WO2017088700A1 - 预警决策的方法、节点及子*** - Google Patents

预警决策的方法、节点及子*** Download PDF

Info

Publication number
WO2017088700A1
WO2017088700A1 PCT/CN2016/106325 CN2016106325W WO2017088700A1 WO 2017088700 A1 WO2017088700 A1 WO 2017088700A1 CN 2016106325 W CN2016106325 W CN 2016106325W WO 2017088700 A1 WO2017088700 A1 WO 2017088700A1
Authority
WO
WIPO (PCT)
Prior art keywords
traffic
server
analysis result
weight
service request
Prior art date
Application number
PCT/CN2016/106325
Other languages
English (en)
French (fr)
Inventor
屠一凡
乔会来
贾炯
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to JP2018526929A priority Critical patent/JP6811776B2/ja
Priority to EP16867923.1A priority patent/EP3382973B1/en
Priority to KR1020187014569A priority patent/KR20180088392A/ko
Publication of WO2017088700A1 publication Critical patent/WO2017088700A1/zh
Priority to US15/990,474 priority patent/US11102240B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/141—Denial of service attacks against endpoints in a network

Definitions

  • the present invention relates to the field of distributed denial of service (DDoS) early warning technology, and in particular, to a method, a node and a subsystem for early warning decision making.
  • DDoS distributed denial of service
  • a DDoS attack occupies a large amount of network resources through a large number of legitimate service requests to achieve the purpose of the network.
  • DDoS attacks can be identified through traffic analysis. When DDoS attacks are identified, traffic cleaning is performed to remove attacks or abnormal service requests.
  • the request data for accessing the server in the equipment room reaches the equipment room network device (such as a router) through an Internet Service Provider (ISP) network device.
  • ISP Internet Service Provider
  • the service request from the ISP network device to the equipment room network device of the equipment room will reach the load balancing device in a mirrored manner, and then distributed to each distributed traffic analysis device through the load balancing device.
  • the traffic analysis device periodically performs traffic analysis on the service request distributed to the device, and specifically calculates the traffic component and the traffic size of the service request in each traffic analysis period according to the IP address. Then, the traffic analysis device sends the traffic analysis result to the decision device.
  • the decision device determines whether the traffic of the server in each equipment room is abnormal according to the summarized traffic analysis result.
  • the DDoS attack may occur.
  • the cleaning device is notified that the service request to the network device of the equipment room is towed, and then the device is returned to the network device of the equipment room after the cleaning process is completed. If the server does not have abnormal traffic, the processing is not performed.
  • the service request in the absence of a DDoS attack, is normally forwarded to the server in the equipment room through the equipment ingress network device.
  • the service request is forwarded to the network cleaning device through the traffic pull. After the traffic cleaning device processes the service request, the service request is returned to the network access device of the equipment room, and then forwarded. Give the server in the machine room.
  • the purpose of the present application is to provide a method, node and subsystem for early warning decision making to solve the problem of poor reliability and security of the existing DDoS early warning system.
  • a method for early warning decision is provided, which is respectively implemented in each distributed node that performs early warning decision, and the method includes the following steps: acquiring a traffic analysis result of a partial service request for the same server; Calculating the traffic indicated by the traffic analysis result and the weight of the distributed node, and calculating the traffic of all the service requests for the server, where the weight is that the traffic indicated by the traffic analysis result acquired by the distributed node accounts for all the servers.
  • the weight of the traffic requested by the service comparing the traffic of all service requests for the server with the abnormal traffic threshold; and according to the comparison result, determining whether to issue an indication for subsequent processing of the server.
  • a node for early warning decision is also provided, the node is a distributed node, and the node includes the following module: a traffic analysis result obtaining module, configured to obtain traffic analysis of a part of the service request for the same server.
  • the result is a complete traffic estimation module, configured to calculate, according to the traffic indicated by the traffic analysis result and the weight of the distributed node, the traffic of all the service requests for the server, where the weight is the traffic analysis obtained by the distributed node.
  • the result indicates that the traffic of the server accounts for the traffic of all the service requests of the server; the threshold comparison module is configured to compare the traffic of all the service requests for the server with the abnormal traffic threshold; and determine the control module, according to the comparison result. And determining whether an instruction to perform subsequent processing on the server is issued.
  • a system for early warning decision including:
  • the first load balancing device is configured to offload the service request to the multiple traffic analysis nodes
  • Each traffic analysis node receives the service request, and reports the traffic analysis result to the second load balancing device.
  • the second load balancing device offloads the traffic analysis result to the multiple early warning decision amount nodes.
  • the present application has the following advantages: there is only one decision device in the existing DDoS early warning system.
  • the decision device fails to work normally for some reason, for example, the decision device fails and cannot work normally, or Limited to the processing power of a single decision device, for example, when the amount of data that needs to be processed exceeds the processing power of the decision device, the decision device cannot work properly, and the network defense of the entire computer room will be invalid.
  • the technical solution provided by the embodiment adopts a distributed architecture to make early warning decisions. Even if the node that performs the early warning decision cannot work normally, the other normal working nodes can make early warning decisions, thereby effectively improving the reliability of the DDoS early warning system. And security.
  • each distributed node that performs the early warning decision has its own weight, which is the weight of the traffic indicated by the distributed node to obtain the traffic analysis result and the traffic of all the service requests for the server. Further, for each distributed node, according to the weight and the traffic indicated by the traffic analysis result of the partial service request for the same server, it is possible to estimate the traffic of all the service requests for the same server. Furthermore, the early warning decision is realized by comparing the estimated flow rate with the abnormal flow threshold.
  • a single distributed node can estimate the traffic of all service requests by combining its weights under the premise of obtaining the traffic of some service requests, thereby implementing early warning decision. It can be seen that each of the above distributed nodes can make early warning decisions. When distributed nodes that make early warning decisions cannot work normally, they can still work normally by other distributed nodes that make early warning decisions, improving the reliability of the DDoS early warning system. And security, and improve the processing power of the system.
  • FIG. 1 is a schematic diagram of a conventional DDoS early warning system
  • FIG. 2 is a flow chart of a method according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a DDoS early warning system according to another embodiment of the present application.
  • FIG. 5 is a schematic diagram of a node according to still another embodiment of the present application.
  • node or “load balancing device” as used in the context is a computing device, which refers to an intelligent electronic device that can perform predetermined processing such as numerical calculation and/or logical calculation by running a predetermined program or instruction. It may include a processor and a memory, the processor executing a pre-stored instruction stored in the memory to perform a predetermined process, or performing a predetermined process by hardware such as an ASIC, an FPGA, a DSP, or the like, or a combination of the two.
  • predetermined processing such as numerical calculation and/or logical calculation by running a predetermined program or instruction. It may include a processor and a memory, the processor executing a pre-stored instruction stored in the memory to perform a predetermined process, or performing a predetermined process by hardware such as an ASIC, an FPGA, a DSP, or the like, or a combination of the two.
  • FIG. 2 is a schematic flowchart diagram of a method for early warning decision according to an embodiment of the present application.
  • the method of the embodiment is mainly implemented by a computer device, and is particularly suitable for a DDoS early warning system.
  • the traffic analysis device analyzes the traffic composition and traffic size of each IP address according to the IP address in the service request (one IP address corresponds to one server).
  • the traffic analysis results of the traffic analysis device are distributed to the various distributed nodes that make the early warning decisions. Even if a person skilled in the art can think of introducing a distributed architecture for early warning decision in the DDoS early warning system, based on the characteristics of the DDoS attack, it is necessary to know the traffic of all the service requests for one server, and then the early warning decision can be made.
  • the technical solution provided by the embodiment of the present application calculates, by the distributed nodes that perform the early warning decision, all the service requests for the server according to the traffic and the weight indicated by the traffic analysis result of the partial service request obtained by the same server. Traffic, and then make early warning decisions. It can be seen that, in the technical solution provided by the embodiment of the present application, each distributed node can perform early warning decision according to the fragmented data. Furthermore, when distributed nodes with early warning decisions are not working properly, early warning decisions can still be made by other distributed distributed nodes, thereby improving the reliability and security of the DDoS early warning system. In addition, the total processing capability of the multiple distributed nodes is higher than the processing capability of the single decision device. Therefore, the technical solution provided by the embodiments of the present application also improves the processing capability of the system.
