WO2021083324A1 - 一种信息上报方法、数据处理方法及装置 - Google Patents

一种信息上报方法、数据处理方法及装置 Download PDF

Info

Publication number
WO2021083324A1
WO2021083324A1 PCT/CN2020/125227 CN2020125227W WO2021083324A1 WO 2021083324 A1 WO2021083324 A1 WO 2021083324A1 CN 2020125227 W CN2020125227 W CN 2020125227W WO 2021083324 A1 WO2021083324 A1 WO 2021083324A1
Authority
WO
WIPO (PCT)
Prior art keywords
bgp
rule
network node
server
status
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/125227
Other languages
English (en)
French (fr)
Inventor
庄顺万
王海波
顾钰楠
闫刚
李振斌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to JP2022525231A priority Critical patent/JP7470786B2/ja
Priority to EP20880447.6A priority patent/EP4030720B1/en
Priority to BR112022007412A priority patent/BR112022007412A2/pt
Publication of WO2021083324A1 publication Critical patent/WO2021083324A1/zh
Priority to US17/732,588 priority patent/US12177183B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • This application relates to the field of communications, in particular to an information reporting method, data processing method and device.
  • BGPFS Border Gateway Protocol Flow Specification
  • the embodiment of the present application provides an information reporting method, which is beneficial to solve the problem that the use of BGP FS rules cannot effectively prevent traffic attacks.
  • an information reporting method is provided.
  • the control process related to the BGP FS rule is That's the end, and no measures have been taken to further monitor the status of the BGP FS rules implemented on the network nodes.
  • the implementation status of the BGP FS rule on the network node is unknown, and the BGP FS rule cannot effectively prevent attack traffic because the aforementioned BGP FS rule may not be implemented on the network node.
  • the network node after the network node receives the BGP FS rule, it can obtain the status of the BGP FS rule implemented on the network node, where the status can indicate that the BGP FS rule has been implemented on the network node , Or, indicates that the BGP FS rule is not implemented on the network node. Then, the network node sends the status to the server. In this way, the server can learn the status of the BGP FS rule implemented on the network node.
  • the server or other servers such as servers that generate BGP FS rules, can store the status, and if necessary, can further perform corresponding operations based on the status, such as performing corresponding adjustment measures, so as to effectively prevent attack traffic.
  • the network node will report the BGP FS route to the BMP server after receiving the BGP FS route . Moreover, the network node can report the received BGPFS route to the BMP server through the RM message. In view of this, the network node can use the RM message as a carrier to carry the status of the BGP FS rule implemented on the network node in the RM message and send it to the first server. Specifically, the network node may add the state of the BGP FS rule implemented on the network node to the RM message, and then send the RM message with the aforementioned state added to the first server.
  • the network node will not report to the first server.
  • the first server may send a status report instruction to the network node, where the status report instruction is used to instruct the network node to report the status of the BGP FS rule implemented on the network node to the first server.
  • the network node may execute the step of acquiring the status of the BGP FS rule implemented on the network node and sending the acquired status to the first server.
  • the BGP FS rules that have been implemented on network nodes can include at least two types of situations, one of which can be summarized as normal implementation, and the other can be summarized as abnormal implementation.
  • the so-called normal implementation means that the BGP FS rule has correctly participated in the BGP optimal routing process, and the BGP FS rule has not been interfered by other factors when it is implemented.
  • the so-called abnormal implementation means that although the BGP FS rule has correctly participated in the BGP optimal routing process, the implementation of the BGP FS rule is interfered by other factors. Therefore, the aforementioned BGP FS rules have been implemented on the network nodes, which may include the normal implementation of the BGP FS rules on the network nodes, or the abnormal implementation of the BGP FS rules on the network nodes.
  • the aforementioned state is that the BGP FS rule is not implemented on the network node
  • the aforementioned state can further reflect the specific reasons why the BGP FS rule is not implemented on the network node.
  • the network node may implement the BGP FS rule.
  • the verification of BGP FS rules may include BGP verification and/or BGP FS verification.
  • the BGP FS rule fails the BGP verification, or the BGP FS rule fails the BGP FS verification, the network node no longer implements the BGP FS rule. Therefore, the BGP FS rules are not implemented on the network nodes, which may include the BGP FS rules failing the BGP verification, and/or the BGP FS rules failing the BGP FS verification.
  • the failure of the BGP FS rule to pass the BGP verification can mean that the BGP FS rule carries illegal parameters.
  • Illegal parameters can include at least two situations. One is that there are parameters in the BGP FS rules that cannot be processed by network nodes, and the other is that there are illegal autonomous domain paths in the BGP FS rules.
  • the BGP FS rule generally carries the effective interface of the BGP FS rule. If the effective interface carried in the BGP FS rule does not match the interface of the network node, the BGP FS rule cannot be implemented on the network node. Therefore, the BGP FS rule is not implemented on the network node, and it may be that the effective interface carried in the BGP FS rule does not match the interface of the network node. Moreover, considering that in actual applications, corresponding security protection policies can also be configured on network nodes, if the BGP FS rule conflicts with the security protection policy, it will also cause the BGP FS rule to fail to be implemented on the network node.
  • the BGP FS rules are not implemented on the network nodes, which can be because the BGP FS rules conflict with the security protection policy.
  • preset implementation conditions for the BGP FS rule can also be set on the network node. Only when the BGP FS rule meets the preset implementation condition, the network node may implement the BGP FS rule. Therefore, the BGP FS rule is not implemented on the network node, which can be used for BGP FS not meeting the preset implementation conditions of the rule.
  • the network node when the BGF FS rule has been implemented on the network node, in order to further evaluate the flow control effect of the BGP FS rule, the network node can also obtain the traffic matching information of the BGP FS rule and compare the flow The matching information is sent to the first server.
  • the traffic matching information refers to: information related to the data traffic that matches the BGP FS rule.
  • the network node will report the BGP FS route to the BMP server after receiving the BGP FS route.
  • one type of message is an SR message
  • the SR message carries statistical information
  • the traffic matching information can also be considered as a kind of statistical information.
  • an existing SR message can be used as a carrier to send the aforementioned traffic matching information to the first server.
  • the network node may add the traffic matching information of the BGP FS rule to the SR message, and then send the SR message with the aforementioned traffic matching information added to the first server.
  • the network node may carry the traffic matching information in the extension field of the SR message.
  • the traffic matching information can be carried in the extended TLV field.
  • the first server may send a traffic information report instruction to the network node.
  • the traffic information report instruction is used to instruct the network node to The aforementioned traffic matching information is reported to the first server.
  • the network node may perform the steps of acquiring the traffic matching information of the BGP FS rule and sending the traffic matching information to the first server.
  • the first server can only send traffic information reporting instructions to the network node when it receives the aforementioned status from the network node and the status indicates that the BGP FS rule has been implemented on the network node, thereby reducing the number of first server and network nodes. Data interaction between nodes.
  • the embodiments of the present application provide a data processing method.
  • the first server can obtain the status of the border gateway protocol flow specification BGP FS rule implemented on the network node; the status indicates that the BGP FS rule has been It is implemented on the network node, or the status indicates that the BGP FS rule is not implemented on the network node; the first server stores the status.
  • the first server can learn the status of the implementation of the BGP FS rule on the network node.
  • the first server may further perform corresponding operations according to the status when necessary, for example, perform corresponding adjustment measures, thereby effectively preventing attack traffic.
  • the first server after the first server stores the status of the implementation of the BGP FS rule on the network node, it can read the status of the implementation of the BGP FS rule on the network node, and perform other operations according to the status, for example, execute according to the status First operation.
  • the first server may also send the aforementioned status to the second server, and the second server performs the first operation according to the status.
  • this first operation has a certain connection with the aforementioned BGP FS rule. Therefore, in this embodiment of the present application, the second server may be a server that generates the BGP FS rule.
  • the first server and the second server are running on one device, the first server itself can perform the first operation according to the aforementioned state.
  • the first server may send the aforementioned status to the second server, and the second server performs the first operation according to the aforementioned status.
  • the first server or the second server may control the display device to display the aforementioned status.
  • network administrators can determine the status of BGP FS rules implemented on network nodes through the content displayed by the display device. Further, network management personnel can perform corresponding adjustment measures according to the status.
  • the first server or the second server may perform the first operation according to the foregoing state in specific implementation, and may also aim at enabling the BGP FS rule to be implemented on the network node.
  • the first server or the second server determines that the BGP FS rule is not implemented on the network node due to the configuration parameters of the BGP FS rule
  • the first server or the second server performs the first operation in specific implementation, for example It may be to modify the BGP FS rule, and send the modified BGP FS rule to the network node, so that the network node implements the modified BGP FS rule.
  • the first server or the second server determines that the non-implementation of the BGP FS rule is caused by the configuration of the network node, the first server or the second server performs the first operation in specific implementation, for example, sending the first configuration to the network node Instruction, the first configuration instruction is used to reconfigure the network node, so that the network node can implement the BGP FS rule.
  • the BGP FS rule may carry illegal parameters. Therefore, if the aforementioned status indicates that the BGP FS rule has not passed the BGP verification, the first server or the second server can modify the BGP FS rule so that the modified BGP FS rule passes the BGP verification. In this way, after the first server or the second server sends the modified BGP FS rule to the network node, the network node can execute the BGP FS rule. Specifically, the first server or the second server may determine the illegal parameter carried in the BGP FS rule, and modify the illegal parameter to a legal parameter.
  • the first server or the second server may modify the BGP FS rule. Specifically, the first server or the second server may modify the effective interface carried in the BGP FS rule to an interface that matches the interface of the network node, and send the modified BGP FS rule to the network node. In this way, the network node can implement the BGP FS rule.
  • the first server or the second server can modify the BGP FS rule.
  • the first server or the second server can modify the BGP FS rule.
  • the FS rule is modified to a BGP FS rule that does not conflict with the security protection policy, and the modified BGP FS rule is sent to the network node, so that the network node can implement the BGP FS rule.
  • the first server or the second server may send a first configuration instruction to the network node.
  • the first configuration instruction is used to instruct the network node to reconfigure the target parameter.
  • the target parameter is to determine whether the BGP FS rule conforms to the preset. Set the parameters used in the implementation conditions so that after the network node reconfigures the target parameters, the BGP FS rule can meet the preset implementation conditions.
  • the first configuration instruction may also be a configuration instruction used to configure the network node to cancel the verification of whether the BGP FS rule meets the preset implementation conditions. It is understandable that if the network node no longer verifies whether the BGP FS rule meets the preset implementation conditions, the network node can implement the BGP FS rule.
  • the first server may also obtain the flow matching information of the BGP FS rule, and after obtaining the flow matching information, the first server may also store the flow matching information. In this way, the first server can learn the traffic matching condition of the BGP FS rule on the network node. Correspondingly, the first server may further perform corresponding operations according to the status when necessary, for example, perform corresponding adjustment measures, thereby effectively preventing attack traffic.
  • the first server may also perform the second operation according to the traffic matching information, or send the traffic matching information to the second server, and the second server may perform the second operation according to the traffic matching information.
  • the first server or the second server performs the second operation according to the traffic matching information.
  • the A server or a second server may control the display device to display the foregoing traffic matching information. In this way, network managers can determine the traffic matching situation of BGP FS rules on network nodes by displaying the content displayed by the device.
  • the first server or the second server may further determine whether the traffic matching information meets the preset condition.
  • the determination of whether the traffic matching information meets the preset conditions mentioned here refers to determining whether the effect of the BGF FS rule for traffic control is as expected.
  • the BGP FS rule is to analyze historical data traffic passing through network nodes, and formulate for the abnormal traffic after it is determined that there is abnormal traffic. Therefore, the aforementioned preset conditions can also be determined based on abnormal traffic, that is, obtained by analyzing historical data traffic passing through the network node.
  • the first server or second server can further determine the reason why BGP FS rules cannot effectively prevent attack traffic, and implement corresponding adjustment measures to achieve the purpose of effectively preventing attack traffic. .
  • BGP FS rules are interfered by other flow control strategies when they are implemented.
  • BGP FS rules are implemented abnormally on network nodes.
  • the other is caused by the configuration of the BGP FS rule itself.
  • the first server or the second server may, for example, reconfigure the network node, so that the BGP FS rule is normally implemented on the network node.
  • the first server or the second server may modify the BGP FS rule, for example, and send the modified BGP FS rule to the network node.
  • the first server or the second server executes the second operation according to the traffic matching information, it may also include two implementation manners.
  • One implementation manner is to send a second configuration instruction to the network node according to the traffic matching information when it is determined that the traffic matching information does not meet the preset condition, and the second configuration instruction is used to reconfigure the network node.
  • Another implementation manner is to modify the BGP FS rule according to the traffic matching information when it is determined that the traffic matching information does not meet the preset condition, and send the modified BGP FS rule to the network node.
  • the first server or the second server may first determine whether the BGP FS rule is in the network because the traffic matching information does not meet the preset conditions according to the status of the acquired BGP FS rule implemented on the network node. Abnormal implementation on the node. Specifically, if the BGP FS rule obtained by the first server or the second server is implemented on the network node, including the priority of the BGP FS rule is lower than the priority of other traffic control policies, it means that the BGP FS rule is on the network node Abnormal implementation.
  • the first server or the second server can send a second configuration instruction to the network node. The second configuration instruction is used to configure the network node to cancel the implementation of other traffic control policies, or to configure the network node to preferentially implement BGP FS rules.
  • the first server or the second server can analyze the data traffic passing through the network nodes to determine whether there is abnormal traffic. If there is abnormal traffic, it means that other traffic control strategies have not effectively prevented attack traffic. In this case, the first server or the second server can The network node sends the aforementioned second configuration instruction. If there is no abnormal traffic, it means that other traffic control strategies can effectively prevent attack traffic. At this time, the first server or the second server may not need to perform the foregoing step of sending the foregoing second configuration instruction to the network node.
  • the priority of the BGP FS rule is lower than the priority of other traffic control policies, it means BGP FS
  • the rule is implemented normally, and accordingly, the first server or the second server can determine that the traffic matching information does not meet the preset conditions, which is caused by the configuration of the BGP FS rule itself. In this case, the first server or the second server may send a second configuration instruction to the network node to reconfigure the network node, so that the aforementioned BGPFS rule can effectively prevent attack traffic after being implemented.
  • the first server or the second server can analyze the configuration parameters of the BGP FS rule to determine whether there are some parameter combinations in the BGP FS rule that will make the BGP FS rule ineffective. If it exists, the first server or the second server can modify these parameters again, so that the modified BGP FS rule can take effect.
  • the first server or the second server may analyze the data traffic passing through the network node, and modify the BGP FS rule based on the analysis result. Specifically, the first server or the second server may analyze the data traffic passing through the network node within a preset time period to determine the characteristics of the attack traffic, and modify the BGP FS rule according to the characteristics of the attack traffic.
  • an embodiment of the present application provides an information reporting device, the device includes: an obtaining unit, configured to obtain a border gateway protocol flow specification BGP FS rule implemented on a network node; the status indicates the BGP The FS rule has been implemented on the network node, or the status indicates that the BGP FS rule is not implemented on the network node; the sending unit is configured to send the status to the server.
  • an obtaining unit configured to obtain a border gateway protocol flow specification BGP FS rule implemented on a network node
  • the status indicates the BGP The FS rule has been implemented on the network node, or the status indicates that the BGP FS rule is not implemented on the network node
  • the sending unit is configured to send the status to the server.
  • the sending unit is specifically configured to: add the status to the route monitoring RM message, and send the RM message with the status added to the server.
  • the obtaining unit is further configured to obtain traffic matching information of the BGP FS rule, and the traffic matching information Is related information of the data flow matching the BGP FS rule; the sending unit is further configured to send the flow matching information to the server.
  • the sending unit is specifically configured to: add the flow matching information to a status report SR message, and send the SR message with the flow matching information added to the server.
  • the acquiring unit is specifically configured to: after receiving a status report instruction from the server, acquire the status of the BGP FS rule implemented on the network node.
  • the acquiring unit is specifically configured to: after receiving a traffic information reporting instruction from the server, acquire traffic matching information of the BGP FS rule.
  • an embodiment of the present application provides a data processing device, the device includes: an acquiring unit, configured to acquire the status of the border gateway protocol flow specification BGP FS rule implemented on a network node; the status indicates the BGP The FS rule has been implemented on the network node, or the status indicates that the BGP FS rule is not implemented on the network node; the storage unit is used to store the status.
  • the device further includes: an operating unit, configured to perform a first operation according to the status, or a sending unit, configured to send the status to a second server, and the second server Perform the first operation according to the state.
  • the operating unit is specifically configured to: if the status is that the effective interface carried by the BGP FS rule does not match the interface of the network node, then the effective interface carried by the BGP FS rule Modified to an interface that matches the interface of the network node.
  • the operating unit is specifically configured to: if the state is describing that the BGP FS rule conflicts with the security protection policy, modify the BGP FS rule to be non-conflicting with the security protection policy. BGP FS rules.
  • the operating unit is specifically configured to: if the status is that the BGP FS rule does not meet a preset implementation condition, send a first configuration instruction to the network node, the first configuration instruction Used to instruct the network node to reconfigure target parameters so that the BGP FS rule meets the preset implementation conditions; or, the first configuration instruction is used to configure the network node to cancel the verification of the BGP FS rule Whether it meets the preset implementation conditions.
  • the acquiring unit is further configured to acquire traffic matching information of the BGP FS rule, where the traffic matching information is related information of data traffic matching the BGP FS rule; the storage unit is also Used to store the traffic matching information.
  • the operating unit is further configured to perform a second operation according to the traffic matching information; or, the sending unit is further configured to send the traffic matching information to the second server, and The second server performs a second operation according to the traffic matching information.
  • the operating unit is specifically configured to: control a display device to display the flow matching information.
  • the operating unit is specifically configured to determine whether the flow matching information meets a preset condition, and if the flow matching information does not meet the preset condition, perform a check on the traffic matching information according to the flow matching information.
  • the BGP FS rule is modified, and the modified BGP FS rule is sent to the network node.
  • the operating unit is specifically configured to: send a second configuration instruction to the network node according to the traffic matching information, and the second configuration instruction is used to configure the network node.
  • the operating unit is specifically configured to: if the status includes that the priority of the BGP FS rule is lower than the priority of other flow control policies, send a second configuration instruction to the network node, The second configuration instruction is used to configure the network node to cancel the implementation of the other flow control policy, or to configure the network node to preferentially implement the BGP FS rule.
  • the method further includes: an analysis unit, configured to analyze the data traffic passing through the network node to obtain an analysis result before the second configuration instruction is sent to the network node; the operation unit Specifically, if the analysis result indicates that there is abnormal traffic in the data traffic passing through the network node, sending a second configuration instruction to the network node.
  • an analysis unit configured to analyze the data traffic passing through the network node to obtain an analysis result before the second configuration instruction is sent to the network node
  • the operation unit Specifically, if the analysis result indicates that there is abnormal traffic in the data traffic passing through the network node, sending a second configuration instruction to the network node.
  • the operating unit is specifically configured to modify the BGP FS rule if the status does not include the priority of the BGP FS rule lower than the priority of other flow control policies.
  • the operating unit is specifically configured to: analyze the configuration parameters of the BGP FS rule to determine whether there is a parameter combination that causes the BGP FS rule to fail to take effect; if it exists, modify the parameter combination , To make the modified BGP FS rule take effect.
  • the operating unit is specifically configured to analyze the data traffic passing through the network node, and modify the BGP FS rule according to the analysis result.
  • the sending unit is further configured to send a status report instruction to the network node, and the status report instruction is used to instruct the network node to report the BGP FS rule to the data processing device. The status of the implementation on the network node.
  • the sending unit is further configured to send a traffic information report instruction to the network node, and the traffic information report instruction is used to instruct the network node to report the BGP FS to the data processing apparatus.
  • the flow matching information of the rule where the flow matching information is related information of the data flow matching the BGP FS rule.
  • the sending unit is specifically configured to: when the status received by the data processing apparatus is that the BGP FS rule has been implemented on the network node, send all data to the network node.
  • the traffic information report instruction is specifically configured to: when the status received by the data processing apparatus is that the BGP FS rule has been implemented on the network node, send all data to the network node.
  • that the aforementioned BGP FS rule has been implemented on the network node includes: the BGP FS rule is normally implemented, or the BGP FS rule is implemented abnormally.
  • the abnormal implementation of the aforementioned BGP FS rule includes: the priority of the BGP FS rule is lower than the priority of other flow control policies, and the other flow control policies are running on the network node.
  • the aforementioned BGP FS rule is not implemented on the network node, including: the BGP FS rule fails the BGP verification, and/or the BGP FS rule fails the BGP FS verification.
  • the failure of the aforementioned BGP FS rule to pass the BGP verification includes: the BGP FS rule carries illegal parameters.
  • the aforementioned BGP FS rule fails the BGP FS verification, including any one or more of the following: the BGP FS rule does not meet the preset implementation conditions; the effective interface carried by the BGP FS rule and all The interface of the network node does not match; and the BGP FS rule conflicts with the security protection policy, and the security protection policy runs on the network node.
