TWI717454B - Method, device and system for quantifying defense results - Google Patents

Abstract

The embodiment of the present invention provides a method and system for quantifying defense results, wherein the method includes: obtaining a suspicious data flow set, the suspicious data flow set is the suspicious IP address contained in the original data flow at the defense end of the cloud platform The data flow volume corresponding to each suspicious IP address in the collection is composed; the normal data flow volume is obtained, and the normal data flow volume is the remaining data after the suspicious data flow volume set is cleaned by the defense end according to the preset defense strategy Process volume; authorized host performance parameters, host performance parameters are the set of parameters extracted from the target end after the defense end sends the normal data flow volume to the target end; quantified defense based on the target parameter set Result; the target parameter set includes at least: suspicious data flow set, normal data flow, and host performance parameters. Since the evaluation angle and index of the calculated defense result of the present invention are more comprehensive, the defense result is more accurate.

Description

Method, device and system for quantifying defense results

The present invention relates to the field of network technology, in particular to methods, devices and systems for quantifying defense results.

With the continuous advancement of network technology, there are more and more network attacks in the network field. At present, distributed denial of service (DDoS) has become a more serious attack method among many network attacks. For this reason, a defensive end is added to the original system architecture to block DDoS attacks.

As shown in Figure 1, it is a schematic diagram of the existing network system architecture. As can be seen from the figure, the system architecture includes the business end, routing equipment, defense end and target end. Among them, the business end includes the normal business end and the attack end. The attacker sends various forms of attack data flow, and the defender blocks the attack data flow according to its own internal defense strategy.

If the defense strategy in the defense end is too loose, it will cause a large amount of attack traffic to attack the target end; but if the defense strategy is too tight, it will affect the normal business end to send normal data flow to the target end. Therefore, it is necessary to evaluate the defense results of the defense strategy on the defensive side, and determine an appropriate defense strategy based on the defense results.

At present, due to imperfect use of methods, incomplete parameter indicators, and incomplete data flow in the process of evaluating defense results, the results of evaluating defense results are inaccurate.

The present invention provides a method, device and system for quantifying the defense result, and by improving the evaluation method, the accuracy of evaluating the defense result is improved. In addition, combined with the cloud platform to further improve the integrity of the data flow.

In order to achieve the above objective, the present invention adopts the following technical means: a method for quantifying the defense results, including: obtaining a set of suspicious data flow, the set of suspicious data flow is taken by the defense end of the cloud platform via the core routing service end After the raw data flow volume of the target end, it is composed of the data flow volume corresponding to each suspicious IP address in the suspicious IP address set included in the raw data flow volume, and the suspicious IP address set is preset based on The detection rules are determined in the original data flow volume; the normal data flow volume is obtained, and the normal data flow volume is the remaining data flow volume after the defense end cleans the suspicious data flow volume set according to the preset defense strategy Authorized host performance parameters, the host performance parameters are the set of parameters extracted on the target end after the defense end sends the normal data flow to the target end; quantified defense based on the target parameter set Result; wherein, the target parameter set includes at least: the suspicious data flow set, normal data flow, and host performance parameters.

Preferably, the target parameter set further includes: an access success rate sent by a service monitoring device connected to the defense end; wherein the access success rate is when the service monitoring device is controlling multiple locations located in different geographic locations. After receiving the target terminal, the service terminal is calculated according to the request success rate and the request time delay returned by the target terminal.

Preferably, the target parameter set further includes network service quality; wherein, the network service quality is calculated by the defense end based on the suspicious data flow set and the normal data flow.

Preferably, the preset defense strategy in the suspicious traffic cleaning device corresponds to the expected SLA level; then the quantifying the defense result based on the target parameter set includes: using the target parameter set and the preset parameter set to determine the respective A set of parameter change values; wherein, the preset parameter set is a set of various parameters stored in advance without attacking data flow; the change value set of each parameter is compared with each of the expected SLA levels The parameter range is matched; if the matching is successful, it is determined that the defense effect of the defense end reaches the expected SLA level; if the matching is unsuccessful, it is determined that the defense effect of the defense end does not reach the expected SLA level.

Preferably, the method further includes: if the matching is unsuccessful, determining the previous defense strategy of the current defense strategy as the preset defense strategy; wherein the defense terminal stores a plurality of SLA levels arranged in order, And, a defense strategy corresponding to each SLA level, the smaller the SLA level, the higher the service level enjoyed by the target end, and the defense strategy corresponding to the previous SLA level is better than the defense strategy corresponding to the latter SLA level.

Preferably, the use of the target parameter set and the preset parameter set to determine the change value set of each parameter includes: calculating input agreement information and output based on the suspicious data flow set and the normal data flow set A set of changes in the rate of change of agreement information; wherein the input protocol information is extracted from the suspicious data flow set, and the output protocol information is extracted from the normal data flow; and, calculating the The standard deviation set between the core data set of the normal data flow volume and the preset core data set in the preset parameter set; wherein, the core data set includes the request response rate, the business success rate, and the total value of the 30x status code. Percentage, percentage of 40x status code, percentage of 50x status code, and time delay of normal user request; and, calculating between the host performance parameter and the preset host performance parameter in the preset parameter set And/or calculate the access success rate and the third variation value set of the preset access success rate in the preset parameter set; and/or calculate the network service quality And the fourth change value set of the preset network service quality in the preset parameter set.

Preferably, based on the suspicious data flow set and the normal data flow set, calculating the change set of the input agreement information and the change rate of the output agreement information includes: calculating the difference between syn information in the input direction and syn information in the output direction Value, the ratio of the difference to the syn information in the input direction is taken as the increase rate of the syn information; the difference between the syn-ack information in the input direction and the syn-ack information in the output direction is calculated, and the difference is compared with the The syn-ack information ratio in the input direction is used as the increase rate of the syn-ack information; the difference between the increase rate of the syn information and the increase rate of the syn-ack information is determined as the change amount set.

Preferably, the calculating the standard deviation set between the core data set of the normal data flow volume and the preset core data set in the preset parameter set includes: calculating the core data set and the preset core data Concentrated, for the first standard deviation of the request response rate, the second standard deviation for the business success rate, the third standard deviation for the proportion of 30x status codes, the fourth standard deviation for the proportion of 40x status codes, The fifth standard deviation for the proportion of 50x status codes and the sixth standard deviation for the time delay requested by normal users; the first standard deviation, the second standard deviation, the third standard deviation, and the The set of the fourth standard deviation, the fifth standard deviation, and the sixth standard deviation is determined as the set of standard deviations.

Preferably, the access success rate includes a request success rate and a request time delay; then the calculation of the access success rate and the third change value set of the preset access success rate in the preset parameter set includes : Calculate the request success rate in the access success rate and the change rate of the request success rate in the preset access success rate; calculate the difference between the request time delay in the access success rate and the request time delay in the preset access success rate Change amount; the change rate and the change amount are determined as the third change value set.

Preferably, the host performance parameter includes: the number of half-open connections of the host of the target end after receiving the first syn packet; the host CPU of the target end; the host memory of the target end; the connection of the target end Table; the host input and output times of the target end; and, the proportion of the incoming and outgoing traffic of the host of the target end.

