Information network attack behavior detection method and system

Abstract

The invention relates to the technical field of information network attack behavior detection, and provides an information network attack behavior detection method and system, and the method comprises the steps: presetting a request permission value for a switch in a network; receiving a control request; after the control request is received, processing the control request based on a condition that a request permission value is greater than a preset threshold value, deducting the request permission value of the switch, and setting a confirmation condition based on a data stream corresponding to the control request; when the confirmation condition is satisfied within a preset time limit, receiving a corresponding confirmation voucher, and increasing a request permission value based on the confirmation voucher; judging whether the switch initiates an attack behavior based on a preset change mode; and when the actual change mode of the switch satisfies the preset change mode, determining that the switch initiates an attack behavior. The method provided by the invention has the effect of detecting the attack behavior that controller resources are used up by using a control plane false request and data plane traffic abnormality is not generated.

Description

Technical Field

[0001] The present invention relates to the technical field of information network attack behavior detection, and in particular to an information network attack behavior detection method and system. Background Art

[0002] In a typical software-defined networking (SDN) environment, network control functions are centralized in the SDN controller, while data forwarding is performed by the underlying switches. When a switch receives a packet that doesn't match a rule in its flow table, it generates a Packet-In message and reports it to the controller. After processing the Packet-In message, the controller calculates a path and sends a Flow-Mod message to install the flow table, allowing subsequent packets to be forwarded directly on the switch. This mechanism improves network flexibility and efficiency.

[0003] When the controller receives a massive number of forged Packet-In messages, Packet-In messages generated by genuine service needs reported by other healthy switches in the network cannot be promptly responded to. This significantly increases the delay in establishing connections for normal services, severely impacting user experience and network service quality. Because this attack method relies on the misuse of control plane messages, the attacker does not generate abnormal traffic on the data plane. Therefore, traditional network security monitoring and detection tools that rely on data plane traffic statistics and analysis often fail to detect such attacks, allowing attackers to conceal their malicious activities for a long time.

[0004] Existing technologies are insufficient in detecting attacks that exploit false control plane requests to exhaust controller resources without causing data plane traffic anomalies. There is a lack of an effective mechanism to verify the correlation between control plane events (such as Packet-In) and the subsequent corresponding real data forwarding behavior on the data plane, making it difficult to accurately identify and locate the source of such attacks.

[0005] In view of the above problems, the existing technology is in urgent need of improvement. Summary of the Invention

[0006] The purpose of the present invention is to provide an information network attack behavior detection method and system, which has the advantage of being able to effectively detect attack behaviors that exhaust controller resources by using false requests on the control plane without generating data plane traffic anomalies.

[0007] The present invention provides a method for detecting information network attack behavior, and the technical solution is as follows: A method for detecting information network attack behavior, comprising: Preset request permission values ​​for switches in the network; Receive control requests from the switch; After receiving the control request, the control request is processed based on the condition that the request permission value is greater than a preset threshold, and the switch's request permission value is deducted. At the same time, based on the data flow corresponding to the control request, a confirmation condition is set to verify whether real data forwarding behavior occurs on the data flow; When the confirmation condition is satisfied within a preset time limit, receiving a corresponding confirmation certificate, and increasing the request permission value based on the confirmation certificate; Determine whether the switch has initiated an attack based on a preset change pattern; a preset change pattern is one in which the requested permission value continuously decreases due to deduction operations and cannot be restored due to the absence of addition operations; When the actual change pattern of the switch meets the preset change pattern, it is determined that the switch initiates an attack behavior.

[0008] The above solution can effectively detect attacks that use false control plane requests to exhaust controller resources without causing data plane traffic anomalies.

[0009] Furthermore, the present invention also proposes that after receiving the control request, based on the condition that the request permission value is greater than a preset threshold, the control request is processed and the request permission value of the switch is deducted. At the same time, based on the data flow corresponding to the control request, a confirmation condition for verifying whether real data forwarding behavior occurs on the data flow is set, including the following steps: After receiving the control request, check whether the control request carries the associated credentials; If not, the control request is determined to be an independent control request, and based on the condition that the request permission value is greater than the preset threshold, the control request is processed, the request permission value is deducted, and confirmation conditions are set based on the data flow corresponding to the control request. At the same time, an associated certificate is generated and sent to the switch; If it is carried, based on the validity of the associated certificate, it is determined that there is a business correlation between the control request and the previous control request, so as to perform aggregation processing and eliminate the operation of repeated deduction of the request permission value.

[0010] Through the above solution, aggregate processing is performed by checking the associated vouchers, which avoids repeated deductions of license values ​​and improves processing efficiency and accuracy.

[0011] Furthermore, the present invention also proposes that when the confirmation condition is satisfied within a preset time limit, the steps of receiving a corresponding confirmation certificate and increasing the requested permission value based on the confirmation certificate include: Receive the confirmation certificate returned by the switch; Verify the structural integrity and timestamp validity of the certificate; Based on the identification information of the preceding control request in the confirmation voucher, check whether the corresponding confirmation condition is in a valid state; If the confirmation condition is in a valid state, the confirmation credential is determined to be valid, and the corresponding increment of the request permission value is added to the request permission value of the switch.

[0012] Through the above scheme, by verifying the validity of the confirmation credential and finding the confirmation condition, it is ensured that the increase of the permission value is based on the effective real forwarding behavior, thereby improving the accuracy of detection.

[0013] Furthermore, the present invention also proposes that, if carried, based on the validity of the associated credentials, the steps of determining whether there is a business correlation between the control request and the previous control request for aggregation processing to eliminate the repeated deduction of the request permission value include: Based on the associated credentials, obtain the corresponding preceding control request; Query the status of the data stream established by the previous control request; When the state of the data flow is active, it is determined that there is a business correlation between the control request and the previous control request, so as to perform aggregation processing and exclude the operation of repeated deduction of the request permission value.

[0014] Through the above solution, by querying the data flow status established by the preceding control request, the business relevance can be judged more accurately and the aggregation processing can be further optimized.

[0015] Furthermore, the present invention also proposes that the step of querying the status of the data flow established by the preceding control request includes: Obtain a first traffic statistic value of a data flow at a first moment; After a preset time interval, obtaining a second traffic statistic value of the data flow at a second moment; The first traffic statistics value is compared with the second traffic statistics value. If the second traffic statistics value is greater than the first traffic statistics value, it is determined that the state of the data flow is an active state.