  • the method according to the present embodiment includes steps S110-S140.
  • step S110 a traffic analysis result of a partial service request for the same server is obtained.
  • step S110 the traffic analysis result of the partial service request for the same server in the current traffic analysis period is obtained.
  • step S120 based on the traffic indicated by the traffic analysis result and the weight of the distributed node, the traffic for all service requests of the server is calculated.
  • step S120 according to the traffic indicated by the traffic analysis result and the weight of the distributed node, the traffic of all service requests for the server in the current traffic analysis period is calculated.
  • the weight of the distributed node is the weight of the traffic indicated by the traffic analysis result obtained by the distributed node, and the traffic of all the service requests for the server. Specifically, the weight of the distributed node is the weight of the traffic indicated by the traffic analysis result acquired by the distributed node in the traffic analysis period, and the traffic of all the service requests for the server.
  • the traffic analysis result obtained by the distributed node is a traffic analysis result for a partial service request of the foregoing server.
  • step S130 the traffic for all service requests of the above server is compared with the abnormal traffic threshold.
  • step S130 the traffic of all service requests for the server in the current traffic analysis period is compared with an abnormal traffic threshold.
  • the abnormal traffic threshold is determined according to the actual situation, and the embodiment of the present application does not specifically The value is limited.
  • step S140 based on the comparison result, it is determined whether an instruction to perform subsequent processing for the server is issued.
  • the subsequent processing is not limited.
  • downstream processing such as traffic cleaning, traffic black holes, or traffic analysis can be performed.
  • the traffic analysis result of the partial service request for the same server is obtained in step S110, which is fragmented data.
  • step S120 the traffic of all the service requests for the server is calculated according to the traffic indicated by the traffic analysis result and the weight of the distributed node.
  • step S130 the estimated flow rate is compared with the abnormal flow rate threshold, and in step S140, it is determined whether an instruction to perform subsequent processing for the server is issued based on the comparison result.
  • each distributed node only obtains the traffic indicated by the traffic analysis result of the partial access traffic, that is, data fragmentation, and how according to the fragmented data. Making early warning decisions is not known to those skilled in the art without creative labor.
  • the step S140 may be specifically: when the comparison result meets the predetermined condition, determining to issue an instruction for performing subsequent processing on the server; otherwise, determining not to issue an instruction for performing subsequent processing on the server;
  • the condition is that the flow rate for comparison is greater than the abnormal flow rate threshold, or the predetermined condition is that the flow rate for comparison is not less than the abnormal flow rate threshold.
  • the predetermined condition is that the flow rate for comparison is greater than the abnormal flow rate threshold, or the predetermined condition is that the flow rate for comparison is not less than the abnormal flow rate threshold.
  • step S110 the traffic indicated by the traffic analysis result of the partial service request for the server is compared with the abnormal traffic threshold; if the comparison result meets the predetermined condition, the server is issued for the server.
  • step S120 is performed when the comparison result of the traffic indicated by the traffic analysis result of the partial service request of the server and the abnormal traffic threshold is not in compliance with the predetermined condition.
  • the abnormal traffic threshold is 10 MBps. If the traffic size indicated by the traffic analysis result for the service request of the same server in the current traffic analysis period is 20 MBps, it is determined that the traffic indicated by the traffic analysis result is greater than the abnormal traffic threshold. And sending an indication for the subsequent processing of the server; if the traffic size indicated by the traffic analysis result of the partial service request for the same server in the current traffic analysis period is 8 MBps, it is further required to calculate the current weight based on the weight of the distributed node. The traffic of all service requests for the server in the traffic analysis period, and then the estimated traffic is compared with the abnormal traffic threshold to determine whether an indication for subsequent processing of the server needs to be issued.
  • the method provided by the embodiment of the present application may be implemented in a traffic analysis device, or may be implemented by a separate device.
  • the load analysis device distributes the traffic analysis result obtained by the traffic analysis device to each distributed node that performs the early warning decision. Accordingly, in step S110, a partial service request for the same server is obtained from the load balancing device. Traffic analysis results.
  • each distributed traffic analysis device obtains a partial service request for the server from the load balancing device, performs traffic analysis on the part of the service request, and obtains traffic analysis for a part of the service request of the server. result.
  • the traffic analysis result obtained by the traffic analysis by the device is obtained.
  • the embodiment of the present application further adjusts the weight of the distributed node according to a predetermined weight adjustment period to ensure the accuracy of the estimation result.
  • each weight adjustment period determining a partial time period in a current weight adjustment period acquired by another distributed node that performs the early warning decision (eg, one weight adjustment period is 60 seconds, and each traffic analysis period is 1 second, Only the traffic indicated by the traffic analysis result for some service requests of the above server in the last two traffic analysis periods in each weight adjustment period, that is, the last 2 seconds); in each weight adjustment period, according to the entire distribution of the early warning decision Calculating the traffic indicated by the traffic analysis result of the partial service request of the server in the above part of the time period, and calculating the traffic of all the service requests for the server in the partial time period; in each weight adjustment period, according to at least The traffic indicated by the traffic analysis result of the partial service request for the server in the part of the time period obtained by the distributed node occupies the weight of the traffic request for all the service requests of the server in the part of the time period, and adjusts the distributed node in the next The weight of the weight adjustment period.
  • one weight adjustment period is 60 seconds, and each traffic analysis period is 1 second, Only the
  • the traffic analysis period is 1 second and the weight adjustment period is 60 seconds. Then, every 60 seconds, adjust the weight once.
  • the interaction with the other distributed nodes may be performed to determine the traffic indicated by the traffic analysis result for the partial service request of the server in the partial time period of the current weight adjustment period acquired by the other distributed nodes that perform the early warning decision;
  • the traffic balancing device may be interacted with to determine the traffic indicated by the traffic analysis result for the partial service request of the server during a partial time period within the current weight adjustment period acquired by the other distributed nodes that make the early warning decision.
  • the load balancing device may also be requested to obtain the weight of the distributed node according to a predetermined weight adjustment period.
  • the traffic analysis result indicates at least the traffic size.
  • the flow rate of each traffic component is specified.
  • the early warning decision may be made based on the composition of the traffic, or the early warning decision may be made only according to the traffic size.
  • step S120 specifically, according to the traffic size indicated by the traffic analysis result and the weight of the distributed node, the traffic size of all service requests for the server is calculated.
  • step S130 specifically, the traffic size of all the service requests for the server is compared with the abnormal traffic threshold. If the traffic indicated by the traffic analysis result of the partial service request for the server is compared with the abnormal traffic threshold, the traffic size of all the service requests for the server is compared with the abnormal traffic threshold.
  • the traffic analysis result of the partial service request for the server is specifically performed.
  • the flow rate corresponding to each of the indicated flow components is compared with the abnormal flow threshold corresponding to each flow component; correspondingly, in the above step S110, specifically, the traffic volume corresponding to the target flow component indicated by the flow analysis result
  • the weight of the distributed node corresponding to the target traffic component respectively calculating the traffic size of the target traffic component of all the service requests for the server; in the above step S130, specifically, the target of all the service requests for the server
  • the flow rate of the flow component is compared with the abnormal flow threshold corresponding to the target flow component, and the target flow component is a flow component that does not meet the reservation condition.
  • step S110 is specifically corresponding to each traffic component indicated by the traffic analysis result.
  • the traffic size and the weight of the distributed node corresponding to each traffic component respectively calculate the traffic size of each traffic component of all the service requests for the server; in step S130, specifically, all the service requests for the server are Composition of each flow
  • the flow rate of the components is compared with the abnormal flow threshold corresponding to each flow component.
  • the step of issuing an indication for subsequent processing of the server includes: for the flow component that the comparison result meets the predetermined condition, is issued for the The server performs an indication of subsequent processing of the traffic component.
  • the server in the room is used to process the service request of the e-commerce.
  • the request data of the server in the access room reaches the equipment entrance network device through the ISP network device, and the service request from the ISP network device to the equipment room entrance network device completely reaches the first load balancing device by means of mirroring, the first load
  • the equalization device distributes the service request to the distributed individual traffic analysis devices.
