WO2017041656A1

WO2017041656A1 - Traffic processing method, device and system

Info

Publication number: WO2017041656A1
Application number: PCT/CN2016/097500
Authority: WO
Inventors: 李阳; 董宝强; 赵洪日; 张毅
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2015-09-09
Filing date: 2016-08-31
Publication date: 2017-03-16
Also published as: CN106534043A; CN106534043B

Abstract

Disclosed is a traffic processing method, device and system, which are applied to a system comprising an elementary defence device and an advanced defence device, wherein the traffic cleaning capability of the advanced defence device is higher than that of the elementary defence device. The method comprises: a management and control device monitoring whether the load of an elementary defence device for cleaning the user traffic is greater than a first threshold; if a monitoring result is yes, the management and control device transferring the traffic processed by the elementary defence device to the advanced defence device for cleaning; the management and control device controlling the transfer of traffic which has been cleaned to a service processing device for processing. Thus different defence devices can be selected for traffic cleaning according to specific situations, reducing usage costs. At the same time, this series of operations are conducted without being perceived by a user, which does not need an additional operation from the user; thus the user experience is improved by way of dynamically scheduling a defence device.

Description

Traffic processing method, device and system

The present application claims priority to Chinese Patent Application Serial No. No. No. No. No. No. No. No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a traffic processing method, device, and system.

Background technique

As shown in Figure 1, it is a schematic diagram of a DDoS (Distributed Denial of Service) attack. The attacker uses a broiler to launch a DDoS attack. The attack causes the service server resources to be exhausted, thereby denying the normal user's service. For DDoS attacks. The existing defense programs include:

I. DDoS traffic cleaning. This is the most commonly used defense DDoS method. DDoS attacks are detected by the DDoS detection device. When the DDoS attack is discovered, the bypassed traffic cleaning device is used to pull the traffic of the attacked destination IP address and clean the attack traffic. Refill normal traffic.

2. When blackhole routes are advertised on the carrier network, that is, when the attack traffic exceeds the reach of the service provider, the service party sometimes shields the attacked by issuing blackhole routes in the carrier network so as not to affect other services in the same equipment room. IP access, discarding all DDoS traffic on the backbone network.

However, when performing DDoS traffic cleaning, the primary defense capability is relatively low. In order to defend against higher-level DDoS attacks, the cleaning equipment and bandwidth capacity must be continuously upgraded, resulting in a substantial increase in cost; and the current stage of cleaning equipment cannot be 100% Cleaning, as long as the traction must bring about manslaughter and missed, has a certain impact on normal business access; and the release of black hole routing through black hole routing to shield IP access results in the same attack, even through DNS (Domain Name System, Domain Name System), etc. Changing the access IP of the service will also cause some services to be completely unavailable for a period of time.

It can be known from the above that the above-mentioned current mainstream defense scheme in the existing base station cannot completely solve the DDoS problem currently encountered.

Summary of the invention

In the prior art, in the prior art, when the DDoS is defended, the high cost and the inefficiency are not solved, thereby affecting the defect of the normal service of the user. The present application proposes a traffic processing method, which is applied to the primary defense device and the advanced defense. In the system of the device, the traffic cleaning capability of the advanced defense device is higher than the cleaning capability of the primary defense device, and the method includes:

The control device monitors whether the load of the primary defense device used to clean the user traffic is greater than a first threshold;

If the monitoring result is yes, the control device transfers the traffic processed by the primary defense device to the advanced defense device for cleaning;

The control device controls the flow of the cleaning to be transferred to the service processing device for processing.

Optionally, the control device transfers the traffic processed by the primary defense device to the advanced defense device for cleaning, specifically:

The control device searches for an advanced defense device;

The control device allocates a first high-defense IP to the advanced defense device, where the first high-defense IP is different from the initial defense IP of the primary defense device;

The management device modifies the destination address of the enhanced DNS device to the first high-defense IP, so that the enhanced DNS device transfers the traffic of the user to the advanced defense device corresponding to the first high-defense IP based on the modified destination address for cleaning. .