[0016] Through the above solution, whether the data flow is active is determined by comparing the traffic statistics at different times, which provides a specific method for determining the data flow status.

[0017] Furthermore, the present invention also proposes that, after a preset time interval, the step of obtaining a second traffic statistic value of the data flow at a second moment includes: Measuring and obtaining a statistical round trip period corresponding to a communication interaction of a first traffic statistic value; Inputting the statistical round trip period into a preset conversion logic, and using the output result of the preset conversion logic as the dynamic time interval; After the dynamic time interval has passed, a second traffic statistic value of the data flow at a second moment is obtained.

[0018] Through the above solution, by determining the dynamic time interval based on the statistical round-trip cycle, traffic statistics are made more flexible and adaptable to network conditions.

[0019] Furthermore, the present invention also proposes that before the step of inputting the statistical round-trip period into the preset conversion logic and using the output result of the preset conversion logic as the dynamic time interval, the method further includes: Get the statistical round trip cycle of historical moments; Determine the benchmark cycle value based on the statistical round-trip cycle of historical moments; Based on the reference period value, the output value boundary of the preset conversion logic is updated.

[0020] Through the above solution, by obtaining the historical period and determining the reference period value, the output boundary of the conversion logic is updated, making the determination of the dynamic time interval more stable and reliable.

[0021] Furthermore, the present invention also proposes that the step of determining the reference period value based on the statistical round-trip period of historical moments includes: Among the statistical round-trip cycles of historical moments, exclude the statistical round-trip cycles that are greater than the preset maximum cycle threshold; A reference period value is determined based on the statistical round trip period after the elimination operation is completed.

[0022] Through the above solution, the accuracy of determining the reference period value is improved by excluding abnormally large statistical round-trip periods.

[0023] Furthermore, the present invention also proposes that the step of determining the reference period value based on the statistical round-trip period after the elimination operation is completed includes: The statistical round-trip cycle after the exclusion operation is completed is associated with the corresponding time information and stored; According to the preset time period division rules, the statistical round-trip cycle after associated storage is divided into several data sets according to the time period; For each data set, determine the corresponding base period value; Get the time period to which the current moment belongs; The base period value of the data set corresponding to the time period to which the current moment belongs is selected as the determined base period value.

[0024] Through the above scheme, by dividing the data set by time period and determining the benchmark period value, the benchmark period value is made more timely and representative.

[0025] An information network attack behavior detection system, used to perform the above-mentioned information network attack behavior detection, comprising: A request permission preset module, used to preset request permission values ​​for switches in the network; A control request receiving module, configured to receive a control request from a switch; a data processing setting module, configured to, upon receiving a control request, process the control request based on the condition that the request permission value is greater than a preset threshold, deduct the request permission value of the switch, and, based on the data flow corresponding to the control request, set a confirmation condition for verifying whether a real data forwarding behavior occurs on the data flow; a confirmation credential response module, configured to receive a corresponding confirmation credential when a confirmation condition is satisfied within a preset time limit, and increase the request permission value based on the confirmation credential; An attack behavior judgment module is used to judge whether the switch has initiated an attack behavior based on a preset change pattern; the preset change pattern is a change pattern in which the request permission value continuously decreases due to deduction operations and cannot be restored due to the absence of increase operations; The attack behavior confirmation module is used to determine whether the switch initiates an attack behavior when the actual change pattern of the switch meets the preset change pattern.

[0026] Through the above solution, a system for implementing the above method is provided, which is convenient for actual deployment and application.

[0027] From the above, it can be seen that the information network attack behavior detection method and system provided by the present invention establishes an association between the request permission value and the actual forwarding behavior of the data flow, and judges the attack behavior based on the change pattern of the permission value. It effectively solves the problem that the existing technology is difficult to detect attacks that use false requests on the control plane to exhaust controller resources without causing data plane traffic anomalies. It has the advantage of being able to effectively detect attack behaviors that use false requests on the control plane to exhaust controller resources without causing data plane traffic anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flow chart of a method for detecting information network attack behavior in one embodiment of the present invention; Figure 2 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 1 ; Figure 3 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 2 ; Figure 4 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 3 ; Figure 5 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 4 ; Figure 6This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 5 ; Figure 7 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 6 ; Figure 8 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 7 ; Figure 9 This is a method flow of an information network attack behavior detection method in another embodiment of the present invention. Figure 8 ; Figure 10 This is a system block diagram of an information network attack behavior detection system in another embodiment of the present invention.

[0029] Description of reference numerals: 1. Information network attack behavior detection system; 11. Request permission preset module; 12. Control request receiving module; 13. Data processing setting module; 14. Confirmation credential response module; 15. Attack behavior judgment module; 16. Attack behavior confirmation module. DETAILED DESCRIPTION

[0030] The technical solutions of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The components of the present invention generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0031] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are used only to distinguish the description and should not be understood as indicating or implying relative importance.

[0032] In a software-defined networking (SDN) environment, traditional methods lack an effective mechanism to verify whether the Packet-In events reported by a single switch correspond to actual data forwarding behavior on the data plane. This makes it difficult to accurately identify control plane attacks characterized by the continuous sending of "empty" flow establishment requests and to locate the source switch.

[0033] For example, consider a large data center SDN network where an SDN controller manages hundreds of OpenFlow switches. An attacker gains control of a switch at the network edge and exploits it to send forged Packet-In messages to the controller thousands of times per second. These messages contain randomly generated, but formatted, virtual packet headers. Upon receiving these messages, the controller performs path calculation, policy lookup, and other processing for each message. Because these messages do not correspond to real data flows, no actual traffic is generated on the data plane. The controller continuously processes these forged requests, causing its CPU load to remain high for extended periods and a backlog of internal task queues. Packet-In messages reported by other healthy switches in the network cannot be processed promptly, increasing the delay in flow table delivery from milliseconds to tens of seconds when users initiate new connections. Traditional traffic statistics-based monitoring systems fail to detect the anomaly because data plane traffic is normal.

