WO2022199316A1 - 控制方法、装置及计算设备 - Google Patents

控制方法、装置及计算设备 Download PDF

Info

Publication number
WO2022199316A1
WO2022199316A1 PCT/CN2022/077740 CN2022077740W WO2022199316A1 WO 2022199316 A1 WO2022199316 A1 WO 2022199316A1 CN 2022077740 W CN2022077740 W CN 2022077740W WO 2022199316 A1 WO2022199316 A1 WO 2022199316A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
virtual machine
backpressure
source virtual
packet
Prior art date
Application number
PCT/CN2022/077740
Other languages
English (en)
French (fr)
Inventor
吕怡龙
Original Assignee
阿里巴巴（中国）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴（中国）有限公司 filed Critical 阿里巴巴（中国）有限公司
Priority to EP22773978.6A priority Critical patent/EP4319094A1/en
Publication of WO2022199316A1 publication Critical patent/WO2022199316A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/12—Avoiding congestion; Recovering from congestion
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the embodiments of the present application relate to the field of network technologies, and in particular, to a control method, an apparatus, and a computing device.
  • Overlay network is a virtual network built on top of an existing physical network.
  • Vxlan Virtual Extensible Local Area Network
  • Overlay network is an Overlay network.
  • the overlay network adopts the many-to-one (many-to-one) communication mode
  • multiple virtual machines access the same virtual machine, resulting in virtual
  • the CPU (central processing unit, central processing unit) corresponding to the switch is too occupied, which will affect the use of other virtual machines in the same host; for example, when multiple virtual machines access other networks through a virtual gateway at the same time, As a result, the CPU of the device where the virtual gateway is located is occupied too much, thereby affecting normal network access.
  • Embodiments of the present application provide a control method, apparatus, and computing device, so as to solve the problem of traffic attack in the prior art.
  • control method including:
  • control method including:
  • the back pressure information is sent by the destination to the source virtual machine that satisfies the speed limit condition; the source virtual machine that satisfies the speed limit condition is determined based on the inner encapsulation information; the inner encapsulation information is sent by the destination end It is detected that the access traffic meets the speed limit condition, the access packet is captured, and the access packet is parsed and obtained;
  • the source virtual machine is subjected to packet rate limiting processing.
  • an embodiment of the present application provides a control device, including:
  • the packet capture module is used to detect that the access traffic meets the speed limit condition and capture the access packets
  • a message parsing module configured to parse the access message, and obtain inner layer encapsulation information in the access message
  • a determining module configured to determine the source virtual machine that satisfies the speed limit condition based on the inner layer encapsulation information
  • a backpressure triggering module configured to send backpressure information to the source host machine where the source virtual machine is located; wherein the backpressure information is used to instruct the source virtual machine to perform packet rate limiting processing.
  • an embodiment of the present application provides a control device, including:
  • an information receiving module configured to receive back pressure information; wherein, the back pressure information is sent by the destination to the source virtual machine that satisfies the speed limit condition; the source virtual machine that satisfies the speed limit condition is determined based on the inner layer encapsulation information; the inner layer encapsulation The information is obtained by the destination terminal detecting that the access traffic meets the speed limit condition, grabbing the access packet, and analysing the access packet;
  • a processing module configured to perform packet rate limiting processing on the source virtual machine according to the back pressure information.
  • an embodiment of the present application provides a computing device, including a processing component and a storage component, the storage component stores one or more computer instructions, and the one or more computer instructions are used by the processing component Execution is invoked to run at least one virtual machine and a virtual switch that implements the control method described in the first aspect above.
  • an embodiment of the present application provides a computing device, including a processing component and a storage component, the storage component stores one or more computer instructions, and the one or more computer instructions are used by the processing component Execute is invoked to run the virtual gateway that implements the control method described in the first aspect above.
  • an embodiment of the present application provides a computing device, including a processing component and a storage component, the storage component stores one or more computer instructions, and the one or more computer instructions are used by the processing component Execution is invoked to run at least one virtual machine and a virtual switch implementing the control method described in the second aspect above.
  • an embodiment of the present application provides a computer storage medium storing a computer program, and when the computer program is executed by a computer, the control method described in the first aspect above is implemented.
  • an embodiment of the present application provides a computer storage medium storing a computer program, and when the computer program is executed by a computer, the control method described in the second aspect above is implemented.
  • the inner layer encapsulation information can be obtained by parsing the access packet, and then the source virtual machine that initiates the attack can be determined based on the inner layer encapsulation information, so that the source virtual machine can be sent to the source virtual machine.
  • the destination host sends back pressure information to instruct the source virtual machine to perform packet rate limiting processing.
  • the source virtual machine that initiates the attack can be identified and back pressure is applied to it. Implement packet rate limit processing to solve the problem of traffic attacks.
  • Figure 1a shows a schematic diagram of a traffic attack scenario in the prior art
  • Figure 1b shows a schematic diagram of another traffic attack scenario in the prior art
  • FIG. 2 shows a flowchart of an embodiment of a control method provided by the present application
  • FIG. 3 shows a schematic diagram of a message format of a backpressure message in a practical application according to an embodiment of the present application
  • FIG. 4 shows a flowchart of another embodiment of a control method provided by the present application.
  • FIG. 5 shows a flowchart of another embodiment of a control method provided by the present application.
  • FIG. 6a shows a schematic diagram of control interaction in a practical application according to an embodiment of the present application
  • FIG. 6b shows a schematic diagram of control interaction in another practical application according to an embodiment of the present application.
  • FIG. 7 shows a schematic structural diagram of an embodiment of a control device provided by the present application.
  • FIG. 8 shows a schematic structural diagram of another embodiment of a control device provided by the present application.
  • FIG. 9 shows a schematic structural diagram of an embodiment of a computing device provided by the present application.
  • FIG. 10 shows a schematic structural diagram of another embodiment of a computing device provided by the present application.
  • FIG. 11 shows a schematic structural diagram of yet another embodiment of a computing device provided by the present application.
  • the technical solutions of the embodiments of the present application are applied in a virtual network to solve the traffic attack problem in the virtual network, for example, the traffic attack problem in an overlay network (overlay network or overlay network).
  • an overlay network overlay network or overlay network
  • Virtual machine (English: Virtual Machine, referred to as: VM): refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment.
  • Host The physical host on which the virtual machine runs.
  • Overlay network A virtual network built on top of an existing physical network.
  • Vxlan Virtual Extensible Local Area Network, virtual extended local area network
  • UDP User Datagram Protocol, User Data Protocol
  • Five-tuple information including source IP (Internet Protocol, Internet Protocol) address, source port, destination IP address, destination port and transport layer protocol, in the virtual network, the source in the five-tuple information encapsulated in the inner layer
  • the IP address is the virtual IP address of the source VM
  • the source port is the virtual port of the source VM
  • the destination IP address is the virtual IP address of the destination
  • the source port is the virtual port of the destination.
  • a packet flow can be uniquely identified by the inner quintuple information.
  • Packet flow refers to a flow formed by packets transmitted between a source IP address and a destination IP address. All packets in a packet flow have the same quintuple information.
  • Virtual Switch (English: Virtual Switch, VSwitch for short): Provides Layer 2 network access and some Layer 3 network functions for the virtual machine running in the host machine. The access of the source virtual machine to the destination virtual machine needs to be realized through the virtual switch , which is responsible for forwarding the access packets of the source VM to the destination VM.
  • Virtual gateway (Chinese: Virtual gate, referred to as: VG): used to realize the interconnection between the network where the virtual machine is located and other networks,
  • Figure 1a shows a situation where multiple virtual machines access a virtual machine at the same time.
  • a host may have multiple virtual machines installed 1a, the source virtual machine 101 located in the source host machine 10 requests to send an access message to a certain destination virtual machine 103 in the destination host machine 20 through the source virtual switch 102 in the source host machine 10, The destination virtual switch 104 in the destination host machine 20 is responsible for forwarding the access message to the destination virtual machine 103.
  • the destination virtual machine switch 104 will receive a large number of access packets At the same time, a large number of packets need to be forwarded, which may cause the forwarding capacity of the forwarding CPU corresponding to the destination virtual machine switch 104 to be too high and full, which affects the processing performance of the forwarding CPU, which in turn affects other virtual machines in the destination host 20. normal use of the machine.
  • FIG. 1b shows a situation in which multiple virtual machines access the public network through the virtual gateway at the same time.
  • the source virtual machine 105 in the source host 30 passes through the source virtual switch 106 in the source host 30, Send an access message to the virtual gateway 107 to request access to the public network 40, and the virtual gateway 107 is responsible for message forwarding.
  • the virtual gateway 107 is responsible for message forwarding.
  • the virtual gateway 107 sends access packets, and multiple source virtual machines 105 may be located in the same source host 30, or may be located in multiple source hosts 30, then at this time, the virtual gateway 107 will receive a large number of access packets, and it needs to When a large number of packets are forwarded, the forwarding capacity of the forwarding CPU corresponding to the virtual gateway 107 may be too high and full, which affects the processing performance of the forwarding CPU, and further affects the normal network access of other virtual machines through the virtual gateway.
  • the inventor found in the process of implementing the present application that in the overlay network, the original message of the virtual machine will be re-encapsulated, and network-related information such as the host address is added to form an access message. That is, the original packet in the access packet is encapsulated in the inner layer, and the outer layer is network-related information.
  • the Vxlan message encapsulates the original message in the UDP data format, and adds the Vxlan header to the original message and encapsulates it in the UDP data packet.
  • the Vxlan header information can include, for example, the Vxaln logo and the IP header.
  • Etc. the IP header mainly includes the host IP address for communication between hosts, etc.
  • Vxlan header information may also include other information, which is the same as the existing one, and will not be described in detail in this application.
  • the original message is a message actually transmitted between virtual machines, and its header information includes, for example, the virtual machine IP address, port, transport layer protocol and so on for communication between virtual machines.
  • the access packets can be parsed to identify the source virtual machine that generates the attack, and then the back pressure information can be constructed to realize the detection of the source virtual machine.
  • the virtual machine's packet rate limit processing can easily solve the problem of traffic attacks.
  • FIG. 2 is a flowchart of an embodiment of a control method provided by this application.
  • the technical solution of this embodiment can be executed by the destination end of the attacked party, such as virtual switch execution or virtual gateway, etc.
  • the method can include the following step:
  • whether the access traffic meets the speed limit condition can be realized by detecting the forwarding capacity of the forwarding CPU or the CPU water level. If the forwarding capacity is higher than a certain easy or the CPU water level is greater than a certain water level, it can be considered that the access traffic meets the speed limit condition.
  • the access packets can be captured from the forwarding CPU.
  • a virtual machine switch or virtual gateway may use one or more CPUs to implement its functions, and the forwarding CPU refers to the CPU responsible for packet forwarding.
  • the access packets may be captured according to the sampling frequency and the number of samples, that is, packet capture and sampling are performed in the forwarding CPU, for example, 1000 access packets are captured per second.
  • capturing the access packets does not intercept the access packets, but mirrors the access packets and copies the obtained access packets.
  • the destination will still perform normal access processing based on the access packets, such as forwarding to the destination virtual machine or the external network.
  • the captured access packets can be parsed to obtain their inner encapsulation information.
  • the inner layer encapsulation information mainly refers to header information in the original packet encapsulated in the access packet, such as inner layer quintuple information.
  • the inner layer quintuple information can uniquely identify a packet stream, based on the number of packets in the packet stream, it can be determined which packet stream caused the attack, and then the inner layer quintuple information can be corresponding to the packet stream.
  • the source IP address in can determine the corresponding source virtual machine.
  • determining the source virtual machine that satisfies the rate limit condition includes: based on the packet flow identified by the inner layer encapsulation information, summarizing the access packets to determine the number of packets in different packet streams ; According to the number of packets in different packet flows, select the packet flow to be rate-limited; determine the source virtual machine corresponding to the rate-limited packet flow.
  • selecting the packet flow to be rate-limited may be: according to the number of packets in different packet flows, selecting the number of packets to be limited is greater than or equal to the preset number. Fast message flow.
