DDoS attack identification method and system based on multi-modal fusion analysis

Abstract

The invention belongs to the technical field of network security, and discloses a DDoS attack identification method and system based on multi-modal fusion analysis. The method comprises the following steps: constructing a Hfish honeypot chain network, a multi-modal fusion model, a DDoS attack recognition model and a defense strategy generation model based on a cloud data center; the method comprises the following steps: acquiring real-time multi-modal data based on a Hfish honeypot chain network, and performing multi-modal fusion on the real-time multi-modal data by using a multi-modal fusion model to obtain real-time multi-modal fusion features; using a DDoS attack recognition model to perform DDoS attack recognition on the real-time multi-modal fusion feature to obtain a real-time recognition result; and performing defense strategy generation on the real-time identification result by using a defense strategy generation model to obtain a real-time DDoS attack defense strategy. According to the invention, the problems of insufficient identification accuracy and insufficient real-time performance of a defense strategy in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a DDoS attack identification method and system based on multimodal fusion analysis. Background Art

[0002] With the popularization of the Internet, more and more individuals and enterprises rely on network services, which provides a wide range of targets for Distributed Denial of Service (DDoS) attacks. DDoS attacks are a type of network attack that aims to overload the target server or network resources so that it cannot provide services to legitimate users. Attackers infect a large number of computers, build botnets, and use these controlled computers to launch large-scale coordinated attacks. With the development of DDoS attack technology, its methods are becoming increasingly complex, and the frequency and scale of attacks are also growing. Therefore, identifying and defending against DDoS attacks has become an important topic in the field of network security.

[0003] Existing DDoS attack identification technologies have the following defects: 1) Insufficient identification accuracy: Existing technologies often rely on a single data source or feature to identify DDoS attacks, which may lead to high false positive and false negative rates, and may not be able to effectively distinguish between normal traffic and malicious traffic, especially when faced with complex and changing attack methods; 2) Lack of real-time performance of defense strategies: After detecting an attack, the existing defense system has a long response time and is unable to block the attack in time, resulting in impaired service availability. In addition, the update of defense strategies often relies on manual intervention and lacks automated real-time adjustment capabilities. Summary of the invention

[0004] In order to solve the problems of insufficient recognition accuracy and insufficient real-time performance of defense strategies in the prior art, the present invention aims to provide a DDoS attack recognition method and system based on multimodal fusion analysis.

[0005] The technical solution adopted by the present invention is: A DDoS attack identification method based on multimodal fusion analysis includes the following steps: Based on the cloud data center, we built the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model, and defense strategy generation model; Based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features; Use the DDoS attack recognition model to identify DDoS attacks using real-time multimodal fusion features and obtain real-time recognition results; The defense strategy generation model is used to generate defense strategies for real-time identification results to obtain real-time DDoS attack defense strategies.

[0006] Furthermore, based on the cloud data center, the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model and defense strategy generation model are constructed, including the following steps: Based on the cloud data center, build several Hfish honeypots, set up the Hfish management module, and build the Hfish honeypot chain network based on the Hfish management module and several Hfish honeypots; Collect some historical multimodal data, and use feature fusion algorithm to build a multimodal fusion model based on some historical multimodal data, and generate some historical multimodal fusion features; Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results; Collecting some historical DDoS defense information and some historical DDoS defense decisions of the cloud data center under different historical identification results; According to some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated.

[0007] Furthermore, based on the cloud data center, several Hfish honeypots are constructed, an Hfish management module is set, and an Hfish honeypot chain network is constructed according to the Hfish management module and the several Hfish honeypots, including the following steps: Based on the cloud data center, basic information of several applications is collected, and corresponding Hfish honeypot elements are generated according to the basic information; According to the Hfish honeypot elements, build the corresponding Hfish honeypot at the application, and set the flow probe in the Hfish honeypot; Set up the Hfish management module and connect all Hfish honeypots to the Hfish management module to obtain the Hfish honeypot chain network.

[0008] Furthermore, the multimodal fusion model is constructed based on the CNN-LSTM-MLP algorithm; The DDoS attack identification model is built based on the RF algorithm; The defense strategy generation model is built based on the DQN algorithm.

