LDoS attack detection method based on MF-LSTM in SDN environment

Abstract

The invention discloses an LDoS attack detection method based on an MF-LSTM in an SDN environment, and belongs to the field of network security. Normal and LDoS attack traffic data are generated in the SDN environment through a D-ITG network traffic generator and a Python script, real-time sampling is performed by using a Ryu controller, and a training and test data set is formed; original traffic data is cut into a plurality of time slices, and each slice is further subdivided into data slices for feature calculation; extracting 11 key features to construct a feature matrix for describing a network state; training an LSTM model by using the feature matrix, and optimizing model performance by using ReLU as an activation function and cross entropy as a loss function; and deploying the trained model in a Ryu controller, monitoring network traffic in real time, and carrying out LDoS attack detection. According to the method, the centralized control advantage of the SDN and the time sequence data processing capability of the LSTM network are fully utilized, and the efficient and accurate detection of the LDoS attack is realized by comprehensively analyzing the multi-dimensional characteristics of the network flow.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an LDoS attack detection method based on MF-LSTM in an SDN environment. Background Art

[0002] The current society is in an era of rapid digital development. Network technology is constantly improving, and network applications are becoming increasingly popular, bringing great convenience to people's lives. At the same time, due to the openness, complexity, and fragility of the network itself, the network is extremely vulnerable to attacks. As the forms and means of network attacks become increasingly diverse and complex, network security issues have become the focus of social attention. Network attacks will not only have a negative impact on users' daily use, but also cause huge economic losses to society.

[0003] The tight coupling between the control plane and the data plane in traditional networks, embedding them in the same network device, leads to a very complex architecture and is unable to cope well with dynamic changes. Software Defined Network (SDN) is a milestone technology that completely subverts the traditional vertical integration model, isolates the control and data of network devices, and converts complex functions into program interfaces that can be called by the application layer, greatly enhancing the flexibility of the network and building a completely open and programmable network environment that allows users to access and manage more easily. By virtualizing the underlying network resources, network resources can be effectively integrated logically to achieve unified centralized management and control. SDN technology can effectively improve the control efficiency of network devices. It can transfer control from traditional embedded control systems to central control nodes, and can use software-driven technology to achieve more flexible and automated network management and business configuration.

[0004] As a new variant of DoS attack, low-rate denial of service (LDoS) attack does not need to maintain a high-rate attack flow compared to traditional DoS attack. The attacking end remains silent for most of the time, so the average traffic of LDoS attack is very low and almost indistinguishable from the traffic of legitimate users. The characteristic of LDoS attack is that it is highly concealed, which can make the victim host suffer from attack for a long time without being noticed. Its destructiveness is even greater than that of Flood DDoS attack. LDoS attack mainly attacks the loopholes of various adaptive mechanisms in the network, causing the network to constantly switch between stable and unstable states, seriously reducing the performance of the network. Therefore, its attack efficiency is higher and its destructiveness is stronger.

[0005] Traditional LDoS attack detection technologies face some challenges, including the cumbersome feature extraction process, high computational costs, and limitations of the experimental environment, which limit their effectiveness in dealing with complex and changing situations in today's network environment. Traditional network monitoring systems often lack real-time performance and are unable to detect and respond to new attacks in a timely manner, resulting in frequent security incidents. Low-rate denial of service (LDoS) attacks are difficult to distinguish from legitimate traffic due to their high concealment, making it difficult for traditional network security measures to detect and respond to such attacks in a timely manner. Existing technologies are difficult to accurately represent network status, which is crucial for network security. However, existing technologies fail to fully capture subtle changes in network traffic in feature extraction, resulting in an insufficient understanding of network status. This requires us to adopt new technical means to improve the accuracy of identifying LDoS attacks, simplify the operation process, and reduce training and deployment costs. Summary of the invention

[0006] In view of the above-mentioned deficiencies in the prior art, the present invention provides a LDoS attack detection method based on MF-LSTM in an SDN environment.

