WO2020187295A1 - 异常主机的监控 - Google Patents

异常主机的监控 Download PDF

Info

Publication number
WO2020187295A1
WO2020187295A1 PCT/CN2020/080223 CN2020080223W WO2020187295A1 WO 2020187295 A1 WO2020187295 A1 WO 2020187295A1 CN 2020080223 W CN2020080223 W CN 2020080223W WO 2020187295 A1 WO2020187295 A1 WO 2020187295A1
Authority
WO
WIPO (PCT)
Prior art keywords
host
information
detected
deployed
address
Prior art date
Application number
PCT/CN2020/080223
Other languages
English (en)
French (fr)
Inventor
侯叶飞
Original Assignee
新华三技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三技术有限公司 filed Critical 新华三技术有限公司
Priority to JP2021555483A priority Critical patent/JP7228712B2/ja
Priority to US17/593,547 priority patent/US20220174081A1/en
Priority to EP20773249.6A priority patent/EP3944582B1/en
Publication of WO2020187295A1 publication Critical patent/WO2020187295A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/22—Alternate routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/66—Layer 2 routing, e.g. in Ethernet based MAN's
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks

Definitions

  • Ethernet Virtual Private Network is a Layer 2 Virtual Private Network (Virtual Private Network, VPN) technology.
  • the control plane uses Multi-Protocol Border Gateway Protocol (MP-BGP) to advertise routing information .
  • MP-BGP Multi-Protocol Border Gateway Protocol
  • the data plane adopts an extensible virtual local area network (Virtual eXtensible Local Area Network, VXLAN) encapsulation method to forward packets.
  • VXLAN is a Layer 2 VPN technology based on IP (Internet Protocol) network, using Media Access Control (MAC) and User Datagram Protocol (UDP) encapsulation.
  • VXLAN can be based on existing A service provider or enterprise IP network provides Layer 2 interconnection for scattered sites and can provide business isolation for different tenants.
  • the EVPN network includes a host and an edge device.
  • the edge device can learn the forwarding table entries of the host and use the forwarding table entries to send data packets to the host. For example, after edge device A receives an Address Resolution Protocol (ARP) message sent by host A, it learns the forwarding entry 1 of host A, and advertises the address of host A to edge device B, and edge device B learns the host A's forwarding table item 2.
  • ARP Address Resolution Protocol
  • edge device B uses forwarding entry 2 to send the data message to edge device A
  • edge device A uses forwarding entry 1 to send the data message to host A.
  • ARP Address Resolution Protocol
  • Fig. 1 is a schematic diagram of an application scenario in an embodiment of the present application.
  • Fig. 2 is a flowchart of a method for monitoring an abnormal host in an embodiment of the present application.
  • Fig. 3 is a flowchart of a method for monitoring an abnormal host in another embodiment of the present application.
  • Fig. 4 is a structural diagram of a monitoring device for an abnormal host in an embodiment of the present application.
  • Fig. 5 is a hardware structure diagram of a data processing device in an embodiment of the present application.
  • first, second, third, etc. may be used in the embodiments of the present application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
  • second information may also be referred to as first information.
  • if used can be interpreted as "when” or "when” or "in response to certainty.”
  • the attacker may send a large number of attack ARP packets through the host, and the edge device will learn a large number of forwarding entries, which will waste entry resources and affect the processing performance of the edge device.
  • the edge device can send the ARP message to the controller, and the controller analyzes whether the ARP message is sent by the attacker. If the ARP message is sent by an attacker, the controller can generate alarm information, and the manager can handle the attack.
  • the controller analyzes whether these ARP packets are sent by an attacker, which is a heavy workload, consumes a lot of resources of the controller, and reduces processing performance.
  • the embodiment of the present application proposes a monitoring method for abnormal hosts, which can be applied to networks including hosts, edge devices, controllers, cloud platforms, route management devices, and data processing devices, such as EVPN networks.
  • Figure 1 is a schematic diagram of an application scenario of an embodiment of this application.
  • the host 111 and the host 112 are taken as examples for description. In actual applications, the number of hosts can be more.
  • the edge device 121 and the edge device 122 as examples for description, in practical applications, the number of edge devices may be more.
  • the hosts 111 and 112 may be virtual machines deployed on physical servers, or physical servers, or other types of hosts, such as personal computers, terminal devices, and mobile terminals.
  • the edge devices 121 and 122 may be scalable virtual local area network tunnel end point (VXLAN Tunnel End Point, VTEP) devices, and may also be other types of edge devices. Furthermore, the VTEP device can be used as an edge device of the EVPN network, and all processing related to VXLAN is performed in the VTEP device.
  • VXLAN Tunnel End Point VXLAN Tunnel End Point
  • the controller 141 may be a Software Define Network (SDN) controller, or other types of controllers.
  • the cloud platform 151 may be an Openstack cloud platform or other types of cloud platforms.
  • the EVPN network uses the Openstack cloud platform and SDN controller to implement control plane functions.
  • the route management device 131 is used to collect all routing information in the EVPN network.
  • the route management device 131 may be a route reflector (Route Reflector, RR), or other types of devices.
  • the data processing device 161 may be a device in a big data processing system, and the data processing device 161 may use big data technology to implement functions such as data collection, data analysis, data storage, data statistics, and data mining.
  • Host type The host in this embodiment can be divided into a deployed host and a host to be detected.
  • the deployed host is a host that is actually deployed on the network and is a legal host.
  • Deployed hosts can include online hosts and offline hosts. Online hosts are hosts that have accessed the network, and offline hosts are hosts that have not accessed the network. Both online hosts and offline hosts are legitimate hosts that are truly deployed on the network. .
  • the host to be detected is a host that needs to be detected.
  • the monitoring method of an abnormal host in this embodiment is to detect whether the host to be detected is an abnormal host. If the host to be detected is an abnormal host, the host to be detected does not belong to the deployed host, and exception handling is required. If the host to be detected is not an abnormal host, that is, the host to be detected is a normal host, the host to be detected belongs to a deployed host and is allowed to access the network.
  • the controller obtains the host information of the deployed host and stores the host information locally.
  • the cloud platform can create hosts for tenants (for example, create virtual machines for tenants on physical servers, or assign physical servers to tenants), and assign host information to the hosts. All hosts created by the platform for tenants are called deployed hosts. Then, the cloud platform sends the host information of the deployed host to the controller, and the controller stores the host information.
  • hosts for tenants for example, create virtual machines for tenants on physical servers, or assign physical servers to tenants
  • All hosts created by the platform for tenants are called deployed hosts. Then, the cloud platform sends the host information of the deployed host to the controller, and the controller stores the host information.
  • all deployed hosts in the EVPN network can be created by the cloud platform, that is, the host information sent by the cloud platform to the controller includes the host information of all deployed hosts.
  • the host information may include, but is not limited to: address information and host identification. Further, the address information may include, but is not limited to: IP address, MAC address, and network identifier.
  • the network identifier may be VNI (VXLAN Network Identifier, network identifier of an extensible virtual local area network). If the host is a virtual machine deployed on a physical server, the host identifier may be the device identifier of the physical server where the virtual machine is located; if the host is a physical server, the host identifier may be the device identifier of the physical server.
  • VNI VXLAN Network Identifier
  • the host information is an example of the host information of all deployed hosts in the EVPN network. This host information is used as an example for description in the following.
  • Serial number IP address MAC address Network identification Host ID 1 IP address A MAC address A VNI1 aaa 2 IP address B MAC address B VNI1 bbb 3 IP address C MAC address C VNI2 ccc 4 IP address D MAC address D VNI2 ddd ... ... ... ... ... ... ...
  • the controller can obtain the Link Layer Discovery Protocol (LLDP) information of the deployed host, and locally store the LLDP information of the deployed host.
  • the LLDP information may include, but is not limited to, the host identifier corresponding to the deployed host, and the device information of the edge device associated with the deployed host.
  • the device information may include an IP address and/or MAC address.
  • the host identifier corresponding to the deployed host may be the device identifier of the physical server where the virtual machine is located, and the edge device associated with the deployed host may be The edge device connected to the physical server where the virtual machine is located.
  • the host identifier corresponding to the deployed host may be the device identifier of the physical server, and the edge device associated with the deployed host may be an edge device connected to the physical server.
  • the deployed hosts may include online hosts and offline hosts.
  • the online hosts in order to obtain the LLDP information of the online hosts, the following methods may be used.
  • the host 111 when the host 111 goes online, that is, the host 111 becomes an online host, the host 111 can send an LLDP packet to the edge device 121 connected to the host 111.
  • the LLDP packet includes the management address of the host 111 and the host Logo and other content.
  • the edge device 121 may send the LLDP message to the controller 141 through openflow.
  • the controller 141 may issue a control flow table to the edge device 121.
  • This control flow table is used to enable the edge device 121 to send LLDP packets to the controller 141.
  • the matching option of the control flow table includes the protocol type being LLDP.
  • Type, action items include upload controller.
  • the edge device 121 may send the LLDP message to the controller 141 because the LLDP message matches the control flow table.
  • the controller 141 After receiving the LLDP message, the controller 141 obtains the management address and host identifier of the host 111 from the LLDP message. In addition, since the controller 141 can manage all edge devices, the controller 141 can also obtain device information (such as IP address, MAC address, etc.) of the edge device 121 after receiving the LLDP message sent by the edge device 121. In summary, the controller 141 can obtain the host identifier of the host 111 and the device information of the edge device 121, and the host identifier and the device information are included in the LLDP information of the host 111.
  • device information such as IP address, MAC address, etc.
  • the offline host in order to obtain the LLDP information of the offline host, the following methods can be used.
  • the host 112 is not online, and the offline host 112 is a virtual machine deployed on a physical server. Assuming that the physical server is already online, the physical server can send an LLDP packet to the edge device 122 connected to the physical server.
  • the LLDP message includes the host ID of the physical server, and this host ID is also the host ID of all virtual machines deployed on the physical server.
  • the edge device 122 After receiving the LLDP message, the edge device 122 sends the LLDP message to the controller 141. After receiving the LLDP message, the controller 141 obtains the host ID of the physical server from the LLDP message, and obtains the device information (such as IP address, MAC address, etc.) of the edge device 122, and the host ID of the physical server and the edge device The device information of 122 is included in the LLDP information of the host 112.
  • the edge device 121 can send an LLDP packet to the host 111.
  • the LLDP packet can carry the device information of the edge device 121 (such as IP address, MAC address) Wait).
  • the host 111 is not online, its operating system and LLDP daemon are still working normally, so the LLDP message sent by the edge device 121 can be received when the host 111 is not online.
  • the host 111 can send the device information of the edge device 121 and the host identifier of the host 111 to the cloud platform 151. Since the host is directly controlled by the cloud platform, it can send information to the cloud platform through an internal channel.
  • the cloud platform 151 sends the device information of the edge device 121 and the host ID of the host 111 to the controller 141, and the device information of the edge device 121 and the host ID of the host 111 are included in the LLDP information of the edge device 121.
  • the controller 141 can obtain the LLDP information of each deployed host, and store the LLDP information of each deployed host.
  • Table 2 is an example of LLDP information.
  • Host ID Device information of edge devices aaa IP address 1 and MAC address 1 bbb IP address 2 and MAC address 2 ccc IP address 3 and MAC address 3 ddd IP address 4 and MAC address 4 ... ...
  • the routing management device receives routing information and synchronizes the routing information with the edge device.
  • the host 111 when the host 111 goes online, the host 111 sends an ARP message (such as an ARP request message or a gratuitous ARP message, etc.) to the edge device 121.
  • the edge device 121 After receiving the ARP message, the edge device 121 can record the correspondence between the source address of the ARP message (that is, the address of the host 111, such as IP address and/or MAC address, etc.) and the incoming interface of the ARP message in the forwarding table entry relationship.
  • the edge device 121 may also generate a BGP message (such as an MP-BGP message).
  • the BGP message may include routing information, and the routing information may include but is not limited to: address information of the host 111 (The address information may include an IP address, a MAC address, and a network identifier), the device information of the edge device 121 (the device information may include an IP address, a MAC address, etc.).