  • an embodiment of the present application provides a device, including: a processor and a memory; the memory is configured to store instructions; the processor is configured to execute the instructions in the memory, and execute the above On the one hand, the method described in any one of the above, or execute any one of the methods described in the second method above.
  • an embodiment of the present application provides a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute the method described in any one of the first aspects above, or execute the second method above Any one of the methods.
  • the embodiments of the present application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute any one of the methods described in the first aspect above, or execute any one of the second methods above The method described in the item.
  • FIG. 1 is a schematic diagram of an exemplary application scenario provided by an embodiment of the application
  • Figure 2 is a signaling interaction diagram of an information reporting method provided by an embodiment of this application.
  • FIG. 3 is a signaling interaction diagram of an information reporting method provided by an embodiment of this application.
  • FIG. 4 is a schematic structural diagram of an information reporting device provided by an embodiment of this application.
  • FIG. 5 is a schematic structural diagram of a data processing device provided by an embodiment of the application.
  • FIG. 6 is a schematic structural diagram of a device provided by an embodiment of the application.
  • the embodiment of the present application provides an information reporting method to solve the problem that the use of BGP FS in the traditional technology cannot effectively prevent traffic attacks.
  • BGP FS routes are routes that contain new BGP network layer reachability information and extended community attributes. Through the new network layer reachability information and extended community attributes, BGP FS routing can carry corresponding BGP FS rules.
  • the BGP FS rules can also be regarded as a flow control strategy. Specifically, BGP FS rules can include traffic matching The corresponding traffic processing behavior after the conditions and traffic match.
  • traffic matching conditions are carried in BGP FS routing as network layer reachability information
  • traffic processing behaviors are carried in BGP FS routing as extended community attributes.
  • traffic matching conditions can include 12 matching methods. They are matching according to the destination address, matching according to the source address, matching according to the Internet Protocol (IP) protocol number, matching according to the port number, matching according to the destination port number, matching according to the source port number, and matching according to the source port number.
  • IP Internet Protocol
  • ICMP Internet Control Message Protocol
  • ICMP code matching ICMP code matching
  • TCP Transmission Control Protocol
  • DSCP differentiated services code point
  • Traffic processing behaviors can include four types, namely, discarding traffic, limiting the rate of traffic, modifying the DSCP value of the message, and redirecting to a virtual private network (virtual private network, VPN).
  • VPN virtual private network
  • FIG. 1 is a schematic diagram of an exemplary application scenario provided by an embodiment of the application.
  • An autonomous system (AS) 100 includes a network device 101, a network device 102, and a network device 103.
  • the network device 101, the network device 102, and the network device 103 may be routers or switches, which are not specifically limited in the embodiment of the present application.
  • the network device 101 may be a provider edge (PE) device, and the network device 101 may be, for example, a network edge node of the AS 100.
  • PE provider edge
  • the BGP FS neighbor relationship of the server 200, the network device 101, and the network device 102 can be established, and the BGP FS neighbor relationship of the network device 101, the network device 102, and the network device 103 can be established.
  • the server 200 can, for example, deploy a traffic sampling function on the network device 102 and the network device 103, for example, can sample the traffic passing through the network device 102 and the network device 103 through a network stream (netstream).
  • the server 200 analyzes the sampled traffic to determine whether there is abnormal traffic. If there is abnormal traffic, the server 200 generates a BGP FS route corresponding to the abnormal traffic.
  • the server 200 analyzes the sampled traffic and determines that a large amount of attack traffic with the IP protocol number 193 appears on the network device 102
  • the server 200 generates a BGP FS route indicating to intercept the data message with the IP protocol number 193.
  • the server 200 sends the BGP FS route to the network device 101 or the network device 102.
  • the network device 101 or the network device 102 receives the BGP FS route, it can analyze the BGP FS route and determine the corresponding BGP FS rule.
  • the network device 101 can implement the BGP FS rule to control abnormal traffic. . It is understandable that if the server 200 sends the aforementioned BGP FS route to the network device 101, since the network device 101 is a network edge node of the AS, abnormal traffic can be controlled at the network entrance or the network exit of the AS 100.
  • the network device 101 or the network device 102 after the network device 101 or the network device 102 receives the BGP FS route from the server 200, it may not be able to implement the BGP FS rule as described in the foregoing ideal situation.
  • no device currently monitors the status of the implementation of the BGP FS rule on the network node, such as the aforementioned network device 101.
  • the server 200 cannot evaluate the effect of the BGP FS rule in preventing attack traffic according to the status of the BGP FS rule implemented on the network node, and implement corresponding adjustment measures when necessary, so as to effectively prevent the attack traffic.
  • the server 300 is also included in FIG. 1.
  • the server 300 may be a BGP Monitoring Protocol (BGP Monitoring Protocol, BMP) server.
  • BMP BGP Monitoring Protocol
  • the BMP server can monitor the BGP operating status of network devices in real time.
  • the BGP operating status includes the establishment and release of peer relationships, and routing information refresh.
  • the network device can use the BMP protocol to send messages to the BMP server, thereby sending its own BGP running status to the BMP server.
  • the network device 101, the network device 102, and the network device 103 can report their own BGP running status to the server 300.
  • the messages sent by the network equipment to the BMP server using the BMP protocol can be understood in conjunction with Table 1.
  • the network device can report the received BGP FS route to the BMP server.
  • the BMP monitoring BGP FS Local-RIB function is deployed on the network device 101, after the network device 101 receives the BGP FS route, it will report the BGP FS route to the BMP server.
  • the network device 101 only reports the BGP FS route to the BMP server. Therefore, even if the server 200 receives the BGP FS route from the network device 101, it cannot know the status of the BGP FS rule implemented on the network device 101, so that the aforementioned problem that the BGP FS cannot effectively prevent attack traffic still exists.
  • an embodiment of the present application provides an information reporting method.
  • the information reporting method will be introduced below in conjunction with the scenario shown in FIG. 1.
  • FIG. 1 is only shown for ease of understanding, and it does not constitute a limitation to the embodiments of the present application.
  • the number of network devices included in an AS is not limited to the three shown in Figure 1.
  • the server mentioned in the embodiment of the present application may be a device or a functional module, which is not specifically limited in the embodiment of the present application.
  • the server in the embodiment of the present application refers to a functional module
  • the functional module can run on various devices.
  • the embodiment of the present application does not specifically limit the device running the functional module.
  • the device may be a network node or It is a terminal device, etc., which are not listed here.
  • the server 200 and the server 300 may be two independent devices, or they may be integrated on one device.
  • the server 200 and the server 300 may also be two functional modules running on the same device, or two functional modules running on two different devices.
  • FIG. 2 is a signaling interaction diagram of an information reporting method provided by an embodiment of the application.
  • the information reporting method provided in the embodiments of this application can be implemented through the following S101-S102-S103.
  • the network node obtains the status of the BGP FS rule implemented on the network node.
  • the network node mentioned here may be, for example, the network device 101 shown in FIG. 1.
  • the network node may receive a BGP FS route from a server, such as the server 200 shown in FIG. 1, where the BGP FS route carries BGP FS rules.
  • the network node can analyze the BGP FS route to determine the BGP FS rule carried in the BGP FS route. Further, the network node can implement the BGP FS rule.
  • the status of the BGP FS rule implemented on the network node is used to indicate that the BGP FS rule has been implemented on the network node, or it is used to indicate that the BGP FS rule is not implemented on the network node.
  • the network node itself records the status of the BGP FS rule implemented on the network node, so the network node can read the corresponding storage file to obtain the status of the BGP FS rule implemented on the network node.
  • BGP FS rules in order to enable the state to reflect more details of the implementation state of the BGP FS rule on the network node.
  • BGP FS rules have been implemented on network nodes, there can be at least two types of situations, one of which can be summarized as normal implementation, and the other can be summarized as Exception implementation.
  • the so-called normal implementation means that the BGP FS rule has correctly participated in the BGP optimal routing process, and the BGP FS rule has not been interfered by other factors when it is implemented.
  • the so-called abnormal implementation means that although the BGP FS rule has correctly participated in the BGP optimal routing process, the implementation of the BGP FS rule is interfered by other factors.
  • the aforementioned BGP FS rules have been implemented on network nodes, which may include the normal implementation of BGP FS rules on network nodes, or the abnormal implementation of BGP FS rules on network nodes.
  • other traffic control policies may be running on network nodes, such as the traffic control policy indicated by the access control list (ACL), and the traffic indicated by the policy-based routing (PBR).
  • ACL access control list
  • PBR policy-based routing
  • Control Strategy Once the priority of the BGP FS rule is lower than the priority of other flow control policies. Then these other flow control strategies will cause interference to the implementation of BGP FS rules on network nodes. Because the traffic passing through the network nodes will be processed by other traffic control policies first, and then processed by the BGP FS rules. In other words, in an implementation manner of the embodiment of the present application, the aforementioned BGP FS rule is abnormally implemented on the network node, which may mean that the priority of the BGP FS rule is lower than the priority of other traffic control policies.
  • this state may further reflect the specific reason why the BGP FS rule is not implemented on the network node.
  • the network node considering that the network node obtains the BGP FS rule, it first checks the BGP FS rule. Only after the BGP FS rule passes the check, the network node may implement the BGP FS rule. rule. Among them, the verification of BGP FS rules may include BGP verification and/or BGP FS verification. If the BGP FS rule fails the BGP verification, or the BGP FS rule fails the BGP FS verification, the network node no longer implements the BGP FS rule. Therefore, in the embodiment of the present application, the BGP FS rule is not implemented on the network node, which may include that the BGP FS rule fails the BGP verification, and/or the BGP FS rule fails the BGP FS verification.
  • BGP FS rules failing BGP verification it should be noted that considering that in actual applications, BGP FS rules failing BGP verification, it may generally be because the BGP FS rules carry illegal parameters.
  • the so-called illegal parameters can include at least two situations, one of which is that there are parameters in the BGP FS rules that cannot be processed by the network node.
  • the BGP FS rule indicates to redirect to the Internet Protocol Version 6 (Internet Protocol Version 6, IPv6) next hop.
  • IPv6 Internet Protocol Version 6, IPv6
  • the AS identifier carried in the BGP FS rule is equal to the AS identifier corresponding to the network node, and the AS identifier carried in the BGP FS rule is not equal to the first The AS identifier corresponding to the second server.
  • the BGP FS rule generally carries the BGP The effective interface of the FS rule. If the effective interface carried in the BGP FS rule does not match the interface of the network node, the BGP FS rule cannot be implemented on the network node. In this case, the BGP FS rule is not implemented on the network node, and it may be that the effective interface carried in the BGP FS rule does not match the interface of the network node.
  • the effective interface mentioned here may be one interface or multiple interfaces, which is not specifically limited in the embodiment of the present application.
  • the aforementioned BGP FS rule may, for example, carry the identifiers of the multiple interfaces in the carrying BGP FS rule.
  • the corresponding security protection policy can also be configured on the network node. If the BGP FS rule conflicts with the security protection policy, the BGP FS rule will not be implemented on the network node. .
  • the security protection policy on the network node indicates that it is forbidden to restrict the flow of packets of the specified IP prefix or specified protocol, and the BGP FS rule is to restrict the flow of packets of the specified IP, which will lead to the BGP FS rule Cannot be implemented on network nodes. In this case, the BGP FS rule is not implemented on the network node, which may be because the BGP FS rule conflicts with the security protection policy.
  • preset implementation conditions for the BGP FS rule can also be set on the network node. Only when the BGP FS rule meets the preset implementation condition, the network node may implement the BGP FS rule.
  • the preset implementation conditions it should be noted that in an implementation manner, considering that in actual applications, not all devices have the requirements to implement BGP FS rules. For example, for a route reflector, its It is only used to transmit routes and does not need to implement BGP FS rules. Therefore, generally speaking, the aforementioned preset implementation conditions may include that network nodes are not allowed to implement the BGP FS rule.
  • the network node can set the upper limit of the number of BGP FS rules to be implemented. When the number of received BGP FS rules exceeds When the number is upper limit, it is determined that the BGP FS rule does not meet the preset implementation conditions.
  • the network device settings can set the upper limit of the number of traffic matching conditions.
  • the network device may set an upper limit for the number of traffic processing behaviors, and when the network node determines that the traffic processing behavior indicated by the BGP FS rule exceeds the upper limit of the number of traffic processing behaviors, it is determined that the BGP FS rule does not meet the preset implementation conditions; or, The network node allocates a certain amount of memory for the BGP FS rule. When the network node determines that the available memory corresponding to the BGP FS rule is insufficient, it determines that the BGP FS rule does not meet the preset implementation conditions.
  • S102 The network node sends the status to the first server.
  • the network node After obtaining the aforementioned status, the network node can send the status to the first server. After the network node sends the status to the first server, the first server can determine the status of the BGP FS rule implemented on the network node based on the status.
  • the first server mentioned here may be the server 200 shown in FIG. 1 or the server 300 shown in FIG. 1, which is not specifically limited in the embodiment of the present application.
  • the BMP server is generally used to monitor the BGP operating status of network devices in real time. Therefore, in an optional solution, the first server can be a BMP server, as shown in Figure 1. Server 300. In the following description of the embodiments of the present application, unless otherwise specified, the first server corresponds to the server 300 shown in FIG. 1.
  • the network node will report the BGP FS route to the BMP server after receiving the BGP FS route. Moreover, the network node can report the received BGP FS route to the BMP server through the RM message shown in Table 1.
  • the network node may use the RM message as a carrier, and carry the state of the BGP FS rule implemented on the network node in the RM message and send it to the first server.
  • the network node may add the state of the BGP FS rule implemented on the network node to the RM message, and then send the RM message with the aforementioned state added to the first server.
  • the RM message can be extended, so that the aforementioned status is carried in the extension field of the RM message.
  • the aforementioned status may be carried in an extended type-length-value (type length-value, TLV) field.
  • the network node will not send the BGP FS route to the first server.
  • the implementation status of the BGP FS rule on the network node cannot be carried in the RM message and sent to the first server.
  • the first server may send a status report instruction to the network node, where the status report instruction is used to instruct the network node to report the status of the BGP FS rule implemented on the network node to the first server.
  • the network node may execute the aforementioned S101-S102 after receiving the status report instruction of the first server.
  • the embodiment of the present application does not specifically limit the frame structure of the status report instruction.
  • the status report instruction may carry an address family identifier (AFI) and a subsequent address family identifier (AFI, SAFI). For each BGP FS rule matching the AFI and SAFI, the network node can report the status of each BGP FS rule implemented on the network node to the first server.
  • the status report instruction carries an identifier of the BGP FS rule, and the network node may report the status of the BGP FS rule implemented on the network node corresponding to the identifier to the first server.
  • the status report instruction may also include other fields, which are not listed here.
  • the network node may periodically execute the aforementioned S101-S102, of course, it may also execute S101-S102 only once, which is not specifically limited in the embodiment of the present application.
  • the first server may also send a status stop reporting instruction to the network node to instruct the network node to no longer report the BGP FS rule The status implemented on the network node.
  • the first server determines that the BGP FS rule is implemented normally on the network node according to the status of the BGP FS rule reported by the network node, so it no longer monitors the status of the BGP FS rule implemented on the network node.
  • the first server can send a state stop reporting instruction to the network node.
  • the status report command and the status stop report command can adopt the same frame structure, and the value of a certain field is used to distinguish the status report command and the status stop report command.
  • the first instruction issued by the first server when the value of the first field in the first instruction is 1, the first instruction is a status report instruction, and when the value of the first field in the first instruction is At 0, the first command is the status stop reporting command.
  • S103 The first server stores the received state.
  • the first server may store the state, specifically, the first server may store the state in the memory.
  • the first server may read the state of the BGP FS rule implemented on the network node from the aforementioned memory, and perform other operations according to the state, for example, perform the first operation according to the state.
  • the first server may also send the aforementioned status to the second server, and the second server performs the first operation according to the status.
  • the second server it should be noted that, considering that in practical applications, generally speaking, the first operation has a certain connection with the aforementioned BGP FS rule.
  • the second server may be The server of the BGP FS rule is, for example, the server 200 shown in FIG. 1.
  • the first server and the second server can run on the same device or on different devices. It can be understood that when the first server and the second server run on the same device, the first server It can perform the first operation according to the aforementioned status.
  • the first server and the second server are running on two devices, the first server can send the aforementioned status to the second server, and the second server can execute the first operation according to the aforementioned status. operating.
  • the specific implementation of the first server and the second server performing the first operation according to the foregoing state is the same. The following takes the first server performing the first operation according to the foregoing state as an example for description.
  • the first server may control the display device to display the aforementioned status.
  • network administrators can determine the status of BGP FS rules implemented on network nodes through the content displayed by the display device. Further, network management personnel can perform corresponding adjustment measures according to the status.
  • the display device mentioned here may be a display screen, and the display screen may be a display screen of the first server or a display screen of other devices, and the embodiment of the present application does not make specific limitations.
  • the purpose of controlling attack traffic is achieved.
  • the first server may perform the first operation according to the foregoing status when it is specifically implemented, and it may also aim at enabling the BGP FS rule to be implemented on the network node.
  • BGP FS rules are not implemented on network nodes. It may be caused by the configuration parameters of BGP FS rules, or it may be caused by network nodes. Caused by its own configuration.
  • the first server can determine the reason that the BGP FS rule is not implemented on the network node according to the status of the BGP FS rule being implemented on the network node, and further, execute the first server according to the determined reason. operating.
  • the first server determines that the non-implementation of the BGP FS rule on the network node is caused by the configuration parameters of the BGP FS rule
  • the first server performs the first operation in specific implementation, for example, to modify the BGP FS rule
  • the first server determines that the non-implementation of the BGP FS rule is caused by the configuration of the network node, when the first server performs the first operation in specific implementation, for example, it may be sending a first configuration instruction to the network node. To reconfigure the network node so that the network node can implement BGP FS rules.
  • the specific implementation of the first server to modify the BGP FS rule according to the foregoing state and the first server to send the first configuration instruction to the network node are respectively introduced below.
  • the specific implementation method of "the first server modifies the BGP FS rule based on the aforementioned state” is introduced.
  • this state may indicate that the BGP FS rule has not passed the BGP verification.
  • the BGP FS rule fails the BGP verification, which may include illegal parameters carried in the BGP FS rule.
  • the first server may modify the BGP FS rule so that the modified BGP FS rule passes the BGP verification.
  • the network node can execute and implement the BGP FS rule.
  • the first server may determine the illegal parameter carried in the BGP FS rule, and modify the illegal parameter to a legal parameter.
  • the first server may modify the parameters that cannot be processed by the network node in the BGP FS rule to the parameters that the network node can process, and send the modified BGP FS rule to the network node.
  • the first server may modify the illegal AS path in the BGP FS rule to a legal AS path, and send the modified BGP FS rule to the network node.
  • this state may indicate that the effective interface carried by the BGP FS rule does not match the interface of the network node.
  • the BGP FS rule cannot be implemented on the network node, so the first server can modify the BGP FS rule.
  • the first server may modify the effective interface carried in the BGP FS rule to an interface that matches the interface of the network node, and send the modified BGP FS rule to the network node. In this way, the network node can implement the BGP FS rule.
  • this state may indicate that the BGP FS rule conflicts with the security protection policy.
  • the first server may modify the BGP FS rule. Specifically, the first server may modify the BGP FS rule to a BGP FS rule that does not conflict with the security protection policy, and send the modified BGP FS rule to The network node, in this way, the network node can implement the BGP FS rule.
  • the security protection policy on the network node indicates that it is forbidden to restrict the flow of packets of the first IP prefix
  • the BGP FS rule indicates that the flow of packets of the first IP prefix and the second IP prefix is restricted.
  • the first server may delete the flow control policy that restricts the flow of the packets of the first IP prefix from the BGP FS rule.
  • this state may indicate that the BGP FS rule has not passed the BGP FS verification.
  • the BGP FS rule failed the BGP FS verification, which may be because the BGP FS rule did not pass the verification rule that the network node verifies the BGP FS rule, that is, the BGP FS rule does not meet the preset implementation conditions.
  • the first server may send a first configuration instruction to the network node.
  • the first configuration instruction is used to instruct the network node to reconfigure the target parameter.
  • the target parameter is used to determine whether the BGP FS rule meets the preset implementation conditions.
  • the target parameter may be, for example, a parameter that enables the network node to be configured to implement BGP FS rules; for example, it may be the upper limit of the number of BGP FS rules mentioned above; and for example, it may be the upper limit of the number of traffic matching conditions mentioned above; and For example, it can be the upper limit of the number of traffic processing actions mentioned above, or it can be the memory size allocated by the network node for the BGP FS rule, and so on.
  • the first configuration instruction may also be a configuration instruction used to configure the network node to cancel the verification of whether the BGP FS rule meets the preset implementation conditions. It is understandable that if the network node no longer verifies whether the BGP FS rule meets the preset implementation conditions, the network node can implement the BGP FS rule.
  • the first server can learn the status of the BGP FS rule implemented on the network node.
  • the first server can store the state, and perform the first operation according to the state when needed, such as modifying the BGP FS rule, or reconfiguring the network node, so that the BGP FS rule can be displayed on the network node. Implementation of the above, thereby effectively preventing attack traffic.
  • the network node when the BGF FS rule has been implemented on the network node, in order to further evaluate the flow control effect of the BGP FS rule, the network node can also obtain the traffic matching information of the BGP FS rule , And send the traffic matching information to the first server.
  • the traffic matching information refers to: information related to the data traffic that matches the BGP FS rule.
  • the embodiments of this application do not specifically limit the flow matching information.
  • the flow matching information may be, for example, the number of packets matching the BGP FS rule, or the number of bytes occupied by the packets matching the BGP FS rule. .