[0034] In this regard, the present invention proposes a method for detecting information network attack behaviors. Figure 1 As shown, including: S1, presets the request permission value for the switches in the network; S2, receives the control request from the switch; S3, after receiving the control request, based on the condition that the request permission value is greater than a preset threshold, the control request is processed and the switch's request permission value is deducted. At the same time, based on the data flow corresponding to the control request, a confirmation condition is set to verify whether real data forwarding behavior occurs on the data flow; S4, when the confirmation condition is satisfied within a preset time limit, receiving a corresponding confirmation certificate, and increasing the request permission value based on the confirmation certificate; S5, determining whether the switch has initiated an attack based on a preset change pattern; the preset change pattern is a change pattern in which the requested permission value continuously decreases due to a deduction operation and cannot be restored due to the absence of an increase operation; S6: When the actual change pattern of the switch meets the preset change pattern, it is determined that the switch initiates an attack behavior.

[0035] The request permission value refers to a resource amount allocated to a switch in the network, used to measure the "credit" or "quota" of the switch initiating control requests. It can be expressed in the form of a number, token, etc. Its main purpose is to limit the total number of control requests sent by a single switch to the controller per unit time to prevent malicious or abnormal request flooding. The preset threshold refers to a reference value used to determine whether to allow the processing of a control request. When the switch's request permission value is greater than the threshold, the control request will be further processed. Its main purpose is to refuse to process the switch's control request when the request permission value is low, thereby preliminarily limiting abnormal behavior. The confirmation condition refers to the judgment basis used to verify whether the data flow established by the control request generates real data forwarding behavior on the data plane. It can be set based on information such as the data flow's traffic statistics, connection status, and specific interaction events. Its main purpose is to associate control requests with actual network behavior and distinguish between real business requests and false requests. Confirmation credentials refer to proof information generated by a switch or other entity in the network and sent to the controller to prove that the confirmation conditions have been met. They can include data flow identification, timestamps, signatures and other information. Their main purpose is to provide the controller with evidence of the actual forwarding of the data flow as a basis for restoring the requested permission value. A preset change pattern refers to a specific trend in the change of the requested permission value, specifically a change pattern in which the requested permission value continues to decrease due to the processing of control requests and cannot be effectively increased or restored due to the lack of confirmation credentials corresponding to the actual data forwarding. Its main purpose is to identify abnormal behaviors that continue to initiate false requests without real business support by monitoring the dynamic changes of the requested permission value.

[0036] Based on the above technical features, the solution of the present invention operates as follows. First, a request permission value is preset for switches in the network, laying the foundation for subsequent request processing and attack determination. Next, a control request is received from the switch. After receiving the control request, the system checks whether the switch's request permission value is greater than a preset threshold. If the conditions are met, the control request is processed, for example, by calculating a forwarding path and preparing to issue flow table rules. At the same time, the switch's request permission value is deducted, reflecting the resources or quota consumed by processing the request. Simultaneously, based on the data flow information corresponding to the control request, a confirmation condition is set to verify whether actual data forwarding behavior has occurred on the data flow, preparing for subsequent verification. The system then waits to see if the confirmation condition is met within a preset time limit. If the confirmation condition is met within the preset time limit and a corresponding confirmation certificate is received, the switch's request permission value is increased based on the confirmation certificate, reflecting the "supplementation" or "reward" of the permission value by actual business activity. The system continuously determines whether the switch has initiated attack behavior based on a preset change pattern. The preset change pattern is a specific trend in the permitted value. This means that the permitted value decreases due to continuous deductions, but due to the lack of corresponding increases in real forwarding, the permitted value cannot recover and continues to decline. When the permitted value change pattern of the switch's actual request matches the preset change pattern, the system determines that the switch is initiating an attack. This entire process forms a closed loop, enabling the identification of abnormal control requests through dynamic management of permitted values ​​and verification based on real forwarding.

[0037] As a specific implementation, each switch can maintain a request permission value counter, with an initial value set to a relatively large number. The preset threshold can be set to a small positive number. When a Packet-In message is received from a switch, the corresponding counter value is checked. If the counter value is greater than the preset threshold, the Packet-In message is processed, for example, by performing path calculation, and the counter value is deducted by a preset deduction amount. Furthermore, a confirmation condition is set for the five-tuple (source IP, destination IP, source port, destination port, protocol) corresponding to the Packet-In message, such as requiring that actual packet forwarding be detected on the data flow corresponding to the five-tuple within a certain period of time. If the switch actually forwards data after establishing the data flow and is able to provide a confirmation certificate to the controller through some mechanism (such as sending a specific confirmation message or the controller detecting traffic through other means), the controller verifies the validity of the certificate and increments the corresponding counter value of the switch by a preset increment. The system continuously monitors the changing trend of each switch's counter. If the counter value of a switch continuously decreases, with little or no increase due to the receipt of confirmation certificates, exhibiting a continuous and unrecoverable downward trend, the switch is determined to be launching an attack. For example, an attacking switch continuously sends fake Packet-In messages, causing its counter value to be continuously decremented. However, since no real data is forwarded, it cannot obtain confirmation credentials to increment the counter value. Eventually, the counter value will continue to decrease, even falling to zero or a negative value, showing an attack pattern. However, the Packet-In messages sent by a normal switch correspond to real services, resulting in data forwarding and confirmation credentials. Its counter value will fluctuate between decrements and increments, and will not show a continuous decrease pattern.

[0038] Through the above technical solution, the present invention can effectively detect attack behaviors in a software-defined network environment where attackers send a large number of false control requests without generating data plane traffic. This method limits the consumption of controller resources by a single switch by introducing a request permission value mechanism, and ensures that only real business requests can obtain permission value recovery by forcibly associating the processing of control requests with the actual forwarding behavior of data flows. By monitoring the change pattern of the request permission value, the attack source that continuously sends "empty" flow establishment requests can be accurately identified. This solution is implemented at the controller level, has low detection overhead, and can directly locate the switch that initiates the attack.

[0039] Optional, combined Figure 2As shown, after receiving the control request, S3 processes the control request based on the condition that the request permission value is greater than a preset threshold, deducts the request permission value of the switch, and at the same time, sets a confirmation condition for verifying whether a real data forwarding behavior occurs on the data flow based on the data flow corresponding to the control request. The steps include: S31, after receiving the control request, checking whether the control request carries the associated certificate; If not, determine that the control request is an independent control request and, based on the condition that the request permission value is greater than a preset threshold, process the control request, deduct the request permission value, set a confirmation condition based on the data flow corresponding to the control request, and generate an associated certificate and send it to the switch. S33, if it is carried, based on the validity of the associated certificate, determine whether there is business correlation between the control request and the previous control request, so as to perform aggregation processing and exclude the operation of repeated deduction of the request permission value.

