Synchronous adaptive link flooding attack defense method for heterogeneous networks with multi-dimensional identification

Abstract

The present invention discloses a synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network, comprising the following steps: S1, sampling the packet loss rate and link utilization of the network topology link to obtain the current state of the link; S2, extracting the key traffic features of the current state through the Honey Badger optimization algorithm; S3, inputting the key traffic features of the current state into a prediction model based on a spatiotemporal graph convolutional neural network to obtain a DDoS attack traffic prediction value; S4, identifying the attack action of the DDoS attack traffic prediction value, and selecting the optimal defense action through a partially observable Markov decision process model and a reward mechanism; S5, adjusting the defense strategy based on the optimal defense action selected in the current state. The present invention can accurately predict attack behavior and dynamically learn the optimal mitigation strategy in a novel multi-dimensional identification fusion network scenario to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links.

Description

Technical Field

[0001] The present invention belongs to the field of novel multi-dimensional identification fusion network security, and in particular relates to a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network. Background Art

[0002] To meet the urgent demands of diverse emerging services for the future internet, including high security, lightweight, intelligent, efficient, and mobile features, a new multi-dimensional identity convergence network has been proposed based on an in-depth study of existing network identification systems and their derivative technologies. This new multi-dimensional identity convergence network uses multi-dimensional unified identifiers (UIDs) as unique identifiers for network entities. These identifiers possess multi-dimensional attributes, such as identity, location, time, and physical attributes, and are used to describe various network entities, including terminals, interfaces, services, content, and specific groups. The new multi-dimensional identity convergence network utilizes the concept of separating identity from location, separating the IP space into multi-dimensional unified identifiers (UIDs) and network interconnection identifiers (NIDs). UIDs are used to uniquely identify objects, while NIDs are used to identify their locations within the network. Multi-dimensionally identified network objects are divided into two categories: device objects and service objects, each embodying different multi-dimensional attributes (MADs).

[0003] By analyzing the DDoS attack prediction methods of existing technical solutions, although the software-defined network defense solutions in the existing technology have made significant progress in DDoS attack prediction and defense, there is still a centralized architecture of the control plane, which may cause the controller to become a bottleneck, affecting the overall network performance, especially in the case of high-traffic DDoS attacks. Hardware performance limitations. Summary of the Invention

[0004] In response to the above-mentioned deficiencies in the prior art, the synchronous adaptive link flood attack defense method for multi-dimensionally identified heterogeneous networks provided by the present invention solves the problem that the centralized architecture of the control plane in the software-defined network defense solution in the prior art in terms of DDoS attack prediction and defense may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitation in the case of high-traffic DDoS attacks.

[0005] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is: a synchronous adaptive link flooding attack defense method for multi-dimensional identification heterogeneous networks, comprising the following steps:

[0006] S1. Sampling the packet loss rate and link utilization of the network topology links of the multi-dimensionally identified heterogeneous network to obtain the current status of the link;

[0007] S2. Extract key traffic features of the current state through the Honey Badger optimization algorithm;

[0008] S3. Input the key traffic features of the current state into the prediction model based on the spatiotemporal graph convolutional neural network to obtain the DDoS attack traffic prediction value;

[0009] S4,identify the attack actions of the DDoS attack traffic prediction value and select the best defense action through the partially observable Markov decision process model and reward mechanism;

[0010] S5. Adjust the defense strategy based on the best defense action selected in the current state.

[0011] Further: In S1, the current state of the link s Possibility The specific expression is:

[0012]

[0013] Where, is the normalization constant, is the confidence level, The best possible defensive action for the current situation, Possible attack actions in the current state, For all offensive actions, When the attack event and defense event interact for the last time, the state To the current state s The possibility of state transition, For all states, is the probability of the last attack action occurring, Status possibility.

[0014] Furthermore, in S2, the method for extracting the key traffic features of the current state by the Honey Badger optimization algorithm includes the following steps:

[0015] S21. Set the position of the honey badger within the search space using the following formula;

[0016]

[0017] Where, for The location of the honey badger, and are the lower and upper bounds of the search domain, is the first random number;

[0018] S22. Calculate the intensity of the influence on movement dynamics based on the distance between the honey badger and the prey ;

[0019]

[0020] Where, is the second random number, is the density coefficient, and its specific expression is:

[0021]

[0022] Where, is the maximum number of iterations, is the current iteration number;

[0023] S23. Update the honey badger according to its strength and the position of the honey badger after the update ;

[0024]

[0025] Where, The location of the honey badger before the update. is a random factor, and , is the third random number, is the fourth random number, is the fifth random number, and , It is the sign of the search direction, and its specific expression is:

[0026]

[0027] Where, is the sixth random number;

[0028] S24, using the updated honey badger to track the bees and guide the bird to the beehive, updating the honey badger position to obtain the final honey badger position, wherein the honey badger tracking the bees and guiding the bird to the beehive is simulated by the following formula;

[0029]

[0030] Where, is the seventh random number, F is a tensor containing the feature dimensions of all nodes;

[0031] S25. Determine the key traffic characteristics of the current state according to the final honey badger position output.