  • the edge device 121 After the edge device 121 generates the BGP message, it may send the BGP message to the edge device 122. After receiving the BGP message, the edge device 122 can obtain the address information of the host 111 from the BGP message, and record the address information of the host 111 (such as IP address, MAC address, and network identifier) and the tunnel correspondence in the forwarding table entry There are no restrictions on the learning process of this forwarding entry.
  • the tunnel may be a tunnel between the edge device 122 and the edge device 121, such as a VXLAN tunnel.
  • the edge device 121 sends the BGP message to the edge device 122, which may include but is not limited to the following two methods.
  • the edge device 121 may directly send the BGP message to the edge device 122.
  • the edge device 121 may send a BGP message to the route management device 131, and the route management device 131 sends the BGP message to the edge device 122 after receiving the BGP message.
  • BGP neighbors need to be established between any two edge devices. For example, when there are 100 edge devices, each edge device needs to establish BGP neighbors with 99 other edge devices, which will affect network resources and CPU (Central Processing Unit) consumes a lot of resources.
  • CPU Central Processing Unit
  • a route management device 131 (such as a route reflector) can be deployed on the EVPN network.
  • each edge device only needs to establish BGP neighbors with the route management device 131, and no longer establish BGP neighbors with other edge devices. Reduce the consumption of network resources and CPU resources.
  • the second method can be used to transmit BGP messages. That is, when each edge device sends a BGP message, it sends the BGP message to the route management device 131, and the route management device 131 transmits the BGP message Send to other edge devices.
  • the second method is used as an example for description.
  • the routing management device 131 can collect all BGP messages generated in the EVPN network, and each BGP message includes routing information issued by the publisher, such as the address information of the host and the device information of the edge device.
  • Fig. 2 is a schematic flowchart of a method for monitoring an abnormal host. Referring to Fig. 2, the method can be applied to a data processing device, and the method can include the following steps.
  • Step 201 Obtain host information of a deployed host from the controller, where the host information includes address information of the deployed host.
  • the host information may also include the host identification of the deployed host.
  • the controller has stored the host information of all deployed hosts in the EVPN network. Therefore, the data processing device can obtain the host information of all deployed hosts in the EVPN network from the controller, as shown in Table 1.
  • the host information may include, but is not limited to, address information and host identification, and the address information may include IP address, MAC address, and network identification.
  • Step 202 Obtain routing information of the host to be detected, where the routing information includes address information of the host to be detected.
  • the host to be detected is a host that needs to be detected, and is an abnormal host or a normal host.
  • the data processing device may negotiate with the route management device to establish a BGP neighbor.
  • the BGP protocol can be configured on the data processing device, so that the data processing device can negotiate with the route management device to establish BGP neighbors, and there is no restriction on the process of establishing BGP neighbors.
  • obtaining the routing information of the host to be detected may include but is not limited to: receiving the routing information of the host to be detected sent by the routing management device.
  • the data processing device since the data processing device has negotiated with the routing management device to establish a BGP neighbor, each time the routing management device receives routing information, it can send the routing information to the data processing device.
  • the route management device can collect all BGP messages generated in the EVPN network.
  • the BGP message includes routing information, which may include the address information of the host to be detected and the device information of the edge device associated with the host to be detected. Since the data processing device has negotiated with the route management device to establish a BGP neighbor, the route management device sends each BGP message to the data processing device when it collects each BGP message. After receiving the BGP message, the data processing device can obtain routing information from the BGP message, such as the address information of the host to be detected, and the device information of the edge device associated with the host to be detected.
  • Step 203 Determine whether the address information of the deployed host includes the address information of the host to be detected.
  • step 204 can be performed, and if the address information of the deployed host includes the address information of the host to be detected, step 205 can be performed.
  • Step 204 Determine that the host to be detected is an abnormal host.
  • Step 205 Determine that the host to be detected is a normal host.
  • the data processing device can obtain the host information of all deployed hosts in the EVPN network from the controller, as shown in Table 1. Based on this, when the host information shown in Table 1 includes the address information of the host to be detected, It can be determined that the host to be detected is a normal host. When the host information shown in Table 1 does not include the address information of the host to be detected, it can be determined that the host to be detected is an abnormal host.
  • the host 111 when the host 111 (assumed to be the host to be detected) goes online, it sends an ARP message to the edge device 121. If the host 111 is a normal host, the ARP message carries real address information, such as IP address A and MAC address A.
  • the edge device 121 After receiving the ARP message, the edge device 121 can generate a BGP message for the host 111 and send the BGP message to the routing management device 131. After receiving the BGP message, the routing management device 131 can send the BGP message ⁇ 161 ⁇ To data processing equipment 161.
  • the BGP message may include routing information.
  • the routing information may include, but is not limited to: the IP address A and MAC address A of the host 111, the network identifier of the host 111 (such as VNI1), and the device information of the edge device 121 (IP address 1). And MAC address 1).
  • the address information of the host 111 included in the routing information is: IP address A, MAC address A, and network identification VNI1, then it is determined whether the host information shown in Table 1 includes the above address information. Since the host information shown in Table 1 includes the aforementioned address information, it can be determined that the host 111 is a normal host.
  • the host 111 when the host 111 (assumed to be the host to be detected) goes online, it sends an ARP packet to the edge device 121. If the host 111 is an abnormal host (such as an attacker), the ARP message carries address information forged by the attacker, such as IP address AAA and MAC address AAA.
  • the edge device 121 After receiving the ARP message, the edge device 121 can generate a BGP message for the host 111 and send the BGP message to the routing management device 131. After receiving the BGP message, the routing management device 131 can send the BGP message ⁇ 161 ⁇ To data processing equipment 161.
  • the BGP message may include routing information, the routing information may include, but is not limited to: the IP address AAA and MAC address AAA of the host 111, the network identifier of the host 111 (such as VNI1), and the device information of the edge device 121 (IP address 1 And MAC address 1).
  • the address information of the host 111 included in the routing information is: IP address AAA, MAC address AAA, and network identification VNI1, then it is determined whether the above address information is included in the host information shown in Table 1. Since the host information shown in Table 1 does not include the aforementioned address information, it can be determined that the host 111 is an abnormal host.
  • the data processing device 161 when the data processing device 161 determines that the host 111 is an abnormal host, it can also generate alarm information, and the management personnel can handle the attack behavior, and the processing process will not be repeated.
  • the data processing device (usually a big data processing system) can obtain the host information of the deployed host from the controller, obtain the routing information of the host to be detected from the routing management device, and obtain the routing information of the host to be detected from the routing management device.
  • routing information analyzes whether the host to be detected is an abnormal host, so as to give full play to the data collection and data processing capabilities of the big data processing system, and accurately analyze whether the host to be detected is an abnormal host.
  • the above method does not require the controller to analyze whether the host to be detected is an abnormal host, which reduces the workload of the controller, saves the processing resources of the controller, and improves the processing performance of the controller.
  • the above method based on big data technology to analyze whether the host to be detected is an abnormal host, perform host behavior analysis, anomaly detection and error correction, so that network maintenance personnel can accurately grasp the network access information of each host and quickly sense the host's abnormality Access behavior.
  • Fig. 3 is a schematic flowchart of a method for monitoring an abnormal host. As shown in Fig. 3, the method can be applied to a data processing device, and the method can include the following steps:
  • Step 301 Obtain host information of the deployed host from the controller, where the host information includes address information of the deployed host.
  • the host information may also include the host identification of the deployed host.
  • step 301 For the implementation process of step 301, refer to step 201, which will not be repeated here.
  • Step 302 Obtain LLDP information of the deployed host from the controller, where the LLDP information includes the host identifier of the deployed host and the device information of the first edge device associated with the deployed host.
  • the controller has stored the LLDP information of all deployed hosts in the EVPN network. Therefore, the data processing device can obtain the LLDP information of all deployed hosts in the EVPN network from the controller, as shown in Table 2.
  • the LLDP information may include, but is not limited to: the host identifier of the deployed host, and the device information of the first edge device associated with the deployed host.
  • Step 303 Obtain routing information of the host to be detected.
  • the routing information includes address information of the host to be detected and device information of the second edge device associated with the host to be detected, such as an IP address and/or MAC address.
  • the edge device associated with the host to be detected may be referred to as the second edge device.
  • step 303 refer to step 202, which will not be repeated here.
  • Step 304 Determine whether the address information of the deployed host includes the address information of the host to be detected.
  • step 305 can be performed, and if the address information of the deployed host includes the address information of the host to be detected, step 306 can be performed.
  • Step 305 Determine that the host to be detected is an abnormal host.
  • the data processing device can obtain the host information of all deployed hosts in the EVPN network from the controller, as shown in Table 1. Based on this, when the host information shown in Table 1 does not include the address information of the host to be detected , It can be determined that the host to be detected is an abnormal host. When the host information shown in Table 1 includes the address information of the host to be detected, step 306 and subsequent steps can be performed.
  • Step 306 Obtain device information of the first edge device associated with the target host from the LLDP information.
  • the deployed host with the same address information as the host to be detected is referred to as the target host in this embodiment.
  • the host information of the deployed host includes the address information of the deployed host, the host identifier of the deployed host, and the LLDP information includes the host identifier of the deployed host, the device information of the first edge device associated with the deployed host, and the routing The information includes the address information of the host to be detected.
  • obtaining the device information of the first edge device associated with the target host from the LLDP information may include: according to the address information of the target host (target The address information of the host is the same as the address information of the host to be detected.) Query the host information to obtain the host ID of the target host; query the LLDP information according to the host ID of the target host to obtain the device information of the first edge device associated with the target host.
  • the data processing device can query the host information shown in Table 1 through the address information of the host to be detected, and determine the host information with the host to be detected.
  • the host ID of the deployed host that is, the target host with the same address information.
  • the address information of the host to be detected is IP address A, MAC address A, and network identification VNI1
  • the address information of the host to be detected is IP address B, MAC address B, and network identification VNI1
  • the host information shown in Table 1 can be looked up according to the address information of the host to be detected, and the target host's host identification can be obtained as bbb .
  • Step 307 Determine whether the device information of the second edge device (that is, the device information carried in the routing information) is the same as the device information of the first edge device associated with the target host.
  • step 308 can be performed. If the device information of the second edge device is the same as the device information of the first edge device associated with the target host , Then step 309 can be performed.
  • the routing information of the host to be detected includes the device information of the second edge device, and the device information of the first edge device associated with the target host has been obtained. Therefore, in this step 307, it can be determined It is detected whether the device information of the second edge device associated with the host is the same as the device information of the first edge device associated with the target host.