Optionally, the management device modifies the destination address of the enhanced DNS device to the first high-defense IP, so that the enhanced DNS device transfers the user's traffic to the advanced defense device based on the modified destination address, and then includes:

The control device monitors whether the load of the advanced defense device for performing traffic cleaning exceeds a second threshold;

If the monitoring result is yes, the management device creates a second high-defense IP, wherein the second high-defense IP is different from the initial defense IP of the primary defense device and the first high-defense IP;

The control device modifies the destination address of the enhanced DNS device to the second high-defense IP, so that the enhanced DNS device transfers the user's traffic to the second high-defense IP-compliant advanced defense device for cleaning based on the modified destination address. .

The application also proposes a traffic processing method, including

The enhanced DNS device receives the DNS request from the user terminal;

The enhanced DNS device parses the DNS request based on an index table stored by itself and includes a correspondence between a DNS request and a destination address, and returns the parsed destination address to the user.

Optionally, the enhanced DNS device receives the DNS request from the user terminal, and specifically includes:

The enhanced DNS device receives a DNS request from a user terminal forwarded by a user DNS.

Optionally, the destination address in the index table is modifiable; the method further includes:

The enhanced DNS device receives an update message of the management device, where the update message carries an update IP set by the control device, and the update message is used to modify the destination address in the index table to the update IP;

When receiving the DNS request from the user terminal, the enhanced DNS device performs domain name resolution based on the newly modified index table, and returns the parsed latest modified destination address to the user terminal.

The application also proposes a management device comprising:

a monitoring module, configured to monitor whether a load of the primary defense device used for cleaning user traffic is greater than a first threshold;

a transfer module, configured to: when the load of the primary defense device is greater than the first threshold, transfer the traffic processed by the primary defense device to the advanced defense device for cleaning;

The processing module is configured to control the flow of the cleaning completion to be transferred to the service processing device for processing.

Optionally, the transfer module is specifically configured to:

Find advanced defense equipment;

Assigning a first high-defense IP to the advanced defense device, where the first high-defense IP is different from the initial defense IP of the primary defense device;

The destination address of the enhanced DNS device is modified to be the first high-defense IP, so that the enhanced DNS device transfers the traffic of the user to the advanced defense device corresponding to the first high-defense IP based on the modified destination address for cleaning.

Optionally, it also includes:

An operation module, configured to monitor whether a load of an advanced defense device that performs traffic cleaning exceeds a second threshold;

When the monitoring result is yes, a second high-defense IP is created, where the second high-defense IP is different from the primary defense IP of the primary defense device and the first high-defense IP;

The destination address of the enhanced DNS device is modified to be the second high-defense IP, so that the enhanced DNS device transfers the traffic of the user to the advanced defense device corresponding to the second high-defense IP based on the modified destination address for cleaning.

The application also proposes an enhanced DNS device, including:

a receiving module, configured to receive a DNS request from the user terminal;

The parsing module is configured to parse the DNS request based on an index table that includes a correspondence between the DNS request and the destination address, and return the parsed destination address to the user.

Optionally, the receiving module is specifically configured to:

Receives a DNS request from the user terminal forwarded by the user's DNS.

Optionally, the destination address in the index table is modifiable; the parsing module is further configured to:

Receiving an update message of the management device, where the update message carries an update IP set by the control device, and the update message is used to modify the destination address in the index table to the update IP;

Upon receiving the DNS request from the user terminal, the domain name resolution is performed based on the newly modified index table, and the parsed latest modified destination address is returned to the user terminal.

The present application further provides a traffic processing system, which is applied to a system including a primary defense device and an advanced defense device, wherein the traffic protection capability of the advanced defense device is higher than the cleaning capability of the primary defense device, and the system includes:

The control device is configured to monitor whether the load of the primary defense device used for cleaning the user traffic is greater than a first threshold; when the monitoring result is yes, the traffic processed by the primary defense device is transferred to the advanced defense device for cleaning; and the control cleaning is completed. The traffic is transferred to the service processing device for processing;

The enhanced DNS device is configured to receive a DNS request from the user terminal, and parse the DNS request based on an index table stored by the host that includes a correspondence between the DNS request and the destination address, and return the parsed destination address to the user.

Compared with the prior art, the solution in the present application firstly enables the user's traffic to be cleaned by the primary defense device, while monitoring the load of the primary defense device in real time, and switching to the advanced defense when the primary defense device is overloaded. The device performs traffic cleaning to select different defense devices for traffic cleaning according to specific conditions, which reduces the use cost. At the same time, this series of operations is performed without the user's perception, and does not require additional users. Operation, thereby improving the user experience by dynamically scheduling defense devices.