[0032] Further: in said S3, the prediction model based on the spatiotemporal graph convolutional neural network includes an adaptive hybrid spatiotemporal learning layer, an input layer, and an output layer connected in sequence, the adaptive hybrid spatiotemporal learning layer includes a plurality of adaptive hybrid spatiotemporal learning components with jump connections, each adaptive hybrid spatiotemporal learning component includes a temporal convolution module, an adaptive hybrid graph learning module, and a spatiotemporal adaptation module, wherein the adaptive hybrid graph learning module includes a static adaptive graph learning submodule, a dynamic graph learning submodule based on a graph attention mechanism, and a spatial gate fusion mechanism submodule;

[0033] The S3 includes the following sub-steps:

[0034] S31. Model the key traffic characteristics of the current state at the millisecond, second, and minute levels;

[0035] S32, inputting the modeling result into the time convolution module to obtain the final output of the time convolution module;

[0036] S33, inputting the modeling result into the adaptive hybrid graph learning module to obtain the output of the adaptive hybrid graph learning module;

[0037] S34, inputting the output of the multi-layer temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module, obtaining the output of the spatiotemporal adaptation module, and using it as the output of the adaptive hybrid spatiotemporal learning component;

[0038] S35. Obtain the output of the adaptive hybrid spatiotemporal learning layer according to the outputs of all adaptive hybrid spatiotemporal learning components;

[0039] S36. Input the output of the adaptive hybrid spatiotemporal learning layer into the input layer, and output the DDoS attack traffic prediction value through the output layer.

[0040] Further: In said S31, the flow characteristics of the current state G The graph data is represented as ;

[0041] in, is the set of switches whose traffic characteristics change over time, and , N is the number of switches, E is the set of links between switches, is the adjacency matrix of the graph, X For a given historical time step The graph signal matrix of , submatrix , To identify the observed value of the i-th switch at time slice t, is a matrix, and F is a tensor containing the feature dimensions of all nodes.

[0042] Furthermore, the step S32 includes the following sub-steps:

[0043] S321, sequentially inputting the modeling results into a number of temporal convolution modules with skip connections to obtain the first to third temporal feature elements finally calculated;

[0044] The expressions of the first to third time characteristic elements finally calculated are specifically as follows:

[0045]

[0046] Where, is the first time characteristic element finally calculated, For the l -1 calculated first time feature element, is the second time characteristic element finally calculated, For the l -1 calculated second time characteristic element, is the third time characteristic element finally calculated, For the l -1 times the third time feature element, ∗ is the convolution operator, is the element-wise product, is the learning parameter, tanh is the hyperbolic tangent activation function, The first to third time feature elements calculated for the lth time are generated based on the key traffic features of the current state at the millisecond, second, and minute levels.

[0047] S322: Connect the first to third time feature elements finally calculated into a vector to obtain the final output of the time convolution module;

[0048] Among them, the output of the temporal convolution module The specific expression is:

[0049]

[0050] Where, is a multi-layer perceptron.

[0051] Furthermore, the step S33 includes the following sub-steps:

[0052] S331: Input the modeling results into the static adaptive graph learning submodule for graph convolution operation to obtain the output of adaptive graph learning. ;

[0053]

[0054] Where, is a self-connected unitary matrix, is the adaptive adjacency matrix, is the graph convolution kernel, is the output of the dimensional graph convolutional neural network, and its specific expression is:

[0055]

[0056] Where, is the augmented adjacency matrix, is the feature matrix of the modeling results;

[0057] S332, inputting the modeling result into the dynamic graph learning submodule based on the graph attention mechanism to obtain the dynamic graph learning result;

[0058] S333: Input the output of adaptive graph learning and the result of dynamic graph learning into the spatial gate fusion mechanism submodule to obtain the output of the adaptive hybrid graph learning module. ;

[0059]

[0060] Where, is the result of dynamic graph learning, are all learnable parameters.

