WO2022205907A1 - 缓解拒绝服务攻击的方法、装置及系统 - Google Patents

缓解拒绝服务攻击的方法、装置及系统 Download PDF

Info

Publication number
WO2022205907A1
WO2022205907A1 PCT/CN2021/128678 CN2021128678W WO2022205907A1 WO 2022205907 A1 WO2022205907 A1 WO 2022205907A1 CN 2021128678 W CN2021128678 W CN 2021128678W WO 2022205907 A1 WO2022205907 A1 WO 2022205907A1
Authority
WO
WIPO (PCT)
Prior art keywords
slice
attack
service
denial
attacked
Prior art date
Application number
PCT/CN2021/128678
Other languages
English (en)
French (fr)
Inventor
王海燚
林燕飞
樊宁
沈军
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Publication of WO2022205907A1 publication Critical patent/WO2022205907A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present disclosure relates to the technical field of network security, and in particular, to a method, device, and system for mitigating denial-of-service attacks, and a computer-storable medium.
  • a network slice is a complete, instantiated logical network composed of a set of network functions and corresponding resources.
  • Network slicing can provide isolated and customizable network services according to different service requirements, and flexibly respond to differentiated application scenarios.
  • the abnormal traffic related to the denial of service attack is subjected to traffic cleaning or expansion of the attacked network resources or service resources.
  • a method for mitigating a denial of service attack including: acquiring attack information of a denial of service attack against at least one attacked slice resource in a service network system; for each attacked slice resource, According to the corresponding attack information, determine the parameter information for creating the target network slice; for each attacked slice resource, create a target network slice according to the determined parameter information, where the target network slice includes support for each attacked slice resource The target slice resource of the business function supported by the slice resource; for each attacked slice resource, the service traffic or abnormal traffic related to denial of service attacks sent to each attacked slice resource is forwarded to the target The target slice resource in the network slice.
  • forwarding the service traffic or abnormal traffic related to the denial of service attack sent to each attacked slice resource to the target slice resource in the target network slice includes: generating and sending a first The traffic forwarding strategy is sent to the traffic forwarding system, so that the traffic forwarding system performs traffic forwarding according to the first traffic forwarding strategy, where the first traffic forwarding strategy is the service traffic or The abnormal traffic related to the denial of service attack is forwarded to the target slice resource in the target network slice.
  • forwarding the service traffic or abnormal traffic related to the denial of service attack sent to each of the attacked slice resources to the target slice resource in the target network slice further includes:
  • the attack information corresponding to the attacked slice resource determines the attack type of the denial of service attack for each attacked slice resource, and different attack types correspond to different first traffic forwarding policies.
  • the attack types include a single type and a multi-vector complex type, and in the case that the determined attack type of the denial of service attack on each of the attacked slice resources is a single type, the first attack type
  • the traffic forwarding strategy is to forward abnormal traffic related to denial of service attacks sent to each attacked slice resource to the target slice resource in the target network slice; after the determined denial of each attacked slice resource
  • the attack type of the service attack is multi-vector complex
  • the first traffic forwarding strategy is to forward the service traffic sent to each attacked slice resource to the target slice resource in the target network slice.
  • determining the attack type of the denial of service attack on each of the attacked slice resources includes: for each attacked slice resource, according to the corresponding attack information, determining the attack means information of the corresponding denial of service attack, At least one of attack strategy information and attack target information; according to at least one of the determined attack means information, attack strategy information and attack target information of the denial of service attack, determine the denial of each attacked slice resource The attack type of the service attack.
  • the attack means information includes the number of attack means
  • the attack strategy information includes at least one of attack frequency, attack time interval, and types of attack sources
  • the attack target information includes the number of attack targets.
  • the method for mitigating a denial of service attack further includes: forwarding abnormal traffic related to a denial of service attack sent to each of the attacked slice resources to a target slice resource in the target network slice after , monitor whether the attack information of the denial of service attack with the target slice resource satisfies the preset condition; in the case where the attack information of the denial of service attack with the target slice resource satisfies the preset condition, terminate the target network slice.
  • the method for mitigating a denial of service attack further includes: after forwarding the service traffic sent to each of the attacked slice resources to the target slice resource in the target network slice, monitoring each of the attacked slice resources Whether the attack information of the denial-of-service attack that attacks the slice resource meets the preset condition; if the attack information of the denial-of-service attack of each attacked slice resource is monitored and meets the preset condition, it will be sent to the target slice resource
  • the service traffic sent to the target slice resource is forwarded to each of the attacked slice resources; after the service traffic sent to the target slice resource is forwarded to each of the attacked slice resources, the target network slice is terminated.
  • a slice termination request is generated and sent to the slice management system, so that the slice management system terminates the target network slice according to the slice termination request, and the prompt message represents The traffic forwarding system has completed the traffic forwarding operation according to the second traffic forwarding policy, and the slice termination request includes the identifier of the target network slice.
  • forwarding the service traffic sent to the target slice resource to each of the attacked slice resources includes: generating and sending a second traffic forwarding policy to the traffic forwarding system, so that the traffic forwarding system The second traffic forwarding strategy is used to forward traffic, and the second traffic forwarding strategy is to forward the service traffic sent to the target slice resource to each of the attacked slice resources.
  • terminating the target network slice includes generating and sending a slice termination request to a slice management system, so that the slice management system terminates the target network slice according to the slice termination request, the slice termination request including The identifier of the target network slice.
  • acquiring attack information of a denial-of-service attack against at least one attacked slice resource in a service network system includes: using a probe and a security protection system deployed in the service network system to acquire the service network The attack information of the denial-of-service attack against at least one attacked slice resource in the system, the probe is deployed in a designated position of the service network system, and the designated position is outside the protection range of the security protection system.
  • using a probe and a security protection system deployed in the service network system acquiring attack information of a denial of service attack against at least one attacked slice resource in the service network system includes: using the The probe and the security protection system collect at least one of abnormal traffic information and abnormal service status information for slice resources in the business network system; according to at least one of the collected abnormal traffic information and abnormal service status information In this way, the denial of service attack is detected on the corresponding abnormal traffic; when it is detected that the corresponding abnormal traffic belongs to the denial of service attack, it is determined that the slice resource is the attacked slice resource, and the slicing resource is sent to the abnormal slicing resource. From the abnormal traffic information corresponding to the traffic, the attack information of the denial of service attack on the sliced resource is acquired.
  • the slice creation request further includes service requirements of the network slice to which each attacked slice resource belongs.
  • creating the target network slice includes generating and sending a slice creation request to a slice management system, so that the slice management system creates the target network slice according to the slice creation request, the slice creation request including the determined parameter information.
  • the parameter information includes a resource identifier of each attacked slice resource and a slice identifier of a network slice to which each attacked slice resource belongs.
  • an apparatus for mitigating a denial of service attack comprising: an acquisition module configured to acquire attack information of a denial of service attack against at least one attacked slice resource in a service network system; a determination module, It is configured to, for each attacked slice resource, determine the parameter information for creating the target network slice according to the corresponding attack information; the creation module is configured to, for each attacked slice resource, create the target network slice according to the determined parameter information.
  • the target network slice includes a target slice resource that supports the business functions supported by each of the attacked slice resources; the forwarding module is configured to, for each attacked slice resource, send to each of the attacked slice resources The service traffic of the attacked slice resource, or the abnormal traffic related to the denial of service attack is forwarded to the target slice resource in the target network slice.
  • an apparatus for mitigating a denial of service attack comprising: a memory; and a processor coupled to the memory, the processor configured to execute, based on instructions stored in the memory, A method for alleviating a denial of service attack described in any of the above embodiments.
  • a system for mitigating a denial of service attack including the device for mitigating a denial of service attack according to any of the foregoing embodiments.
  • the system for mitigating a denial of service attack further includes a slice management system configured to receive a slice creation request from the apparatus for mitigating a denial of service attack, and create the target network according to the slice creation request slicing, the slice creation request includes parameter information for creating a target network slice; and a traffic forwarding system configured to receive a first traffic forwarding policy from the device for mitigating denial of service attacks and, according to the first traffic The forwarding strategy performs traffic forwarding, and the first traffic forwarding strategy is to forward the service traffic or abnormal traffic related to denial of service attacks sent to each of the attacked slice resources to the target slice in the target network slice resource.
