WO2024021495A1

WO2024021495A1 - Method and apparatus for identifying flooding attack in cloud platform, and device and storage medium

Info

Publication number: WO2024021495A1
Application number: PCT/CN2022/141869
Authority: WO
Inventors: 肖玮勇
Original assignee: 天翼云科技有限公司
Priority date: 2022-07-29
Filing date: 2022-12-26
Publication date: 2024-02-01
Also published as: CN115484047A

Abstract

The present application relates to the field of network security, and relates to a method and apparatus for identifying a flooding attack in a cloud platform, and a device and a storage medium. The method is executed by a controller arranged in a cloud platform. The method comprises: receiving parsing results of network messages sent by different virtual switches in a cloud platform; within the current statistical period, analyzing the parsing results of the network messages from the different virtual switches, so as to obtain a count value corresponding to the same parsing result; and when the count value exceeds a threshold value, determining that there is a flooding attack in the cloud platform. The parsing work of network messages and the determination work of a flooding attack are respectively allocated to virtual switches and a controller for execution; in addition, since the virtual switches are deployed in a cloud platform in a distributed manner, the number of network messages that need to be analyzed by each virtual switch is not large, such that the performance requirements for a device during the identification process of a flooding attack can be reduced.

Description

Identification methods, devices, equipment and storage media for flooding attacks in cloud platforms

Technical field

The present invention relates to the field of network security, and in particular to a method, device, equipment and storage medium for identifying flood attacks in a cloud platform.

Background technique

Transmission Control Protocol (TCP) Synchronize Sequence Numbers (SYN) flooding attack is a type of flooding attack that affects network security.

technical problem

In related technologies, a border firewall is set up at the network exit of the cloud platform, and the border firewall is used to uniformly identify whether network packets passing through the network exit are undergoing TCP SYN flooding attacks. At this time, if the traffic of network packets is too large, the performance pressure on the border firewall will be greater.

Technical solutions

This application provides a method, device, equipment and storage medium for identifying flood attacks in a cloud platform. The technical solution is as follows.

On the one hand, a method for identifying flood attacks in a cloud platform is provided. The method is executed by a controller provided in the cloud platform. The method includes:

Receive parsing results of network messages sent by different virtual switches in the cloud platform;

Within the current statistical period, analyze the parsing results of network messages from the different virtual switches to obtain a count value corresponding to the same parsing result;

When the count value exceeds the threshold, it is identified that there is a flooding attack in the cloud platform.

On the one hand, a method for identifying flood attacks in a cloud platform is provided. The method is executed by a virtual switch provided in the cloud platform. The method includes:

Collect network packets flowing through the virtual switch;

Parse the network message and obtain the parsing result of the network message;

Send the parsing results of the network messages to the controller in the cloud platform, so that the controller can analyze the parsing results of the network messages from different virtual switches within the current statistical period and obtain the corresponding Based on the count value of the same analysis result, and when the count value exceeds the threshold, it is identified that there is a flooding attack in the cloud platform.

In another aspect, a device for identifying flood attacks in a cloud platform is provided, and the device includes:

An analysis result receiving module, configured to receive analysis results of network messages sent by different virtual switches in the cloud platform;

A statistics module, configured to analyze the parsing results of network messages from the different virtual switches within the current statistical period, and obtain a count value corresponding to the same parsing result;

A flooding attack identification module is configured to identify a flooding attack in the cloud platform when the count value exceeds a threshold.

In a possible implementation, the parsing result includes the following fields:

Source IP;

Destination IP;

TCP port;

SYN equals 1.

In a possible implementation, the network message includes:

Network messages sent by user virtual machines in the cloud platform to other user virtual machines in the cloud platform are forwarded by the virtual switch;

or,

The user virtual machine in the cloud platform forwards the network packet to the physical machine in the cloud platform through the forwarding of the virtual switch;

or,

The network packets sent by the user virtual machine in the cloud platform to the Internet outside the cloud platform through the forwarding of the virtual switch;

Network messages sent by the physical machine in the cloud platform to the user virtual machine in the cloud platform are forwarded by the virtual machine switch;

or,

The Internet outside the cloud platform forwards network packets to user virtual machines in the cloud platform through the forwarding of the virtual machine switch.