  • the network node will report the BGP FS route to the BMP server after receiving the BGP FS route.
  • one type of message is an SR message, and the SR message carries statistical information, and the traffic matching information can also be regarded as a kind of statistical information.
  • an existing SR message may be used as a carrier to send the aforementioned traffic matching information to the first server.
  • the network node may add the traffic matching information of the BGP FS rule to the SR message, and then send the SR message with the aforementioned traffic matching information added to the first server.
  • the network node may carry the traffic matching information in the extension field of the SR message.
  • the traffic matching information can be carried in the extended TLV field.
  • the first server may send a traffic information report instruction to the network node.
  • the traffic information report instruction is used to instruct the network node to report the aforementioned traffic matching information.
  • the network node may perform the steps of acquiring the traffic matching information of the BGP FS rule and sending the traffic matching information to the first server.
  • the embodiment of the present application does not specifically limit the frame structure of the traffic information reporting instruction. Similar to the frame structure of the aforementioned status report instruction, as an example, the traffic information report instruction can carry AFI and SAFI. As another example, the traffic information report instruction carries the identifier of the BGP FS rule. Of course, the traffic information report instruction may also include other fields, which are not listed here.
  • the first server may send to the network node only when it receives the aforementioned state from the network node and the state indicates that the BGP FS rule has been implemented on the network node. Traffic information reporting instructions, thereby reducing data interaction between the first server and the network node.
  • the network node may periodically execute the steps of acquiring the traffic matching information of the BGP FS rule and sending the traffic matching information to the first server.
  • steps of acquiring the flow matching information of the BGP FS rule at one time and sending the flow matching information to the first server are not specifically limited in the embodiment of the present application.
  • the first server may also send traffic to the network node
  • the information stop reporting instruction is used to instruct the network node to no longer report the traffic matching information of the BGP FS rule.
  • the first server determines that the BGP FS rule has successfully intercepted the attack traffic for a period of time. Therefore, it no longer monitors the traffic matching situation of the BGP FS rule, and the first server can report to the network node. Send flow information stop reporting instruction.
  • the flow information report instruction and the flow information stop reporting instruction may adopt the same frame structure, and the value of a certain field is used to distinguish the flow information report instruction and the flow information stop reporting instruction.
  • the second instruction issued by the first server when the value of the second field in the second instruction is 1, the second instruction is a traffic information report instruction, and when the value of the second field in the second instruction is When it is 0, the second instruction is a flow information stop reporting instruction.
  • the first server After the first server receives the traffic matching information from the network node, it can store the traffic matching information. Further, the first server can also perform a second operation according to the traffic matching information, or send the traffic matching information to the second Server, the second server executes the second operation according to the traffic matching information.
  • the specific implementation of the first server and the second server performing the second operation according to the traffic matching information is the same.
  • the first server may control the display device to display the foregoing traffic matching information.
  • network managers can determine the traffic matching situation of BGP FS rules on network nodes by displaying the content displayed by the device. Further, the network administrator can perform corresponding adjustment measures according to the traffic matching information.
  • the display device mentioned here may be a display screen, and the display screen may be a display screen of the first server or a display screen of other devices, and the embodiment of the present application does not make specific limitations.
  • the first server may further determine whether the traffic matching information meets the preset condition.
  • the determination of whether the traffic matching information meets the preset conditions mentioned here refers to determining whether the effect of the BGF FS rule for traffic control is as expected.
  • the embodiment of the present application does not make a specific limitation. Considering that in practical applications, the BGP FS rule is to analyze the historical data traffic passing through the network nodes, and formulate the abnormal traffic after it is determined that there is an abnormal traffic.
  • the foregoing preset condition may also be determined based on abnormal traffic, that is, obtained by analyzing historical data traffic passing through the network node. For example, by analyzing the historical data traffic passing through the network node, it is found that the attack traffic passing through the network node in a unit time is M, then the aforementioned traffic matching information meets the preset condition, for example, the traffic in the unit time and the BGP FS rule.
  • the data flow matched by the control strategy is greater than or equal to M*k, where k is the proportional coefficient.
  • the first server determines that the acquired traffic matching information meets the preset condition, it means that the BGP FS rule can effectively prevent attack traffic. If the first server determines that the acquired traffic matching information does not meet the preset conditions, it means that the BGP FS rule may not be able to effectively prevent attack traffic. For the situation where the BGP FS rule may not be able to effectively prevent the attack traffic, the first server can further determine the reason why the BGP FS rule cannot effectively prevent the attack traffic, and implement corresponding adjustment measures to achieve the purpose of effectively preventing the attack traffic.
  • the first server may, for example, reconfigure the network node, so that the BGP FS rule is normally implemented on the network node.
  • the first server may modify the BGP FS rule, for example, and send the modified BGP FS rule to the network node.
  • the first server when the first server executes the second operation according to the traffic matching information, it may also include two implementation manners in specific implementation.
  • One implementation manner is to send a second configuration instruction to the network node according to the traffic matching information when it is determined that the traffic matching information does not meet the preset condition, and the second configuration instruction is used to reconfigure the network node.
  • Another implementation method is to modify the BGP FS rule according to the traffic matching information when it is determined that the traffic matching information does not meet the preset conditions, and send the modified BGP FS rule to the network node.
  • the two implementations are introduced separately as follows.
  • the first server may first determine whether the BGP FS rule is abnormally implemented on the network node because the traffic matching information does not meet the preset condition according to the status of the acquired BGP FS rule implemented on the network node. Specifically, if the status of the implementation of the BGP FS rule on the network node obtained by the first server, including the priority of the BGP FS rule is lower than the priority of other traffic control policies, it means that the BGP FS rule is abnormally implemented on the network node, and accordingly Yes, the first server may send a second configuration instruction to the network node. The second configuration instruction is used to configure the network node to cancel the implementation of other traffic control policies, or to configure the network node to preferentially implement the BGP FS rule. For other flow control strategies, you can refer to the previous description of the implementation status information, which will not be described in detail here.
  • the first server can also analyze the data traffic passing through the network nodes to determine whether there is abnormal traffic. If there is abnormal traffic, it means that other traffic control strategies have not effectively prevented attack traffic. In this case, the first server will send The network node sends the aforementioned second configuration instruction. If there is no abnormal traffic, it means that other traffic control strategies can effectively prevent attack traffic. At this time, the first server may not need to perform the foregoing step of sending the foregoing second configuration instruction to the network node.
  • the priority of the BGP FS rule is lower than the priority of other traffic control policies, which means that the BGP FS rule is normally implemented. Accordingly, the first server can It is determined that the traffic matching information does not meet the preset conditions, which is caused by the configuration of the BGP FS rule itself. Considering that in practical applications, on the one hand, if there are some parameter combinations in the BGP FS rules, the BGP FS rules will not take effect, and further, the BGP FS rules will not be able to effectively prevent attack traffic after they are implemented on network nodes. For example, parameter 1 requires matching packets less than 1000 bytes, and parameter 2 requires matching packets greater than 2000 bytes.
  • the BGP FS rule cannot take effect.
  • the traffic processing behavior corresponding to parameter 3 is redirected to a certain VPN instance, and the traffic processing behavior corresponding to parameter 3 is redirected to a specific IP address.
  • the BGP FS rule cannot take effect.
  • the first server may analyze the configuration parameters of the BGP FS rule to determine whether there are some parameter combinations in the BGP FS rule that will make the BGP FS rule ineffective. If it exists, the first server can modify these parameters again, so that the modified BGP FS rule can take effect.
  • the first server may analyze the data traffic passing through the network node, and modify the BGP FS rule based on the analysis result.
  • the first server may determine the characteristics of the attack traffic by analyzing the data traffic passing through the network node within a preset time period, and modify the BGPFS rule according to the characteristics of the attack traffic. For example, after the first server analyzes the data traffic passing through the network node in the first time period, it determines that there are a large number of attack traffic with the network segment where the destination address is 10.1.1.0/24, and the matching conditions in the BGP FS rule The network segment where the destination address is located is 20.1.1.0/24, then the first server modifies the network segment where the destination address is located in the matching condition in the BGP FS rule to 10.1.1.0/24. Regarding the preset time period, the embodiment of the present application does not specifically limit it.
  • FIG. 3 is a signaling interaction diagram of an information reporting method provided in an embodiment of this application.
  • Figure 3 shows the signaling interaction between the network node and the first server. It should be noted that in the scenario shown in Figure 3, the second server and the first server mentioned above are integrated on one device.
  • FIG. 3 shows some steps only for the convenience of understanding, but this does not constitute a limitation to the embodiment of the present application.
  • the information reporting method shown in FIG. 3 can be implemented through the following S201-S209.
  • the first server sends the BGP FS route to the network node.
  • S202 The first server sends a status report instruction to the network node.
  • the network node obtains the status of the implementation of the BGP FS rule on the network node, and the status is that the BGP FS route has been implemented on the network node.
  • the BGP FS route received by the network node carries the BGP FS rule.
  • S204 The network node sends the acquired status to the first server.
  • S205 The first server sends a traffic information report instruction to the network node.
  • the network node obtains traffic matching information of the BGP FS rule.
  • S207 The network node sends the acquired traffic matching information to the first server.
  • the first server determines that the traffic matching information does not meet the preset condition, and determines that the received status indicates that the priority of the BGP FS rule is lower than the priority of other traffic control policies.
  • the first server sends a second configuration instruction to the network node, where the second configuration instruction is used to configure the network node to preferentially implement the BGP FS rule.
  • an embodiment of the present application also provides an information reporting device, which is used to execute the information reporting method performed by the network node mentioned in the foregoing embodiment, for example, as shown in FIG. 2 and Figure 3 shows the steps performed by the network node.
  • the information reporting device is described below in conjunction with the drawings.
  • FIG. 4 is a schematic structural diagram of an information reporting apparatus provided by an embodiment of the application.
  • the information reporting apparatus 400 shown in FIG. 4 may include an acquiring unit 401 and a sending unit 402, for example.
  • the obtaining unit 401 is configured to obtain the status of the border gateway protocol flow specification BGP FS rule implemented on the network node; the status indicates that the BGP FS rule has been implemented on the network node, or the status indicates the BGP FS rules are not implemented on the network node;
  • the sending unit 402 is configured to send the status to the server.
  • the sending unit 402 is specifically configured to:
  • the state is added to the route monitoring RM message, and the RM message with the state added is sent to the server.
  • that the BGP FS rule has been implemented on the network node includes: the BGP FS rule is normally implemented, or the BGP FS rule is implemented abnormally.
  • the abnormal implementation of the BGP FS rule includes:
  • the priority of the BGP FS rule is lower than the priority of other flow control policies, and the other flow control policies run on the network node.
  • the BGP FS rule is not implemented on the network node, including:
  • the BGP FS rule fails the BGP verification, and/or, the BGP FS rule fails the BGP FS verification.
  • the BGP FS rule fails BGP verification, including:
  • the BGP FS rule carries illegal parameters.
  • the BGP FS rule fails the BGP FS verification, and includes any one or more of the following:
  • the BGP FS rule does not meet the preset implementation conditions
  • the effective interface carried in the BGP FS rule does not match the interface of the network node
  • the BGP FS rule conflicts with a security protection policy, and the security protection policy runs on the network node.
  • the obtaining unit 401 is further configured to obtain traffic matching information of the BGP FS rule, and the traffic matching information Is the relevant information of the data flow that matches the BGP FS rule;
  • the sending unit 402 is further configured to send the traffic matching information to the server.
  • the sending unit 402 is specifically configured to:
  • the flow matching information is added to the status report SR message, and the SR message with the flow matching information added is sent to the server.
  • the acquiring unit 401 is specifically configured to:
  • the acquiring unit 401 is specifically configured to:
  • the traffic matching information of the BGP FS rule is acquired.
  • the device 400 is a device corresponding to the information reporting method provided by the above method embodiment and executed by a network node, the specific implementation of each unit of the device 400 is based on the same idea as the above method embodiment. Therefore, regarding For the specific implementation of each unit of the apparatus 400, refer to the description part of the method for reporting information performed by the network node in the above method embodiment, and the description will not be repeated here.
  • an embodiment of the present application also provides a data processing device, which is configured to execute the data processing method executed by the first server mentioned in the previous embodiment, for example, Figures 2 and 3 show the steps performed by the first server.
  • the data processing device is described below in conjunction with the drawings.
  • the information reporting apparatus 500 shown in FIG. 5 may include an obtaining unit 501 and a storage unit 502, for example.
  • the obtaining unit 501 is configured to obtain the status of the border gateway protocol flow specification BGP FS rule implemented on the network node; the status indicates that the BGP FS rule has been implemented on the network node, or the status indicates the BGP FS rules are not implemented on the network node;
  • the storage unit 502 is used to store the state.
  • that the BGP FS rule has been implemented on the network node includes: the BGP FS rule is normally implemented, or the BGP FS rule is implemented abnormally.
  • the abnormal implementation of the BGP FS rule includes:
  • the priority of the BGP FS rule is lower than the priority of other flow control policies, and the other flow control policies run on the network node.
  • the BGP FS rule is not implemented on the network node, including:
  • the BGP FS rule fails the BGP verification, and/or, the BGP FS rule fails the BGP FS verification.
  • the BGP FS rule fails BGP verification, including:
  • the BGP FS rule carries illegal parameters.
  • the BGP FS rule fails the BGP FS check, and includes any one or more of the following:
  • the BGP FS rule does not meet the preset implementation conditions
  • the effective interface carried in the BGP FS rule does not match the interface of the network node
  • the BGP FS rule conflicts with a security protection policy, and the security protection policy runs on the network node.
  • the device 500 further includes:
  • the operation unit is configured to perform the first operation according to the state; or,
  • the sending unit is configured to send the status to a second server, and the second server executes the first operation according to the status.
  • the operating unit is specifically configured to:
  • the operating unit is specifically configured to:
  • the operating unit is specifically configured to:
  • the operating unit is specifically configured to:
  • the illegal parameter carried in the BGP FS rule is determined, and the illegal parameter is modified to a legal parameter.
  • the operating unit is specifically configured to:
  • the effective interface carried in the BGP FS rule is modified to an interface that matches the interface of the network node.
  • the operating unit is specifically configured to:
  • the BGP FS rule is modified to a BGP FS rule that does not conflict with the security protection policy.
  • the operating unit is specifically configured to:
  • a first configuration instruction is sent to the network node, where the first configuration instruction is used to instruct the network node to reconfigure the target parameters so that all The BGP FS rule meets the preset implementation condition; or, the first configuration instruction is used to configure the network node to cancel the verification whether the BGP FS rule meets the preset implementation condition.
  • the acquiring unit 501 is further configured to acquire traffic matching information of the BGP FS rule, where the traffic matching information is related information of data traffic matching the BGP FS rule;
  • the storage unit 502 is further configured to store the traffic matching information.
  • the operating unit is further configured to perform a second operation according to the traffic matching information; or,
  • the sending unit is further configured to send the traffic matching information to the second server, and the second server performs a second operation according to the traffic matching information.
  • the operating unit is specifically configured to:
  • the operating unit is specifically configured to:
  • the BGP FS rule is modified according to the traffic matching information, and the modified BGP FS rule is modified Sent to the network node.
  • the operating unit is specifically configured to:
  • the operating unit is specifically configured to:
  • a second configuration instruction is sent to the network node, and the second configuration instruction is used to configure the network node to cancel the implementation
  • the other flow control policy may be used to configure the network node to preferentially implement the BGP FS rule.
  • the device 500 further includes:
  • An analysis unit configured to analyze the data flow passing through the network node before sending the second configuration instruction to the network node to obtain an analysis result
  • the operating unit is specifically used for:
  • the operating unit is specifically configured to:
  • the BGP FS rule is modified.
  • the operating unit is specifically configured to:
  • the operating unit is specifically configured to:
  • the data traffic passing through the network node is analyzed, and the BGP FS rule is modified according to the analysis result.
  • the sending unit is further configured to send a status report instruction to the network node, and the status report instruction is used to instruct the network node to report the BGP FS rule to the data processing device. The status of the implementation on the network node.
  • the sending unit is further configured to send a traffic information report instruction to the network node, and the traffic information report instruction is used to instruct the network node to report the BGP FS to the data processing apparatus.
  • the flow matching information of the rule where the flow matching information is related information of the data flow matching the BGP FS rule.
  • the sending unit is specifically configured to:
  • the flow information reporting instruction is sent to the network node.
  • the device 500 is a device corresponding to the data processing method provided by the above method embodiment and executed by the first server, the specific implementation of each unit of the device 500 is based on the same idea as the above method embodiment, therefore, For the specific implementation of each unit of the device 500, reference may be made to the description part of the data analysis method executed by the first server in the above method embodiment, and the description will not be repeated here.
  • An embodiment of the present application also provides an information reporting device, the device including: a processor and a memory; the memory is used to store instructions; the processor is used to execute the instructions in the memory to The information reporting method performed by the network node provided by the above method embodiment is executed.
  • the information reporting device may be any network device in FIG. 1.
  • An embodiment of the present application also provides a data processing device, the device including: a processor and a memory; the memory is used to store instructions; the processor is used to execute the instructions in the memory to The data analysis method performed by the first server provided in the above method embodiment is executed.
  • the data analysis device may be the server 200 or the server 300 in FIG. 1.
  • FIG. 6 is a schematic diagram of the structure of a device provided by an embodiment of the application.
  • the device 600 includes a processor 610, a communication interface 620, and a memory 630.
  • the number of processors 610 in the device 600 may be one or more.
  • One processor is taken as an example in FIG. 6.
  • the processor 610, the communication interface 620, and the memory 630 may be connected through a bus system or other methods.
  • the connection through the bus system 640 is taken as an example.
  • the processor 610 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor 610 may further include a hardware chip.
  • the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.
  • the processor 610 may execute the steps performed by the foregoing acquisition unit 401 and the sending unit 402.
  • the processor 610 may execute the steps performed by the foregoing acquisition unit 501 and the storage unit 502.
  • the memory 630 may include a volatile memory (English: volatile memory), such as random-access memory (RAM); the memory 630 may also include a non-volatile memory (English: non-volatile memory), such as fast Flash memory (English: flash memory), hard disk drive (HDD) or solid-state drive (SSD); the memory 630 may also include a combination of the foregoing types of memory.
  • volatile memory such as random-access memory (RAM)
  • non-volatile memory such as fast Flash memory (English: flash memory), hard disk drive (HDD) or solid-state drive (SSD)
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory 630 may store the BGP FS rules and the like mentioned in the foregoing embodiment. If the network device 600 is the data processing device mentioned in the foregoing embodiment, the memory 630 may store the status of the implementation of the BGP FS rule mentioned in the foregoing embodiment on the network node, and so on.
  • the memory 630 stores an operating system and a program, an executable module or a data structure, or a subset of them, or an extended set of them, where the program may include various operation instructions for implementing various operations.
  • the operating system may include various system programs for implementing various basic services and processing hardware-based tasks.
  • the processor 610 can read the program in the memory 630 to implement the data collection method provided in the embodiment of the present application.
  • the bus system 640 may be a peripheral component interconnect standard (PCI) bus or an extended industry standard architecture (EISA) bus, etc.
  • PCI peripheral component interconnect standard
  • EISA extended industry standard architecture
  • the bus system 640 can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 6, but it does not mean that there is only one bus or one type of bus.
  • the embodiments of the present application also provide a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute the information reporting method performed by the network node provided in the above embodiments.
  • the embodiments of the present application also provide a computer-readable storage medium, including instructions, which when run on a computer, cause the computer to execute the data processing method provided by the above embodiments and executed by the first server.
  • the embodiments of the present application also provide a computer program product containing a program, which when running on a computer, causes the computer to execute the information reporting method performed by the network node provided in the above embodiments.
  • the embodiments of the present application also provide a computer program product containing a program, which when running on a computer, causes the computer to execute the data processing method provided by the above embodiments and executed by the first server.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of units is only a logical business division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • service units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software business unit.
  • the integrated unit is realized in the form of a software business unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several programs to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .
  • the services described in the present invention can be implemented by hardware, software, firmware, or any combination thereof.
  • these services can be stored in a computer-readable medium or transmitted as one or more programs or codes on the computer-readable medium.
  • the computer-readable medium includes a computer storage medium and a communication medium, where the communication medium includes any medium that facilitates the transfer of a computer program from one place to another.
  • the storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种信息上报方法，在传统技术中，生成BGP FS规则的设备将BGP FS规则发送给网络节点之后，并没有采取措施对该BGP FS规则的在网络节点上实施的状态进行进一步的监控。在本申请中，网络节点接收到BGP FS规则之后，可以获取该BGP FS规则在网络节点上实施的状态，其中，该状态可以指示BGP FS规则已经在网络节点上实施，或者，指示BGP FS规则未在网络节点上实施。而后，网络节点将该状态发送给服务器。这样一来，服务器就可以获知BGP FS规则的在网络节点上实施的状态。相应的，该服务器或者其它服务器例如生成BGP FS规则的服务器则可以存储该状态，如有必要还可以进一步根据该状态执行相应的操作，例如执行相应的调整措施，从而有效防止攻击流量。