  • a computer-storable medium having computer program instructions stored thereon, and when the instructions are executed by a processor, implement the method for mitigating a denial-of-service attack described in any of the foregoing embodiments.
  • FIG. 1 is a flowchart illustrating a method of mitigating a denial of service attack according to some embodiments of the present disclosure
  • FIG. 2 is a block diagram illustrating an apparatus for mitigating a denial of service attack according to some embodiments of the present disclosure
  • FIG. 3 is a block diagram illustrating an apparatus for mitigating a denial of service attack according to further embodiments of the present disclosure
  • FIG. 4 is a block diagram illustrating a system for mitigating denial of service attacks in accordance with some embodiments of the present disclosure
  • FIG. 5 is a block diagram illustrating a computer system for implementing some embodiments of the present disclosure.
  • the present disclosure proposes a method for mitigating a denial of service attack, which can make the attacker unable to perceive the attack situation, reduce the impact of the denial of service attack on the operation of normal services, and improve the protection effect.
  • FIG. 1 is a flowchart illustrating a method of mitigating a denial of service attack in accordance with some embodiments of the present disclosure.
  • the method for mitigating a denial of service attack includes steps S110-S140.
  • step S110 attack information of a denial of service attack against at least one attacked slice resource in the service network system is acquired.
  • a probe and a security protection system deployed in the service network system may be used to acquire attack information of a denial of service attack against at least one attacked slice resource in the service network system.
  • Probes are deployed at specified locations in the business network system. The designated location is outside the protection range of the security guard system.
  • the probe and the security protection system deployed in the service network system can be used to obtain attack information of a denial of service attack on at least one attacked slice resource in the service network system in the following manner.
  • the abnormal traffic information includes input interface, output interface, source IP (Internet Protocol, Internet Protocol) address, destination IP address, source port number, destination port number, communication protocol information, network packet type, The start and end time of the network flow, the number of data packets in the start and end time interval (or the number of data packets in a unit time interval), etc.
  • the abnormal service status information includes CPU (Central Processing Unit, central processing unit) utilization, TCP (Transmission Control Protocol, Transmission Control Protocol) or UDP (User Datagram Protocol, User Datagram Protocol) number of network connections , the number of connections for a specific port state, etc.
  • the collected abnormal traffic information and abnormal service state information perform denial of service attack detection on the abnormal traffic corresponding to at least one of the collected abnormal traffic information and abnormal service state information.
  • the denial of service attack detection may be performed on the corresponding abnormal traffic according to the feature vector of the traffic information or service state information related to the denial of service attack.
  • some specific source IP addresses and network data packets belong to denial of service attacks, which can be converted into feature vectors in advance and stored in the feature vector library.
  • a preset threshold may also be used to perform denial-of-service attack detection on the corresponding abnormal traffic. For example, when the CPU utilization exceeds the preset CPU utilization threshold, the abnormal traffic is a denial of service attack. For another example, when the number of TCP or UDP network connections exceeds the preset number of network connections threshold, the abnormal traffic is a denial of service attack. For another example, in the case that a certain type of network data packets exceeds a preset threshold, the abnormal traffic is a denial of service attack.
  • the slice resource is the attacked slice resource, and obtain the information about the slice resource from the abnormal traffic information corresponding to the abnormal traffic sent to the slice resource.
  • denial of service attack attack information includes input interface, output interface, source IP address, destination IP address, source port number, destination port number, communication protocol information, network packet type, start and end time of network flow, and the number of data packets in the start and end time interval. (or the number of packets in a unit time interval) and so on.
  • a probe or a security protection system independently deployed in the service network system may also be used to acquire attack information of a denial of service attack against at least one attacked slice resource in the service network system.
  • the probes in the foregoing embodiments may be software or hardware.
  • the security protection system may include a firewall system, an intrusion detection or protection system, and the like.
  • step S120 for each attacked slice resource, parameter information for creating a target network slice is determined according to the corresponding attack information.
  • the parameter information includes a resource identifier of each attacked slice resource and a slice identifier of the network slice to which each attacked slice resource belongs.
  • the resource identifier of each attacked slice resource and the The slice identifier of the network slice to which each attacked slice resource belongs.
  • step S130 for each attacked slice resource, a target network slice is created according to the determined parameter information.
  • the target network slice includes the target slice resources that support the business functions supported by each attacked slice resource.
  • target network slices may be created using a slice management system.
  • a slice creation request is generated and sent to the slice management system, so that the slice management system creates the target network slice according to the slice creation request.
  • the slice creation request includes the determined parameter information.
  • the slice management system obtains the relevant parameter information of the attacked slice resource from the slice management system according to the slice identifier and resource identifier in the slice creation request.
  • the parameter information includes the service level of the network slice to which the attacked slice resource belongs, the slice attribute of the network slice to which it belongs (either a dedicated slice or a shared slice), the user information of the network slice to which it belongs, and the network information (such as subnet information) of the network slice to which it belongs.
  • the slice management system creates the target network slice according to the relevant parameter information of the attacked slice resource.
  • the slice creation request further includes the business requirements of the network slice to which each attacked slice resource belongs.
  • the slice management system obtains the relevant parameter information and business requirements of the attacked slice resources from the slice management system according to the slice identifier and resource identifier in the slice creation request.
  • the parameter information includes the service level of the network slice to which the attacked slice resource belongs, the slice attribute of the network slice to which it belongs (either a dedicated slice or a shared slice), the user information of the network slice to which it belongs, and the network information (such as subnet information) of the network slice to which it belongs.
  • the slice management system creates the target network slice according to the relevant parameter information of the attacked slice resources. For example, the slice management system generates the SLA (Service Level Agreement) requirements and resource configuration information of the target network slice according to the relevant parameter information, and creates the target network slice based on the SLA requirements and resource configuration information.
  • SLA Service Level Agreement
  • step S140 for each attacked slice resource, the service traffic or abnormal traffic related to the denial of service attack sent to each attacked slice resource is forwarded to the target slice resource in the target network slice.
  • the traffic forwarding system may be used to forward the traffic, or abnormal traffic related to a denial of service attack, sent to each attacked slice resource to the target slice resource in the target network slice.
  • a first traffic forwarding strategy is generated and sent to the traffic forwarding system, so that the traffic forwarding system performs traffic forwarding according to the first traffic forwarding strategy.
  • the first traffic forwarding strategy is to forward the service traffic or abnormal traffic related to a denial of service attack, which is sent to each attacked slice resource, to the target slice resource in the target network slice.
  • the attack type of the denial of service attack on each attacked slice resource may be determined according to the attack information corresponding to each attacked slice resource.
  • Different attack types correspond to different first traffic forwarding policies. That is, according to different attack types, different first traffic forwarding policies are generated.
  • attack types include single type and multi-vector complex type.
  • the attack method, attack strategy or attack target of a single type of denial of service attack is relatively simple.
  • the attack methods, attack strategies or attack targets of multi-vector complex denial of service attacks are relatively complex, and there are even combinations of different attack methods, attack strategies or attack targets.
  • the target network slice corresponding to the single type can be named as a pseudo slice, and the target network slice corresponding to the multi-vector complex type can be named as an alternative slice.
  • the first traffic forwarding policy is to forward the abnormal traffic related to the denial of service attack sent to each attacked slice resource to the target slice resource in the target network slice.
  • the first traffic forwarding strategy is to forward the service traffic sent to each attacked slice resource to the target network slice The target tile resource in .
  • the attack type of the denial of service attack against each attacked slice resource may be determined in the following manner.
  • attack means information, attack strategy information and attack target information of the corresponding denial of service attack is determined.
  • the attack means information includes the number of attack means.
  • the attack strategy information includes at least one of attack frequency, attack time interval, and types of attack sources.
  • the attack target information includes the number of attack targets.
  • the attack type is a single type.
  • the attack strategy information, and the attack target information meets the second preset condition, it is determined that the attack type is a multi-vector complex type.