  • Step 308 Determine that the host to be detected is an abnormal host.
  • Step 309 Determine that the host to be detected is a normal host.
  • the host 111 when the host 111 (assumed to be the host to be detected) goes online, the host 111 may send an ARP packet to the edge device 121. If the host 111 is a normal host, the ARP message carries real address information, such as IP address A and MAC address A.
  • the edge device 121 After receiving the ARP message, the edge device 121 can generate a BGP message for the host 111 and send the BGP message to the routing management device 131. After receiving the BGP message, the routing management device 131 can send the BGP message ⁇ 161 ⁇ To data processing equipment 161.
  • the BGP message may include routing information.
  • the routing information may include, but is not limited to: the IP address A and MAC address A of the host 111, the network identifier of the host 111 (such as VNI1), and the device information of the edge device 121 (IP address 1). And MAC address 1).
  • the device information of the edge device 121 is the device information of the second edge device associated with the host to be detected.
  • the address information of the host 111 included in the routing information is: IP address A, MAC address A, and network identification VNI1
  • the data processing device 161 can determine whether the host information shown in Table 1 includes the above address information. Since the host information shown in Table 1 includes the foregoing address information, the host identifier of the target host corresponding to the foregoing address information can be obtained from the host information, such as the host identifier aaa. Then, the data processing device 161 can query the LLDP information shown in Table 2 through the host ID aaa, and obtain the device information corresponding to the host ID aaa, that is, the device information is IP address 1 and MAC address 1. Wherein, the device information corresponding to the host identifier aaa is the device information of the first edge device associated with the target host.
  • the device information of the second edge device associated with the host to be detected is IP address 1 and MAC address 1
  • the device information of the first edge device associated with the target host is IP address 1 and MAC address 1, that is, The above two device information is the same, therefore, it can be determined that the host 111 is a normal host.
  • the host 111 when the host 111 (assumed to be the host to be detected) goes online, the host 111 may send an ARP packet to the edge device 121. If host 111 is an abnormal host (such as an attacker), the ARP message carries the address information forged by the attacker. Assuming that the attacker forged the address information of host 112, the ARP message carries IP address B and MAC Address B.
  • the edge device 121 After receiving the ARP message, the edge device 121 can generate a BGP message for the host 111 and send the BGP message to the routing management device 131. After receiving the BGP message, the routing management device 131 can send the BGP message ⁇ 161 ⁇ To data processing equipment 161.
  • the BGP message may include routing information.
  • the routing information may include but is not limited to: the IP address B and MAC address B of the host 111, the network identifier of the host 111 (such as VNI1), and the device information of the edge device 121 (IP address 1). And MAC address 1).
  • the address information of the host 111 included in the routing information is: IP address B, MAC address B, and network identification VNI1
  • the data processing device 161 can determine whether the above address information is included in the host information shown in Table 1. Since the host information shown in Table 1 includes the foregoing address information, the host identifier of the target host corresponding to the foregoing address information can be obtained from the host information, such as the host identifier bbb. Then, the data processing device 161 can query the LLDP information shown in Table 2 through the host identifier bbb to obtain the device information corresponding to the host identifier bbb, that is, the device information is the IP address 2 and the MAC address 2. Wherein, the device information corresponding to the host identifier bbb is the device information of the first edge device associated with the target host.
  • the device information of the second edge device associated with the host to be detected is IP address 1 and MAC address 1
  • the device information of the first edge device associated with the target host is IP address 2 and MAC address 2, that is, The above two device information is different, therefore, it can be determined that the host 111 is an abnormal host.
  • the data processing device 161 can also identify the host 111 as an abnormal host.
  • the data processing device 161 when the data processing device 161 determines that the host 111 is an abnormal host, it can also generate alarm information, and the management personnel can handle the attack behavior, and the processing process will not be repeated.
  • the data processing device (usually a big data processing system) can also analyze whether the host to be detected is an abnormal host, thereby improving identification
  • the accuracy of normal hosts and abnormal hosts can give full play to the data collection and data processing capabilities of the big data processing system.
  • the above method does not require the controller to analyze whether the host to be detected is an abnormal host, which reduces the workload of the controller, saves the processing resources of the controller, and improves the processing performance of the controller.
  • the data processing device may also include: determining whether there is a corresponding host in the history database Entry; if there is an entry corresponding to the host to be detected in the history database, store the routing information and the time of obtaining the routing information in the entry; if the history database does not exist in the waiting list
  • the entry corresponding to the host is detected, the entry corresponding to the host to be detected is added to the history database, and the routing information and the acquisition time of the routing information are stored in the newly added entry.
  • Table 3 is an example of a historical database, which is used to record routing information.
  • Table 3 is only an example, and other content may also be included, which is not limited.
  • the host 111 can resend an ARP packet.
  • the edge device 121 can send a BGP message to the routing management device 131, and the routing management device 131
  • the BGP message may be sent to the data processing device 161, and the data processing device 161 finally obtains the routing information of the host 111.
  • the routing information includes address information of the host 111 (such as IP address A, MAC address A, and network identification VNI1), and device information of the edge device 121 (such as IP address 1 and MAC address 1).
  • the data processing device 161 may also determine the acquisition time of the routing information, such as time D.
  • the data processing device 161 may also determine whether there is an entry corresponding to address information (such as IP address A, MAC address A, and network identifier VNI1) in the historical database shown in Table 3. Due to existence, the corresponding relationship between IP address A, MAC address A and network identification VNI1, IP address 1 and MAC address 1, time D is stored in the table entry, as shown in Table 4.
  • address information such as IP address A, MAC address A, and network identifier VNI1
  • the data processing device 161 can add routing information to the table entry instead of replacing the routing information that already exists in the table entry, that is, it can be used for a long time.
  • the routing information can be saved and retrieved quickly in chronological order.
  • the historical database not only stores information during normal routing, but also information during abnormal routing.
  • the historical database can also be queried according to historical time, so as to support long-term access behavior abnormality backtracking. For example, as shown in Table 3 or 4 above, the host corresponding to IP address B, MAC address B, and network identifier VNI1 occurred at time C abnormal. Therefore, based on the massive amount of time-series information stored in the big data system, it is possible to quickly trace back the abnormal access behavior at any point in history.
  • the data processing device 161 may include a data collector and a data analyzer.
  • the data collector is used to implement data collection
  • the data analyzer is used to implement data analysis. Based on this, step 301 to step 303 can be performed by the data collector, and step 304 to step 309 can be performed by the data analyzer.
  • FIG. 4 is a structural diagram of the device. As shown in FIG. 4, the device includes The following modules.
  • the first obtaining module 41 is configured to obtain host information of the deployed host from the controller, where the host information includes address information of the deployed host.
  • the second acquiring module 42 is configured to acquire routing information of the host to be detected, where the routing information includes address information of the host to be detected.
  • the first determining module 43 is configured to determine whether the address information of the deployed host includes the address information of the host to be detected.
  • the first determining module 44 is configured to determine that the host to be detected is an abnormal host when the address information of the deployed host does not include the address information of the host to be detected.
  • the apparatus further includes (not shown in the figure): an establishment module, which is used to negotiate with the route management device to establish a BGP neighbor; the second acquisition module 42 is specifically used to: receive the route management device Send routing information of the host to be detected.
  • the device further includes (not shown in the figure): a third obtaining module, configured to obtain the LLDP information of the deployed host from the controller, wherein the LLDP information includes the Device information of the first edge device associated with the deployed host; if the address information of the deployed host includes the address information of the host to be detected, the apparatus further includes (not shown in the figure): fourth acquisition A module for obtaining device information of the first edge device associated with a target host from the LLDP information, where the target host is a deployed host with the same address information as the host to be detected; second determination Module for determining that the host to be detected is the abnormal host if the device information of the second edge device associated with the host to be detected is different from the device information of the first edge device associated with the target host.
  • the device information of the second edge device associated with the host to be detected is included in the routing information.
  • the host information further includes the host identifier of the deployed host, and the LLDP information also includes the host identifier of the deployed host;
  • the fourth acquiring module is specifically configured to: according to the target host Query the host information of the target host to obtain the host identification of the target host; query the LLDP information of the target host according to the host identification of the target host to obtain the first edge device associated with the target host Device Information.
  • the second determining module is further configured to, if the device information of the second edge device associated with the host to be detected is the same as the device information of the first edge device associated with the target host, It is determined that the host to be detected is a normal host.
  • the device further includes (not shown in the figure): a second determining module, configured to determine whether there is any information in the history database after the second acquiring module acquires the routing information of the host to be detected The entry corresponding to the host to be detected; a storage module for storing the routing information and the routing information in the entry when the entry corresponding to the host to be detected exists in the history database Acquisition time; the adding module is used to, when the entry corresponding to the host to be detected does not exist in the history database, add the entry corresponding to the host to be detected in the history database, and add the entry in the newly added table
  • the routing information and the acquisition time of the routing information are stored in the item.
  • An embodiment of the present application provides a data processing device. From a hardware perspective, a schematic diagram of the hardware architecture of the data processing device may be specifically shown in FIG. 5.
  • the data processing device includes: a machine-readable storage medium 502 and a processor 501.
  • the data processing device may further include an interface 503 and a bus 504.
  • the machine-readable storage medium 502 stores machine executable instructions that can be executed by the processor 501.
  • the processor 501 communicates with the machine-readable storage medium 502, reads and executes machine-executable instructions stored in the machine-readable storage medium 502, and implements the monitoring operation of the abnormal host disclosed in the above-mentioned examples of this application.
  • the interface 503 can be used to connect with the controller and the routing management device.
  • the processor 501, the machine-readable storage medium 502, and the interface 503 may communicate with each other through a bus 504.
  • the machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device, and may contain or store information, such as executable instructions, data, and so on.
  • the machine-readable storage medium may be: volatile memory, including RAM (Radom Access Memory, random access memory) and non-volatile memory, including flash memory, storage drives (such as hard drives), solid state drives, and any type of Storage discs (such as optical discs, DVDs, etc.), or similar storage media, or a combination of them.
  • a typical implementation device is a computer.
  • the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device,
  • the instruction device realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so that the computer or other programmable equipment is executed
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供一种异常主机的监控方法及装置、数据处理设备。其中，该方法包括：从控制器获取已部署主机的主机信息，其中，所述主机信息包括所述已部署主机的地址信息；获取待检测主机的路由信息，所述路由信息包括所述待检测主机的地址信息；确定所述已部署主机的地址信息中是否包括所述待检测主机的地址信息；如果所述已部署主机的地址信息中不包括所述待检测主机的地址信息，则确定所述待检测主机是异常主机。