Description

一种信息上报方法、数据处理方法及装置
本申请要求于2019年10月31日提交中国国家知识产权局、申请号201911053999.5、申请名称为“一种信息上报方法、数据处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种信息上报方法、数据处理方法及装。
背景技术
目前，随着通信技术的发展，出现了一些通信安全问题，例如，通信设备受到网络攻击等等。相应的，也出现了一些防止网络攻击的策略，其中一种防止网络攻击的策略即为边界网关协议流规则(Border Gateway Protocol Flow Specification，BGP FS)。BGP FS可以通过传递BGP FS路由将BGP FS规则传递给BGP FS对等体例如网络节点，从而达到在网络节点处控制流量，以达到防止攻击流量的目的。
但是在传统技术中，利用BGP FS并不能有效防止攻击流量，因此，急需一种方案，可以解决上述问题。
发明内容
本申请实施例提供了一种信息上报方法，有利于解决利用BGP FS规则并不能有效防止流量攻击的问题。
在本申请实施例的第一方面，提供了一种信息上报方法，考虑到在传统技术中，生成BGP FS规则的服务器将BGP FS规则发送给网络节点之后，与该BGP FS规则相关的控制流程就结束了，并没有采取任何措施对该BGP FS规则的在网络节点上实施的状态进行进一步的监控。从而导致该BGP FS规则在网络节点上实施的状态未知，进一步导致BGP FS规则并不能有效防止攻击流量，因为前述BGP FS规则可能并没有在网络节点上实施。为了解决这个问题，在本申请实施例中，网络节点接收到BGP FS规则之后，可以获取该BGP FS规则在网络节点上实施的状态，其中，该状态可以指示BGP FS规则已经在网络节点上实施，或者，指示BGP FS规则未在网络节点上实施。而后，网络节点将该状态发送给服务器。这样一来，服务器就可以获知BGP FS规则的在网络节点上实施的状态。相应的，该服务器或者其它服务器例如生成BGP FS规则的服务器则可以存储该状态，如有必要还可以进一步根据该状态执行相应的操作，例如执行相应的调整措施，从而有效防止攻击流量。
在一种实现方式中，考虑到在实际应用中，若在网络节点上部署了BMP监控BGP FS Local-RIB功能，则网络节点接收到BGP FS路由之后，会将该BGP FS路由上报给BMP服务器。而且，网络节点可以通过RM消息将接收到的BGP FS路由上报给BMP服务器。鉴于此，网络节点可以利用该RM消息作为载体，将BGP FS规则在网络节点上实施的 状态携带在该RM消息中发送给第一服务器。具体地，网络节点可以将BGP FS规则在网络节点上实施的状态添加到RM消息中，而后将该添加了前述状态的RM消息，发送给第一服务器。
在一种实现方式中，对于网络节点上并未部署BMP监控BGP FS Local-RIB功能的情况，由于网络节点上并未部署BMP监控BGP FS Local-RIB功能，故而网络节点不会向第一服务器发送BGP FS路由，相应的，也不能将该BGP FS规则在网络节点上实施的状态，携带在RM消息中发送给第一服务器。对于这种情况，第一服务器可以向网络节点发送状态上报指令，该状态上报指令，用于指示网络节点将该BGP FS规则在网络节点上实施的状态上报给第一服务器。换言之，网络节点可以在接收到第一服务器的状态上报指令之后，执行获取BGP FS规则在网络节点上实施的状态、并将获取的状态发送给第一服务器的步骤。
在一种实现方式中，为了使得前述状态能够体现该BGP FS规则在网络节点上实施的更多细节。而BGP FS规则已经在网络节点上实施可以包括至少两类情况，其中一类可以归纳为正常实施，另一类可以归纳为异常实施。所谓正常实施，指的是该BGP FS规则已经正确参与BGP最优选路流程，并且该BGP FS规则实施时并未受到其它因素的干扰。所谓异常实施，指的是虽然该BGP FS规则已经正确参与BGP最优选路流程，但是该BGP FS规则实施时受到了其它因素的干扰。因此，前述BGP FS规则已经在网络节点上实施，可以包括BGP FS规则在网络节点上正常实施，或者，BGP FS规则在网络节点上异常实施。
在一种实现方式中，考虑到在实际应用中，网络节点上可能还运行了其它流量控制策略。一旦BGP FS规则的优先级低于其它流量控制策略的优先级。则这些其它流量控制策略就会对网络节点实施BGP FS规则带来干扰。因为经过网络节点的流量，会首先被其它流量控制策略处理，然后再被BGP FS规则处理。换言之，前述BGP FS规则在网络节点上异常实施，可以指的是BGP FS规则的优先级低于其它流量控制策略的优先级。
在一种实现方式中，当前述状态为BGP FS规则未在网络节点上实施时，为了使得该状态能够进一步体现该BGP FS规则未在网络节点上实施的原因。前述状态还可以进一步体现BGP FS规则未在网络节点上实施的具体原因。具体地，考虑到网络节点获取到BGP FS规则之后，首先会对BGP FS规则进行校验，只有在BGP FS规则通过校验之后，网络节点才有可能实施该BGP FS规则。其中，对BGP FS规则进行校验，可以包括BGP校验和/或BGP FS校验。若该BGP FS规则未通过BGP校验，或者，该BGP FS规则未通过BGP FS校验，网络节点则不再实施该BGP FS规则。因此，BGP FS规则未在网络节点上实施，可以包括BGP FS规则未通过BGP校验，和/或，BGP FS规则未通过BGP FS校验。
在一种实现方式中，BGP FS规则未通过BGP校验可以为BGP FS规则中携带非法参数。非法参数可以至少包括两种情况，其中一种是BGP FS规则中存在网络节点无法处理的参数，另外一种是BGP FS规则中存在非法自治域路径。
在一种实现方式中，考虑到一般而言，网络节点可以包括一个或者多个接口，该BGP FS规则中一般会携带该BGP FS规则的生效接口。若该BGP FS规则中携带的生效 接口，与网络节点的接口不匹配，则会导致该BGP FS规则无法在网络节点上实施。因此，BGP FS规则未在网络节点上实施，可以为BGP FS规则携带的生效接口与网络节点的接口不匹配。而且，考虑到在实际应用中，网络节点上还可以配置相应的安全保护策略，若BGP FS规则与安全保护策略冲突，则也会导致该BGP FS规则无法在网络节点上实施。因此，BGP FS规则未在网络节点上实施，可以为BGP FS规则与安全保护策略冲突。另外，一般而言，在网络节点上还可以为BGP FS规则设置预设实施条件，当该BGP FS规则满足该预设实施条件时，网络节点才可能实施该BGP FS规则。因此，BGP FS规则未在网络节点上实施，可以为BGP FS不符合规则预设实施条件。
在一种实现方式中，当BGF FS规则已经在网络节点上实施时，为了进一步对该BGP FS规则的流量控制效果进行评估，网络节点还可以获取BGP FS规则的流量匹配信息，并将该流量匹配信息发送给第一服务器。其中，该流量匹配信息指的是：与BGP FS规则匹配的数据流量的相关信息。
在一种实现方式中，若在网络节点上部署了BMP监控BGP FS Local-RIB功能，则网络节点接收到BGP FS路由之后，会将该BGP FS路由上报给BMP服务器。网络节点向BMP服务器发送的消息中，有一类消息是SR消息，该SR消息中携带的是统计信息，而流量匹配信息也可以认为是一种统计信息。鉴于此，可以以已有的SR消息为载体，将前述流量匹配信息发送给第一服务器。换言之，网络节点可以将BGP FS规则的流量匹配信息添加到SR消息中，而后将该添加了前述流量匹配信息的SR消息，发送给第一服务器。具体地，网络节点可以将该流量匹配信息携带在SR消息的扩展字段中。例如，可以将该流量匹配信息携带在扩展的TLV字段中。
在一种实现方式中，对于网络节点上并未部署BMP监控BGP FS Local-RIB功能的情况，第一服务器可以向网络节点发送流量信息上报指令，该流量信息上报指令，用于指示网络节点将前述流量匹配信息上报给第一服务器。换言之，网络节点可以在接收到第一服务器的流量信息上报指令之后，执行获取BGP FS规则的流量匹配信息、并将流量匹配信息发送给第一服务器的步骤。
在一种实现方式中，考虑到若BGP FS规则并未在网络节点上实施，则必然不会存在与该BGP FS规则匹配的数据流量。鉴于此，第一服务器可以在接收到来自网络节点的前述状态，并在该状态指示BGP FS规则已经在网络节点上实施时，才向网络节点发送流量信息上报指令，从而减少第一服务器与网络节点之间的数据交互。
第二方面，本申请实施例提供了一种数据处理方法，具体地，第一服务器可以获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；所述第一服务器存储所述状态。这样一来，第一服务器即可以获知BGP FS规则的在网络节点上实施的状态。相应的，第一服务器可以在有必要时进一步根据该状态执行相应的操作，例如执行相应的调整措施，从而有效防止攻击流量。
在一种实现方式中，第一服务器存储BGP FS规则在网络节点上实施的状态之后，可以读取BGP FS规则在网络节点上实施的状态，并且根据该状态执行其它操作，例如根据该状态执行第一操作。当然，第一服务器也可以将前述状态发送给第二服务器，由第二服务器根据该状态执行第一操作。考虑到在实际应用中，一般而言，该第一操 作与前述BGP FS规则具备一定的联系，因此，在本申请实施例中，第二服务器可以为生成BGP FS规则的服务器。可以理解的是，当第一服务器和第二服务器运行在一个设备上时，第一服务器自身即可根据前述状态执行第一操作，当第一服务器和第二服务器运行在两个设备上时，第一服务器可以将前述状态发送给第二服务器，由第二服务器根据前述状态执行第一操作。
在本申请实施例的一种实现方式中，为了使得网络管理人员了解BGP FS规则在网络节点上实施的状态，第一服务器或者第二服务器可以控制显示设备显示前述状态。这样一来，网络管理人员即可通过显示设备显示的内容，确定BGP FS规则在网络节点上实施的状态。进一步地，网络管理人员可以根据该状态执行相应的调整措施。
在一种实现方式中，为了使得前述BGP FS规则可以在网络节点上实施，以达到控制攻击流量的目的。若前述状态指示BGP FS规则未在网络节点上实施，第一服务器或者第二服务器根据前述状态执行第一操作在具体实现时，还可以是以使得BGP FS规则能够在网络节点上实施为目的。具体地，若第一服务器或者第二服务器确定BGP FS规则未在网络节点上实施是由BGP FS规则的配置参数导致的，则第一服务器或者第二服务器执行第一操作在具体实现时，例如可以为对BGP FS规则进行修改，并将修改后的BGP FS规则发送给网络节点，以使得网络节点实施修改后的BGP FS规则。若第一服务器或者第二服务器确定BGP FS规则未实施是由网络节点的配置导致的，则第一服务器或者第二服务器执行第一操作在具体实现时，例如可以为向网络节点发送第一配置指令，该第一配置指令用于重新配置网络节点，从而使得网络节点可以实施BGP FS规则。
在一种实现方式中，考虑到BGP FS规则未通过BGP校验，可以为BGP FS规则中携带非法参数。因此，若前述状态指示BGP FS规则未通过BGP校验，第一服务器或者第二服务器可以对BGP FS规则进行修改，使得修改后的BGP FS规则通过BGP校验。这样一来，第一服务器或者第二服务器将修改后的BGP FS规则发送给网络节点之后，网络节点即可执行实施该BGP FS规则。具体地，第一服务器或者第二服务器可以确定BGP FS规则中携带的非法参数，并将非法参数修改为合法参数。
在一种实现方式中，若前述状态指示BGP FS规则携带的生效接口与网络节点的接口不匹配，则第一服务器或者第二服务器可以对BGP FS规则进行修改。具体地，第一服务器或者第二服务器可以将BGP FS规则携带的生效接口，修改为与网络节点的接口匹配的接口，并将修改后的BGP FS规则发送给网络节点。这样一来，网络节点即可执行实施该BGP FS规则。
在一种实现方式中，若前述状态可以指示BGP FS规则与安全保护策略冲突，则第一服务器或者第二服务器可以对BGP FS规则进行修改，具体地，第一服务器或者第二服务器可以将BGP FS规则修改为与安全保护策略不冲突的BGP FS规则，并将修改后的BGP FS规则发送给网络节点，这样一来，网络节点即可执行实施该BGP FS规则。
在一种实现方式中，若前述状态可以指示BGP FS规则未通过BGP FS校验。而BGP FS规则未通过BGP FS校验，可能是因为BGP FS规则不符合预设实施条件。对于这种情况，第一服务器或者第二服务器可以向网络节点发送第一配置指令，该第一配置指令用于指示网络节点重新配置目标参数，该目标参数为确定BGP FS规则是否符合所述 预设实施条件所使用的参数，使得网络节点重新配置目标参数之后，该BGP FS规则可以符合预设实施条件。当然，该第一配置指令，还可以为用于配置网络节点取消验证BGP FS规则是否符合预设实施条件的配置指令。可以理解的是，若网络节点不再验证BGP FS规则是否符合预设实施条件，网络节点则可以实施该BGP FS规则。
在一种实现方式中，第一服务器还可以获取BGP FS规则的流量匹配信息，获取到该流量匹配信息之后，第一服务器还可以存储该流量匹配信息。这样一来，第一服务器即可以获知BGP FS规则的在网络节点上的流量匹配情况。相应的，第一服务器可以在有必要时进一步根据该状态执行相应的操作，例如执行相应的调整措施，从而有效防止攻击流量。
在一种实现方式中，第一服务器还可以根据该流量匹配信息执行第二操作，或者，将该流量匹配信息发送给第二服务器，由第二服务器根据该流量匹配信息执行第二操作。
在一种实现方式中，为了使得网络管理人员了解BGP FS规则在网络节点上的流量匹配情况，第一服务器或者第二服务器根据该流量匹配信息执行第二操作在具体实现时，例如可以为第一服务器或者第二服务器可以控制显示设备显示前述流量匹配信息。这样一来，网络管理人员即可通过显示设备显示的内容，确定BGP FS规则在网络节点上的流量匹配情况。
在一种实现方式中，为了使得前述BGP FS规则可以有效控制攻击流量，以达到控制攻击流量的目的。第一服务器或者第二服务器获取到流量匹配信息之后，可以进一步判断该流量匹配信息是否符合预设条件。此处提及的确定流量匹配信息是否符合预设条件，指的是确定BGF FS规则进行流量控制的效果是否达到预期。
在一种实现方式中，考虑到在实际应用中，BGP FS规则是对经过网络节点的历史数据流量进行分析，确定存在异常流量之后针对该异常流量制定的。因此，前述预设条件也可以根据异常流量来确定，即通过对经过所述网络节点的历史数据流量进行分析得到。
在一种实现方式中，若确定获取到的流量匹配信息符合预设条件，则表示该BGP FS规则可以有效防止攻击流量。若确定获取到的流量匹配信息不符合预设条件，则表示BGP FS规则可能并不能有效防止攻击流量。对于BGP FS规则可能并不能有效防止攻击流量的情况，第一服务器或者第二服务器可以进一步确定BGP FS规则不能有效防止攻击流量的原因，并执行相应的调整措施，以达到有效防止攻击流量的目的。一般而言，导致前述流量匹配信息不符合预设条件的原因可能有两种。其中一种是BGP FS规则在实施时受到了其它流量控制策略的干扰。也就是BGP FS规则在网络节点上异常实施。另外一种则是由于BGP FS规则自身的配置导致的。对于第一种原因，第一服务器或者第二服务器例如可以对网络节点进行重新配置，从而使得BGP FS规则在网络节点上正常实施。对于第二种原因，第一服务器或者第二服务器例如可以对BGP FS规则进行修改，并将修改后的BGP FS规则发送给网络节点。换言之，第一服务器或者第二服务器根据流量匹配信息执行第二操作在具体实现时，还可以包括两种实现方式。一种实现方式是，在确定流量匹配信息不符合预设条件时，根据流量匹配信息向网络节点发送第二配置指令，该第二配置指令用于重新配置网络节点。另一种实现方式是， 在确定流量匹配信息不符合预设条件时，根据流量匹配信息对BGP FS规则进行修改，并将修改后的BGP FS规则发送给网络节点。
在一种实现方式中，第一服务器或者第二服务器可以首先根据获取到的BGP FS规则在网络节点上实施的状态，确定导致流量匹配信息不符合预设条件的原因是不是BGP FS规则在网络节点上异常实施。具体地，若第一服务器或者第二服务器获取的BGP FS规则在网络节点上实施的状态，包括BGP FS规则的优先级低于其它流量控制策略的优先级，则表示BGP FS规则在网络节点上异常实施，相应的，第一服务器或者第二服务器可以向网络节点发送第二配置指令，第二配置指令，用于配置网络节点取消实施其它流量控制策略，或者，用于配置网络节点优先实施BGP FS规则。
在一种实现方式中，考虑到在实际应用中，若前述其它流量控制策略能有效防止攻击流量，则即使BGP FS规则不在网络节点上实施，也不会影响网络系统的正常工作。鉴于此，若第一服务器或者第二服务器获取的BGP FS规则在网络节点上实施的状态，包括BGP FS规则的优先级低于其它流量控制策略的优先级，则第一服务器或者第二服务器还可以对经过网络节点的数据流量进行分析，确定是否存在异常流量，若存在异常流量，则表示其它流量控制策略并未有效防止攻击流量，在这种情况下，第一服务器或者第二服务器才向网络节点发送前述第二配置指令。若不存在异常流量，则表示其它流量控制策略可以有效防止攻击流量，此时第一服务器或者第二服务器可以不必执行前述向网络节点发送前述第二配置指令的步骤。
在一种实现方式中，若第一服务器或者第二服务器获取的BGP FS规则在网络节点上实施的状态，不包括BGP FS规则的优先级低于其它流量控制策略的优先级，则表示BGP FS规则正常实施，相应的，第一服务器或者第二服务器可以确定流量匹配信息不符合预设条件，是由于BGP FS规则自身的配置导致的。对于这种情况，第一服务器或者第二服务器可以向网络节点发送第二配置指令，用于重新配置网络节点，使得前述BGP FS规则实施之后可以有效防止攻击流量。
在一种实现方式中，考虑到在实际应用中，若BGP FS规则中存在一些参数组合，会使得BGP FS规则无法生效，进一步地则会导致该BGP FS规则在网络节点上实施之后不能有效防止攻击流量。因此，第一服务器或者第二服务器可以对BGP FS规则的配置参数进行分析，确定BGP FS规则中是否存在一些参数组合会使得BGP FS规则无法生效。若存在，则第一服务器或者第二服务器可以对这些参数重新进行修改，使得修改后得到的BGP FS规则能够生效。
在一种实现方式中，考虑到在实际应用中，若BGP FS规则指示的流量控制策略所针对的流量，并非是实际上需要防止的攻击流量，也会导致该BGP FS规则实施之后不能有效防止攻击流量。对于这种情况，第一服务器或者第二服务器可以对经过网络节点的数据流量进行分析，并根据基于分析结果对BGP FS规则进行修改。具体地，第一服务器或者第二服务器可以通过对预设时间段内经过网络节点的数据流量进行分析，确定攻击流量的特征，并根据攻击流量的特征来对BGP FS规则进行修改。
第三方面，本申请实施例提供了一种信息上报装置，所述装置包括：获取单元，用于获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则 未在所述网络节点上实施；发送单元，用于将所述状态发送给服务器。