  • the first preset condition includes that the number of attack means is less than the means number threshold (for example, 3), the number of attack targets is less than the target number threshold (for example, 3), the attack frequency is less than the frequency threshold, the attack time interval is less than the time threshold, and the source of the attack is The species is less than the species threshold.
  • the second preset condition includes that the number of attack means is greater than or equal to the means number threshold (for example, 3), the number of attack targets is greater than or equal to the target number threshold (for example, 3), the attack frequency is greater than or equal to the frequency threshold, and the attack time interval is greater than or equal to The time threshold and the type of attack source are greater than or equal to the type threshold.
  • the attack type of the denial of service attack against each attacked slice resource as a single type as an example, forward the abnormal traffic related to the denial of service attack sent to each attacked slice resource to the target slice resource in the target network slice Then, monitor whether the attack information of the denial of service attack with the target slice resource satisfies the preset condition.
  • the target network slice is terminated when the attack information of the denial-of-service attack with the target slice resource is detected and meets the preset condition. If the attack information of the denial-of-service attack with the target slice resource satisfies the preset condition, it indicates that the attack intensity of the denial-of-service attack is weakened or the attack has ended.
  • the attack type of the denial of service attack on each attacked slice resource as a multi-vector complex type as an example, after forwarding the service traffic sent to each attacked slice resource to the target slice resource in the target network slice, monitoring Whether the attack information of the denial of service attack of each attacked slice resource meets the preset conditions.
  • the service traffic sent to the target slice resource is forwarded to each attacked slice resource. After forwarding the service traffic sent to the target slice resource to each attacked slice resource, terminate the target slice resource.
  • the attack intensity of the denial of service attack is weakened or the attack is over, the control service traffic is sent to the original attacked slice resources, and the target network slice is terminated, which can release the occupied resources in time and improve the resource utilization in the service network system. Rate.
  • a traffic forwarding system may be utilized to forward traffic traffic sent to the target slice resource to each attacked slice resource.
  • a second traffic forwarding policy is generated and sent to the traffic forwarding system, so that the traffic forwarding system performs traffic forwarding according to the second traffic forwarding policy.
  • the second traffic forwarding strategy is to forward the service traffic sent to the target slice resource to each attacked slice resource.
  • the foregoing step of terminating the target network slice may be implemented in the following manner. Generate and send a slice termination request to the slice management system, so that the slice management system terminates the target network slice according to the slice termination request.
  • the slice termination request includes the identification of the target network slice.
  • a new network slice is created for the attacked slice resource, and the service traffic sent to the attacked slice resource or the abnormal traffic related to the denial of service attack is directed to be forwarded to the new slice in the new network slice.
  • the attackers mistakenly believe that their attacks are still affecting the operation of normal business, so that the attackers cannot perceive the attack situation.
  • the present disclosure isolates business traffic and abnormal traffic related to denial-of-service attacks by forwarding traffic, which can reduce the impact of denial-of-service attacks on normal business operations and improve protection effects.
  • FIG. 2 is a block diagram illustrating an apparatus for mitigating a denial of service attack according to some embodiments of the present disclosure.
  • the apparatus 21 for mitigating a denial of service attack includes an acquisition module 211 , a determination module 212 , a creation module 213 and a forwarding module 214 .
  • the obtaining module 211 is configured to obtain attack information of a denial of service attack against at least one attacked slice resource in the service network system, for example, performing step S110 shown in FIG. 1 .
  • the determining module 212 is configured to, for each attacked slice resource, determine the parameter information for creating the target network slice according to the corresponding attack information, for example, perform step S120 shown in FIG. 1 .
  • the creation module 213 is configured to, for each attacked slice resource, create a target network slice according to the determined parameter information, for example, perform step S130 shown in FIG. 1 .
  • the target network slice includes the target slice resources that support the business functions supported by each attacked slice resource.
  • the forwarding module 214 is configured to, for each attacked slice resource, forward the service traffic or abnormal traffic related to the denial of service attack, which is sent to each attacked slice resource, to the target slice resource in the target network slice, such as executing Step S140 as shown in FIG. 1 .
  • FIG. 3 is a block diagram illustrating an apparatus for mitigating a denial of service attack according to further embodiments of the present disclosure.
  • the apparatus 31 for mitigating a denial of service attack includes a memory 311 ; and a processor 312 coupled to the memory 311 .
  • the memory 311 is used to store instructions for executing corresponding embodiments of the method for mitigating denial of service attacks.
  • the processor 312 is configured to perform the method of mitigating a denial of service attack in any of some embodiments of the present disclosure based on instructions stored in the memory 311 .
  • FIG. 4 is a block diagram illustrating a system for mitigating denial of service attacks in accordance with some embodiments of the present disclosure.
  • the system 4 for mitigating a denial of service attack includes an apparatus 41 for mitigating a denial of service attack.
  • the denial of service attack mitigation device 41 has the same or similar functions as the denial of service attack mitigation device 21 , 31 .
  • the system 4 for mitigating denial of service attacks also includes a slice management system 42 .
  • the slice management system 42 is configured to receive a slice creation request from the denial of service attack mitigation device 41, and to create a target network slice according to the slice creation request.
  • the slice creation request includes parameter information for creating the target network slice.
  • the system 4 for mitigating denial of service attacks also includes a traffic forwarding system 43 .
  • the traffic forwarding system 43 is configured to receive the first traffic forwarding policy from the device 41 for mitigating denial of service attacks, and to perform traffic forwarding according to the first traffic forwarding policy.
  • the first traffic forwarding strategy is to forward the service traffic or abnormal traffic related to a denial of service attack, which is sent to each attacked slice resource, to the target slice resource in the target network slice.
  • the traffic forwarding system 43 includes an SDN (Software Defined Network, software defined network) control platform and specific network devices.
  • the SDN control platform generates a traffic forwarding instruction according to the first traffic forwarding policy, and issues the traffic forwarding instruction to a specific network device.
  • a specific network device performs traffic forwarding according to the traffic forwarding instruction.
  • FIG. 5 is a block diagram illustrating a computer system for implementing some embodiments of the present disclosure.
  • Computer system 50 may take the form of a general-purpose computing device.
  • Computer system 50 includes memory 510, a processor 520, and a bus 500 that connects various system components.
  • the memory 510 may include, for example, system memory, non-volatile storage media, and the like.
  • the system memory stores, for example, an operating system, an application program, a boot loader (Boot Loader), and other programs.
  • System memory may include volatile storage media such as random access memory (RAM) and/or cache memory.
  • the non-volatile storage medium stores, for example, instructions for performing corresponding embodiments of at least one of the methods of mitigating a denial of service attack.
  • Non-volatile storage media include, but are not limited to, magnetic disk memory, optical memory, flash memory, and the like.
  • Processor 520 may be implemented as a general purpose processor, digital signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete hardware components such as discrete gates or transistors.
  • each module such as the judging module and the determining module can be implemented by a central processing unit (CPU) running instructions in a memory for executing the corresponding steps, or can be implemented by a dedicated circuit for executing the corresponding steps.
  • CPU central processing unit
  • bus 500 may use any of a variety of bus structures.
  • bus structures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus.
  • ISA Industry Standard Architecture
  • MCA Micro Channel Architecture
  • PCI Peripheral Component Interconnect
  • the computer system 50 may also include an input-output interface 530, a network interface 540, a storage interface 550, and the like.
  • the interfaces 530 , 540 , 550 and the memory 510 and the processor 520 can be connected through the bus 500 .
  • the input and output interface 530 may provide a connection interface for input and output devices such as a monitor, a mouse, and a keyboard.
  • Network interface 540 provides a connection interface for various networked devices.
  • the storage interface 550 provides a connection interface for external storage devices such as a floppy disk, a U disk, and an SD card.
  • These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer or other programmable device to produce a machine such that execution of the instructions by the processor produces one or more blocks in the flowchart and/or block diagrams the device with the specified function.
  • Also stored in computer readable memory are these computer readable program instructions, which cause the computer to operate in a particular manner resulting in an article of manufacture including implementing the functions specified in one or more blocks of the flowchart and/or block diagrams instruction.
  • the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects.
  • the method, device and system, and computer storable medium for mitigating denial of service attacks in the above embodiments can prevent attackers from perceiving their attack conditions, reduce the impact of denial-of-service attacks on normal business operations, and improve protection effects.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本公开涉及缓解拒绝服务攻击的方法、装置及系统、计算机可存储介质，涉及网络安全技术领域。缓解拒绝服务攻击的方法包括：获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息；对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息；对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片，所述目标网络切片包括支持所述每个受攻击切片资源所支持的业务功能的目标切片资源；对于每个受攻击切片资源，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。