[0040] Among them, the association credential refers to a unique or semi-unique identifier used to identify the business association relationship between different control requests. It can be implemented by a randomly generated string, a hash value based on a timestamp and request information, or a session ID assigned by the controller. Its purpose is to provide a common identification mark for control requests with business association; aggregation processing refers to processing multiple control requests with business association as a logical unit instead of treating them as independent events. It can be implemented by binding the processing logic of subsequent association requests with the processing logic of previous requests, sharing the resource status consumed by previous requests, or skipping certain processing steps for independent requests (such as deduction of request permission value). Its purpose is to avoid repeated resource consumption calculations for multiple control requests in the same logical business process.

[0041] In some preferred embodiments, the present invention is implemented as follows: When a controller receives a Packet-In message from a switch, it first checks the OpenFlow header or custom extension field of the Packet-In message for a predefined association credential field. If the field is empty or absent, the controller determines that this is an independent Packet-In request, indicating that a new data flow may be established. The controller then checks whether the switch's current request grant value is greater than a preset threshold. If so, the controller begins processing the Packet-In message, performing path calculation and flow table generation, and deducting a unit value from the switch's request grant value. The controller then sets a confirmation condition based on the data flow information (e.g., a quintuple) in the Packet-In message, for example, monitoring the data flow for actual data packets within the next five seconds. Simultaneously, the controller generates a unique association credential, such as a UUID, and sends it back to the switch in a Flow-Mod message. The Flow-Mod message may contain instructions for installing the flow table and the association credential, instructing the switch to include the credential in subsequent Packet-In messages related to this flow. If a received Packet-In message carries a correlation credential, the controller searches its internally stored list of valid correlation credentials to verify that the credential exists and has not expired. If the credential is valid, the controller determines that the Packet-In message has business relevance to a previously processed request, such as a subsequent Packet-In message for the same data flow (although this should not occur in normal SDN processes, it may occur in attack scenarios). At this point, the controller performs aggregation processing, such as directly locating previously calculated flow table information based on the correlation credential for processing. However, the controller does not deduct the requested permission value from the switch again, thus avoiding duplicate deductions.

[0042] Optional, combined Figure 3 As shown, when the confirmation condition is satisfied within a preset time limit, the step of receiving the corresponding confirmation certificate and increasing the request permission value based on the confirmation certificate includes: S41, receiving a confirmation certificate returned by the switch; S42, verifying the structural integrity and timestamp validity of the certificate; S43, based on the identification information of the preceding control request in the confirmation voucher, checking whether the corresponding confirmation condition is in a valid state; S44: If the confirmation condition is in a valid state, the confirmation certificate is determined to be valid, and the corresponding increment of the request permission value is added to the request permission value of the switch.

[0043] Verifying the structural integrity and timestamp validity of the confirmation voucher refers to checking the format and timeliness of the received confirmation voucher. Specifically, it can be checking whether the data fields of the confirmation voucher comply with the preset format specifications, such as the number of fields, data type, etc., and checking whether the timestamp contained in the confirmation voucher is within the current valid time range. The purpose is to ensure that the received confirmation voucher has not been tampered with and was generated within the specified time, providing a reliable data foundation for subsequent processing. Specifically, based on the identification information of the previous control request in the confirmation voucher, searching for the corresponding confirmation condition in the system to see if it is in a valid state refers to using the unique identifier associated with a previous control request carried in the confirmation voucher to query the confirmation condition record corresponding to the identifier in the system and check whether the status of the record is still marked as "valid" or "pending confirmation". Specifically, it can be done by using the identification information to search in a data structure storing confirmation conditions (such as a hash table or database) and reading the status field or expiration time of the confirmation condition. The purpose is to ensure that the received confirmation voucher actually corresponds to an event that the current system is waiting for confirmation and is triggered by real data forwarding behavior, so as to avoid processing vouchers related to expired or canceled confirmation conditions.

[0044] In some preferred embodiments, specifically, when the system receives a confirmation voucher returned by the switch, it first performs a preliminary parsing to check whether it conforms to the predetermined data format. For example, if the confirmation voucher is in JSON format, it checks whether it contains all required key-value pairs and that the corresponding value types are correct. It also extracts the timestamp information from the confirmation voucher and compares it with the current system time and the preset voucher validity period. For example, it checks whether the current time is later than the timestamp plus the validity period. If the structure is incomplete or the timestamp is invalid, the voucher is directly discarded and an exception is recorded. If the preliminary verification passes, the system extracts the identification information of the preceding control request, such as a unique request ID, from the confirmation voucher. Using this request ID, the system searches for the corresponding confirmation condition record in an internally maintained confirmation condition list. Once the record is found, the system checks the status field of the record. For example, if the status field is marked as "Expired" or "Completed," the confirmation condition is no longer valid. The confirmation voucher is only considered valid if the confirmation condition record exists and the status is marked as "Pending Confirmation" or "Valid." At this time, the system reads the request permission value increment contained in the confirmation credential and adds it to the current request permission value of the corresponding switch, for example, by updating the switch request permission value counter stored in the memory or database through an atomic operation.

[0045] Optional, combined Figure 4As shown, if S33 carries, then based on the validity of the associated credentials, it is determined that there is a business correlation between the control request and the previous control request to perform aggregation processing, and the steps of excluding the repeated deduction of the request permission value include: S331, based on the associated credentials, obtain the corresponding preamble control request; S332, querying the status of the data stream established by the preceding control request; S333: When the state of the data flow is active, determine whether there is a business correlation between the control request and the previous control request, so as to perform aggregation processing and eliminate the operation of repeated deduction of the request permission value.

[0046] Among them, the status of the data flow refers to whether the network data flow established by the previous control request is currently in an active data transmission state. It can be achieved by checking whether the flow table entry on the network device related to the data flow (such as a switch) exists and whether there is traffic passing through, or querying the traffic statistics information of the data flow recorded by the network monitoring system. Its purpose is to verify whether the business connection pointed to by the associated certificate still exists and is in use; the active state means that the status of the data flow shows that the data flow is performing effective data transmission, for example, the flow table entry corresponding to the data flow exists and its packet counter or byte counter is continuously increasing, or the data flow is detected to have non-zero traffic within a certain time window.