DRAWINGS

Figure 1 is a schematic diagram of a DDoS attack;

2 is a schematic flowchart of a traffic processing method according to an embodiment of the present application;

3 is a schematic flowchart of a traffic processing method according to an embodiment of the present application;

4 is a schematic structural diagram of a control device according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of an enhanced DNS device according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a traffic processing system according to an embodiment of the present application.

detailed description

As described in the background, the defense method in the prior art cannot achieve a good defense effect, and the use cost is too high, and the effect is not good, resulting in a low user experience. Therefore, a flow processing method is proposed in the embodiment of the present application. It is applied to a system including a primary defense device and an advanced defense device, wherein the traffic protection capability of the advanced defense device is higher than that of the primary defense device, as shown in FIG. 2, the method includes:

Step 201: The management device monitors whether the load of the primary defense device used to clean the user traffic is greater than a first threshold.

Specifically, when it is detected that there is illegal traffic, the primary defense device is first started to clean the illegal traffic, and the primary defense device may be an IDC (Internet Data Center) device, because it is not a dedicated traffic cleaning. The device also needs to undertake other functions, so its ability to clean illegal traffic is low, but the use cost is low, and it can cope with the situation of small illegal traffic. The control device monitors the load of the primary defense device in real time. Specifically, the load depends on the load. For the traffic cleaning capability of the primary defense device itself, the currently received traffic can be preset with a threshold of, for example, 90%. When the traffic received by the primary defense device requires the cleaning capability to reach 90% of its own traffic cleaning capability. The load is determined to be greater than the first threshold. Certainly, the load and the first threshold may be set based on other conditions or factors, and details are not described herein.

The monitoring has two results. When the load is greater than the first threshold, step 202 is performed. If the load is not greater than the first threshold, the traffic that has been cleaned by the primary defense device can be transferred to the service processing device to complete the corresponding service.

Step 202: If the monitoring result is yes, the control device transfers the traffic processed by the primary defense device to the advanced defense device for cleaning.

The specific transfer process may include: the management device searches for the advanced defense device; the management device allocates the first high defense IP to the advanced defense device, where the first high defense IP is different from the initial defense IP of the primary defense device. In order to enhance the DNS device to transfer the user's traffic to the first high-defense IP-compliant advanced defense device for cleaning based on the modified destination address.

Specifically, in the present application, an enhanced DNS device is provided, and the destination address obtained by the enhanced DNS device can be changed, and it is determined that the load of the primary defense device is greater than the first threshold, that is, the primary defense device cannot be well completed. When traffic is cleaned, first look for the advanced defense device, which is dedicated to traffic cleaning. Its processing power, efficiency and accuracy are higher than the primary defense device, and it is the advanced defense device found (for example, advanced defense). The device 1) allocates the first high-defense IP, for example, IP2, and specifically sends an update message to the enhanced DNS device by using the control device, where the update message carries the IP2, and the destination address for enhancing the DNS device resolution is modified to IP2. IP2 is different from the primary defense IP of the primary defense device, and the destination address of the enhanced DNS device resolution is modified to IP2, specifically, for example, an enhanced DNS device stores an index table, and the index table stores a correspondence between a DNS request and a resolved destination address. In this case, the management device sends a re-resolving command to the enhanced DNS device to enhance the DNS. The device re-parsing, the destination address of the parsing will be changed to the modified destination address, that is, IP2, so that the traffic that was originally cleaned on the primary defense device is transferred to the advanced defense device (for example, the advanced defense device 1). Flow cleaning.

In the process of transferring traffic to advanced defense equipment for cleaning, in fact, although the processing power of advanced defense equipment is much higher than that of primary defense equipment, it is not unlimited. Compared with attack traffic, it may not be enough. So considering this situation, after transferring traffic to the advanced defense device for cleaning, you can also perform the following steps:

The control device monitors whether the load of the advanced defense device for traffic cleaning exceeds the second threshold; if the monitoring result is yes, the management device creates the second high-defense IP, where the second high-defense IP is different from the primary defense IP of the primary defense device and the first A high-defense IP; the control device modifies the destination address of the enhanced DNS device to the second high-defense IP; in order to enhance the DNS device to transfer the user's traffic to the second high-defense IP-compliant advanced defense device based on the modified destination address. Cleaning.