  • the service request carries the IP address and access time of the target server.
  • the traffic analysis device counts the traffic composition and the size of each traffic component for the same server per second according to the IP address and access time.
  • the traffic analysis device A analyzes the received service request, and the traffic with the access time of 18:10:20, and the IP address of the server B is 20MBps, which can be divided into 20MBps.
  • the three flow components are components a, b, and c.
  • the traffic volume component a corresponds to a traffic volume of 10 MBps
  • the traffic component b corresponds to a traffic volume of 8 MBps
  • the traffic component component component c corresponds to a traffic volume of 2 MBps.
  • Each traffic analysis device sends the traffic analysis result to the second load balancing device, and the second load balancing device distributes the received traffic analysis result to each distributed node that performs the early warning decision, and the traffic analysis result carries the traffic component and
  • the corresponding traffic size also carries the IP address and access time of the target server. For example, if the second load balancing device receives 100 analysis results for the same access time for the same IP address, and 50 distributed nodes for early warning decision, the 100 analysis results are equally divided into the 50 distributions. Node. It should be noted that when a distributed node fails to work normally, the second load balancing device no longer distributes the traffic analysis result to it, but divides the traffic analysis result into distributed distributed nodes.
  • the distributed node that makes the early warning decision performs the following operations:
  • Step S210 Acquire a traffic analysis result of a partial service request for the same server within one second.
  • the traffic analysis result carries the IP address of the server, the access time, and the traffic volume of each traffic component.
  • traffic component a 10 MBps
  • traffic component of traffic component b 8 MBps.
  • the traffic size is 2MBps.
  • step S220 the flow rate of each flow component is compared with the abnormal flow threshold corresponding to the flow component, and for the flow component that does not meet the predetermined condition, the step S230 is executed, and the flow composition that meets the predetermined condition is compared. In step, step S250 is performed.
  • the abnormal flow threshold corresponding to each flow component can be determined in advance.
  • the abnormal flow threshold corresponding to the flow component a is 8 MBps
  • the abnormal flow threshold corresponding to the flow component b is 20 MBps
  • the abnormal flow threshold corresponding to the flow component c is 2 MBps.
  • the other two flow components are not mentioned in the embodiment of the present application, and therefore will not be described.
  • Step S230 Estimating, according to the traffic size corresponding to the traffic component that does not meet the predetermined condition, and the weight of the corresponding distributed node, respectively, estimating that the comparison result of all the service requests for the server in the above 1 second does not meet the predetermined condition The size of the flow of the component.
  • the predetermined condition is that the traffic size is not less than the abnormal traffic threshold. Then, based on the traffic size of the traffic component b (8 MBps) and the weight of the distributed node corresponding to the traffic component b, the traffic volume of the traffic component b in the total service request for the server in the above 1 second is estimated ( 16MBps).
  • Step S240 Comparing the estimated flow rate with the abnormal flow threshold corresponding to the corresponding flow component, and not performing any processing for the flow component that does not meet the predetermined condition, and the flow component that meets the predetermined condition for the comparison result , step S250 is performed.
  • Step S250 Send an instruction for the flow rate cleaning of the flow component that matches the predetermined condition with respect to the server.
  • the cleaning device cleans the service request to the network equipment of the equipment entrance, filters out the service request of the traffic components a and c, and retains the service request of the traffic component b (normal e-commerce service request), The cleaned service request is returned to the equipment room network device.
  • the equipment room network device sends a service request to the corresponding server in the equipment room according to the IP address.
  • one second is taken as a flow analysis cycle as an example. It should be noted that in practical applications, the size of the traffic analysis period can be set according to actual needs.
  • the load balancing device divides the traffic analysis results into distributed nodes that work normally. It should be noted that, in practical applications, the load balancing device can be configured to distribute traffic analysis results according to different policies.
  • FIG. 5 is a node 5 of an early warning decision according to an embodiment of the present application.
  • the node 5 is a distributed node, and includes the following modules:
  • the traffic analysis result obtaining module 501 is configured to obtain a traffic analysis result of a partial service request for the same server.
  • the complete traffic estimation module 502 is configured to calculate traffic of all service requests for the server according to the traffic indicated by the traffic analysis result and the weight of the distributed node, where the weight is the traffic analysis result obtained by the distributed node.
  • the indicated traffic accounts for the weight of the traffic requested by the server for all services;
  • a threshold comparison module 503 configured to compare traffic of all service requests for the server with an abnormal traffic threshold
  • the determining control module 504 is configured to determine, according to the comparison result, whether to issue an instruction for performing subsequent processing on the server.
  • the threshold comparison module is further configured to:
  • the predetermined condition is that the compared traffic is greater than the abnormal traffic threshold, Or the predetermined condition is that the flow rate for comparison is not less than the abnormal flow rate threshold.
  • the threshold comparison module is further configured to:
  • the calculating, according to the traffic indicated by the traffic analysis result and the weight of the distributed node, calculating the traffic of all the service requests for the server is performed on the premise that the comparison result does not meet the predetermined condition.
  • the method further includes a weight adjustment module, configured to adjust a weight of the distributed node according to a predetermined weight adjustment period.
  • the weight adjustment module is specifically configured to:
  • each weight adjustment period determining, according to the traffic analysis result indicated by the traffic analysis result of the partial service request of the server in a part of the time period of the local weight adjustment period acquired by the other distributed nodes that perform the early warning decision;
  • the traffic indicated in the part of the time period is for the service The weight of the traffic requested by the server for all services, and adjusts the weight of the distributed node in the next weight adjustment period.
  • the traffic analysis result obtaining module is specifically configured to:
  • the node further includes a service request obtaining module, configured to:
  • the traffic result obtaining module is specifically configured to: perform traffic analysis on the part of the service request, and obtain a traffic analysis result for a part of the service request of the server.
  • the complete traffic estimation module is specifically configured to:
  • the threshold comparison module is specifically configured to: compare a traffic size indicated by a traffic analysis result of a partial service request for the server with the abnormal traffic threshold; and when the comparison result does not meet the predetermined condition, The traffic size of all service requests of the server is compared with the abnormal traffic threshold.
  • the threshold comparison module is specifically configured to:
  • the traffic size corresponding to each traffic component indicated by the traffic analysis result of the partial service request of the server is compared with an abnormal traffic threshold corresponding to the target traffic component, where the target traffic component is Traffic components that do not meet the booking criteria;
  • the complete traffic estimation module is specifically configured to: calculate, according to the traffic size component of the target traffic component indicated by the traffic analysis result, the weight of the distributed node corresponding to the target traffic component, and respectively calculate all service requests for the server
  • the target traffic consists of the component's traffic size.
  • the indication sending module is specifically configured to:
  • An indication of the subsequent processing of the flow component for the server is issued for the traffic component that the comparison result meets the predetermined condition.
  • subsequent processing includes: traffic cleaning, traffic black hole, or traffic analysis.
  • the embodiment of the present application further provides an early warning decision system, where the system includes a plurality of nodes for performing early warning decisions.
  • the method further includes multiple traffic analysis nodes, a first load balancing device and a second load balancing device;
  • the first load balancing device is configured to offload the service request to the multiple traffic analysis nodes
  • Each traffic analysis node receives the service request, and reports the traffic analysis result to the second load balancing device.
  • the second load balancing device offloads the traffic analysis result to the multiple early warning decision amount nodes.
  • the present application can be implemented in software and/or a combination of software and hardware.
  • the various devices of the present application can be implemented using an application specific integrated circuit (ASIC) or any other similar hardware device.
  • the software program of the present application can be executed by a processor to implement the steps or functions described above.
  • the software programs (including related data structures) of the present application can be stored in a computer readable recording medium such as a RAM memory, a magnetic or optical drive or a floppy disk and the like.
  • some of the steps or functions of the present application may be implemented in hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Multimedia (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种预警决策的方法、节点及子***。该方法包括以下步骤：获取针对同一服务器的部分服务请求的流量分析结果；根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量，所述权重是本分布式节点获取的流量分析结果指示的流量占针对所述服务器的全部服务请求的流量的权重；将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较；根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。根据本申请的方案，有效提高了DDoS预警***的可靠性和安全性。