Description

缓解拒绝服务攻击的方法、装置及系统
相关申请的交叉引用
本申请是以CN申请号为202110333711.0，申请日为2021年3月29日的申请为基础，并主张其优先权，该CN申请的公开内容在此作为整体引入本申请中。
技术领域
本公开涉及网络安全技术领域，特别涉及缓解拒绝服务攻击的方法、装置及系统、计算机可存储介质。
背景技术
网络切片是由一组网络功能和对应的资源构成的完整的实例化的逻辑网络。网络切片能够根据不同的服务需求提供隔离、可定制功能的网络服务，灵活应对差异化的应用场景。
近年来，拒绝服务攻击(包括分布式拒绝服务攻击)的强度和复杂程度不断攀升，在共享硬件资源和网络资源的多网络切片场景下，针对某一网络切片的拒绝服务攻击不但会严重影响本网络切片承载的业务，也可能会破坏其他网络切片上托管的服务。
相关技术中，对于与拒绝服务攻击相关的异常流量进行流量清洗或者扩容被攻击网络资源或者服务资源。
发明内容
根据本公开的第一方面，提供了一种缓解拒绝服务攻击的方法，包括：获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息；对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息；对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片，所述目标网络切片包括支持所述每个受攻击切片资源所支持的业务功能的目标切片资源；对于每个受攻击切片资源，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
在一些实施例中，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源包括：生成并发送第一流量转发策略到流量转发系统，以便所述流量转发系统根据所述第一流量转发策略进行流量转发，所述第一流量转发策略为将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
在一些实施例中，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源还包括：根据与每个受攻击切片资源对应的攻击信息，确定针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型，不同的攻击类型对应不同的第一流量转发策略。
在一些实施例中，所述攻击类型包括单一型和多向量复杂型，在所确定的针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型为单一型的情况下，所述第一流量转发策略为将发送到每个受攻击切片资源的与拒绝服务攻击相关的异常流量转发到所述目标网络切片中的目标切片资源；在所确定的针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型为多向量复杂型的情况下，所述第一流量转发策略为将发送到每个受攻击切片资源的业务流量转发到所述目标网络切片中的目标切片资源。
在一些实施例中，确定针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型包括：对于每个受攻击切片资源，根据对应的攻击信息，确定对应的拒绝服务攻击的攻击手段信息、攻击策略信息和攻击目标信息中的至少一种；根据所确定的拒绝服务攻击的攻击手段信息、攻击策略信息和攻击目标信息中的至少一种，确定针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型。
在一些实施例中，攻击手段信息包括攻击手段的数量，攻击策略信息包括攻击频率、攻击时间间隔和攻击来源的种类数中的至少一种，攻击目标信息包括攻击目标的数量。
在一些实施例中，缓解拒绝服务攻击的方法，还包括：将发送到所述每个受攻击切片资源的、与拒绝服务攻击相关的异常流量转发到所述目标网络切片中的目标切片资源后，监测与所述目标切片资源的拒绝服务攻击的攻击信息是否满足预设条件；在监测到与所述目标切片资源的拒绝服务攻击的攻击信息满足预设条件的情况下，终止所述目标网络切片。
在一些实施例中，缓解拒绝服务攻击的方法，还包括：将发送到所述每个受攻击切片资源的业务流量转发到所述目标网络切片中的目标切片资源后，监测所述每个受攻击切片资源的拒绝服务攻击的攻击信息是否满足预设条件；在监测到所述每个受攻击切片资源的拒绝服务攻击的攻击信息满足预设条件的情况下，将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源；在将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源后，终止所述目标网络切片。响应于接收来自所述流量转发系统的提示消息，生成并发送切片终止请求到所述切片管理系统，以便所述切片管理系统根据所述切片终止请求终止所述目标网络切片，所述提示消息表征所述流量转发系统已完成根据所述第二流量转发策略进行流量转发的操作，所述切片终止请求包括所述目标网络切片的标识。
在一些实施例中，将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源包括：生成并发送第二流量转发策略到流量转发系统，以便所述流量转发系统根据所述第二流量转发策略进行流量转发，所述第二流量转发策略为将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源。
在一些实施例中，终止所述目标网络切片包括：生成并发送切片终止请求到切片管理系统，以便所述切片管理系统根据所述切片终止请求终止所述目标网络切片，所述切片终止请求包括所述目标网络切片的标识。
在一些实施例中，获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息包括：利用部署在所述业务网络系统中的探针和安全防护系统，获取所述业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息，所述探针部署在所述业务网络系统的指定位置，所述指定位置位于所述安全防护系统的防护范围之外。
在一些实施例中，利用部署在所述业务网络系统中的探针和安全防护系统，获取所述业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息包括：利用所述探针和所述安全防护系统，采集针对所述业务网络系统中切片资源的异常流量信息和异常服务状态信息中的至少一种；根据所采集的异常流量信息和异常服务状态信息中的至少一种，对相应的异常流量进行拒绝服务攻击检测；在检测到相应的异常流量属于拒绝服务攻击的情况下，确定所述切片资源为受攻击切片资源，并从发送 到与所述切片资源的异常流量对应的异常流量信息中，获取针对所述切片资源的拒绝服务攻击的攻击信息。
在一些实施例中，所述切片创建请求还包括所述每个受攻击切片资源所属的网络切片的业务需求。
在一些实施例中，创建目标网络切片包括：生成并发送切片创建请求到切片管理系统，以便所述切片管理系统根据所述切片创建请求创建所述目标网络切片，所述切片创建请求包括所确定的参数信息。
在一些实施例中，所述参数信息包括所述每个受攻击切片资源的资源标识以及所述每个受攻击切片资源所属的网络切片的切片标识。
根据本公开第二方面，提供了一种缓解拒绝服务攻击的装置，包括：获取模块，被配置为获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息；确定模块，被配置为对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息；创建模块，被配置为对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片，所述目标网络切片包括支持所述每个受攻击切片资源所支持的业务功能的目标切片资源；转发模块，被配置为对于每个受攻击切片资源，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
根据本公开第三方面，提供了一种缓解拒绝服务攻击的装置，包括：存储器；以及耦接至所述存储器的处理器，所述处理器被配置为基于存储在所述存储器的指令，执行上述任一实施例所述的一种缓解拒绝服务攻击的方法。
根据本公开的第四方面，提供了一种缓解拒绝服务攻击的系统，包括上述任一实施例所述的缓解拒绝服务攻击的装置。
在一些实施例中，缓解拒绝服务攻击的系统，还包括：切片管理系统，被配置为接收来自所述缓解拒绝服务攻击的装置的切片创建请求，并根据所述切片创建请求创建所述目标网络切片，所述切片创建请求包括用于创建目标网络切片的参数信息；和流量转发系统，被配置为接收来自所述缓解拒绝服务攻击的装置的第一流量转发策略，并根据所述第一流量转发策略进行流量转发，所述第一流量转发策略为将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
根据本公开的第五方面，提供了一种计算机可存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现上述任一实施例所述的缓解拒绝服务攻击的方法。
附图说明
构成说明书的一部分的附图描述了本公开的实施例，并且连同说明书一起用于解释本公开的原理。