[0007] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is: A LDoS attack detection method based on MF-LSTM in an SDN environment includes the following steps: S1. Simulate normal network traffic and LDoS attack traffic in the SDN environment, collect and mark the original network traffic data in the SDN environment, and form training data sets and test data sets; S2, cutting the original network traffic to obtain data fragments, using the cut data fragments to calculate the feature matrix, and using the calculated feature matrix to distinguish normal traffic from attack traffic; S3. Use the feature matrix of the training data set to train the LSTM model, using the feature matrix as input and the corresponding label as the classification result of the model; S4. Use the test data set to verify the model effect, and deploy the MF-LSTM model in the SDN controller to collect network traffic data in real time for classification detection.

[0008] Furthermore, in S1, the D-ITG network traffic generator and the Python script are used to generate normal network traffic and LDoS attack traffic in the SDN environment respectively, and the traffic data in the network is sampled in real time at equal time intervals through the Ryu controller to form a training data set and a test data set.

[0009] Furthermore, the S2 specifically includes the following steps: S21, cutting the original network traffic data into multiple time segments according to the set time intervals; S22, using each time segment as a detection window to calculate a feature matrix of the training data set within a unit time; S23. Extract multiple original network traffic data features based on the feature matrix of the training data set to distinguish attack traffic from normal traffic.

[0010] Furthermore, the original network traffic data features in S23 include TCP traffic, UDP traffic, TCP information entropy and UDP information entropy, wherein the TCP information entropy represents the TCP traffic within a detection window, and the UDP information entropy represents the UDP traffic within a detection window.

[0011] Furthermore, the calculation method of TCP information entropy and UDP information entropy in S23 is:

[0012] In the formula, is the TCP information entropy or the UDP information entropy, When the extracted i-th raw network traffic data value is The probability of It is the total amount of raw network traffic data.

[0013] Furthermore, the specific method of distinguishing attack traffic from normal traffic in S23 is: When LDoS attack occurs, the covariance between TCP traffic and UDP traffic increases; When the LDoS attack occurs, the correlation coefficient between TCP traffic and UDP traffic decreases.

[0014] Furthermore, the covariance between the TCP flow and the UDP flow is calculated as follows:

[0015] In the formula, are the i-th TCP flow or UDP flow to each other, , is the mean of the corresponding TCP traffic or UDP traffic, Data length.

[0016] Furthermore, the correlation coefficient between the TCP flow and the UDP flow is calculated as follows:

[0017] In the formula, TCP traffic or UDP traffic. is the mean of the corresponding TCP traffic or UDP traffic, for Standard Deviation Furthermore, when the feature matrix of the training data set is used to train the LSTM model in S3, ReLU is used in the input gate and candidate memory cells of the LSTM instead of the traditional tanh function, which is expressed as:

[0018] In the formula, is the value input to the ReLU activation function.

[0019] The present invention has the following beneficial effects: In the software defined network (SDN) environment, a slow denial of service (LDoS) attack detection method based on a multi-feature long short-term memory network (MF-LSTM) is implemented. By comprehensively analyzing multiple features of network traffic and using the LSTM network's deep learning ability for time series data, the LDoS attack behavior hidden in normal traffic can be accurately identified. It can achieve real-time monitoring and rapid response to network behavior while maintaining high-precision detection performance and reducing the possibility of false positives and false negatives. In addition, with the centralized control advantage of SDN, this method can be flexibly deployed and updated to adapt to the ever-changing network environment and attack methods. Therefore, this detection method can be universally used to accurately detect LDoS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the LDoS attack detection method based on MF-LSTM in the SDN environment of the present invention.

[0021] Figure 2 It is a schematic diagram of the LDoS attack model of an embodiment of the present invention.

[0022] Figure 3 It is a schematic diagram of the chain structure of the LSTM algorithm according to an embodiment of the present invention.