[0061] Furthermore, the step S34 includes the following sub-steps:

[0062] S341, inputting the output of the temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module to obtain the key vectors of the nodes in the temporal and spatial dimensions;

[0063]

[0064] Where, are all learnable transformation matrices, is the key vector of the node in the time dimension, is the key vector of the node in the spatial dimension;

[0065] S342, calculating the time and space dimension attention of the graph node through the key vector of the node in the time and space dimensions;

[0066]

[0067] Where, is the time dimension attention, is the spatial dimension attention, D is the degree normalization matrix, Q is the query vector, and , is a learnable transformation matrix;

[0068] S343, calculating the attention score of the node in the time and space dimensions according to the time and space dimension attention of the graph node;

[0069]

[0070] Where, is the attention score in the time dimension, is the attention score in the spatial dimension, Score for overall attention;

[0071] S344. Calculate the output of the spatiotemporal adaptation module based on the attention score of the node in the time and space dimensions ;

[0072] .

[0073] Further: In said S35, the output of the adaptive hybrid spatiotemporal learning component is obtained The specific expression is:

[0074]

[0075] Where, L is the total number of adaptive hybrid spatiotemporal learning components;

[0076] In S36, the DDoS attack traffic prediction value is calculated. The specific expression is:

[0077]

[0078] Where, 、 、 are all weight matrices, 、 、 are bias vectors, It is a fully connected layer operation.

[0079] Further: In S4, the reward mechanism The specific expression is:

[0080]

[0081] Where, A state determined based on historical data s The average good traffic in The next state determined based on historical data The average good traffic in A term that provides additional incentives for less explored defensive actions.

[0082] The beneficial effects of the present invention are:

[0083] (1) The present invention provides a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network. In response to the communication requirements of the communication peers for high security, high mobility, and intelligent communication in a heterogeneous network communication environment, a new active LFA defense framework is designed based on a new multi-dimensional identification heterogeneous network architecture. The framework can accurately predict attack behavior and dynamically learn the optimal mitigation strategy in the new multi-dimensional identification fusion network scenario to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links. In this way, the safe operation of the new multi-dimensional identification fusion network and system is ensured, which helps to achieve an efficient, secure, and intelligent network environment. It solves the problem in the existing software-defined network defense solution that the centralized architecture of the control plane may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitation in the case of high-traffic DDoS attacks.

[0084] (2) This paper designs a hybrid spatiotemporal graph convolutional neural network based on the honey badger optimization algorithm to build a prediction model that can capture the composite spatial dependency and nonlinear temporal dependency of periodic data input, thereby greatly improving the prediction performance.

[0085] (3) This paper designs a reinforcement learning optimization mitigation strategy based on partially observable Markov decision process modeling, which uses prediction results and distributed sampling information to continuously evolve and adapt to changes in attack strategies and environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 This is a flow chart of the synchronous adaptive link flooding attack defense method for multi-dimensional identification heterogeneous networks of the present invention. DETAILED DESCRIPTION

[0087] The specific embodiments of the present invention are described below to facilitate understanding of the present invention by those skilled in the art. However, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations utilizing the concepts of the present invention are protected.

[0088] like Figure 1 As shown, in one embodiment of the present invention, a synchronous adaptive link flood attack defense method for multi-dimensionally identifying heterogeneous networks includes the following steps:

[0089] S1. Sampling the packet loss rate and link utilization of the network topology links of the multi-dimensionally identified heterogeneous network to obtain the current status of the link;

[0090] S2. Extract key traffic features of the current state through the Honey Badger optimization algorithm;

[0091] S3. Input the key traffic features of the current state into the prediction model based on the spatiotemporal graph convolutional neural network to obtain the DDoS attack traffic prediction value;

[0092] S4,identify the attack actions of the DDoS attack traffic prediction value and select the best defense action through the partially observable Markov decision process model and reward mechanism;

[0093] S5. Adjust the defense strategy based on the best defense action selected in the current state.

[0094] This patent addresses the problems and shortcomings of existing technologies and, based on existing research results, proposes an active collaborative DDoS defense framework. This framework makes full use of INT distributed sampling, spatiotemporal graph convolutional neural network models, and self-learning-driven mitigation strategies to improve fine-grained prediction accuracy and reduce false positive rates. It aims to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links. It has important research value and application prospects.

[0095] In S1, the current state of the link s Possibility The specific expression is:

[0096]

[0097] Where, is the normalization constant, is the confidence level, The best possible defensive action for the current situation, Possible attack actions in the current state, For all offensive actions, When the attack event and defense event interact for the last time, the state To the current state s The possibility of state transition, For all states, is the probability of the last attack action occurring, Status possibility.