参照附图，根据下面的详细描述，可以更加清楚地理解本公开，其中：
图1是示出根据本公开一些实施例的缓解拒绝服务攻击的方法的流程图；
图2是示出根据本公开一些实施例的缓解拒绝服务攻击的装置的框图；
图3是示出根据本公开另一些实施例的缓解拒绝服务攻击的装置的框图；
图4是示出根据本公开一些实施例的缓解拒绝服务攻击的系统的框图；
图5是示出用于实现本公开一些实施例的计算机系统的框图。
具体实施方式
现在将参照附图来详细描述本公开的各种示例性实施例。应注意到：除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对布置、数字表达式和数值不限制本公开的范围。
同时，应当明白，为了便于描述，附图中所示出的各个部分的尺寸并不是按照实际的比例关系绘制的。
以下对至少一个示例性实施例的描述实际上仅仅是说明性的，决不作为对本公开及其应用或使用的任何限制。
对于相关领域普通技术人员已知的技术、方法和设备可能不作详细讨论，但在适当情况下，所述技术、方法和设备应当被视为说明书的一部分。
在这里示出和讨论的所有示例中，任何具体值应被解释为仅仅是示例性的，而不是作为限制。因此，示例性实施例的其它示例可以具有不同的值。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步讨论。
相关技术中，采用流量清洗的方式进行防护，易被攻击者感知，容易导致攻击者发起更严重的拒绝服务攻击，防护效果欠佳。采用扩容的方式进行防护，未有效隔离 与拒绝服务攻击相关的异常流量和业务流量，仍然会对正常业务的运行造成一定的影响，防护效果欠佳。
针对上述技术问题，本公开提出了一种缓解拒绝服务攻击的方法，可以使攻击者无法感知其攻击情况，并降低拒绝服务攻击对正常业务的运行造成的影响，提高防护效果。
图1是示出根据本公开一些实施例的缓解拒绝服务攻击的方法的流程图。
如图1所示，缓解拒绝服务攻击的方法包括步骤S110-步骤S140。
在步骤S110中，获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息。
在一些实施例中，可以利用部署在业务网络系统中的探针和安全防护系统，获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息。探针部署在业务网络系统的指定位置。指定位置位于安全防护系统的防护范围之外。通过探针和安全防护系统配合部署在业务网络系统的不同防护范围内，可以提高安全防护范围和部署资源的利用率，进一步提高防护效果。例如，探针和安全防护系统的防护范围也可以存在交叠。
例如，可以通过如下的方式实现利用部署在业务网络系统中的探针和安全防护系统，获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息。
首先，利用探针和安全防护系统，采集针对业务网络系统中切片资源的异常流量信息和异常服务状态信息中的至少一种。在一些实施例中，异常流量信息包括输入接口、输出接口、源IP(Internet Protocol，网际互连协议)地址、目的IP地址、源端口号、目的端口号、通信协议信息、网络数据包类型、网络流的起止时间、起止时间区间内的数据包数量(或者单位时间区间内的数据包数量)等。在一些实施例中，异常服务状态信息包括CPU(Central Processing Unit，中央处理器)利用率、TCP(Transmission Control Protocol，传输控制协议)或UDP(User Datagram Protocol，用户数据包协议)的网络连接数量、特定端口状态的连接数量等。
然后，根据所采集的异常流量信息和异常服务状态信息中的至少一种，对与所采集的异常流量信息和异常服务状态信息中的至少一种相应的异常流量进行拒绝服务攻击检测。
在一些实施例中，可以根据与拒绝服务攻击相关的流量信息或服务状态信息的特征向量，对相应的异常流量进行拒绝服务攻击检测。例如，一些特定的源IP地址、网络数据包属于拒绝服务攻击，则可以预先将其转换作为特征向量，存储在特征向量库中。通过将异常流量信息中的源IP地址和/或网络数据包类型转换为特征向量，进而与特征向量库中的特征向量进行匹配操作，以判断异常流量是否属于拒绝服务攻击。
在另一些实施例中，还可以利用预设阈值，对相应的异常流量进行拒绝服务攻击检测。例如，在CPU利用率超过预设CPU利用率阈值的情况下，异常流量属于拒绝服务攻击。又例如，在TCP或UDP的网络连接数量超过预设网络连接数量阈值的情况下，异常流量属于拒绝服务攻击。又例如，在特定类型的网络数据包超过预设阈值的情况下，异常流量属于拒绝服务攻击。
最后，在检测到发送到切片资源的异常流量属于拒绝服务攻击的情况下，确定切片资源为受攻击切片资源，并从发送到与切片资源的异常流量对应的异常流量信息中，获取针对切片资源的拒绝服务攻击的攻击信息。例如，攻击信息包括输入接口、输出接口、源IP地址、目的IP地址、源端口号、目的端口号、通信协议信息、网络数据包类型、网络流的起止时间、起止时间区间内的数据包数量(或者单位时间区间内的数据包数量)等。
在另一些实施例中，也可以利用单独部署在业务网络系统中的探针或者安全防护系统，获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息。
前述实施例中的探针可以是软件，也可以是硬件。安全防护系统可以包括防火墙系统、入侵检测或者防护系统等。
在步骤S120中，对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息。在一些实施例中，参数信息包括每个受攻击切片资源的资源标识以及每个受攻击切片资源所属的网络切片的切片标识。
例如，可以根据攻击信息中的输入接口、输出接口、源IP地址、目的IP地址、源端口号、目的端口号中的至少一个，从切片管理系统中查找每个受攻击切片资源的资源标识以及每个受攻击切片资源所属的网络切片的切片标识。
在步骤S130中，对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片。目标网络切片包括支持每个受攻击切片资源所支持的业务功能的目标切片资源。
在一些实施例中，可以利用切片管理系统创建目标网络切片。例如，生成并发送切片创建请求到切片管理系统，以便切片管理系统根据切片创建请求创建目标网络切片。切片创建请求包括所确定的参数信息。
例如，切片管理系统根据切片创建请求中的切片标识和资源标识，从切片管理系统中获取受攻击切片资源的相关参数信息。参数信息包括受攻击切片资源所属的网络切片的服务等级、所属网络切片的切片属性(专属切片或共享切片)、所属网络切片的用户信息、所属网络切片的网络信息(例如子网信息)等。切片管理系统在获取到与受攻击切片资源的相关参数信息后，根据受攻击切片资源的相关参数信息，创建目标网络切片。
在一些实施例中，切片创建请求还包括每个受攻击切片资源所属的网络切片的业务需求。依据利用攻击信息确定的参数信息和业务需求，创建目标网络切片，可以更加精准地创建与受攻击切片资源所属网络切片相近的目标网络切片，进一步提高防护效果，降低防护成本。
例如，切片管理系统根据切片创建请求中的切片标识和资源标识，从切片管理系统中获取受攻击切片资源的相关参数信息和业务需求。参数信息包括受攻击切片资源所属的网络切片的服务等级、所属网络切片的切片属性(专属切片或共享切片)、所属网络切片的用户信息、所属网络切片的网络信息(例如子网信息)等。切片管理系统在获取到与受攻击切片资源的相关参数信息和业务需求后，根据受攻击切片资源的相关参数信息，创建目标网络切片。例如，切片管理系统根据相关参数信息，生成目标网络切片的SLA(Service Level Agreement，服务等级协议)需求以及资源配置信息，并基于SLA需求以及资源配置信息，创建目标网络切片。
在步骤S140中，对于每个受攻击切片资源，将发送到每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到目标网络切片中的目标切片资源。
在一些实施例中，可以利用流量转发系统将发送到每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到目标网络切片中的目标切片资源。 例如，生成并发送第一流量转发策略到流量转发系统，以便流量转发系统根据第一流量转发策略进行流量转发。第一流量转发策略为将发送到每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到目标网络切片中的目标切片资源。
在一些实施例中，可以根据与每个受攻击切片资源对应的攻击信息，确定针对每个受攻击切片资源的拒绝服务攻击的攻击类型。不同的攻击类型对应不同的第一流量转发策略。即，根据不同的攻击类型，生成不同的第一流量转发策略。通过根据不同攻击类型来选择转发与拒绝服务攻击相关的异常流量或业务流量，可以平衡维持正常业务的运转和处理与拒绝服务攻击相关的异常流量之间的投入与成效，尽可能降低防护成本，进一步提高防护效果。
例如，攻击类型包括单一型和多向量复杂型。单一型的拒绝服务攻击的攻击手段、攻击策略或者攻击目标相对比较单一。多向量复杂型的拒绝服务攻击的攻击手段、攻击策略或者攻击目标相对比较复杂，甚至存在不同攻击手段、攻击策略或攻击目标的组合情况。单一型对应的目标网络切片可以命名为伪切片，多向量复杂型对应的目标网络切片可以命名为替代切片。
