n-2 +...+p _k a _n-k+1 ......Formula (1)

Where p _k represents whether the service packet of the type passes the node, and the value of p _k is 0 or 1, and a _n represents the location information of the node where the packet is located at time n; a _n+1 represents the normal message at the next moment. Expected path information.

Step S103, the second path is obtained, where the second path is path information that is experienced inside the network element system when the second packet passes through the network element system, and the second path includes the second path. At least one node that the message passes in the order of time within the network element system.

When the second packet passes through the network element system, the path information that is experienced in the network element system is the second path. The second packet passes through one or more nodes in the order of time in the network element system. Passed node information.

Step S104: Match each node included in the first path with a corresponding node included in the second path to obtain a first matching degree of the second path and the first path.

Before performing node or path matching, at least one node included in the first path and at least one node included in the second path are respectively sorted according to a time sequence, and then located in the first path and located in the second path. The nodes having the same sequence are corresponding, and then each node included in the first path is matched with the corresponding node included in the second path to obtain the matching degree of the second path and the first path.

In step S105, the first matching degree is compared with the first set threshold. If the first matching degree is lower than the first set threshold, the second packet is determined to be an abnormal packet. The first set threshold is set according to the tolerance of the service type to the bit error rate or the communication delay.

The packets of the service type are highly tolerant to the bit error rate or the communication delay. That is, the order of the internal nodes of a certain NE system that the packets are allowed to pass through is different from that of the packets passing through the NE system for the first time. , The packets of the service type are less tolerant to the bit error rate or the communication delay. The order of the internal nodes of a certain NE system that the packets pass through is less than the difference between the packets passing through the NE system for the first time. Therefore, different matching thresholds are set for different service types. If the matching degree between the obtained second packet and the path of the first packet is lower than the threshold, the second packet is determined to be an abnormal packet. .

Step S106: If it is determined that the second packet is an abnormal packet, reduce the allowed access traffic of the first port.

When it is determined that the second packet is an abnormal packet, the abnormal traffic can be prevented from initiating a large-scale attack on the network element system by reducing the allowed access traffic of the port that receives the second packet.

An adaptive anti-attack method according to the embodiment of the present invention, the node that passes the packets received from the port in the order of the time in the network element system is the same as the service type of the packet, and The first time that the packet passing through the packet of the NE system is matched, the matching degree of the path is obtained, and the received packet is determined to be an abnormal packet according to the matching degree. If the packet is an abnormal packet, Reduce the allowable access traffic of the port that receives the packet, so as to achieve adaptive attack defense against abnormal packets, eliminate the cumbersome operation of the firewall manual configuration, and effectively improve the dynamic identification and interception effect of the network attack.

FIG. 3 is a schematic flowchart of another adaptive attack defense method according to an embodiment of the present invention, where the method includes the following steps:

Step S201: Receive a second packet from the first port of the network element system, where the network element system includes at least one port, the first port is one of the at least one port, and the network element system includes Multiple nodes.

Step S202: Acquire a pre-stored first path according to the service type of the second packet, where the first path is a path that is experienced inside the network element system when the first packet passes through the network element system. The first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is all services that have the second packet. The packets passing through the NE system are passed through the packets of the NE system for the first time.

Step S203, the second path is obtained, where the second path is that the second packet passes the network element. In the system, the path information that is experienced in the network element system, the second path includes at least one node that the second packet passes in time sequence in the network element system.

Steps S201-S203 are the same as steps S101-S103 of the embodiment shown in FIG. 1, and details are not described herein again.

Step S204, matching each node included in the first path with a corresponding node included in the second path, to determine whether each node included in the first path is corresponding to the second path The nodes are the same, and the first matching degree of the second path and the first path is obtained.

Before performing node or path matching, at least one node included in the first path and at least one node included in the second path are respectively sorted according to a time sequence, and then located in the first path and located in the second path. Nodes having the same order are corresponding, and then each node included in the first path is respectively matched with a corresponding node included in the second path to determine whether each node included in the first path includes the second path. The corresponding nodes are the same to obtain the matching degree of the second path and the first path.

As shown in Figure 2, the service packets of the A service type should pass through these nodes in sequence: CCU->MDU->MIU->SIG->CSU->IFU, assuming that the current service of the set type is detected. The third and fourth nodes passing through the message are different from the normal order learned above, and the matching degree is considered to be 4/6=66.7%.

In step S205, the first matching degree is compared with the first set threshold. If the first matching degree is lower than the first set threshold, the second packet is determined to be an abnormal packet. The first set threshold is set according to the tolerance of the service type to the bit error rate or the communication delay.

Step S206: When it is determined that the second packet is an abnormal packet, reduce the allowed access traffic of the first port to a first reduced value.

Different matching thresholds are set according to different tolerances of different service types to the error rate or the communication delay. The threshold ranges from 60% to 70%. If the matching degree between the obtained second packet and the path of the first packet is lower than the threshold, the second packet may be determined to be an abnormal packet.

If it is determined that the service packet is abnormal, the method of adjusting the allowed access traffic of the port that receives the packet is triggered to prevent packet attack. Specifically, for the packet flow whose matching degree is higher than the set threshold, the packet is determined to be a legal packet, and the access traffic is not controlled; for the packet flow whose matching degree is lower than the set threshold, the packet is determined to be an abnormal packet, and Start the defense mechanism to reduce the allowed access traffic of the port. Allowed access to the stream The amount is reduced, and the attack on the system by the abnormal service message is relatively small.

In this embodiment, the allowed access traffic of the port is reduced step by step, which can reduce the impact of the short-time pulse attack on the packet. Specifically, in the case that the second packet is determined to be an abnormal packet, the allowed access traffic of the first port is reduced to a first reduced value, and the first reduced value is the second packet. a process of the first port, the maximum value of the actual access traffic of the first port is multiplied by a first ratio, wherein the first reduction value is not lower than the preset first port. The minimum allowable access traffic, the first ratio value ranges from 1/5 to 1/2.

Step S207: Receive a third packet from the first port.

Step S208, the third path is obtained, where the third path is path information that is experienced inside the network element system when the third packet passes through the network element system, and the third path includes the third path. At least one node that the message passes in the order of time within the network element system.