[0047] In some preferred embodiments, the specific implementation is as follows: when a control request carrying an associated credential is received, the system first uses the associated credential as an index to search and obtain detailed information of the previous control request associated with it in a database or cache that stores historical control request information, such as the identifier, timestamp, and related information of the previous control request establishing the data flow (such as a five-tuple or flow identifier). Then, based on the acquired data flow related information, the system sends a query request to the switch or network monitoring system in the network to obtain the current operating status information of the data flow, such as querying whether the corresponding flow table entry exists and its traffic statistics. After receiving the status query result, the system analyzes the result, such as checking whether the flow table entry exists and whether its packet count or byte count is continuously increasing or has a non-zero value in the recent period. If these signs indicate that the data flow is transmitting data, the status of the data flow is determined to be active. At this time, the system determines that the current control request and the previous control request do have business relevance, and logically aggregates the control request with the previous control request. In the subsequent request permission value management, the request permission value is deducted only once for the aggregated business flow, avoiding repeated deductions for multiple control requests for the same business flow.

[0048] Optional, combined Figure 5As shown, the step of querying the status of the data flow established by the preceding control request in S332 includes: S3321, obtaining a first traffic statistic value of a data flow at a first moment; S3322: After a preset time interval, obtain a second traffic statistic value of the data flow at a second moment; S3323: Compare the first traffic statistics value with the second traffic statistics value. If the second traffic statistics value is greater than the first traffic statistics value, determine that the state of the data flow is an active state.

[0049] Among them, the traffic statistics value refers to a numerical value reflecting the amount of data or the number of data packets transmitted by a data flow at a specific time point or time period, which can be implemented using indicators such as the number of bytes, the number of data packets, and the traffic rate; the preset time interval refers to the interval duration used to determine the time point for obtaining the second traffic statistics value, which can be determined by a fixed duration, a duration dynamically adjusted according to the network status, etc.

[0050] In some preferred embodiments, querying the status of a data flow established by a preceding control request can be specifically implemented as follows. First, at a first moment, the system sends a request to the switch associated with the data flow to obtain the byte counter value of the flow table entry corresponding to the data flow as a first traffic statistic. For example, it can be obtained through the OFPFlowStatsRequest message of the OpenFlow protocol. Then, a preset time interval is set, for example, fixed to 5 seconds. After these 5 seconds, that is, at a second moment, the system again sends a request to the same switch to obtain the byte counter value of the flow table entry corresponding to the data flow as a second traffic statistic. Finally, the obtained second traffic statistic is compared with the first traffic statistic. If the second traffic statistic is greater than the first traffic statistic, it can be determined that data transmission has occurred on the data flow within the 5-second interval, thereby determining that the data flow is currently in an active state.

[0051] Optional, combined Figure 6 As shown, the step of obtaining a second traffic statistic value of the data flow at a second moment after a preset time interval in S3322 includes: A1, measuring a statistical round trip period corresponding to a communication interaction to obtain a first traffic statistic value; A2, inputting the statistical round-trip period into a preset conversion logic, and using the output of the preset conversion logic as the dynamic time interval; A3: After the dynamic time interval, obtain a second traffic statistic value of the data flow at a second moment.

[0052] Among them, the statistical round-trip cycle refers to the time interval between sending a data packet and receiving the corresponding confirmation data packet. It can be implemented by recording the timestamp when sending the data packet and calculating the time difference when receiving the confirmation data packet. Its purpose is to reflect the real-time communication delay characteristics of the data flow; the preset conversion logic refers to a mapping relationship or algorithm used to convert the statistical round-trip cycle into a dynamic time interval. It can be implemented by table lookup, formula calculation or machine learning model. Its purpose is to determine the appropriate waiting time according to the communication characteristics of the data flow; the dynamic time interval refers to the time length calculated based on the statistical round-trip cycle and used to determine the timing of obtaining the second traffic statistical value. Its purpose is to enable the timing of obtaining the second traffic statistical value to adapt to the actual communication speed of the data flow.

[0053] In some preferred embodiments, specifically, the timestamp of the request message sent to obtain the first traffic statistics value can be recorded, and the reception timestamp of the corresponding response message can be recorded upon receipt. The difference between the two timestamps is calculated as the statistical round-trip period. This statistical round-trip period is then input into a pre-defined conversion function, such as a simple linear function (dynamic time interval = k * statistical round-trip period + c) or a piecewise function, to obtain the dynamic time interval based on the calculation result. The system then starts a timer and sets the timer duration to the dynamic time interval. When the timer expires, the dynamic time interval is considered to have elapsed, and the current traffic statistics value of the data flow is obtained as the second traffic statistics value.

[0054] Optional, combined Figure 7 As shown, before executing step A2 of inputting the statistical round-trip cycle into the preset conversion logic and using the output result of the preset conversion logic as the dynamic time interval, the method further includes: B1, obtain the statistical round-trip cycle of historical moments; B2, based on the statistical round-trip cycles of historical moments, determine the benchmark cycle value; B3, based on the reference period value, updates the output value boundary of the preset conversion logic.

[0055] The statistical round-trip cycle at a historical moment refers to the round-trip time data obtained by measuring communication interactions within a period of time before the current moment. It can be data collected from the past few minutes, hours, or days. The benchmark cycle value refers to a representative value calculated based on the statistical round-trip cycle at a historical moment. It is used to reflect the normal level of the network round-trip cycle and can be calculated using statistical methods such as average, median, and weighted average. The preset conversion logic refers to a function or set of rules that maps the statistical round-trip cycle to a dynamic time interval. Its output value boundaries refer to the minimum and maximum ranges of the dynamic time intervals calculated by the logic. Updating the output value boundaries refers to adjusting these minimum and maximum values ​​based on the benchmark cycle value to limit the value range of the dynamic time interval.