Preferably, the network service quality includes: network delay brought in the process of cleaning the original data flow; network packet loss rate brought in the process of cleaning the original data flow; The TCP availability brought in the process of the original data flow; the UDP availability brought in the process of cleaning the raw data flow; and the jitter brought in the process of cleaning the raw data flow.

A system for quantifying defense results, including: a business end, a defense end located on a cloud platform, a target end, and a core route connected to the business end, the defense end, and the target end; the core route is used for copying The business end obtains the original data flow volume of the target end to obtain the copy data flow volume; the defense end is used to obtain the suspicious data flow volume collection, and the suspicious data flow volume collection is the defense end located on the cloud platform and the core routing traction business After receiving the raw data flow volume of the target end, it is composed of the data flow volume corresponding to each suspicious IP address in the suspicious IP address set included in the raw data flow volume, and the suspicious IP address set is Determined in the original data flow volume according to the preset detection rules; obtain the normal data flow volume, the normal data flow volume is the remaining after the defense end cleans the suspicious data flow volume set according to the preset defense strategy Data flow volume; authorized host performance parameters, the host performance parameters are the set of parameters extracted from the target end after the defense end sends the normal data flow volume to the target end; based on the target parameter set To quantify the defense result; wherein, the target parameter set includes at least: the suspicious data flow set, normal data flow, and host performance parameters.

Preferably, the defense end includes: a suspicious traffic detection device connected to the core route, configured to analyze the copy data flow volume according to a preset detection rule to obtain the suspicious IP address included in the copy data flow volume And send the set of suspicious IP addresses; a suspicious traffic cleaning device connected to the core route and the suspicious traffic detection device is used to obtain the set of suspicious IP addresses in the original data of the core route Pull the suspicious data flow collection in the flow volume, wherein the suspicious data flow collection is cleaned according to the preset defense strategy, and the suspicious data flow collection is the remaining normal data flow volume after the cleaning is forwarded to the target A cloud host connected to the suspicious traffic detection device, the suspicious traffic cleaning device, and the target terminal, for obtaining the suspicious data flow collection on the suspicious traffic detection device, the suspicious data flow The volume set contains the suspicious data flow volume corresponding to each suspicious IP address; the normal data flow volume is obtained on the suspicious traffic cleaning device, and after the normal data flow volume is sent to the target end, the target Obtain the host performance parameters representing the performance of the target end on the end.

Preferably, the system further includes: a service monitoring device connected to the cloud host, which is used to control a plurality of service hosts located in different geographic locations to access the target terminal, according to the success rate of the target terminal feedback And the request time delay, calculate the access success rate; send the access success rate to the cloud host; correspondingly, the target parameter set also includes the access success rate.

Preferably, the cloud host is further configured to calculate the network service quality based on the suspicious data flow volume set and the normal data flow volume; correspondingly, the target parameter set also includes the network service quality.

Preferably, the core route is also used to forward the data flow volume remaining after the suspicious data flow volume is collected by the suspicious data flow cleaning device from the original data flow volume to the target end.

Preferably, the cloud host is specifically configured to determine the change value set of each parameter by using the target parameter set and the preset parameter set; and compare the change value set of each parameter with each of the expected SLA levels. The parameter range is matched; if the matching is successful, it is determined that the defense effect of the defense end reaches the expected SLA level; if the matching is unsuccessful, it is determined that the defense effect of the defense end does not reach the expected SLA level.

Preferably, the cloud host is further configured to determine the previous defense strategy of the current defense strategy as the preset defense strategy in the case of unsuccessful matching; wherein, the preset parameter set is stored in advance The collection of various parameters in the case of no attack data flow; the defense end stores multiple SLA levels arranged in order, and a defense strategy corresponding to each SLA level. The smaller the SLA level, the target The higher the service level enjoyed by the terminal, and the defense strategy corresponding to the previous SLA level is better than the defense strategy corresponding to the latter SLA level.

Preferably, the host performance parameters include: the number of half-open connections of the host of the target end after receiving the first syn packet; the host CPU of the target end; the host memory of the target end; Connection table; host input and output times of the target end; and, the proportion of the in and out traffic of the host of the target end.

Preferably, the network service quality includes: network delay brought in the process of cleaning the original data flow; network packet loss rate brought in the process of cleaning the original data flow; The TCP availability brought in the process of the original data flow; the UDP availability brought in the process of cleaning the original data flow; and the jitter brought in the process of cleaning the raw data flow.

It can be seen from the above technical content that the present invention has the following beneficial effects: the embodiment of the present invention sets the defense end on the cloud platform, and the original data flow of the business end can be pulled to itself on the cloud platform defense end, and the business of the target end is generally It runs on the cloud platform, so the defense end can obtain the data flow volume of the target end on the cloud platform, and at the same time, the defense end can also obtain its own data flow volume. Therefore, under the cloud platform, the data flow volume of the business side, the target side and the defense side can be unified and centralized, so that the data flow volume of the three ends can be obtained. Because the data flow volume of the three parts of the business end, the defense end and the target end can be analyzed in a unified manner in the present invention, the evaluation angle and indicators for evaluating the defense result are more comprehensive, and the defense result is more accurate.

100‧‧‧Business side

200‧‧‧Defensive end

300‧‧‧Target

400‧‧‧Core routing

201‧‧‧Suspicious traffic detection device

202‧‧‧Suspicious flow cleaning device

203‧‧‧Cloud Host

500‧‧‧Business monitoring device

600‧‧‧Splitter

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are merely present For some of the embodiments of the invention, for those of ordinary skill in the art, other drawings may be obtained based on these drawings without creative work.

Fig. 1 is a schematic diagram of an existing network system architecture; Fig. 2 is a schematic structural diagram of a system for quantifying defense results disclosed in an embodiment of the present invention; Fig. 3 is a schematic structural diagram of another system for quantifying defense results disclosed in an embodiment of the present invention; 4 is a schematic structural diagram of another system for quantifying defense results disclosed in an embodiment of the present invention; FIG. 5 is a schematic structural diagram of another system for quantifying defense results disclosed in an embodiment of the present invention; FIG. 6 is a quantification disclosed by an embodiment of the present invention The flow chart of the method of defense result; FIG. 7 is a flowchart of calculating the defense result in the method of quantifying the defense result disclosed in the embodiment of the present invention.

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

The fundamental reason for the incomplete evaluation angles and evaluation indicators in the process of quantifying defense results in the prior art lies in the inability to centralize the data flow volume of the business side, the defense side, and the target side. The reason why the data flow of the three cannot be unified and centralized is: the data flow of the attacker comes from outside the network, the data flow of the defensive side is generally at the border or exit of the network, and the data flow of the target is generally managed by the user. , That is, the data flow of the three are not in the same system; and there is no interface between the business side, the target side and the defense side, that is, the data flow between the three cannot be shared through the interface; so the three data flow The amount is difficult to be centralized.

To this end, the present invention provides a system for quantifying defense results. As shown in Figure 2, the system for quantifying defense results includes: a business end 100, a defense end 200 located on a cloud platform, a target end 300, and a core route 400 connected to the business end 100, defense end 200, and target end 300 . In this embodiment, the defense end 200 is bypassed on one side of the core route 400.