  • determining the packet flows to be rate-limited according to the number of packets in different packet flows includes: selecting the top N packet flows as the rate-limited packets in descending order of the number of packets. text flow.
  • the source virtual machines that satisfy the rate limit conditions may include multiple source virtual machines, and the packet rate limit processing may be performed in the following manner for each source virtual machine that satisfies the rate limit conditions.
  • back pressure information can be sent, and the back pressure information is specifically received by the source virtual switch in the source host, and the source virtual machine is subjected to speed limit processing according to the back pressure information.
  • the backpressure information may be sent based on the host address in the outer encapsulation information obtained by parsing the access message, and the host address may specifically refer to the IP address of the host.
  • the inner layer encapsulation information can be obtained by parsing the access packet, and then the source virtual machine that initiates the attack can be determined based on the inner layer encapsulation information, so that the source virtual machine where the source virtual machine is located can be determined.
  • the destination host sends back pressure information to instruct the source virtual machine to perform packet rate limiting processing.
  • the source virtual machine that initiates the attack can be identified and back pressure is applied to it. Implement packet rate limit processing to solve the problem of traffic attacks.
  • the method may also include:
  • the back pressure object may refer to all the message flows sent by the source virtual machine and all messages of the destination virtual machine corresponding to the message flow to be sent by the source virtual machine to be sent to it.
  • backpressure information is generated; wherein the backpressure information is used to instruct the backpressure object to perform speed-limiting processing.
  • the to-be-speed-limited packet flow may be used as a backpressure object, or in a scenario where multiple source virtual machines access a destination virtual machine at the same time, based on the
  • the destination IP address in the inner layer quintuple information corresponding to the packet flow to be limited can determine the destination virtual machine, which can be all packet flows sent to the destination virtual machine as the back pressure object; or directly sent by the source virtual machine. All packet flows are used as backpressure objects. Among them, the back pressure object can be preset in combination with actual needs, etc.
  • the method may also include:
  • Back pressure information is generated according to at least one processing manner; wherein the back pressure information is used to instruct the source virtual machine to perform packet rate limiting processing on the source virtual machine according to at least one processing manner.
  • the backpressure object in the source virtual machine can also be determined; then specifically according to the at least one processing method and the backpressure object, backpressure information can be generated to indicate that the source virtual machine is to be processed according to the at least one processing method.
  • the backpressure object in the packet is processed for rate limiting.
  • the method may also include:
  • At least one processing method includes a rate-limiting processing method, determining a rate-limiting type corresponding to the source virtual machine;
  • generating backpressure information includes:
  • backpressure information at least according to at least one processing method and a speed limit type; wherein the backpressure information may specifically indicate that speed limit processing is performed on the source virtual machine according to the speed limit processing method corresponding to the speed limit.
  • backpressure information may also be generated at least according to the at least one processing method, the speed limit type, and the backpressure object.
  • the speed limit processing method may include adjusting the packet forwarding rate (English: Packet Forwarding Rate, referred to as: pps) and/or the bit rate of the sent packets.
  • the pps speed limit can be realized by limiting the number of packets sent per second.
  • the rate can be achieved by limiting bps (Bit Per Second).
  • the speed limit type may include at least one of pps speed limit and bps speed limit.
  • the back pressure may also include inner layer quintuple information and the like in the inner layer encapsulation information.
  • the backpressure information may also include a virtual network identifier, such as a VNI (Vxlan Network Identifier, Vxlan identifier) in a Vxlan network.
  • VNI Vxlan Network Identifier
  • Vxlan identifier Vxlan Network Identifier
  • the backpressure information may include at least one processing method, speed limit information, backpressure object, inner layer quintuple information in inner layer encapsulation information, and at least one of virtual network identifiers, etc.
  • It can also include the network protocol in the inner encapsulation information; in addition, in the scenario where the virtual gateway is attacked by traffic, the traffic attack may come from the internal network or the external network, so the back pressure information can also include Traffic attack direction, etc.
  • the alarm processing method may indicate to perform alarm processing on the source virtual machine, for example, including obtaining the current packet sending situation of the source virtual machine, the virtual machine identifier of the source virtual machine, the backpressure object identifier, etc. as the response information to feed back to the destination end, and the destination end According to this, alarms, etc., such as outputting alarm prompt information.
  • the speed limit processing method can instruct the pps speed limit and/or bps speed limit to be performed on the source virtual machine, and obtain the current packet sending status of the source virtual machine, the virtual machine identifier of the source virtual machine, the backpressure object identifier, etc. and feed it back to the destination.
  • the destination end will alarm accordingly, such as outputting alarm prompt information.
  • the method may further include:
  • the alarm prompt information is output.
  • the response information may include the source virtual machine identifier, the backpressure object identifier, and/or the current packet sending situation of the source virtual machine, and the like.
  • the current packet sending situation may include, for example, the current packet forwarding rate, the average packet forwarding rate within the most recent preset time range, the maximum packet forwarding rate within the most recent preset time range, the current bit rate of the packet, and the average packet forwarding rate within the most recent preset time range. Bit rate, maximum bit rate in the most recent preset time range, etc.
  • the output of the alarm prompt information can be based on the communication account of the relevant personnel, the alarm prompt information will be sent, and of course, the alarm prompt information can also be sent to the corresponding display device to display the alarm prompt information, etc., so as to facilitate the relevant personnel to attack the source virtual machine, the current Attack situations, and/or speed-limiting effects, etc.
  • the backpressure information may be encapsulated as a backpressure message for transmission. Therefore, in some embodiments, the method may further include: parsing the access message to obtain outer encapsulation information;
  • Sending backpressure information to the host where the source virtual machine is located includes:
  • the outer layer encapsulation information may specifically include the source host address, in addition, the destination host address, and the like.
  • the backpressure message may include at least one backpressure field corresponding to the backpressure indication information, a host address field, a network identifier field, and a field corresponding to the inner layer quintuple respectively;
  • constructing a backpressure packet may include:
  • the back pressure indication information is specifically used to indicate how to process the message speed limit, etc.; the source host address is used to send the back pressure message accordingly; the virtual network identifier and the inner layer quintuple information are used to identify the need for limiting The source virtual machine and its backpressure objects for fast processing, etc.
  • the back pressure indication information may include, for example, at least one processing method, a back pressure object, a speed limit type, and the like.
  • the at least one backpressure field may include a processing mode field, a rate limit type field, and a backpressure object field;
  • filling the back pressure indication information into at least one back pressure field may include:
  • At least one processing method includes a speed limit processing method, determine the speed limit type corresponding to the source virtual machine, and write the parameter value identifying the speed limit type into the speed limit type field; 1 means bps speed limit, value 2 means both pps speed limit and bps speed limit are executed;
  • the source IP address in the group information is valid
  • the value 1 indicates that the triples in the inner quintuple information, namely the source IP address, the destination IP address and the transport layer protocol, are valid
  • the value 2 indicates that all the inner quintuple are valid.
  • the valid source IP address indicates that the backpressure object is all the packet flows sent by the source virtual machine
  • the triplet effectively indicates that the backpressure object is the destination virtual machine corresponding to the packet flow to be sent by the source virtual machine to be rate-limited. All packet flows and backpressure objects effectively represented by quintuple are the packet flows to be sent by the source VM to be rate-limited.
  • the backpressure message may further include at least one feedback field; the at least one feedback field is used to fill in the processing result after performing the message rate limiting process to generate a response message;
  • the method may further include: receiving a response message; and outputting speed limit prompt information based on the response message.
  • the response packet may be used as the rate limit prompt information.
  • the at least one feedback field may include, for example, a virtual machine identification field for filling in the virtual machine identification of the source virtual machine; in addition, it may also include: a packet forwarding rate field for filling in the current packet forwarding rate of the backpressure object and /or the current bit rate field used to fill in the current bit rate of the backpressure object; in addition, it may also include: an average packet forwarding rate field used to fill in the average packet forwarding rate within the most recent preset time range of the backpressure object, a The maximum packet forwarding rate field used to fill in the maximum packet forwarding rate within the most recent preset time range of the backpressure object, the average bitrate field used to fill in the average bit rate within the most recent preset time range of the backpressure object, and the Fill in at least one of the maximum bit rate fields of the maximum bit rate within the most recent preset time range of the backpressure object, and the like.
  • the latest preset time range may refer to, for example, the last 10 minutes.
  • the source virtual switch may obtain a corresponding processing result based on the at least one feedback field and fill in the corresponding feedback field.
  • the backpressure packet may further include an attack direction field
  • the method may further include:
  • At least one processing method includes alarm processing, determine the traffic attack direction
  • a value of 0 indicates an internal network attack
  • a value of 1 indicates an external network attack.
  • the attack direction of the traffic identified by the field value in the attack direction field is used as a kind of alarm information. After the processing result after the packet rate limit processing is filled in the backpressure packet, a response packet is output.
  • the back pressure message may further include a network protocol field
  • the method may further include:
  • a value of 0 indicates ipv4 (Internet Protocol version 4), and a value of 1 indicates ipv6 (Internet Protocol version 6).
  • the network protocol field is used to parse the inner layer quintuple information from the backpressure message according to the network protocol identified by the field value.
  • FIG. 3 a schematic diagram of the message format of a backpressure message in a practical application is shown, and the fields that may be included in the backpressure message are introduced below in conjunction with the above related descriptions. :
  • the processing method field the value can include 0 or 1; the value 0 indicates the alarm processing method, indicating only the alarm without speed limit; the value 1 indicates the speed limit processing method, and the speed limit action is performed.
  • Limit_type The speed limit type field, the value can include 0, 1 or 2; a value of 0 indicates pps speed limit, a value of 1 indicates a bps speed limit, and a value of 3 indicates both pps speed limit and bps speed limit.
  • the Limit_type can be null.
  • the attack direction field the value can include 0 or 1.
  • the value 0 indicates the direction of the internal network, and the value 1 indicates the direction of the external network.
  • the value of the Direction is 1, the value of the Action is 0.
  • key_type backpressure object field
  • the value can include 0, 1 or 2.
  • a value of 0 indicates that the inner layer source IP address is valid, and a value of 1 indicates that the inner layer triplet (source IP address, destination IP address, and transport layer protocol) is valid.
  • a value of 2 indicates that the inner layer quintuple (source IP address, destination IP address, source port, destination port, and transport layer protocol) is valid.
  • Ncip host field, the value is the host IP address of the host where the source virtual machine that meets the speed limit condition is located;
  • tunnel id Network ID field, the value is the virtual network ID of the virtual network where the source VM that meets the speed limit condition is located, such as VNI.
  • Af Network protocol field, the value is the inner network protocol.
  • inner_proto One of the inner layer quintuple fields, the inner layer protocol field, the value of the inner layer transport layer protocol number.
  • inner_src ip one of the inner quintuple fields, the inner source address field, the value is the inner source IP address;
  • inner_dst ip one of the inner quintuple fields, the inner source address field, the value is the inner destination IP address;
  • inner src port one of the inner quintuple fields, the inner source port field, the value is the inner source port number;
  • inner dst port One of the inner quintuple fields, the inner destination port field, the value is the inner destination port number.
  • ecs_id VM ID field, the value is the VM ID of the source VM that satisfies the rate limit condition, such as the VM name.
  • avg_pps Average packet forwarding rate field, the value is the average pps of the backpressure object in the most recent preset time range, such as the average pps in the last 10 minutes.
  • max_pps The field of the maximum packet forwarding rate, which is the maximum pps of the backpressure object within the most recent preset time range, such as the maximum pps within the last 10 minutes.
  • the constructed backpressure message can be sent based on the host address in the Ncip field.
  • FIG. 4 is a flowchart of another embodiment of a control method provided by an embodiment of the present application. This embodiment introduces a packet rate limit processing process from the perspective of a backpressure information receiving end, and the receiving end specifically refers to a source virtual switch.