Description

预警决策的方法、节点及子***
本申请要求2015年11月27日递交的申请号为201510846433.3、发明名称为“预警决策的方法、节点及子***”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及分布式拒绝服务(Distributed Denial of Service，DDoS)预警技术领域，尤其涉及一种预警决策的方法、节点及子***。
背景技术
DDoS攻击通过大量合法的服务请求占用大量网络资源，以达到瘫痪网络的目的。为了应对DDoS攻击，可以通过流量分析识别DDoS攻击，当识别出DDoS攻击时，进行流量清洗，以去掉攻击或异常的服务请求。
以图1所示的DDoS预警***为例。
访问机房内服务器的请求数据通过互联网服务提供商(Internet Service Provider，ISP)网络设备到达机房入口网络设备(例如路由器)。并且，从ISP网络设备流入机房入口网络设备的服务请求会通过镜像的方式完整地到达负载均衡设备，再通过负载均衡设备分发给分布式的各个流量分析设备。流量分析设备周期性地对分发到本设备的服务请求进行流量分析，具体是按照IP地址对每个流量分析周期内的服务请求的流量组成成分和流量大小进行统计。然后各个流量分析设备将流量分析结果发送给决策设备，由决策设备根据汇总后的流量分析结果判断各个机房内服务器的流量是否存在异常，如果某个服务器的流量异常，即可能存在DDoS攻击，则通知清洗设备将到达机房入口网络设备的服务请求进行牵引，并在清洗处理完成后再回注到机房入口网络设备，如果服务器不存在流量异常，则不进行处理。
基于上述处理过程，在没有DDoS攻击的情况下，服务请求通过机房入口网络设备正常转发给机房内服务器。在有DDoS攻击的情况下，服务请求到达机房入口网络设备后，通过流量牵引将服务请求先转发给流量清洗设备，经过流量清洗设备处理后将服务请求回注给机房入口网络设备，然后再转发给机房内服务器。
现有的DDoS预警***中只有一个决策设备，当这个决策设备由于某种原因(例如 出现故障)无法正常工作时，整个机房的网络防御就会失效。因此，现有的DDoS预警***的可靠性和安全性较差。
发明内容
本申请的目的是提供一种预警决策的方法、节点及子***，以解决现有的DDoS预警***的可靠性和安全性较差的问题。
根据本申请的一个方面，提供一种预警决策的方法，应用于进行预警决策的各个分布式节点中分别实现，该方法包括以下步骤：获取针对同一服务器的部分服务请求的流量分析结果；根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量，所述权重是本分布式节点获取的流量分析结果指示的流量占针对所述服务器的全部服务请求的流量的权重；将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较；根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。
根据本申请的另一方面，还提供了一种预警决策的节点，该节点为分布式节点，该节点包括以下模块：流量分析结果获取模块，用于获取针对同一服务器的部分服务请求的流量分析结果；完整流量估计模块，用于根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量，所述权重是本分布式节点获取的流量分析结果指示的流量占所述服务器的全部服务请求的流量的权重；阈值比较模块，用于将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较；判断控制模块，用于根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。
根据本申请的又一方面，还提供了一种预警决策的***，包括：
多个上述预警决策节点，多个流量分析节点，第一负载均衡设备和第二负载均衡设备；
所述第一负载均衡设备用于服务请求分流给所述多个流量分析节点；
各个流量分析节点接收服务请求，向第二负载均衡设备上报流量分析结果；
所述第二负载均衡设备将流量分析结果分流给所述多个预警决策额节点。
与现有技术相比，本申请具有以下优点：现有的DDoS预警***中只有一个决策设备，当这个决策设备由于某种原因无法正常工作时，例如，决策设备出现故障而无法正常工作，或者限于单个决策设备的处理能力，又例如，当需要处理的数据量超出决策设备的处理能力将导致决策设备无法正常工作，整个机房的网络防御就会失效。而本申请 实施例提供的技术方案，采用分布式的架构来进行预警决策，即使有进行预警决策的节点无法正常工作，还可以由其他正常工作的节点进行预警决策，从而有效提高了DDoS预警***的可靠性和安全性。另外，采用分布式的架构进行预警决策，较之单个决策设备的处理能力大大提高。具体地说，每个进行预警决策的分布式节点均有其权重，该权重是本分布式节点获取流量分析结果指示的流量占针对所述服务器的全部服务请求的流量的权重。进一步的，对于每个分布式节点，根据其权重以及针对同一服务器的部分服务请求的流量分析结果指示的流量，就能够估计出针对同一服务器的全部服务请求的流量。进而通过将估计得到的流量与异常流量阈值进行比较，实现预警决策。通过这种方法，使得单个分布式节点在获得的是部分服务请求的流量的前提下，结合其权重即可估计得到全部服务请求的流量，进而实现预警决策。可见，每个上述分布式节点均可以进行预警决策，当有进行预警决策的分布式节点无法正常工作时，仍然可以由其他进行预警决策的分布式节点正常工作，提高了DDoS预警***的可靠性和安全性，且提高了***的处理能力。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1为现有的一种DDoS预警***示意图；
图2为本申请一个实施例的方法流程图；
图3为本申请另一个实施例的DDoS预警***示意图；
图4为本申请另一个实施例的方法流程图；
图5为本申请又一个实施例的节点示意图。
附图中相同或相似的附图标记代表相同或相似的部件。
具体实施方式
在更加详细地讨论示例性实施例之前应当提到的是，一些示例性实施例被描述成作为流程图描绘的处理或方法。虽然流程图将各项操作描述成顺序的处理，但是其中的许多操作可以被并行地、并发地或者同时实施。此外，各项操作的顺序可以被重新安排。当其操作完成时所述处理可以被终止，但是还可以具有未包括在附图中的附加步骤。所述处理可以对应于方法、函数、规程、子例程、子程序等等。
在上下文中所称“节点”、“负载均衡设备”是一种计算机设备(computing device)，指可以通过运行预定程序或指令来执行数值计算和/或逻辑计算等预定处理过程的智能电子设备，其可以包括处理器与存储器，由处理器执行在存储器中预存的存续指令来执行预定处理过程，或是由ASIC、FPGA、DSP等硬件执行预定处理过程，或是由上述二者组合来实现。
需要说明的是，所述计算机设备仅为举例，其他现有的或今后可能出现的计算机设备如可适用于本申请，也应包含在本申请保护范围以内，并以引用方式包含于此。
后面所讨论的方法(其中一些通过流程图示出)可以通过硬件、软件、固件、中间件、微代码、硬件描述语言或者其任意组合来实施。当用软件、固件、中间件或微代码来实施时，用以实施必要任务的程序代码或代码段可以被存储在机器或计算机可读介质(比如存储介质)中。(一个或多个)处理器可以实施必要的任务。
这里所公开的具体结构和功能细节仅仅是代表性的，并且是用于描述本申请的示例性实施例的目的。但是本申请可以通过许多替换形式来具体实现，并且不应当被解释成仅仅受限于这里所阐述的实施例。
应当理解的是，当一个模块被称为“连接”或“耦合”到另一模块时，其可以直接连接或耦合到所述另一模块，或者可以存在中间模块。与此相对，当一个模块被称为“直接连接”或“直接耦合”到另一模块时，则不存在中间单元。应当按照类似的方式来解释被用于描述模块之间的关系的其他词语(例如“处于...之间”相比于“直接处于...之间”，“与...邻近”相比于“与...直接邻近”等等)。
这里所使用的术语仅仅是为了描述具体实施例而不意图限制示例性实施例。除非上下文明确地另有所指，否则这里所使用的单数形式“一个”、“一项”还意图包括复数。还应当理解的是，这里所使用的术语“包括”和/或“包含”规定所陈述的特征、整数、步骤、操作、单元和/或组件的存在，而不排除存在或添加一个或更多其他特征、整数、步骤、操作、单元、组件和/或其组合。
还应当提到的是，在一些替换实现方式中，所提到的功能/动作可以按照不同于附图中标示的顺序发生。举例来说，取决于所涉及的功能/动作，相继示出的两幅图实际上可以基本上同时执行或者有时可以按照相反的顺序来执行。
下面结合附图对本申请作进一步详细描述。
图2为本申请一个实施例的预警决策的方法的流程示意图。
其中，本实施例的方法主要通过计算机设备来实现，且特别适用于DDoS预警*** 中进行预警决策的各个分布式节点。DDoS预警***中，由流量分析设备根据服务请求中的IP地址(一个IP地址对应一个服务器)，分析每个IP地址的流量组成成分和流量大小。流量分析设备的流量分析结果被分发至进行预警决策的各个分布式节点。即使本领域技术人员能够想到在DDoS预警***中引入分布式架构进行预警决策，但基于DDoS攻击的特点，需要获知针对一个服务器的全部服务请求的流量，才能够进行预警决策。本申请实施例提供的技术方案，由进行预警决策的各个分布式节点根据其所获得的针对同一服务器的部分服务请求的流量分析结果指示的流量及其权重，计算出针对该服务器的全部服务请求的流量，进而进行预警决策。可见，本申请实施例提供的技术方案，每个分布式节点能够根据碎片化的数据进行预警决策。进而，在有进行预警决策的分布式节点不能正常工作时，仍然可以由其他正常工作的分布式节点进行预警决策，从而提高了DDoS预警***的可靠性和安全性。另外，多个分布式节点总的处理能力高于单个决策设备的处理能力，因此，本申请实施例提供的技术方案还提高了***的处理能力。