The following is a detailed description of the role of each part of the system for quantifying defense results:

(1) Business end 100

In the present invention, the service terminal 100 may include multiple service hosts, each of which has a unique source address (IP address), and each service host can send data flow to the target terminal 300. Therefore, the raw data flow volume sent by the business end 100 to the target end 300 includes the data flow volume sent by multiple business hosts, and each data flow volume includes the source address of the business host, that is, the raw data flow volume includes There are source addresses (IP addresses) of multiple business hosts.

Since some business hosts are normal business hosts and some are attacking business hosts, part of the original data flow is the normal data flow sent by the normal business host, and the other is the attack data flow sent by the attacking business host.

The business end 100 may send the original data flow volume intended to be sent to the target end 300 to the core router 400.

(2) Core routing 400

The core router 400 is used to copy the original data flow volume of the target end by the copy business terminal to obtain the copy data flow volume.

The core router 400 can adopt the optical splitter method or the software program copy method to copy the original data flow volume of the target end 300 received by the business end 100, thereby obtaining the copy data flow volume consistent with the original data flow volume. This can facilitate the subsequent defense end 200 to detect the copy data flow volume to check whether there is an attack data flow volume in the copy data flow volume.

(3) Defensive end 200

As shown in FIG. 3, the defense terminal 200 specifically includes:

(a) Suspicious traffic detection device 201.

The suspicious traffic detection device 201 is connected to the core route 400, and is used to analyze the copy data flow volume according to a preset detection rule, obtain a set of suspicious IP addresses included in the copy data flow volume, and send the suspicious IP Address collection.

The preset detection rule in the suspicious traffic detection device 201 may be a plurality of offensive abnormal IP addresses. The data flow volume sent from the suspicious IP address is the suspicious data flow volume that may be offensive.

After the suspicious traffic detection device 201 obtains the flow volume of the copy data, it can extract all the IP addresses therein, and then can compare all the IP addresses with the abnormal IP addresses in the preset detection rule. When all IP addresses in the copy data flow volume contain abnormal IP addresses, it means that the copy data flow volume contains suspicious data flow volume.

All abnormal IP addresses included in the copy data flow are regarded as suspicious IP addresses, the set of all suspicious IP addresses is called a suspicious IP address set, and the suspicious IP address set is sent to the suspicious traffic cleaning device 202.

After determining the set of suspicious IP addresses, extract the suspicious data flow volume corresponding to each suspicious IP address from the copy data flow volume, and call the set of all suspicious data flow volume sets as the suspicious data flow volume set; The process volume collection is sent to the cloud host 203 for use by the cloud host 203 to calculate the defense result.

(b) Suspicious flow cleaning device 202.

The suspicious traffic cleaning device 202 connected to the core route 400 and the suspicious traffic detection device 201 is used to obtain the set of suspicious IP addresses and pull the suspicious data flow from the raw data flow of the core route 400 The collection, wherein the suspicious data flow collection is cleaned according to a preset defense strategy, and the suspicious data flow collection is the remaining normal data flow after cleaning, and forwarded to the target terminal 300.

After the suspicious traffic cleaning device 202 obtains the set of suspicious IP addresses, it pulls the suspicious data flow corresponding to each suspicious IP address from the original data flow of the core route 400, and composes the set of all suspicious data flows A collection of suspicious data flows.

After removing the suspicious data flow collection from the original data flow volume, the remaining amount is the data flow volume corresponding to the non-aggressive IP address. Therefore, this part of the data flow volume can be cleaned directly without being dragged to the suspicious flow cleaning device 202. The core router 400 can forward to the target terminal 300.

The suspicious data flow set is the data flow transmitted from the suspicious IP address, so the suspicious data flow in the suspicious data flow set may be the normal data flow or the attack data flow. Therefore, after obtaining the suspicious data flow set, the suspicious traffic cleaning device 202 needs to clean the attack data flow in the suspicious data flow set according to a preset defense strategy.

It can be seen that the suspicious flow cleaning device 203 in the present invention only needs to clean the suspicious data flow set in the original data flow, and does not need to clean the entire raw data flow. Since the data flow volume of the suspicious flow cleaning device 203 is reduced, the cleaning efficiency of the suspicious flow cleaning device 203 can be improved.

Theoretically, the data flow volume output after cleaning by the suspicious traffic cleaning device 202 is a normal data flow volume that is not offensive. Therefore, the normal data flow volume can be forwarded to the target end 300, so that the normal data flow volume received by the business end 100 from the target end 300 can be forwarded to the target end 300.

In reality, the preset defense strategy in the suspicious traffic cleaning device 202 is not necessarily the most suitable defense strategy for the target. That is, the data flow volume obtained after the suspicious data flow collection is cleaned according to the preset defense strategy still has the attack data flow volume (in this case, the defense strategy is too loose); or the data flow volume obtained after the cleaning is the original normal data flow The amount is washed away (in this case, the defense strategy is too tight).

Therefore, the suspicious traffic cleaning device 202 can collect the suspicious data flow volume and the remaining normal data flow volume after cleaning, and send it to the cloud host 203 for the cloud host 203 to calculate the defense result, so as to improve the preset defense strategy based on the defense result.

(c) Cloud host 203.

The cloud host 203 connected to the suspicious traffic detection device 201, the suspicious traffic cleaning device 202, and the target terminal 300 is used to obtain the suspicious data flow collection on the suspicious traffic detection device 201, the The suspicious data flow set includes the suspicious data flow corresponding to each suspicious IP address; the normal data flow is obtained on the suspicious flow cleaning device 202, and after the normal data flow is sent to the target terminal 300 , Acquire the host performance parameters representing the performance of the target 300 on the target 300; determine the target parameter set as the basis for the quantitative defense result; wherein the target parameter set includes at least: the suspicious data flow set, The normal data flow volume and the host performance parameters are described.

The cloud host 203 obtains the suspicious data flow collection on the suspicious traffic detection device 201, and obtains the normal data flow after cleaning according to the preset defense strategy on the suspicious traffic cleaning device 202, and uses these two parts to calculate the pre-cleaning and post-cleaning data. The rate of change of the data flow; use the rate of change as a basis for quantifying defense results.

Since the cleaned normal data flow volume is sent to the target end 300, the normal data flow volume will have a direct impact on the target end, that is, the performance status of the target end 300 will change first, for example, excessive CPU usage, unresponsiveness, etc. Wait. Therefore, after the normal data flow obtained after cleaning is sent to the target end 300, the host performance parameters of the target end can be extracted, and the host performance parameters can be used as a basis for quantifying the defense result.

Wherein, the host performance parameters include: the number of half-open connections of the host of the target end after receiving the first syn packet; the host CPU of the target end; the host memory of the target end; the connection of the target end Table; the host input and output times of the target end; and, the proportion of the incoming and outgoing traffic of the host of the target end.

Under the system for quantifying defense results provided by the present invention, the defense end 200 located on the cloud platform can pull the original data flow of the business end 100 to itself through the routing scheduling strategy on the core route; the business of the target end 300 is generally Running on a cloud platform, the defense end 200 can obtain the data flow volume of the target end 300 on the cloud platform; at the same time, the defense end 200 located on the cloud platform can also obtain its own data flow volume on the cloud platform. Therefore, the data flow volume of the business end 100, the target end 300, and the defense end 200 can be unified and centralized on the cloud platform.