[0056] In some preferred embodiments, the system can be implemented as follows: First, the system can maintain a data queue of historical statistical round-trip cycles, which stores all statistical round-trip cycle values ​​measured within a recent period (e.g., the past hour). When determining a dynamic time interval, the system first retrieves a set of statistical round-trip cycle values ​​from this data queue. Based on this historical set, a median calculation method can be used to determine a baseline cycle value. For example, by sorting the historical data and taking the median value. This method effectively eliminates the influence of a few extreme outliers. For example, if the historical data is [50ms, 55ms, 60ms, 150ms, 2000ms], the median is 60ms, indicating a baseline cycle value of 60ms. Based on this determined baseline cycle value, the output value boundaries of the preset conversion logic are then updated. The preset conversion logic can convert the statistical round-trip cycles into dynamic time intervals, for example, using a function f(RTT). Its output value boundaries can be set to [baseline cycle value * 0.5, base cycle value * 2]. Using a base cycle value of 60ms, the output value boundaries are updated to [30ms, 120ms]. This means that regardless of the current statistical round-trip cycle, the dynamic interval calculated by the preset conversion logic will be limited to between 30ms and 120ms. For example, if the current statistical round-trip cycle is 70ms and the preset conversion logic calculates a dynamic interval of 80ms, which is within the bounds, the 80ms interval will be used. If the current statistical round-trip cycle is 10ms and the preset conversion logic calculates a dynamic interval of 15ms, which is less than 30ms, the 30ms interval will be used. If the current statistical round-trip cycle is 500ms and the preset conversion logic calculates a dynamic interval of 600ms, which is greater than 120ms, the 120ms interval will be used.

[0057] Optional, combined Figure 8 As shown, B2 determines the benchmark cycle value based on the statistical round-trip cycle of historical moments, including the following steps: B21, among the statistical round-trip cycles of historical moments, exclude the statistical round-trip cycles that are greater than the preset maximum cycle threshold; B22, determining a reference cycle value based on the statistical round-trip cycle after completing the elimination operation.

[0058] The historical round-trip latency refers to the set of round-trip latency values ​​obtained by measuring communication interactions (such as the sending of a Packet-In message and the receiving of a confirmation certificate) at a certain point in the past or during a period of time. This can be achieved by continuously recording the round-trip time of each communication interaction or by periodically sampling network latency. Its purpose is to provide basic data for analyzing network latency characteristics. The preset maximum cycle threshold refers to a pre-set value used to define the upper limit of the normal round-trip cycle. It can be set based on the statistical distribution of historical network delays, network service quality requirements, or manual experience. Its purpose is to identify and eliminate abnormally high round-trip cycle values.

[0059] In some preferred embodiments, specifically, assume that the system records a set of statistical round-trip cycle data for historical moments over a period of time, for example, including values ​​of 50ms, 60ms, 55ms, 1000ms, 70ms, 52ms, 1200ms, and 65ms. The preset maximum cycle threshold can be set to 500ms. When determining the reference cycle value, first, from the above historical statistical round-trip cycle data, statistical round-trip cycles greater than 500ms are excluded, that is, the values ​​of 1000ms and 1200ms are eliminated. After the exclusion operation is completed, the remaining statistical round-trip cycle data are 50ms, 60ms, 55ms, 70ms, 52ms, and 65ms. Then, based on the statistical round-trip cycles after the exclusion operation, the reference cycle value can be determined by calculating an average. For example, the average of the remaining data is calculated as (50+60+55+70+52+65) / 6≈58.67ms, and 58.67ms is used as the determined reference cycle value. This reference cycle value can then be used to update the output value boundaries of the preset conversion logic.

[0060] Optional, combined Figure 9 As shown, the step B22 of determining the reference period value based on the statistical round-trip period after the elimination operation is completed includes: B221, associate and store the statistical round-trip cycle after the elimination operation with the corresponding time information; B222, according to a preset time period division rule, the statistical round-trip cycle after associated storage is divided into several data sets according to time periods; B223, for each data set, determine the corresponding reference period value; B224, obtain the time period to which the current moment belongs; B225, select the reference period value of the data set corresponding to the time period to which the current moment belongs as the determined reference period value.

[0061] Among them, the preset time period division rule refers to the standard used to divide the historical statistical round-trip cycle data with continuous time into discrete time periods. It can be implemented by dividing it by hour, day or week, and its purpose is to group the cycle data according to time characteristics; determining the corresponding benchmark cycle value means calculating a value that can represent the normal round-trip cycle level in each time period for the data set. It can be implemented by calculating the average, median, mode or a certain percentile in the data set. Its purpose is to obtain a representative cycle value that reflects the network behavior characteristics of a specific time period.

[0062] In some preferred embodiments, the specific implementation is as follows: the system continuously collects and stores statistical round-trip cycle data after the abnormal values ​​are eliminated, and records the specific timestamp when each cycle value is generated. The preset time period division rule can be set to hourly division, that is, dividing the 24 hours of a day into 24 time periods. The system classifies the historical cycle data into the corresponding hourly data set according to its timestamp. For example, all cycle data occurring between 9 am and 10 am are classified into the "9 am - 10 am" data set. For each hourly data set, the system can calculate the average value of all cycle values ​​in the data set as the benchmark cycle value for that hour. When it is necessary to determine the benchmark cycle value at the current moment, the system obtains the current time. For example, if the current time is 3:35 pm, the system determines that the time period to which the current moment belongs is the "3 pm - 4 pm" time period. The system then searches and selects the pre-calculated average value of the "3 pm - 4 pm" data set as the benchmark cycle value determined at the current moment.

[0063] Through the above technical solution, the statistical round-trip cycle after the exclusion operation is completed is divided into time periods and the benchmark cycle values ​​are determined respectively. Then, the benchmark cycle value of the corresponding time period is selected according to the current moment, thereby avoiding the influence of network behavior differences in different time periods on the accuracy of the benchmark cycle value, so that the determined benchmark cycle value can more accurately reflect the current network environment characteristics, thereby improving the accuracy of dynamic time interval setting, and ultimately improving the accuracy of information network attack behavior detection.

[0064] An information network attack behavior detection system is used to perform information network attack behavior detection, combined with Figure 10 As shown, the information network attack behavior detection system 1 includes: A request permission preset module 11 is used to preset a request permission value for a switch in the network; A control request receiving module 12, configured to receive a control request from a switch; The data processing setting module 13 is configured to, upon receiving the control request, process the control request based on the condition that the request permission value is greater than a preset threshold, deduct the switch's request permission value, and set a confirmation condition for verifying whether real data forwarding behavior occurs on the data flow corresponding to the control request based on the data flow; a confirmation credential response module 14 for receiving a corresponding confirmation credential when a confirmation condition is satisfied within a preset time limit, and increasing the request permission value based on the confirmation credential; The attack behavior determination module 15 is configured to determine whether the switch has initiated an attack behavior based on a preset change pattern; the preset change pattern is a change pattern in which the requested permission value continuously decreases due to a deduction operation and cannot be restored due to the absence of an increase operation; The attack behavior confirmation module 16 is configured to determine that the switch initiates an attack behavior when the actual change pattern of the switch satisfies the preset change pattern.