[0009] Furthermore, based on several historical multimodal fusion features, a deep learning algorithm is used to construct a DDoS attack recognition model and generate several historical recognition results, including the following steps: According to the data structure of historical multimodal fusion features and historical recognition results, a second input layer and a second output layer are constructed; Use the RF algorithm to build an attack identification module, and combine the second input layer and the second output layer to build an initial DDoS attack identification model; Using the initial DDoS attack identification model, several feature key scores of the historical multimodal fusion features are generated, and according to the several feature key scores, several corresponding historical key features are extracted; Based on several historical key features and using several historical multimodal fusion features, the initial DDoS attack recognition model is optimized and trained to obtain the final DDoS attack recognition model and generate several historical recognition results.

[0010] Furthermore, according to some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated, including the following steps: The defense strategy generation problem is used as the simulation environment of the DQN algorithm, and the intelligent agent and experience replay pool of the defense strategy generation model are set up; Based on several historical DDoS defense information of the same historical recognition result, the state space of the DQN algorithm is defined, and based on several corresponding historical DDoS defense decisions, the action space of the DQN algorithm is defined; Based on the state space and action space, a deep Q network of the defense strategy generation model is constructed, and a reward function is constructed based on the impact of historical DDoS defense decisions on historical DDoS defense information; The initial defense strategy generation model is constructed based on the reward function, intelligent agent, deep Q network and experience replay pool; Traverse all historical DDoS defense information and historical DDoS defense decisions of all historical recognition results, perform optimization training, and obtain the final defense strategy generation model; Several historical defense strategy generation experiences generated by each optimization training are stored in the experience replay pool of the final defense strategy generation model.

[0011] Furthermore, based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features, including the following steps: Use the Hfish honeypot in the Hfish honeypot chain network to collect real-time multimodal data and send it to the Hfish management module; Use the Hfish management module in the Hfish honeypot chain network to send real-time multimodal data to the multimodal fusion model; Use multimodal fusion models to extract real-time unstructured features and real-time structured features of real-time multimodal data; The real-time unstructured features and the real-time structured features are multimodally fused to obtain real-time multimodal fusion features.

[0012] Furthermore, the DDoS attack identification model is used to identify the DDoS attack using the real-time multimodal fusion features to obtain the real-time identification results, including the following steps: Input the real-time multimodal fusion features into the DDoS attack identification model; According to several key feature scores of the DDoS attack identification model, several real-time key features of the real-time multimodal fusion features are extracted; Based on several real-time key features, DDoS attack identification is performed to obtain real-time identification results.

[0013] Furthermore, a defense strategy generation model is used to generate a defense strategy for the real-time identification result to obtain a real-time DDoS attack defense strategy, including the following steps: If the real-time identification result is that there is a DDoS attack, then according to the real-time identification result, several matching historical defense strategies are extracted from the experience replay pool to generate experience. Otherwise, the DDoS attack identification is terminated. Analyze the experience of generating several matching historical defense strategies, obtain several real-time DDoS defense decisions, and extract real-time DDoS defense information; According to the real-time DDoS defense information, the state space of the defense strategy generation model is updated to obtain an updated state space; According to a number of real-time DDoS defense decisions, the action space of the defense strategy generation model is updated to obtain an updated action space; Based on the updated state space, use the reward function to obtain the real-time reward value of possible actions in the updated action space; According to the real-time reward value, use the agent to update the Q value of all possible actions of the deep Q network in the updated action space to obtain the updated Q value of the possible action; Repeat the above Q-value update steps until the number of iterations reaches the iteration threshold, and use the greedy strategy to take the possible action with the highest updated Q-value as the execution action; According to the execution action, a real-time DDoS attack defense strategy is obtained, and the generated real-time defense strategy generation experience is stored in the experience replay pool of the defense strategy generation model.

[0014] A DDoS attack identification system based on multimodal fusion analysis is used to implement a DDoS attack identification method. The system is deployed in a cloud data center, and the system includes a model building unit, a multimodal fusion unit, a DDoS attack identification unit, and a DDoS attack defense unit connected in sequence.