In addition, because the data flows of the business end 100, the target end 300, and the defense end 200 all pass through the cloud platform, the cloud platform has the function of a unified data format. Therefore, the data format of the three can be unified on the cloud platform, which can facilitate unified analysis of the data flow volume of the three. Therefore, on the cloud platform, the defense end 200 can use the ability of big data analysis to analyze the data flow of the business end 100, the target end 300, and the defense end 200 at the same time. Because the evaluation angle and indicators of the quantitative defense results are relatively high. Comprehensive, so you can get accurate defense effects.

In order to make the defense result calculated by the cloud host 203 more accurate, as shown in FIG. 4, the system for quantifying the defense result provided by the present invention further includes: a service monitoring device 500 connected to the cloud host.

The service monitoring device 500 is used to control multiple service hosts located in different geographic locations to access the target terminal 300, and calculate the access success rate according to the request success rate and the request time delay returned by the target terminal 300; The success rate is obtained and sent to the cloud host 203. The access success rate is taken as a member of the target parameter set, so that the cloud host 203 can calculate the defense result.

After the suspicious traffic cleaning device 202 sends the cleaned normal data flow to the target 300, the normal data flow (if the cleaning effect is not good, it may carry the attack data flow) may affect the normal operation of the target. For example, assuming that the target terminal is "Taobao.com", after the normal data flow is sent to the target terminal, it may cause users to be unable to open the "Taobao" page normally.

Therefore, the service monitoring device 500 can control multiple service hosts located at different addresses to access the target end 300 to calculate the access success rate of the target end 300, and check whether the normal data flow volume after cleaning is based on the access success rate Affect the normal business of the target end.

For example, controlling geographic locations for multiple business hosts such as Shenzhen, Beijing, Shanghai, and Guangzhou to access "Taobao.com". According to whether "Taobao" can open the page and the speed of opening the page, calculate the access of multiple business hosts. Take the success rate. Then, the average access success rate of multiple service hosts is taken as the access success rate of "Taobao.com".

After the access success rate of the target terminal 300 is obtained, the access success rate is taken as a member of the target parameter set, so that the cloud host 203 can calculate the defense result.

In addition, the target parameter set for quantifying the defense result may also include: network service quality.

When the defense end 200 cleans the suspicious data flow collection, it may cause overall network jitter, resulting in a decrease in network service quality, a decrease in the access success rate of the target end 300, and a decrease in host performance parameters, thereby affecting the defense results Calculation. Therefore, the cloud host 203 is also used to calculate the network service quality based on the suspicious data flow set and the normal data flow set; and use the network service quality as a member of the target parameter set. This allows the cloud host 203 to consider the network service quality when calculating the defense result, thereby obtaining a reasonable defense effect.

Wherein, the network service quality includes: the network service quality includes: network delay caused in the process of cleaning the raw data flow; network packet loss caused in the process of cleaning the raw data flow Rate; TCP availability brought in the process of cleaning the original data flow; UDP availability brought in the process of cleaning the raw data flow; and, jitter brought in the process of cleaning the raw data flow .

The system of quantifying defense results shown in Figure 2 to Figure 4 is applicable to both optical fiber networks and non-optical fiber networks. In the optical fiber network, the amount of data flow is large, so the rate of copying the original traffic using core routing is slow. In order to speed up the process of copying the original data flow volume, the present invention provides a system suitable for the quantitative defense result of the optical network.

As shown in Figure 5, the system for quantifying defense results of the present invention includes: a business end 100, an optical splitter 600 connected to the business end 100, a defense end 200, a target end 300 located on the cloud platform, and, The optical splitter 600, the defensive end 200 and the target end 300 are connected to the core route 400. In this embodiment, the defense end 200 is bypassed on one side of the core route 400.

In this embodiment, the splitter 600 implements the process of copying the original traffic sent from the service end 100 to the target end 300 to obtain the copy data flow volume, and sends the copy data flow volume and the original data flow volume to the core router 400. The other content in this embodiment is consistent with the content shown in FIGS. 2 to 4, and will not be repeated here.

On the basis of the system for quantifying defense results shown in Figures 2 to 5, the following describes an embodiment of the method for quantifying defense results of the present invention. This embodiment is applied to the cloud host at the defense end of the system for quantifying defense results. As shown in FIG. 6, the method specifically includes the following steps S601 to S602:

Step S601: Obtain a set of suspicious data flow volumes; wherein the set of suspicious data flow volumes is determined by the original data flow volume of the target end after the defensive end of the cloud platform receives the original data flow volume of the target end via the core routing traction service end. The set of suspicious IP addresses included is composed of a data flow volume corresponding to each suspicious IP address, and the suspicious IP address set is determined in the original data flow volume according to a preset detection rule.

Step S602: Obtain normal data flow volume; wherein, the normal data flow volume is the remaining data flow volume after the suspicious data flow volume set is cleaned by the defense end according to a preset defense strategy.

Step S603: Authorize host performance parameters; wherein, the host performance parameters are a set of parameters extracted from the target end after the defense end sends the normal data flow volume to the target end.

Step S604: Quantify the defense result based on the target parameter set; wherein, the target parameter set includes at least: the suspicious data flow set, the normal data flow set, and the host performance parameter.

In addition, the target parameter set also includes: the access success rate sent by the service monitoring device connected to the defense end; wherein the access success rate is that the service monitoring device is controlling a plurality of devices located in different geographic locations. After the service terminal receives the target terminal, it is calculated according to the request success rate and the request time delay returned by the target terminal.

Network service quality; wherein, the network service quality is calculated by the defense end based on the suspicious data flow collection and the normal data flow.

The process by which the cloud host on the defense end obtains the target parameter set has been clearly explained in the system embodiment for quantifying the defense result shown in Figure 2-Figure 5, and will not be repeated here.

It can be seen from this that the present invention has the following beneficial effects: in the embodiment of the present invention, the defense end is set on the cloud platform, and the original data flow of the business end can be pulled to itself on the cloud platform defense end, and the business of the target end is generally in the cloud. It runs on the platform, so the defense end can obtain the data flow volume of the target end on the cloud platform, and at the same time, the defense end can also obtain its own data flow volume. Therefore, under the cloud platform, the data flow volume of the business side, the target side and the defense side can be unified and centralized, so that the data flow volume of the three ends can be obtained. Because the data flow volume of the three parts of the business end, the defense end and the target end can be analyzed in a unified manner in the present invention, the evaluation angle and indicators for evaluating the defense result are more comprehensive, and the defense result is more accurate.

The defense result can be calculated after the target parameter set is obtained. Before introducing the content of calculating the defense result, first explain the defense strategy and SLA level used by the suspicious traffic cleaning device in the defense end. Among them, SLA is the abbreviation of Service-Level Agreement, which means service level agreement. SLA is a contract between a network service provider and a customer, which defines terms such as service type, service quality, and customer payment.

There are multiple defense strategies pre-stored in the defense end, and one defense strategy corresponds to a theoretical SLA level that should be achieved. For example, the first SLA level corresponds to the first defense strategy, the second SLA level corresponds to the second defense strategy, the third SLA level corresponds to the third defense strategy, and so on. In addition, the service quality of the first SLA level, the second SLA level and the third SLA level are gradually reduced for users. Similarly, the first defense strategy, the second defense strategy, and the third defense strategy are for attack traffic. Gradually become loose. That is, the tighter the defense strategy, the better the defense result, which makes the SLA level of the target end higher.