根据本实施例的方法包括步骤S110-S140。
在步骤S110中，获取针对同一服务器的部分服务请求的流量分析结果。
可选的，步骤S110中，获取当前流量分析周期内针对同一服务器的部分服务请求的流量分析结果。
在步骤S120中，根据上述流量分析结果指示的流量和本分布式节点的权重，计算针对上述服务器的全部服务请求的流量。
可选的，步骤S120中，根据上述流量分析结果指示的流量和本分布式节点的权重，计算当前流量分析周期内针对上述服务器的全部服务请求的流量。
其中，分布式节点的权重是该分布式节点获取的流量分析结果指示的流量占针对服务器的全部服务请求的流量的权重。特别的，分布式节点的权重是至少一个流量分析周期内，该分布式节点获取的流量分析结果指示的流量占针对服务器的全部服务请求的流量的权重。该分布式节点获取的流量分析结果是针对上述服务器的部分服务请求的流量分析结果。
在步骤S130中，将针对上述服务器的全部服务请求的流量与异常流量阈值进行比较。
可选的，步骤S130中，将当前流量分析周期内针对上述服务器的全部服务请求的流量与异常流量阈值进行比较。
本申请实施例中，异常流量阈值是根据实际情况确定的，本申请实施例不对其具体 取值进行限定。
在步骤S140中，根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。
本申请实施例中，不对后续处理进行限定。例如，可以进行流量清洗、流量黑洞、或流量分析等等后续处理。
本申请实施例中，步骤S110中获取针对同一服务器的部分服务请求的流量分析结果，是碎片化的数据。为了实现预警决策，在步骤S120中，要根据上述流量分析结果指示的流量和本分布式节点的权重，计算针对上述服务器的全部服务请求的流量。具体的，是在步骤S130中，将估计出的流量与异常流量阈值进行比较，在步骤S140中根据比较结果判断是否发出针对服务器进行后续处理的指示。从而提高了DDoS预警***的可靠性和安全性，还提高了***的处理能力。
即使本领域技术人员能够想到在DDoS预警***中引入分布式架构进行预警决策，但每个分布式节点仅获得部分访问流量的流量分析结果指示的流量，即数据碎片化，如何根据碎片化的数据进行预警决策，是本领域技术人员不付出创造性的劳动而无法获知的。
本发明实施例中，上述步骤S140具体可以是：当比较结果符合预定条件，判断发出针对所述服务器进行后续处理的指示；否则，判断不发出针对所述服务器进行后续处理的指示；所述预定条件为进行比较的流量大于所述异常流量阈值，或者所述预定条件为进行比较的流量不小于所述异常流量阈值。
其中，预定条件为进行比较的流量大于上述异常流量阈值，或者所述预定条件为进行比较的流量不小于上述异常流量阈值。
应当指出的是，当比较结果不符合上述预定条件，则表示不存在DDoS攻击，不需要发出针对上述服务器进行后续处理的指示。
为了进一步提高处理效率，可选地，在步骤S110之后，将针对上述服务器的部分服务请求的流量分析结果指示的流量与上述异常流量阈值进行比较；如果比较结果符合上述预定条件，发出针对上述服务器的后续处理指示。相应的，上述步骤S120是在针对上述服务器的部分服务请求的流量分析结果指示的流量与上述异常流量阈值进行比较的比较结果不符合上述预定条件时执行的。
上述可选的实现方式中，在获取了针对同一服务器的部分服务请求的流量分析结果，首先将该流量分析结果指示的流量与异常流量阈值进行比较，如果比较结果符合预定条件则直接发出针对上述服务器进行后续处理的指示，不再进行后续处理，从而进一步提 高了处理效率。
例如，异常流量阈值是10MBps，如果获取的当前流量分析周期内针对同一服务器的部分服务请求的流量分析结果指示的流量大小是20MBps，则判断出该流量分析结果指示的流量大于异常流量阈值后，发出针对该服务器进行后续处理的指示；如果获取的当前流量分析周期内针对同一服务器的部分服务请求的流量分析结果指示的流量大小是8MBps，则还进一步需要结合本分布式节点的权重估计出当前流量分析周期内针对该服务器的全部服务请求的流量，进而将估计得到的流量与异常流量阈值进行比较，从而判断是否需要发出针对该服务器进行后续处理的指示。
基于上述任意方法实施例，本申请实施例提供的方法可以在流量分析设备中实现，也可以由单独的设备实现。
如果由单独的设备实现，由负载均衡设备将流量分析设备得到的流量分析结果分发给进行预警决策的各个分布式节点，相应的，步骤S110中，从负载均衡设备获取针对同一服务器的部分服务请求的流量分析结果。
如果由流量分析设备实现，那么，分布式的每个流量分析设备从负载均衡设备获取针对上述服务器的部分服务请求，对这部分服务请求进行流量分析，得到针对上述服务器的部分服务请求的流量分析结果。即步骤S110中，是由本设备进行流量分析从而获取的流量分析结果。
基于上述任意方法实施例，可选地，本申请实施例还按照预定的权重调整周期，调整本分布式节点的权重，以保证估计结果的准确性。
本申请实施例中，调整本分布式节点的权重的实现方式有多种。
可选地，在每个权重调整周期，确定进行预警决策的其它分布式节点获取的当前权重调整周期内的部分时间段(例如一个权重调整周期为60秒，每个流量分析周期为1秒，只取每个权重调整周期内最后两个流量分析周期，即最后2秒)内针对上述服务器的部分服务请求的流量分析结果指示的流量；在每个权重调整周期，根据进行预警决策的全部分布式节点获取的上述部分时间段内针对上述服务器的部分服务请求的流量分析结果指示的流量，计算上述部分时间段内针对所述服务器的全部服务请求的流量；在每个权重调整周期，至少根据本分布式节点获取的上述部分时间段内针对上述服务器的部分服务请求的流量分析结果指示的流量占上述部分时间段内针对上述服务器的全部服务请求的流量的权重，调整本分布式节点在下一个权重调整周期的权重。
例如，流量分析周期为1秒，权重调整周期为60秒。则每隔60秒，调整一次权重。
其中，既可以与其他分布式节点进行交互，从而确定进行预警决策的其它分布式节点获取的当前权重调整周期内的部分时间段内针对上述服务器的部分服务请求的流量分析结果指示的流量；也可以与负载均衡设备交互，从而确定进行预警决策的其它分布式节点获取的当前权重调整周期内的部分时间段内针对上述服务器的部分服务请求的流量分析结果指示的流量。
应当指出的是，为了调整权重，也可以按照预定的权重调整周期，向负载均衡设备请求获取本分布式节点的权重。
流量分析结果至少指示了流量大小。可选的，具体指示每个流量组成成分的流量大小。相应的，基于上述任意方法实施例，既可以基于流量的组成成分进行预警决策，也可以仅依据流量大小进行预警决策。
如果仅依据流量大小进行预警决策。那么，步骤S120中，具体是根据上述流量分析结果指示的流量大小和本分布式节点的权重，计算针对上述服务器的全部服务请求的流量大小。相应的，上述步骤S130中，具体是将针对所述服务器的全部服务请求的流量大小与异常流量阈值进行比较。如果还将上针对上述服务器的部分服务请求的流量分析结果指示的流量与异常流量阈值进行比较，具体是将针对上述服务器的全部服务请求的流量大小与异常流量阈值进行比较。
如果基于流量的组成成分进行预警决策，如果还将上述针对上述服务器的部分服务请求的流量分析结果指示的流量与异常流量阈值进行比较，具体是将上述针对上述服务器的部分服务请求的流量分析结果指示的各流量组成成分对应的流量大小分别与各流量组成成分对应的异常流量阈值进行比较；相应的，上述步骤S110中，具体是根据所述流量分析结果指示的目标流量组成成分对应的流量大小和目标流量组成成分对应的本分布式节点的权重，分别计算针对所述服务器的全部服务请求的目标流量组成成分的流量大小；上述步骤S130中，具体是将针对上述服务器的全部服务请求的目标流量组成成分的流量大小分别与目标流量组成成分对应的异常流量阈值进行比较，目标流量组成成分为不符合预订条件的流量组成成分。如果没有将上述针对上述服务器的部分服务请求的流量分析结果指示的流量与异常流量阈值进行比较的步骤，相应的，上述步骤S110中，具体是根据上述流量分析结果指示的各流量组成成分对应的流量大小和各流量组成成分对应的本分布式节点的权重，分别计算针对上述服务器的全部服务请求的各流量组成成分的流量大小；上述步骤S130中，具体是将针对上述服务器的全部服务请求的各流量组成 成分的流量大小分别与各流量组成成分对应的异常流量阈值进行比较。
在此基础上，可选的，无论哪次比较，当比较结果符合预定条件，发出针对所述服务器进行后续处理的指示的步骤包括：针对比较结果符合预定条件的流量组成成分，发出针对所述服务器进行该流量组成成分的后续处理的指示。
应当指出的是，也可以是当比较结果符合预定条件，发出针对上述服务器进行后续处理的指示，而不区分具体流量组成成分。
下面将结合具体应用场景，对本申请实施例提供的方法进行详细说明。