A network packet collection module, used to collect network packets flowing through the virtual switch;

A parsing module, used to parse the network message and obtain the parsing result of the network message;

An analysis result sending module, configured to send the analysis result of the network message to the controller in the cloud platform, so that the controller can analyze network messages from different virtual switches within the current statistical period. The parsing results are analyzed to obtain a count value corresponding to the same parsing result, and when the count value exceeds the threshold, it is identified that there is a flooding attack in the cloud platform.

In a possible implementation, the parsing result includes the following fields:

Source IP;

Destination IP;

TCP port;

SYN equals 1.

In a possible implementation, the network message includes:

or,

In yet another aspect, a controller is provided. The controller includes a processor and a memory. The memory stores at least one instruction, at least a program, a code set or an instruction set. The at least one instruction, at least a section The program, code set or instruction set is loaded and executed by the processor to implement the above-mentioned identification method of flooding attacks in the cloud platform.

In another aspect, a virtual switch is provided. The virtual switch includes a processor and a memory. The memory stores at least one instruction, at least a program, a code set or an instruction set. The at least one instruction, at least a section The program, code set or instruction set is loaded and executed by the processor to implement the above-mentioned identification method of flooding attacks in the cloud platform.

In another aspect, a computer-readable storage medium is provided, in which at least one instruction is stored, and the at least one instruction is loaded and executed by a processor to implement the above-mentioned method for identifying flood attacks in a cloud platform. .

In yet another aspect, a computer program product or computer program is provided that includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above-mentioned method for identifying flood attacks in the cloud platform.

beneficial effects

Using the virtual switch in the cloud platform, the virtual switch parses the network packets flowing through it, and reports the parsing results of the network packets to the controller in the cloud platform. The controller calculates the counts based on the same parsing results. value to determine whether there is a flooding attack in the current cloud platform. On the one hand, the analysis of network packets and the judgment of flood attacks are assigned to virtual switches and controllers respectively. On the other hand, since virtual switches are deployed in a distributed manner in the cloud platform, each virtual switch needs The number of network packets analyzed is not large, therefore, the performance requirements for the device during the identification process of flooding attacks are greatly reduced.

Description of drawings

In order to more clearly explain the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description The drawings illustrate some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a schematic architectural diagram of a cloud platform according to an exemplary embodiment.

Figure 2 is a method flow chart of a method for identifying flooding attacks in a cloud platform according to an exemplary embodiment.

Figure 3 is a structural block diagram of an apparatus for identifying flood attacks in a cloud platform according to an exemplary embodiment.

Figure 4 is a structural block diagram of a device for identifying flood attacks in a cloud platform according to an exemplary embodiment.

Figure 5 is a schematic diagram of a controller provided according to an exemplary embodiment of the present application.

Figure 6 is a schematic diagram of a virtual machine switch provided according to an exemplary embodiment of the present application.

Embodiments of the invention

The technical solution of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

It should be understood that the "instruction" mentioned in the embodiments of this application may be a direct instruction, an indirect instruction, or an association relationship. For example, A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association between A and B. relation.

In the description of the embodiments of this application, the term "correspondence" can mean that there is a direct correspondence or indirect correspondence between the two, it can also mean that there is an associated relationship between the two, or it can mean indicating and being instructed, configuration and being. Configuration and other relationships.

In the embodiment of this application, "predefinition" can be achieved by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in devices (for example, including terminal equipment and network equipment). This application is specific to its The implementation method is not limited.

Before describing each embodiment shown in this application, the concepts involved in this application are first introduced.

TCP SYN flood attack : It is an attack that takes advantage of the three-way handshake characteristics of the TCP protocol.