Description

异常主机的监控 背景技术
以太网虚拟专用网络(Ethernet Virtual Private Network，EVPN)是二层虚拟专用网络(Virtual Private Network，VPN)技术，控制平面采用多协议边界网关协议(Multi Protocol Border Gateway Protocol，MP-BGP)通告路由信息，数据平面采用可扩展虚拟局域网络(Virtual eXtensible Local Area Network，VXLAN)封装方式转发报文。其中，VXLAN是一种基于IP(Internet Protocol)网络、采用介质访问控制(Media Access Control，MAC)和用户数据报协议(User Datagram Protocol，UDP)封装形式的二层VPN技术，VXLAN可以基于已有的服务提供商或者企业IP网络，为分散的站点提供二层互联，并能够为不同的租户提供业务的隔离。
EVPN网络包括主机和边缘设备，边缘设备可以学习主机的转发表项，利用转发表项将数据报文发送给主机。例如，边缘设备A收到主机A发送的地址解析协议(Address Resolution Protocol，ARP)报文后，学习主机A的转发表项1，将主机A的地址通告给边缘设备B，边缘设备B学习主机A的转发表项2。边缘设备B收到主机B发送给主机A的数据报文时，利用转发表项2将数据报文发送给边缘设备A，边缘设备A利用转发表项1将数据报文发送给主机A。
附图说明
为了更加清楚地的说明本申请实施例或者现有技术中的技术方案，下面将对本申请实施例或者现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，还可以根据本申请实施例的这些附图获得其他的附图。
图1是本申请一实施例中的应用场景示意图。
图2是本申请一实施例中的异常主机的监控方法的流程图。
图3是本申请另一实施例中的异常主机的监控方法的流程图。
图4是本申请一实施例中的异常主机的监控装置的结构图。
图5是本申请一实施例中的数据处理设备的硬件结构图。
具体实施方式
在本申请实施例使用的术语仅仅是出于描述特定实施例的目的，而非限制本申请。本申请和权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其它含义。还应当理解，本文中使用的术语“和/或”是指包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，此外，所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
在EVPN网络遭到攻击时，攻击者可能通过主机发送大量攻击ARP报文，则边缘设备将学习到大量转发表项，从而造成表项资源的浪费，影响边缘设备的处理性能。为此，在一个例子中，边缘设备在接收到ARP报文后，可以将ARP报文发送给控制器，由控制器分析ARP报文是否为攻击者发送。若ARP报文是攻击者发送，则控制器可以产生告警信息，由管理人员对攻击行为进行处理。
但是，EVPN网络中存在大量ARP报文，由控制器分析这些ARP报文是否为攻击者发送，工作量很大，消耗控制器的大量资源，降低处理性能。
本申请实施例中提出一种异常主机的监控方法，该方法可以应用于包括主机、边缘设备、控制器、云平台、路由管理设备和数据处理设备的网络中，如EVPN网络等。参见图1所示，为本申请实施例的应用场景示意图。在图1中，是以主机111和主机112为例进行说明，在实际应用中，主机的数量可以更多。此外，以边缘设备121和边缘设备122为例进行说明，在实际应用中，边缘设备的数量可以更多。
其中，主机111和112可以是物理服务器上部署的虚拟机，也可以是物理服务器，还可以是其它类型的主机，例如，个人计算机、终端设备、移动终端等。
边缘设备121和122可以是可扩展虚拟局域网络隧道端点(VXLAN Tunnel End Point，VTEP)设备，也可以是其它类型的边缘设备。进一步的，VTEP设备可以作为EVPN网络的边缘设备，与VXLAN有关的处理均在VTEP设备进行。
控制器141可以是软件定义网络(Software Define Network，SDN)控制器，也可以是其它类型的控制器。云平台151可以是Openstack云平台，也可以是其它类型的云平 台。EVPN网络使用Openstack云平台和SDN控制器实现控制平面的功能。
路由管理设备131用于收集EVPN网络中的所有路由信息，例如，路由管理设备131可以是路由反射器(Route Reflector，RR)，也可以是其它类型的设备。
数据处理设备161可以是大数据处理系统中的设备，数据处理设备161可以采用大数据技术实现数据收集、数据分析、数据存储、数据统计、数据挖掘等功能。
在介绍本申请实施例中的异常主机的监控方法之前，先介绍如下技术。
1、主机类型。本实施例中的主机可以划分为已部署主机和待检测主机，已部署主机是真正部署在网络的主机，是合法的主机。已部署主机可以包括已在线主机和未在线主机，已在线主机是已经访问网络的主机，未在线主机是未访问网络的主机，已在线主机和未在线主机均是真正部署在网络的合法的主机。
待检测主机是需要进行检测的主机，本实施例中的异常主机的监控方法，正是检测该待检测主机是否为异常主机。若待检测主机是异常主机，则待检测主机不属于已部署主机，需要进行异常处理。若待检测主机不是异常主机，即待检测主机是正常主机，则待检测主机属于已部署主机，允许其访问网络。
2、控制器获取已部署主机的主机信息，并在本地存储该主机信息。
在一个例子中，可以由云平台为租户创建主机(例如，在物理服务器上为租户创建虚拟机，或者，将物理服务器分配给租户)，并为该主机分配主机信息，为了区分方便，将云平台为租户创建的所有主机均称为已部署主机。然后，云平台将已部署主机的主机信息发送给控制器，由控制器存储该主机信息。
需要注意的是，EVPN网络中的所有已部署主机均可以由云平台创建，也就是说，云平台向控制器发送的主机信息，包括所有已部署主机的主机信息。
其中，主机信息可以包括但不限于：地址信息和主机标识。进一步的，该地址信息可以包括但不限于：IP地址、MAC地址和网络标识，网络标识可以如VNI(VXLAN Network Identifier，可扩展虚拟局域网的网络标识)等。若主机是物理服务器上部署的虚拟机，则该主机标识可以是该虚拟机所在的物理服务器的设备标识，若主机是物理服务器，则该主机标识可以是该物理服务器的设备标识。
参见表1所示，为控制器存储的主机信息的示例，这些主机信息是EVPN网络中的所有已部署主机的主机信息的示例，后续以这些主机信息为例进行说明。
表1
序号 IP地址 MAC地址 网络标识 主机标识
1 IP地址A MAC地址A VNI1 aaa
2 IP地址B MAC地址B VNI1 bbb
3 IP地址C MAC地址C VNI2 ccc
4 IP地址D MAC地址D VNI2 ddd
… … … … …
3、控制器可以获取上述已部署主机的链路层发现协议(Link Layer Discovery Protocol，LLDP)信息，并在本地存储已部署主机的LLDP信息。其中，该LLDP信息可以包括但不限于已部署主机对应的主机标识、与已部署主机关联的边缘设备的设备信息，该设备信息可以包括IP地址和/或MAC地址等。
在一个例子中，若已部署主机是物理服务器上部署的虚拟机，则已部署主机对应的主机标识可以是该虚拟机所在的物理服务器的设备标识，与已部署主机关联的边缘设备可以是与该虚拟机所在的物理服务器连接的边缘设备。或者，若已部署主机是物理服务器，则已部署主机对应的主机标识可以是该物理服务器的设备标识，与已部署主机关联的边缘设备可以是与该物理服务器连接的边缘设备。
参见上述实施例，已部署主机可以包括已在线主机和未在线主机，针对已在线主机来说，为了获取已在线主机的LLDP信息，则可以采用如下方式。
参见图1所示，当主机111上线后，即主机111成为已在线主机，则主机111可以向与主机111连接的边缘设备121发送LLDP报文，该LLDP报文包括主机111的管理地址、主机标识等内容。边缘设备121在接收到LLDP报文后，可以通过openflow将该LLDP报文发送给控制器141。
其中，控制器141可以向边缘设备121下发控制流表，这个控制流表用于使边缘设备121将LLDP报文发送给控制器141，例如，这个控制流表的匹配选项包括协议类型是LLDP类型，动作项包括上送控制器。基于此，边缘设备121在接收到LLDP报文后，由于该LLDP报文与该控制流表匹配，因此，可以将LLDP报文发送给控制器141。
控制器141在接收到LLDP报文后，从LLDP报文中获取主机111的管理地址、主机标识等内容。此外，由于控制器141能够管理所有的边缘设备，因此，控制器141在 接收到边缘设备121发送的LLDP报文后，还可以获取边缘设备121的设备信息(如IP地址、MAC地址等)。综上所述，控制器141可以获取到主机111的主机标识和边缘设备121的设备信息，而该主机标识和该设备信息包含在主机111的LLDP信息中。
针对未在线主机来说，为了获取未在线主机的LLDP信息，可以采用如下方式。
(1)假设主机112未在线，且未在线主机112是物理服务器上部署的虚拟机，假设该物理服务器已经在线，则物理服务器可以向与该物理服务器连接的边缘设备122发送LLDP报文，该LLDP报文包括物理服务器的主机标识，这个主机标识也就是该物理服务器上部署的所有虚拟机的主机标识。
边缘设备122在接收到LLDP报文后，将该LLDP报文发送给控制器141。控制器141在接收到LLDP报文后，从LLDP报文中获取物理服务器的主机标识，并获取边缘设备122的设备信息(如IP地址、MAC地址等)，而物理服务器的主机标识和边缘设备122的设备信息包含在主机112的LLDP信息中。
(2)假设主机111未在线，且未在线主机111是物理服务器，则边缘设备121可以向主机111发送LLDP报文，该LLDP报文可以携带边缘设备121的设备信息(如IP地址、MAC地址等)。在一个例子中，虽然主机111未在线，但其操作系统和LLDP守护进程依然正常工作，因此可以在未在线的情况下，接收边缘设备121发送的LLDP报文。主机111在接收到LLDP报文后，可以将边缘设备121的设备信息、主机111的主机标识发送给云平台151，由于主机直接受云平台的控制，所以可以通过内部通道发送信息给云平台。云平台151将边缘设备121的设备信息、主机111的主机标识发送给控制器141，而边缘设备121的设备信息、主机111的主机标识包含在边缘设备121的LLDP信息中。
综上所述，控制器141可以获取每个已部署主机的LLDP信息，并存储每个已部署主机的LLDP信息，表2为LLDP信息的一个示例。
表2
主机标识 边缘设备的设备信息
aaa IP地址1和MAC地址1
bbb IP地址2和MAC地址2
ccc IP地址3和MAC地址3
ddd IP地址4和MAC地址4
… …
4、路由管理设备接收路由信息，并向边缘设备同步该路由信息。
在一个例子中，参见图1所示，当主机111上线时，主机111向边缘设备121发送ARP报文(如ARP请求报文或者免费ARP报文等)。边缘设备121在接收到ARP报文后，可以在转发表项中记录ARP报文的源地址(即主机111的地址，如IP地址和/或MAC地址等)与ARP报文的入接口的对应关系。
进一步的，边缘设备121在接收到该ARP报文后，还可以生成BGP消息(如MP-BGP消息)，该BGP消息可以包括路由信息，该路由信息可以包括但不限于：主机111的地址信息(该地址信息可以包括IP地址、MAC地址和网络标识)，边缘设备121的设备信息(该设备信息可以包括IP地址、MAC地址等)。