假设在对进行电子商务的服务器进行DDoS预警的***中，如图3所示，机房内服务器用于处理电子商务的服务请求。具体的，访问机房内服务器的请求数据通过ISP网络设备到达机房入口网络设备，从ISP网络设备流入机房入口网络设备的服务请求会通过镜像的方式完整地到达第一负载均衡设备，该第一负载均衡设备将服务请求分发给分布式的各个流量分析设备。服务请求中会携带目标服务器的IP地址和访问时间，流量分析设备根据IP地址和访问时间，对每秒钟针对同一个服务器的流量组成成分和各流量组成成分的大小进行统计。例如，流量分析设备A对接收到的服务请求进行分析，统计得到访问时间为18时10分20秒的、IP地址为服务器B的访问请求的流量大小可以表示为20MBps，其中，又可以分为三个流量组成成分a、b和c，流量组成成分a对应的流量大小为10MBps，流量组成成分b对应的流量大小为8MBps，流量组成成分c对应的流量大小为2MBps。各个流量分析设备将其流量分析结果发送给第二负载均衡设备，该第二负载均衡设备将接收到的流量分析结果分发给进行预警决策的各个分布式节点，流量分析结果中携带流量组成成分及对应的流量大小，还携带目标服务器的IP地址和访问时间。例如，第二负载均衡设备接收到针对同一个IP地址的、相同访问时间的100条分析结果，进行预警决策的分布式节点共有50个，则将这100条分析结果均分给这50个分布式节点。应当指出的是，当某个分布式节点无法正常工作时，第二负载均衡设备不再向其分发流量分析结果，而是将流量分析结果均分给正常工作的各个分布式节点。
如图4所示，进行预警决策的分布式节点执行如下操作：
步骤S210、获取1秒内针对同一服务器的部分服务请求的流量分析结果。
其中，该流量分析结果中携带该服务器的IP地址，访问时间，以及各流量组成成分的流量大小。
例如，18时10分20秒内访问服务器B的流量组成成分共有三个，其中，流量组成成分a的流量大小为10MBps，流量组成成分b的流量大小为8MBps，流量组成成分c 的流量大小为2MBps。
步骤S220、分别将每个流量组成成分的流量大小与流量组成成分对应的异常流量阈值进行比较，针对比较结果不符合预定条件的流量组成成分，执行步骤S230，针对比较结果符合预定条件的流量组成成分，执行步骤S250。
由于流量组成成分的数量是有限的，且能够预先获知。因此，可以预先确定每个流量组成成分对应的异常流量阈值。
例如，已知总共有5种流量组成成分，其中，流量组成成分a对应的异常流量阈值为8MBps，流量组成成分b对应的异常流量阈值为20MBps，流量组成成分c对应的异常流量阈值为2MBps，其他两种流量组成成分由于本申请实施例中未涉及，故不再介绍。
步骤S230、根据比较结果不符合预定条件的流量组成成分对应的流量大小和对应的本分布式节点的权重，分别估计上述1秒内针对上述服务器的全部服务请求的比较结果不符合预定条件的流量组成成分的流量大小。
例如，预定条件是流量大小不小于异常流量阈值。那么，根据流量组成成分b的流量大小(8MBps)和流量组成成分b对应的本分布式节点的权重0.5，估计上述1秒内针对上述服务器的全部服务请求中、流量组成成分b的流量大小(16MBps)。
步骤S240、将估计得到的流量大小与相应的流量组成成分对应的异常流量阈值进行比较，针对比较结果不符合预定条件的流量组成成分，不进行任何处理，针对比较结果符合预定条件的流量组成成分，执行步骤S250。
步骤S250、发出针对上述服务器进行比较结果符合预定条件的流量组成成分的流量清洗的指示。
即，发出针对上述服务器B进行流量组成成分a和c的流量清洗的指示。
清洗设备在接收到上述指示后，对到达机房入口网络设备的服务请求进行清洗，滤除流量组成成分a和c的服务请求，保留流量组成成分b的服务请求(正常电子商务的服务请求)，并将清洗后的服务请求回注至机房入口网络设备。
机房入口网络设备根据IP地址将服务请求发送给对应的机房内服务器。
上述过程中，以1秒作为流量分析周期为例进行说明。应当指出的是，在实际应用中，可以根据实际需要设置流量分析周期的大小。
上述过程中，负载均衡设备将流量分析结果均分给正常工作的各个分布式节点。应当指出的是，在实际应用中，可以配置负载均衡设备按照不同的策略进行流量分析结果的分发。
图5为本申请一个实施例的预警决策的节点5，该节点5为分布式节点，包括以下模块：
流量分析结果获取模块501，用于获取针对同一服务器的部分服务请求的流量分析结果；
完整流量估计模块502，用于根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量，所述权重是本分布式节点获取的流量分析结果指示的流量占所述服务器的全部服务请求的流量的权重；
阈值比较模块503，用于将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较；
判断控制模块504，用于根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。
可选地，所述阈值比较模块还用于：
当比较结果符合预定条件，判断发出针对所述服务器进行后续处理的指示；否则，判断不发出针对所述服务器进行后续处理的指示；所述预定条件为进行比较的流量大于所述异常流量阈值，或者所述预定条件为进行比较的流量不小于所述异常流量阈值。
可选的，所述阈值比较模块还用于：
将针对所述服务器的部分服务请求的流量分析结果指示的流量与所述异常流量阈值进行比较；
所述根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量是在比较结果不符合所述预定条件的前提下执行的。
可选的，还包括权重调整模块，用于按照预定的权重调整周期，调整本分布式节点的权重。
可选的，所述权重调整模块具体用于：
在每个权重调整周期，确定进行预警决策的其它分布式节点获取的本权重调整周期的部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量；
在每个所述的权重调整周期，根据进行预警决策的全部分布式节点获取的所述部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量，计算所述部分时间段内针对所述服务器的全部服务请求的流量；
在每个所述的权重调整周期，至少根据本分布式节点获取的所述部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量占所述部分时间段内针对所述服 务器的全部服务请求的流量的权重，调整本分布式节点在下一个权重调整周期的权重。
可选的，所述流量分析结果获取模块具体用于：
从负载均衡设备获取针对同一服务器的部分服务请求的流量分析结果。
可选的，该节点还包括服务请求获取模块，用于：
从负载均衡设备获取针对所述服务器的部分服务请求；
所述流量结果获取模块具体用于：对所述部分服务请求进行流量分析，得到针对所述服务器的部分服务请求的流量分析结果。
可选的，所述完整流量估计模块具体用于：
根据所述流量分析结果指示的流量大小和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量大小；
所述阈值比较模块具体用于：将针对所述服务器的部分服务请求的流量分析结果指示的流量大小与所述异常流量阈值进行比较；以及在比较结果不符合所述预定条件时，将针对所述服务器的全部服务请求的流量大小与异常流量阈值进行比较。
可选的，所述阈值比较模块具体用于：
将针对所述服务器的部分服务请求的流量分析结果指示的各流量组成成分对应的流量大小分别与各流量组成成分对应的异常流量阈值进行比较；以及在有流量组成成分对应的流量大小与对应的异常流量阈值的比较结果不符合预定条件时，将针对所述服务器的全部服务请求的目标流量组成成分的流量大小分别与目标流量组成成分对应的异常流量阈值进行比较，所述目标流量组成成分为不符合预订条件的流量组成成分；
所述完整流量估计模块具体用于：根据所述流量分析结果指示的目标流量组成成分对应的流量大小和目标流量组成成分对应的本分布式节点的权重，分别计算针对所述服务器的全部服务请求的目标流量组成成分的流量大小。
可选的，所述指示发送模块具体用于：
针对比较结果符合预定条件的流量组成成分，发出针对所述服务器进行该流量组成成分的后续处理的指示。
基于上述任意节点实施例，可选的，后续处理包括：流量清洗，流量黑洞，或流量分析。
本申请实施例还提供一种预警决策***，该***包括多个上述进行预警决策的节点。
可选的，还包括多个流量分析节点，第一负载均衡设备和第二负载均衡设备；
所述第一负载均衡设备用于服务请求分流给所述多个流量分析节点；
各个流量分析节点接收服务请求，向第二负载均衡设备上报流量分析结果；
所述第二负载均衡设备将流量分析结果分流给所述多个预警决策额节点。
需要注意的是，本申请可在软件和/或软件与硬件的组合体中被实施，例如，本申请的各个装置可采用专用集成电路(ASIC)或任何其他类似硬件设备来实现。在一个实施例中，本申请的软件程序可以通过处理器执行以实现上文所述步骤或功能。同样地，本申请的软件程序(包括相关的数据结构)可以被存储到计算机可读记录介质中，例如，RAM存储器，磁或光驱动器或软磁盘及类似设备。另外，本申请的一些步骤或功能可采用硬件来实现，例如，作为与处理器配合从而执行各个步骤或功能的电路。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。***权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。
虽然前面特别示出并且描述了示例性实施例，但是本领域技术人员将会理解的是，在不背离权利要求书的精神和范围的情况下，在其形式和细节方面可以有所变化。