The port receives the packet continuously. The service type of the received third packet may be the same as or different from the first packet or the second packet. Similarly, the path information that is experienced inside the network element system when the third packet passes through the network element system is obtained.

Step S209, in a case where the service type of the third packet is the same as the service type of the first packet, each node included in the third path is respectively associated with a corresponding node included in the first path. Matching is performed to obtain a second matching degree of the third path and the first path.

Step S210: If the service type of the third packet is the same as the service type of the fourth packet, obtain a fourth path that is stored in advance, where the fourth path is that the fourth packet passes the network. The path information that is experienced in the network element system, the fourth path includes at least one node that the fourth packet passes in time sequence in the network element system, and the fourth The packet is the packet that passes through the network element system for the first time in all the packets that have the same service type as the third packet and that pass through the network element system.

Step S211, each node included in the third path is matched with a corresponding node included in the fourth path, to obtain a second matching degree of the third path and the fourth path.

When the matching degree of the newly received third packet is calculated, if the service type of the third packet is the same as the first packet, the third packet is matched with the path of the first packet to obtain the second matching. Degree, if the service type of the third packet is different from the first packet, obtain the same service type as the third packet, and The path of the fourth packet of the network element system is matched for the first time to match the path of the third packet with the fourth packet to obtain the second matching degree.

Step S212, if the second matching degree is lower than or equal to the first set threshold, reducing the allowed access traffic of the first port to a second reduced value, the second reduced value a process of the third packet passing through the first port, the maximum value of the actual access traffic of the first port, and a second ratio value, wherein the second reduction value is not lower than the pre-predetermined value. The minimum allowable access traffic of the first port is set, and the second ratio value ranges from 1/5 to 1/2.

If the matching degree of the newly received packet is still lower than or equal to the first set threshold, the allowed access traffic of the port is again reduced according to a certain ratio.

It should be noted that reducing the allowed access traffic of the port is performed step by step, that is, the process of S207-S212 is cyclic until the allowed access traffic of the port is not lower than the preset minimum allowable of the first port. Access traffic.

Step S213, if the second matching degree is higher than the second set threshold, increasing the allowed access traffic of the first port to a first increasing value, where the first increasing value is During the process of the third packet passing through the first port, the maximum value of the actual access traffic of the first port is the product of the third ratio value, wherein the first increase value is not higher than the preset. The highest allowable access traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold is in a range of 70% to 80%, the third ratio The value ranges from 2 to 5.

However, if the matching degree of the newly received packet is higher than the second set threshold, the allowed access traffic of the port is restored, and the recovery process is performed step by step, and the allowed connection of the port is gradually reduced. The process of entering traffic is similar.

For example, the defense implementation adopts a binary exponential backoff algorithm to effectively implement the traffic restriction of the abnormal access port; and maintain the minimum traffic standard, and automatically recover the abnormality when the port attack behavior disappears.

Specifically, when the matching degree between the packet flow and the vector path migration model flowing from the port is lower than the threshold, the allowed access traffic of the port is decremented to 1/2 of the previous period setting threshold, and the abnormal attack is suppressed to the system. The degree of influence of the text processing; after the minimum traffic standard (the minimum traffic standard is set according to the traffic in the normal period of the port, the default is 5%), no further down-regulation, and the port shape is monitored in real time. When the matching degree between the packet flow and the vector path migration model of the abnormal node is restored to be higher than the threshold, the traffic limit of the port is adjusted to twice the threshold set in the previous cycle, and the access capability is gradually restored until the port is allowed. Maximum flow threshold.

The defense algorithm can try to avoid the black hole of the node, that is, avoid the "unrecoverable exception". The black hole of the node means that a node is restricted by the system due to abnormal behavior. When the normal state is restored after a certain period of time, the historical abnormality cannot be eliminated and recovered. The system is normally connected.

We construct a packet flow with a valid protocol type and an abnormal service type, and perform a large traffic impact on the system to observe the abnormal defense capability of the system. As shown in Figure 4, it is a comparison diagram of the defense effect of the service packet attack, and the abscissa indicates the strength of the attack packet. (Unit: packet per second), the ordinate indicates the load level of the system (the CPU usage is shown in the figure, the unit is a percentage; it can also be measured by the occupancy rate of other key resources), and the curve 1 is the service with the general defense strategy. The packet defense attack defense effect, the common defense policy uses a separate firewall unit to enable the traffic attack related configuration; the curve 2 is the adaptive anti-attack method of the embodiment. It can be clearly seen that the adaptive attack defense method of the present embodiment can effectively reduce the impact of abnormal attack packets on the system, and ensure service access and smooth operation of the normal port.

An adaptive anti-attack method according to the embodiment of the present invention, the node that passes the packets received from the port in the order of the time in the network element system is the same as the service type of the packet, and The first time that the packet passing through the packet of the NE system is matched, the matching degree of the path is obtained, and the received packet is determined to be an abnormal packet according to the matching degree. If the packet is an abnormal packet, The access control traffic of the port that receives the packet is reduced step by step, so as to achieve adaptive attack defense against abnormal packets, eliminate the cumbersome operation of the manual configuration of the firewall, and effectively improve the dynamic identification and interception effect of the network attack; When the matching degree is increased, the allowed access traffic of the port can be quickly restored to avoid the instability of the NE system.

FIG. 5 is a schematic flowchart of still another method for implementing an adaptive attack defense according to an embodiment of the present invention. The method includes the following steps:

Step S301: Receive a second packet from the first port of the network element system, where the network element system includes at least one port, the first port is one of the at least one port, and the network element system includes Multiple nodes.

This step is the same as step S101 or S102 of the embodiment shown in FIG. 1 or FIG. 3, and details are not described herein again.

Step S302: Acquire a pre-stored first path according to the service type of the second packet, and acquire traffic of each node of the n1 nodes included in the first path.

The step of acquiring the first path stored in advance is the same as the step S102 or S202 of the embodiment shown in FIG. 1 or FIG. 3, and details are not described herein again. However, the present embodiment also requires acquiring the traffic of each of the n1 nodes included in the first path, simultaneously with or after acquiring the first path stored in advance. The packets pass through the nodes of the NE system in sequence. The traffic of different packets on the same node may be the same or different.

Step S303, acquiring a second path, and acquiring traffic of each of the n2 nodes included in the second path.