Before using the defensive end to clean the original traffic, the user of the target end 300 negotiates with the network service provider and sets the expected SLA level that the target end 300 hopes to achieve. The network service provider will use the defense strategy corresponding to the expected SLA level as the preset defense strategy, adopt the preset defense strategy to block the attack data flow volume of the attack target, and make the final defense result reach the expected SLA level desired by the user.

In order to make the target end reach the expected SLA level, the suspicious traffic cleaning device shown in FIG. 2 is preset with a preset defense strategy corresponding to the expected SLA level. Theoretically, this defense strategy can make the defense result reach the corresponding expected SLA level. However, with the continuous changes in the amount of attack data flow, the amount of attack data flow may break through the defense strategy and attack the target end, thereby making the SLA level on the target end lower than the expected SLA level.

Therefore, it can be calculated whether the defense effect obtained by the target end reaches the expected SLA level. As shown in Figure 7, it includes the following steps:

Step S701: Use the target parameter set and the preset parameter set to determine the change value set of each parameter; wherein, the preset parameter set is a set of various parameters stored in advance without attacking data flow.

The detailed calculation process will be described in detail after this embodiment.

Step S702: Determine whether the matching is successful, that is, match the change value set of each parameter with each parameter range in the expected SLA level, and determine whether the matching is successful.

The range of each parameter of each SLA level is stored in the cloud host. Compare each parameter change value calculated according to the target parameter set with the parameter range of the expected SLA level.

Step S703: If the matching is successful, it is determined that the defense effect of the defense end reaches the expected SLA level.

If the change value of each parameter is within the range specified by the expected SLA level, it means that the current defense effect has reached the expected defense effect; you can continue to follow the preset defense strategy in the suspicious traffic cleaning device to continue to access the data flow volume of the target end Clean.

Step S704: If the matching is unsuccessful, determine the previous defense strategy of the current defense strategy as the preset defense strategy; enter step S701 again. Wherein, the defense terminal stores multiple SLA levels arranged in order, and a defense strategy corresponding to each SLA level. The smaller the SLA level, the higher the service level enjoyed by the target terminal, and the previous one The defense strategy corresponding to the SLA level is better than the defense strategy corresponding to the latter SLA level.

If the matching is unsuccessful, it is determined that the defense effect of the defense end has not reached the expected SLA level. That is: if the change value set of each parameter is not within the range specified by the expected SLA level, it means that the current defense effect has not reached the expected defense effect, that is, the preset defense strategy in the suspicious traffic cleaning device is too loose to achieve the expected SLA grade. Therefore, the defense strategy needs to be tightened so that the defense effect after the defense strategy cleansing reaches the desired SLA level.

Therefore, the previous defense strategy of the current defense strategy is selected and determined as the preset defense strategy. Then, according to the latest preset defense strategy, continue to clean the data flow volume of the target end, and calculate the defense result (variation value set of each parameter) according to the method of the present invention, and judge the defense result (variation value set of each parameter) Whether the desired SLA level is reached (the range of various parameters of the desired SLA level). If the defense result still does not reach the expected SLA level, continue to tighten the defense strategy, repeat the process of calculating the defense result, and directly determine that the defense result reaches the expected SLA level.

The step S701: the step of determining the change value set of each parameter by using the target parameter set and the preset parameter set will be described in detail below in conjunction with specific application scenarios.

(1) Flow performance parameters

That is, according to the suspicious data flow volume set and the normal data flow volume, the change amount set of the input agreement information and the change rate of the output agreement information is calculated. Wherein, the input protocol information is extracted from the suspicious data flow volume set, and the output protocol information is extracted from the normal data flow volume.

The transmission mode between the business end and the target end is one-to-one. For example, the business end sends a connection establishment request to the target end, and the target end sends a connection confirmation instruction to the business end. Therefore, the amount of information sent by the business end to the target end should be consistent with the amount of information sent by the target end to the business end. When the amount of output information or the amount of input information suddenly increases, it indicates that the cleaning effect of the defense end is not good.

The following uses specific three types of traffic attacks as examples to describe this step in detail:

(a) The target is attacked by syn flood

Under normal circumstances, the business end sends a syn (can establish a connection?) request information to the target end, the target end will return syn-ack (can + please confirm) information, and the business end sends an ack (confirmation) message to the target end again. Establish a connection between the two.

In the case of a syn flood attack on the target end (that is, the attacking end sends a large amount of syn request information to the target end), if the cleaning effect of the defense strategy is not good, the syn-ack information in the output direction will increase; however, the information sent by the business end The third ack message will decrease.

Thus, increasing the ratio information before calculating syn cleaning and after cleaning _syn P, and increase the ratio of syn-ack message before washing and after washing P _syn-ack.

P _syn =(pps _syn -pps ^` _syn )/pps _syn

P _syn-ack =(pps _syn-ack -pps ^` _syn-ack )/pps _syn-ack

P ₁ =P _syn -P _syn-ack

Among them, pps _syn is the amount of syn information before cleaning according to the preset defense strategy, pps ^{`</sup> <sub>syn</sub> is the amount of syn information after cleaning according to the preset defense strategy; pps <sub>syn-ack</sub> is the syn-ack information before cleaning according to the preset defense strategy Number, pps <sup>`} _syn is the number of syn-ack messages cleaned according to the preset defense strategy, and P1 represents the defense result of the defense end.

Ideally, the syn packet in the input direction and the syn-ack information in the output direction are 1:1, that is, P1=0. Therefore, when the value of P1 is larger, most of the syn information representing the input direction has not received a response. At this time, the defense result is worse.

(b) The target is attacked by ack flood

Under normal circumstances, the business end sends an ack (confirmation) request message to the target end. When the target end confirms that it has not established a connection with the business end, the business end sends rst (reset) information to the target end. That is, if the target end receives a connection that is obviously not its own, it sends a reset packet to the service end.

In the case of an ack flood attack on the target end, if the cleaning effect of the defense end is not good, the rst information will increase. Therefore, calculate the increase ratio P _ack before and after ack information cleaning, and calculate the increase ratio P _rst before and after the rst information cleaning.

P _ack =(pps _ack -pps ^` _ack )/pps _ack

P _rst =(pps _rst -pps ^` _rst )/pps _rst

P2=P _ack -P _rst

Among them, pps _ack is the amount of rst information before cleaning according to the preset defense strategy, pps ^{`</sup> <sub>ack</sub> is the amount of rst information after cleaning according to the preset defense strategy, pps <sub>rst</sub> is the amount of rst information before cleaning according to the preset defense strategy, pps <sup>`} _rst is the amount of rst information cleaned according to the preset defense strategy, and P2 represents the defense result of the defense end.

Ideally, the ack information in the input direction and the rst information in the output direction are 1:1, that is, P2=0. Therefore, when the value of P2 is larger, most of the ack messages representing the input direction are not responded. At this time, the defense result is worse.

(c) The target is attacked by icmp flood

In the case that the target end is attacked by icmp flood, if the cleaning effect of the defense end is not good, the icmp response information will increase. Therefore, calculate the increase ratio _Picmp of icmp information before and after cleaning, and calculate the increase ratio of icmp response information before and after cleaning _{Picmp response} .