Claims (23)

  1. 一种预警决策的方法，其特征在于，应用于进行预警决策的各个分布式节点，该方法包括以下步骤：
    获取针对同一服务器的部分服务请求的流量分析结果；
    根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量，所述权重是本分布式节点获取的流量分析结果指示的流量占针对所述服务器的全部服务请求的流量的权重；
    将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较；
    根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。
  2. 根据权利要求1所述的方法，其特征在于，所述根据比较结果，判断是否发出针对所述服务器进行后续处理的指示，包括：
    当比较结果符合预定条件，判断发出针对所述服务器进行后续处理的指示；否则，判断不发出针对所述服务器进行后续处理的指示；所述预定条件为进行比较的流量大于所述异常流量阈值，或者所述预定条件为进行比较的流量不小于所述异常流量阈值。
  3. 根据权利要求2所述的方法，其特征在于，该方法还包括：
    将所述针对所述服务器的部分服务请求的流量分析结果指示的流量与所述异常流量阈值进行比较；
    如果比较结果符合所述预定条件，发出针对所述服务器的后续处理的指示；
    所述根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量的步骤是在比较结果不符合所述预定条件的前提下执行的。
  4. 根据权利要求1～3任一项所述的方法，其特征在于，该方法还包括：
    按照预定的权重调整周期，调整本分布式节点的权重。
  5. 根据权利要求4所述的方法，其特征在于，所述按照预定的权重调整周期，调整本分布式节点的权重的步骤包括：
    在每个权重调整周期，确定进行预警决策的其它分布式节点获取的本权重调整周期的部分时间段内的针对所述服务器的部分服务请求的流量分析结果指示的流量；
    在每个所述的权重调整周期，根据进行预警决策的全部分布式节点获取的所述部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量，计算所述部分时间段内针对所述服务器的全部服务请求的流量；
    在每个所述的权重调整周期，至少根据本分布式节点获取的所述部分时间段内针对 所述服务器的部分服务请求的流量分析结果指示的流量占所述部分时间段内针对所述服务器的全部服务请求的流量的权重，调整本分布式节点在下一个权重调整周期的权重。
  6. 根据权利要求1～3任一项所述的方法，其特征在于，所述获取针对同一服务器的部分服务请求的流量分析结果的步骤包括：
    从负载均衡设备获取针对同一服务器的部分服务请求的流量分析结果。
  7. 根据权利要求1～3任一项所述的方法，其特征在于，该方法还包括：
    从负载均衡设备获取针对所述服务器的部分服务请求；
    所述获取针对同一服务器的部分服务请求的流量分析结果的步骤包括：
    对所述部分服务请求进行流量分析，得到针对所述服务器的部分服务请求的流量分析结果。
  8. 根据权利要求3所述的方法，其特征在于，所述根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量的步骤包括：根据所述流量分析结果指示的流量大小和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量大小；
    所述将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较的步骤包括：将针对所述服务器的全部服务请求的流量大小与异常流量阈值进行比较；
    所述将针对所述服务器的部分服务请求的流量分析结果指示的流量与所述异常流量阈值进行比较的步骤包括：将针对所述服务器的部分服务请求的流量分析结果指示的流量大小与所述异常流量阈值进行比较。
  9. 根据权利要求3所述的方法，其特征在于，所述将针对所述服务器的部分服务请求的流量分析结果指示的流量与所述异常流量阈值进行比较的步骤包括：将针对所述服务器的部分服务请求的流量分析结果指示的各流量组成成分对应的流量大小分别与各流量组成成分对应的异常流量阈值进行比较；
    所述根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量的步骤包括：根据所述流量分析结果指示的目标流量组成成分对应的流量大小和目标流量组成成分对应的本分布式节点的权重，分别计算针对所述服务器的全部服务请求的目标流量组成成分的流量大小，所述目标流量组成成分为不符合预订条件的流量组成成分；
    所述将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较的步骤包 括：将针对所述服务器的全部服务请求的目标流量组成成分的流量大小分别与目标流量组成成分对应的异常流量阈值进行比较。
  10. 根据权利要求9所述的方法，其特征在于，所述当比较结果符合预定条件，发出针对所述服务器进行后续处理的指示的步骤包括：
    针对比较结果符合预定条件的流量组成成分，发出针对所述服务器进行该流量组成成分的后续处理的指示。
  11. 根据权利要求1～3、10中的任一项所述的方法，其特征在于，所述后续处理包括：流量清洗，流量黑洞，或流量分析。
  12. 一种预警决策节点，其特征在于，该节点为分布式节点，该节点包括以下模块：
    流量分析结果获取模块，用于获取针对同一服务器的部分服务请求的流量分析结果；
    完整流量估计模块，用于根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量，所述权重是本分布式节点获取的流量分析结果指示的流量占所述服务器的全部服务请求的流量的权重；
    阈值比较模块，用于将针对所述服务器的全部服务请求的流量与异常流量阈值进行比较；
    判断控制模块，用于根据比较结果，判断是否发出针对所述服务器进行后续处理的指示。
  13. 根据权利要求12所述的节点，其特征在于，所述阈值比较模块具体用于：
    当比较结果符合预定条件，判断发出针对所述服务器进行后续处理的指示；否则，判断不发出针对所述服务器进行后续处理的指示；所述预定条件为进行比较的流量大于所述异常流量阈值，或者所述预定条件为进行比较的流量不小于所述异常流量阈值。
  14. 根据权利要求12所述的节点，其特征在于，所述阈值比较模块还用于：
    将针对所述服务器的部分服务请求的流量分析结果指示的流量与所述异常流量阈值进行比较；
    所述根据所述流量分析结果指示的流量和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量是在比较结果不符合所述预定条件的前提下执行的。
  15. 根据权利要求12～14任一项所述的节点，其特征在于，还包括权重调整模块，用于按照预定的权重调整周期，调整本分布式节点的权重。
  16. 根据权利要求15所述的节点，其特征在于，所述权重调整模块具体用于：
    在每个权重调整周期，确定进行预警决策的其它分布式节点获取的本权重调整周期的部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量；
    在每个所述的权重调整周期，根据进行预警决策的全部分布式节点获取的所述部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量，计算所述部分时间段内针对所述服务器的全部服务请求的流量；
    在每个所述的权重调整周期，至少根据本分布式节点获取的所述部分时间段内针对所述服务器的部分服务请求的流量分析结果指示的流量占所述部分时间段内针对所述服务器的全部服务请求的流量的权重，调整本分布式节点在下一个权重调整周期的权重。
  17. 根据权利要求12～14任一项所述的节点，其特征在于，所述流量分析结果获取模块具体用于：
    从负载均衡设备获取针对同一服务器的部分服务请求的流量分析结果。
  18. 根据权利要求12～14任一项所述的节点，其特征在于，该节点还包括服务请求获取模块，用于：从负载均衡设备获取针对所述服务器的部分服务请求；
    所述流量结果获取模块具体用于：对所述部分服务请求进行流量分析，得到针对所述服务器的部分服务请求的流量分析结果。
  19. 根据权利要求14所述的节点，其特征在于，所述完整流量估计模块具体用于：根据所述流量分析结果指示的流量大小和本分布式节点的权重，计算针对所述服务器的全部服务请求的流量大小；
    所述阈值比较模块具体用于：将针对所述服务器的部分服务请求的流量分析结果指示的流量大小与所述异常流量阈值进行比较；以及在比较结果不符合所述预定条件时，将针对所述服务器的全部服务请求的流量大小与异常流量阈值进行比较。
  20. 根据权利要求14所述的节点，其特征在于，所述阈值比较模块具体用于：将针对所述服务器的部分服务请求的流量分析结果指示的各流量组成成分对应的流量大小分别与各流量组成成分对应的异常流量阈值进行比较；以及在有流量组成成分对应的流量大小与对应的异常流量阈值的比较结果不符合预定条件时，将针对所述服务器的全部服务请求的目标流量组成成分的流量大小分别与目标流量组成成分对应的异常流量阈值进行比较，所述目标流量组成成分为不符合预订条件的流量组成成分；
    所述完整流量估计模块具体用于：根据所述流量分析结果指示的目标流量组成成分对应的流量大小和目标流量组成成分对应的本分布式节点的权重，分别计算针对所述服 务器的全部服务请求的目标流量组成成分的流量大小。
  21. 根据权利要求20所述的节点，其特征在于，所述指示发送模块具体用于：
    针对比较结果符合预定条件的流量组成成分，发出针对所述服务器进行该流量组成成分的后续处理的指示。
  22. 根据权利要求12～13、21中的任一项所述的节点，其特征在于，所述后续处理包括：流量清洗，流量黑洞，或流量分析。
  23. 一种预警决策***，其特征在于，包括：
    多个如权利要求12～22任一项所述的预警决策节点，多个流量分析节点，第一负载均衡设备和第二负载均衡设备；
    所述第一负载均衡设备用于服务请求分流给所述多个流量分析节点；
    各个流量分析节点接收服务请求，向第二负载均衡设备上报流量分析结果；
    所述第二负载均衡设备将流量分析结果分流给所述多个预警决策额节点。
PCT/CN2016/106325 2015-11-27 2016-11-18 预警决策的方法、节点及子*** WO2017088700A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2018526929A JP6811776B2 (ja) 2015-11-27 2016-11-18 早期警戒決定方法、ノード、及びサブシステム
EP16867923.1A EP3382973B1 (en) 2015-11-27 2016-11-18 Early-warning decision method, node and sub-system
KR1020187014569A KR20180088392A (ko) 2015-11-27 2016-11-18 조기 경고 결정 방법, 노드 및 서브 시스템
US15/990,474 US11102240B2 (en) 2015-11-27 2018-05-25 Early-warning decision method, node and sub-system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510846433.3 2015-11-27
CN201510846433.3A CN106817340B (zh) 2015-11-27 2015-11-27 预警决策的方法、节点及子***

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/990,474 Continuation US11102240B2 (en) 2015-11-27 2018-05-25 Early-warning decision method, node and sub-system

Publications (1)

Publication Number Publication Date
WO2017088700A1 true WO2017088700A1 (zh) 2017-06-01

Family

ID=58763035

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/106325 WO2017088700A1 (zh) 2015-11-27 2016-11-18 预警决策的方法、节点及子***

Country Status (6)

Country Link
US (1) US11102240B2 (zh)
EP (1) EP3382973B1 (zh)
JP (1) JP6811776B2 (zh)
KR (1) KR20180088392A (zh)
CN (1) CN106817340B (zh)
WO (1) WO2017088700A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112235167A (zh) * 2020-12-21 2021-01-15 北京每日优鲜电子商务有限公司 流量报警方法、装置、电子设备和计算机可读介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106817340B (zh) * 2015-11-27 2020-05-08 阿里巴巴集团控股有限公司 预警决策的方法、节点及子***
CN109558247A (zh) * 2018-12-09 2019-04-02 江苏华存电子科技有限公司 一种避免权重失衡之自动动态调整权重数值轮替模块设计
US11477163B2 (en) * 2019-08-26 2022-10-18 At&T Intellectual Property I, L.P. Scrubbed internet protocol domain for enhanced cloud security
CN111130945B (zh) * 2019-12-30 2021-12-28 江苏万佳科技开发股份有限公司 一种数据监测云平台及使用方法
CN111416869A (zh) * 2020-03-26 2020-07-14 华泰证券股份有限公司 一种分布式集群中节点权重调整的方法
CN114584469B (zh) * 2020-11-17 2024-06-18 ***通信集团山东有限公司 网络安全确定方法、电子设备和存储介质
CN114331222B (zh) * 2022-03-03 2022-05-27 常州市瑞德信息科技有限公司 烟花爆竹生产环境下的风险监测预警通信交互方法及***