在所确定的针对每个受攻击切片资源的拒绝服务攻击的攻击类型为单一型的情况下，第一流量转发策略为将发送到每个受攻击切片资源的与拒绝服务攻击相关的异常流量转发到目标网络切片中的目标切片资源。
在所确定的针对每个受攻击切片资源的拒绝服务攻击的攻击类型为多向量复杂型的情况下，第一流量转发策略为将发送到每个受攻击切片资源的业务流量转发到目标网络切片中的目标切片资源。
在一些实施例中，可以通过如下的方式确定针对每个受攻击切片资源的拒绝服务攻击的攻击类型。
首先，对于每个受攻击切片资源，根据对应的攻击信息，确定对应的拒绝服务攻击的攻击手段信息、攻击策略信息和攻击目标信息中的至少一种。
然后，根据所确定的拒绝服务攻击的攻击手段信息、攻击策略信息和攻击目标信息中的至少一种，确定针对每个受攻击切片资源的拒绝服务攻击的攻击类型。例如，攻击手段信息包括攻击手段的数量。攻击策略信息包括攻击频率、攻击时间间隔和攻击来源的种类数中的至少一种。攻击目标信息包括攻击目标的数量。
例如，在攻击手段信息、攻击策略信息和攻击目标信息中的至少一种符合第一预设条件的情况下，确定攻击类型为单一型。在攻击手段信息、攻击策略信息和攻击目标信息中的至少一种符合第二预设条件的情况下，确定攻击类型为多向量复杂型。
例如，第一预设条件包括攻击手段的数量小于手段数量阈值(例如3)、攻击目标的数量小于目标数量阈值(例如3)、攻击频率小于频率阈值、攻击时间间隔小于时间阈值、攻击来源的种类小于种类阈值。第二预设条件包括攻击手段的数量大于或等于手段数量阈值(例如3)、攻击目标的数量大于或等于目标数量阈值(例如3)、攻击频率大于或等于频率阈值、攻击时间间隔大于或等于时间阈值、攻击来源的种类大于或等于种类阈值。
以针对每个受攻击切片资源的拒绝服务攻击的攻击类型为单一型为例，将发送到每个受攻击切片资源的、与拒绝服务攻击相关的异常流量转发到目标网络切片中的目标切片资源后，监测与目标切片资源的拒绝服务攻击的攻击信息是否满足预设条件。在监测到与目标切片资源的拒绝服务攻击的攻击信息满足预设条件的情况下，终止目标网络切片。与目标切片资源的拒绝服务攻击的攻击信息满足预设条件表征拒绝服务攻击的攻击强度减弱或者攻击结束。通过在拒绝服务攻击的攻击强度减弱或者攻击结束的情况下，终止目标网络切片，可以及时释放被占用的资源，提高业务网络系统中的资源利用率。
以针对每个受攻击切片资源的拒绝服务攻击的攻击类型为多向量复杂型为例，将发送到所述每个受攻击切片资源的业务流量转发到目标网络切片中的目标切片资源后，监测每个受攻击切片资源的拒绝服务攻击的攻击信息是否满足预设条件。
在监测到每个受攻击切片资源的拒绝服务攻击的攻击信息满足预设条件的情况下，将发送到目标切片资源的业务流量转发到每个受攻击切片资源。将发送到目标切片资源的业务流量转发到每个受攻击切片资源后，终止目标切片资源。通过在拒绝服务攻击的攻击强度减弱或者攻击结束的情况下，控制业务流量被发送到原受攻击切片资源，并终止目标网络切片，可以及时释放被占用的资源，提高业务网络系统中的资源利用率。
在一些实施例中，可以利用流量转发系统，将发送到目标切片资源的业务流量转发到每个受攻击切片资源。例如，生成并发送第二流量转发策略到流量转发系统，以 便流量转发系统根据第二流量转发策略进行流量转发。第二流量转发策略为将发送到目标切片资源的业务流量转发到每个受攻击切片资源。
在一些实施例中，可以通过如下的方式实现前述的终止目标网络切片的步骤。生成并发送切片终止请求到切片管理系统，以便切片管理系统根据切片终止请求终止目标网络切片。切片终止请求包括目标网络切片的标识。
在上述实施例中，通过针对受攻击切片资源，创建新的网络切片，并引导发送到受攻击切片资源的业务流量或者与拒绝服务攻击相关的异常流量，转发到新的网络切片中的新切片资源上，使得攻击者误以为其攻击仍然在影响正常业务的运转，从而使得攻击者无法感知其攻击情况。另外，本公开通过转发流量的方式隔离了业务流量和与拒绝服务攻击相关的异常流量，可以降低拒绝服务攻击对正常业务的运行造成的影响，提高防护效果。
图2是示出根据本公开一些实施例的缓解拒绝服务攻击的装置的框图。
如图2所示，缓解拒绝服务攻击的装置21包括获取模块211、确定模块212、创建模块213和转发模块214。
获取模块211被配置为获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息，例如执行如图1所示的步骤S110。
确定模块212被配置为对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息，例如执行如图1所示的步骤S120。
创建模块213被配置为对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片，例如执行如图1所示的步骤S130。目标网络切片包括支持每个受攻击切片资源所支持的业务功能的目标切片资源。
转发模块214被配置为对于每个受攻击切片资源，将发送到每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到目标网络切片中的目标切片资源，例如执行如图1所示的步骤S140。
图3是示出根据本公开另一些实施例的缓解拒绝服务攻击的装置的框图。
如图3所示，缓解拒绝服务攻击的装置31包括存储器311；以及耦接至该存储器311的处理器312。存储器311用于存储执行缓解拒绝服务攻击的方法对应实施例 的指令。处理器312被配置为基于存储在存储器311中的指令，执行本公开中任意一些实施例中的缓解拒绝服务攻击的方法。
图4是示出根据本公开一些实施例的缓解拒绝服务攻击的系统的框图。
如图4所示，缓解拒绝服务攻击的系统4包括缓解拒绝服务攻击的装置41。缓解拒绝服务攻击的装置41与缓解拒绝服务攻击的装置21、31的功能相同或类似。
在一些实施例中，缓解拒绝服务攻击的系统4还包括切片管理系统42。切片管理系统42被配置为接收来自缓解拒绝服务攻击的装置41的切片创建请求，并根据切片创建请求创建目标网络切片。切片创建请求包括用于创建目标网络切片的参数信息。
在一些实施例中，缓解拒绝服务攻击的系统4还包括流量转发系统43。流量转发系统43被配置为接收来自缓解拒绝服务攻击的装置41的第一流量转发策略，并根据第一流量转发策略进行流量转发。第一流量转发策略为将发送到每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到目标网络切片中的目标切片资源。
例如，流量转发系统43包括SDN(Software Defined Network，软件定义网络)控制平台和特定网络设备。SDN控制平台根据第一流量转发策略，生成流量转发指令，并将流量转发指令下发到特定网络设备。特定网络设备根据流量转发指令，进行流量转发。
图5是示出用于实现本公开一些实施例的计算机系统的框图。
如图5所示，计算机系统50可以通用计算设备的形式表现。计算机系统50包括存储器510、处理器520和连接不同系统组件的总线500。
存储器510例如可以包括系统存储器、非易失性存储介质等。系统存储器例如存储有操作系统、应用程序、引导装载程序(Boot Loader)以及其他程序等。系统存储器可以包括易失性存储介质，例如随机存取存储器(RAM)和/或高速缓存存储器。非易失性存储介质例如存储有执行缓解拒绝服务攻击的方法中的至少一种的对应实施例的指令。非易失性存储介质包括但不限于磁盘存储器、光学存储器、闪存等。
处理器520可以用通用处理器、数字信号处理器(DSP)、应用专用集成电路(ASIC)、现场可编程门阵列(FPGA)或其它可编程逻辑设备、分立门或晶体管等分立硬件组件方式来实现。相应地，诸如判断模块和确定模块的每个模块，可以通过中央处理器(CPU) 运行存储器中执行相应步骤的指令来实现，也可以通过执行相应步骤的专用电路来实现。
总线500可以使用多种总线结构中的任意总线结构。例如，总线结构包括但不限于工业标准体系结构(ISA)总线、微通道体系结构(MCA)总线、外围组件互连(PCI)总线。
计算机系统50还可以包括输入输出接口530、网络接口540、存储接口550等。这些接口530、540、550以及存储器510和处理器520之间可以通过总线500连接。输入输出接口530可以为显示器、鼠标、键盘等输入输出设备提供连接接口。网络接口540为各种联网设备提供连接接口。存储接口550为软盘、U盘、SD卡等外部存储设备提供连接接口。
这里，参照根据本公开实施例的方法、装置和计算机程序产品的流程图和/或框图描述了本公开的各个方面。应当理解，流程图和/或框图的每个框以及各框的组合，都可以由计算机可读程序指令实现。
这些计算机可读程序指令可提供到通用计算机、专用计算机或其他可编程装置的处理器，以产生一个机器，使得通过处理器执行指令产生实现在流程图和/或框图中一个或多个框中指定的功能的装置。
这些计算机可读程序指令也可存储在计算机可读存储器中，这些指令使得计算机以特定方式工作，从而产生一个制造品，包括实现在流程图和/或框图中一个或多个框中指定的功能的指令。
本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。
通过上述实施例中的缓解拒绝服务攻击的方法、装置及系统、计算机可存储介质，可以使攻击者无法感知其攻击情况，并降低拒绝服务攻击对正常业务的运行造成的影响，提高防护效果。