It occurs on the fourth layer of the Open System Interconnection (OSI). This attack uses the characteristics of the three-way handshake of the TCP protocol. The attacker sends TCP SYN to make a TCP connection. SYN is the first packet in the TCP three-way handshake. , when the server returns ACK and the attacker does not reconfirm it, then the TCP connection is in a suspended state, which is the so-called semi-connected state. If the server cannot receive the re-confirmation, it will repeatedly send ACK to the attacker, which will further waste the server's resources.

The attacker sends a very large number of such TCP connections to the server. Since each TCP connection cannot complete the three-way handshake, on the server, these TCP connections will consume the central processing unit (Central Processing) because they are in a suspended state. Unit, CPU) and memory, resulting in the server possibly crashing and being unable to provide services to normal users.

For TCP in cloud platform SYN flood attack, in related technology, a border firewall is set up at the network exit of the cloud platform, and the border firewall is used to uniformly identify whether network packets passing through the network exit are undergoing a TCP SYN flood attack. At this time, if the traffic of network packets is too large, the performance pressure on the border firewall will be greater.

In response to the above problems, embodiments of this application provide a flood attack identification method, which uses a virtual switch in the cloud platform to parse the network packets flowing through it and report the parsing results of the network packets. Provided to the controller in the cloud platform, the controller determines whether there is a flooding attack in the current cloud platform based on the count value obtained from the same analysis result. On the one hand, the analysis of network packets and the judgment of flood attacks are assigned to virtual switches and controllers respectively. On the other hand, since virtual switches are deployed in a distributed manner in the cloud platform, each virtual switch needs The number of network packets analyzed is not large, therefore, the performance requirements for the device during the identification process of flooding attacks are greatly reduced.

Below, the technical solutions provided by this application will be described with reference to the following examples.

Reference is made to Figure 1, which shows a schematic architectural diagram of the cloud platform. In the cloud platform, it includes: multiple virtual switches and a controller.

Among them, the virtual switch is distributed on each computing server in the cloud platform and is a virtual network element that connects user virtual machines under the computing server with the physical network.

Specifically, the virtual switch provides network forwarding capabilities for virtualization and is a bridge between user virtual machines and physical networks or between user virtual machines and user virtual machines. For example, user virtual machines communicate with the physical network through the virtual switch, and user virtual machines communicate with each other through the virtual switch. Communicate with other user virtual machines through virtual switches.

In the embodiment of this application, a traffic analysis module is embedded in the virtual switch. The traffic analysis module is mainly responsible for the following two functions: 1) parsing the collected network messages and generating parsing results; 2) converting the parsing results Report to the controller.

Among them, the controller is a device deployed centrally in the cloud platform and is used to analyze and judge TCP SYN flooding attacks.

In this embodiment of the present application, the virtual switch and the controller can communicate through the management network in the cloud platform. The virtual switches in the cloud platform regularly report the parsing results of network packets to the controller through the management network, so that the controller can analyze TCP SYN flood attacks based on the parsing results of network packets received from different virtual switches. and judgment.

Figure 2 is a method flow chart of a method for identifying flooding attacks in a cloud platform according to an exemplary embodiment. The method is performed by controllers and virtual switches in the cloud platform. As shown in Figure 2, the identification method of the flooding attack may include the following steps:

Step 210: The virtual switch collects network packets flowing through the virtual switch.

In the cloud platform, a virtual machine switch is connected to at least one user virtual machine, and the virtual switch is used to undertake the forwarding of network packets of these user virtual machines. Therefore, when user virtual machines send network packets or send network packets to these user virtual machines, the user packets will flow through the virtual switch, and the virtual machine switch will collect these network packets.

In one possible implementation, the virtual switch collects network packets sent by user virtual machines in the cloud platform to other user virtual machines in the cloud platform through forwarding by the virtual switch.

In one possible implementation, the virtual switch collects network packets sent by user virtual machines in the cloud platform to physical machines in the cloud platform through forwarding by the virtual switch.

In one possible implementation, the virtual switch collects network packets sent by user virtual machines in the cloud platform to the Internet outside the cloud platform through forwarding by the virtual switch.