Specifically, for example, the load of the advanced defense device 1 exceeds the second threshold, and similar to the primary defense device, the evaluation of the load and the setting of the second threshold may be set based on a specific situation, and the control device will not be described here. An advanced defense device that performs traffic processing in real time, for example, when it is determined that the load of the advanced defense device 1 exceeds a second threshold, a new high-defense IP, that is, a second high-defense IP, such as IP3, is created. The high-defense IP is different from the primary defense IP of the primary defense device and the first high-defense IP. It can also carry the IP3 by updating the message, so as to modify the destination address of the enhanced DNS device resolution to IP3, and trigger the enhanced DNS device to perform domain name resolution again. Therefore, the traffic is transferred to the advanced defense device corresponding to IP3, wherein the advanced defense device for IP3 can be the advanced defense device 1, that is, the specific advanced defense device hardware is not replaced, and only the IP is changed, and a new advanced can also be found. The defense device, for example, the advanced defense device 2, then assigns the IP3 to the advanced defense device 2, that is, replaces the advanced defense device. After the IP address is replaced, the original attack traffic for the unreplaced IP will no longer have an attacking effect. Correspondingly, for the attacker to attack, the attack cost will be continued. It will become very big, of course, with the replacement of advanced defense equipment, the difficulty will be greater, and the attack will be more successful, thus achieving the purpose of defense.

Step 203: The control device controls the flow of the cleaning to be transferred to the service processing device for processing.

After the traffic is cleaned through the primary defense device or the advanced defense device, the traffic that controls the cleaning is transferred to the service processing device for processing, thereby implementing the corresponding service.

The above is a description of the application based on the perspective of the management device. For further explanation of the application, the embodiment of the present application further discloses a traffic processing method, as shown in FIG. 3, including

Step 301: The enhanced DNS device receives a DNS request from the user terminal.

Specifically, the enhanced DNS device receives the DNS request from the user terminal, specifically:

The enhanced DNS device receives a DNS request from the user terminal forwarded by the user's DNS.

In a specific application scenario, when a user inputs a domain name in a user terminal, the NDS request is sent to the user's DNS (Domain Name System), and the destination address of the user's DNS resolution cannot be replaced. Sending the received NDS request to the enhanced DNS device, the destination address of the enhanced DNS device resolution proposed in this application can be changed, thereby implementing the function by enhancing the DNS device without changing the existing architecture. On the expansion.

Step 302: The enhanced DNS device parses the DNS request based on an index table that is stored by itself and includes a correspondence between the DNS request and the destination address, and returns the parsed destination address to the user terminal.

Specifically, when the parsed destination address is returned to the user terminal, the user traffic of the user terminal can be directed to the defense device corresponding to the parsed destination address (primary defense device or advanced defense device, and which advanced defense device, specifically According to the parsed destination address, the cleaning is performed; in a specific implementation, the enhanced DNS device stores an index table; the index table stores the correspondence between the DNS request and the destination address; and the enhanced DNS device resolves the DNS request, and the parsing is obtained. The destination address is returned to the user terminal, including:

The enhanced DNS device parses the DNS request based on the index table stored by itself, and obtains the destination address corresponding to the DNS request and returns it to the user terminal.

Since the destination address in the index table is modifiable; the method further includes:

Specifically, when performing domain name resolution, it is possible that the destination address in the index table is modified or not modified; when the modification has not been made, the newly modified index table is always the original index table (that is, the initial The index table is created. Therefore, when the domain name resolution is performed, the latest modified destination address is also the original destination address. When the modification is made, it may be modified multiple times. At this time, the newly modified index table is used. Perform domain name resolution. For example, there are two modifications. The first modification time is 13:12:13 on May 1, 2015. The second modification is made. The time is 13:15:23 on May 2, 2015. Obviously, the time of the second modification is the latest, so the domain name resolution is performed with the second modified index table. Of course, other things can be used. The method is to identify the latest. For example, the value of the number of times of modification may be increased by one for each modification, and the index table corresponding to the maximum value may be directly found, as long as the latest modified index table can be identified.