  • the method can include the following steps:
  • the backpressure information is sent by the destination to the source virtual machine that meets the speed limit condition; the source virtual machine that meets the speed limit condition is determined based on the inner layer encapsulation information; the inner layer encapsulation information is detected by the destination end that the access traffic meets the speed limit condition,
  • the access packet is captured and obtained by parsing the access packet. For the specific implementation, refer to the embodiment shown in FIG. 2 , which will not be repeated here.
  • the source virtual machine requesting the speed limit may be determined according to the inner layer quintuple information, the virtual network identifier, and the like in the backpressure information.
  • performing the packet rate limit processing on the source virtual machine requesting the speed limit may be to perform the backpressure object indicated by the backpressure information in the source virtual machine requesting the speed limit according to the backpressure information Perform packet rate limiting processing.
  • performing packet rate limiting processing on the source virtual machine requesting speed limit according to the backpressure information may be reporting to the source virtual machine requesting speed limit according to at least one processing method indicated by the backpressure information Speed limit processing.
  • performing packet rate limiting processing on the source virtual machine that requests rate limiting may include:
  • the first feedback result is generated based on the virtual machine identifier of the source virtual machine requesting the speed limit and the package sending situation information of the source virtual machine;
  • the rate-limiting processing is performed on the packet transmission of the source virtual machine requesting the rate-limiting, and based on the virtual machine identifier of the source virtual machine and the packet sending situation information of the source virtual machine generating a second feedback result;
  • response information is generated, and the response information is fed back to the destination end.
  • the speed-limiting processing for the sending of the packets of the source virtual machine requesting the speed limit may specifically be combined with the backpressure object, and the packets in a certain packet flow represented by the backpressure object in the source virtual machine requesting the speed limiter may be specifically processed.
  • Sending is processed at a rate limit.
  • the rate limiting processing may include performing pps rate limiting and/or performing bps rate limiting, etc. Specifically, it may be performing rate limiting processing on the virtual network card corresponding to the source virtual machine, and performing pps rate limiting on the packet flow forwarded from the virtual network card. And/or bps speed limit, such as reducing pps or bps by a certain percentage, etc.
  • a speed limit record can be generated and saved.
  • the packet sending situation information in the first feedback result may include, for example, the current packet forwarding rate, the average packet forwarding rate within the last 10 minutes, and the maximum packet forwarding rate within the last 10 minutes.
  • the packet sending situation information in the second feedback result may include, for example, the current packet forwarding rate after the rate-limiting process, the average packet forwarding rate within the last 10 minutes, and the maximum packet forwarding rate within the last 10 minutes.
  • receiving the backpressure information may include: receiving a backpressure message; parsing the backpressure message to obtain backpressure indication information, a virtual network identifier, and an inner layer quintuple in the backpressure message information
  • performing packet rate limiting processing on the source virtual machine requesting rate limiting may include:
  • performing the packet rate limiting processing in the source virtual machine may include:
  • the packet rate limiting process is performed on the backpressure object identified by the valid information.
  • the method may also include:
  • the processing result may include the aforementioned first feedback result or the second feedback result.
  • receiving backpressure information may be receiving backpressure information at regular intervals
  • the method may also include:
  • the recovery operation is performed on the backpressure object that has been subjected to speed-limiting processing.
  • the recovery operation may refer to increasing the pps corresponding to the backpressure object by a certain percentage, or the like.
  • the method may further include:
  • the speed limit record corresponding to the backpressure object that has undergone the speed limit treatment is deleted.
  • this embodiment is executed by the source virtual switch, and may include the following steps:
  • step 501 at the timing time, determine whether a back pressure message is received, if yes, go to step 502 , if not, go to step 507 .
  • the backpressure packet By parsing the backpressure packet, you can obtain relevant information in the backpressure packet, such as the source VM requesting the rate limit, the backpressure object in the source VM, the processing method, and the rate limit type, etc.
  • the speed limit type is pps as an example for description.
  • step 503 Determine whether to execute the speed limit processing method, if it is to execute step 504, if not, execute step 505
  • step 504 Adjust the pps corresponding to the backpressure object in the virtual network card to the original x%, generate a speed limit record and save it, and then perform step 505 .
  • 506 Send the response message to the destination.
  • step 507 Based on the speed limit record, determine whether there is a backpressure object that has been speed limited, and if so, go to step 508 .
  • the corresponding pps of the speed-limited backpressure object is the current y%, where y is greater than 100.
  • step 509 Based on the speed limit record, determine whether the pps corresponding to the backpressure object that has been speed limited is restored to the original state, and if so, go to step 510 .
  • Figure 6a is a schematic diagram of control interaction corresponding to the traffic attack scenario in Figure 1a, when the destination virtual switch 104 detects that the access traffic meets the speed limit condition , grab the access packet, and obtain the inner-layer encapsulation information by parsing the access packet. Based on the inner-layer encapsulation information, the source virtual machine 101 that satisfies the speed limit condition can be determined, and a response is sent to the source host 10 where the source virtual machine 101 is located.
  • the source virtual switch 102 in the source host machine 10 receives the backpressure message, performs packet rate limiting processing on the source virtual machine 101 based on the backpressure message, and generates a response message based on the processing result,
  • the response message is sent to the destination virtual switch 104, and the destination virtual switch 104 can output alarm prompt information based on the response message.
  • Fig. 6b is a schematic diagram of control interaction corresponding to the traffic attack scenario of Fig. 1b.
  • the virtual gateway 107 detects that the access traffic meets the speed limit condition, it grabs the access packet, and obtains the inner-layer encapsulation information by parsing the access packet, and based on the inner-layer encapsulation information
  • the source virtual machine 105 that satisfies the speed limit condition can be determined, and a back pressure message is sent to the source host machine 30 where the source virtual machine 105 is located, and the back pressure message is received by the source virtual switch 106 in the source host machine 30, and based on the
  • the backpressure message performs message rate limiting processing on the source virtual machine 105, and generates a response message based on the processing result, and sends the response message to the virtual gateway 107.
  • the virtual gateway 107 can output alarm prompt information based on the response message. .
  • the embodiment of the present application also provides a control method applied to a Vxlan network, which may include:
  • the access message is specifically a Vxlan message, and other identical or similar steps can be found in the foregoing embodiments, which will not be repeated here.
  • the embodiment of the present application also provides a control method applied to a Vxlan network, which may include:
  • the backpressure information is sent by the destination to the source virtual machine that meets the speed limit condition; the source virtual machine that meets the speed limit condition is determined based on the inner encapsulation information; the inner encapsulation information is detected by the destination end to access traffic Satisfy the speed limit conditions, capture Vxlan packets, and parse the VXlan packets to obtain;
  • the source VM performs packet rate limiting processing.
  • FIG. 7 is a schematic structural diagram of an embodiment of a control device provided by an embodiment of the present application, and the device may include:
  • a packet capture module 701, configured to detect that the access traffic meets the speed limit condition, and capture the access packets
  • a message parsing module 702 configured to parse the access message, and obtain inner layer encapsulation information in the access message;
  • a determination module 703, configured to determine the source virtual machine that satisfies the speed limit condition based on the inner layer encapsulation information
  • the backpressure triggering module 704 is configured to send backpressure information to the source host machine where the source virtual machine is located; wherein the backpressure information is used to instruct the source virtual machine to perform packet rate limiting processing.
  • the control device shown in FIG. 7 can execute the control method described in the embodiment shown in FIG. 2 , and the implementation principle and technical effect thereof will not be described again.
  • the specific manner in which each module and unit of the control device in the above embodiment performs operations has been described in detail in the embodiments of the method, and will not be described in detail here.
  • FIG. 8 is a schematic structural diagram of another embodiment of a control device provided by an embodiment of the present application, and the device may include:
  • the information receiving module 801 is configured to receive back pressure information; wherein, the back pressure information is sent by the destination terminal to the source virtual machine that satisfies the speed limit condition; the source virtual machine that satisfies the speed limit condition is determined based on the inner layer encapsulation information; the inner layer encapsulation information The destination detects that the access traffic meets the speed limit condition, captures the access packet, and parses the access packet to obtain it;
  • the processing module 802 is configured to perform packet rate limiting processing on the source virtual machine according to the back pressure information.
  • the control device shown in FIG. 8 can execute the control method described in the embodiment shown in FIG. 4 , and the implementation principle and technical effect thereof will not be described again.
  • the specific manner in which each module and unit of the control device in the above embodiment performs operations has been described in detail in the embodiments of the method, and will not be described in detail here.
  • an embodiment of the present application also provides a computing device.
  • the computing device may include a processing component 901 and a storage component 902, and the storage component 902 stores one or more computer instructions, the one or more The computer instructions are used to be called and executed by the processing component 901, so that the processing component 901 can run at least one virtual machine 903 and a virtual switch 904 that implements the control method shown in FIG. 1 .
  • the processing component includes one or more processors, and a processor may specifically refer to a CPU.
  • computing devices may necessarily include other components, such as input/output interfaces, communication components, and the like.
  • the input/output interface provides an interface between the processing component and a peripheral interface module, and the above-mentioned peripheral interface module may be an output device, an input device, or the like.
  • the communication components are configured to facilitate wired or wireless communication, and the like, between the computing device and other devices.
  • the computing device may be an elastic computing host provided by a cloud computing platform, etc.
  • the computing device may refer to a cloud server.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the control method of the embodiment shown in FIG. 2 can be implemented.
  • an embodiment of the present application further provides a computing device.
  • the computing device may include a processing component 1001 and a storage component 1002 , the processing component 1001 may include one or more processors, and the storage component 1002 stores One or more computer instructions, the one or more computer instructions are used to be invoked and executed by the processing component 1001 to run the virtual gateway 1003 that implements the control method shown in FIG. 1 .
  • the processor may specifically refer to a CPU.
  • computing devices may necessarily include other components, such as input/output interfaces, communication components, and the like.
  • the input/output interface provides an interface between the processing component and a peripheral interface module, and the above-mentioned peripheral interface module may be an output device, an input device, or the like.
  • the communication components are configured to facilitate wired or wireless communication, and the like, between the computing device and other devices.
  • the computing device may be an elastic computing host provided by a cloud computing platform, etc.
  • the computing device may refer to a cloud server.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the control method of the embodiment shown in FIG. 2 can be implemented.
  • an embodiment of the present application further provides a computing device.
  • the computing device may include a processing component 1101 and a storage component 1102, the processing component 1101 includes one or more processors, and the storage component stores one or more A plurality of computer instructions, the one or more computer instructions are used to be invoked and executed by the processing component to run at least one virtual machine 1103 and the virtual switch 1104 implementing the control method in the embodiment shown in FIG. 4 .
  • the processor may specifically refer to a CPU.
  • computing devices may necessarily include other components, such as input/output interfaces, communication components, and the like.
  • the input/output interface provides an interface between the processing component and a peripheral interface module, and the above-mentioned peripheral interface module may be an output device, an input device, or the like.
  • the communication components are configured to facilitate wired or wireless communication, and the like, between the computing device and other devices.
  • the computing device may be an elastic computing host provided by a cloud computing platform, etc.
  • the computing device may refer to a cloud server.
  • Embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the control method of the embodiment shown in FIG. 4 can be implemented.
  • the device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.
  • each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware.
  • the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供一种控制方法、装置及计算设备。其中，检测访问流量满足限速条件，抓取访问报文；解析所述访问报文，获得所述访问报文中的内层封装信息；基于所述内层封装信息，确定满足限速条件的源虚拟机；向所述源虚拟机所在源宿主机发送反压信息；其中，所述反压信息用于指示对所述源虚拟机进行报文限速处理。本申请实施例提供的技术方案通过对访问报文进行解析，从而可以识别发起攻击的源虚拟机，并对其进行反压实现报文限速处理，以解决流量攻击问题。