[0015] The beneficial effects of the present invention are: The present invention discloses a DDoS attack identification method and system based on multimodal fusion analysis. The multimodal data is feature-fused through a multimodal fusion model, and the DDoS attack identification model is used to perform automatic, intelligent and efficient DDoS attack identification, thereby improving the accuracy and robustness of DDoS attack identification, reducing the false alarm rate and the missed alarm rate, and accurately distinguishing normal traffic from malicious traffic when facing complex and changeable attack means, thereby improving the reliability of DDoS attack identification; by constructing an attack trapping Hfish honeypot network, using active defense technology, actively exposing some loopholes, and setting some baits to lure attackers to attack, the attack behavior can be captured and analyzed, thereby improving the effectiveness of security defense means, and improving the security protection level and security; by using a defense strategy generation model to generate and adjust the DDoS defense strategy in real time, the real-time performance, response speed and adaptability of the defense system are greatly improved, the attack can be blocked in time, and the service availability is avoided from being damaged; the defense strategy generation model can be automatically adjusted according to changes in the network environment and the attack mode, thereby improving the flexibility and effectiveness of the defense strategy, and realizing the real-time adjustment and update of the defense strategy.

[0016] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flowchart of the DDoS attack identification method based on multimodal fusion analysis in the present invention.

[0018] Figure 2 It is a structural block diagram of the DDoS attack identification system based on multimodal fusion analysis in the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

[0020] Embodiment 1: like Figure 1 As shown, this embodiment provides a DDoS attack identification method based on multimodal fusion analysis, comprising the following steps: S1: Based on the cloud data center, build the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model and defense strategy generation model, including the following steps: S1-1: Based on the cloud data center, build several Hfish honeypots, set up the Hfish management module, and build the Hfish honeypot chain network based on the Hfish management module and several Hfish honeypots, including the following steps: S1-1-1: Based on the cloud data center, collect the basic information of several applications, and generate the corresponding Hfish honeypot elements according to the basic information; S1-1-2: According to the Hfish honeypot elements, build the corresponding Hfish honeypot at the application and set the traffic probe in the Hfish honeypot; S1-1-3: Set up the Hfish management module and connect all Hfish honeypots to the Hfish management module to obtain the Hfish honeypot chain network; S1-2: Collect some historical multimodal data, and use feature fusion algorithm to build a multimodal fusion model based on some historical multimodal data, and generate some historical multimodal fusion features, including the following steps: S1-2-1: Collect a number of historical multimodal data, and preprocess and add labels to the number of historical multimodal data to obtain a number of preprocessed historical multimodal data with real labels; Historical multimodal data includes historical access traffic data, historical access behavior data, and multimodal historical transmission data; Access traffic data usually includes statistical information such as the source IP address of the request, the number of requests, the size of the data packet, the access frequency, and the access time; access behavior data usually includes user behavior data (such as clicks, browsing, searching, and other behaviors, as well as timestamps related to these behaviors), page content (text or images), or other user interaction data; transmission data refers to the data content actually transmitted in the network, usually including text, images, videos, audio, and other data; the above multimodal data can be divided into structured data and unstructured data; S1-2-2: Divide a number of pre-processed historical multimodal data into a model training set and a model test set, and use the feature fusion algorithm to build an initial multimodal fusion model; The multimodal fusion model is constructed based on the CNN-LSTM-MLP algorithm, and the multimodal fusion model includes a first input layer, an unstructured feature extraction module constructed based on a convolutional neural network (CNN) algorithm, a structured feature extraction module constructed based on a long short-term memory network (LSTM) algorithm, a feature fusion module constructed based on a multilayer perceptron (MLP) algorithm, and a first output layer. The first input layer is connected to the unstructured feature extraction module and the structured feature extraction module respectively, and the unstructured feature extraction module and the structured feature extraction module are both connected to the feature fusion module, and the feature fusion module is connected to the first output layer; CNN network performs well in processing unstructured data such as images, videos, audio and text. For image data, it can capture spatial hierarchical structures such as edges, textures and shapes. For text data, one-dimensional CNN or text convolutional neural network can be used to extract local features. LSTM network is suitable for processing and predicting time dependencies in sequence data, and can extract features related to structured data time series through deep features, which meets the requirements that traffic data (such as network traffic, traffic flow, etc.) usually changes over time and has obvious time series characteristics. MLP network is used to fuse structured features and unstructured features, and output multimodal fusion features; by integrating information from different modes, the model's understanding ability, accuracy and robustness can be improved; S1-2-3: Input the model training set into the initial multimodal fusion model, perform optimization training, and obtain an optimized multimodal fusion model; S1-2-4: Input the model test set into the optimized multimodal fusion model, perform model testing, and obtain the model accuracy; S1-2-5: If the model accuracy is greater than the preset accuracy threshold, the final multimodal fusion model is output and several historical multimodal fusion features are generated; otherwise, optimization training continues; S1-3: Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results, including the following steps: S1-3-1: Construct the second input layer and the second output layer according to the data structure of historical multimodal fusion features and historical recognition results; S1-3-2: Use the RF algorithm to build an attack identification module, and combine the second input layer and the second output layer to build an initial DDoS attack identification model; The DDoS attack identification model is constructed based on a Random Forest (RF) algorithm, and the DDoS attack identification model includes a second input layer, an attack identification module, and a second output layer connected in sequence; Multimodal fusion features are high-dimensional features. The RF structure provides a score for feature importance, which can help screen out the most important features for prediction tasks and reduce the complexity of the model and the risk of overfitting. S1-3-3: Using the initial DDoS attack identification model, generate several feature key scores of the historical multimodal fusion features, and extract several corresponding historical key features according to the several feature key scores, including the following steps: S1-3-3-1: Use the RF structure of the initial DDoS attack recognition model to extract the feature contribution of M candidate features of the historical multimodal fusion features; The formula is:

[0021] In the formula, For the Feature contribution of candidate features; For the The candidate features are in the random forest The feature contribution of each tree; is the CART tree indicator; is an alternative characteristic indicator; is the total number of CARTs;

[0022] In the formula, CART tree node for random forest m ,node and nodes The Gini index of CART tree node m Medium Category The proportion of is the total number of categories; m , , is the node indicator; is the category indicator; S1-3-3-2: normalize the feature contributions of the M candidate features to obtain a number of corresponding normalized feature contributions; The formula is:

[0023] In the formula, It is the contribution of the feature after normalization; Jis the total number of candidate features; S1-3-3-3: Generate feature selection standard values ​​for several candidate features based on the normalized feature contribution; The formula is:

[0024] In the formula, For the Feature selection criterion values ​​for candidate features; For the The normalized feature contribution of the candidate features; is an alternative characteristic indicator; S1-3-3-4: According to the feature selection standard value as the feature key score, the candidate features are sorted in descending order, and the first M candidate features are selected as historical key features to obtain M historical key features; S1-3-4: Based on several historical key features, several historical multimodal fusion features are used to optimize and train the initial DDoS attack recognition model, obtain the final DDoS attack recognition model, and generate several historical recognition results, including the following steps: S1-3-4-1: Based on several historical key features, each historical multimodal fusion feature is reduced in dimension to obtain a historical key feature sequence of each historical multimodal fusion feature; S1-3-4-2: According to the historical key feature sequence, the attack identification module of the initial DDoS attack identification model is optimized and trained to obtain an optimized attack identification module; S1-3-4-3: Based on the optimized attack identification module, attack identification is performed according to the historical key feature sequence to generate the corresponding historical identification results; The identification results include whether there is a DDoS attack and the type of DDoS attack (including volumetric attack, protocol attack, and application layer attack, etc.); S1-3-4-4: Traverse all historical multimodal fusion features and obtain the final DDoS attack recognition model based on the trained attack recognition module; S1-4: Collect some historical DDoS defense information and some historical DDoS defense decisions of the cloud data center under different historical identification results; DDoS defense information includes network traffic statistics (such as traffic size, traffic pattern, abnormal traffic detection, etc.), server or network device load, known attack types and attack characteristics, the status of currently activated defense measures (such as traffic cleaning rules, IP blocking lists, etc.), network service availability and performance indicators, etc.; DDoS defense decisions include enabling or adjusting traffic cleaning rules, blocking or unblocking specific IP addresses or address segments, adjusting network routing policies to mitigate the impact of attacks, increasing server resources to cope with traffic peaks, and starting or stopping specific defense scripts or programs. S1-5: Based on some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated, including the following steps: S1-5-1: Use the defense strategy generation problem as a simulation environment for the Deep Q Network (DQN) algorithm, and set up the intelligent agent and experience replay pool of the defense strategy generation model; The defense strategy generation model is built based on the DQN algorithm, and the defense strategy generation model is equipped with an intelligent agent, a deep Q network, and an experience replay pool; The agent is the entity that interacts with the model and the environment. It is used to select actions based on the current state and observe the state and reward after the action. The strategy of the agent is determined by learning the Q function. The deep Q network is used to approximate the Q function. The Q function is used to take the expected return of a specific action in a given state. The experience replay pool is used to store the historical experience of the interaction between the model and the environment. S1-5-2: Define the state space of the DQN algorithm based on several historical DDoS defense information of the same historical recognition result, and define the action space of the DQN algorithm based on several corresponding historical DDoS defense decisions; S1-5-3: Based on the state space and action space, a deep Q network of the defense strategy generation model is constructed, and a reward function is constructed based on the impact of