The embodiment of the present application further provides a management device, as shown in FIG. 4, including:

The monitoring module 401 is configured to monitor whether a load of the primary defense device used for cleaning user traffic is greater than a first threshold;

The transfer module 402 is configured to transfer the traffic processed by the primary defense device to the advanced defense device for cleaning when the load of the primary defense device is greater than the first threshold;

The processing module 403 is configured to control the flow of the cleaning completion to be transferred to the service processing device for processing.

The transfer module 402 is specifically configured to:

Find advanced defense equipment;

Specifically, the control device further includes:

The embodiment of the present application further discloses an enhanced DNS device, as shown in FIG. 5, including:

The receiving module 501 is configured to receive a DNS request from the user terminal.

The parsing module 502 is configured to parse the DNS request based on an index table that includes a correspondence between the DNS request and the destination address, and return the parsed destination address to the user terminal.

The receiving module 501 is specifically configured to:

Receives a DNS request from the user terminal forwarded by the user's DNS.

Specifically, the enhanced DNS device stores an index table, where the index table stores a correspondence between a DNS request and a destination address;

The destination address in the index table is modifiable; the parsing module 502 is further configured to:

The embodiment of the present application further discloses a traffic processing system, which is applied to a system including a primary defense device and an advanced defense device, wherein the traffic protection capability of the advanced defense device is higher than the cleaning capability of the primary defense device, as shown in the figure. As shown in 6, the system includes:

The control device 601 is configured to monitor whether the load of the primary defense device used for cleaning user traffic is greater than a first threshold; when the monitoring result is yes, the traffic processed by the primary defense device is transferred to an advanced defense device for cleaning; and the cleaning is controlled. The completed traffic is transferred to the service processing device for processing;

The enhanced DNS device 602 is configured to receive a DNS request from the user terminal, and parse the DNS request based on an index table stored by the host that includes a correspondence between the DNS request and the destination address, and return the parsed destination address to the user.

Compared with the prior art, the solution in the present application firstly enables the user's traffic to be cleaned by the primary defense device, while monitoring the load of the primary defense device in real time, and switching to the advanced defense when the primary defense device is overloaded. The device performs traffic cleaning, so that different defense devices can be selected for traffic cleaning according to specific conditions, which reduces the use cost. At the same time, the series of operations are performed without the user's perception, and no additional user is required. The operation improves the user experience by dynamically scheduling defense devices.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by hardware, or by software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present application may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including several The instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the various implementation scenarios described in this application. Methods.

A person skilled in the art can understand that the drawings are only a schematic diagram of a preferred implementation scenario, and the modules or processes in the drawings are not necessarily required to implement the application.

A person skilled in the art may understand that the modules in the apparatus in the implementation scenario may be distributed in the apparatus for implementing the scenario according to the implementation scenario description, or may be correspondingly changed in one or more devices different from the implementation scenario. The modules of the above implementation scenarios may be combined into one module, or may be further split into multiple sub-modules.

The above serial numbers are only for the description, and do not represent the advantages and disadvantages of the implementation scenario.

The above disclosure is only a few specific implementation scenarios of the present application, but the present application is not limited thereto, and any changes that can be made by those skilled in the art should fall within the protection scope of the present application.

Claims

A traffic processing method, which is applied to a system including a primary defense device and an advanced defense device, wherein the traffic protection capability of the advanced defense device is higher than the cleaning capability of the primary defense device, and the method includes:

The control device monitors whether the load of the primary defense device used to clean the user traffic is greater than a first threshold;

If the monitoring result is yes, the control device transfers the traffic processed by the primary defense device to the advanced defense device for cleaning;

The control device controls the flow of the cleaning to be transferred to the service processing device for processing.
The method according to claim 1, wherein the control device transfers the traffic processed by the primary defense device to the advanced defense device for cleaning, and specifically includes:

The control device searches for an advanced defense device;

The control device allocates a first high-defense IP to the advanced defense device, where the first high-defense IP is different from the initial defense IP of the primary defense device;

The management device modifies the destination address of the enhanced DNS device to the first high-defense IP, so that the enhanced DNS device transfers the traffic of the user to the advanced defense device corresponding to the first high-defense IP based on the modified destination address for cleaning. .
The method according to claim 2, wherein the management device modifies the destination address of the enhanced DNS device resolution to the first high anti-IP, so that the enhanced DNS device transfers the user's traffic based on the modified destination address. To advanced defense equipment, including:

The control device monitors whether the load of the advanced defense device for performing traffic cleaning exceeds a second threshold;

If the monitoring result is yes, the management device creates a second high-defense IP, wherein the second high-defense IP is different from the initial defense IP of the primary defense device and the first high-defense IP;

The control device modifies the destination address of the enhanced DNS device to the second high-defense IP, so that the enhanced DNS device transfers the user's traffic to the second high-defense IP-compliant advanced defense device for cleaning based on the modified destination address. .
A flow processing method, characterized in that

The enhanced DNS device receives the DNS request from the user terminal;

The enhanced DNS device parses the DNS request based on an index table stored by itself and includes a correspondence between a DNS request and a destination address, and returns the parsed destination address to the user terminal.
The method of claim 4, wherein the enhanced DNS device receives the DNS request from the user terminal, specifically:

The enhanced DNS device receives a DNS request from a user terminal forwarded by a user DNS.
The method of claim 4, wherein the destination address in the index table is modifiable; the method further comprising:

The enhanced DNS device receives an update message of the management device, where the update message carries an update IP set by the control device, and the update message is used to modify the destination address in the index table to the update IP;

When receiving the DNS request from the user terminal, the enhanced DNS device performs domain name resolution based on the newly modified index table, and returns the parsed latest modified destination address to the user terminal.
A control device, comprising:

a monitoring module, configured to monitor whether a load of the primary defense device used for cleaning user traffic is greater than a first threshold;

a transfer module, configured to: when the load of the primary defense device is greater than the first threshold, transfer the traffic processed by the primary defense device to the advanced defense device for cleaning;

The processing module is configured to control the flow of the cleaning completion to be transferred to the service processing device for processing.
The device according to claim 7, wherein the transfer module is specifically configured to:

Find advanced defense equipment;

Assigning a first high-defense IP to the advanced defense device, where the first high-defense IP is different from the initial defense IP of the primary defense device;

The destination address of the enhanced DNS device is modified to be the first high-defense IP, so that the enhanced DNS device transfers the traffic of the user to the advanced defense device corresponding to the first high-defense IP based on the modified destination address for cleaning.
The device of claim 8 further comprising:

An operation module, configured to monitor whether a load of an advanced defense device that performs traffic cleaning exceeds a second threshold;

When the monitoring result is yes, a second high-defense IP is created, where the second high-defense IP is different from the primary defense IP of the primary defense device and the first high-defense IP;

The destination address of the enhanced DNS device is modified to be the second high-defense IP, so that the enhanced DNS device transfers the traffic of the user to the advanced defense device corresponding to the second high-defense IP based on the modified destination address for cleaning.
An enhanced DNS device, comprising:

a receiving module, configured to receive a DNS request from the user terminal;

The parsing module is configured to parse the DNS request based on an index table that includes a correspondence between the DNS request and the destination address, and return the parsed destination address to the user terminal.
The device according to claim 10, wherein the receiving module is specifically configured to:

Receives a DNS request from the user terminal forwarded by the user's DNS.
The device according to claim 10, wherein the destination address in the index table is modifiable; the parsing module is further configured to:

Receiving an update message of the management device, where the update message carries an update IP set by the control device, and the update message is used to modify the destination address in the index table to the update IP;

Upon receiving the DNS request from the user terminal, the domain name resolution is performed based on the newly modified index table, and the parsed latest modified destination address is returned to the user terminal.
A traffic processing system is characterized in that it is applied to a system including a primary defense device and an advanced defense device, wherein the traffic protection capability of the advanced defense device is higher than the cleaning capability of the primary defense device, and the system includes:

The control device is configured to monitor whether the load of the primary defense device used for cleaning the user traffic is greater than a first threshold; when the monitoring result is yes, the traffic processed by the primary defense device is transferred to the advanced defense device for cleaning; and the control cleaning is completed. The traffic is transferred to the service processing device for processing;

The enhanced DNS device is configured to receive a DNS request from the user terminal, and parse the DNS request based on an index table stored by the host that includes a correspondence between the DNS request and the destination address, and return the parsed destination address to the user.