The step of acquiring the second path is the same as the step S103 or S203 of the embodiment shown in FIG. 1 or FIG. 3, and details are not described herein again. Similarly, while acquiring the second path, the embodiment further requires acquiring the traffic of each of the n2 nodes included in the second path.

Step S304, normalizing the traffic of each of the n1 and n2 nodes respectively.

Since the traffic is a large value, the traffic matching of each node is directly performed, and the calculation amount is large. Therefore, the traffic of each node in the n1 and n2 nodes can be normalized separately, as follows:

The traffic of each node in the n1 nodes is normalized by using the following formula (2):

...formula (2)

The maximum value of the traffic of the n1 nodes.

The traffic of each node in the n2 nodes is normalized by using the following formula (3):

...formula (3)

Where f _y is the traffic of the node y after the normalization process, and the value of y ranges from 1 to n2, and F _y is the traffic of the node y.

The maximum value of the traffic of the n2 nodes.

Taking service type A as an example, based on the normalized traffic algorithm, the statistical distribution of traffic characteristics of each node is shown in FIG. 6.

Step S305, matching traffic of each node in the n2 nodes with traffic of a corresponding node in the n1 nodes, respectively, to determine a traffic distribution of the n2 nodes and a traffic distribution of the n1 nodes. Whether they are the same, and then acquiring the first matching degree of the second path and the first path.

The traffic of each node in the n2 nodes is matched with the traffic of the corresponding node in the n1 nodes, so that it can be determined whether the traffic distribution of the n2 nodes is the same as the traffic distribution of the n1 nodes, specifically The matching technique may refer to the prior art to determine whether the traffic distribution of the n2 nodes is the same as the traffic distribution of the n1 nodes, so that the first matching degree of the second path and the first path may be acquired.

Step S306: The first matching degree is compared with the first set threshold. If the first matching degree is lower than the first set threshold, the second packet is determined to be an abnormal message.

Step S307, in the case that the second packet is determined to be an abnormal packet, the allowed access traffic of the first port is reduced to a first reduced value, and the first reduced value is the second reported The first value of the actual value of the actual access traffic of the first port is the product of the first ratio value, wherein the first reduction value is not lower than the preset first The minimum allowable access traffic of the port, the first ratio value ranges from 1/5 to 1/2.

Step S308, receiving a third packet from the first port.

Step S309, acquiring a third path, and acquiring traffic of each of the n3 nodes included in the third path.

The third path is path information that is experienced in the network element system when the third packet passes through the network element system, and the third path includes the third packet in the network element system. At least one node that passes internally in chronological order.

Step S310, if the service type of the third packet is the same as the service type of the first packet, the traffic of each node in the n3 nodes is respectively corresponding to the n1 nodes. The traffic of the node is matched to determine the traffic distribution of the n3 nodes and the flow of the n1 nodes. Whether the quantity distribution is the same, and then acquiring the second matching degree of the third path and the first path.

Step S311: If the service type of the third packet is the same as the service type of the fourth packet, obtain a fourth path stored in advance, and acquire each node of the n4 nodes included in the fourth path. Traffic.

Step S312, matching the traffic of each node of the n3 nodes with the traffic of the corresponding node of the n4 nodes, respectively, to determine the traffic distribution of the n3 nodes and the traffic distribution of the n4 nodes. Whether they are the same, and then acquiring the second matching degree of the third path and the fourth path.

Step S313, if the second matching degree is lower than or equal to the first set threshold, reducing the allowed access flow of the first port to a second reduced value, the second reduced value a process of the third packet passing through the first port, the maximum value of the actual access traffic of the first port, and a second ratio value, wherein the second reduction value is not lower than the pre-predetermined value. The minimum allowable access traffic of the first port is set, and the second ratio value ranges from 1/5 to 1/2.

Step S314, if the second matching degree is higher than the second set threshold, increasing the allowed access traffic of the first port to a first increasing value, where the first increasing value is During the process of the third packet passing through the first port, the maximum value of the actual access traffic of the first port is the product of the third ratio value, wherein the first increase value is not higher than the preset. The highest allowable access traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold is in a range of 70% to 80%, the third ratio The value ranges from 2 to 5.

The process of the steps S306-S314 is to perform the process of determining the abnormality of the packet and the process of adjusting the allowed access traffic of the port, which is similar to the foregoing embodiment, except that the matching degree of the newly received packet is obtained. The traffic of each node in the network element system through which the newly received packet passes, the traffic of each node and the webpage system through which the packet of the service type passes through the network element system for the first time. The traffic of each node of multiple nodes is compared to determine whether their traffic distribution is the same, thereby obtaining the matching degree of the path.

An adaptive anti-attack method according to the embodiment of the present invention, the node that passes the packets received from the port in the order of the time in the network element system is the same as the service type of the packet, and The traffic of the passing node of the packet passing through the NE system is matched for the first time to obtain the path. The matching degree is determined according to the matching degree, and whether the received packet is an abnormal packet, and when the packet is an abnormal packet, the allowed access traffic of the port receiving the packet is gradually decreased, thereby achieving The adaptive anti-attack of abnormal packets eliminates the cumbersome operation of the manual configuration of the firewall, effectively improves the dynamic identification and interception effect of the network attack, and can quickly restore the allowed access traffic of the port when the matching degree is increased. To avoid the instability of the network element system.

The adaptive anti-attack device provided by the embodiment of the present invention is described in detail below with reference to FIG. 7 to FIG.

FIG. 7 is a schematic structural diagram of an adaptive anti-attack device according to an embodiment of the present invention. The device 1000 is located in a network element system and is a monitoring device independent of a service processing node of a webpage system. The device 1000 includes:

The first receiving unit 11 is configured to receive a second packet from a first port of the network element system, where the network element system includes at least one port, the first port is one of the at least one port, and the The network element system includes multiple nodes inside.

The network element system in this embodiment may be any communication network element such as a router, a switch, or a mobility management entity (English: Mobility Management Entity, MME for short), and the network element system includes multiple ports, and the internal network includes multiple The first receiving unit 11 can receive the packet sent by the other network element system from any port, and the packet passes through one or more nodes in the network element system, and each node processes the packet separately, and each node performs the packet processing. Authentication, analysis and other processing. The second packet here is generally a packet of the service type that is not passed through the network element system for the first time.