historical DDoS defense decisions on historical DDoS defense information; S1-5-4: The initial defense strategy generation model is constructed based on the reward function, intelligent agent, deep Q network and experience replay pool; S1-5-5: Traverse all historical recognition results of several historical DDoS defense information and several historical DDoS defense decisions, perform optimization training, and obtain the final defense strategy generation model; S1-5-6: Store several historical defense strategy generation experiences generated by each optimization training into the experience replay pool of the final defense strategy generation model; S2: Based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features, including the following steps: S2-1: Use the Hfish honeypot in the Hfish honeypot chain network to collect real-time access traffic data and real-time access behavior data, combine multi-modal real-time transmission data, obtain real-time multi-modal data, and send it to the Hfish management module; S2-2: Use the Hfish management module in the Hfish honeypot chain network to send real-time multimodal data to the first input layer of the multimodal fusion model; S2-3: Use the unstructured feature extraction module of the multimodal fusion model to extract real-time unstructured features of real-time multimodal data, and use the structured feature extraction module of the multimodal fusion model to extract real-time structured features of real-time multimodal data; S2-5: Use the feature fusion module to perform multimodal fusion on the real-time unstructured features and the real-time structured features, and use the first output layer to output the corresponding real-time multimodal fusion features; S3: Use the DDoS attack identification model to identify DDoS attacks based on real-time multimodal fusion features to obtain real-time identification results, including the following steps: S3-1: Input the real-time multimodal fusion features into the second input layer of the DDoS attack identification model; S3-2: Extracting several real-time key features of real-time multimodal fusion features according to several key feature scores of the DDoS attack identification model; S3-3: Based on several real-time key features, use the attack identification module to identify DDoS attacks and obtain real-time identification results; S4: Use the defense strategy generation model to generate a defense strategy for the real-time identification results to obtain a real-time DDoS attack defense strategy, including the following steps: S4-1: If the real-time identification result is that there is a DDoS attack, the attack source tracing module of the firewall device is called to analyze the transmission path and jump nodes of the attack traffic according to the source IP in the real-time access traffic data, and add the corresponding attack source to the blacklist to prohibit the next access. According to the real-time identification result, several matching historical defense strategies are extracted from the experience playback pool to generate experience. Otherwise, the DDoS attack identification is terminated. S4-2: Analyze several matching historical defense strategy generation experiences, obtain several real-time DDoS defense decisions, and extract real-time DDoS defense information; S4-3: Update the state space of the defense strategy generation model based on real-time DDoS defense information to obtain an updated state space ,in, For the updated Status value, is the state indicator, is the total number of state space dimensions; S4-4: Update the action space of the defense strategy generation model based on several real-time DDoS defense decisions to obtain an updated action space ,in, For the updated Action value, is the action indicator, is the total number of action space dimensions; S4-5: Based on the updated state space, use the reward function to obtain the real-time reward value of the possible actions in the updated action space; S4-6: Based on the real-time reward value, use the agent to update the Q values ​​of all possible actions of the deep Q network in the updated action space to obtain the updated Q values ​​of the possible actions; The formula is:

[0025] In the formula, In the updated state Next update action The corresponding updated Q value; For the status Next action The corresponding Q value of the possible action; is the learning rate; is the Q value of the highest possible action; To update the parameters; To use the updated action The status Adjust to the updated status Real-time reward value; S4-7: Repeat the above Q value update steps until the number of iterations reaches the iteration number threshold, and use the greedy strategy to take the possible action with the highest updated Q value as the execution action; S4-8: According to the execution action, a real-time DDoS attack defense strategy is obtained, and the generated real-time defense strategy generation experience is stored in the experience replay pool of the defense strategy generation model.