[0023] Figure 4 It is the overall framework of the LDoS attack detection solution based on MF-LSTM in the SDN environment of the embodiment of the present invention. DETAILED DESCRIPTION

[0024] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0025] A LDoS attack detection method based on MF-LSTM in SDN environment, such as Figure 1 As shown, the following steps are included: S1. Simulate normal network traffic and LDoS attack traffic in the SDN environment, collect the original network traffic data in the network, and label it to form training data sets and test data sets; In this embodiment, if Figure 2 As shown, the LDoS attack model consists of three parameters: attack period T, attack burst length t, and attack rate R. Each attack period contains only one attack pulse, and the rest of the time is silent. The duration of the LDoS attack pulse is very short, which makes its average rate very low and has good concealment. In this embodiment, the D-ITG network traffic generator and Python script are used to generate normal network traffic and LDoS attack traffic in the SDN environment, and the traffic data in the network is sampled in real time at equal time intervals through the Ryu controller. The network data traffic sampled within a period of time is recorded to obtain the original traffic data set as the training data set and the test data set.

[0026] S2, cutting the original network traffic data into multiple time segments according to the set time intervals, each time segment becomes a detection window, and forming a feature matrix of the training data set with the detection window as the basic unit for feature calculation; In this embodiment, the original network traffic data of the data set is cut into multiple time segments according to the set time interval, and each time segment becomes a detection window. Therefore, the network traffic is divided into multiple detection windows (DetectionWindow, DW), and each detection window can be evenly divided into several data slices (Data Slice, DS).

[0027] Perform feature calculation on training samples and test samples. Specifically, the unit time can be evenly divided into several segments of appropriate time length, each of which is called a data slice. In the unit time, the feature matrix of the network data in the unit time is obtained by taking the data slice as the feature calculation unit. Based on the analysis of network traffic, multiple network traffic features are extracted to distinguish attack flows from normal traffic, including average packet transmission speed, packet variation coefficient, average packet length, total TCP packets, total UDP packets, TCP information entropy, UDP information entropy, TCP variance, UDP variance, covariance, and correlation coefficient. TCP represents TCP traffic within a detection window, and UDP represents UDP traffic within a detection window.

[0028] The above features are organized into a matrix according to time segments, and the features of each time segment constitute a row of the matrix, thus forming a multi-dimensional feature matrix. The detection window is set to 10 seconds, and the data slice is set to 1 second, which means that each detection window contains 10 consecutive data slices. The dimension of the feature matrix will be 10 rows and 11 columns. The feature matrix will be as follows:

[0029] Among them, x i,j Represents the value of the jth feature of the ith data slice.

[0030] In information theory, the amount of information generated by each terminal is random. So its uncertainty can be measured by probability distribution. Here, x i is the extracted information sequence, P(x i ) (i = 1, 2, ···, m) is when the value of the source is x i The probability of . Then the calculation formula of information entropy can be expressed as:

[0031] In statistics, covariance is used to measure the degree to which each dimension deviates from its mean. When an LDoS attack occurs, the covariance between TCP traffic and UDP traffic will increase, and the calculation formula is expressed as:

[0032] The correlation coefficient is used to study the correlation between variables. When an LDoS attack occurs, the correlation coefficient between TCP traffic and UDP traffic decreases, and the calculation formula is expressed as:

[0033] S3. Use the feature matrix of the training data set to train the LSTM model, using the feature matrix as input and the corresponding label as the classification result of the model; For example, the feature matrix of the training sample is used to train Figure 3 The LSTM model shown in the figure. The input is the feature matrix, which indicates whether an LDoS attack has occurred. "0" indicates normal traffic and "1" indicates an attack. ReLU is used in the input gate and candidate memory cells of LSTM instead of the traditional tanh function to improve the computational efficiency and have better model expression and generalization capabilities.

[0034]

[0035] In the formula, is the value input to the ReLU activation function.

[0036] For the binary classification problem, cross entropy is used as the loss function to update the model. The formula is as follows: is the probability predicted by the model, usually given by the Sigmoid function of the LSTM output layer.

[0037]

[0038] S4. Use the test data set to verify the model effect, and deploy the MF-LSTM model in the SDN controller to collect network traffic data in real time for classification detection.

[0039] The trained LSTM model is used to verify the feature matrix of the test data set, and the detection model is deployed in the Ryu controller. Normal traffic data and LDoS attack detection data are simulated in the SDN environment, and network traffic data is obtained in real time through the controller for classification.