Claims (20)

  1. 一种缓解拒绝服务攻击的方法，包括：
    获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息；
    对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息；
    对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片，所述目标网络切片包括支持所述每个受攻击切片资源所支持的业务功能的目标切片资源；
    对于每个受攻击切片资源，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
  2. 根据权利要求1所述的缓解拒绝服务攻击的方法，其中，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源包括：
    生成并发送第一流量转发策略到流量转发系统，以便所述流量转发系统根据所述第一流量转发策略进行流量转发，所述第一流量转发策略为将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
  3. 根据权利要求2所述的缓解拒绝服务攻击的方法，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源还包括：
    根据与每个受攻击切片资源对应的攻击信息，确定针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型，不同的攻击类型对应不同的第一流量转发策略。
  4. 根据权利要求3所述的缓解拒绝服务攻击的方法，其中，所述攻击类型包括单一型和多向量复杂型，
    在所确定的针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型为单一型的情况下，所述第一流量转发策略为将发送到每个受攻击切片资源的与拒绝服务攻击相关的异常流量转发到所述目标网络切片中的目标切片资源；
    在所确定的针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型为多向量复杂型的情况下，所述第一流量转发策略为将发送到每个受攻击切片资源的业务流量转发到所述目标网络切片中的目标切片资源。
  5. 根据权利要求3所述的缓解拒绝服务攻击的方法，其中，确定针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型包括：
    对于每个受攻击切片资源，根据对应的攻击信息，确定对应的拒绝服务攻击的攻击手段信息、攻击策略信息和攻击目标信息中的至少一种；
    根据所确定的拒绝服务攻击的攻击手段信息、攻击策略信息和攻击目标信息中的至少一种，确定针对所述每个受攻击切片资源的拒绝服务攻击的攻击类型。
  6. 根据权利要求5所述的缓解拒绝服务攻击的方法，其中，攻击手段信息包括攻击手段的数量，攻击策略信息包括攻击频率、攻击时间间隔和攻击来源的种类数中的至少一种，攻击目标信息包括攻击目标的数量。
  7. 根据权利要求1所述的缓解拒绝服务攻击的方法，还包括：
    将发送到所述每个受攻击切片资源的、与拒绝服务攻击相关的异常流量转发到所述目标网络切片中的目标切片资源后，监测所述目标切片资源的拒绝服务攻击的攻击信息是否满足预设条件；
    在监测到所述目标切片资源的拒绝服务攻击的攻击信息满足预设条件的情况下，终止所述目标网络切片。
  8. 根据权利要求1所述的缓解拒绝服务攻击的方法，还包括：
    将发送到所述每个受攻击切片资源的业务流量转发到所述目标网络切片中的目标切片资源后，监测所述每个受攻击切片资源的拒绝服务攻击的攻击信息是否满足预设条件；
    在监测到所述每个受攻击切片资源的拒绝服务攻击的攻击信息满足预设条件的情况下，将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源；
    在将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源后，终止所述目标网络切片。
  9. 根据权利要求8所述的缓解拒绝服务攻击的方法，其中，将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源包括：
    生成并发送第二流量转发策略到流量转发系统，以便所述流量转发系统根据所述第二流量转发策略进行流量转发，所述第二流量转发策略为将发送到所述目标切片资源的业务流量转发到所述每个受攻击切片资源。
  10. 根据权利要求7至9任一项所述的缓解拒绝服务攻击的方法，其中，终止所述目标网络切片包括：
    生成并发送切片终止请求到切片管理系统，以便所述切片管理系统根据所述切片终止请求终止所述目标网络切片，所述切片终止请求包括所述目标网络切片的标识。
  11. 根据权利要求1所述的缓解拒绝服务攻击的方法，其中，获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息包括：
    利用部署在所述业务网络系统中的探针和安全防护系统，获取所述业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息，所述探针部署在所述业务网络系统的指定位置，所述指定位置位于所述安全防护系统的防护范围之外。
  12. 根据权利要求11所述的缓解拒绝服务攻击的方法，其中，利用部署在所述业务网络系统中的探针和安全防护系统，获取所述业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息包括：
    利用所述探针和所述安全防护系统，采集针对所述业务网络系统中切片资源的异常流量信息和异常服务状态信息中的至少一种；
    根据所采集的异常流量信息和异常服务状态信息中的至少一种，对相应的异常流量进行拒绝服务攻击检测；
    在检测到相应的异常流量属于拒绝服务攻击的情况下，确定所述切片资源为受攻击切片资源，并从发送到与所述切片资源的异常流量对应的异常流量信息中，获取针对所述切片资源的拒绝服务攻击的攻击信息。
  13. 根据权利要求1所述的缓解拒绝服务攻击的方法，其中，所述切片创建请求还包括所述每个受攻击切片资源所属的网络切片的业务需求。
  14. 根据权利要求1所述的缓解拒绝服务攻击的方法，其中，创建目标网络切片包括：
    生成并发送切片创建请求到切片管理系统，以便所述切片管理系统根据所述切片创建请求创建所述目标网络切片，所述切片创建请求包括所确定的参数信息。
  15. 根据权利要求1所述的缓解拒绝服务攻击的方法，其中，所述参数信息包括所述每个受攻击切片资源的资源标识以及所述每个受攻击切片资源所属的网络切片的切片标识。
  16. 一种缓解拒绝服务攻击的装置，包括：
    获取模块，被配置为获取业务网络系统中的针对至少一个受攻击切片资源的拒绝服务攻击的攻击信息；
    确定模块，被配置为对于每个受攻击切片资源，根据对应的攻击信息，确定用于创建目标网络切片的参数信息；
    创建模块，被配置为对于每个受攻击切片资源，根据所确定的参数信息，创建目标网络切片，所述目标网络切片包括支持所述每个受攻击切片资源所支持的业务功能的目标切片资源；
    转发模块，被配置为对于每个受攻击切片资源，将发送到所述每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
  17. 一种缓解拒绝服务攻击的装置，包括：
    存储器；以及
    耦接至所述存储器的处理器，所述处理器被配置为基于存储在所述存储器的指令，执行如权利要求1至15任一项所述的缓解拒绝服务攻击的方法。
  18. 一种缓解拒绝服务攻击的系统，包括：
    如权利要求16或17所述的缓解拒绝服务攻击的装置。
  19. 根据权利要求18所述的缓解拒绝服务攻击的系统，还包括：
    切片管理系统，被配置为接收来自所述缓解拒绝服务攻击的装置的切片创建请求，并根据所述切片创建请求创建所述目标网络切片，所述切片创建请求包括用于创建目标网络切片的参数信息；和
    流量转发系统，被配置为接收来自所述缓解拒绝服务攻击的装置的第一流量转发策略，并根据所述第一流量转发策略进行流量转发，所述第一流量转发策略为将发送到每个受攻击切片资源的、业务流量或者与拒绝服务攻击相关的异常流量，转发到所述目标网络切片中的目标切片资源。
  20. 一种计算机可存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现如权利要求1至15任一项所述的缓解拒绝服务攻击的方法。
    至此，已经详细描述了根据本公开的缓解拒绝服务攻击的方法、装置及系统、计算机可存储介质。为了避免遮蔽本公开的构思，没有描述本领域所公知的一些细节。本领域技术人员根据上面的描述，完全可以明白如何实施这里公开的技术方案。
PCT/CN2021/128678 2021-03-29 2021-11-04 缓解拒绝服务攻击的方法、装置及系统 WO2022205907A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110333711.0 2021-03-29
CN202110333711.0A CN115208594A (zh) 2021-03-29 2021-03-29 缓解拒绝服务攻击的方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2022205907A1 true WO2022205907A1 (zh) 2022-10-06