The first obtaining unit 12 is configured to acquire a pre-stored first path according to the service type of the second packet, where the first path is when the first packet passes the network element system, and the network element is Path information that is experienced by the system, the first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is all For the first time, the packets of the service type of the second packet pass through the packet of the network element system.

Before receiving the second packet, the third receiving unit (not shown) is configured to receive the first packet from any port of the network element system, and the seventh acquiring unit (not shown) For obtaining the first report When the text passes through the network element system, the first path that is experienced in the network element system, and the first path is stored, and the first packet is a packet that passes through the network element system for the first time. . When there is a newly registered service, or when the attributes of the service are changed, for example, some configurations of the service are changed, or the version of the service is upgraded, when the packets pass through the service processing system, the type of the service changes, and The path of the processing node or the node that passes through the system may change. The path that the service packet passes through is re-learned. The packet is considered to be the first packet passing through the NE system. Therefore, when there is a new registration. When the service is changed, or the attribute of the service is changed, the path information that is learned in the network element system when the first packet passes through the network element system is triggered. The path includes the packet passing through the time in the network element system. One or more nodes. The path is classified into a network element system, a node, or a cloud server according to the type of service. Therefore, the first obtaining unit 12 may obtain the first path of the packet of the service type according to the service type of the second packet.

As shown in Figure 2, the packet vector path diagram is used. For each type of service packet, the network element system has a corresponding node processing link. The packet of the A service type is taken as an example, and the normal packet enters the network element. After the system, it needs to pass the authentication, registration, hierarchical processing and other business links. The processing path is: CCU->MDU->MIU->SIG->CSU->IFU, among them, CCU, MDU, MIU, SIG, CSU, The IFU is a node inside the network element system; the processing path of the B service type packet is: CCU->CSU->MIU->MDU->SIG->IFU.

The message is modeled by the direction vector diagram as follows:

The second obtaining unit 13 is configured to acquire a second path, where the second path is path information that is experienced inside the network element system when the second packet passes through the network element system, and the second path is And including at least one node that the second packet passes in time sequence in the network element system.

The second obtaining unit 13 obtains the path information that is experienced in the network element system when the second packet passes through the network element system, that is, the second path, and the second packet passes through one or more times in the order of time in the network element system. Nodes can obtain node information that passes in sequence.

a first matching unit 14 configured to match each node included in the first path with a corresponding node included in the second path, to obtain a first match between the second path and the first path degree.

Before performing node or path matching, the first matching unit 14 sorts at least one node included in the first path and at least one node included in the second path according to a time sequence, and the sum located in the first path is located. The nodes having the same order in the second path are corresponding, and then the first matching unit 14 matches each node included in the first path with the corresponding node included in the second path to obtain the second path and The degree of matching of the first path.

The comparing unit 15 is configured to compare the first matching degree with the first set threshold, and if the first matching degree is lower than the first set threshold, determine that the second packet is an abnormal report The first set threshold is set according to the tolerance of the service type to the error rate or the communication delay.

The packets of the service type are highly tolerant to the bit error rate or the communication delay. That is, the order of the internal nodes of a certain NE system that the packets are allowed to pass through is different from that of the packets passing through the NE system for the first time. The service type of the packet is less tolerant to the bit error rate or the communication delay. The order of the internal nodes of a certain NE system that the packet passes through is different from the packet passing through the NE system for the first time. If the matching degree of the obtained second packet and the path of the first packet is lower than the threshold, the comparing unit 15 may determine the second packet. It is an abnormal message.

In the case that the comparison unit 15 determines that the second packet is an abnormal packet, the adjusting unit 16 is configured to reduce the allowed access traffic of the first port.

In the case that the second packet is determined to be an abnormal packet, the adjusting unit 16 can prevent the abnormal packet from initiating a large-scale attack on the network element system by reducing the allowed access traffic of the port that receives the second packet.

According to an embodiment of the present invention, an adaptive attack defense device is configured to pass the packets received from the port in the sequence of time in the network element system, and the service type of the packet is the same as that of the packet. The first time that the packet passing through the packet of the NE system is matched, the matching degree of the path is obtained, and the received packet is determined to be an abnormal packet according to the matching degree. If the packet is an abnormal packet, Reduce the allowable access traffic of the port that receives the packet, so as to achieve adaptive attack defense against abnormal packets, eliminate the cumbersome operation of the firewall manual configuration, and effectively improve the network attack. Don't intercept the effect.

FIG. 8 is a schematic structural diagram of another adaptive anti-attack device according to an embodiment of the present invention. The device 2000 includes:

The first receiving unit 20 is configured to receive a second packet from the first port of the network element system, where the network element system includes at least one port, the first port is one of the at least one port, and the The network element system includes multiple nodes inside.

The first obtaining unit 21 is configured to acquire, according to the service type of the second packet, a first path that is stored in advance, where the first path is when the first packet passes the network element system, and the network element is Path information that is experienced by the system, the first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is all For the first time, the packets of the service type of the second packet pass through the packet of the network element system.

The second obtaining unit 22 is configured to acquire a second path, where the second path is path information that is experienced inside the network element system when the second packet passes through the network element system, and the second path is And including at least one node that the second packet passes in time sequence in the network element system.

The functions of the first receiving unit 20, the first obtaining unit 21, and the second obtaining unit 22 are the same as the first receiving unit 11, the first obtaining unit 12, and the second obtaining unit 13 of the embodiment shown in FIG. 7, respectively. Let me repeat.

a first matching unit 23, configured to match each node included in the first path with a corresponding node included in the second path, to determine whether each node included in the first path is related to the first The second path includes the same node, and the first matching degree of the second path and the first path is obtained.

Before performing node or path matching, the first matching unit 23 sorts at least one node included in the first path and at least one node included in the second path according to a sequence of time, and the sum located in the first path is located. The nodes having the same order in the second path are corresponding, and then the first matching unit 23 matches each node included in the first path with the corresponding node included in the second path, respectively, to determine that the first path includes Whether each node is associated with the corresponding section of the second path The points are the same to obtain the matching degree between the second path and the first path.

The comparing unit 23 is configured to compare the first matching degree with the first set threshold, and if the first matching degree is lower than the first set threshold, determine that the second packet is an abnormal report The first set threshold is set according to the tolerance of the service type to the error rate or the communication delay.