[0098] In this embodiment, the process of selecting relevant features for the adaptive active defense framework includes eliminating the most redundant and unnecessary features, and adopting the Honey Badger optimization algorithm to overcome the main problems of previous algorithms such as long calculation time and local optimal superposition.

[0099] In S2, the method of extracting the key traffic features of the current state by the Honey Badger optimization algorithm includes the following steps:

[0100] S21. Set the position of the honey badger within the search space using the following formula;

[0101]

[0102] Where, for The location of the honey badger, and are the lower and upper bounds of the search domain, is the first random number, and its numerical strength is calculated based on the distance between the honey badger and the prey;

[0103] S22. Calculate the intensity of the influence on movement dynamics based on the distance between the honey badger and the prey ;

[0104]

[0105] Where, is the second random number, is the density coefficient, which is used to promote a smooth transition from exploration to mining. Its specific expression is:

[0106]

[0107] Where, is the maximum number of iterations, is the current iteration number;

[0108] S23. Update the honey badger according to its strength and the position of the honey badger after the update ;

[0109]

[0110] Where, The location of the honey badger before the update. is a random factor, and , is the third random number, is the fourth random number, is the fifth random number, and , It is the sign of the search direction, and its specific expression is:

[0111]

[0112] Where, is the sixth random number;

[0113] S24, using the updated honey badger to track the bees and guide the bird to the beehive, updating the honey badger position to obtain the final honey badger position, wherein the honey badger tracking the bees and guiding the bird to the beehive is simulated by the following formula;

[0114]

[0115] Where, is the seventh random number, F is a tensor containing the feature dimensions of all nodes;

[0116] S25. Determine the key traffic characteristics of the current state according to the final honey badger position output.

[0117] In this example, the Honey Badger Optimization algorithm uses root mean square error (RMSE) as the fitness function of the spatiotemporal graph convolutional neural network model to evaluate feature quality, minimizing RMSE to select the best features. This approach allows the Honey Badger Optimization algorithm to effectively select features to improve the accuracy and performance of the prediction model. An update function, RMSE value, is associated with the update in each iteration to identify the best features.

[0118] The multi-periodic temporal dependency between the input data in the prediction model is captured with three periodic inputs of milliseconds each. ,Second ,minute ,The present paper introduces the Honey Badger optimization algorithm to select the ,best features and uses them as the key traffic features of the ,current state. The features are fed into the prediction model to ,calculate the DDoS attack traffic prediction value for ,predicting link flooding DDoS attacks.

[0119] In S3, the prediction model based on the spatiotemporal graph convolutional neural network includes an adaptive hybrid spatiotemporal learning layer, an input layer, and an output layer connected in sequence, the adaptive hybrid spatiotemporal learning layer includes a plurality of adaptive hybrid spatiotemporal learning components with jump connections, each adaptive hybrid spatiotemporal learning component includes a temporal convolution module, an adaptive hybrid graph learning module, and a spatiotemporal adaptation module, wherein the adaptive hybrid graph learning module includes a static adaptive graph learning submodule, a dynamic graph learning submodule based on a graph attention mechanism, and a spatial gate fusion mechanism submodule;

[0120] In this example, the root mean square error (RMSE) between the predicted values ​​and the true values ​​of the prediction model based on the spatiotemporal graph convolutional neural network is used as the loss function and minimized through backpropagation. The MAE function is chosen because it provides an intuitive way to measure the average size of the prediction error applied to regression problems.

[0121]

[0122] Where, is the prediction model’s prediction of all switch forwarding traffic at time step i, It is the actual traffic forwarded by the switch.

[0123] The S3 includes the following sub-steps:

[0124] S31. Model the key traffic characteristics of the current state at the millisecond, second, and minute levels;

[0125] S32, inputting the modeling result into the time convolution module to obtain the final output of the time convolution module;

[0126] S33, inputting the modeling result into the adaptive hybrid graph learning module to obtain the output of the adaptive hybrid graph learning module;

[0127] S34, inputting the output of the multi-layer temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module, obtaining the output of the spatiotemporal adaptation module, and using it as the output of the adaptive hybrid spatiotemporal learning component;

[0128] S35. Obtain the output of the adaptive hybrid spatiotemporal learning layer according to the outputs of all adaptive hybrid spatiotemporal learning components;

[0129] S36. Input the output of the adaptive hybrid spatiotemporal learning layer into the input layer, and output the DDoS attack traffic prediction value through the output layer.