Family

ID=83457880

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/128678 WO2022205907A1 (zh) 2021-03-29 2021-11-04 缓解拒绝服务攻击的方法、装置及系统

Country Status (2)

Country Link
CN (1) CN115208594A (zh)
WO (1) WO2022205907A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9276955B1 (en) * 2014-09-17 2016-03-01 Fortinet, Inc. Hardware-logic based flow collector for distributed denial of service (DDoS) attack mitigation
CN107231384A (zh) * 2017-08-10 2017-10-03 北京科技大学 一种面向5g网络切片的DDoS攻击检测防御方法及系统
US20170353490A1 (en) * 2016-06-03 2017-12-07 Ciena Corporation Method and system of mitigating network attacks
CN108696541A (zh) * 2018-07-20 2018-10-23 国家电网公司 通信网络的安全处理方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9276955B1 (en) * 2014-09-17 2016-03-01 Fortinet, Inc. Hardware-logic based flow collector for distributed denial of service (DDoS) attack mitigation
US20170353490A1 (en) * 2016-06-03 2017-12-07 Ciena Corporation Method and system of mitigating network attacks
CN107231384A (zh) * 2017-08-10 2017-10-03 北京科技大学 一种面向5g网络切片的DDoS攻击检测防御方法及系统
CN108696541A (zh) * 2018-07-20 2018-10-23 国家电网公司 通信网络的安全处理方法和装置

Also Published As

Publication number Publication date
CN115208594A (zh) 2022-10-18

Similar Documents

Publication Publication Date Title
Kumar et al. SAFETY: Early detection and mitigation of TCP SYN flood utilizing entropy in SDN
WO2021008028A1 (zh) 网络攻击源定位及防护方法、电子设备及计算机存储介质
US9942251B1 (en) Malware detection based on traffic analysis
US9843593B2 (en) Detecting encrypted tunneling traffic
US20220239687A1 (en) Security Vulnerability Defense Method and Device
US8707440B2 (en) System and method for passively identifying encrypted and interactive network sessions
US10033745B2 (en) Method and system for virtual security isolation
US8347383B2 (en) Network monitoring apparatus, network monitoring method, and network monitoring program
CN113612784B (zh) 使用蜜罐的动态服务处理
EP2843904A2 (en) Identifying malicious devices within a computer network
JP6435695B2 (ja) コントローラ，及びその攻撃者検知方法
Alharbi et al. Smart and lightweight DDoS detection using NFV
CN105812318A (zh) 用于在网络中防止攻击的方法、控制器和系统
CN110620773B (zh) 一种tcp流量隔离方法、装置及相关组件
Al Sukkar et al. Address resolution protocol (ARP): Spoofing attack and proposed defense
WO2019096104A1 (zh) 攻击防范
WO2019140876A1 (zh) 一种防网络攻击的幻影设备建立的方法、介质及设备
Khosravifar et al. An experience improving intrusion detection systems false alarm ratio by using honeypot
Juba et al. Dynamic isolation of network devices using OpenFlow for keeping LAN secure from intra-LAN attack
WO2022205907A1 (zh) 缓解拒绝服务攻击的方法、装置及系统
Yaibuates et al. Starvation delayed dhcp service for enabling pool recovery
Gad et al. Hierarchical events for efficient distributed network analysis and surveillance
CN113328976A (zh) 一种安全威胁事件识别方法、装置及设备
Jingna An analysis on DoS attack and defense technology
CN113014530A (zh) Arp欺骗攻击防范方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21934543

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21934543

Country of ref document: EP

Kind code of ref document: A1