[0040] Figure 4It is the overall framework of the LDoS attack detection solution based on MF-LSTM in the SDN environment, which mainly includes five steps: data collection, data segmentation, data processing, model training and attack detection. An SDN network centered on the Ryu controller is built in the Mininet network simulator to simulate LDoS attack traffic and normal traffic. After data collection, segmentation and processing, a prediction model is established using the LSTM algorithm so that when new traffic arrives, it can be judged in real time whether it is malicious attack traffic. The present invention uses a time series method to analyze changes in network traffic. LSTM can process sequence data, learn long-term dependencies, capture dynamic features in time series, is suitable for network traffic analysis, and helps to identify complex attack patterns. And the method uses multiple features to describe the current network status, more accurately detects LDoS attacks, and the method can be deployed in the Ryu controller to monitor the network status in real time, identify hidden LDoS attacks in the network, and effectively improve the reliability of the network.

[0041] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0042] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0043] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0044] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0045] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A LDoS attack detection method based on MF-LSTM in SDN environment, characterized in that: The steps include: S1. Simulate normal network traffic and LDoS attack traffic in the SDN environment, collect and mark the original network traffic data in the SDN environment, and form training data sets and test data sets; S2, cutting the original network traffic to obtain data fragments, using the cut data fragments to calculate the feature matrix, and using the calculated feature matrix to distinguish normal traffic from attack traffic; S3. Use the feature matrix of the training data set to train the LSTM model, using the feature matrix as input and the corresponding label as the classification result of the model; S4. Use the test data set to verify the model effect, and deploy the MF-LSTM model in the SDN controller to collect network traffic data in real time for classification and detection.

2. According to claim 1, the LDoS attack detection method based on MF-LSTM in SDN environment is characterized in that: In S1, the D-ITG network traffic generator and Python script are used to generate normal network traffic and LDoS attack traffic in the SDN environment respectively, and the traffic data in the network is sampled in real time at equal time intervals through the Ryu controller to form a training data set and a test data set.

3. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 1 is characterized in that: The S2 specifically includes the following steps: S21, cutting the original network traffic data into multiple time segments according to the set time intervals; S22, using each time segment as a detection window to calculate a feature matrix of the training data set per unit time; S23. Extract multiple original network traffic data features based on the feature matrix of the training data set to distinguish attack traffic from normal traffic.

4. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 3 is characterized in that: The original network traffic data features in S23 include average packet transmission speed, packet variation coefficient, average packet length, total number of TCP packets, total number of UDP packets, TCP information entropy, UDP information entropy, TCP variance, UDP variance, covariance, and correlation coefficient, where TCP information entropy represents TCP traffic within a detection window, and UDP information entropy represents UDP traffic within a detection window.

5. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 4 is characterized in that: The calculation method of TCP information entropy and UDP information entropy in S23 is: In the formula, is the TCP information entropy or the UDP information entropy, When the extracted i-th raw network traffic data value is The probability of It is the total amount of raw network traffic data.

6. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 4 is characterized in that: The specific method of distinguishing attack traffic from normal traffic in S23 is: When LDoS attack occurs, the covariance between TCP traffic and UDP traffic increases; When the LDoS attack occurs, the correlation coefficient between TCP traffic and UDP traffic decreases.

7. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 6 is characterized in that: The covariance calculation method is: In the formula, are the i-th TCP flow or UDP flow to each other, , is the mean of the corresponding TCP traffic or UDP traffic, Data length.

8. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 6, characterized in that: The correlation coefficient between the TCP flow and the UDP flow is calculated as follows: In the formula, TCP traffic or UDP traffic. is the mean of the corresponding TCP traffic or UDP traffic, for The standard deviation of .

9. The LDoS attack detection method based on MF-LSTM in SDN environment according to claim 1, characterized in that: When the feature matrix of the training data set is used to train the LSTM model in S3, ReLU is used instead of the traditional tanh function in the input gate and candidate memory cells of the LSTM, which is expressed as: In the formula, is the value input to the ReLU activation function.

Images