[0026] Embodiment 2: like Figure 2 As shown, this embodiment provides a DDoS attack identification system based on multimodal fusion analysis, which is used to implement a DDoS attack identification method. The system is deployed in a cloud data center, and the system includes a model building unit, a multimodal fusion unit, a DDoS attack identification unit, and a DDoS attack defense unit connected in sequence.

[0027] Model building unit, used to build Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model and defense strategy generation model based on cloud data center; The multimodal fusion unit is used to collect real-time multimodal data based on the Hfish honeypot chain network, and use the multimodal fusion model to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features; A DDoS attack identification unit, used to use a DDoS attack identification model to perform DDoS attack identification on real-time multimodal fusion features to obtain real-time identification results; The DDoS attack defense unit is used to generate a defense strategy based on the real-time identification result using a defense strategy generation model to obtain a real-time DDoS attack defense strategy.

[0028] The present invention discloses a DDoS attack identification method and system based on multimodal fusion analysis. The multimodal data is feature-fused through a multimodal fusion model, and the DDoS attack identification model is used to perform automatic, intelligent and efficient DDoS attack identification, thereby improving the accuracy and robustness of DDoS attack identification, reducing the false alarm rate and the missed alarm rate, and accurately distinguishing normal traffic from malicious traffic when facing complex and changeable attack means, thereby improving the reliability of DDoS attack identification; by constructing an attack trapping Hfish honeypot network, using active defense technology, actively exposing some loopholes, and setting some baits to lure attackers to attack, the attack behavior can be captured and analyzed, thereby improving the effectiveness of security defense means, and improving the security protection level and security; by using a defense strategy generation model to generate and adjust the DDoS defense strategy in real time, the real-time performance, response speed and adaptability of the defense system are greatly improved, the attack can be blocked in time, and the service availability is avoided from being damaged; the defense strategy generation model can be automatically adjusted according to changes in the network environment and the attack mode, thereby improving the flexibility and effectiveness of the defense strategy, and realizing the real-time adjustment and update of the defense strategy.

[0029] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A DDoS attack identification method based on multimodal fusion analysis, characterized by: The steps include: Based on the cloud data center, we built the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model, and defense strategy generation model; Based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features; Use the DDoS attack recognition model to identify DDoS attacks using real-time multimodal fusion features and obtain real-time recognition results; The defense strategy generation model is used to generate defense strategies for real-time identification results to obtain real-time DDoS attack defense strategies.

2. The DDoS attack identification method based on multimodal fusion analysis according to claim 1 is characterized by: Based on the cloud data center, the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model and defense strategy generation model are constructed, including the following steps: Based on the cloud data center, build several Hfish honeypots, set up the Hfish management module, and build the Hfish honeypot chain network based on the Hfish management module and several Hfish honeypots; Collect some historical multimodal data, and use feature fusion algorithm to build a multimodal fusion model based on some historical multimodal data, and generate some historical multimodal fusion features; Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results; Collecting some historical DDoS defense information and some historical DDoS defense decisions of the cloud data center under different historical identification results; According to some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated.

3. The DDoS attack identification method based on multimodal fusion analysis according to claim 2 is characterized by: Based on the cloud data center, several Hfish honeypots are constructed, the Hfish management module is set up, and the Hfish honeypot chain network is constructed according to the Hfish management module and several Hfish honeypots, including the following steps: Based on the cloud data center, basic information of several applications is collected, and corresponding Hfish honeypot elements are generated according to the basic information; According to the Hfish honeypot elements, build the corresponding Hfish honeypot at the application, and set the flow probe in the Hfish honeypot; Set up the Hfish management module and connect all Hfish honeypots to the Hfish management module to obtain the Hfish honeypot chain network.

4. The DDoS attack identification method based on multimodal fusion analysis according to claim 3 is characterized by: The multimodal fusion model is constructed based on the CNN-LSTM-MLP algorithm; The DDoS attack identification model is constructed based on the RF algorithm; The defense strategy generation model is constructed based on the DQN algorithm.