Description

控制方法、装置及计算设备 技术领域
本申请实施例涉及网络技术领域，尤其涉及一种控制方法、装置及计算设备。
背景技术
Overlay网络(叠加网络或覆盖网络)是一种在现有的物理网络之上构建的虚拟网络，比如Vxlan(Virtual Extensible Local Area Network，虚拟扩展局域网)即是一种Overlay网络。
Overlay网络采用many-to-one(多对一)通信模式的情况下，不可避免的会存在流量攻击问题，例如，多个虚拟机访问同一个虚拟机，导致目的虚拟机所在宿主机中的虚拟交换机对应的CPU(central processing unit，中央处理器)被过多占用，进而会影响同一宿主机中的其它虚拟机的使用；又如，多个虚拟机同时通过一个虚拟网关进行其它网络访问时，导致该虚拟网关所在设备的CPU被过多占用，从而影响正常网络访问等。
因此，如何解决流量攻击问题成为在Overlay网络中目前迫切需要解决的技术问题。
发明内容
本申请实施例提供一种控制方法、装置及计算设备，用以解决现有技术中的流量攻击问题。
第一方面，本申请实施例中提供了一种控制方法，包括：
检测访问流量满足限速条件，抓取访问报文；
解析所述访问报文，获得所述访问报文中的内层封装信息；
基于所述内层封装信息，确定满足限速条件的源虚拟机；
向所述源虚拟机所在源宿主机发送反压信息；其中，所述反压信息用于指示对所述源虚拟机进行报文限速处理。
第二方面，本申请实施例中提供一种控制方法，包括：
接收反压信息；其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；所述内层封装信息由所述目的端检测到访问流量满足限速条件，抓取访问报文，并对所述访问报文解析获得；
按照所述反压信息，对所述源虚拟机进行报文限速处理。
第三方面，本申请实施例中提供了一种控制装置，包括：
报文抓取模块，用于检测访问流量满足限速条件，抓取访问报文；
报文解析模块，用于解析所述访问报文，获得所述访问报文中的内层封装信息；
确定模块，用于基于所述内层封装信息，确定满足限速条件的源虚拟机；
反压触发模块，用于向所述源虚拟机所在源宿主机发送反压信息；其中，所述反压信息用于指示对所述源虚拟机进行报文限速处理。
第四方面，本申请实施例中提供了一种控制装置，包括：
信息接收模块，用于接收反压信息；其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；所述内层封装信息由所述目的端检测到访问流量满足限速条件，抓取访问报文，并对所述访问报文解析获得；
处理模块，用于按照所述反压信息，对所述源虚拟机进行报文限速处理。
第五方面，本申请实施例中提供了一种计算设备，包括处理组件及存储组件，所述存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行至少一个虚拟机、以及运行实现如 上述第一方面所述控制方法的虚拟交换机。
第六方面，本申请实施例中提供了一种计算设备，包括处理组件及存储组件，所述存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行实现如上述第一方面所述控制方法的虚拟网关。
第七方面，本申请实施例中提供了一种计算设备，包括处理组件及存储组件，所述存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行至少一个虚拟机、以及实现如上述第二方面所述控制方法的虚拟交换机。
第八方面，本申请实施例中提供了一种计算机存储介质，存储有计算机程序，所述计算机程序被计算机执行时实现如上述第一方面所述控制方法。
第九方面，本申请实施例中提供了一种计算机存储介质，存储有计算机程序，所述计算机程序被计算机执行时实现如上述第二方面所述的控制方法。
本申请实施例中，检测访问流量满足限速条件时，对访问报文进行解析可以获得内层封装信息，进而基于内层封装信息可以确定发起攻击的源虚拟机，从而可以向该源虚拟机所在目的宿主机发送反压信息，以指示对该源虚拟机进行报文限速处理，本实施例通过对访问报文进行解析，从而可以识别发起攻击的源虚拟机，并对其进行反压实现报文限速处理，以解决流量攻击问题。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1a示出了现有技术中的一种流量攻击场景示意图；
图1b示出了现有技术中的另一种流量攻击场景示意图；
图2示出了本申请提供的一种控制方法一个实施例的流程图；
图3示出了本申请实施例在一个实际应用中的反压报文的报文格式示意图；
图4示出了本申请提供的一种控制方法又一个实施例的流程图；
图5示出了本申请提供的一种控制方法又一个实施例的流程图；
图6a示出了本申请实施例在一个实际应用中控制交互示意图；
图6b示出了本申请实施例在又一个实际应用中控制交互示意图；
图7示出了本申请提供的一种控制装置一个实施例的结构示意图；
图8示出了本申请提供的一种控制装置又一个实施例的结构示意图；
图9示出了本申请提供的一种计算设备一个实施例的结构示意图；
图10示出了本申请提供的一种计算设备又一个实施例的结构示意图；
图11示出了本申请提供的一种计算设备又一个实施例的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
在本申请的说明书和权利要求书及上述附图中的描述的一些流程中，包含了按照特定顺序出现的多个操作，但是应该清楚了解，这些操作可以不按照其在本文中出现的顺序来执行或并行执行，操作的序号如101、102等，仅仅是用于区分开各个不同的操作，序号本身不代表任何的执行顺序。另外，这些流程可以包括更多或更少的操作，并且这些操作可以按顺序执行或并行执行。需要说明的是，本文中的“第一”、“第二”等描述，是用于区分不同的消息、设备、模块等，不代表先后顺序，也不限定“第一”和“第二”是不同的类型。
本申请实施例的技术方案应用于虚拟网络中，用于解决虚拟网络中的流量攻击问题，例如Overlay网络(叠加网络或覆盖网络)中的流量攻击问题。
为了便于理解，下面首先对本申请实施例中可能涉及的技术术语进行相应解释：
虚拟机(英文：Virtual Machine，简称：VM)：是指一种通过软件模拟的具有完整硬件系统功能的，并运行在一个完全隔离环境中的完整计算机系统。
宿主机：运行虚拟机的物理主机。
Overlay网络：一种在现有的物理网络之上构建的虚拟网络。
Vxlan(Virtual Extensible Local Area Network，虚拟扩展局域网)：是在三层网络之上构建的二层网络的一种Overlay网络，采取将原始报文封装在UDP(User Datagram Protoco，用户数据协议)数据包里的封装格式。
五元组信息：包括源IP(Internet Protocol，网际互连协议)地址，源端口，目的IP地址，目的端口和传输层协议，在虚拟网络中，封装在内层的五元组信息中的源IP地址为源虚拟机的虚拟IP地址，源端口为源虚拟机的虚拟端口，目的IP地址为目的端的虚拟IP地址，源端口为目的端的虚拟端口。通过内层五元组信息可以唯一标识一个报文流。
报文流：是指一个源IP地址和目的IP地址之间传输的报文形成的流，一个报文流中的所有报文的五元组信息相同。
虚拟交换机(英文：Virtual Switch，简称VSwitch)：为运行在本台宿主机中的虚拟机提供二层网络接入和部分三层网络功能，源虚拟机对目的虚拟机的访问需经由虚拟交换机实现，负责转发源虚拟机的访问报文至目的虚拟机。
虚拟网关(中文：Virtual gate，简称：VG)：用以实现虚拟机所在网络与其它网络的互连，
以Overlay网络为例，随着云计算技术的发展，目前云数据中心通常是 基于Overlay网络实现，在Overlay网络中，采用many-to-one(多对一)通信模式的两种常见访问方式造成的流量攻击场景，分别如图1a和如图1b所示，图1a中示出了多个虚拟机同时访问一个虚拟机的情况，实际应用中，一台宿主机中可能安装有多个虚拟机，如图1a中所示，位于源宿主机10中的源虚拟机101，通过源宿主机10中的源虚拟交换机102向目的宿主机20中的某个目的虚拟机103请求发送访问报文，由目的宿主机20中的目的虚拟交换机104负责转发访问报文至该目的虚拟机103，在many-to-one通信模式中，可能会有多个源虚拟机101同时向一个目的虚拟机103不断请求发送访问报文，其中，多个源虚拟机101可能位于同一个源宿主机10中，也可能位于多个源宿主机10中，那么此时，目的虚拟机交换机104会接收到大量访问报文，同时需要进行大量报文转发，就可能导致目的虚拟机交换机104对应的转发CPU的转发容量过高而被打满，影响转发CPU的处理性能，进而就会影响目宿主机20中其它虚拟机的正常使用。
图1b示出了多个虚拟机同时通过虚拟网关访问公网的情况，如图1b中所示，源宿主机30中的源虚拟机105，会通过源宿主机30中的源虚拟交换机106，向虚拟网关107发送访问报文，以请求访问向公网40，由虚拟网关107负责进行报文转发，在many-to-one通信模式中，可能会有多个源虚拟机105同时向虚拟网关107发送访问报文，多个源虚拟机105可能位于同一个源宿主机30中，也可能位于多个源宿主机30中，那么此时，虚拟网关107会接收到大量访问报文，同时需要进行大量报文转发，就可能导致虚拟网关107对应的转发CPU的转发容量过高而被打满，影响转发CPU的处理性能，进而就会影响其它虚拟机通过该虚拟网关的正常网络访问。
为了解决流量攻击问题，发明人在实现本申请的过程中发现，Overlay网络中，虚拟机的原始报文会被二次封装，添加网络相关信息如宿主机地址等形成访问报文。也即访问报文中的原始报文封装在内层，外层为网络相关信息。以Vxlan为例，Vxlan报文中是将原始报文封装在UDP数据格式中，将 原始报文添加Vxlan头部一起封装在UDP数据包中，Vxlan头部信息例如可以包括Vxaln标识、IP头部等，IP头部主要包括主机之间通信的主机IP地址等，Vxlan头部信息当然还可以包括其它信息，这与现有的相同，本申请不进行过多赘述。而原始报文是虚拟机之间真正传输的报文，其头部信息例如包括了虚拟机之间进行通信的虚拟机IP地址、端口、传输层协议等等。
由于原始报文进行了二次封装，无法确定访问报文是由谁来发出的，也就没有办法确定攻击方。而采用本申请实施例的技术方案，结合虚拟交换机或虚拟网关的报文解析能力，可以对访问报文进行解析，以识别产生攻击的源虚拟机，进而可以构造反压信息，实现了对源虚拟机的报文限速处理，从容可以实现解决流量攻击的问题。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
图2为本申请提供的一种控制方法一个实施例的流程图，本实施例的技术方案可以由被攻击方的目的端执行，如虚拟交换机执行或者虚拟网关等，该方法可以包括如下几个步骤：
201：检测访问流量满足限速条件，抓取访问报文。
其中，访问流量是否满足限速条件可以通过检测转发CPU的转发容量或者CPU水位实现，若转发容量高于一定容易或者CPU水位大于一定水位时，可以认为访问流量满足限速条件。
若访问流量满足限速条件，可以从转发CPU中抓取访问报文。
实际应用中，虚拟机交换机或者虚拟网关可能会利用一个或多个CPU实现其功能，转发CPU即是指负责报文转发的CPU。
可选地，可以按照采样频率及采样数量抓取访问报文，也即在转发CPU中进行抓包采样，例如1秒种抓取1000个访问报文。
需要说明的是，抓取访问报文并非对访问报文进行拦截，而对访问报文进行镜像处理，复制获得的访问报文。目的端仍然会基于访问报文进行正常的访问处理，如转发至目的虚拟机或者外网等。
202：解析访问报文，获得访问报文中的内层封装信息。
对抓取的访问报文可以进行解析，获得其内层封装信息。
该内层封装信息主要是指封装在访问报文中的原始报文中的头部信息，例如内层五元组信息。
203：基于内层封装信息，确定满足限速条件的源虚拟机。
由于内层五元组信息可以唯一标识一条报文流，基于报文流中的报文数量，可以确定是哪条报文流造成攻击，进而可以根据该报文流对应内层五元组信息中的源IP地址可以确定对应源虚拟机。