P _icmp =(pps _icmp -pps ^` _icmp )/pps _icmp

P _icmp-reponse =(pps _icmp-reponse -pps ^` _icmp-reponse )/pps _icmp-reponse

P3=P _icmp -P _icmp-reponse

Wherein, pps _icmp is the number icmp information before cleaning, pps <sub>^{`icmp</sup></sub> after washing quantity icmp message, pps <sub>icmp-reponse</sub> is the number icmp Response information before cleaning, <sup>pps`} _icmp-reponse is the number icmp Response information cleaning, P3 representatives Defensive results on the defensive side.

Ideally, the icmp information in the input direction and the icmp response information in the output direction are 1:1, that is, P3=0. Therefore, when the value of P3 is larger, most of the icmp information representing the input direction does not receive a response. At this time, the defense result is poor.

The above lists three examples of calculating the proportion of input agreement information and output agreement information. It is understandable that the proportion of other traffic types that characterize the defense result can also be calculated to evaluate the defense result. I will not list them all here.

This step is mainly used to evaluate the defense results of traffic-based attacks. Among them, syn flood attack, ack flood attack and icmp flood attack are all flow-based attacks. Therefore, after obtaining all the ratios (P1, P2, and P3) for evaluating defense results, calculate the average of multiple defense result ratios as the defense result against the evaluation traffic type attack.

Since this step is mainly used to evaluate the defense result of traffic-based attacks, syn flood attack is a typical representative of traffic-based attacks, so P1 can also be directly used as the defense result of traffic-based attacks.

Another manifestation of the flow performance parameter is: calculating the standard deviation set between the core data set of the normal data flow volume and the preset core data set in the preset parameter set.

The main purpose of this step is to evaluate whether the proportion of normal request information and abnormal request information meets expectations by obtaining the proportion of request information and corresponding response information in real time and analyzing the change of the http status code.

In the specific process of use, the core data set that characterizes the normal data flow can be calculated; the core data set includes the request response rate, the business success rate, the proportion of 30x status codes, the proportion of 40x status codes, and the 50x status. The proportion of codes and the time delay of normal user requests.

The following is a detailed description of each parameter in the core data set:

(a) The request response rate of the website P _request

The ratio of request information to response information at the target end is constantly changing. Take the statistical period t as an example. For example, if an attack suddenly starts from t1 to t2, the http request information and response information will increase. When the defense result of the defensive side is not good, there will be very little response information for normal request information. Therefore, the proportion of request information and response information is calculated. If the cleaning effect of the defense end is not good, then the ratio of request information and response information will be lower than a certain limit value.

P _request =C _{have_response} /C _{request_total} * 100%

Among them, P _request is the request response rate of the website, C _{have_response} is the number of response messages, and C _{request_total} is the total number of requested messages.

(b) The proportion of 200 ok messages

The 200 ok information is information indicating the success of the service request, and P _{200 ok} indicates the success rate of the service. The request response ratio P _request can only measure the current network http traffic situation. And P _{200 ok} can reflect the probability of response from the business end.

_{P 200ok = C have_200ok / C have_response} * 100%

Among them, C _{have_200ok} represents the information that the business request is successful, and C _{have_response} is the number of response messages.

(c) The proportion of status codes such as 30x, 40x, 50x, etc.

Status codes such as 30x, 40x, and 50x will appear when there is an error packet loss in the normal data flow. A large number of GET packets cannot be responded, and 40x and 50x error status codes are generally returned. Therefore, the proportion of status codes can be used to measure the amount of normal data flow in the defense.

It is worth noting that some protection systems use man-machine identification mechanisms to determine whether the receiver is a real browser. For example, the url redirect algorithm commonly used in the industry, that is, by returning a 302 (30x) status code to determine whether the recipient is a program or a real browser, so the rapid increase in the 302 (30x) status code in the network is also It can be used as an indicator to evaluate the defense results.

The above three indicators can comprehensively measure the cleaning rate of CC attacks

P _30x =C _{have_30x} /C _{have_response} * 100%

P _40x =C _{have_40x} /C _{have_response} * 100%

P _50x =C _{have_500} /C _{have_response} * 100%

Among them, P _30x represents the proportion of 30x status codes in the response message, C _{have_30x} represents the proportion of 30x messages; P _40x represents the proportion of 40x status codes in the response message, and C _{have_40x} represents the proportion of 40x messages; P _50x represents the proportion of the status code of 50x in the response message, and C _{have_50x x} represents the number of messages of 50x.

(d) RTT (request time delay) of a normal user's request. Assuming that the user has initiated n requests during the attack time, the average time delay of the user is used as a reference when evaluating this attack event.

(e) Determine the core data set

P _request , P _200ok , P _30x , P _40x , P _50x , T ₀ obtained through (a), (b), (c) and (d) are used to construct a core data set M, which defines the core traffic indicators at the time of the attack data of.

In order to determine the defense result more accurately, an array M of multiple core data sets can be calculated. For example, count n core data sets to form an array M, then M={M ₁ ,M ₂ ,...M _i ...M _n }; where M _i ={P _request ,P _200ok ,P _30x ,P _40x ,P _50x ,T ₀ }, i=1, 2...n.

Based on historical big data analysis of services in the cloud environment, another core data set N is obtained. I.e., _{N = {P` request, P` 200ok} , P` 30x, P` 40x, P` 50x, T` 0}. N represents the proportion of each indicator when there is no attack, that is, the standard core data set.

Ideally, there will be no significant fluctuations in the changes in these indicators. However, when the defense strategy is not ideal, it may cause rapid changes in individual indicators. For example, when there is a huge change curve of the 200ok status code compared with the same period in history in a certain attack event, it means that the defense result is poor and the response to the normal request information decreases.

Therefore, the present invention uses the standard deviation to evaluate the impact of the defense strategy on business indicators during an attack, takes the core data set N as the average value, and then calculates the standard deviation for each parameter. Taking the indicator P _request as an example, the formula for calculating the standard deviation is explained in detail:

為第i個P_request的值，n為陣列M中核心資料集的個數。P`<sub>request</sub>在此 處代表平均值，核心資料集N中的P`_request。 Among them, σ _requst represents the standard deviation of P _request ,

Is the value of the i-th P _request , and n is the number of core data sets in the array M. P` <sub>request</sub> here represent the mean, P` _request the core data set N.

Calculated in the above manner array _{M = {M 1, M 2} , ... M i ... M n} with standard N for each parameter difference to obtain a plurality of standard deviation _{σ = {σ requst, σ 200ok} , σ _{30 x} ,σ _{40 x} ,σ _{50 x} ,σ ₀ }. When the standard deviation is smaller, the defense result is better, and when the standard deviation is larger, the defense result is worse.

(2) Host performance parameters

That is, the second change value set between the host performance parameter and the preset host performance parameter in the preset parameter set is calculated.

After the suspicious traffic cleaning device transmits the normal data flow after cleaning according to the preset defense strategy to the target end, the host performance parameters of the target end are acquired. This is because the victim host first changes its state during a DDos attack. Obtaining the performance parameters of the victim host can directly quantify the impact of the attack traffic on the host. In some cases, host performance parameters are more convenient than monitoring changes in network traffic.