在一种实现方式中，所述发送单元，具体用于：将所述状态添加至路由监控RM消息中，并将添加了所述状态的RM消息发送给所述服务器。
在一种实现方式中，若所述状态为所述BGP FS规则已经在所述网络节点上实施，所述获取单元，还用于获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；所述发送单元，还用于将所述流量匹配信息发送给所述服务器。
在一种实现方式中，所述发送单元具体用于：将所述流量匹配信息添加至状态报告SR消息中，并将添加了所述流量匹配信息的SR消息发送给所述服务器。
在一种实现方式中，所述获取单元具体用于：接收到来自所述服务器的状态上报指令之后，获取所述BGP FS规则在所述网络节点上实施的状态。
在一种实现方式中，所述获取单元具体用于：接收到来自所述服务器的流量信息上报指令之后，获取所述BGP FS规则的流量匹配信息。
第四方面，本申请实施例提供了一种数据处理装置，所述装置包括：获取单元，用于获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；存储单元，用于存储所述状态。
在一种实现方式中，所述装置还包括：操作单元，用于根据所述状态执行第一操作，或者，发送单元，用于将所述状态发送给第二服务器，由所述第二服务器根据所述状态执行第一操作。
在一种实现方式中，所述操作单元具体用于：若所述状态为所述BGP FS规则携带的生效接口与所述网络节点的接口不匹配，则将所述BGP FS规则携带的生效接口修改为与所述网络节点的接口匹配的接口。
在一种实现方式中，所述操作单元具体用于：若所述状态为描述所述BGP FS规则与安全保护策略冲突，则将所述BGP FS规则修改为与所述安全保护策略不冲突的BGP FS规则。
在一种实现方式中，所述操作单元具体用于：若所述状态为所述BGP FS规则不符合预设实施条件，则向所述网络节点发送第一配置指令，所述第一配置指令用于指示所述网络节点重新配置目标参数，以使得所述BGP FS规则符合所述预设实施条件；或者，所述第一配置指令，用于配置所述网络节点取消验证所述BGP FS规则是否符合所述预设实施条件。
在一种实现方式中，所述获取单元还用于获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；所述存储单元还用于存储所述流量匹配信息。
在一种实现方式中，所述操作单元还用于根据所述流量匹配信息执行第二操作；或者，所述发送单元还用于将所述流量匹配信息发送给所述第二服务器，由所述第二服务器根据所述流量匹配信息执行第二操作。
在一种实现方式中，所述操作单元具体用于：控制显示设备显示所述流量匹配信息。
在一种实现方式中，所述操作单元具体用于：确定所述流量匹配信息是否符合预设条件，若所述流量匹配信息不符合所述预设条件，则根据所述流量匹配信息对所述BGP FS规则进行修改，并将修改后的BGP FS规则发送给所述网络节点。
在一种实现方式中，所述操作单元具体用于：根据所述流量匹配信息向所述网络节点发送第二配置指令，所述第二配置指令用于配置所述网络节点。
在一种实现方式中，所述操作单元具体用于：若所述状态包括所述BGP FS规则的优先级低于其它流量控制策略的优先级，则向所述网络节点发送第二配置指令，所述第二配置指令用于配置所述网络节点取消实施所述其它流量控制策略，或者，用于配置所述网络节点优先实施所述BGP FS规则。
在一种实现方式中，还包括：分析单元，用于在所述向所述网络节点发送第二配置指令之前，对经过所述网络节点的数据流量进行分析，得到分析结果；所述操作单元具体用于：若所述分析结果指示经过所述网络节点的数据流量中存在异常流量，则向所述网络节点发送第二配置指令。
在一种实现方式中，所述操作单元具体用于：若所述状态不包括所述BGP FS规则的优先级低于其它流量控制策略的优先级，则对所述BGP FS规则进行修改。
在一种实现方式中，所述操作单元具体用于：对所述BGP FS规则的配置参数进行分析，确定是否存在导致BGP FS规则无法生效的参数组合；若存在，对所述参数组合进行修改，使得修改后得到的BGP FS规则生效。
在一种实现方式中，所述操作单元具体用于：对经过所述网络节点的数据流量进行分析，并根据分析结果对所述BGP FS规则进行修改。
在一种实现方式中，所述发送单元还用于向所述网络节点发送状态上报指令，所述状态上报指令，用于指示所述网络节点向所述数据处理装置上报所述BGP FS规则在所述网络节点上实施的状态。
在一种实现方式中，所述发送单元还用于向所述网络节点发送流量信息上报指令，所述流量信息上报指令，用于指示所述网络节点向所述数据处理装置上报所述BGP FS规则的流量匹配信息，所述流量匹配信息，为与所述BGP FS规则匹配的数据流量的相关信息。
在一种实现方式中，所述发送单元具体用于：当所述数据处理装置接收到的所述状态为所述BGP FS规则已经在所述网络节点上实施时，向所述网络节点发送所述流量信息上报指令。
在一种实现方式中，前述BGP FS规则已经在所述网络节点上实施包括：所述BGP FS规则正常实施，或者，所述BGP FS规则异常实施。
在一种实现方式中，前述BGP FS规则异常实施，包括：所述BGP FS规则的优先级低于其它流量控制策略的优先级，所述其它流量控制策略运行在所述网络节点上。
在一种实现方式中，前述BGP FS规则未在所述网络节点上实施，包括:所述BGP FS规则未通过BGP校验，和/或，所述BGP FS规则未通过BGP FS校验。
在一种实现方式中，前述BGP FS规则未通过BGP校验，包括：所述BGP FS规则中携带非法参数。
在一种实现方式中，前述BGP FS规则未通过BGP FS校验，包括以下任意一项或 者多项：所述BGP FS规则不符合预设实施条件；所述BGP FS规则携带的生效接口与所述网络节点的接口不匹配；和所述BGP FS规则与安全保护策略冲突，所述安全保护策略运行在所述网络节点上。
第五方面，本申请实施例提供了一种设备，包括：处理器和存储器；所述存储器，用于存储指令；所述处理器，用于执行所述存储器中的所述指令，执行以上第一方面任意一项所述的方法，或者执行以上第二方法任意一项所述的方法。
第六方面，本申请实施例提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上第一方面任意一项所述的方法，或者执行以上第二方法任意一项所述的方法。
第七方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行以上第一方面任意一项所述的方法，或者执行以上第二方法任意一项所述的方法。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种示例性应用场景示意图；
图2为本申请实施例提供的一种信息上报方法的信令交互图；
图3为本申请实施例提供一种信息上报方法的信令交互图；
图4为本申请实施例提供的一种信息上报装置的结构示意图；
图5为本申请实施例提供的一种数据处理装置的结构示意图；
图6为本申请实施例提供的一种设备的结构示意图。
具体实施方式
本申请实施例提供了一种信息上报方法，用于解决传统技术中利用BGP FS并不能有效防止流量攻击的问题。
为方便理解本申请实施例提供的方案，首先，对BGP FS路由进行简单介绍。
BGP FS路由为包含新的BGP网络层可达信息和扩展团体属性的路由。通过新的网络层可达信息和扩展团体属性，BGP FS路由可以携带相应的BGP FS规则，该BGP FS规则也可以看成是一种流量控制策略，具体地，BGP FS规则可以包括流量的匹配条件和流量匹配后对应的流量处理行为。目前，流量匹配条件作为网络层可达信息携带在BGP FS路由中，流量处理行为作为扩展团体属性携带在BGP FS路由中。
其中：流量匹配条件可以包括12种匹配方式。分别为根据目的地址进行匹配、根据源地址进行匹配、根据互联网协议地址(Internet Protocol，IP)协议号进行匹配、根据端口号进行匹配、根据目的端口号进行匹配、根据源端口号进行匹配、根据互联网控制报文协议(Internet Control Message Protocol，ICMP)类型进行匹配、根据ICMP编码进行匹配、根据传输控制协议(Transmission Control Protocol，TCP)的标志位进行匹配、根据差分服务代码点(differentiated services code point， DSCP)进行匹配以及根据分片类型匹配。流量处理行为可以包括4种，分别为丢弃流量、流量限速、修改报文的DSCP值以及重新定向到虚拟专用网络(virtual private network，VPN)。
接下来结合附图对本申请实施例的应用场景进行简单介绍。参见图1，该图为本申请实施例提供的一种示例性应用场景示意图。
自治系统(autonomous system，AS)100包括网络设备101、网络设备102、和网络设备103。网络设备101、网络设备102和网络设备103可以为路由器，也可以为交换机，本申请实施例不做具体限定。其中，网络设备101可以为运营商边缘(provider edge，PE)设备，网络设备101例如可以为AS 100的网络边缘节点。
为了防止攻击流量，可以建立服务器200、网络设备101以及网络设备102的BGP FS邻居关系，以及建立网络设备101、网络设备102和网络设备103的BGP FS邻居关系。这样一来，服务器200例如可以在网络设备102和网络设备103上部署流量采样功能，例如可以通过网络流(netstream)对经过网络设备102和网络设备103的流量进行采样。服务器200对采样得到的流量进行分析，确定出是否存在异常流量，若存在异常流量，则服务器200则会生成与该异常流量对应的BGP FS路由。例如，服务器200对采样的流量进行分析之后，确定网络设备102上出现了大量的IP协议号为193的攻击流量，则服务器200生成指示拦截IP协议号为193的数据报文的BGP FS路由。服务器200生成该BGP FS路由之后，将该BGP FS路由发送给网络设备101或者网络设备102。网络设备101或者网络设备102接收到该BGP FS路由之后，可以对该BGP FS路由进行解析，确定对应的BGP FS规则，在理想情况下，网络设备101可以实施该BGP FS规则，从而控制异常流量。可以理解的是，若服务器200将前述BGP FS路由发送给网络设备101，则由于网络设备101是AS的网络边缘节点，因此，可以在AS 100的网络入口或者网络出口控制异常流量。
可以理解的是，在实际应用中，网络设备101或者网络设备102接收到来自服务器200的BGP FS路由之后，可能并不能如前述理想情况所述的那样，实施该BGP FS规则。而目前没有任何设备会对BGP FS规则在网络节点例如前述网络设备101上实施的状态进行监控。相应的，服务器200也不能根据BGP FS规则在网络节点上实施的状态对BGP FS规则防止攻击流量的效果进行评估，并在需要时执行相应的调整措施，从而有效防止攻击流量。
如图1所示，图1中除了服务器200之外，还包括服务器300。该服务器300可以是BGP监控协议(BGP Monitoring Protocol，BMP)服务器。BMP服务器可以对网络设备的BGP运行状态进行实时监控，其中，BGP运行状态包括对等体关系的建立与解除、路由信息刷新等。网络设备可以利用BMP协议向BMP服务器发送消息，从而将自身的BGP运行状态发送给BMP服务器。在图1所示的场景中，网络设备101、网络设备102和网络设备103可以将自身的BGP运行状态上报给服务器300。网络设备利用BMP协议向BMP服务器发送的消息，可以结合表1进行理解。
表1
Figure PCTCN2020125227-appb-000001
Figure PCTCN2020125227-appb-000002
另外，对于部署了BMP监控BGP FS本地路由信息库(local routing information base，Local-RIB)功能的网络设备而言，该网络设备可以向BMP服务器上报其接收到的BGP FS路由。例如，在网络设备101上部署了BMP监控BGP FS Local-RIB功能，则网络设备101接收到BGP FS路由之后，会将该BGP FS路由上报给BMP服务器。但是，网络设备101仅仅是将该BGP FS路由上报给BMP服务器。因此，服务器200即使接收到来自网络设备101的BGP FS路由，也不能获知BGP FS规则在网络设备101上实施的状态，从而使得前述提及的BGP FS并不能有效防止攻击流量的问题依然存在。
为了解决上述问题，本申请实施例提供了一种信息上报方法，以下结合图1所示的场景对该信息上报方法进行介绍。
在介绍本申请实施例提供的信息上报方法之前，还需要说明的是，图1只是为了方便理解而示出，其并不构成对本申请实施例的限定。在实际应用中，一个AS中包含的网络设备的数量不限于图1所示的3个。另外，本申请实施例中提及的服务器，可以是一个设备，也可以是一个功能模块，本申请实施例不做具体限定。当本申请实施例中的服务器指的是一个功能模块时，该功能模块可以运行在各种设备上，本申请实施例不具体限定运行该功能模块的设备，该设备可以是网络节点，也可以是终端设备等等，此处不一一列举说明。换言之，服务器200和服务器300可以是两个独立的设备，也可以集成在一个设备上。服务器200和服务器300也可以是运行在同一个设备上的两个功能模块，还可以是运行在两个不同设备上的两个功能模块。
参见图2，该图为本申请实施例提供的一种信息上报方法的信令交互图。本申请实施例提供的信息上报方法，可以通过如下S101-S102-S103实现。
S101：网络节点获取BGP FS规则在网络节点上实施的状态。
需要说明的是，此处提及的网络节点，例如可以是图1所示的网络设备101。网络节点可以从服务器例如图1所示的服务器200处接收BGP FS路由，该BGP FS路由中携带BGP FS规则。网络节点接收到该BGP FS路由之后，可以对该BGP FS路由进行解析，确定该BGP FS路由中携带的BGP FS规则，进一步地，网络节点可以实施该BGP FS规则。
在本申请实施例中，BGP FS规则在网络节点上实施的状态，用于指示BGP FS规则已经在网络节点上实施，或者，用于指示BGP FS规则未在网络节点上实施。在实际应用中，网络节点自身会记录BGP FS规则在网络节点上实施的状态，因此网络节点可以读取相应的存储文件，从而获取BGP FS规则在网络节点上实施的状态。
在本申请实施例中，为了使得该状态能够体现该BGP FS规则在网络节点上实施状态的更多细节。在本申请实施例的一种实现方式中，考虑到在实际应用中，BGP FS规则已经在网络节点上实施可以包括至少两类情况，其中一类可以归纳为正常实施， 另一类可以归纳为异常实施。所谓正常实施，指的是该BGP FS规则已经正确参与BGP最优选路流程，并且该BGP FS规则实施时并未受到其它因素的干扰。所谓异常实施，指的是虽然该BGP FS规则已经正确参与BGP最优选路流程，但是该BGP FS规则实施时受到了其它因素的干扰。鉴于此，前述BGP FS规则已经在网络节点上实施，可以包括BGP FS规则在网络节点上正常实施，或者，BGP FS规则在网络节点上异常实施。
考虑到在实际应用中，网络节点上可能还运行了其它流量控制策略，例如访问控制列表(access control list，ACL)指示的流量控制策略，又如策略规则(policy based routing，PBR)指示的流量控制策略。一旦BGP FS规则的优先级低于其它流量控制策略的优先级。则这些其它流量控制策略就会对网络节点实施BGP FS规则带来干扰。因为经过网络节点的流量，会首先被其它流量控制策略处理，然后再被BGP FS规则处理。换言之，在本申请实施例的一种实现方式中，前述BGP FS规则在网络节点上异常实施，可以指的是BGP FS规则的优先级低于其它流量控制策略的优先级。
相应的，当前述状态为BGP FS规则未在网络节点上实施时，为了使得该状态能够进一步体现该BGP FS规则未在网络节点上实施的原因。在本申请实施例的一种实现方式中，该状态还可以进一步体现BGP FS规则未在网络节点上实施的具体原因。
具体地，在一种实现方式中，考虑到网络节点获取到BGP FS规则之后，首先会对BGP FS规则进行校验，只有在BGP FS规则通过校验之后，网络节点才有可能实施该BGP FS规则。其中，对BGP FS规则进行校验，可以包括BGP校验和/或BGP FS校验。若该BGP FS规则未通过BGP校验，或者，该BGP FS规则未通过BGP FS校验，网络节点则不再实施该BGP FS规则。因此，在本申请实施例中，BGP FS规则未在网络节点上实施，可以包括BGP FS规则未通过BGP校验，和/或，BGP FS规则未通过BGP FS校验。
关于前述BGP FS规则未通过BGP校验，需要说明的是，考虑到在实际应用中，BGP FS规则未通过BGP校验，一般可能是因为BGP FS规则中携带非法参数。所谓非法参数可以至少包括两种情况，其中一种是BGP FS规则中存在网络节点无法处理的参数，例如BGP FS规则指示重定向到互联网协议第6版(Internet Protocol Version 6，IPv6)下一跳，但是网络节点不支持重定向到IPv6下一跳。另外一种是BGP FS规则中存在非法自治域(autonomous system，AS)路径，例如BGP FS规则中携带的AS标识等于网络节点对应的AS标识，又如BGP FS规则中携带的AS标识不等于第二服务器对应的AS标识。
关于前述BGP FS规则未通过BGP FS校验，需要说明的是，在一种实现方式中，考虑到一般而言，网络节点可以包括一个或者多个接口，该BGP FS规则中一般会携带该BGP FS规则的生效接口。若该BGP FS规则中携带的生效接口，与网络节点的接口不匹配，则会导致该BGP FS规则无法在网络节点上实施。对于这种情况，BGP FS规则未在网络节点上实施，可以为BGP FS规则携带的生效接口与网络节点的接口不匹配。
需要说明的是，此处提及的生效接口，可以是一个接口，也可以是多个接口，本申请实施例不做具体限定。当生效接口包括多个接口时，前述BGP FS规则例如可以将该多个接口的标识携带在携带BGP FS规则中。
在一种实现方式中，考虑到在实际应用中，网络节点上还可以配置相应的安全保 护策略，若BGP FS规则与安全保护策略冲突，则也会导致该BGP FS规则无法在网络节点上实施。例如，网络节点上的安全保护策略指示禁止对指定IP前缀或指定协议的报文进行限流，而该BGP FS规则即为针对该指定IP的报文进行限流，这就会导致BGP FS规则无法在网络节点上实施。对于这种情况，BGP FS规则未在网络节点上实施，可以为BGP FS规则与安全保护策略冲突。