The adjusting unit 25 is configured to reduce the allowed access traffic of the first port to a first reduced value if the second packet is determined to be an abnormal packet.

Different matching thresholds are set according to different tolerances of different service types to the error rate or the communication delay. The threshold ranges from 60% to 70%. If the matching degree between the obtained second packet and the path of the first packet is lower than the threshold, the comparing unit 24 may determine that the second packet is an abnormal packet.

If it is determined that the service packet is abnormal, the trigger adjustment unit 25 adopts a manner of adjusting the allowed access traffic of the port that receives the packet to prevent packet attack. Specifically, for the packet flow whose matching degree is higher than the set threshold, the packet is determined to be a legal packet, and the access traffic is not controlled; for the packet flow whose matching degree is lower than the set threshold, the packet is determined to be an abnormal packet, and Start the defense mechanism to reduce the allowed access traffic of the port. The traffic allowed to be accessed is reduced, and the attack on the system by abnormal service packets is relatively small.

After the adjusting unit reduces the allowed access traffic of the first port, the second receiving unit 26 is configured to receive the third packet from the first port.

The fifth obtaining unit 27 is configured to acquire a third path, where the third path is path information that is experienced inside the network element system when the third packet passes through the network element system, and the third path is Including The third packet is at least one node that passes through the network element system in chronological order.

The port receives the packet continuously, and the service type of the third packet received by the second receiving unit 26 may be the same as or different from the first packet or the second packet. Similarly, the fifth obtaining unit 27 acquires path information that is experienced inside the network element system when the third packet passes through the network element system.

a second matching unit 28, configured to: each node included in the third path and the first one, respectively, if a service type of the third packet is the same as a service type of the first packet The corresponding node included in the path performs matching to obtain the second matching degree of the third path and the first path.

The sixth obtaining unit 29 is configured to acquire a pre-stored fourth path, where the fourth path is the fourth report, if the service type of the third packet is the same as the service type of the fourth packet When the text passes through the network element system, the path information that is experienced in the network element system, the fourth path includes at least one node that the fourth packet passes in time sequence in the network element system. The fourth packet is a packet that passes through the network element system for the first time in all the packets that have the same service type as the service type of the third packet and that pass through the network element system.

The second matching unit 28 is further configured to match each node included in the third path with a corresponding node included in the fourth path to obtain a second matching degree of the third path and the fourth path.

When calculating the matching degree of the newly received third packet, if the service type of the third packet is the same as the first packet, the second matching unit 28 matches the third packet with the path of the first packet. Obtaining a second matching degree. If the service type of the third packet is different from the first packet, the path of the fourth packet that is the same as the service type of the third packet and passes through the network element system for the first time is obtained. The three packets are matched with the path of the fourth packet to obtain a second matching degree.

The adjusting unit 25 is further configured to reduce the allowed access traffic of the first port to a second reduced value if the second matching degree is lower than or equal to the first set threshold, where The second reduction value is a product of a maximum value of the actual access traffic of the first port and a second ratio value in the process of the third packet passing through the first port, where the second reduction value is not The minimum allowable access traffic of the first port is lower than the preset, and the second ratio value ranges from 1/5 to 1/2.

It should be noted that reducing the allowed access traffic of the port is performed step by step, that is, the process is cyclic until the allowed access traffic of the port is not lower than the preset minimum allowed access traffic of the first port. .

The adjusting unit 25 is further configured to increase the allowed access traffic of the first port to a first increased value, where the second matching degree is higher than a second set threshold, the first increase The value is a product of a maximum value of the actual access traffic of the first port and a third ratio value in the process of the third packet passing through the first port, where the first increase value is not high. The preset maximum allowable access traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold ranges from 70% to 80%, the first The three-ratio value ranges from 2 to 5.

Specifically, when the matching degree between the packet flow and the vector path migration model flowing from the port is lower than the threshold, the allowed access traffic of the port is decremented to 1/2 of the previous period setting threshold, and the abnormal attack is suppressed to the system. The degree of influence of the text processing; after the minimum traffic standard (the minimum traffic standard is set according to the traffic in the normal period of the port, the default is 5%), no longer down, and the status of the port is monitored in real time; When the matching degree between the stream and the vector path migration model is restored to be higher than the threshold, the traffic limit of the port is adjusted to twice the threshold set by the previous period, and the access capability is gradually restored until the maximum traffic threshold allowed by the port is reached.

We construct a packet flow with a valid protocol type and an abnormal service type, and perform a large traffic impact on the system to observe the abnormal defense capability of the system. As shown in Figure 4, it is a comparison diagram of the defense effect of the service packet attack, and the abscissa indicates the strength of the attack packet. (unit: packet per second), the ordinate indicates the degree of load of the system (The CPU usage is shown in the figure. The unit is a percentage; it can also be measured by the occupancy rate of other key resources.) Curve 1 is the defense effect of the service packet attack with the common defense policy. The common defense policy is the independent firewall unit. Traffic attack related configuration; curve 2 is an adaptive anti-attack method using this embodiment. It can be clearly seen that the adaptive attack defense method of the present embodiment can effectively reduce the impact of abnormal attack packets on the system, and ensure service access and smooth operation of the normal port.

According to an embodiment of the present invention, an adaptive attack defense device is configured to pass the packets received from the port in the sequence of time in the network element system, and the service type of the packet is the same as that of the packet. The first time that the packet passing through the packet of the NE system is matched, the matching degree of the path is obtained, and the received packet is determined to be an abnormal packet according to the matching degree. If the packet is an abnormal packet, The access control traffic of the port that receives the packet is reduced step by step, so as to achieve adaptive attack defense against abnormal packets, eliminate the cumbersome operation of the manual configuration of the firewall, and effectively improve the dynamic identification and interception effect of the network attack; When the matching degree is increased, the allowed access traffic of the port can be quickly restored to avoid the instability of the NE system.

FIG. 9 is a schematic structural diagram of another adaptive anti-attack device according to an embodiment of the present invention. The device 3000 includes:

The first receiving unit 31 is configured to receive a second packet from the first port of the network element system, where the network element system includes at least one port, the first port is one of the at least one port, and the The network element system includes multiple nodes inside.