因此，可选地，基于内层封装信息，确定满足限速条件的源虚拟机包括：基于内层封装信息标识的报文流，对访问报文进行汇总以确定不同报文流的报文数量；按照不同报文流的报文数量，选择待限速报文流；确定待限速报文流对应的源虚拟机。
作为一种可选方式，按照不同报文流的报文数量，选择待限速报文流可以是：按照不同报文流的报文数量，选择报文数量大于或等于预设数量的待限速报文流。
作为另一种可选方式，按照不同报文流的报文数量，确定待限速报文流包括：按照报文数量从大到小的顺序，选择前N个报文流作为待限速报文流。
其中，满足限速条件的源虚拟机可能包括多个，对于每个满足限速条件的源虚拟机均可以按照如下方式进行报文限速处理。
204：向源虚拟机所在宿主机发送反压信息；其中，反压信息用于指示对源虚拟机进行报文限速处理。
确定出满足限速条件的源虚拟机，即可以发送反压信息，该反压信息具体由源宿主机中的源虚拟交换机接收，并按照反压信息对该源虚拟机进行限 速处理。
其中，可以基于解析访问报文获得的外层封装信息中的宿主机地址来发送该反压信息，宿主机地址可以具体是指宿主机IP地址。
本实施例中，检测访问流量满足限速条件时，对访问报文进行解析可以获得内层封装信息，进而基于内层封装信息可以确定发起攻击的源虚拟机，从而可以向该源虚拟机所在目的宿主机发送反压信息，以指示对该源虚拟机进行报文限速处理，本实施例通过对访问报文进行解析，从而可以识别了发起攻击的源虚拟机，并对其进行反压实现报文限速处理，以解决流量攻击问题。
在某些实施例中，该方法还可以包括：
确定源虚拟机中的反压对象；其中，反压对象可以是指源虚拟机发出的全部报文流、源虚拟机发向其发出的待限速报文流对应的目的虚拟机的全部报文流、或者源虚拟机发出的待限速报文流；
至少根据反压对象，生成反压信息；其中，反压信息用于指示对反压对象进行限速处理。
由于源虚拟机可能会发出多条报文流，而产生流量攻击的可能仅是其中一条报文流。对于确定出的该源虚拟机的待限速报文流，可以是将该待限速报文流作为反压对象，或在多个源虚拟机同时访问一个目的虚拟机的场景下，基于该待限速报文流对应内层五元组信息中目的IP地址可以确定目的虚拟机，可以是将发往该目的虚拟机的全部报文流作为反压对象；或者直接将源虚拟机发出的全部报文流均作为反压对象。其中，反压对象可以结合结合实际需求进行预先设定等。
在某些实施例中，该方法还可以包括：
确定源虚拟机对应的限速处理方式及报警处理方式中的至少一种处理方 式；
至少根据至少一种处理方式，生成反压信息；其中，反压信息用于指示按照至少一种处理方式对源虚拟机进行报文限速处理。
可选地，还可以确定源虚拟机中的反压对象；则可以具体是根据该至少一种处理方式及该反压对象，生成反压信息，以指示按照至少一种处理方式对源虚拟机中的反压对象进行报文限速处理。
在某些实施例中，该方法还可以包括：
在至少一种处理方式包括限速处理方式的情况下，确定源虚拟机对应的限速类型；
至少根据至少一种处理方式，生成反压信息包括：
至少根据至少一种处理方式及限速类型，生成反压信息；其中，反压信息可以具体是指示按照该限速流行对应的限速处理方式对源虚拟机进行限速处理。
可选地，还可以是至少根据该至少一种处理方法、该限速类型及反压对象生成反压信息。
实际应用中，限速处理方式可以包括调整发送报文的包转发率(英文：Packet Forwarding Rate，简称：pps)和/或比特率，pps限速可以是通过限制每秒发包数来实现，比特率可以通过限制bps(Bit Per Second，每秒比特数)来实现。限速类型即可以包括pps限速及bps限速中的至少一种。
此外，由于一个宿主机中可能会安装多个虚拟机，且一个虚拟机可能会发送多条报文流，为了方便源虚拟交换机确定反压信息针对的反压对象，可选地，该反压信息中还可以包括该内层封装信息中的内层五元组信息等。
此外，该反压信息中还可以包括虚拟网络标识，例如Vxlan网络中的VNI(Vxlan Network Identifier，Vxlan标识)，只有在同一个虚拟网络上的虚拟 机之间才能相互通信，从而可以基于反压信息中的虚拟网络标识和内层五元组信息可以识别源虚拟机中的反压对象。
结合上文描述可知，反压信息中可以包括至少一种处理方式、限速信息、反压对象、内层封装信息中的内层五元组信息、虚拟网络标识中的至少一个等，此外，还可以包括内层封装信息中的网络协议；此外，在虚拟网关受到流量攻击的场景下，流量攻击可能是来自于内网，也可能是来自于外网，因此该反压信息中还可以包括流量攻击方向等。
其中，报警处理方式可以指示对源虚拟机进行报警处理，例如包括获取源虚拟机的当前发包情况、源虚拟机的虚拟机标识、反压对象标识等作为应答信息反馈给目的端，由目的端据此进行报警等，如输出报警提示信息。
限速处理方式可以指示对源虚拟机进行pps限速和/或bps限速，并获取源虚拟机的当前发包情况、源虚拟机的虚拟机标识、反压对象标识等反馈给目的端，由目的端据此进行报警等，如输出报警提示信息。
因此，在某些实施例中，该方法还可以包括：
接收按照反压信息对源虚拟机进行报文限速处理之后反馈的应答信息；
基于应答信息，输出报警提示信息。
可选地，该应答信息中可以包括源虚拟机标识、反压对象标识和/或源虚拟机的当前发包情况等。
当前发包情况例如可以包括当前包转发率、最近预设时间范围内的平均包转发率、最近预设时间范围内的最大包转发率，还可以包当前比特率、最近预设时间范围内的平均比特率、最近预设时间范围内的最大比特率等。
可选地，输出报警提示信息可以基于相关人员的通信账号，将发送该报警提示信息，当然也可以发送至相应显示设备显示该报警提示信息等，以方便相关人员发生攻击的源虚拟机、当前攻击情况、和/或限速效果等
实际实现中，反压信息可以封装为反压报文进行发送，因此，在某些实施例中，该方法还可以包括：解析访问报文获得外层封装信息；
则向源虚拟机所在宿主机发送反压信息包括：
基于反压指示信息，及源虚拟机对应的内层封装信息和外层封装信息，构造反压报文；
将反压报文作为反压信息，发送至源虚拟机所在宿主机。
其中，外层封装信息可以具体包括源宿主机地址、此外，还可以目的主机地址等。
在某些实施例中，反压报文可以至少包括反压指示信息对应的至少一个反压字段、宿主机地址字段、网络标识字段、及内层五元组分别对应的字段；
则基于反压指示信息，及源虚拟机对应的内层封装信息和外层封装信息，构造反压报文可以包括：
将反压指示信息填入至少一个反压字段；
将源虚拟机对应外层封装信息中的源宿主机地址，填入宿主机地址字段；
将源虚拟机对应外层封装信息中的虚拟网络标识，填入网络标识字段；
将源虚拟机对应的内层封装信息中的内层五元组信息，填入内层五元组分别对应的字段。
其中，反压指示信息具体用于指示如何进行报文限速处理等；源宿主机地址用以据此发送该反压报文；虚拟网络标识及内层五元组信息用以识别需要进行限速处理的源虚拟机及其反压对象等。
由上文描述可知，反压指示信息例如可以包括至少一种处理方式、反压对象、限速类型等等。
因此，在某些实施例中，该至少一个反压字段可以包括处理方式字段、限速类型字段及反压对象字段；
则将反压指示信息填入至少一个反压字段可以包括：
确定源虚拟机对应的限速处理方式及报警处理方式中的至少一种处理方 式，将标识至少一个处理方式的参数数值写入处理方式字段；例如数值0表示限速处理方式，数值1报警处理方式；
在至少一种处理方式包括限速处理方式的情况下，确定源虚拟机对应的限速类型，将标识限速类型的参数数值写入限速类型字段；例如，数值0表示pps限速，数值1表示bps限速，数值2表示同时执行pps限速及bps限速；
确定源虚拟机中的反压对象，并基于反压对象确定内层五元组信息中的有效信息，以及将标识有效信息的参数数值写入反压对象字段；例如数值0表示内层五元组信息中源IP地址有效，数值1表示内层五元组信息中的三元组即源IP地址、目的IP地址以及传输层协议有效，数值2表示内层五元组全部有效。其中，源IP地址有效表示反压对象为源虚拟机发出的全部报文流，三元组有效表示反压对象为源虚拟机发向其发出的待限速报文流对应的目的虚拟机的全部报文流、五元组有效表示的反压对象为源虚拟机发出的待限速报文流。
在某些实施例中，反压报文还可以包括至少一个反馈字段；至少一个反馈字段用于进行报文限速处理之后填入处理结果，以生成应答报文；
该方法还可以包括：接收应答报文；基于应答报文，输出限速提示信息。
可选地，可以是将该应答报文作为限速提示信息。
其中，该至少一个反馈字段例如可以包括用于填入源虚拟机的虚拟机标识的虚拟机标识字段；此外，还可以包括：用于填入反压对象当前包转发率的包转发率字段和/或用于填入反压对象当前比特率的当前比特率字段；此外，还可以包括：用于填入反压对象最近预设时间范围内的平均包转发率的平均包转发率字段、用于填入反压对象最近预设时间范围内的最大包转发率的最大包转发率字段、用于填入反压对象最近预设时间范围内的平均比特率的平均比特率字段、以及用于填入反压对象最近预设时间范围内的最大比特率的最大比特率字段等中的至少一个。该最近预设时间范围例如可以是指最近10 分钟。
源虚拟交换机可以基于该至少一个反馈字段，获取相应的处理结果并填入相应反馈字段中。
在某些实施例中，该反压报文还可以包括攻击方向字段，该方法还可以包括：
在至少一种处理方式包括报警处理的情况下，确定流量攻击方向；
将标识流量攻击方向的参数数值，填入攻击方向字段。例如，数值0表示内网攻击，数值1表示外网攻击。
该攻击方向字段中的字段值标识的流量攻击方向用以作为一种报警信息，在反压报文中填入报文限速处理之后的处理结果之后，形成应答报文输出。
在某些实施例中，该反压报文还可以包括网络协议字段，该方法还可以包括：
将标识内层网络协议的参数数值，写入网络协议字段；例如，数值0表示ipv4(Internet Protocol version 4，网际协议版本4)，数值1表示ipv6(Internet Protocol version 6，网际协议版本6)。
该网络协议字段用于按照字段值标识的网络协议从反压报文中解析获得内层五元组信息。
为了便于理解，如图3中所示，示出了在一个实际应用中的反压报文的报文格式示意图，结合上文相关描述下面对该反压报文中可能包括的字段进行介绍：
Action：处理方式字段，取值可以包括0或1；数值0表示报警处理方式，指示仅报警不限速；数值1表示限速处理方式，执行限速动作。
Limit_type：限速类型字段，取值可以包括0、1或2；数值0表示进行 pps限速，数值1表示进行bps限速，数值3表示同时进行pps限速和bps限速。可选地，Action取值为0时，该Limit_type可以为空值。
Direction：攻击方向字段，取值可以包括0或1，数值0表示内网方向，数值1表示外网方向；其中，Direction取值为1时，Action取值为0。
key_type：反压对象字段，取值可以包括0、1或2，数值0表示内层源IP地址有效，数值1表示内层三元组(源IP地址、目的IP地址、传输层协议)有效，数值2表示内层五元组(源IP地址、目的IP地址、源端口、目的端口、传输层协议)有效。
Ncip：宿主机字段，取值为满足限速条件的源虚拟机所在的宿主机的宿主机IP地址；
tunnel id：网络标识字段，取值为满足限速条件的源虚拟机所在虚拟网络的虚拟网络标识，例如VNI。
Af：网络协议字段，取值为内层网络协议。
inner_proto：内层五元组字段之一，内层协议字段，取值内层传输层协议号。
inner_src ip：内层五元组字段之一，内层源地址字段，取值为内层源Ip地址；
inner_dst ip：内层五元组字段之一，内层源地址字段，取值为内层目的IP地址；
inner src port：内层五元组字段之一，内层源端口字段，取值为内层源端口号；
inner dst port：内层五元组字段之一，内层目的端口字段，取值为内层目的端口号。
ecs_id：虚拟机标识字段，取值为满足限速条件的源虚拟机的虚拟机标识，如虚拟机名称等。
out_pps：当前包转发率字段，取值为反压对象的当前pps。
avg_pps：平均包转发率字段，取值为最近预设时间范围内反压对象的平均pps，如最近10分钟内的平均pps。
max_pps：最大包转发率字段，取值为最近预设时间范围内反压对象的最大pps，如最近10分钟内的最大pps。
其中，构造完成的反压报文即可以基于Ncip字段中的宿主机地址进行发送。