[0065] Among them, the request permission preset module refers to a functional unit used to initialize and maintain the request permission status of the switch in the network. It can be implemented in the form of a software module, database record or configuration file, and its purpose is to set initial constraints for the control request behavior of the switch; the control request receiving module refers to a functional unit used to receive control request messages from the switch, which can be implemented in the form of a network interface listener, a message queue consumer or an API interface, and its purpose is to obtain the control intention initiated by the switch; the data processing setting module refers to a functional unit used to process the received control request according to the request permission value and set the subsequent verification mechanism, which can be implemented in the form of a business logic handler, a state machine or an event handler, and its purpose is to manage the request permission value of the switch while allowing the control request to be executed, and to prepare for verifying the actual data forwarding behavior; the confirmation credential response module refers to a functional unit used to receive and process the confirmation credential returned by the switch, and adjust the request permission value according to the credential result, which can be implemented in the form of a credential verification service, a message processing queue or a callback function, and its purpose The purpose is to reward the switch's actual data forwarding behavior and restore its request permission capability; the attack behavior judgment module refers to a functional unit used to analyze the change trend of the switch's request permission value and compare it with the preset attack pattern. It can be implemented using a time series analysis algorithm, a rule engine, or a machine learning model. Its purpose is to identify potential abnormal behavior patterns from the dynamic changes of the request permission value; the attack behavior confirmation module refers to a functional unit used to perform final confirmation and trigger subsequent responses after the judgment module identifies behavior that meets the attack pattern. It can be implemented using state confirmation logic, an alarm trigger, or a policy executor. Its purpose is to make a final judgment on the identified attack behavior so that defensive measures can be taken; the preset change pattern refers to a specific change pattern of the request permission value, which is specifically manifested in that the request permission value continues to decrease due to the deduction operation of the control request, and due to the lack of confirmation credentials generated by the corresponding data forwarding behavior, the request permission value cannot be restored by increasing the operation. Its purpose is to characterize the resource exhaustion phenomenon caused by the attacker sending false control requests but not performing real data forwarding.

[0066] The solution of the present invention transforms the logical steps in the information network attack behavior detection method into a system-level modular implementation, thereby constructing a practical detection system. The request permission preset module is responsible for setting the initial request permission resources for switches in the network, which serve as the basis for them to initiate control requests. The control request receiving module continuously monitors and receives control requests from switches. Upon receiving a request, the data processing setting module first checks whether the switch's current request permission value meets the conditions required to process the request (e.g., greater than a preset threshold). If so, it processes the control request (e.g., performs path calculation, issues a flow table, etc.) and deducts the corresponding value from the switch's request permission value. Simultaneously, based on the data flow information corresponding to the control request, it sets a confirmation condition for subsequent verification. This condition is intended to confirm whether the data flow has generated actual data forwarding behavior on the data plane. If the switch has indeed forwarded data and meets the previously set confirmation conditions (e.g., generated traffic within a preset time limit), it generates and sends a corresponding confirmation credential. Upon receiving the credential, the confirmation credential response module verifies it. If valid, it increases the switch's request permission value based on the credential information as a reward for its normal behavior. The attack behavior judgment module continuously monitors the dynamic changes in the request permission value of each switch and compares its change pattern with the preset attack change pattern. The preset change pattern describes the characteristics of the attacker sending a large number of false requests but not actually forwarding them, causing the permission value to continue to decrease and cannot be recovered. When the attack behavior judgment module finds that the actual permission value change pattern of a switch meets the preset attack change pattern, the attack behavior confirmation module will intervene and make a final judgment to confirm that the switch is launching an attack behavior. This systematic implementation method enables methods that originally only remained at the logical level to be actually run, and conducts real-time and automated detection of attack behaviors in large-scale networks, solving the problem of difficult implementation of the method. Through the collaborative work between modules, the system can effectively identify control plane attacks characterized by sending false control requests and protect core network resources.

[0067] In some preferred embodiments, the present invention is specifically implemented as follows: the information network attack behavior detection system can be deployed on an SDN controller and run as a functional component of the controller or as an independent service. The request permission preset module can be specifically implemented as a configuration management interface and a persistent storage unit, such as a database table, which stores the identifiers of all switches in the network and their corresponding current request permission values. When the system starts or a new switch is connected, the request permission value is initialized for the switch through the configuration interface. The control request receiving module can be specifically implemented as a network monitoring service, which is bound to the southbound interface for communication between the controller and the switch, such as monitoring the Packet-In message of the OpenFlow protocol. The data processing setting module can be specifically implemented as a business logic processing service. This service receives messages forwarded by the control request receiving module, queries the database maintained by the request permission preset module, checks the permission value of the requesting switch, and if conditions are met, invokes the forwarding logic within the controller to process the request. It also updates the permission value of the switch in the database and inserts a record into another database table (e.g., a confirmation condition table) containing the data flow identifier corresponding to the request, the preset time limit, and the expected verification condition (e.g., the flow increment of the data flow within the time limit is greater than zero). If necessary, it also generates an associated credential (e.g., a unique transaction ID) and prepares to send it to the switch via the southbound interface. The confirmation credential response module can be specifically implemented as a message processing service. This service receives the confirmation credential message from the switch, verifies the validity of the credential (e.g., checks whether the associated ID exists in the confirmation condition table and has not expired). If valid, it deletes the corresponding record from the confirmation condition table and updates the database maintained by the request permission preset module, increasing the request permission value for the corresponding switch. The attack behavior judgment module can be implemented as a scheduled task or stream processing engine, which periodically reads the historical data of the permission value of each switch from the database of the permission request preset module, analyzes its changing trends, such as calculating the average rate of change over a period of time, the number of consecutive decreases, etc., and compares it with the preset attack pattern rules. The attack behavior confirmation module can be implemented as an event trigger. When the attack behavior judgment module issues a potential attack alarm, the trigger is activated and further confirmation logic is performed. For example, it checks whether the permission value continues to decrease in the short period after the alarm is generated and shows no signs of recovery. If it is confirmed to be an attack behavior, it can trigger an alarm notification to the administrator, record detailed logs, or invoke the controller's built-in defense mechanism, such as isolating the switch or limiting its control request rate.