In one possible implementation, the virtual switch collects network packets sent by physical machines in the cloud platform to user virtual machines in the cloud platform through forwarding by the virtual machine switch.

In one possible implementation, the virtual switch collects network packets sent from the Internet outside the cloud platform to user virtual machines in the cloud platform through forwarding by the virtual machine switch.

It should be understood that for the communication of network packets between user virtual machines in the cloud platform, or the communication between user virtual machines and physical machines in the cloud platform, since the traffic will not pass through the network exit, Therefore, based on the technical solution adopted in the related technology of using a border firewall to collect network packets flowing through the network egress, the above types of network packets will not be collected.

In the embodiment of this application, by using virtual switches to collect network messages, network messages sent by user virtual machines to other user virtual machines in the cloud platform, and between user virtual machines and physical machines in the cloud platform are The sent network messages can also be collected to ensure that subsequent flooding attacks in the cloud platform can also be identified, thereby providing security protection between user virtual machines in the same cloud platform.

Step 220: The virtual switch parses the network message and obtains the parsing result of the network message.

After collecting network messages, the virtual switch supports parsing the network messages to obtain the parsing results of the network messages.

In a possible implementation, the parsing result includes the following fields: source network address (Internet Protocol, IP), destination IP, TCP port, and SYN equal to 1. That is, when the virtual switch performs analysis, it uses the fields of source IP, destination IP, TCP port, and SYN equal to 1 to collect and collect information.

Step 230: The virtual switch sends the analysis result of the network packet to the controller in the cloud platform.

Correspondingly, the controller receives the parsing results of the network packets sent by the virtual switch. It should be understood that multiple virtual switches are generally deployed in a distributed manner in the cloud platform. Therefore, these virtual switches all send the analysis results of network packets to the controller in the cloud platform.

For example, when the virtual switch and the controller establish a connection through the management network, the virtual switch sends the analysis result of the network message to the controller in the cloud platform through the management network.

For example, the virtual switch corresponds to a reporting cycle, and the virtual switch regularly sends the analysis results of the network packets collected during the reporting cycle to the controller in the cloud platform.

Step 240: In the current statistical period, the controller analyzes the parsing results of network packets from different virtual switches and obtains a count value corresponding to the same parsing result.

The parsing results include the following fields: source IP, destination IP, TCP port, and SYN equal to 1. In the current statistical period, the controller will correspond to the same group of source IP, destination IP, TCP port, and SYN equal to 1. Network packets are counted to obtain a count value corresponding to the same parsing result.

Step 250: When the count value exceeds the threshold, the controller identifies that there is a flooding attack in the cloud platform.

After the controller obtains the count value corresponding to the same parsing result, the controller compares the count value with the threshold, and when the count value exceeds the threshold, it determines that there is a flooding attack in the cloud platform memory.

For example, the threshold is preset, or obtained by the controller through machine learning.

For example, after identifying that there is a flooding attack in the cloud platform memory, the controller can call the alarm interface to issue an alarm: there is a flooding attack in the current cloud platform memory.

To sum up, the flood attack identification method provided in this embodiment uses a virtual switch in the cloud platform. The virtual switch parses the network packets flowing through it, and reports the analysis results of the network packets to the cloud platform. The controller in , based on the count value obtained by counting the same parsing results, determines whether there is a flooding attack in the current cloud platform. On the one hand, the analysis of network packets and the judgment of flood attacks are assigned to virtual switches and controllers respectively. On the other hand, since virtual switches are deployed in a distributed manner in the cloud platform, each virtual switch needs The number of network packets analyzed is not large, therefore, the performance requirements for the device during the identification process of flooding attacks are greatly reduced.

In addition, virtual switches are used to collect distributed traffic within the cloud platform. When the traffic within the cloud platform is understood as horizontal traffic, this technical solution has high horizontal scalability.

In addition, the flood attack identification method provided by this embodiment uses virtual switches to collect network messages, so that user virtual machines can detect network messages sent by other user virtual machines in the cloud platform, and user virtual machines in the cloud platform. Network messages sent between the computer and the physical machine can also be collected to ensure that subsequent flooding attacks in the cloud platform can also be identified, thereby providing a link between user virtual machines and user virtual machines in the same cloud platform. room security.