[0130] In S31, the current state of the flow characteristics G The graph data is represented as ;

[0131] in, is the set of switches whose traffic characteristics change over time, and , N is the number of switches, E is the set of links between switches, is the adjacency matrix of the graph, X For a given historical time step The graph signal matrix of , submatrix , To identify the observed value of the i-th switch at time slice t, is a matrix, and F is a tensor containing the feature dimensions of all nodes.

[0132] The S32 includes the following sub-steps:

[0133] S321, sequentially inputting the modeling results into a number of temporal convolution modules with skip connections to obtain the first to third temporal feature elements finally calculated;

[0134] The expressions of the first to third time characteristic elements finally calculated are specifically as follows:

[0135]

[0136] Where, is the first time characteristic element finally calculated, For the l -1 calculated first time feature element, is the second time characteristic element finally calculated, For the l -1 calculated second time characteristic element, is the third time characteristic element finally calculated, For the l -1 times the third time feature element, ∗ is the convolution operator, is the element-wise product, is the learning parameter, tanh is the hyperbolic tangent activation function, The first to third time feature elements calculated for the lth time are generated based on the key traffic features of the current state at the millisecond, second, and minute levels.

[0137] In this implementation, the temporal convolution module of the adaptive hybrid spatiotemporal learning component consists of three gated temporal convolutional networks, namely Temporal Conv-milliseconds, Temporal Conv-second, and Temporal Conv-minute, to capture the complex temporal correlations and periodicity of traffic. The temporal convolution module is highly parallelizable and easy to maintain high computational efficiency. By stacking multiple layers to construct a temporal convolutional network, the temporal convolutional network allows for an exponential sensing field with extended causal convolution. The gating mechanism has the ability to process continuous data, avoids the gradient vanishing / exploding problem, and enhances the modeling capability of temporal convolution, providing efficient model training and inference.

[0138] S322: Connect the first to third time feature elements finally calculated into a vector to obtain the final output of the time convolution module;

[0139] Among them, the output of the temporal convolution module The specific expression is:

[0140]

[0141] Where, is a multi-layer perceptron.

[0142] In this embodiment, the first to third temporal feature elements are input into a multilayer perceptron to obtain the final output of the temporal convolution module.

[0143] The S33 includes the following sub-steps:

[0144] S331: Input the modeling results into the static adaptive graph learning submodule for graph convolution operation to obtain the output of adaptive graph learning. ;

[0145]

[0146] Where, is a self-connected unitary matrix, is the adaptive adjacency matrix, is the graph convolution kernel, is the output of the dimensional graph convolutional neural network, and its specific expression is:

[0147]

[0148] Where, is the augmented adjacency matrix, is the feature matrix of the modeling results;

[0149] In this embodiment, the augmented adjacency matrix is ​​composed of the self-connected unitary matrix , based on the degree normalization matrix D and the adjacency matrix A get.

[0150] S332, inputting the modeling result into the dynamic graph learning submodule based on the graph attention mechanism to obtain the dynamic graph learning result;

[0151] In this embodiment, a dynamic graph learning submodule (GAT) based on a graph attention mechanism is used to empower dynamic graph learning to achieve dynamic spatial feature aggregation, because GAT is known to capture the dynamic influence between adjacent nodes. Considering that the short-term dynamic effects of traffic trend changes mainly occur between adjacent 1-hop switches, an exponential distance decay matrix called the distance adjacency matrix is ​​designed as the prior graph structure of GAT. GAT achieves weighted feature aggregation by calculating the attention scores of the central node and the adjacent nodes. Multi-head attention is also suitable for capturing the semantics of the relationship between nodes in different learning subspaces. In addition, multi-head attention can be calculated in parallel to reduce the time complexity:

[0152]

[0153] After the above changes in the formula, the graph attention mechanism formula for dynamic graph learning can be modeled as follows:

[0154]

[0155] in Indicates that the switch The attention score calculated between , Represents the neighboring nodes of a node in the topology The collection of >0 is a learnable parameter vector, and . is the weight matrix of the shared linear transformation. For each head, and are both expressed as linear transformation matrices for generating the corresponding heads, and Head is expressed as the number of heads. The final output of dynamic graph learning is defined as .

[0156] S333: Input the output of adaptive graph learning and the result of dynamic graph learning into the spatial gate fusion mechanism submodule to obtain the output of the adaptive hybrid graph learning module. ;

[0157]

[0158] Where, is the result of dynamic graph learning, are all learnable parameters.