另外，一般而言，在网络节点上还可以为BGP FS规则设置预设实施条件，当该BGP FS规则满足该预设实施条件时，网络节点才可能实施该BGP FS规则。关于该预设实施条件，需要说明的是，在一种实现方式中，考虑到在实际应用中，并不是所有的设备均具备实施BGP FS规则的需求，例如，对于路由反射器而言，其仅用于传递路由，不需要实施BGP FS规则。因此，一般而言，前述预设实施条件，可以包括网络节点不被允许实施BGP FS规则。可以理解的是，若网络节点被配置为不允许实施BGP FS规则，则必定会导致该BGP FS规则在网络节点上的实施状态为未实施。在又一种实现方式中，考虑到在实际应用中，为控制网络节点实施BGP FS规则所占用的资源，网络节点可以设置实施BGP FS规则的数量上限，当接收到的BGP FS规则的数量超过该数量上限时，则确定该BGP FS规则不符合预设实施条件。或者，网络设备设置可以设置流量匹配条件的数量上限，当网络节点确定BGP FS规则指示的流量匹配条件超过流量匹配条件的数量上限时，则确定该BGP FS规则不符合预设实施条件。或者，网络设备可以设置流量处理行为的数量上限，当网络节点确定BGP FS规则指示的流量处理行为超过流量处理行为的数量上限时，则确定对该BGP FS规则不符合预设实施条件；或者，网络节点为BGP FS规则分配了一定数量的内存，当网络节点确定与BGP FS规则对应的可用内存不足时，则确定该BGP FS规则不符合预设实施条件。
S102：网络节点将该状态发送给第一服务器。
网络节点获取前述状态之后，可以将该状态发送给第一服务器。网络节点将状态发送给第一服务器之后，第一服务器即可根据该状态，确定BGP FS规则在网络节点上实施的状态。需要说明的是，此处提及的第一服务器，可以为图1所示的服务器200，也可以为图1所示的服务器300，本申请实施例不做具体限定。但是，考虑到在实际应用中，一般是由BMP服务器对网络设备的BGP运行状态进行实时监控，因此，在一个可选的方案中，该第一服务器可以为BMP服务器，即图1所示的服务器300。在本申请实施例的以下描述中，如无特别说明，第一服务器即对应图1所示的服务器300。
如前文，若在网络节点上部署了BMP监控BGP FS Local-RIB功能，则网络节点接收到BGP FS路由之后，会将该BGP FS路由上报给BMP服务器。而且，网络节点可以通过表1所示的RM消息将接收到的BGP FS路由上报给BMP服务器。鉴于此，在本申请实施例的一种实现方式中，网络节点可以利用该RM消息作为载体，将BGP FS规则在网络节点上实施的状态携带在该RM消息中发送给第一服务器。具体地，网络节点可以将BGP FS规则在网络节点上实施的状态添加到RM消息中，而后将该添加了前述状态的RM消息，发送给第一服务器。在本申请实施例中，可以对RM消息进行扩展，从而将前述状态携带在RM消息的扩展字段中。例如，可以将前述状态携带在扩展的类型-长度-值(type length value，TLV)字段中。
另外，对于网络节点上并未部署BMP监控BGP FS Local-RIB功能的情况，由于 网络节点上并未部署BMP监控BGP FS Local-RIB功能，故而网络节点不会向第一服务器发送BGP FS路由，相应的，也不能将该BGP FS规则在网络节点上实施的状态，携带在RM消息中发送给第一服务器。对于这种情况，第一服务器可以向网络节点发送状态上报指令，该状态上报指令，用于指示网络节点将该BGP FS规则在网络节点上实施的状态上报给第一服务器。换言之，网络节点可以在接收到第一服务器的状态上报指令之后，执行前述S101-S102。
需要说明的是，本申请实施例对该状态上报指令的帧结构不做具体限定。作为一种示例，该状态上报指令中可以携带地址族标识(address family identifier，AFI)和子序列地址族标识(subsequent AFI，SAFI)。对于与该AFI和SAFI相匹配的各个BGP FS规则，网络节点均可以向第一服务器上报每个BGP FS规则在网络节点上实施的状态。作为又一种示例，该状态上报指令中携带BGP FS规则的标识，网络节点可以将该标识对应的BGP FS规则在网络节点上实施的状态上报给第一服务器。当然，该状态上报指令中还可以包括其它字段，此处不一一列举说明。
在本申请实施例中，网络节点接收到该状态上报指令之后，可以周期性执行前述S101-S102，当然也可以仅执行一次S101-S102，本申请实施例不做具体限定。对于网络节点周期性执行前述S101-S102的方案，在本申请实施例的一种实现方式中，第一服务器还可以向网络节点发送状态停止上报指令，用于指示网络节点不再上报BGP FS规则在网络节点上实施的状态。例如，第一服务器根据网络节点上报的BGP FS规则在网络节点上实施的状态，确定该BGP FS规则在一段时间内均正常实施，故而不再对BGP FS规则在网络节点上实施的状态进行监控，则第一服务器可以向网络节点发送状态停止上报指令。
在本申请实施例中，状态上报指令和状态停止上报指令可以采用相同的帧结构，利用某一字段的值来区分状态上报指令和状态停止上报指令。例如，对于第一服务器下发的第一指令，当该第一指令中第一字段的值为1时，该第一指令为状态上报指令，当该第一指令中的第一字段的值为0时，该第一指令为状态停止上报指令。
S103：第一服务器存储接收到的状态。
在本申请实施例中，第一服务器接收到前述BGP FS规则在网络节点上实施的状态之后，第一服务器可以存储该状态，具体地，第一服务器可以将该状态存储在存储器中。在有必要时，第一服务器可以从前述存储器中读取BGP FS规则在网络节点上实施的状态，并且根据该状态执行其它操作，例如根据该状态执行第一操作。当然，第一服务器也可以将前述状态发送给第二服务器，由第二服务器根据该状态执行第一操作。关于第二服务器，需要说明的是，考虑到在实际应用中，一般而言，该第一操作与前述BGP FS规则具备一定的联系，因此，在本申请实施例中，第二服务器可以为生成BGP FS规则的服务器，例如图1所示的服务器200。如前文，第一服务器和第二服务器可以运行在同一个设备上，也可以运行在不同的设备上，可以理解的是，当第一服务器和第二服务器运行在一个设备上时，第一服务器自身即可根据前述状态执行第一操作，当第一服务器和第二服务器运行在两个设备上时，第一服务器可以将前述状态发送给第二服务器，由第二服务器根据前述状态执行第一操作。第一服务器和第二服务器根据前述状态执行第一操作的具体实现是相同的，以下以第一服务器根据前述 状态执行第一操作为例进行说明。
在本申请实施例的一种实现方式中，为了使得网络管理人员了解BGP FS规则在网络节点上实施的状态，第一服务器可以控制显示设备显示前述状态。这样一来，网络管理人员即可通过显示设备显示的内容，确定BGP FS规则在网络节点上实施的状态。进一步地，网络管理人员可以根据该状态执行相应的调整措施。此处提及的显示设备可以为显示屏，该显示屏可以为第一服务器的显示屏，也可以为其它设备的显示屏，本申请实施例不做具体性限定。
在本申请实施例的又一种实现方式中，为了使得前述BGP FS规则可以在网络节点上实施，以达到控制攻击流量的目的。若前述状态指示BGP FS规则未在网络节点上实施，第一服务器根据前述状态执行第一操作在具体实现时，还可以是以使得BGP FS规则能够在网络节点上实施为目的。具体地，如S101中对BGP FS规则在网络节点上实施的状态的描述可知，BGP FS规则未在网络节点上实施，有可能是因为BGP FS规则的配置参数导致的，也有可能是因为网络节点自身的配置导致的。故而在本申请实施例中，第一服务器可以根据BGP FS规则在网络节点上实施的状态，确定导致该BGP FS规则未在网络节点上实施的原因，进一步地，根据所确定的原因执行第一操作。
具体地，若第一服务器确定BGP FS规则未在网络节点上实施是由BGP FS规则的配置参数导致的，则第一服务器执行第一操作在具体实现时，例如可以为对BGP FS规则进行修改，并将修改后的BGP FS规则发送给网络节点，以使得网络节点实施修改后的BGP FS规则。若第一服务器确定BGP FS规则未实施是由网络节点的配置导致的，则第一服务器执行第一操作在具体实现时，例如可以为向网络节点发送第一配置指令，该第一配置指令用于重新配置网络节点，从而使得网络节点可以实施BGP FS规则。
以下分别对第一服务器根据前述状态对BGP FS规则进行修改、和第一服务器向网络节点发送第一配置指令的具体实现进行介绍。
首先介绍“第一服务器根据前述状态对BGP FS规则进行修改”的具体实现方式。
如S101中对BGP FS规则在网络节点上实施的状态描述可知，该状态可以指示BGP FS规则未通过BGP校验。而BGP FS规则未通过BGP校验，可以包括BGP FS规则中携带非法参数。对于这种情况，第一服务器可以对BGP FS规则进行修改，使得修改后的BGP FS规则通过BGP校验。这样一来，第一服务器将修改后的BGP FS规则发送给网络节点之后，网络节点即可执行实施该BGP FS规则。具体地，第一服务器可以确定BGP FS规则中携带的非法参数，并将非法参数修改为合法参数。例如，第一服务器可以将BGP FS规则中网络节点无法处理的参数，修改为所述网络节点能够处理的参数，并将修改后的BGP FS规则发送给网络节点。又如，第一服务器可以将BGP FS规则中非法AS路径修改为合法AS路径，并将修改后的BGP FS规则发送给网络节点。
如S101中对BGP FS规则在网络节点上实施的状态的描述可知，该状态可以指示BGP FS规则携带的生效接口与网络节点的接口不匹配。对于这种情况，由于BGP FS规则携带的生效接口与网络节点的接口不匹配，则该BGP FS规则无法在网络节点上实施，故而第一服务器可以对BGP FS规则进行修改。具体地，第一服务器可以将BGP FS规则携带的生效接口，修改为与网络节点的接口匹配的接口，并将修改后的BGP FS规则发送给网络节点。这样一来，网络节点即可执行实施该BGP FS规则。
如S101中对BGP FS规则在网络节点上实施的状态的描述可知，该状态可以指示BGP FS规则与安全保护策略冲突。对于这种情况，第一服务器可以对BGP FS规则进行修改，具体地，第一服务器可以将BGP FS规则修改为与安全保护策略不冲突的BGP FS规则，并将修改后的BGP FS规则发送给网络节点，这样一来，网络节点即可执行实施该BGP FS规则。例如，网络节点上的安全保护策略指示禁止对第一IP前缀的报文进行限流，而该BGP FS规则指示针对该第一IP前缀和第二IP前缀的报文进行限流。则第一服务器可以将针对第一IP前缀的报文进行限流的流量控制策略，从BGP FS规则中删除。
接下来介绍“第一服务器根据前述状态向网络节点发送第一配置指令”的具体实现方式。
如S101中对BGP FS规则在网络节点上实施的状态的描述可知，该状态可以指示BGP FS规则未通过BGP FS校验。BGP FS规则未通过BGP FS校验，可能是因为该BGP FS规则未通过网络节点对BGP FS规则进行校验的校验规则，即BGP FS规则不符合预设实施条件。对于这种情况，第一服务器可以向网络节点发送第一配置指令，该第一配置指令用于指示网络节点重新配置目标参数，该目标参数为确定BGP FS规则是否符合所述预设实施条件所使用的参数，使得网络节点重新配置目标参数之后，该BGP FS规则可以符合预设实施条件。该目标参数例如可以为使得网络节点被配置为实施BGP FS规则的参数；又如可以为前述提及的BGP FS规则的数量上限；再如可以为前述提及的流量匹配条件的数量上限；再如可以为前述提及的流量处理行为的数量上限，也可以为网络节点为BGP FS规则分配的内存大小，等等。当然，该第一配置指令，还可以为用于配置网络节点取消验证BGP FS规则是否符合预设实施条件的配置指令。可以理解的是，若网络节点不再验证BGP FS规则是否符合预设实施条件，网络节点则可以实施该BGP FS规则。
通过以上描述可知，利用本申请实施例提供的方案，第一服务器可以获知BGP FS规则在网络节点上实施的状态。相应的，第一服务器可以存储该状态，并在需要时根据该状态执行第一操作，例如对该BGP FS规则进行修改，又如对网络节点进行重新配置，从而使得BGP FS规则能够在网络节点上实施，从而有效防止攻击流量。
在本申请实施例的一种实现方式中，当BGF FS规则已经在网络节点上实施时，为了进一步对该BGP FS规则的流量控制效果进行评估，网络节点还可以获取BGP FS规则的流量匹配信息，并将该流量匹配信息发送给第一服务器。其中，该流量匹配信息指的是：与BGP FS规则匹配的数据流量的相关信息。本申请实施例不具体限定该流量匹配信息，该流量匹配信息，例如可以为与BGP FS规则匹配的报文的条数，又如可以为与BGP FS规则匹配的报文所占的字节数。
如前文，若在网络节点上部署了BMP监控BGP FS Local-RIB功能，则网络节点接收到BGP FS路由之后，会将该BGP FS路由上报给BMP服务器。结合表1可知，网络节点向BMP服务器发送的消息中，有一类消息是SR消息，该SR消息中携带的是统计信息，而流量匹配信息也可以认为是一种统计信息。鉴于此，在本申请实施例中，可以以已有的SR消息为载体，将前述流量匹配信息发送给第一服务器。换言之，在本申请实施例的一种实现方式中，网络节点可以将BGP FS规则的流量匹配信息添加到 SR消息中，而后将该添加了前述流量匹配信息的SR消息，发送给第一服务器。具体地，网络节点可以将该流量匹配信息携带在SR消息的扩展字段中。例如，可以将该流量匹配信息携带在扩展的TLV字段中。
另外，对于网络节点上并未部署BMP监控BGP FS Local-RIB功能的情况，第一服务器可以向网络节点发送流量信息上报指令，该流量信息上报指令，用于指示网络节点将前述流量匹配信息上报给第一服务器。换言之，网络节点可以在接收到第一服务器的流量信息上报指令之后，执行获取BGP FS规则的流量匹配信息、并将流量匹配信息发送给第一服务器的步骤。需要说明的是，本申请实施例对该流量信息上报指令的帧结构不做具体限定。与前述状态上报指令的帧结构类似，作为一种示例，该流量信息上报指令中可以携带AFI和SAFI。作为又一种示例，该流量信息上报指令中携带BGP FS规则的标识。当然，该流量信息上报指令中还可以包括其它字段，此处不一一列举说明。
考虑到在实际应用中，若BGP FS规则并未在网络节点上实施，则必然不会存在与该BGP FS规则匹配的数据流量。鉴于此，在本申请实施例的一种实现方式中，第一服务器可以在接收到来自网络节点的前述状态，并在该状态指示BGP FS规则已经在网络节点上实施时，才向网络节点发送流量信息上报指令，从而减少第一服务器与网络节点之间的数据交互。
在本申请实施例中，网络节点接收到该流量信息上报指令之后，可以周期性执行获取BGP FS规则的流量匹配信息，并将该流量匹配信息发送给第一服务器的步骤，当然也可以仅执行一次获取BGP FS规则的流量匹配信息，并将该流量匹配信息发送给第一服务器的步骤，本申请实施例不做具体限定。对于网络节点周期性执行获取BGP FS规则的流量匹配信息、并将流量匹配信息发送给第一服务器的步骤，在本申请实施例的一种实现方式中，第一服务器还可以向网络节点发送流量信息停止上报指令，用于指示网络节点不再上报BGP FS规则的流量匹配信息。例如，第一服务器根据网络节点上报的流量匹配信息，确定该BGP FS规则在一段时间成功拦截了攻击流量，故而不再对BGP FS规则的流量匹配情况进行监控，则第一服务器可以向网络节点发送流量信息停止上报指令。
在本申请实施例中，流量信息上报指令和流量信息停止上报指令可以采用相同的帧结构，利用某一字段的值来区分流量信息上报指令和流量信息停止上报指令。例如，对于第一服务器下发的第二指令，当该第二指令中第二字段的值为1时，该第二指令为流量信息上报指令，当该第二指令中的第二字段的值为0时，该第二指令为流量信息停止上报指令。
第一服务器接收到来自网络节点的流量匹配信息之后，可以存储该流量匹配信息，进一步地，第一服务器还可以根据该流量匹配信息执行第二操作，或者，将该流量匹配信息发送给第二服务器，由第二服务器根据该流量匹配信息执行第二操作。
第一服务器和第二服务器根据流量匹配信息执行第二操作的具体实现是相同的，以下以第一服务器根据流量匹配信息执行第二操作为例进行说明。
在本申请实施例的一种实现方式中，为了使得网络管理人员了解BGP FS规则在网络节点上的流量匹配情况，第一服务器可以控制显示设备显示前述流量匹配信息。 这样一来，网络管理人员即可通过显示设备显示的内容，确定BGP FS规则在网络节点上的流量匹配情况。进一步地，网络管理人员可以根据该流量匹配信息执行相应的调整措施。此处提及的显示设备可以为显示屏，该显示屏可以为第一服务器的显示屏，也可以为其它设备的显示屏，本申请实施例不做具体性限定。
在本申请实施例的又一种实现方式中，为了使得前述BGP FS规则可以有效控制攻击流量，以达到控制攻击流量的目的。第一服务器获取到流量匹配信息之后，可以进一步判断该流量匹配信息是否符合预设条件。此处提及的确定流量匹配信息是否符合预设条件，指的是确定BGF FS规则进行流量控制的效果是否达到预期。关于该预设条件，本申请实施例不作具体限定。考虑到在实际应用中，BGP FS规则是对经过网络节点的历史数据流量进行分析，确定存在异常流量之后针对该异常流量制定的。因此，在本申请实施例的一种实现方式中，前述预设条件也可以根据异常流量来确定，即通过对经过所述网络节点的历史数据流量进行分析得到。例如，通过对经过网络节点的历史数据流量进行分析，发现单位时间内经过网络节点的攻击流量为M，则前述流量匹配信息符合预设条件，例如可以为单位时间内与BGP FS规则指示的流量控制策略匹配的数据流量大于或者等于M*k，其中，k为比例系数。当然，此处只是为了方便理解而示出，其并不构成对本申请实施例的限定。
可以理解的是，若第一服务器确定获取到的流量匹配信息符合预设条件，则表示该BGP FS规则可以有效防止攻击流量。若第一服务器确定获取到的流量匹配信息不符合预设条件，则表示BGP FS规则可能并不能有效防止攻击流量。对于BGP FS规则可能并不能有效防止攻击流量的情况，第一服务器可以进一步确定BGP FS规则不能有效防止攻击流量的原因，并执行相应的调整措施，以达到有效防止攻击流量的目的。
在实际应用中，导致前述流量匹配信息不符合预设条件的原因可能有两种。其中一种是BGP FS规则在实施时受到了其它流量控制策略的干扰。也就是前文提及的BGP FS规则在网络节点上异常实施。另外一种则是由于BGP FS规则自身的配置导致的。对于第一种原因，在本申请实施例中，第一服务器例如可以对网络节点进行重新配置，从而使得BGP FS规则在网络节点上正常实施。对于第二种原因，在本申请实施例中，第一服务器例如可以对BGP FS规则进行修改，并将修改后的BGP FS规则发送给网络节点。换言之，在本申请实施例中，第一服务器根据流量匹配信息执行第二操作在具体实现时，还可以包括两种实现方式。一种实现方式是，在确定流量匹配信息不符合预设条件时，根据流量匹配信息向网络节点发送第二配置指令，该第二配置指令用于重新配置网络节点。另一种实现方式是，在确定流量匹配信息不符合预设条件时，根据流量匹配信息对BGP FS规则进行修改，并将修改后的BGP FS规则发送给网络节点。以下分别对这两种实现方式进行介绍。