图4为本申请实施例提供的一种控制方法又一个实施例的流程图，本实施例从反压信息接收端角度对报文限速处理过程进行介绍，接收端具体是指源虚拟交换机。该方法可以包括以下几个步骤：
401：接收反压信息。
其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；内层封装信息由目的端检测到访问流量满足限速条件，抓取访问报文，并对访问报文解析获得，具体实现可以详见图2所示实施例，在此不再赘述。
402：按照反压信息，对请求限速的源虚拟机进行报文限速处理。
其中，请求限速的源虚拟机可以根据反压信息中的内层五元组信息、虚拟网络标识等确定。
在某些实施例中，按照反压信息，对请求限速的源虚拟机进行报文限速处理可以是按照反压信息，对请求限速的源虚拟机中反压信息指示的反压对象进行报文限速处理。
在某些实施例中，按照反压信息，对请求限速的源虚拟机进行报文限速处理可以是按照反压信息指示的至少一种处理方式，对请求限速的源虚拟机进行报文限速处理。
在某些实施例中，按照反压信息指示的至少一种处理方式，对请求限速的源虚拟机进行报文限速处理可以包括：
确定反压信息指示的至少一种处理方式；
在至少一种处理方式包括报警处理方式的情况下，基于请求限速的源虚拟机的虚拟机标识、及该源虚拟机的发包情况信息生成第一反馈结果；
在至少一个处理方式包括限速处理方式的情况下，对请求限速的源虚拟机的报文发送进行限速处理，并基于该源虚拟机的虚拟机标识、及源虚拟机的发包情况信息生成第二反馈结果；
基于第一反馈结果或者第二反馈结果，生成应答信息，并将应答信息反馈给目的端。
其中，对请求限速的源虚拟机的报文发送进行限速处理可以具体是结合反压对象，对请求限速的源虚拟机中的反压对象表示的某个报文流中的报文发送进行限速处理。其中进行限速处理可以包括进行pps限速和/或进行bps限速等，具体可以是对源虚拟机对应的虚拟网卡进行限速处理，对从该虚拟网卡转发的报文流进行pps限速和/或bps限速，如将pps或bps降低一定百分比等。
此外，对报文发送进行限速处理之后，还可以生成限速记录进行保存。
其中，第一反馈结果中的发包情况信息例如可以包括当前包转发率，最近10分钟内的平均包转发率、以及最近10分钟内的最大包转发率等。
第二反馈结果中的发包情况信息例如可以包括进行限速处理之后的当前包转发率、最近10分钟内的平均包转发率、以及最近10分钟内的最大包转发率等。
由于前文描述可知，反压信息以反压报文形式发送。因此，在某些实施例中，接收反压信息可以包括：接收反压报文；解析反压报文，获得反压报文中的反压指示信息、虚拟网络标识、及内层五元组信息
则按照反压信息，对请求限速的源虚拟机进行报文限速处理可以包括：
基于虚拟网络标识及内层五元组信息中的源虚拟机地址，确定请求限速的源虚拟机；
按照反压指示信息，对该源虚拟机进行报文限速处理。
可选地，按照反压指示信息，对源虚拟机中进行报文限速处理可以包括：
按照反压指示信息中的反压对象字段值，确定内层五元组信息中的有效信息；
按照反压指示信息中的至少一种处理方式及限速类型，对有效信息标识的反压对象进行报文限速处理。
在某些实施例中，该方法还可以包括：
获取对源虚拟机进行报文限速处理之后的处理结果；
将处理结果填入反压报文中的至少一个反馈字段中，以生成应答报文；
发送应答报文至目的端。
其中，该处理结果即可以包括前文所述的第一反馈结果或者第二反馈结果。
此外，为了保证报文正常发送，在某些实施例中，接收反压信息可以是定时接收反压信息；
该方法还可以包括：
若在定时时间未接收到反压信息，则对已进行限速处理的反压对象执行恢复操作。
可以是基于限速记录，确定已进行限速处理的反压对象并执行恢复操作。例如假设对该反压对象进行pps限速，该恢复操作可以是指将该反压对象对应的pps升高一定百分比等。
在某些实施例中，对已进行限速处理的反压对象执行恢复操作之后，该方法还可以包括：
若已进行限速处理的反压对象恢复至进行限速处理之前的原始状态，则删除该进行限速处理的反压对象对应的限速记录。
如图5中所示，为本申请实施例提供的一种控制方法又一个实施例的流 程图，本实施例由源虚拟交换机执行，可以包括如下几个步骤：
501：在定时时间，判断是否接收到反压报文，如果是，执行步骤502，若否，执行步骤507。
502：解析反压报文。
解析反压报文，可以获得反压报文中的相关信息，如请求限速的源虚拟机、源虚拟机中的反压对象、处理方式、限速类型等等。
其中，本实施例中以限速类型为pps为例进行说明。
503：确定是否执行限速处理方式，若是执行步骤504，若否执行步骤505
504：将虚拟网卡中该反压对象对应的pps调整为原有的x％，并生成限速记录保存，之后执行步骤505。
其中，x小于100。
505：确定请求限速的源虚拟机的虚拟机标识和发包情况信息，填入反压报文中的反馈字段中，生成应答报文。
506：将应答报文发送至目的端。
507：基于限速记录，判断是否存在已进行限速的反压对象，若是，执行步骤508。
508：调整虚拟网卡中，该已进行限速的反压对象对应pps为当前的y％，其中，y大于100。
509：基于限速记录，判断该已进行限速的反压对象对应pps是否恢复为原始状态，若是，执行步骤510。
510：删除该已进行限速的反压对象对应的限速记录。
下面结合图1a和图1b分别示出的两种流量攻击场景对本申请技术方案进行介绍，图6a为对应图1a的流量攻击场景的控制交互示意图，目的虚拟交换机104检测访问流量满足限速条件时，抓取访问报文，并通过解析访问报文获得内层封装信息，基于内层封装信息可以确定满足限速条件的源虚拟 机101，并向该源虚拟机101所在源宿主机10发送反压报文，由源宿主机10中的源虚拟交换机102接收该反压报文，并基于反压报文对该源虚拟机101进行报文限速处理，并基于处理结果生成应答报文，将应答报文发送至目的虚拟交换机104，目的虚拟交换机104可以基于该应答报文，输出报警提示信息。
图6b为对应图1b的流量攻击场景的控制交互示意图，虚拟网关107检测访问流量满足限速条件时，抓取访问报文，并通过解析访问报文获得内层封装信息，基于内层封装信息可以确定满足限速条件的源虚拟机105，并向该源虚拟机105所在源宿主机30发送反压报文，由源宿主机30中的源虚拟交换机106接收该反压报文，并基于反压报文对该源虚拟机105进行报文限速处理，并基于处理结果生成应答报文，将应答报文发送至虚拟网关107，虚拟网关107可以基于该应答报文，输出报警提示信息。
此外，在一个实际应用中，本申请实施例的技术方案可以用于解决Vxlan网络中的流量攻击问题。因此，本申请实施例还提供了一种应用于Vxlan网络中的控制方法，可以包括：
检测访问流量满足限速条件，抓取Vxlan报文；
解析Vxlan报文，获得Vxlan报文中的内层封装信息；
基于内层封装信息，确定满足限速条件的源虚拟机；
向源虚拟机所在源宿主机发送反压信息；其中，反压信息用于指示对源虚拟机进行报文限速处理。
本实施例与图2所示实施例不同之处在于，访问报文具体为Vxlan报文，其它相同或相似步骤可以详见前文实施例中所述，在此不再赘述。
本申请实施例还提供了一种应用于Vxlan网络中的控制方法，可以包括：
接收反压信息；其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；内层封装信息由目 的端检测到访问流量满足限速条件，抓取Vxlan报文，并对VXlan报文解析获得；
按照反压信息，对源虚拟机进行报文限速处理。
图7为本申请实施例提供的一种控制装置一个实施例的结构示意图，该装置可以包括：
报文抓取模块701，用于检测访问流量满足限速条件，抓取访问报文；
报文解析模块702，用于解析访问报文，获得访问报文中的内层封装信息；
确定模块703，用于基于内层封装信息，确定满足限速条件的源虚拟机；
反压触发模块704，用于向源虚拟机所在源宿主机发送反压信息；其中，反压信息用于指示对源虚拟机进行报文限速处理。
图7所述的控制装置可以执行图2所示实施例所述的控制方法，其实现原理和技术效果不再赘述。对于上述实施例中的控制装置其中各个模块、单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图8为本申请实施例提供的一种控制装置又一个实施例的结构示意图，该装置可以包括：
信息接收模块801，用于接收反压信息；其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；内层封装信息由目的端检测到访问流量满足限速条件，抓取访问报文，并对访问报文解析获得；
处理模块802，用于按照反压信息，对源虚拟机进行报文限速处理。
图8所述的控制装置可以执行图4所示实施例所述的控制方法，其实现原理和技术效果不再赘述。对于上述实施例中的控制装置其中各个模块、单元执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处 将不做详细阐述说明。
此外，本申请实施例还提供了一种计算设备，如图9中所示，该计算设备可以包括处理组件901以及存储组件902，存储组件902存储一条或多条计算机指令，该一条或多条计算机指令用以被处理组件901调用执行，以使得该处理组件901可以运行至少一个虚拟机903，以及实现图1所示的控制方法的虚拟交换机904。
其中，该处理组件包括一个或多个处理器，处理器可以具体是指CPU。
此外，计算设备必然还可以包括其他部件，例如输入/输出接口、通信组件等。输入/输出接口为处理组件和外围接口模块之间提供接口，上述外围接口模块可以是输出设备、输入设备等。通信组件被配置为便于计算设备和其他设备之间有线或无线方式的通信等。
实际应用中，该计算设备可以为云计算平台提供的弹性计算主机等，此时计算设备即可以是指云服务器。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被计算机执行时可以实现上述图2所示实施例的控制方法。
此外，本申请实施例还提供了一种计算设备，如图10中所示，该计算设备可以包括处理组件1001以及存储组件1002，处理组件1001可以包括一个或多个处理器，存储组件1002存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件1001调用执行，以运行实现图1所示的控制方法的虚拟网关1003。
其中，处理器可以具体是指CPU。
此外，计算设备必然还可以包括其他部件，例如输入/输出接口、通信组件等。输入/输出接口为处理组件和外围接口模块之间提供接口，上述外围接口模块可以是输出设备、输入设备等。通信组件被配置为便于计算设备和其他设备之间有线或无线方式的通信等。
实际应用中，该计算设备可以为云计算平台提供的弹性计算主机等，此时计算设备即可以是指云服务器。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被计算机执行时可以实现上述图2所示实施例的控制方法。
此外，本申请实施例还提供了一种计算设备，如图11中所示，该计算设备可以包括处理组件1101以及存储组件1102，处理组件1101包括一个或多个处理器，存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行至少一个虚拟机1103、以及实现如图4所示实施例中所述控制方法的虚拟交换机1104。
其中，处理器可以具体是指CPU。
此外，计算设备必然还可以包括其他部件，例如输入/输出接口、通信组件等。输入/输出接口为处理组件和外围接口模块之间提供接口，上述外围接口模块可以是输出设备、输入设备等。通信组件被配置为便于计算设备和其他设备之间有线或无线方式的通信等。
实际应用中，该计算设备可以为云计算平台提供的弹性计算主机等，此时计算设备即可以是指云服务器。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序，所述计算机程序被计算机执行时可以实现上述图4所示实施例的控制方法。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例 方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (31)