The first receiving unit 31 has the same functions as the first receiving unit 11 shown in FIG. 7 or the first receiving unit 20 shown in FIG. 8, and details are not described herein again.

The first obtaining unit 32 is configured to acquire a pre-stored first path according to the service type of the second packet.

The third obtaining unit 33 is configured to acquire traffic of each of the n1 nodes included in the first path.

The present embodiment further requires the third obtaining unit 33 to acquire the traffic of each of the n1 nodes included in the first path, while the first obtaining unit 32 acquires the first path stored in advance. The packets pass through the nodes of the NE system in sequence. The traffic of different packets on the same node may be the same or different.

After the third obtaining unit acquires the traffic of each of the n1 nodes included in the first path, the first normalization processing unit 34 is configured to use each node of the n1 nodes. The traffic is normalized separately.

Since the traffic is a large value, the traffic matching of each node is directly performed, and the calculation amount is large. Therefore, the traffic of each node in the n1 nodes can be normalized separately, as follows:

...formula (2)

The maximum value of the traffic of the n1 nodes.

The second obtaining unit 35 is configured to acquire the second path.

The fourth obtaining unit 36 is configured to acquire traffic of each of the n2 nodes included in the second path.

Similarly, the present embodiment further requires the fourth obtaining unit 36 to acquire the traffic of each of the n2 nodes included in the second path, while the second acquiring unit 33 acquires the second path.

After the fourth obtaining unit acquires the traffic of each of the n2 nodes included in the second path, the second normalization processing unit 37 is configured to use each of the n2 nodes. The traffic is normalized separately.

...formula (3)

a first matching unit 38, configured to separately send traffic of each of the n2 nodes to the n1 The traffic of the corresponding node in the nodes is matched to determine whether the traffic distribution of the n2 nodes is the same as the traffic distribution of the n1 nodes, and the first matching of the second path and the first path is obtained. degree.

The first matching unit 38 matches the traffic of each of the n2 nodes with the traffic of the corresponding node of the n1 nodes, so that the traffic distribution of the n2 nodes and the traffic of the n1 nodes may be determined. If the distribution is the same, the specific matching technique may refer to the prior art to determine whether the traffic distribution of the n2 nodes is the same as the traffic distribution of the n1 nodes, so that the first matching degree of the second path and the first path may be acquired.

The comparing unit 39 is configured to compare the first matching degree with the first set threshold, and if the first matching degree is lower than the first set threshold, determine that the second packet is an abnormal report Text.

The adjusting unit 40 is configured to reduce, when the second packet is an abnormal packet, the allowed access traffic of the first port to a first reduced value, where the first reduced value is The first packet is passed through the first port, and the maximum value of the actual access traffic of the first port is a product of a first ratio, where the first reduction value is not lower than a preset location. The minimum allowable access traffic of the first port, where the first ratio value ranges from 1/5 to 1/2.

After the adjusting unit reduces the allowed access traffic of the first port, the second receiving unit 41 is configured to receive the third packet from the first port.

The fifth obtaining unit 42 is configured to acquire a third path, and acquire traffic of each of the n3 nodes included in the third path.

The second matching unit 43 is configured to: when the service type of the third packet is the same as the service type of the first packet, the traffic of each node of the n3 nodes is respectively associated with the n1 The traffic of the corresponding one of the nodes is matched to determine whether the traffic distribution of the n3 nodes is the same as the traffic distribution of the n1 nodes, and the second matching of the third path and the first path is obtained. degree.

The sixth obtaining unit 44 is configured to: service type of the third packet and a service class of the fourth packet In the case of the same type, the pre-stored fourth path is acquired, and the traffic of each of the n4 nodes included in the fourth path is acquired.

The second matching unit 43 is further configured to match traffic of each of the n3 nodes with traffic of a corresponding one of the n4 nodes to determine a traffic distribution of the n3 nodes and the n4 Whether the traffic distributions of the nodes are the same, and the second matching degree of the third path and the fourth path is obtained.

The adjusting unit 40 is further configured to reduce the allowed access traffic of the first port to a second reduced value if the second matching degree is lower than or equal to the first set threshold, where The second reduction value is a product of a maximum value of the actual access traffic of the first port and a second ratio value in the process of the third packet passing through the first port, where the second reduction value is not The minimum allowable access traffic of the first port is lower than the preset, and the second ratio value ranges from 1/5 to 1/2.

The adjusting unit 40 is further configured to increase the allowed access traffic of the first port to a first increased value, where the second matching degree is higher than a second set threshold, the first increase The value is a product of a maximum value of the actual access traffic of the first port and a third ratio value in the process of the third packet passing through the first port, where the first increase value is not high. The preset maximum allowable access traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold ranges from 70% to 80%, the first The three-ratio value ranges from 2 to 5.

The function of the above unit is to perform the process of determining the abnormal packet and the process of adjusting the allowed access traffic of the port, which is similar to the foregoing embodiment, except that when the matching degree of the newly received message is acquired, the new receiving is obtained. The traffic of each of the plurality of nodes in the network element system through which the received message passes, and the traffic of each node and the number of webpage systems that the first type of the service type passes through the message of the network element system The traffic of each node of each node is compared to determine whether the traffic distribution is the same, so as to obtain the matching degree of the path.

According to an embodiment of the present invention, an adaptive attack defense device is configured to pass the packets received from the port in the sequence of time in the network element system, and the service type of the packet is the same as that of the packet. For the first time, the traffic passing through the packets of the NE system is matched, and the matching degree of the path is obtained. According to the matching degree, it is determined whether the received packet is an abnormal packet, and the packet is an abnormal packet. Down, stepping down the allowed access traffic of the port receiving the packet, thereby reaching the abnormality The adaptive anti-attack of the packet eliminates the cumbersome operation of the manual configuration of the firewall, effectively improves the dynamic identification and interception effect of the network attack, and can quickly restore the allowed access traffic of the port when the matching degree is increased. The instability of the network element system.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present invention is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present invention. In addition, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the above embodiments, the descriptions of the various embodiments are different, and the details that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented in hardware, firmware implementation, or a combination thereof. When implemented in software, the functions described above may be stored in or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a computer. For example, but not limited to, the computer readable medium may include a random access memory (RAM), a read-only memory (ROM), and an electrically erasable programmable read only memory (Electrically Erasable Programmable Read). -Only Memory, EEPROM), Compact DiscRead-Only Memory (CD-ROM) or other optical disc storage, disk storage media or other magnetic storage device, or can be used to carry or store expectations in the form of instructions or data structures. Program code and any other medium that can be accessed by a computer. Also. Any connection may suitably be a computer readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wireless technologies such as infrared, radio, and microwave, Then coaxial cable, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, wireless and microwave are included in the fixing of the associated medium. Disks and discs, as used in the present invention, include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy discs, and Blu-ray discs, where the disc is usually magnetically complex. The data is used, and the disc uses a laser to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable media.