具体地，第一服务器可以首先根据获取到的BGP FS规则在网络节点上实施的状态，确定导致流量匹配信息不符合预设条件的原因是不是BGP FS规则在网络节点上异常实施。具体地，若第一服务器获取的BGP FS规则在网络节点上实施的状态，包括BGP FS规则的优先级低于其它流量控制策略的优先级，则表示BGP FS规则在网络节点上异常实施，相应的，第一服务器可以向网络节点发送第二配置指令，第二配置指令，用于配置网络节点取消实施其它流量控制策略，或者，用于配置网络节点优先实 施BGP FS规则。关于其它流量控制策略，可以参考前文对于实施状态信息的描述部分，此处不再详述。
需要说明的是，考虑到在实际应用中，若前述其它流量控制策略能有效防止攻击流量，则即使BGP FS规则不在网络节点上实施，也不会影响网络系统的正常工作。鉴于此，在本申请实施例的一种实现方式中，若第一服务器获取的BGP FS规则在网络节点上实施的状态，包括BGP FS规则的优先级低于其它流量控制策略的优先级，则第一服务器还可以对经过网络节点的数据流量进行分析，确定是否存在异常流量，若存在异常流量，则表示其它流量控制策略并未有效防止攻击流量，在这种情况下，第一服务器才向网络节点发送前述第二配置指令。若不存在异常流量，则表示其它流量控制策略可以有效防止攻击流量，此时第一服务器可以不必执行前述向网络节点发送前述第二配置指令的步骤。
若第一服务器获取的BGP FS规则在网络节点上实施的状态，不包括BGP FS规则的优先级低于其它流量控制策略的优先级，则表示BGP FS规则正常实施，相应的，第一服务器可以确定流量匹配信息不符合预设条件，是由于BGP FS规则自身的配置导致的。考虑到在实际应用中，一方面，若BGP FS规则中存在一些参数组合，会使得BGP FS规则无法生效，进一步地则会导致该BGP FS规则在网络节点上实施之后不能有效防止攻击流量。例如，参数1要求匹配小于1000字节的报文，参数2又要求匹配大于2000字节的报文，这2个参数组合之后导致BGP FS规则无法生效。又如，参数3对应的流量处理行为是重定向到某一个VPN实例，参数3对应的流量处理行为是重定向到某个具体的IP地址，这两个参数组合之后导致BGP FS规则无法生效。鉴于此，在本申请实施例的一种实现方式中，第一服务器可以对BGP FS规则的配置参数进行分析，确定BGP FS规则中是否存在一些参数组合会使得BGP FS规则无法生效。若存在，则第一服务器可以对这些参数重新进行修改，使得修改后得到的BGP FS规则能够生效。另一方面，若BGP FS规则指示的流量控制策略所针对的流量，并非是实际上需要防止的攻击流量，也会导致该BGP FS规则实施之后不能有效防止攻击流量。例如，攻击流量的目的地址网段是10.1.1.0/24,而BGP FS规则中的匹配条件中的目的地址所在的网段为20.1.1.0/24。对于这种情况，在本申请实施例的一种实现方式中，第一服务器可以对经过网络节点的数据流量进行分析，并根据基于分析结果对BGP FS规则进行修改。具体地，第一服务器可以通过对预设时间段内经过网络节点的数据流量进行分析，确定攻击流量的特征，并根据攻击流量的特征来对BGP FS规则进行修改。例如，第一服务器对第一时间段内经过网络节点的数据流量进行分析之后，确定存在大量的目的地址所在的网段为10.1.1.0/24的攻击流量，而BGP FS规则中的匹配条件中的目的地址所在的网段为20.1.1.0/24，则第一服务器将BGP FS规则中的匹配条件中的目的地址所在的网段修改为10.1.1.0/24。关于该预设时间段，本申请实施例不做具体限定。
以上对本申请实施例提供的信息上报方法进行了介绍，以下结合附图对本申请实施例提供的信息上报方法进行介绍。参见图3，该图为本申请实施例提供一种信息上报方法的信令交互图。图3示出了网络节点和第一服务器之间的信令交互。需要说明 的是，在图3所示的场景中，前文提及的第二服务器和第一服务器集成在一个设备上。图3只是为了方便理解，示出了部分步骤，但这并不构成对本申请实施例的限定。图3所示的信息上报方法，可以通过如下S201-S209实现。
S201：第一服务器向网络节点发送BGP FS路由。
S202：第一服务器向网络节点发送状态上报指令。
S203：网络节点获取BGP FS规则在网络节点上实施的状态，该状态为BGP FS路由已经在网络节点上实施。
可以理解的是，网络节点接收的BGP FS路由中携带BGP FS规则。
S204：网络节点将获取的状态发送给第一服务器。
S205：第一服务器向网络节点发送流量信息上报指令。
S206：网络节点获取BGP FS规则的流量匹配信息。
S207：网络节点将获取的流量匹配信息发送给第一服务器。
S208：第一服务器确定流量匹配信息不符合预设条件，并确定接收的状态指示BGP FS规则的优先级低于其它流量控制策略的优先级。
S209：第一服务器向网络节点发送第二配置指令，第二配置指令用于配置网络节点优先实施BGP FS规则。
基于以上实施例提供的信息上报方法，本申请实施例还提供了一种信息上报装置，该信息上报装置，用于执行前述实施例提及的由网络节点执行的信息上报方法，例如执行如图2和图3所示的网络节点执行的步骤。以下结合附图介绍该信息上报装置。
参见图4，该图为本申请实施例提供的一种信息上报装置的结构示意图。图4所示的信息上报装置400，例如可以包括获取单元401和发送单元402。
获取单元401，用于获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；
发送单元402，用于将所述状态发送给服务器。
在一种实现方式中，所述发送单元402，具体用于：
将所述状态添加至路由监控RM消息中，并将添加了所述状态的RM消息发送给所述服务器。
在一种实现方式中，所述BGP FS规则已经在所述网络节点上实施包括：所述BGP FS规则正常实施，或者，所述BGP FS规则异常实施。
在一种实现方式中，所述BGP FS规则异常实施，包括：
所述BGP FS规则的优先级低于其它流量控制策略的优先级，所述其它流量控制策略运行在所述网络节点上。
在一种实现方式中，所述BGP FS规则未在所述网络节点上实施，包括:
所述BGP FS规则未通过BGP校验，和/或，所述BGP FS规则未通过BGP FS校验。
在一种实现方式中，所述BGP FS规则未通过BGP校验，包括：
所述BGP FS规则中携带非法参数。
在一种实现方式中，所述BGP FS规则未通过BGP FS校验，包括以下任意一项或 者多项：
所述BGP FS规则不符合预设实施条件；
所述BGP FS规则携带的生效接口与所述网络节点的接口不匹配；和，
所述BGP FS规则与安全保护策略冲突，所述安全保护策略运行在所述网络节点上。
在一种实现方式中，若所述状态为所述BGP FS规则已经在所述网络节点上实施，所述获取单元401还用于获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；
所述发送单元402还用于将所述流量匹配信息发送给所述服务器。
在一种实现方式中，所述发送单元402具体用于：
将所述流量匹配信息添加至状态报告SR消息中，并将添加了所述流量匹配信息的SR消息发送给所述服务器。
在一种实现方式中，所述获取单元401具体用于：
接收到来自所述服务器的状态上报指令之后，获取所述BGP FS规则在所述网络节点上实施的状态。
在一种实现方式中，所述获取单元401具体用于：
接收到来自所述服务器的流量信息上报指令之后，获取所述BGP FS规则的流量匹配信息。
由于所述装置400是与以上方法实施例提供的、由网络节点执行的信息上报方法对应的装置，所述装置400的各个单元的具体实现，均与以上方法实施例为同一构思，因此，关于所述装置400的各个单元的具体实现，可以参考以上方法实施例中关于网络节点执行的信息上报方法的描述部分，此处不再重复描述。
基于以上实施例提供的数据处理方法，本申请实施例还提供了一种数据处理装置，该数据处理装置，用于执行前述实施例提及的由第一服务器执行的数据处理方法，例如执行如图2和图3所示的第一服务器执行的步骤。以下结合附图介绍该数据处理装置。
参见图5，该图为本申请实施例提供的一种数据处理装置的结构示意图。图5所示的信息上报装置500，例如可以包括获取单元501和存储单元502。
获取单元501，用于获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；
存储单元502，用于存储所述状态。
在一种实现方式中，所述BGP FS规则已经在所述网络节点上实施包括：所述BGP FS规则正常实施，或者，所述BGP FS规则异常实施。
在一种实现方式中，所述BGP FS规则异常实施，包括：
所述BGP FS规则的优先级低于其它流量控制策略的优先级，所述其它流量控制策略运行在所述网络节点上。
在一种实现方式中，所述BGP FS规则未在所述网络节点上实施，包括:
所述BGP FS规则未通过BGP校验，和/或，所述BGP FS规则未通过BGP FS校验。
在一种实现方式中，所述BGP FS规则未通过BGP校验，包括：
所述BGP FS规则中携带非法参数。
在一种实现方式中，所述BGP FS规则未通过BGP FS校验，包括以下任意一项或者多项：
所述BGP FS规则不符合预设实施条件；
所述BGP FS规则携带的生效接口与所述网络节点的接口不匹配；和，
所述BGP FS规则与安全保护策略冲突，所述安全保护策略运行在所述网络节点上。
在一种实现方式中，所述装置500还包括：
操作单元，用于根据所述状态执行第一操作；或者，
发送单元，用于将所述状态发送给第二服务器，由所述第二服务器根据所述状态执行第一操作。
在一种实现方式中，所述操作单元具体用于：
控制显示设备显示所述状态。
在一种实现方式中，所述操作单元具体用于：
根据所述状态对所述BGP FS规则进行修改，并将修改后的BGP FS规则发送给所述网络节点。
在一种实现方式中，所述操作单元具体用于：
根据所述状态向所述网络节点发送第一配置指令，所述第一配置指令用于配置所述网络节点。
在一种实现方式中，所述操作单元具体用于：
若所述状态为所述BGP FS规则未通过BGP校验，则确定所述BGP FS规则中携带的非法参数，并将所述非法参数修改为合法参数。
在一种实现方式中，所述操作单元具体用于：
若所述状态为所述BGP FS规则携带的生效接口与所述网络节点的接口不匹配，则将所述BGP FS规则携带的生效接口修改为与所述网络节点的接口匹配的接口。
在一种实现方式中，所述操作单元具体用于：
若所述状态为描述所述BGP FS规则与安全保护策略冲突，则将所述BGP FS规则修改为与所述安全保护策略不冲突的BGP FS规则。
在一种实现方式中，所述操作单元具体用于：
若所述状态为所述BGP FS规则不符合预设实施条件，则向所述网络节点发送第一配置指令，所述第一配置指令用于指示所述网络节点重新配置目标参数，以使得所述BGP FS规则符合所述预设实施条件；或者，所述第一配置指令，用于配置所述网络节点取消验证所述BGP FS规则是否符合所述预设实施条件。
在一种实现方式中，所述获取单元501还用于获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；
所述存储单元502还用于存储所述流量匹配信息。
在一种实现方式中，所述操作单元还用于根据所述流量匹配信息执行第二操作；或者，
所述发送单元还用于将所述流量匹配信息发送给所述第二服务器，由所述第二服 务器根据所述流量匹配信息执行第二操作。
在一种实现方式中，所述操作单元具体用于：
控制显示设备显示所述流量匹配信息。
在一种实现方式中，所述操作单元具体用于：
确定所述流量匹配信息是否符合预设条件，若所述流量匹配信息不符合所述预设条件，则根据所述流量匹配信息对所述BGP FS规则进行修改，并将修改后的BGP FS规则发送给所述网络节点。
在一种实现方式中，所述操作单元具体用于：
根据所述流量匹配信息向所述网络节点发送第二配置指令，所述第二配置指令用于配置所述网络节点。
在一种实现方式中，所述操作单元具体用于：
若所述状态包括所述BGP FS规则的优先级低于其它流量控制策略的优先级，则向所述网络节点发送第二配置指令，所述第二配置指令用于配置所述网络节点取消实施所述其它流量控制策略，或者，用于配置所述网络节点优先实施所述BGP FS规则。
在一种实现方式中，所述装置500还包括：
分析单元，用于在所述向所述网络节点发送第二配置指令之前，对经过所述网络节点的数据流量进行分析，得到分析结果；
相应的，所述操作单元具体用于：
若所述分析结果指示经过所述网络节点的数据流量中存在异常流量，则向所述网络节点发送第二配置指令。
在一种实现方式中，所述操作单元具体用于：
若所述状态不包括所述BGP FS规则的优先级低于其它流量控制策略的优先级，则对所述BGP FS规则进行修改。
在一种实现方式中，所述操作单元具体用于：
对所述BGP FS规则的配置参数进行分析，确定是否存在导致BGP FS规则无法生效的参数组合；
若存在，对所述参数组合进行修改，使得修改后得到的BGP FS规则生效。
在一种实现方式中，所述操作单元具体用于：
对经过所述网络节点的数据流量进行分析，并根据分析结果对所述BGP FS规则进行修改。
在一种实现方式中，所述发送单元还用于向所述网络节点发送状态上报指令，所述状态上报指令，用于指示所述网络节点向所述数据处理装置上报所述BGP FS规则在所述网络节点上实施的状态。
在一种实现方式中，所述发送单元还用于向所述网络节点发送流量信息上报指令，所述流量信息上报指令，用于指示所述网络节点向所述数据处理装置上报所述BGP FS规则的流量匹配信息，所述流量匹配信息，为与所述BGP FS规则匹配的数据流量的相关信息。
在一种实现方式中，所述发送单元具体用于：
当所述数据处理装置接收到的所述状态为所述BGP FS规则已经在所述网络节点上 实施时，向所述网络节点发送所述流量信息上报指令。
由于所述装置500是与以上方法实施例提供的、由第一服务器执行的数据处理方法对应的装置，所述装置500的各个单元的具体实现，均与以上方法实施例为同一构思，因此，关于所述装置500的各个单元的具体实现，可以参考以上方法实施例中关于第一服务器执行的数据分析方法的描述部分，此处不再重复描述。
本申请实施例还提供了一种信息上报设备，所述设备包括：处理器和存储器；所述存储器，用于存储指令；所述处理器，用于执行所述存储器中的所述指令，以执行以上方法实施例提供的由网络节点执行的信息上报方法。在一些实施例中，该信息上报设备可以是图1中的任一网络设备。
本申请实施例还提供了一种数据处理设备，所述设备包括：处理器和存储器；所述存储器，用于存储指令；所述处理器，用于执行所述存储器中的所述指令，以执行以上方法实施例提供的由第一服务器执行的数据分析方法。在一些实施例中，该数据分析设备可以是图1中服务器200或者服务器300。
需要说明的是，前述提及的信息上报设备和数据处理设备，其硬件结构均可以为如图6所示的结构，图6为本申请实施例提供的一种设备的结构示意图。
请参阅图6所示，设备600包括：处理器610、通信接口620和和存储器630。其中设备600中的处理器610的数量可以一个或多个，图6中以一个处理器为例。本申请实施例中，处理器610、通信接口620和存储器630可通过总线系统或其它方式连接，其中，图6中以通过总线系统640连接为例。
处理器610可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器610还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。若所述设备600为前述实施例中提及的信息上报设备，则处理器610可以执行前述获取单元401和发送单元402等单元执行的步骤。若所述网络设备600为前述实施例中提及的数据处理设备，则处理器610可以执行前述获取单元501和存储单元502等单元执行的步骤。
存储器630可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器630也可以包括非易失性存储器(英文：non-volatile memory)，例如快闪存储器(英文：flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器630还可以包括上述种类的存储器的组合。
若所述设备600为前述实施例中提及的信息上报设备，则存储器630可以存储前述实施例提及的BGP FS规则等等。若所述网络设备600为前述实施例中提及的数据处理设备，则存储器630可以存储前述实施例提及的BGP FS规则在网络节点上实施的状态等等。
可选地，存储器630存储有操作系统和程序、可执行模块或者数据结构，或者它们的子集，或者它们的扩展集，其中，程序可包括各种操作指令，用于实现各种操作。操作系统可包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。处理器610可以读取存储器630中的程序，实现本申请实施例提供的数据采集方法。
总线系统640可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线系统640可以分为地址总线、数据总线、控制总线等。为便于表示，图6中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上实施例提供的由网络节点执行的信息上报方法。
本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行以上实施例提供的由第一服务器执行的数据处理方法。
本申请实施例还提供了一种包含程序的计算机程序产品，当其在计算机上运行时，使得计算机执行以上实施例提供的由网络节点执行的信息上报方法。
本申请实施例还提供了一种包含程序的计算机程序产品，当其在计算机上运行时，使得计算机执行以上实施例提供的由第一服务器执行的数据处理方法。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑业务划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各业务单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件业务单元的形式实现。
集成的单元如果以软件业务单元的形式实现并作为独立的产品销售或使用时，可 以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干程序用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的业务可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些业务存储在计算机可读介质中或者作为计算机可读介质上的一个或多个程序或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上仅为本发明的具体实施方式而已。
以上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围