边缘设备121在生成BGP消息后，可以将BGP消息发送给边缘设备122。边缘设备122在接收到BGP消息后，可以从BGP消息中获取主机111的地址信息，并在转发表项中记录主机111的地址信息(如IP地址、MAC地址和网络标识等)与隧道的对应关系，对此转发表项的学习过程不做限制。其中，该隧道可以是边缘设备122与边缘设备121之间的隧道，如VXLAN隧道等。
边缘设备121将BGP消息发送给边缘设备122，可以包括但不限于以下两种方式。
方式一、边缘设备121可以直接将BGP消息发送给边缘设备122。
方式二、边缘设备121可以将BGP消息发送给路由管理设备131，路由管理设备131在接收到BGP消息后，将该BGP消息发送给边缘设备122。
为了实现方式一，则任意两个边缘设备之间需要建立BGP邻居，如存在100个边缘设备时，则每个边缘设备均需要与其它99个边缘设备建立BGP邻居，对网络资源和 CPU(Central Processing Unit)资源的消耗很大。
而实施方式二中，可以在EVPN网络部署路由管理设备131(如路由反射器)，这样，每个边缘设备只需要与路由管理设备131建立BGP邻居，不再与其它边缘设备建立BGP邻居，从而减少网络资源和CPU资源的消耗。
当在EVPN网络中部署路由管理设备131时，可以采用方式二传输BGP消息，即，每个边缘设备在发送BGP消息时，将BGP消息发送给路由管理设备131，由路由管理设备131将BGP消息发送给其它边缘设备。
本申请实施例中，以采用方式二为例进行说明。在采用方式二时，路由管理设备131可以收集到EVPN网络中产生的所有BGP消息，每个BGP消息均包括发布者发布的路由信息，如主机的地址信息、边缘设备的设备信息等。
在上述应用场景下，本申请提供了一种异常主机的监控方法。图2为异常主机的监控方法的流程示意图，参见图2，该方法可以应用于数据处理设备，该方法可以包括以下步骤。
步骤201，从控制器获取已部署主机的主机信息，其中，该主机信息包括已部署主机的地址信息。此外，该主机信息还可以包括已部署主机的主机标识。
参见上述实施例，控制器中已经存储EVPN网络中的所有已部署主机的主机信息，因此，数据处理设备可以从控制器获取EVPN网络中的所有已部署主机的主机信息，参见表1所示，这些主机信息可以包括但不限于地址信息和主机标识，该地址信息可以包括IP地址、MAC地址和网络标识等。
步骤202，获取待检测主机的路由信息，该路由信息包括待检测主机的地址信息。其中，待检测主机是需要进行检测的主机，为异常主机或者正常主机。
在一个例子中，数据处理设备可以与路由管理设备协商建立BGP邻居。具体的，可以在数据处理设备配置BGP协议，这样，数据处理设备就可以与路由管理设备协商建立BGP邻居，对此BGP邻居的建立过程不做限制。
在一个例子中，获取待检测主机的路由信息，可以包括但不限于：接收路由管理设备发送的待检测主机的路由信息。
具体的，由于数据处理设备已经与路由管理设备协商建立BGP邻居，因此，路由管理设备每次接收到路由信息时，就可以将该路由信息发送给数据处理设备。
具体的，参见上述实施例，路由管理设备可以收集EVPN网络中产生的所有BGP消息。BGP消息包括路由信息，该路由信息可以包括待检测主机的地址信息、与待检测主机关联的边缘设备的设备信息。由于数据处理设备已经与路由管理设备协商建立BGP邻居，因此，路由管理设备在收集到每个BGP消息时，将该BGP消息发送给数据处理设备。数据处理设备接收到BGP消息后，可以从BGP消息中获取路由信息，如待检测主机的地址信息、与待检测主机关联的边缘设备的设备信息。
步骤203，确定已部署主机的地址信息中是否包括待检测主机的地址信息。
如果已部署主机的地址信息中不包括待检测主机的地址信息，则可以执行步骤204，如果已部署主机的地址信息中包括待检测主机的地址信息，则可以执行步骤205。
步骤204，确定该待检测主机是异常主机。
步骤205，确定该待检测主机是正常主机。
在一个例子中，数据处理设备可以从控制器获取EVPN网络中所有已部署主机的主机信息，参见表1所示，基于此，当表1所示的主机信息中包括待检测主机的地址信息，则可以确定待检测主机是正常主机，当表1所示的主机信息中不包括待检测主机的地址信息，则可以确定待检测主机是异常主机。
在一种情况中，参见图1所示，当主机111(假设为待检测主机)上线后，向边缘设备121发送ARP报文。若主机111是正常主机，则ARP报文携带的是真实的地址信息，如IP地址A和MAC地址A。
边缘设备121在接收到ARP报文后，可以生成针对主机111的BGP消息，并将该BGP消息发送给路由管理设备131，路由管理设备131在接收到该BGP消息后，可以将该BGP消息发送给数据处理设备161。
其中，该BGP消息可以包括路由信息，该路由信息可以包括但不限于：主机111的IP地址A和MAC地址A，主机111的网络标识(如VNI1)，边缘设备121的设备信息(IP地址1和MAC地址1)。
在该情况中，路由信息包括的主机111的地址信息是：IP地址A、MAC地址A和网络标识VNI1，则判断表1所示的主机信息中是否包括上述地址信息。由于表1所示的主机信息中包括上述地址信息，因此，可以确定主机111是正常主机。
在另一种情况中，参见图1所示，当主机111(假设为待检测主机)上线后，向边 缘设备121发送ARP报文。若主机111是异常主机(如攻击者)，则ARP报文携带的是攻击者伪造的地址信息，如IP地址AAA和MAC地址AAA。
边缘设备121在接收到ARP报文后，可以生成针对主机111的BGP消息，并将该BGP消息发送给路由管理设备131，路由管理设备131在接收到该BGP消息后，可以将该BGP消息发送给数据处理设备161。
其中，该BGP消息可以包括路由信息，该路由信息可以包括但不限于：主机111的IP地址AAA和MAC地址AAA，主机111的网络标识(如VNI1)，边缘设备121的设备信息(IP地址1和MAC地址1)。
在该情况中，路由信息包括的主机111的地址信息是：IP地址AAA、MAC地址AAA和网络标识VNI1，则判断表1所示的主机信息中是否包括上述地址信息。由于表1所示的主机信息中不包括上述地址信息，因此，可以确定主机111是异常主机。
在一个例子中，数据处理设备161确定主机111是异常主机时，还可以产生告警信息，由管理人员对攻击行为进行处理，对此处理过程不再赘述。
基于上述技术方案，本申请实施例中，数据处理设备(通常为大数据处理系统)可以从控制器获取已部署主机的主机信息，从路由管理设备获取待检测主机的路由信息，并根据主机信息和路由信息分析待检测主机是否为异常主机，从而充分发挥大数据处理系统的数据收集能力和数据处理能力，并准确分析待检测主机是否为异常主机。上述方式不需要由控制器分析待检测主机是否为异常主机，减轻控制器的工作量，节约控制器的处理资源，提高控制器的处理性能。在上述方式中，基于大数据技术分析待检测主机是否为异常主机，进行主机行为的分析、异常检测和错误纠正，使得网络维护人员精确掌握每个主机的网络接入信息、快速感知主机的异常接入行为。
在上述应用场景下，本申请还提供了另一种异常主机的监控方法。图3为异常主机的监控方法的流程示意图，如图3所示，该方法可以应用于数据处理设备，该方法可以包括以下步骤：
步骤301，从控制器获取已部署主机的主机信息，其中，该主机信息包括已部署主机的地址信息。此外，该主机信息还可以包括已部署主机的主机标识。
其中，步骤301的实现过程可以参见步骤201，在此不再赘述。
步骤302，从控制器获取已部署主机的LLDP信息，其中，该LLDP信息包括已部署主机的主机标识、已部署主机关联的第一边缘设备的设备信息。
参见上述实施例，控制器中已经存储EVPN网络中的所有已部署主机的LLDP信息，因此，数据处理设备可以从控制器获取EVPN网络中的所有已部署主机的LLDP信息，参见表2所示，这些LLDP信息可以包括但不限于：已部署主机的主机标识、与该已部署主机关联的第一边缘设备的设备信息。
步骤303，获取待检测主机的路由信息，该路由信息包括待检测主机的地址信息、与待检测主机关联的第二边缘设备的设备信息，如IP地址和/或MAC地址。其中，与待检测主机关联的边缘设备可以称为第二边缘设备。其中，步骤303的实现过程可以参见步骤202，在此不再赘述。
步骤304，确定已部署主机的地址信息中是否包括待检测主机的地址信息。
如果已部署主机的地址信息中不包括待检测主机的地址信息，则可以执行步骤305，如果已部署主机的地址信息中包括待检测主机的地址信息，则可以执行步骤306。
步骤305，确定该待检测主机是异常主机。
在一个例子中，数据处理设备可以从控制器获取EVPN网络中所有已部署主机的主机信息，参见表1所示，基于此，当表1所示的主机信息中不包括待检测主机的地址信息，则可以确定待检测主机是异常主机。当表1所示的主机信息中包括待检测主机的地址信息，则可以执行步骤306及后续步骤。
步骤306，从LLDP信息中获取目标主机关联的第一边缘设备的设备信息，其中，为了描述方便，本实施例中将与所述待检测主机的地址信息相同的已部署主机称为目标主机。
参见上述实施例，已部署主机的主机信息包括已部署主机的地址信息、已部署主机的主机标识，LLDP信息包括已部署主机的主机标识、已部署主机关联的第一边缘设备的设备信息，路由信息包括待检测主机的地址信息。
基于此，在已部署主机的地址信息中包括待检测主机的地址信息的情况下，从LLDP信息中获取目标主机关联的第一边缘设备的设备信息，可以包括：根据目标主机的地址信息(目标主机的地址信息与待检测主机的地址信息相同)查询主机信息，得到目标主机的主机标识；根据目标主机的主机标识查询LLDP信息，得到目标主机关联的第一边缘设备的设备信息。
例如，参见表1所示，由于主机信息包括地址信息与主机标识的对应关系，因此，数据处理设备可以通过待检测主机的地址信息查询表1所示的主机信息，确定出与待检 测主机的地址信息相同的已部署主机(即目标主机)的主机标识。
例如，若待检测主机的地址信息为IP地址A、MAC地址A和网络标识VNI1，则根据待检测主机的地址信息查询表1所示的主机信息，可以命中得到表1中目标主机的主机标识为aaa。又例如，若待检测主机的地址信息为IP地址B、MAC地址B和网络标识VNI1，则根据待检测主机的地址信息查询表1所示的主机信息，可以命中得到目标主机的主机标识为bbb。
在得到目标主机的主机标识为aaa后，通过主机标识aaa查询表2所示的LLDP信息，得到目标主机关联的第一边缘设备的设备信息为IP地址1和MAC地址1。
步骤307，确定第二边缘设备的设备信息(即路由信息中携带的设备信息)与目标主机关联的第一边缘设备的设备信息是否相同。
如果第二边缘设备的设备信息和目标主机关联的第一边缘设备的设备信息不相同，则可以执行步骤308，如果第二边缘设备的设备信息和目标主机关联的第一边缘设备的设备信息相同，则可以执行步骤309。
参见上述实施例，在待检测主机的路由信息中，包括第二边缘设备的设备信息，而且，已经获取目标主机关联的第一边缘设备的设备信息，因此，在本步骤307中，可以判断待检测主机关联的第二边缘设备的设备信息与目标主机关联的第一边缘设备的设备信息是否相同。
步骤308，确定该待检测主机是异常主机。
步骤309，确定该待检测主机是正常主机。
在一种情况中，参见图1所示，当主机111(假设为待检测主机)上线后，主机111可以向边缘设备121发送ARP报文。若主机111是正常主机，则ARP报文携带的是真实的地址信息，如IP地址A和MAC地址A。