It should be noted that the above method embodiments can be implemented individually or in combination, and this application is not limited thereto.

Figure 3 is a structural block diagram of an apparatus for identifying flood attacks in a cloud platform according to an exemplary embodiment. The device includes:

The analysis result receiving module 301 is used to receive the analysis results of network messages sent by different virtual switches in the cloud platform;

The statistics module 302 is configured to analyze the parsing results of network messages from the different virtual switches within the current statistical period, and obtain a count value corresponding to the same parsing result;

The flooding attack identification module 303 is configured to identify a flooding attack in the cloud platform when the count value exceeds a threshold.

In a possible implementation, the parsing result includes the following fields:

Source IP;

Destination IP;

TCP port;

SYN equals 1.

In a possible implementation, the network message includes:

or,

Figure 4 is a structural block diagram of a device for identifying flood attacks in a cloud platform according to an exemplary embodiment. The device includes:

The network packet collection module 401 is used to collect network packets flowing through the virtual switch;

The parsing module 402 is used to parse the network message and obtain the parsing result of the network message;

The analysis result sending module 403 is used to send the analysis result of the network message to the controller in the cloud platform, so that the controller can analyze the network messages from different virtual switches within the current statistical period. Analyze the parsing results to obtain a count value corresponding to the same parsing result, and identify a flooding attack in the cloud platform when the count value exceeds the threshold.

In a possible implementation, the parsing result includes the following fields:

Source IP;

Destination IP;

TCP port;

SYN equals 1.

In a possible implementation, the network message includes:

or,

It should be noted that the device for identifying flood attacks in the cloud platform provided by the above embodiments is only illustrated by taking the division of the above functional modules. In actual applications, the above functions can be allocated to different functional modules as needed. Completion means dividing the internal structure of the device into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be described again here.

Please refer to Figure 5, which is a schematic diagram of a controller provided according to an exemplary embodiment of the present application. The controller includes a memory and a processor. The memory is used to store a computer program. The computer program is When the processor is executed, the above-mentioned identification method of flooding attacks in the cloud platform is implemented.

The processor may be a central processing unit (Central Processing Unit, CPU). The processor can also be other general-purpose processors, Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other Chips such as programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of these types of chips.

As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions/modules corresponding to the methods in the embodiments of the present invention. The processor executes various functional applications and data processing of the processor by running non-transient software programs, instructions and modules stored in the memory, that is, implementing the method in the above method implementation.

The memory may include a program storage area and a data storage area, where the program storage area may store an operating system and an application program required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include high-speed random access memory and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory optionally includes memory located remotely from the processor, and these remote memories may be connected to the processor through a network. Examples of the above-mentioned networks include but are not limited to the Internet, intranets, local area networks, mobile communication networks and combinations thereof.

Please refer to Figure 6, which is a schematic diagram of a virtual switch provided according to an exemplary embodiment of the present application. The virtual switch includes a memory and a processor. The memory is used to store a computer program. The computer program is When the processor is executed, the above-mentioned identification method of flooding attacks in the cloud platform is implemented.

In an exemplary embodiment, a computer-readable storage medium is also provided for storing at least one computer program. The at least one computer program is loaded and executed by the processor to implement all or part of the steps in the above method. . For example, the computer-readable storage medium can be read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), read-only compact disc (Compact Disc Read-Only Memory, CD-ROM), Tapes, floppy disks and optical data storage devices, etc.

