Edge server DoS attack detection method based on runtime verification

Abstract

The invention belongs to the technical field of program running verification, and discloses an edge server DoS attack detection method based on runtime verification, and the method comprises the steps of carrying out the formalized description of an edge server expected behavior through employing a PPTL formula; adopting a PPTL formula to describe DoS attack features of the edge server in a formalized manner; aiming at a program variable and a program function involved in the PPTL formula, carrying out instrumentation on an edge server running program; and aiming at the dynamic execution track of the edge server program, detecting the running state of the program by adopting a verification framework during parallel running, and judging whether the edge server is under DoS attack or not according to a detection result. According to the verification framework based on parallel runtime provided by the invention, idle computing and storage resources of the edge server can be fully utilized, the verification efficiency is improved, attacks can be found in time, each state of program execution can be reliably verified, and the security of the edge server is effectively guaranteed.

Description

technical field [0001] The invention belongs to the technical field of program operation verification, and in particular relates to a DoS attack detection method of an edge server based on runtime verification. Background technique [0002] At present, the edge computing system uses the computing and storage resources of the terminal device and the edge server near the terminal to partially process the data in advance, reducing the amount of data to be sent to the cloud data center, thereby reducing the usage of network bandwidth and enabling the system to Respond to data immediately with low data latency. However, the characteristics of edge servers make it face new challenges. First, because edge servers are located at the edge of the network, closer to users, heterogeneous access environments and diverse business requirements make edge servers face a more complex network environment. In addition, edge servers are often geographically distributed, making it difficult to ...

AI Technical Summary

Problems solved by technology

[0006] (1) The existing DoS attack detection methods for edge computing systems use pattern recognition or machine learning methods, which need to train the model in advance, and then use a large amount of memory when performing real-time detection based on the trained model;

[0007] (2) In the existing formal verification methods represented by model checking and runtime verification, theoretical models such as automata need to be constructed, and the detection efficiency is not high

However, the computing resources of edge servers are limited, which increases the difficulty of accurately and efficiently detecting DoS attacks

Images