5. The DDoS attack identification method based on multimodal fusion analysis according to claim 4 is characterized by: Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results, including the following steps: According to the data structure of historical multimodal fusion features and historical recognition results, a second input layer and a second output layer are constructed; Use the RF algorithm to build an attack identification module, and combine the second input layer and the second output layer to build an initial DDoS attack identification model; Using the initial DDoS attack identification model, several feature key scores of the historical multimodal fusion features are generated, and according to the several feature key scores, several corresponding historical key features are extracted; Based on several historical key features and using several historical multimodal fusion features, the initial DDoS attack recognition model is optimized and trained to obtain the final DDoS attack recognition model and generate several historical recognition results.

6. The DDoS attack identification method based on multimodal fusion analysis according to claim 4 is characterized by: Based on some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated, including the following steps: The defense strategy generation problem is used as the simulation environment of the DQN algorithm, and the intelligent agent and experience replay pool of the defense strategy generation model are set up; Based on several historical DDoS defense information of the same historical recognition result, the state space of the DQN algorithm is defined, and based on several corresponding historical DDoS defense decisions, the action space of the DQN algorithm is defined; Based on the state space and action space, a deep Q network of the defense strategy generation model is constructed, and a reward function is constructed based on the impact of historical DDoS defense decisions on historical DDoS defense information; The initial defense strategy generation model is constructed based on the reward function, intelligent agent, deep Q network and experience replay pool; Traverse all historical DDoS defense information and historical DDoS defense decisions of all historical recognition results, perform optimization training, and obtain the final defense strategy generation model; Several historical defense strategy generation experiences generated by each optimization training are stored in the experience replay pool of the final defense strategy generation model.

7. The DDoS attack identification method based on multimodal fusion analysis according to claim 4 is characterized by: Based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features, including the following steps: Use the Hfish honeypot in the Hfish honeypot chain network to collect real-time multimodal data and send it to the Hfish management module; Use the Hfish management module in the Hfish honeypot chain network to send real-time multimodal data to the multimodal fusion model; Use multimodal fusion models to extract real-time unstructured features and real-time structured features of real-time multimodal data; The real-time unstructured features and the real-time structured features are multimodally fused to obtain real-time multimodal fusion features.

8. The DDoS attack identification method based on multimodal fusion analysis according to claim 4 is characterized by: Using the DDoS attack identification model, real-time multimodal fusion features are used to identify DDoS attacks and obtain real-time identification results, including the following steps: Input the real-time multimodal fusion features into the DDoS attack identification model; According to several key feature scores of the DDoS attack identification model, several real-time key features of the real-time multimodal fusion features are extracted; Based on several real-time key features, DDoS attack identification is performed to obtain real-time identification results.

9. The DDoS attack identification method based on multimodal fusion analysis according to claim 6 is characterized by: Using the defense strategy generation model, a defense strategy is generated for the real-time identification results to obtain a real-time DDoS attack defense strategy, including the following steps: If the real-time identification result is that there is a DDoS attack, then according to the real-time identification result, several matching historical defense strategies are extracted from the experience replay pool to generate experience. Otherwise, the DDoS attack identification is terminated. Analyze the experience of generating several matching historical defense strategies, obtain several real-time DDoS defense decisions, and extract real-time DDoS defense information; According to the real-time DDoS defense information, the state space of the defense strategy generation model is updated to obtain an updated state space; According to a number of real-time DDoS defense decisions, the action space of the defense strategy generation model is updated to obtain an updated action space; Based on the updated state space, use the reward function to obtain the real-time reward value of possible actions in the updated action space; According to the real-time reward value, use the agent to update the Q value of all possible actions of the deep Q network in the updated action space to obtain the updated Q value of the possible action; Repeat the above Q-value update steps until the number of iterations reaches the iteration threshold, and use the greedy strategy to take the possible action with the highest updated Q-value as the execution action; According to the execution action, a real-time DDoS attack defense strategy is obtained, and the generated real-time defense strategy generation experience is stored in the experience replay pool of the defense strategy generation model.

10. A DDoS attack identification system based on multimodal fusion analysis, used to implement the DDoS attack identification method according to any one of claims 1 to 9, characterized in that: The system is deployed in a cloud data center, and the system includes a model building unit, a multimodal fusion unit, a DDoS attack identification unit and a DDoS attack defense unit which are connected in sequence.

Images