Other embodiments of the present application will be readily apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary technical means in the technical field that are not disclosed in this application. . It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It is to be understood that the present application is not limited to the precise structures described above and illustrated in the accompanying drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

A method for identifying flood attacks in a cloud platform, characterized in that the method is executed by a controller provided in the cloud platform, and the method includes:

Receive parsing results of network messages sent by different virtual switches in the cloud platform;

Within the current statistical period, analyze the parsing results of network messages from the different virtual switches to obtain a count value corresponding to the same parsing result;

When the count value exceeds the threshold, it is identified that there is a flooding attack in the cloud platform.
The method according to claim 1, characterized in that the parsing result includes the following fields:

Source network address IP;

Destination IP;

Transmission Control Protocol TCP port;

The synchronization sequence number SYN is equal to 1.
The method according to claim 1, characterized in that the network message includes:

Network messages sent by user virtual machines in the cloud platform to other user virtual machines in the cloud platform are forwarded by the virtual switch;

or,

The user virtual machine in the cloud platform forwards the network packet to the physical machine in the cloud platform through the forwarding of the virtual switch;

or,

The network packets sent by the user virtual machine in the cloud platform to the Internet outside the cloud platform through the forwarding of the virtual switch;

Network messages sent by the physical machine in the cloud platform to the user virtual machine in the cloud platform are forwarded by the virtual machine switch;

or,

The Internet outside the cloud platform forwards network packets to user virtual machines in the cloud platform through the forwarding of the virtual machine switch.
A method for identifying flooding attacks in a cloud platform, characterized in that the method is executed by a virtual switch provided in the cloud platform, and the method includes:

Collect network packets flowing through the virtual switch;

Parse the network message and obtain the parsing result of the network message;

Send the parsing results of the network messages to the controller in the cloud platform, so that the controller can analyze the parsing results of the network messages from different virtual switches within the current statistical period and obtain the corresponding Based on the count value of the same analysis result, and when the count value exceeds the threshold, it is identified that there is a flooding attack in the cloud platform.
The method according to claim 4, characterized in that the parsing result includes the following fields:

Source network address IP;

Destination IP;

Transmission Control Protocol TCP port;

The synchronization sequence number SYN is equal to 1.
The method according to claim 4, characterized in that the network message includes:

Network messages sent by user virtual machines in the cloud platform to other user virtual machines in the cloud platform are forwarded by the virtual switch;

or,

The user virtual machine in the cloud platform forwards the network packet to the physical machine in the cloud platform through the forwarding of the virtual switch;

or,

The network packets sent by the user virtual machine in the cloud platform to the Internet outside the cloud platform through the forwarding of the virtual switch;

Network messages sent by the physical machine in the cloud platform to the user virtual machine in the cloud platform are forwarded by the virtual machine switch;

or,

The Internet outside the cloud platform forwards network packets to user virtual machines in the cloud platform through the forwarding of the virtual machine switch.
A device for identifying flood attacks in a cloud platform, characterized in that the device includes:

An analysis result receiving module, configured to receive analysis results of network messages sent by different virtual switches in the cloud platform;

A statistics module, configured to analyze the parsing results of network messages from the different virtual switches within the current statistical period, and obtain a count value corresponding to the same parsing result;

A flooding attack identification module is configured to identify a flooding attack in the cloud platform when the count value exceeds a threshold.
A device for identifying flood attacks in a cloud platform, characterized in that the device includes:

A network packet collection module, used to collect network packets flowing through the virtual switch;

A parsing module, used to parse the network message and obtain the parsing result of the network message;

An analysis result sending module, configured to send the analysis result of the network message to the controller in the cloud platform, so that the controller can analyze network messages from different virtual switches within the current statistical period. The parsing results are analyzed to obtain a count value corresponding to the same parsing result, and when the count value exceeds the threshold, it is identified that there is a flooding attack in the cloud platform.
A controller, characterized in that the controller includes a processor and a memory, and the memory stores at least one instruction, at least a program, a code set or an instruction set, and the at least one instruction, at least a program, A code set or instruction set is loaded and executed by the processor to implement the method for identifying flooding attacks in a cloud platform as claimed in any one of claims 1 to 3.
A virtual switch, characterized in that the virtual switch includes a processor and a memory, and the memory stores at least one instruction, at least a program, a code set or an instruction set, and the at least one instruction, at least a program, A code set or instruction set is loaded and executed by the processor to implement the method for identifying flooding attacks in a cloud platform as claimed in any one of claims 4 to 6.