For example, a typical example is when a TCP slow connection occurs, there may be no abnormalities in the network traffic. However, by observing the connection table of the target host, there are a large number of residual connections. Therefore, by evaluating host performance parameters, it is an important factor to measure the defense end.

Referring to Table 1, the host performance parameters include: the number of half-open connections of the host at the target end after receiving the first syn packet, the host CPU at the target end, the host memory at the target end, and the host memory at the target end A connection table, the number of input and output of the host at the target end, and the proportion of the in and out traffic of the host at the target end.

(3) Success rate of access

That is, calculating the access success rate and the third change value set of the preset access success rate in the preset parameter set.

The access success rate may include the request success rate and the request time delay, and then calculate the rate of change between the request success rate and the preset access success rate, and calculate the amount of change between the request time delay and the preset request time delay, And use the change rate and the change amount as the third change value set.

Because the attack traffic will affect the target end, and then affect the target end's business performance. In order to determine the current service performance of the target terminal (which can normally respond to normal service requests), the embodiment of the present invention controls the normal service terminal to access the target terminal. Then, by calculating the change rate of the request success rate and the change amount of the request time delay, the impact of the attack data flow volume on the target is determined, which can reflect the quality of the defense result from the side.

(4) Network service quality.

That is, the network service quality and the fourth change value set of the preset network service quality in the preset parameter set are calculated.

Based on the distributed environment, the defense strategy against the attacked host may affect the overall network status. Therefore, the consequence is that other unattended hosts will also be affected. Therefore, when evaluating the success rate of defense, the overall network performance parameters are also required as the evaluation criteria.

Refer to Table 2. The network environment parameters include: network delay brought in the process of cleaning the original data flow, network packet loss rate brought in the process of cleaning the raw data flow, and the process of cleaning the raw data The availability of TCP in the process, the availability of UDP in the process of cleaning the flow of raw data, and the jitter caused by the process of cleaning the flow of raw data.

The following describes the specific process of matching the change value set of each parameter calculated based on the target parameter set and the parameter range of the expected SLA level. To evaluate whether the defense result meets the user's final expected SLA level.

First: flow performance parameters

When DDoS is under different attacks, the network traffic changes differently. In order to quantify the impact of DDoS defense at the traffic level. Referring to Table 3, the present invention defines SLA indicators of key agreement information in the network. For example, the upper limit of TCP retransmission rate, when it is higher than a certain upper limit, it means that the defense result has not reached the expected SLA level.

Second, access success rate (request success rate and request time delay)

A set of business performance indicators that the application server needs to meet. Therefore, when evaluating whether the ddos defense result meets the user's SLA target, refer to Table 4, which can be assessed by whether it meets the business performance indicators in the following table.

Third, the host performance parameters

Based on the feedback to the host status, according to different attack types, determine whether it meets the current host SLA indicators. See Table 5 for the parameters that characterize the status of the host.

Fourth, network service quality

Based on a decentralized environment, the defense strategy against the attacked host may affect the overall network state, so the consequence is that other unattended hosts will also be affected. Therefore, when evaluating the defense success rate, the overall network service quality is also required as the basis for evaluation. See Table 6. The following key core indicators are defined to characterize the SLA parameters of this dimension.

Based on the range set by each parameter index of the expected SLA level above, it is determined whether the change value set of each parameter is within the range of each parameter of the expected SLA level. If the change value set of each parameter is within the range of each parameter of the expected SLA level, it is determined that the defense effect of the defense strategy has reached the expected SLA level, otherwise it means that the defense effect of the defense strategy has not reached the expected SLA level.

The above is all the content provided by the present invention. From the above technical content, it can be concluded that: in the embodiment of the present invention, the defense end is set on the cloud platform. On the cloud platform defense end, the original data flow of the business end can be pulled to itself, and the business of the target end Generally, it runs on a cloud platform, so the defense end can obtain the data flow volume of the target end on the cloud platform, and at the same time, the defense end can also obtain its own data flow volume. Therefore, under the cloud platform, the data flow volume of the business side, the target side and the defense side can be unified and centralized, so that the data flow volume of the three ends can be obtained. Because the data flow volume of the three parts of the business end, the defense end and the target end can be analyzed in a unified manner in the present invention, the evaluation angle and indicators for evaluating the defense result are more comprehensive, and the defense result is more accurate.

If the function described in the method of this embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium readable by a computing device. Based on this understanding, the part of the embodiment of the present invention that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The software product is stored in a storage medium and includes a number of instructions to make a A computing device (which can be a personal computer, a server, a mobile computing device, or a network device, etc.) executes all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage media include: USB flash drives, mobile hard disks, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disks or optical disks, etc. that can store programs The medium of the code.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown in this document, but should conform to the widest scope consistent with the principles and novel features disclosed in this document.

100‧‧‧Business side

200‧‧‧Defensive end

201‧‧‧Suspicious traffic detection device

202‧‧‧Suspicious flow cleaning device

203‧‧‧Cloud Host

300‧‧‧Target

400‧‧‧Core routing

Claims (20)