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101388885A (zh) * 2008-07-23 2009-03-18 成都市华为赛门铁克科技有限公司 分布式拒绝服务攻击的检测方法和***
CN101562537A (zh) * 2009-05-19 2009-10-21 华中科技大学 分布式自优化入侵检测报警关联***
CN102143143A (zh) * 2010-10-15 2011-08-03 华为数字技术有限公司 一种网络攻击的防护方法、装置及路由器
US8089871B2 (en) * 2005-03-25 2012-01-03 At&T Intellectual Property Ii, L.P. Method and apparatus for traffic control of dynamic denial of service attacks within a communications network
CN102801738A (zh) * 2012-08-30 2012-11-28 中国人民解放军国防科学技术大学 基于概要矩阵的分布式拒绝服务攻击检测方法及***

Family Cites Families (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9444785B2 (en) * 2000-06-23 2016-09-13 Cloudshield Technologies, Inc. Transparent provisioning of network access to an application
KR101111099B1 (ko) * 2004-09-09 2012-02-17 아바야 테크놀러지 코퍼레이션 네트워크 트래픽 보안 방법들 및 시스템들
CN1878141A (zh) 2005-05-20 2006-12-13 阿拉克斯拉网络株式会社 网络控制装置及其控制方法
US20060272018A1 (en) * 2005-05-27 2006-11-30 Mci, Inc. Method and apparatus for detecting denial of service attacks
JP2007179131A (ja) * 2005-12-27 2007-07-12 Nec Corp イベント検出システム、管理端末及びプログラムと、イベント検出方法
CN1838588A (zh) 2006-04-26 2006-09-27 南京大学 基于高速网络数据处理平台的入侵检测方法和***
US8160056B2 (en) * 2006-09-08 2012-04-17 At&T Intellectual Property Ii, Lp Systems, devices, and methods for network routing
JP2008092069A (ja) 2006-09-29 2008-04-17 Oki Electric Ind Co Ltd 観測設定管理システム、観測設定管理方法及び観測設定プログラム
US20090182818A1 (en) * 2008-01-11 2009-07-16 Fortinet, Inc. A Delaware Corporation Heuristic detection of probable misspelled addresses in electronic communications
US7746808B2 (en) * 2008-06-10 2010-06-29 At&T Intellectual Property Ii, L.P. Algorithms and estimators for summarization of unaggregated data streams
US8782755B2 (en) * 2009-03-20 2014-07-15 Citrix Systems, Inc. Systems and methods for selecting an authentication virtual server from a plurality of virtual servers
US8914878B2 (en) * 2009-04-29 2014-12-16 Juniper Networks, Inc. Detecting malicious network software agents
US20120047581A1 (en) * 2010-08-12 2012-02-23 Anirban Banerjee Event-driven auto-restoration of websites
KR20130006750A (ko) * 2011-06-20 2013-01-18 한국전자통신연구원 서비스 거부 공격 탐지 방법 및 장치
US9843488B2 (en) * 2011-11-07 2017-12-12 Netflow Logic Corporation Method and system for confident anomaly detection in computer network traffic
CN102769607B (zh) * 2011-12-30 2015-01-07 北京安天电子设备有限公司 一种基于网络数据包检测恶意代码的方法和***
CN103001825B (zh) * 2012-11-15 2016-03-02 中国科学院计算机网络信息中心 Dns流量异常的检测方法和***
US20140157405A1 (en) * 2012-12-04 2014-06-05 Bill Joll Cyber Behavior Analysis and Detection Method, System and Architecture
US9015839B2 (en) * 2013-08-30 2015-04-21 Juniper Networks, Inc. Identifying malicious devices within a computer network
US20150172096A1 (en) * 2013-12-17 2015-06-18 Microsoft Corporation System alert correlation via deltas
US9614745B2 (en) * 2014-01-09 2017-04-04 Citrix Systems, Inc. Systems and methods for cloud-based probing and diagnostics
US10284619B2 (en) 2014-01-22 2019-05-07 Telefonaktiebolaget Lm Ericsson (Publ) Method for scalable distributed network traffic analytics in telco
US9565204B2 (en) * 2014-07-18 2017-02-07 Empow Cyber Security Ltd. Cyber-security system and methods thereof
US20160036837A1 (en) * 2014-08-04 2016-02-04 Microsoft Corporation Detecting attacks on data centers
US20160182542A1 (en) * 2014-12-18 2016-06-23 Stuart Staniford Denial of service and other resource exhaustion defense and mitigation using transition tracking
CN106161333B (zh) * 2015-03-24 2021-01-15 华为技术有限公司 基于sdn的ddos攻击防护方法、装置及***
US10438207B2 (en) * 2015-04-13 2019-10-08 Ciena Corporation Systems and methods for tracking, predicting, and mitigating advanced persistent threats in networks
CN105007312A (zh) * 2015-07-03 2015-10-28 叶秀兰 一种云计算服务器自适应负载均衡控制方法及控制***
US9838409B2 (en) * 2015-10-08 2017-12-05 Cisco Technology, Inc. Cold start mechanism to prevent compromise of automatic anomaly detection systems
CN106817340B (zh) * 2015-11-27 2020-05-08 阿里巴巴集团控股有限公司 预警决策的方法、节点及子***
US10616251B2 (en) * 2017-02-23 2020-04-07 Cisco Technology, Inc. Anomaly selection using distance metric-based diversity and relevance

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8089871B2 (en) * 2005-03-25 2012-01-03 At&T Intellectual Property Ii, L.P. Method and apparatus for traffic control of dynamic denial of service attacks within a communications network
CN101388885A (zh) * 2008-07-23 2009-03-18 成都市华为赛门铁克科技有限公司 分布式拒绝服务攻击的检测方法和***
CN101562537A (zh) * 2009-05-19 2009-10-21 华中科技大学 分布式自优化入侵检测报警关联***
CN102143143A (zh) * 2010-10-15 2011-08-03 华为数字技术有限公司 一种网络攻击的防护方法、装置及路由器
CN102801738A (zh) * 2012-08-30 2012-11-28 中国人民解放军国防科学技术大学 基于概要矩阵的分布式拒绝服务攻击检测方法及***

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112235167A (zh) * 2020-12-21 2021-01-15 北京每日优鲜电子商务有限公司 流量报警方法、装置、电子设备和计算机可读介质

Also Published As

Publication number Publication date
KR20180088392A (ko) 2018-08-03
CN106817340A (zh) 2017-06-09
EP3382973A1 (en) 2018-10-03
US20180278646A1 (en) 2018-09-27
EP3382973B1 (en) 2020-09-09
JP2018535612A (ja) 2018-11-29
EP3382973A4 (en) 2019-07-03
CN106817340B (zh) 2020-05-08
US11102240B2 (en) 2021-08-24
JP6811776B2 (ja) 2021-01-13

Similar Documents

Publication Publication Date Title
WO2017088700A1 (zh) 预警决策的方法、节点及子***
US10484250B2 (en) Systems and methods for determining network configurations using historical and real-time network metrics
KR101077135B1 (ko) 웹 서비스 대상 응용계층 디도스 공격 탐지 및 대응 장치
US10291539B2 (en) Methods, systems, and computer readable media for discarding messages during a congestion event
CN107770132B (zh) 一种对算法生成域名进行检测的方法及装置
US8341742B2 (en) Network attack detection devices and methods
US20190215403A1 (en) Charging Method, Apparatus, and System
US8086731B2 (en) Method, system and apparatus for collecting statistics of characteristic value with threshold
WO2017016454A1 (zh) 防范ddos攻击的方法和装置
US20190104174A1 (en) Load processing method and apparatus
CN106254394B (zh) 一种攻击流量的记录方法和装置
WO2018120915A1 (zh) 一种DDoS攻击检测方法及设备
EP3295612A1 (en) Uplink performance management
WO2021043146A1 (zh) 检测方法、装置及***
CN110519266B (zh) 一种基于统计学方法的cc攻击检测的方法
CN109120424B (zh) 一种带宽调度方法及装置
CN107547561B (zh) 一种进行ddos攻击防护处理的方法及装置
WO2021147370A1 (zh) 故障检测模型的训练方法、装置及***
TWI723120B (zh) 預警決策的方法、節點及子系統
EP2892187A1 (en) Method and device for processing and tracking tacacs+ session
JP6325993B2 (ja) サービス監視装置、および、サービス監視方法
WO2021147371A1 (zh) 故障检测方法、装置及***
TWI717454B (zh) 量化防禦結果的方法、裝置及系統
KR101587845B1 (ko) 디도스 공격을 탐지하는 방법 및 장치
CN111193760B (zh) 一种信息发送方法、装置及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16867923

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20187014569

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2018526929

Country of ref document: JP

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2016867923

Country of ref document: EP