[0068] Through the above-mentioned technical solution, the present invention provides an information network attack behavior detection system. This system, through a modular design, implements each step of the information network attack behavior detection method at the system level, thereby more effectively detecting and defending against malicious attacks. Specifically, through the dynamic management of request permission values ​​and a verification mechanism based on real data forwarding, the system can identify attacks characterized by sending false control requests and locate the source of the attack, thereby protecting controller resources and maintaining network stability, thus resolving the problem of the method being difficult to implement in actual systems.

[0069] The foregoing description is merely an embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Those skilled in the art will readily appreciate that the present invention is susceptible to various modifications and variations. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A method for detecting information network attack behavior, characterized in that: include Preset request permission values ​​for switches in the network; Receive control requests from the switch; After receiving the control request, based on the condition that the request permission value is greater than a preset threshold, the control request is processed, and the request permission value of the switch is deducted. At the same time, based on the data flow corresponding to the control request, a confirmation condition is set to verify whether a real data forwarding behavior occurs on the data flow; When the confirmation condition is satisfied within a preset time limit, receiving a corresponding confirmation certificate, and increasing the request permission value based on the confirmation certificate; Determine whether the switch has initiated an attack based on a preset change pattern; the preset change pattern is a change pattern in which the requested permission value continuously decreases due to a deduction operation and cannot be restored due to the absence of an increase operation; When the actual change pattern of the switch meets the preset change pattern, it is determined that the switch initiates an attack behavior.

2. The information network attack behavior detection method according to claim 1, characterized in that: The step of processing the control request after receiving the control request and deducting the request permission value of the switch based on the condition that the request permission value is greater than a preset threshold, and setting a confirmation condition for verifying whether a real data forwarding behavior is generated on the data flow based on the data flow corresponding to the control request includes: After receiving the control request, checking whether the control request carries the associated credentials; If not, the control request is determined to be an independent control request, and based on the condition that the request permission value is greater than a preset threshold, the control request is processed, the request permission value is deducted, and a confirmation condition is set based on the data flow corresponding to the control request. At the same time, an associated certificate is generated and sent to the switch; If it is carried, based on the validity of the associated certificate, it is determined that there is business correlation between the control request and the previous control request, so as to perform aggregation processing and eliminate the operation of repeated deduction of the request permission value.

3. The information network attack behavior detection method according to claim 1, characterized in that: When the confirmation condition is satisfied within a preset time limit, the step of receiving a corresponding confirmation certificate and increasing the requested permission value based on the confirmation certificate includes: Receive the confirmation certificate returned by the switch; Verifying the structural integrity and timestamp validity of the confirmation certificate; Based on the identification information of the preceding control request in the confirmation voucher, searching whether the corresponding confirmation condition is in a valid state; If the confirmation condition is in a valid state, the confirmation credential is determined to be valid, and the corresponding increment of the request permission value is added to the request permission value of the switch.

4. The method for detecting information network attack behavior according to claim 2, characterized in that: If the control request is carried, then based on the validity of the associated credential, determining whether there is a business correlation between the control request and the previous control request, so as to perform aggregation processing and exclude the operation of repeated deduction of the request permission value includes: Based on the associated credentials, obtain a corresponding preceding control request; querying the status of the data stream established by the preceding control request; When the state of the data flow is active, it is determined that there is a service correlation between the control request and the previous control request, so as to perform aggregation processing and eliminate the operation of repeated deduction of the request permission value.

5. The information network attack behavior detection method according to claim 4 is characterized in that: The step of querying the status of the data stream established by the preceding control request comprises: Obtain a first traffic statistic value of a data flow at a first moment; After a preset time interval, obtaining a second traffic statistic value of the data flow at a second moment; The first traffic statistics value is compared with the second traffic statistics value. If the second traffic statistics value is greater than the first traffic statistics value, it is determined that the state of the data flow is an active state.

6. The information network attack behavior detection method according to claim 5, characterized in that: The step of obtaining a second traffic statistic value of the data flow at a second moment after a preset time interval includes: Measuring and obtaining a statistical round trip period corresponding to the communication interaction of the first traffic statistical value; Inputting the statistical round trip period into a preset conversion logic, and using the output result of the preset conversion logic as a dynamic time interval; After the dynamic time interval has passed, a second traffic statistic value of the data flow at a second moment is obtained.

7. The information network attack behavior detection method according to claim 6, characterized in that: Before executing the step of inputting the statistical round trip period into a preset conversion logic and using the output result of the preset conversion logic as the dynamic time interval, the method further includes: Get the statistical round trip cycle of historical moments; Determine the benchmark cycle value based on the statistical round-trip cycle of historical moments; Based on the reference period value, the output value boundary of the preset conversion logic is updated.

8. The information network attack behavior detection method according to claim 7, characterized in that: The step of determining the reference period value based on the statistical round-trip period of historical moments includes: Among the statistical round-trip cycles of historical moments, exclude the statistical round-trip cycles that are greater than the preset maximum cycle threshold; A reference period value is determined based on the statistical round trip period after the elimination operation is completed.

9. The information network attack behavior detection method according to claim 8, characterized in that: The step of determining the reference period value based on the statistical round-trip period after the elimination operation is completed includes: The statistical round-trip cycle after the exclusion operation is completed is associated with the corresponding time information and stored; According to the preset time period division rules, the statistical round-trip cycle after associated storage is divided into several data sets according to the time period; For each of the data sets, determining a corresponding reference period value; Get the time period to which the current moment belongs; The base period value of the data set corresponding to the time period to which the current moment belongs is selected as the determined base period value.

10. An information network attack behavior detection system for performing information network attack behavior detection, characterized in that: include: A request permission preset module, used to preset request permission values ​​for switches in the network; A control request receiving module, configured to receive a control request from a switch; a data processing setting module, configured to, upon receiving the control request, process the control request based on the condition that the request permission value is greater than a preset threshold, deduct the request permission value of the switch, and, based on the data flow corresponding to the control request, set a confirmation condition for verifying whether a real data forwarding behavior occurs on the data flow; a confirmation credential response module, configured to receive a corresponding confirmation credential when the confirmation condition is satisfied within a preset time limit, and increase the request permission value based on the confirmation credential; An attack behavior determination module, configured to determine whether the switch has initiated an attack behavior based on a preset change pattern; the preset change pattern is a change pattern in which the requested permission value continuously decreases due to a deduction operation and cannot be restored due to the absence of an increase operation; The attack behavior confirmation module is used to determine whether the switch initiates an attack behavior when the actual change pattern of the switch meets the preset change pattern.

Images