边缘设备121在接收到ARP报文后，可以生成针对主机111的BGP消息，并将该BGP消息发送给路由管理设备131，路由管理设备131在接收到该BGP消息后，可以将该BGP消息发送给数据处理设备161。
其中，该BGP消息可以包括路由信息，该路由信息可以包括但不限于：主机111的IP地址A和MAC地址A，主机111的网络标识(如VNI1)，边缘设备121的设备信息(IP地址1和MAC地址1)。其中，边缘设备121的设备信息是待检测主机关联 的第二边缘设备的设备信息。
在该情况中，路由信息包括的主机111的地址信息是：IP地址A、MAC地址A和网络标识VNI1，则数据处理设备161可以判断表1所示的主机信息中是否包括上述地址信息。由于表1所示的主机信息中包括上述地址信息，因此，可以从主机信息中获取与上述地址信息对应的目标主机的主机标识，如主机标识aaa。然后，数据处理设备161可以通过主机标识aaa查询表2所示的LLDP信息，得到与主机标识aaa对应的设备信息，即该设备信息为IP地址1和MAC地址1。其中，与主机标识aaa对应的设备信息是目标主机关联的第一边缘设备的设备信息。
综上所述，待检测主机关联的第二边缘设备的设备信息为IP地址1和MAC地址1，目标主机关联的第一边缘设备的设备信息为IP地址1和MAC地址1，也就是说，上述两个设备信息相同，因此，可以确定主机111是正常主机。
在另一种情况中，参见图1所示，当主机111(假设为待检测主机)上线后，主机111可以向边缘设备121发送ARP报文。若主机111是异常主机(如攻击者)，则ARP报文携带的是攻击者伪造的地址信息，假设攻击者伪造的是主机112的地址信息，则ARP报文携带的是IP地址B和MAC地址B。
边缘设备121在接收到ARP报文后，可以生成针对主机111的BGP消息，并将该BGP消息发送给路由管理设备131，路由管理设备131在接收到该BGP消息后，可以将该BGP消息发送给数据处理设备161。
其中，该BGP消息可以包括路由信息，该路由信息可以包括但不限于：主机111的IP地址B和MAC地址B，主机111的网络标识(如VNI1)，边缘设备121的设备信息(IP地址1和MAC地址1)。
在该情况中，路由信息包括的主机111的地址信息是：IP地址B、MAC地址B和网络标识VNI1，则数据处理设备161可以判断表1所示的主机信息中是否包括上述地址信息。由于表1所示的主机信息中包括上述地址信息，因此，可以从主机信息中获取与上述地址信息对应的目标主机的主机标识，如主机标识bbb。然后，数据处理设备161可以通过主机标识bbb查询表2所示的LLDP信息，得到与主机标识bbb对应的设备信息，即该设备信息为IP地址2和MAC地址2。其中，与主机标识bbb对应的设备信息是目标主机关联的第一边缘设备的设备信息。
综上所述，待检测主机关联的第二边缘设备的设备信息为IP地址1和MAC地 址1，目标主机关联的第一边缘设备的设备信息为IP地址2和MAC地址2，也就是说，上述两个设备信息不同，因此，可以确定主机111是异常主机。
综上所述，主机111在发送ARP报文时，即使ARP报文携带的是攻击者伪造的合法主机的地址信息，数据处理设备161也可以识别主机111为异常主机。
在一个例子中，数据处理设备161确定主机111是异常主机时，还可以产生告警信息，由管理人员对攻击行为进行处理，对此处理过程不再赘述。
基于上述技术方案，本申请实施例中，即使攻击者伪造的是正常主机的地址信息，数据处理设备(通常为大数据处理系统)也可以分析这个待检测主机是否为异常主机，从而提高识别出正常主机和异常主机的准确率，能够充分发挥大数据处理系统的数据收集能力和数据处理能力。上述方式不需要由控制器分析待检测主机是否为异常主机，减轻控制器的工作量，节约控制器的处理资源，提高控制器的处理性能。在上述方式中，基于大数据技术分析待检测主机是否为异常主机，进行主机行为分析、异常检测和错误纠正，使得网络维护人员精确掌握每个主机的网络接入信息、快速感知主机的异常接入行为。
在上述实施例中，数据处理设备获取待检测主机的路由信息(如地址信息、待检测主机关联的边缘设备的设备信息)之后，还可以包括：确定历史数据库中是否存在该待检测主机对应的表项；如果所述历史数据库中存在所述待检测主机对应的表项，在该表项中存储所述路由信息和所述路由信息的获取时间；如果所述历史数据库中不存在所述待检测主机对应的表项，在历史数据库中添加该待检测主机对应的表项，并在新添加的表项中存储所述路由信息和所述路由信息的获取时间。
例如，表3为历史数据库的一个示例，该历史数据库用于记录路由信息。当然，表3只是一个示例，还可以包括其它内容，对此不做限制。
表3
Figure PCTCN2020080223-appb-000001
在一个例子中，假设主机111下线后重新上线，则主机111可以重新发送ARP报文，边缘设备121在接收到该ARP报文后，可以向路由管理设备131发送BGP消息，路由管理设备131可以将BGP消息发送给数据处理设备161，数据处理设备161最终获取到主机111的路由信息，对此过程不再赘述，可以参见上述实施例。其中，该路由信息包括主机111的地址信息(如IP地址A、MAC地址A和网络标识VNI1)，边缘设备121的设备信息(如IP地址1和MAC地址1)。数据处理设备161还可以确定该路由信息的获取时间，如时刻D。
本申请实施例中，数据处理设备161还可以判断表3所示的历史数据库中是否存在地址信息(如IP地址A、MAC地址A和网络标识VNI1)对应的表项。由于存在，因此，在该表项中存储IP地址A、MAC地址A和网络标识VNI1、IP地址1和MAC地址1、时刻D的对应关系，参见表4所示。
表4
Figure PCTCN2020080223-appb-000002
综上所述，本实施例中，由于大数据系统可以存储海量信息，因此，数据处理设备161可以在表项中添加路由信息，而不是替换表项中已存在的路由信息，即可以长时间的保存路由信息，可以按照时间顺序保存、快速检索信息。由于大数据系统可以存储海量信息，历史数据库不但存储了正常路由时候的信息，还可以存储异常路由时候的信息。历史数据库还可以按照历史时间进行查询，从而支持长时间接入行为异常的原因回溯，例如，如上表3或4所示，IP地址B、MAC地址B和网络标识VNI1对应的主机在时刻C发生异常。因此，基于大数据系统保存的海量带有时间序列属性的信息，可以快速回溯历史上任意时间点的异常接入行为。
在上述实施例中，数据处理设备161可以包括数据收集器和数据分析器，数据收集器用于实现数据的收集，而数据分析器用于实现数据的分析。基于此，可以由数据收集器执行步骤301-步骤303，由数据分析器执行步骤304-步骤309。
基于与上述方法同样的申请构思，本申请实施例中还提出一种异常主机的监控装置，应用于数据处理设备，图4为所述装置的结构图，如图4所示，所述装置包括以下模块。
第一获取模块41，用于从控制器获取已部署主机的主机信息，其中，所述主机信息包括所述已部署主机的地址信息。
第二获取模块42，用于获取待检测主机的路由信息，其中，所述路由信息包括 所述待检测主机的地址信息。
第一判断模块43，用于确定所述已部署主机的地址信息中是否包括所述待检测主机的地址信息。
第一确定模块44，用于当所述已部署主机的地址信息中不包括所述待检测主机的地址信息，确定所述待检测主机是异常主机。
在一个例子中，所述装置还包括(在图中未示出)：建立模块，用于与路由管理设备协商建立BGP邻居；所述第二获取模块42具体用于：接收所述路由管理设备发送的待检测主机的路由信息。
在一个例子中，所述装置还包括(在图中未示出)：第三获取模块，用于从所述控制器获取所述已部署主机的LLDP信息，其中，所述LLDP信息包括所述已部署主机关联的第一边缘设备的设备信息；如果所述已部署主机的地址信息中包括所述待检测主机的地址信息，所述装置还包括(在图中未示出)：第四获取模块，用于从所述LLDP信息中获取目标主机关联的所述第一边缘设备的设备信息，其中，所述目标主机为与所述待检测主机的地址信息相同的已部署主机；第二确定模块，用于若所述待检测主机关联的第二边缘设备的设备信息与所述目标主机关联的所述第一边缘设备的设备信息不同，确定待检测主机是所述异常主机，其中，所述待检测主机关联的所述第二边缘设备的设备信息包括在所述路由信息中。
在一个例子中，所述主机信息还包括所述已部署主机的主机标识，所述LLDP信息还包括所述已部署主机的主机标识；所述第四获取模块具体用于：根据所述目标主机的地址信息查询该目标主机的主机信息，得到所述目标主机的主机标识；根据所述目标主机的主机标识查询该目标主机的LLDP信息，得到所述目标主机关联的所述第一边缘设备的设备信息。
在一个例子中，所述第二确定模块，还用于若所述待检测主机关联的所述第二边缘设备的设备信息与所述目标主机关联的所述第一边缘设备的设备信息相同，则确定所述待检测主机是正常主机。
在一个例子中，所述装置还包括(在图中未示出)：第二判断模块，用于在所述第二获取模块获取所述待检测主机的路由信息之后，确定历史数据库中是否存在所述待检测主机对应的表项；存储模块，用于当所述历史数据库中存在所述待检测主机对应的表项，则在所述表项中存储所述路由信息和所述路由信息的获取时间；添加模块用于， 当所述历史数据库中不存在所述待检测主机对应的表项，则在所述历史数据库中添加所述待检测主机对应的表项，并在新添加的表项中存储所述路由信息和所述路由信息的获取时间。
本申请实施例中提供一种数据处理设备，从硬件层面而言，数据处理设备的硬件架构示意图具体可以参见图5所示。数据处理设备包括：机器可读存储介质502和处理器501。所述数据处理设备还可以包括接口503和总线504。其中：所述机器可读存储介质502存储能够被所述处理器501执行的机器可执行指令。所述处理器501与机器可读存储介质502通信，读取和执行机器可读存储介质502中存储的机器可执行指令，实现本申请上述示例公开的异常主机的监控操作。接口503可以用于和控制器、路由管理设备连接。处理器501、机器可读存储介质502和接口503之间可以通过总线504相互通信。
这里，机器可读存储介质可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，机器可读存储介质可以是：易失存储器，包括RAM(Radom Access Memory，随机存取存储器)以及非易失性存储器，包括闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)，或者类似的存储介质，或者它们的组合。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的 流程图和/或方框图来描述的。应理解可以由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其它可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其它可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
而且，这些计算机程序指令也可以存储在能引导计算机或其它可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或者多个流程和/或方框图一个方框或者多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其它可编程数据处理设备上，使得在计算机或者其它可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其它可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (13)