A method for quantifying defense results, which is characterized in that it comprises: obtaining a set of suspicious data flow volume, where the suspicious data flow volume set is after the defense end located on the cloud platform receives the original data flow volume of the target end via the core routing traction business end, It is composed of the data flow volume corresponding to each suspicious IP address in the suspicious IP address set included in the raw data flow volume, and the suspicious IP address set is used in the raw data flow Obtain the normal data flow volume, the normal data flow volume is the remaining data flow volume after the defensive end cleans the suspicious data flow volume set according to the preset defense strategy; authorized host performance parameters, the The host performance parameter is a set of parameters extracted on the target end after the defense end sends the normal data flow volume to the target end; the defense result is quantified based on the target parameter set; wherein, the target parameter The collection includes at least: the suspicious data flow collection, normal data flow, and host performance parameters. The method according to claim 1, wherein the target parameter set further includes: an access success rate sent by a service monitoring device connected to the defense end; wherein the access success rate is the service monitoring device After controlling multiple service terminals located in different geographic locations to access the target terminal, it is calculated according to the request success rate and the request time delay returned by the target terminal. The method according to claim 2, wherein the target parameter set further includes network service quality; wherein, the network service quality is calculated by the defense terminal based on the suspicious data flow set and the normal data flow of. The method according to claim 1, wherein the preset defense strategy corresponds to a desired service level agreement (SLA) level; then the quantifying the defense result based on the target parameter set includes: using the target parameter set and the preset parameter The set determines the change value set of each parameter; wherein, the preset parameter set is a set of each parameter stored in advance without attacking data flow; the change value set of each parameter is compared with the expected Each parameter range in the SLA level is matched; if the matching is successful, it is determined that the defense effect of the defense end reaches the expected SLA level; if the matching is unsuccessful, it is determined that the defense effect of the defense end does not reach the expected SLA level. The method according to claim 4, which further includes: if the matching is unsuccessful, determining the previous defense strategy of the current defense strategy as the preset defense strategy; wherein the defense end stores a button Multiple SLA levels arranged in sequence, and a defense strategy corresponding to each SLA level. The smaller the SLA level, the higher the service level enjoyed by the target end, and the corresponding defense strategy of the previous SLA level is better than the latter One SLA level corresponding defense Imperial strategy. The method according to claim 4, wherein the using the target parameter set and the preset parameter set to determine the change value set of each parameter includes: according to the suspicious data flow volume set and the normal data flow Calculate the change set of the input agreement information and the change rate of the output agreement information; wherein the input agreement information is extracted from the suspicious data flow set, and the output agreement information is obtained from the normal data flow set And, calculating the standard deviation set between the core data set of the normal data flow volume and the preset core data set in the preset parameter set; wherein, the core data set includes request response rate, business The success rate, the proportion of 30x status codes, the proportion of 40x status codes, the proportion of 50x status codes, and the time delay of normal user requests; and, calculating the host performance parameters and the preset parameter set And/or calculate the access success rate and the third variation value set of the preset access success rate in the preset parameter set; and/or Calculate the network service quality and the fourth change value set of the preset network service quality in the preset parameter set. The method according to claim 6, wherein the calculation of the change amount set of the input agreement information and the change rate of the output agreement information based on the suspicious data flow set and the normal data flow set includes: calculating the syn information of the input direction Difference with syn information in output direction Value, the ratio of the difference to the syn information in the input direction is taken as the increase rate of the syn information; the difference between the syn-ack information in the input direction and the syn-ack information in the output direction is calculated, and the difference is compared with the The syn-ack information ratio in the input direction is used as the increase rate of the syn-ack information; the difference between the increase rate of the syn information and the increase rate of the syn-ack information is determined as the change amount set. The method according to claim 6, wherein the calculating the standard deviation set between the core data set of the normal data flow volume and the preset core data set in the preset parameter set includes: calculating the The core data set and the default core data set are for the first standard deviation of the request response rate, the second standard deviation for the business success rate, the third standard deviation for the proportion of 30x status codes, and the total value for 40x status codes. The fourth standard deviation of the proportion, the fifth standard deviation of the proportion of the 50x status code, and the sixth standard deviation of the time delay for the normal user request; the first standard deviation, the second standard deviation, The set of the third standard deviation, the fourth standard deviation, the fifth standard deviation, and the sixth standard deviation is determined as the standard deviation set. The method according to claim 6, wherein the access success rate includes a request success rate and a request time delay; then the calculation of the access success rate and the preset access success rate in the preset parameter set The third change value set of includes: calculating the request success rate and the preset access success rate in the access success rate The change rate of the request success rate in the medium; calculate the change amount of the request time delay in the access success rate and the request time delay in the preset access success rate; determine the change rate and the change amount as the first Set of three changing values. The method according to claim 1 or 6, wherein the host performance parameters include: the number of half-open connections of the host at the target end after receiving the first syn packet; the host CPU at the target end; and the target The host memory of the target end; the connection table of the target end; the number of input and output of the host of the target end; and the proportion of the incoming and outgoing traffic of the host of the target end. The method according to claim 3 or 6, wherein the network service quality includes: network delay caused in the process of cleaning the original data flow; Network packet loss rate; TCP availability brought in the process of cleaning the raw data flow; UDP availability brought in the cleaning of the raw data flow; and, in the process of cleaning the raw data flow Jitter (jitter). A system for quantifying defense results, characterized by comprising: a business end, a defense end located on a cloud platform, a target end, and a core route connected to the business end, the defense end, and the target end; the core route , Used to copy the business end to obtain the original data flow volume of the target end, and obtain the copy data flow volume; the defense end is used to obtain the suspicious data flow volume set, and the suspicious data flow volume set is the defense end of the cloud platform. After the core routing traction service terminal receives the original data flow volume of the target end, it is composed of the data flow volume corresponding to each suspicious IP address in the suspicious IP address set included in the raw data flow volume. The suspicious IP The address set is determined in the original data flow volume according to a preset detection rule; the normal data flow volume is obtained, and the normal data flow volume is the default defense strategy for the suspicious data flow volume set by the defense end Data flow volume remaining after cleaning; authorized host performance parameters, where the host performance parameter is a set of parameters extracted on the target end after the defense end sends the normal data flow volume to the target end; The defense result is quantified based on the target parameter set; wherein the target parameter set includes at least: the suspicious data flow set, normal data flow, and host performance parameters. The system according to claim 12, wherein the defense end includes: a suspicious traffic detection device connected to the core route, configured to analyze the flow volume of the copy data according to a preset detection rule to obtain the copy data The set of suspicious IP addresses included in the material flow, and the set of suspicious IP addresses are sent; a suspicious traffic cleaning device connected to the core route and the suspicious traffic detection device is used to obtain the suspicious IP address Collecting, pulling the suspicious data flow collection from the original data flow volume of the core route, wherein the suspicious data flow collection is cleaned according to a preset defense strategy, and the suspicious data flow collection is collected after cleaning. The normal data flow volume is forwarded to the target end; the cloud host connected to the suspicious traffic detection device, the suspicious traffic cleaning device, and the target end is used to obtain the suspicious traffic on the suspicious traffic detection device Data flow volume collection, the suspicious data flow volume set includes the suspicious data flow volume corresponding to each suspicious IP address; the normal data flow volume is acquired on the suspicious traffic cleaning device, and the normal data flow volume After being sent to the target terminal, the host performance parameter representing the performance of the target terminal is obtained on the target terminal. The system according to claim 13, wherein the system further includes: a service monitoring device connected to the cloud host, which is used to control a plurality of service hosts located in different geographic locations to access the target end, and according to the The access success rate and the request time delay reported by the target end are calculated, and the access success rate is calculated; the access success rate is sent to the cloud host; correspondingly, the target parameter set also includes the access success rate. The system according to claim 13, wherein the cloud host is also used to gather and collect data based on the suspicious data flow The normal data flow volume calculates the network service quality; correspondingly, the target parameter set also includes the network service quality. The system according to claim 13, wherein the core route is also used to forward the remaining data flow after the suspicious data flow is collected by the suspicious data flow cleaning device from the original data flow to the target end. The system according to any one of claim items 13 to 15, wherein the cloud host is specifically configured to determine the change value set of each parameter using the target parameter set and the preset parameter set; The set of change values of is matched with each parameter range in the expected SLA level; if the matching is successful, it is determined that the defense effect of the defense end has reached the expected SLA level; if the matching is unsuccessful, it is determined that the defense effect of the defense end has not reached the required State the expected SLA level. The system according to claim 17, wherein the cloud host is further used to determine the previous defense strategy of the current defense strategy as the preset defense strategy in the case of unsuccessful matching; The preset parameter set is a set of various parameters stored in advance without attacking data flow; the defense terminal stores multiple SLA levels arranged in order, and a defense corresponding to each SLA level Strategy, the smaller the SLA level, the higher the service level enjoyed by the target end, and the defense strategy corresponding to the previous SLA level is better than the defense strategy corresponding to the latter SLA level. The system according to claim 12, wherein the host performance parameters include: the number of half-open connections of the host of the target end after receiving the first syn packet; the host CPU of the target end; Host memory; the connection table of the target end; the number of input and output times of the host of the target end; and the proportion of the in and out traffic of the host of the target end. The system according to claim 15, wherein the network service quality includes: network delay caused in the process of cleaning the original data flow; network delay caused in the process of cleaning the raw data flow Packet loss rate; TCP availability brought in the process of cleaning the original data flow; UDP availability brought in the process of cleaning the original data flow; and, in the process of cleaning the original data flow The jitter that comes.

Images