  1. 一种控制方法，其特征在于，包括：
    检测访问流量满足限速条件，抓取访问报文；
    解析所述访问报文，获得所述访问报文中的内层封装信息；
    基于所述内层封装信息，确定满足限速条件的源虚拟机；
    向所述源虚拟机所在源宿主机发送反压信息；其中，所述反压信息用于指示对所述源虚拟机进行报文限速处理。
  2. 根据权利要求1所述的方法，其特征在于，所述基于所述内层封装信息，确定满足限速条件的源虚拟机包括：
    基于所述内层封装信息标识的报文流，对所述访问报文进行汇总以确定不同报文流的报文数量；
    按照不同报文流的报文数量，选择待限速报文流；
    确定所述待限速报文流对应的源虚拟机。
  3. 根据权利要求2所述的方法，其特征在于，所述按照不同报文流的报文数量，选择待限速报文流包括：
    按照不同报文流的报文数量，选择报文数量大于或等于预设数量的待限速报文流。
  4. 根据权利要求2所述的方法，其特征在于，所述按照不同报文流的报文数量，确定待限速报文流包括：
    按照报文数量从大到小的顺序，选择前N个报文流作为待限速报文流。
  5. 根据权利要求2所述的方法，其特征在于，还包括：
    确定所述源虚拟机中的反压对象；其中，所述反压对象包括所述源虚拟机发出的全部报文流、所述源虚拟机发向其发出的待限速报文流对应的目的虚拟机的全部报文流、或者所述源虚拟机发出的待限速报文流；
    至少根据所述反压对象，生成所述反压信息；其中，所述反压信息用于指示对所述反压对象进行报文限速处理。
  6. 根据权利要求2所述的方法，其特征在于，还包括：
    确定所述源虚拟机对应的限速处理方式及报警处理方式中的至少一种处理方式；
    至少根据所述至少一种处理方式，生成所述反压信息；其中，所述反压信息用于指示按照所述至少一种处理方式对所述源虚拟机进行报文限速处理。
  7. 根据权利要求6所述的方法，其特征在于，还包括：
    在所述至少一种处理方式包括限速处理方式的情况下，确定所述源虚拟机对应的限速类型；
    所述至少根据所述至少一种处理方式，生成反压信息包括：
    至少根据所述至少一种处理方式及所述限速类型，生成反压信息。
  8. 根据权利要求1所述的方法，其特征在于，还包括：
    接收按照所述反压信息对所述源虚拟机进行报文限速处理之后反馈的应答信息；
    基于所述应答信息，输出报警提示信息。
  9. 根据权利要求1所述的方法，其特征在于，还包括：
    解析所述访问报文获得外层封装信息；
    所述向所述源虚拟机所在宿主机发送反压信息包括：
    基于反压指示信息，及所述源虚拟机对应的内层封装信息和外层封装信息，构造反压报文；
    将所述反压报文作为反压信息，发送至所述源虚拟机所在宿主机。
  10. 根据权利要求9所述的方法，其特征在于，所述反压报文至少包括反压指示信息对应的至少一个反压字段、宿主机地址字段、网络标识字段、及内层五元组分别对应的字段；
    所述基于反压指示信息，及所述源虚拟机对应的内层封装信息和外层封装信息，构造反压报文包括：
    将反压指示信息填入所述至少一个反压字段；
    将所述源虚拟机对应外层封装信息中的源宿主机地址，填入所述宿主机地址字段；
    将所述源虚拟机对应外封装信息中的虚拟网络标识，填入所述网络标识字段；
    将所述源虚拟机对应的内层封装信息中的内层五元组信息，填入所述内层五元组分别对应的字段。
  11. 根据权利要求10所述的方法，其特征在于，所述反压报文还包括至少一个反馈字段；所述至少一个反馈字段用于进行报文限速处理之后填入处理结果，以生成应答报文；
    所述方法还包括：
    接收所述应答报文；
    基于所述应答报文，输出限速提示信息。
  12. 根据权利要求11所述的方法，其特征在于，所述至少一个反馈字段包括用于填入所述源虚拟机的虚拟机标识的虚拟机标识字段、用于填入所述反压对象当前包转发率的当前包转发率字段、用以填入所述反压对象最近预设时间范围内的平均包转发率的平均包转发率字段、以及用以填入所述反压对象最近预设时间范围内的最大包转发率的最大包转发率字段。
  13. 根据权利要求11所述的方法，其特征在于，所述反压报文还包括攻击方向字段；
    所述方法还包括：
    在所述源虚拟机对应报警处理方式的情况下，确定流量攻击方向；
    将标识流量攻击方向的参数数值，填入所述攻击方向字段。
  14. 根据权利要求10所述的方法，其特征在于，所述反压报文还包括网络协议字段；所述方法还包括：
    将标识内层网络协议的参数数值，填入所述网络协议字段；所述网络协议字段用于按照字段值标识的网络协议解析获得所述内层五元组信息。
  15. 根据权利要求10所述的方法，其特征在于，所述至少一个反压字段包括处理方式字段、限速类型字段及反压对象字段；
    所述将反压指示信息填入所述至少一个反压字段包括：
    确定所述源虚拟机对应的限速处理方式及报警处理方式中的至少一种处理方式，将标识所述至少一个处理方式的参数数值写入所述处理方式字段；
    在所述至少一种处理方式包括限速处理方式的情况下，确定所述源虚拟机对应的限速类型，将标识所述限速类型的参数数值写入所述限速类型字段；
    确定所述源虚拟机中的反压对象，并基于所述反压对象确定所述内层五元组信息中的有效信息，及将标识所述有效信息的参数数值写入所述反压对象字段。
  16. 根据权利要求1所述的方法，其特征在于，所述检测访问流量满足限速条件，抓取访问报文包括：
    检测访问流量满足限速条件，按照采样频率及采样数量抓取访问报文。
  17. 一种控制方法，其特征在于，包括：
    接收反压信息；其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；所述内层封装信息由所述目的端检测到访问流量满足限速条件，抓取访问报文，并对所述访问报文解析获得；
    按照所述反压信息，对所述源虚拟机进行报文限速处理。
  18. 根据权利要求17所述的方法，其特征在于，所述按照反压信息，对所述源虚拟机进行报文限速处理包括：
    按照所述反压信息，对所述源虚拟机中所述反压信息指示的反压对象进行报文限速处理。
  19. 根据权利要求17所述的方法，其特征在于，所述按照反压信息，对所述源虚拟机进行报文限速处理包括：
    按照所述反压信息指示的至少一种处理方式，对所述源虚拟机进行报文 限速处理。
  20. 根据权利要求19所述的方法，其特征在于，按照所述反压信息指示的至少一种处理方式，对所述源虚拟机进行报文限速处理包括：
    确定所述反压信息指示的至少一种处理方式；
    在所述至少一种处理方式包括报警处理方式的情况下，基于所述源虚拟机的虚拟机标识、及所述源虚拟机的发包情况信息生成第一反馈结果；
    在所述至少一种处理方式包括限速处理方式的情况下，对所述源虚拟机的报文发送进行限速处理，并基于所述源虚拟机的虚拟机标识、及所述源虚拟机的发包情况信息生成第二反馈结果；
    基于所述第一反馈结果或者所述第二反馈结果，生成应答信息，并将所述应答信息反馈给所述目的端。
  21. 根据权利要求17所述的方法，其特征在于，所述接收反压信息包括：
    定时接收反压信息；
    所述方法还包括：
    若在定时时间未接收到所述反压信息，对已进行限速处理的反压对象执行恢复操作。
  22. 根据权利要求17所述的方法，其特征在于，所述接收反压信息包括：
    接收反压报文；
    解析所述反压报文，获得所述反压报文中的反压指示信息、虚拟网络标识、及内层五元组信息；
    所述按照所述反压信息，对所述源虚拟机进行报文限速处理包括：
    基于所述虚拟网络标识及所述内层五元组信息中源虚拟机地址，确定所述源虚拟机；
    按照所述反压指示信息，对所述源虚拟机进行报文限速处理。
  23. 根据权利要求22所述的方法，其特征在于，还包括：
    获取对所述源虚拟机进行报文限速处理之后的处理结果；
    将所述处理结果填入所述反压报文中的至少一个反馈字段中，以生成应答报文；
    发送所述应答报文至所述目的端。
  24. 根据权利要求23所述的方法，其特征在于，所述按照所述反压指示信息，对所述源虚拟机中进行报文限速处理包括：
    按照所述反压指示信息中的反压对象字段值，确定所述内层五元组信息中的有效信息；
    按照所述反压指示信息中的至少一种处理方式及限速类型，对所述有效信息标识的反压对象进行报文限速处理。
  25. 一种控制装置，其特征在于，包括：
    报文抓取模块，用于检测访问流量满足限速条件，抓取访问报文；
    报文解析模块，用于解析所述访问报文，获得所述访问报文中的内层封装信息；
    确定模块，用于基于所述内层封装信息，确定满足限速条件的源虚拟机；
    反压触发模块，用于向所述源虚拟机所在源宿主机发送反压信息；其中，所述反压信息用于指示对所述源虚拟机进行报文限速处理。
  26. 一种控制装置，其特征在于，包括：
    信息接收模块，用于接收反压信息；其中，反压信息由目的端针对满足限速条件的源虚拟机发送；满足限速条件的源虚拟机基于内层封装信息确定；所述内层封装信息由所述目的端检测到访问流量满足限速条件，抓取访问报文，并对所述访问报文解析获得；
    处理模块，用于按照所述反压信息，对所述源虚拟机进行报文限速处理。
  27. 一种计算设备，其特征在于，包括处理组件及存储组件，所述存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行至少一个虚拟机、以及运行实现如权利要求1～16任一项所述控制方法的虚拟交换机。
  28. 一种计算设备，其特征在于，包括处理组件及存储组件，所述存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行实现如权利要求1～16任一项所述控制方法的虚拟网关。
  29. 一种计算设备，其特征在于，包括处理组件及存储组件，所述存储组件存储一条或多条计算机指令，所述一条或多条计算机指令用以被所述处理组件调用执行，以运行至少一个虚拟机、以及实现如权利要求17～24任一项所述控制方法的虚拟交换机。
  30. 一种计算机存储介质，其特征在于，存储有计算机程序，所述计算机程序被计算机执行时实现如权利要求1-16任一项所述控制方法。
  31. 一种计算机存储介质，其特征在于，存储有计算机程序，所述计算机程序被计算机执行时实现如权利要求17-24任一项所述的控制方法。
PCT/CN2022/077740 2021-03-22 2022-02-24 控制方法、装置及计算设备 WO2022199316A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22773978.6A EP4319094A1 (en) 2021-03-22 2022-02-24 Control method and apparatus, and computing device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110302539.2 2021-03-22
CN202110302539.2A CN115190077B (zh) 2021-03-22 2021-03-22 控制方法、装置及计算设备