  1. 一种异常主机的监控方法，其特征在于，应用于数据处理设备，包括：
    从控制器获取已部署主机的主机信息，其中，所述主机信息包括所述已部署主机的地址信息；
    获取待检测主机的路由信息，其中，所述路由信息包括所述待检测主机的地址信息；
    确定所述已部署主机的地址信息中是否包括所述待检测主机的地址信息；
    如果所述已部署主机的地址信息中不包括所述待检测主机的地址信息，则确定所述待检测主机是异常主机。
  2. 根据权利要求1所述的方法，其特征在于，获取所述待检测主机的路由信息之前，所述方法还包括：
    与路由管理设备协商建立边界网关协议BGP邻居；
    获取所述待检测主机的路由信息，具体包括：
    接收所述路由管理设备发送的所述待检测主机的路由信息。
  3. 根据权利要求1所述的方法，其特征在于，
    从所述控制器获取所述已部署主机链路层发现协议LLDP信息，其中，所述LLDP信息包括所述已部署主机关联的第一边缘设备的设备信息；
    如果所述已部署主机的地址信息中包括所述待检测主机的地址信息，所述方法还包括：
    从所述LLDP信息中获取目标主机关联的第一边缘设备的设备信息，其中，所述目标主机为与所述待检测主机的地址信息相同的已部署主机；
    若所述待检测主机关联的第二边缘设备的设备信息与所述目标主机关联的所述第一边缘设备的设备信息不同，则确定所述待检测主机是所述异常主机，其中，所述待检测主机关联的所述第二边缘设备的设备信息包括在所述路由信息中。
  4. 根据权利要求3所述的方法，其特征在于，所述主机信息还包括所述已部署主机的主机标识，所述LLDP信息还包括所述已部署主机的主机标识；从所述LLDP信息中获取所述目标主机关联的所述第一边缘设备的设备信息，包括：
    根据所述目标主机的地址信息查询该目标主机的主机信息，得到所述目标主机的主机标识；
    根据所述目标主机的主机标识查询该目标主机的LLDP信息，得到所述目标主机关联的所述第一边缘设备的设备信息。
  5. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    若所述待检测主机关联的所述第二边缘设备的设备信息与所述目标主机关联的所述第一边缘设备的设备信息相同，则确定所述待检测主机是正常主机。
  6. 根据权利要求1所述的方法，其特征在于，获取所述待检测主机的路由信息之后，所述方法还包括：
    确定历史数据库中是否存在所述待检测主机对应的表项；
    如果所述历史数据库中存在所述待检测主机对应的表项，则在所述表项中存储所述路由信息和所述路由信息的获取时间；
    如果所述历史数据库中不存在所述待检测主机对应的表项，则在所述历史数据库中添加所述待检测主机对应的表项，并在新添加的表项中存储所述路由信息和所述路由信息的获取时间。
  7. 一种异常主机的监控装置，其特征在于，应用于数据处理设备，包括：
    第一获取模块，用于从控制器获取已部署主机的主机信息，其中，所述主机信息包括所述已部署主机的地址信息；
    第二获取模块，用于获取待检测主机的路由信息，其中，所述路由信息包括所述待检测主机的地址信息；
    第一判断模块，用于确定所述已部署主机的地址信息中是否包括所述待检测主机的地址信息；
    第一确定模块，用于当所述已部署主机的地址信息中不包括所述待检测主机的地址信息，确定所述待检测主机是异常主机。
  8. 根据权利要求7所述的装置，其特征在于，还包括：
    建立模块，用于与路由管理设备协商建立BGP邻居；
    所述第二获取模块具体用于：接收所述路由管理设备发送的所述待检测主机的路由信息。
  9. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    第三获取模块，用于从所述控制器获取所述已部署主机的LLDP信息，其中，所述LLDP信息包括所述已部署主机关联的第一边缘设备的设备信息；
    如果所述已部署主机的地址信息中包括所述待检测主机的地址信息，所述装置还包括：
    第四获取模块，用于从所述LLDP信息中获取目标主机关联的所述第一边缘设备的设备信息，其中，所述目标主机为与所述待检测主机的地址信息相同的已部署主机；
    第二确定模块，用于若所述待检测主机关联的第二边缘设备的设备信息与所述目标 主机关联的所述第一边缘设备的设备信息不同，确定待检测主机是所述异常主机，其中，所述待检测主机关联的所述第二边缘设备的设备信息包括在所述路由信息中。
  10. 根据权利要求9所述的装置，其特征在于，所述主机信息还包括与所述已部署主机的主机标识，所述LLDP信息还包括与所述已部署主机的主机标识；
    所述第四获取模块具体用于：根据所述目标主机的地址信息查询该目标主机的主机信息，得到所述目标主机的主机标识；根据所述目标主机的主机标识查询该目标主机的LLDP信息，得到所述目标主机关联的所述第一边缘设备的设备信息。
  11. 根据权利要求9所述的装置，其特征在于，所述第二确定模块，还用于若所述待检测主机关联的所述第二边缘设备的设备信息与所述目标主机关联的所述第一边缘设备的设备信息相同，则确定所述待检测主机是正常主机。
  12. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    第二判断模块，用于在所述第二获取模块获取所述待检测主机的路由信息之后，确定历史数据库中是否存在所述待检测主机对应的表项；
    存储模块，用于当所述历史数据库中存在所述待检测主机对应的表项，则在所述表项中存储所述路由信息和所述路由信息的获取时间；
    添加模块，用于当所述历史数据库中不存在所述待检测主机对应的表项，则在所述历史数据库中添加所述待检测主机对应的表项，并在新添加的表项中存储所述路由信息和所述路由信息的获取时间。
  13. 一种数据处理设备，其特征在于，所述设备包括：机器可读存储介质和处理器；其中，
    所述机器可读存储介质，用于存储机器可读指令；
    所述处理器，用于调用所述机器可读指令，以执行权利要求1-6任一项所述的异常主机的监控方法。
PCT/CN2020/080223 2019-03-20 2020-03-19 异常主机的监控 WO2020187295A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2021555483A JP7228712B2 (ja) 2019-03-20 2020-03-19 異常ホストのモニタニング
US17/593,547 US20220174081A1 (en) 2019-03-20 2020-03-19 Monitoring of abnormal host
EP20773249.6A EP3944582B1 (en) 2019-03-20 2020-03-19 Monitoring of abnormal host