[0159] The S34 includes the following sub-steps:

[0160] S341, inputting the output of the temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module to obtain the key vectors of the nodes in the temporal and spatial dimensions;

[0161]

[0162] Where, are all learnable transformation matrices, is the key vector of the node in the time dimension, is the key vector of the node in the spatial dimension;

[0163] S342, calculating the time and space dimension attention of the graph node through the key vector of the node in the time and space dimensions;

[0164]

[0165] Where, is the time dimension attention, is the spatial dimension attention, D is the degree normalization matrix, Q is the query vector, and , is a learnable transformation matrix;

[0166] S343, calculating the attention score of the node in the time and space dimensions according to the time and space dimension attention of the graph node;

[0167]

[0168] Where, is the attention score in the time dimension, is the attention score in the spatial dimension, Score for overall attention;

[0169] S344. Calculate the output of the spatiotemporal adaptation module based on the attention score of the node in the time and space dimensions ;

[0170] .

[0171] In the S35, the output of the adaptive hybrid spatiotemporal learning component is obtained. The specific expression is:

[0172]

[0173] Where, L is the total number of adaptive hybrid spatiotemporal learning components;

[0174] In this embodiment, each output of the adaptive hybrid spatiotemporal learning component is fed forward via a skip connection directly to the output layer. This layered arrangement allows the neural network to expand its temporal scope, effectively capturing both short-term, millisecond-scale, and long-term, minute-scale relationships in the data. The model's low-level components are fine-tuned to emphasize characteristics of short time steps, while high-level components are designed to integrate information from longer time spans. Skip connections help the model handle spatial correlations across different time scales. After integrating information via skip connections, an accumulation operation such as the one in the following equation combines the contributions of all adaptive hybrid spatiotemporal learning components to ultimately form a composite feature representation.

[0175] In S36, the DDoS attack traffic prediction value is calculated. The specific expression is:

[0176]

[0177] Where, 、 、 are all weight matrices, 、 、 are bias vectors, It is a fully connected layer operation.

[0178] In this embodiment, the output layer uses a three-layer fully connected layer to convert the combined features of the flow into the final comprehensive and accurate DDoS attack traffic prediction value.

[0179] In S4, by constructing a partially observable Markov decision process model, the required parameters are actively learned and the model is continuously updated. With the help of observation information such as network traffic characteristics and attack behaviors, more accurate defense strategies are formulated to enhance the defense effect. A partially observable Markov decision process is a tuple . in Defined as the state space, Defined as defensible space, represents the observation space, represents the state transition matrix, represents the observation matrix, is a reward function that quantifies the possible defense gain, It is a discount factor that measures the impact of current behavior on the future.

[0180] Reinforcement learning based on partially observable Markov decision processes dynamically formulates sequential decision problems, giving the DDoS defense agent stronger context-awareness. A prediction model based on a spatiotemporal graph convolutional neural network automatically identifies DDoS attack preparation signals and triggers responses to assist in the reasoning and planning of attack strategies. This not only minimizes the negative impact of the agent's blind exploration but also helps the agent converge to the optimal defense strategy more quickly.

[0181] Considering the proactive deployment of the best defense action, the agent is motivated to Accurately determine all possible attack actions in state s and Best Defensive Action .

[0182] It defines the probability terms of the next attack action based on the link conditions and the recent attack trends of the links which are integrated into the state transition matrix.

[0183]

[0184] When the environment is hour, Designated for execution The probability of Being treated as the last attack.

[0185] In S4, the reward mechanism The specific expression is:

[0186]

[0187] Where, A state determined based on historical data s The average good traffic in The next state determined based on historical data The average good traffic in A term that provides additional incentives for less explored defensive actions.

[0188] In this embodiment, the principles of the designed reward mechanism are as follows:

[0189] In order to select the best defense action through the partially observable Markov decision process model and reward mechanism, the possible attack actions in the current state are The probability is specified as the likelihood In the past time environment middle.

[0190] Each time, the agent sends new attack observations to retrain the prediction model, where this online learning method enables learning new attack strategies and their adaptability instead of relying on a static attack model. , next state and actions , state transition matrix Depend on composition.

[0191]

[0192] in Represents a dynamically changing system. is in state s from attack To Defense possibility.