In summary, the above description is only a preferred embodiment of the technical solution of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

An adaptive anti-attack method, comprising:

The first port of the network element system receives the second packet, the network element system includes at least one port, the first port is one of the at least one port, and the network element system includes multiple nodes. ;

Acquiring, according to the service type of the second packet, a first path that is stored in advance, where the first path is path information that is experienced in the network element system when the first packet passes through the network element system, The first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is the same as all the service types of the first packet. The packet passing the network element system for the first time in the packet of the service type and passing through the network element system;

Obtaining a second path, where the second path is path information that is performed inside the network element system when the second packet passes the network element system, and the second path includes the second packet At least one node that passes through the network element system in chronological order;

Matching each node included in the first path with a corresponding node included in the second path to obtain a first matching degree of the second path and the first path;

Comparing the first matching degree with the first set threshold, if the first matching degree is lower than the first set threshold, determining that the second packet is an abnormal packet, the first Setting the threshold is set according to the tolerance of the service type to the bit error rate or the communication delay;

And determining that the second packet is an abnormal packet, and reducing the allowed access traffic of the first port.
The method of claim 1 wherein:

Sorting at least one node included in the first path and at least one node included in the second path according to a sequence of time, and then located in the first path and located in the second path Nodes with the same order are corresponding.
Method according to claim 1 or 2, characterized in that it comprises:

The first set threshold has a value ranging from 60% to 70%.
The method according to any one of claims 1 to 3, wherein before the receiving the second packet from the first port of the network element system, the method further includes:

Receiving the first packet from any port of the network element system;

Obtaining the first path that is experienced inside the network element system when the first packet passes the network element system, and storing the first path.
The method according to any one of claims 1 to 4, wherein each node included in the first path is matched with a corresponding node included in the second path to obtain the first The first matching degree of the second path and the first path includes:

Matching each node included in the first path with a corresponding node included in the second path to determine whether each node included in the first path is the same as a corresponding node included in the second path, And acquiring a first matching degree of the second path and the first path.
The method according to any one of claims 1 to 4, wherein the first path comprises n1 nodes,

After the obtaining the pre-stored first path, the method further includes:

Obtaining traffic of each of the n1 nodes included in the first path.
The method of claim 6 wherein said second path comprises n2 nodes.

After the obtaining the second path, the method further includes:

Obtaining traffic of each of the n2 nodes included in the second path.
The method according to claim 7, wherein each node included in the first path is matched with a corresponding node included in the second path to obtain the second path and the The first matching degree of the first path specifically includes:

Matching traffic of each of the n2 nodes with traffic of a corresponding node of the n1 nodes, respectively, to determine a traffic distribution of the n2 nodes and a traffic distribution of the n1 nodes Whether they are the same, and then acquiring the first matching degree of the second path and the first path.
The method according to claim 6, wherein after the obtaining the traffic of each of the n1 nodes included in the first path, the method further includes:

The traffic of each node in the n1 nodes is separately normalized by using the following formula:

Where f x is the traffic of node x after normalization, x ranges from 1 to n1, and F x is the traffic of node x.
The maximum value of the traffic of the n1 nodes.
The method according to claim 7, wherein after the obtaining the traffic of each of the n2 nodes included in the second path, the method further includes:

The traffic of each of the n2 nodes is normalized by the following formula:

Where f y is the traffic of the node y after the normalization process, and the value of y ranges from 1 to n2, and F y is the traffic of the node y.
The maximum value of the traffic of the n2 nodes.
The method according to any one of claims 1 to 10, wherein, when determining that the second packet is an abnormal packet, reducing the allowed access traffic of the first port, specifically include:

When the second packet is determined to be an abnormal packet, the allowed access traffic of the first port is reduced to a first reduced value, and the first reduced value is the second packet passing through the second packet. In the process of the first port, the maximum value of the actual access traffic of the first port is the product of the first ratio, wherein the first reduction value is not lower than the preset minimum of the first port. The access rate is allowed to be allowed, and the first ratio value ranges from 1/5 to 1/2.
Method according to any one of claims 1 to 11, wherein said determining And after the second packet is an abnormal packet, after the allowed access traffic of the first port is decreased, the method further includes:

Receiving a third message from the first port;

Obtaining a third path, where the third path is path information that is performed inside the network element system when the third packet passes through the network element system, and the third path includes the third packet At least one node that passes through the network element system in chronological order.
The method of claim 12, further comprising:

And each of the nodes included in the third path is matched with a corresponding node included in the first path, where the service type of the third packet is the same as the service type of the first packet, Obtaining a second matching degree of the third path and the first path; or

If the service type of the third packet is the same as the service type of the fourth packet, the fourth path is obtained, where the fourth path is when the fourth packet passes the network element system. The path information that is experienced in the network element system, where the fourth path includes at least one node that the fourth packet passes in time sequence in the network element system, and the fourth packet is All the packets having the same service type as the service type of the third packet and passing through the network element system, the packets passing through the network element system for the first time; and each of the third paths is included The nodes respectively match the corresponding nodes included in the fourth path to obtain the second matching degree of the third path and the fourth path.
The method of claim 13 further comprising:

If the second matching degree is lower than or equal to the first set threshold, reducing the allowed access traffic of the first port to a second reduced value, and the second reduced value is the The process of the third packet passing through the first port, the product of the maximum value of the actual access traffic of the first port and the second ratio value, wherein the second reduction value is not lower than the preset The minimum allowable access traffic of the first port is in the range of 1/5 to 1/2.
The method of claim 13 further comprising:

If the second matching degree is higher than the second set threshold, increasing the allowed access traffic of the first port to a first increased value, and the first increasing value is the third The maximum value of the actual value of the actual access traffic of the first port and the third ratio value during the process of the packet passing through the first port, where the first increase value is not higher than the preset maximum allowable value. Accessing the traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold is in a range of 70% to 80%, and the value of the third ratio is The range is 2 to 5.
An adaptive anti-attack device is applied to a network element system, and includes:

a first receiving unit, configured to receive a second packet from a first port of the network element system, where the network element system includes at least one port, where the first port is one of the at least one port, and The network element system includes multiple nodes inside;

a first acquiring unit, configured to acquire a pre-stored first path according to a service type of the second packet, where the first path is when the first packet passes the network element system, and the network element system Path information that is internally experienced, the first path includes at least one node that the first packet passes in time sequence in the network element system, and the first packet is all having the second The packet of the service type of the same type of the packet and the packet passing through the network element system passes through the packet of the network element system for the first time;

a second acquiring unit, configured to acquire a second path, where the second path is path information that is experienced inside the network element system when the second packet passes through the network element system, where the second path includes At least one node that the second packet passes in the order of time in the network element system;

a first matching unit, configured to match each node included in the first path with a corresponding node included in the second path, to obtain a first matching degree of the second path and the first path ;

a comparing unit, configured to compare the first matching degree with a first set threshold, and if the first matching degree is lower than the first set threshold, determining that the second packet is an abnormal packet The first set threshold is set according to the tolerance of the service type to the bit error rate or the communication delay;

And in the case that the comparing unit determines that the second packet is an abnormal packet, the adjusting unit is configured to reduce the allowed access traffic of the first port.
The device of claim 16 wherein:

Sorting at least one node included in the first path and at least one node included in the second path according to a sequence of time, and then located in the first path and located in the second path Nodes with the same order are corresponding.
The device according to claim 16 or 17, wherein:

The first set threshold has a value ranging from 60% to 70%.
The device according to any one of claims 16 to 18, wherein the first matching unit is specifically configured to:

Matching each node included in the first path with a corresponding node included in the second path to determine whether each node included in the first path is the same as a corresponding node included in the second path, And acquiring a first matching degree of the second path and the first path.
The apparatus according to any one of claims 16 to 18, wherein the first path comprises n1 nodes,

Then the device further comprises:

And a third acquiring unit, configured to acquire traffic of each of the n1 nodes included in the first path.
The apparatus according to claim 20, wherein said second path comprises n2 nodes,

Then the device further comprises:

And a fourth acquiring unit, configured to acquire traffic of each of the n2 nodes included in the second path.
The apparatus according to claim 21, wherein said first matching unit is specific Used for:

Matching the traffic of each of the n2 nodes with the traffic of the corresponding node of the n1 nodes, respectively, to determine whether the traffic distribution of the n2 nodes is the same as the traffic distribution of the n1 nodes, And acquiring a first matching degree of the second path and the first path.
The device of claim 20, wherein the device further comprises:

After the third obtaining unit acquires the traffic of each of the n1 nodes included in the first path,

The first normalization processing unit is configured to normalize the traffic of each of the n1 nodes by using the following formula:

Where f x is the traffic of node x after normalization, x ranges from 1 to n1, and F x is the traffic of node x.
The maximum value of the traffic of the n1 nodes.
The device of claim 21, wherein the device further comprises:

After the fourth obtaining unit acquires the traffic of each of the n2 nodes included in the second path,

The second normalization processing unit is configured to normalize the traffic of each of the n2 nodes by using the following formula:

Where f y is the traffic of the node y after the normalization process, and the value of y ranges from 1 to n2, and F y is the traffic of the node y.
The maximum value of the traffic of the n2 nodes.
The device according to any one of claims 16 to 24, wherein the adjusting unit is specifically configured to:

In the case that the second packet is determined to be an abnormal packet, the allowed access flow of the first port is determined. The amount is reduced to a first reduced value, where the first reduced value is a maximum value of the actual access traffic of the first port and a first ratio during the process of the second packet passing through the first port. And the first reduction value is not lower than a preset minimum allowed access traffic of the first port, and the first ratio value ranges from 1/5 to 1/2.
The device according to any one of claims 16 to 25, wherein the device further comprises:

After the adjusting unit decreases the allowed access traffic of the first port,

a second receiving unit, configured to receive a third packet from the first port;

a fifth acquiring unit, configured to acquire a third path, where the third path is path information that is experienced inside the network element system when the third packet passes through the network element system, where the third path includes The third packet is at least one node that passes through the network element system in chronological order.
The device of claim 26, further comprising:

a second matching unit, configured to: each node included in the third path and the first path, respectively, if a service type of the third packet is the same as a service type of the first packet Corresponding nodes are matched to obtain a second matching degree of the third path and the first path; or

The device includes:

a sixth acquiring unit, configured to acquire a pre-stored fourth path, where the fourth path is the fourth packet, if the service type of the third packet is the same as the service type of the fourth packet When the network element system passes through the path information that is experienced in the network element system, the fourth path includes at least one node that the fourth packet passes in time sequence in the network element system. The service type of the fourth packet is the same as the service type of the third packet, and the fourth packet is the same service type that has the same service type as the third packet and passes through the network. The packet of the meta-system passes through the packet of the network element system for the first time;

The second matching unit is configured to match each node included in the third path with a corresponding node included in the fourth path, to obtain a second matching degree of the third path and the fourth path.
The device according to claim 27, wherein the adjusting unit is further configured to:

If the second matching degree is lower than or equal to the first set threshold, reducing the allowed access traffic of the first port to a second reduced value, and the second reduced value is the The process of the third packet passing through the first port, the product of the maximum value of the actual access traffic of the first port and the second ratio value, wherein the second reduction value is not lower than the preset The minimum allowable access traffic of the first port is in the range of 1/5 to 1/2.
The device according to claim 27, wherein the adjusting unit is further configured to:

If the second matching degree is higher than the second set threshold, increasing the allowed access traffic of the first port to a first increased value, and the first increasing value is the third The maximum value of the actual value of the actual access traffic of the first port and the third ratio value during the process of the packet passing through the first port, where the first increase value is not higher than the preset maximum allowable value. Accessing the traffic; wherein the second set threshold is greater than the first set threshold, and the second set threshold is in a range of 70% to 80%, and the value of the third ratio is The range is 2 to 5.