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910212398.8 2019-03-20
CN201910212398.8A CN111010362B (zh) 2019-03-20 2019-03-20 一种异常主机的监控方法及装置

Publications (1)

Publication Number Publication Date
WO2020187295A1 true WO2020187295A1 (zh) 2020-09-24

Family

ID=70111541

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/080223 WO2020187295A1 (zh) 2019-03-20 2020-03-19 异常主机的监控

Country Status (5)

Country Link
US (1) US20220174081A1 (zh)
EP (1) EP3944582B1 (zh)
JP (1) JP7228712B2 (zh)
CN (1) CN111010362B (zh)
WO (1) WO2020187295A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112437077A (zh) * 2020-11-19 2021-03-02 迈普通信技术股份有限公司 第三方arp攻击、异常处理方法、vrrp网络及系统

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114978580B (zh) * 2022-04-08 2023-09-29 中国电信股份有限公司 网络检测方法及装置、存储介质及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016008212A1 (zh) * 2014-07-15 2016-01-21 中兴通讯股份有限公司 一种终端及检测终端数据交互的安全性的方法、存储介质
CN106888217A (zh) * 2017-03-27 2017-06-23 上海斐讯数据通信技术有限公司 一种针对arp攻击的管控方法及系统
CN107018136A (zh) * 2017-04-06 2017-08-04 福建中金在线信息科技有限公司 一种arp攻击的检测方法及装置
CN107465621A (zh) * 2017-08-18 2017-12-12 迈普通信技术股份有限公司 一种路由器发现方法、sdn控制器、路由器和网络系统
CN107579988A (zh) * 2017-09-25 2018-01-12 新华三技术有限公司 配置安全策略的方法和装置

Family Cites Families (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000183968A (ja) * 1998-12-17 2000-06-30 Nippon Telegr & Teleph Corp <Ntt> パケット通信システムおよびそれを構成するノードとエッジ装置
JP4245486B2 (ja) * 2004-01-08 2009-03-25 富士通株式会社 ネットワーク不正接続防止方法及び装置
US7733788B1 (en) * 2004-08-30 2010-06-08 Sandia Corporation Computer network control plane tampering monitor
JP4437259B2 (ja) * 2005-01-17 2010-03-24 株式会社日立製作所 ネットワーク管理方法およびネットワーク管理システム
KR100863313B1 (ko) * 2007-02-09 2008-10-15 주식회사 코어세스 에이알피 스푸핑 자동 차단 장치 및 방법
CN101370019B (zh) * 2008-09-26 2011-06-22 北京星网锐捷网络技术有限公司 防止地址解析协议报文欺骗攻击的方法及交换机
JP2011124774A (ja) * 2009-12-10 2011-06-23 Toshiba Corp ネットワーク監視装置、ネットワーク監視方法
JP5680978B2 (ja) * 2011-01-14 2015-03-04 株式会社富士通アドバンストエンジニアリング 通信装置、通信方法、および、通信プログラム
US9276953B2 (en) * 2011-05-13 2016-03-01 International Business Machines Corporation Method and apparatus to detect and block unauthorized MAC address by virtual machine aware network switches
CN102694876A (zh) * 2012-05-10 2012-09-26 北京星网锐捷网络技术有限公司 确定学习的mac地址有效性的方法、装置及网关设备
JP5928197B2 (ja) * 2012-06-29 2016-06-01 富士通株式会社 ストレージシステム管理プログラム及びストレージシステム管理装置
CN103259732B (zh) * 2013-04-03 2016-09-28 北京邮电大学 一种基于arp事件触发代理的sdn广播处理方法
CN104780139B (zh) * 2014-01-09 2018-02-13 北京东土科技股份有限公司 一种基于mac地址攻击的防御方法和系统
KR20160002269A (ko) * 2014-06-30 2016-01-07 한국전자통신연구원 Sdn 기반의 arp 스푸핑 탐지장치 및 그 방법
CN107979607A (zh) * 2014-12-17 2018-05-01 蔡留凤 适于网络安全的软件定义的网络架构及其工作方法
JP6460893B2 (ja) * 2015-04-15 2019-01-30 エヌ・ティ・ティ・コミュニケーションズ株式会社 通信経路監視装置、通信システム、障害判定方法、及びプログラム
US10536357B2 (en) * 2015-06-05 2020-01-14 Cisco Technology, Inc. Late data detection in data center
EP3363150B1 (en) * 2015-10-16 2020-12-16 ORock Technologies, Inc. System for providing end-to-end protection against network-based attacks
CN105430113B (zh) * 2015-11-03 2018-07-03 上海斐讯数据通信技术有限公司 Sdn网络arp报文处理方法、系统、控制器及交换机
CN105812502A (zh) * 2016-03-07 2016-07-27 北京工业大学 基于OpenFlow的地址解析协议代理技术的实现方法
US10320838B2 (en) * 2016-07-20 2019-06-11 Cisco Technology, Inc. Technologies for preventing man-in-the-middle attacks in software defined networks
CN106506200A (zh) * 2016-10-31 2017-03-15 中国工程物理研究院计算机应用研究所 一种基于sdn的arp协议辅助模型
CN106506534B (zh) * 2016-12-09 2019-09-27 河南工业大学 一种sdn网络的arp攻击检测方法
US10038671B2 (en) * 2016-12-31 2018-07-31 Fortinet, Inc. Facilitating enforcement of security policies by and on behalf of a perimeter network security device by providing enhanced visibility into interior traffic flows
CN107438068B (zh) * 2017-07-04 2019-12-06 杭州迪普科技股份有限公司 一种防arp攻击的方法及装置
CN107995162A (zh) * 2017-10-27 2018-05-04 深信服科技股份有限公司 网络安全感知系统、方法及可读存储介质
US11218446B2 (en) * 2018-06-15 2022-01-04 Orock Technologies, Inc. Secure on-premise to cloud communication
US11729210B2 (en) * 2020-04-17 2023-08-15 Cisco Technology, Inc. Detecting spoofing in device classification systems

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016008212A1 (zh) * 2014-07-15 2016-01-21 中兴通讯股份有限公司 一种终端及检测终端数据交互的安全性的方法、存储介质
CN106888217A (zh) * 2017-03-27 2017-06-23 上海斐讯数据通信技术有限公司 一种针对arp攻击的管控方法及系统
CN107018136A (zh) * 2017-04-06 2017-08-04 福建中金在线信息科技有限公司 一种arp攻击的检测方法及装置
CN107465621A (zh) * 2017-08-18 2017-12-12 迈普通信技术股份有限公司 一种路由器发现方法、sdn控制器、路由器和网络系统
CN107579988A (zh) * 2017-09-25 2018-01-12 新华三技术有限公司 配置安全策略的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3944582A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112437077A (zh) * 2020-11-19 2021-03-02 迈普通信技术股份有限公司 第三方arp攻击、异常处理方法、vrrp网络及系统

Also Published As

Publication number Publication date
CN111010362B (zh) 2021-09-21
JP7228712B2 (ja) 2023-02-24
CN111010362A (zh) 2020-04-14
EP3944582A1 (en) 2022-01-26
EP3944582A4 (en) 2022-04-27
EP3944582B1 (en) 2023-12-27
US20220174081A1 (en) 2022-06-02
JP2022525205A (ja) 2022-05-11

Similar Documents

Publication Publication Date Title
US9935851B2 (en) Technologies for determining sensor placement and topology
US9608841B2 (en) Method for real-time synchronization of ARP record in RSMLT cluster
US9596159B2 (en) Finding latency through a physical network in a virtualized network
CN110247784B (zh) 确定网络拓扑结构的方法和装置
US9313088B2 (en) Network system and network managing method
CN107547349B (zh) 一种虚拟机迁移的方法及装置
WO2016000362A1 (zh) 一种配置流表项的方法、装置和系统
US20140086069A1 (en) Efficient network traffic analysis using a hierarchical key combination data structure
US20180295029A1 (en) Managing groups of servers
CN102377640B (zh) 一种报文处理装置和报文处理方法、及预处理器
US10027627B2 (en) Context sharing between endpoint device and network security device using in-band communications
WO2020187295A1 (zh) 异常主机的监控
CN103475586A (zh) 网络数据报文的转发方法、装置及系统
US9948568B2 (en) Packet size control using maximum transmission units for facilitating packet transmission
US20230208721A1 (en) Determining network topology based on packet traffic
US10374946B2 (en) Centralized wireless network management system
CN105379206A (zh) 网络中的报文处理方法、转发设备和报文处理系统
WO2016114750A1 (en) Data link layer information
CN104618246A (zh) 一种面向xen虚拟化环境的网络拓扑发现方法
US10298494B2 (en) Reducing short-packet overhead in computer clusters
US10187414B2 (en) Differential malware detection using network and endpoint sensors
US20200382541A1 (en) Communication monitoring system, communication monitoring apparatus, and communication monitoring method
CN107113280A (zh) 一种网络控制方法与虚拟交换机
US20240171498A1 (en) Detecting in-transit inband telemetry packet drops
US10367725B2 (en) Network programming

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20773249

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021555483

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020773249

Country of ref document: EP

Effective date: 20211020