[0193]

[0194] The agent computes the expected reward, composes a new POMDP model, and solves it in real time using the Heuristic Search Value Iteration (HSVI) algorithm to compute the best mitigation strategy recommendation. , the next state , attack action , defensive action , the reward can be calculated by the following equation:

[0195]

[0196] For less explored defensive behaviors, The maximum value of the defense strategy is higher to incentivize the execution of the behavior, thus solving the exploration-exploitation dilemma of reinforcement learning with logarithmic regret. This exploration method has better sample efficiency because the reward of irrelevant actions is always low despite the higher search efficiency.

[0197] The beneficial effects of the present invention are as follows: the present invention provides a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network. In response to the communication counterparts' demand for high security, high mobility, and intelligent communication in a heterogeneous network communication environment, a new active LFA defense framework is designed based on a new multi-dimensional identification heterogeneous network architecture. The framework can accurately predict attack behaviors and dynamically learn the best mitigation strategy in the new multi-dimensional identification fusion network scenario to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links. In this way, the safe operation of the new multi-dimensional identification fusion network and system is ensured, which helps to achieve an efficient, secure, and intelligent network environment. It solves the problem that the centralized architecture of the control plane in the software-defined network defense solution in the prior art may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitations in the case of high-traffic DDoS attacks.

[0198] In this paper, a hybrid spatiotemporal graph convolutional neural network based on the honey badger optimization algorithm is designed to build a prediction model that can capture the composite spatial dependency and nonlinear temporal dependency of periodic data inputs, thereby greatly improving the prediction performance.

[0199] This paper designs a reinforcement learning optimization mitigation strategy based on partially observable Markov decision process modeling, which utilizes prediction results and distributed sampling information to continuously evolve and adapt to changes in attack strategies and environments.

[0200] In the description of the present invention, it should be understood that the terms "center", "thickness", "upper", "lower", "horizontal", "top", "bottom", "inner", "outer", "radial", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only and cannot be understood as indicating or implying the relative importance or the number of technical features implicitly specified. Therefore, the features defined by "first", "second", and "third" may explicitly or implicitly include one or more of such features.

Claims

1. A synchronous adaptive link flood attack defense method for multi-dimensional identification heterogeneous networks, characterized in that: The following steps are involved: S1. Sampling the packet loss rate and link utilization of the network topology links of the multi-dimensionally identified heterogeneous network to obtain the current status of the link; S2. Extract key traffic features of the current state through the Honey Badger optimization algorithm; S3. Input the key traffic features of the current state into the prediction model based on the spatiotemporal graph convolutional neural network to obtain the DDoS attack traffic prediction value; S4,identify the attack actions of the DDoS attack traffic prediction value and select the best defense action through the partially observable Markov decision process model and reward mechanism; S5. Adjust the defense strategy based on the best defense action selected in the current state; In S1, the current state of the link s Possibility The specific expression is: Where, is the normalization constant, is the confidence level, The best possible defensive action for the current situation, Possible attack actions in the current state, For all offensive actions, When the attack event and defense event interact for the last time, the state To the current state s The possibility of state transition, For all states, is the probability of the last attack action occurring, Status possibility; In S3, the prediction model based on the spatiotemporal graph convolutional neural network includes an adaptive hybrid spatiotemporal learning layer, an input layer, and an output layer connected in sequence, the adaptive hybrid spatiotemporal learning layer includes a plurality of adaptive hybrid spatiotemporal learning components with jump connections, each adaptive hybrid spatiotemporal learning component includes a temporal convolution module, an adaptive hybrid graph learning module, and a spatiotemporal adaptation module, wherein the adaptive hybrid graph learning module includes a static adaptive graph learning submodule, a dynamic graph learning submodule based on a graph attention mechanism, and a spatial gate fusion mechanism submodule; The S3 includes the following sub-steps: S31. Model the key traffic characteristics of the current state at the millisecond, second, and minute levels; S32, inputting the modeling result into the time convolution module to obtain the final output of the time convolution module; S33, inputting the modeling result into the adaptive hybrid graph learning module to obtain the output of the adaptive hybrid graph learning module; S34, inputting the output of the multi-layer temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module, obtaining the output of the spatiotemporal adaptation module, and using it as the output of the adaptive hybrid spatiotemporal learning component; S35. Obtain the output of the adaptive hybrid spatiotemporal learning layer according to the outputs of all adaptive hybrid spatiotemporal learning components; S36, inputting the output of the adaptive hybrid spatiotemporal learning layer into the input layer, and outputting the DDoS attack traffic prediction value through the output layer; In S31, the current state of the flow characteristics G The graph data is represented as ; in, is the set of switches whose traffic characteristics change over time, and , N is the number of switches, E is the set of links between switches, is the adjacency matrix of the graph, X For a given historical time step The graph signal matrix of , submatrix , To identify the observed value of the i-th switch at time slice t, is a matrix, and F is a tensor containing the feature dimensions of all nodes; In S4, the reward mechanism The specific expression is: Where, A state determined based on historical data s The average good traffic in The next state determined based on historical data The average good traffic in A term that provides additional incentives for less explored defensive actions.

2. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 1 is characterized in that: In S2, the method for extracting the key traffic features of the current state by the Honey Badger optimization algorithm includes the following steps: S21. Set the position of the honey badger within the search space using the following formula: Where, for The location of the honey badger, and are the lower and upper bounds of the search domain, is the first random number; S22. Calculate the intensity of the influence on movement dynamics based on the distance between the honey badger and the prey ; Where, is the second random number, is the density coefficient, and its specific expression is: Where, is the maximum number of iterations, is the current iteration number; S23. Update the honey badger according to its strength and the position of the honey badger after the update ; Where, The location of the honey badger before the update. is a random factor, and , is the third random number, is the fourth random number, is the fifth random number, and , It is the sign of the search direction, and its specific expression is: Where, is the sixth random number; S24, using the updated honey badger to track the bees and guide the bird to the beehive, updating the honey badger position to obtain the final honey badger position, wherein the honey badger tracking the bees and guiding the bird to the beehive is simulated by the following formula; Where, is the seventh random number, F is a tensor containing the feature dimensions of all nodes; S25. Determine the key traffic characteristics of the current state according to the final honey badger position output.

3. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 1 is characterized in that: The S32 includes the following sub-steps: S321, sequentially inputting the modeling results into a number of temporal convolution modules with skip connections to obtain the first to third temporal feature elements finally calculated; The expressions of the first to third time characteristic elements finally calculated are specifically as follows: Where, is the first time characteristic element finally calculated, For the l -1 calculated first time feature element, is the second time characteristic element finally calculated, For the l -1 calculated second time characteristic element, is the third time characteristic element finally calculated, For the l -1 calculated third time characteristic element, is the convolution operator, is the element-wise product, is the learning parameter, tanh is the hyperbolic tangent activation function, The first to third time feature elements calculated for the lth time are generated based on the key traffic features of the current state at the millisecond, second, and minute levels. S322: Connect the first to third time feature elements finally calculated into a vector to obtain the final output of the time convolution module; Among them, the output of the temporal convolution module The specific expression is: Where, is a multi-layer perceptron.

4. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 3 is characterized in that: The S33 includes the following sub-steps: S331: Input the modeling results into the static adaptive graph learning submodule for graph convolution operation to obtain the output of adaptive graph learning. ; Where, is a self-connected unitary matrix, is the adaptive adjacency matrix, is the graph convolution kernel, is the output of the multi-dimensional graph convolutional neural network, and its specific expression is: Where, is the augmented adjacency matrix, is the feature matrix of the modeling results; S332, inputting the modeling result into the dynamic graph learning submodule based on the graph attention mechanism to obtain the dynamic graph learning result; S333: Input the output of adaptive graph learning and the result of dynamic graph learning into the spatial gate fusion mechanism submodule to obtain the output of the adaptive hybrid graph learning module. ; Where, is the result of dynamic graph learning, are all learnable parameters.

5. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 4 is characterized in that: The S34 includes the following sub-steps: S341, inputting the output of the temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module to obtain the key vectors of the nodes in the temporal and spatial dimensions; Where, are all learnable transformation matrices, is the key vector of the node in the time dimension, is the key vector of the node in the spatial dimension; S342, calculating the time and space dimension attention of the graph node through the key vector of the node in the time and space dimensions; Where, is the time dimension attention, is the spatial dimension attention, D is the degree normalized matrix, Q is the query vector, and , is a learnable transformation matrix; S343, calculating the attention score of the node in the time and space dimensions according to the time and space dimension attention of the graph node; Where, is the attention score in the time dimension, is the attention score in the spatial dimension, Score for overall attention; S344. Calculate the output of the spatiotemporal adaptation module based on the attention score of the node in the time and space dimensions ; 。 6. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 5 is characterized in that: In the S35, the output of the adaptive hybrid spatiotemporal learning component is obtained. The specific expression is: Where, L is the total number of adaptive hybrid spatiotemporal learning components; In S36, the DDoS attack traffic prediction value is calculated. The specific expression is: Where, 、 、 are all weight matrices, 、 、 are bias vectors, It is a fully connected layer operation.

Images