Publications (1)

Publication Number Publication Date
WO2022199316A1 true WO2022199316A1 (zh) 2022-09-29

Family

ID=83396311

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/077740 WO2022199316A1 (zh) 2021-03-22 2022-02-24 控制方法、装置及计算设备

Country Status (3)

Country Link
EP (1) EP4319094A1 (zh)
CN (1) CN115190077B (zh)
WO (1) WO2022199316A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150264077A1 (en) * 2014-03-13 2015-09-17 International Business Machines Corporation Computer Implemented Techniques for Detecting, Investigating and Remediating Security Violations to IT Infrastructure
CN106817243A (zh) * 2015-12-01 2017-06-09 广达电脑股份有限公司 服务器资源的管理系统及其管理方法
US10764249B1 (en) * 2017-11-30 2020-09-01 Juniper Networks, Inc. Anti-spoofing techniques for overlay networks

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103634235A (zh) * 2013-11-01 2014-03-12 国云科技股份有限公司 一种限定虚拟机网络接口速度的方法
CN105591834B (zh) * 2015-07-10 2018-12-11 新华三技术有限公司 Vxlan中的流量监控方法和装置
CN108964959B (zh) * 2017-05-27 2022-02-25 阿里巴巴集团控股有限公司 一种用于虚拟化平台的网卡直通系统及数据包监管方法
CN108683607B (zh) * 2018-06-14 2020-02-21 新华三云计算技术有限公司 虚拟机流量控制方法、装置和服务器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150264077A1 (en) * 2014-03-13 2015-09-17 International Business Machines Corporation Computer Implemented Techniques for Detecting, Investigating and Remediating Security Violations to IT Infrastructure
US20160261624A1 (en) * 2014-03-13 2016-09-08 International Business Machines Corporation Computer Implemented Techniques for Detecting, Investigating and Remediating Security Violations to IT Infrastructure
CN106817243A (zh) * 2015-12-01 2017-06-09 广达电脑股份有限公司 服务器资源的管理系统及其管理方法
US10764249B1 (en) * 2017-11-30 2020-09-01 Juniper Networks, Inc. Anti-spoofing techniques for overlay networks

Also Published As

Publication number Publication date
CN115190077B (zh) 2023-09-22
EP4319094A1 (en) 2024-02-07
CN115190077A (zh) 2022-10-14

Similar Documents

Publication Publication Date Title
US8149705B2 (en) Packet communications unit
CN100474819C (zh) 一种深度报文检测方法、网络设备及系统
US8677473B2 (en) Network intrusion protection
US9819590B2 (en) Method and apparatus for notifying network abnormality
US8958318B1 (en) Event-based capture of packets from a network flow
WO2018099249A1 (zh) 在nfv系统中检测故障的方法、装置和系统
WO2016106592A1 (zh) 一种特征信息分析方法及装置
US9356844B2 (en) Efficient application recognition in network traffic
US9660833B2 (en) Application identification in records of network flows
CN108737447B (zh) 用户数据报协议流量过滤方法、装置、服务器及存储介质
JP5673805B2 (ja) ネットワーク装置、通信システム、異常トラヒックの検出方法およびプログラム
WO2023005773A1 (zh) 基于远程直接数据存储的报文转发方法、装置、网卡及设备
US20150071085A1 (en) Network gateway for real-time inspection of data frames and identification of abnormal network behavior
US20170295193A1 (en) Adaptive anomaly context description
JP2019152912A (ja) 不正通信対処システム及び方法
WO2022199316A1 (zh) 控制方法、装置及计算设备
WO2017070965A1 (zh) 一种基于软件定义网络的数据处理方法及相关设备
CN114244610B (zh) 一种文件传输方法、装置，网络安全设备及存储介质
JP2015032985A (ja) 通信制御装置、通信制御方法、および通信制御システム
JP2019216305A (ja) 通信装置、パケット処理方法及びプログラム
CN111193689B (zh) 一种网络攻击处理方法、装置、电子设备及存储介质
WO2023045865A1 (zh) Bgp flowspec路由下发方法及装置、存储介质、电子设备
CN108737291B (zh) 一种网络流量表示的方法及装置
WO2023216792A1 (zh) 一种检测攻击的方法及装置
JP7396368B2 (ja) 方法、システム及び変換装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22773978

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18551951

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2022773978

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 11202307201W

Country of ref document: SG

ENP Entry into the national phase

Ref document number: 2022773978

Country of ref document: EP

Effective date: 20231023