Claims (30)

  1. 一种信息上报方法，其特征在于，所述方法包括：
    网络节点获取边界网关协议流规范BGP FS规则在所述网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；
    所述网络节点将所述状态发送给服务器。
  2. 根据权利要求1所述的方法，其特征在于，所述网络节点将所述状态发送给服务器，包括：
    所述网络节点将所述状态添加至路由监控RM消息中，并将添加了所述状态的RM消息发送给所述服务器。
  3. 根据权利要求1或2所述的方法，其特征在于，所述BGP FS规则已经在所述网络节点上实施包括：所述BGP FS规则正常实施，或者，所述BGP FS规则异常实施。
  4. 根据权利要求1所述的方法，其特征在于，所述BGP FS规则未在所述网络节点上实施，包括:
    所述BGP FS规则未通过边界网关协议BGP校验，和/或，所述BGP FS规则未通过BGP FS校验。
  5. 根据权利要求1所述的方法，其特征在于，若所述状态为所述BGP FS规则已经在所述网络节点上实施，所述方法还包括：
    所述网络节点获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；
    所述网络节点将所述流量匹配信息发送给所述服务器。
  6. 根据权利要求5所述的方法，其特征在于，所述网络节点将所述流量匹配信息发送给所述服务器，包括：
    所述网络节点将所述流量匹配信息添加至状态报告SR消息中，并将添加了所述流量匹配信息的SR消息发送给所述服务器。
  7. 根据权利要求1-6任一权利要求所述的方法，其特征在于，所述网络节点获取BGP FS规则在所述网络节点上实施的状态，包括：
    所述网络节点接收到来自所述服务器的状态上报指令之后，获取所述BGP FS规则在所述网络节点上实施的状态。
  8. 根据权利要求6或7所述的方法，其特征在于，所述网络节点获取所述BGP FS规则的流量匹配信息，包括：
    所述网络节点接收到来自所述服务器的流量信息上报指令之后，获取所述BGP FS规则的流量匹配信息。
  9. 一种数据处理方法，其特征在于，所述方法包括：
    第一服务器获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；
    所述第一服务器存储所述状态。
  10. 根据要求9所述的方法，其特征在于，所述方法还包括：
    所述第一服务器根据所述状态执行第一操作；或者，
    所述第一服务器将所述状态发送给第二服务器，由所述第二服务器根据所述状态执行第一操作。
  11. 根据权利要求9所述的方法，其特征在于，所述根据所述状态执行第一操作，包括：
    控制显示设备显示所述状态；或者，
    根据所述状态对所述BGP FS规则进行修改，并将修改后的BGP FS规则发送给所述网络节点；或者，
    根据所述状态向所述网络节点发送第一配置指令，所述第一配置指令用于配置所述网络节点。
  12. 根据权利要求11所述的方法，其特征在于，所述根据所述状态对所述BGP FS规则进行修改，包括：
    若所述状态为所述BGP FS规则未通过边界网关协议BGP校验，则确定所述BGP FS规则中携带的非法参数，并将所述非法参数修改为合法参数；或者，
    若所述状态为所述BGP FS规则携带的生效接口与所述网络节点的接口不匹配，则将所述BGP FS规则携带的生效接口修改为与所述网络节点的接口匹配的接口；或者，
    若所述状态为描述所述BGP FS规则与安全保护策略冲突，则将所述BGP FS规则修改为与所述安全保护策略不冲突的BGP FS规则。
  13. 根据权利要求11所述的方法，其特征在于，所述根据所述状态向所述网络节点发送第一配置指令，包括：
    若所述状态为所述BGP FS规则不符合预设实施条件，则向所述网络节点发送第一配置指令，所述第一配置指令用于指示所述网络节点重新配置目标参数，以使得所述BGP FS规则符合所述预设实施条件；或者，所述第一配置指令，用于配置所述网络节点取消验证所述BGP FS规则是否符合所述预设实施条件。
  14. 根据权利要求9-13任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一服务器获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；
    所述第一服务器存储所述流量匹配信息。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    所述第一服务器根据所述流量匹配信息执行第二操作；或者，
    所述第一服务器将所述流量匹配信息发送给所述第二服务器，由所述第二服务器根据所述流量匹配信息执行第二操作。
  16. 根据权利要求15所述的方法，其特征在于，所述根据所述流量匹配信息执行第二操作，包括：
    控制显示设备显示所述流量匹配信息；或者，
    确定所述流量匹配信息是否符合预设条件，若所述流量匹配信息不符合所述预设条件，则根据所述流量匹配信息对所述BGP FS规则进行修改，并将修改后的BGP FS规则发送给所述网络节点；或者，
    根据所述流量匹配信息向所述网络节点发送第二配置指令，所述第二配置指令用 于配置所述网络节点。
  17. 根据权利要求16所述的方法，其特征在于，所述向所述网络节点发送第二配置指令，包括：
    若所述状态包括所述BGP FS规则的优先级低于其它流量控制策略的优先级，则向所述网络节点发送第二配置指令，所述第二配置指令用于配置所述网络节点取消实施所述其它流量控制策略，或者，用于配置所述网络节点优先实施所述BGP FS规则。
  18. 根据权利要求16所述的方法，其特征在于，所述第二服务器对所述BGP FS规则进行修改，包括：
    若所述状态不包括所述BGP FS规则的优先级低于其它流量控制策略的优先级，则对所述BGP FS规则进行修改。
  19. 根据权利要求9-18任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一服务器向所述网络节点发送状态上报指令，所述状态上报指令，用于指示所述网络节点向所述第一服务器上报所述BGP FS规则在所述网络节点上实施的状态。
  20. 根据权利要求9-19任意一项所述的方法，其特征在于，所述方法还包括：
    所述第一服务器向所述网络节点发送流量信息上报指令，所述流量信息上报指令，用于指示所述网络节点向所述第一服务器上报所述BGP FS规则的流量匹配信息，所述流量匹配信息，为与所述BGP FS规则匹配的数据流量的相关信息。
  21. 根据权利要求20所述的方法，其特征在于，所述第一服务器向所述网络节点发送流量信息上报指令，包括：
    当所述第一服务器接收到的所述状态为BGP FS规则已经在所述网络节点上实施时，所述第一服务器向所述网络节点发送所述流量信息上报指令。
  22. 一种信息上报装置，其特征在于，所述装置包括：
    获取单元，用于获取边界网关协议流规范BGP FS规则在网络节点上实施的状态；所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；
    发送单元，用于将所述状态发送给服务器。
  23. 根据权利要求22所述的装置，其特征在于，所述发送单元，具体用于：
    将所述状态添加至路由监控RM消息中，并将添加了所述状态的RM消息发送给所述服务器。
  24. 根据权利要求22所述的装置，其特征在于，若所述状态为所述BGP FS规则已经在所述网络节点上实施，
    所述获取单元，还用于获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；
    所述发送单元，还用于将所述流量匹配信息发送给所述服务器。
  25. 根据权利要求24所述的装置，其特征在于，所述发送单元，具体用于：
    将所述流量匹配信息添加至状态报告SR消息中，并将添加了所述流量匹配信息的SR消息发送给所述服务器。
  26. 一种数据处理装置，其特征在于，所述装置包括：
    获取单元，用于获取边界网关协议流规范BGP FS规则在网络节点上实施的状态； 所述状态指示所述BGP FS规则已经在所述网络节点上实施，或者，所述状态指示所述BGP FS规则未在所述网络节点上实施；
    存储单元，用于存储所述状态。
  27. 根据要求26任意一项所述的装置，其特征在于，所述装置还包括：
    操作单元，用于根据所述状态执行第一操作，或者，
    发送单元，用于将所述状态发送给第二服务器，由所述第二服务器根据所述状态执行第一操作。
  28. 根据权利要求26或27所述的装置，其特征在于，
    所述获取单元，还用于获取所述BGP FS规则的流量匹配信息，所述流量匹配信息为与所述BGP FS规则匹配的数据流量的相关信息；
    所述存储单元，还用于存储所述流量匹配信息。
  29. 根据权利要求28所述的装置，其特征在于，
    所述操作单元，还用于根据所述流量匹配信息执行第二操作；或者，
    所述发送单元，还用于将所述流量匹配信息发送给所述第二服务器，由所述第二服务器根据所述流量匹配信息执行第二操作。
  30. 一种计算机可读存储介质，其特征在于，包括指令，当其在计算机上运行时，使得计算机执行以上权利要求1-21任意一项所述的方法。
PCT/CN2020/125227 2019-10-31 2020-10-30 一种信息上报方法、数据处理方法及装置 Ceased WO2021083324A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2022525231A JP7470786B2 (ja) 2019-10-31 2020-10-30 情報報告方法、データ処理方法、及び装置
EP20880447.6A EP4030720B1 (en) 2019-10-31 2020-10-30 Information reporting method, and data processing method and device
BR112022007412A BR112022007412A2 (pt) 2019-10-31 2020-10-30 Método de relatório de informações, e método de processamento de dados, e dispositivos
US17/732,588 US12177183B2 (en) 2019-10-31 2022-04-29 Information reporting method, data processing method, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911053999.5A CN112751814B (zh) 2019-10-31 2019-10-31 一种信息上报方法、数据处理方法及装置
CN201911053999.5 2019-10-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/732,588 Continuation US12177183B2 (en) 2019-10-31 2022-04-29 Information reporting method, data processing method, and apparatus

Publications (1)

Publication Number Publication Date
WO2021083324A1 true WO2021083324A1 (zh) 2021-05-06

Family

ID=75644643

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/125227 Ceased WO2021083324A1 (zh) 2019-10-31 2020-10-30 一种信息上报方法、数据处理方法及装置

Country Status (6)

Country Link
US (1) US12177183B2 (zh)
EP (1) EP4030720B1 (zh)
JP (1) JP7470786B2 (zh)
CN (2) CN114826697A (zh)
BR (1) BR112022007412A2 (zh)
WO (1) WO2021083324A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115022165A (zh) * 2022-05-27 2022-09-06 烽火通信科技股份有限公司 Bgp流规范生效接口优化方法、装置、设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834491A (zh) * 2021-09-16 2023-03-21 华为技术有限公司 报文处理方法、流规范传输方法、设备、系统及存储介质
US12199999B2 (en) * 2022-04-04 2025-01-14 Arbor Networks, Inc. Flowspec message processing apparatus and method

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015138767A1 (en) * 2014-03-13 2015-09-17 Cisco Technology, Inc. Service node originated service chains in a network environment
CN107592270A (zh) * 2016-07-07 2018-01-16 华为技术有限公司 FlowSpec消息的处理方法和装置以及系统
CN108881041A (zh) * 2017-05-15 2018-11-23 中国移动通信有限公司研究院 一种控制流量的方法及系统
WO2019138414A1 (en) * 2018-01-12 2019-07-18 Telefonaktiebolaget Lm Ericsson (Publ) Data center failure management in an sdn deployment using switching node control

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101369909A (zh) * 2007-08-15 2009-02-18 华为技术有限公司 上报策略执行结果的方法、网络通信系统和设备
JP2011087302A (ja) * 2009-10-19 2011-04-28 Ip Infusion Inc Ｂｇｐ経路監視装置、ｂｇｐ経路監視方法、およびプログラム
CN102158469A (zh) * 2011-01-27 2011-08-17 电子科技大学 一种边界网关协议前缀劫持攻击防范方法
CN104734949B (zh) * 2013-12-24 2019-09-13 南京中兴新软件有限责任公司 一种实现流表配置的方法及装置
CN105871602B (zh) * 2016-03-29 2019-10-18 华为技术有限公司 一种统计流量的控制方法、装置和系统
CN113055290B (zh) * 2016-07-01 2022-12-06 华为技术有限公司 基于业务功能链sfc的报文转发方法、装置和系统
JP2018029303A (ja) 2016-08-19 2018-02-22 日本電信電話株式会社 通知システムおよび通知方法
JP2018125745A (ja) 2017-02-02 2018-08-09 日本電信電話株式会社 転送装置及び転送方法
WO2018170901A1 (en) * 2017-03-24 2018-09-27 Telefonaktiebolaget Lm Ericsson (Publ) Method and device for managing network based on border gateway protocol
US10554493B2 (en) * 2017-06-19 2020-02-04 Cisco Technology, Inc. Identifying mismatches between a logical model and node implementation
CN108924049B (zh) * 2018-06-27 2020-12-25 新华三技术有限公司合肥分公司 流规格路由调度方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015138767A1 (en) * 2014-03-13 2015-09-17 Cisco Technology, Inc. Service node originated service chains in a network environment
CN107592270A (zh) * 2016-07-07 2018-01-16 华为技术有限公司 FlowSpec消息的处理方法和装置以及系统
CN108881041A (zh) * 2017-05-15 2018-11-23 中国移动通信有限公司研究院 一种控制流量的方法及系统
WO2019138414A1 (en) * 2018-01-12 2019-07-18 Telefonaktiebolaget Lm Ericsson (Publ) Data center failure management in an sdn deployment using switching node control

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4030720A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115022165A (zh) * 2022-05-27 2022-09-06 烽火通信科技股份有限公司 Bgp流规范生效接口优化方法、装置、设备及存储介质
CN115022165B (zh) * 2022-05-27 2023-06-02 烽火通信科技股份有限公司 Bgp流规范生效接口优化方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US20220263803A1 (en) 2022-08-18
CN114826697A (zh) 2022-07-29
EP4030720A1 (en) 2022-07-20
CN112751814B (zh) 2022-04-12
JP7470786B2 (ja) 2024-04-18
BR112022007412A2 (pt) 2022-07-05
JP2023500274A (ja) 2023-01-05
CN112751814A (zh) 2021-05-04
EP4030720A4 (en) 2022-11-02
US12177183B2 (en) 2024-12-24
EP4030720B1 (en) 2024-09-25

Similar Documents

Publication Publication Date Title
US10841279B2 (en) Learning network topology and monitoring compliance with security goals
US10291534B2 (en) Incremental application of resources to network traffic flows based on heuristics and business policies
EP3229407B1 (en) Application signature generation and distribution
US10708146B2 (en) Data driven intent based networking approach using a light weight distributed SDN controller for delivering intelligent consumer experience
ES2841323T3 (es) Una estrategia de red basada en intención impulsada por datos que utiliza un controlador SDN distribuido ligero para brindar experiencias inteligentes al consumidor
US10116696B2 (en) Network privilege manager for a dynamically programmable computer network
US10135841B2 (en) Integrated security system having threat visualization and automated security device control
US11296930B2 (en) Tunnel-enabled elastic service model
AU2015255980B2 (en) System and methods for reducing impact of malicious activity on operations of a wide area network
US7742406B1 (en) Coordinated environment for classification and control of network traffic
CN115885502B (zh) 对中间网络节点进行诊断
US20230275818A1 (en) Increasing data availability
WO2021110894A1 (en) Providing interface between network management and slice management
US9584422B2 (en) Methods and apparatuses for automating return traffic redirection to a service appliance by injecting traffic interception/redirection rules into network nodes
US12177183B2 (en) Information reporting method, data processing method, and apparatus
US10771499B2 (en) Automatic handling of device group oversubscription using stateless upstream network devices
US12120128B1 (en) Route and packet flow evaluation on a cloud exchange
US20250322084A1 (en) Enforcing trusted and untrusted postures on data traffic and transports
JP2018037835A (ja) 攻撃判定装置および攻撃判定方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20880447

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020880447

Country of ref document: EP

Effective date: 20220414

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112022007412

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2022525231

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 112022007412

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20220418