Link flooding attack defense method and system based on data plane programmable SDN

Abstract

The invention provides a link flooding attack defense method and system based on a data plane programmable SDN (Software Defined Network), and relates to the technical field of network security defense. The method comprises the following steps: carrying out real-time clustering analysis on a Traceroute data packet passing through a switch by adopting an online clustering algorithm based on a weighted Manhattan distance, positioning a suspicious link and sending alarm information to a controller; establishing a link attribute graph sequence by collecting link state data based on the alarm information, and performing abnormal link identification by using a space-time double-attention detection model based on GAT-Seq2Seq to obtain an attack path; and identifying a link flooding attack flow by adopting an attack flow identification method based on reinforcement learning, and discarding the link flooding attack flow at a source end switch of an attack path. According to the method, the link flooding attack defense system with high accuracy, low resource overhead and quick response capability is constructed, so that efficient defense of attacks is realized.

Description

Technical Field

[0001] This invention relates to the field of network security defense technology, and in particular to a link flooding attack defense method and system based on data plane programmable SDN. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks are a type of attack where malicious hosts exhaust server resources, preventing the server from providing services to other users, posing a significant threat to the Internet. With the iterative updates of DDoS attacks, their methods have become increasingly complex. A new type of indirect DDoS attack—Link Flooding Attack (LFA)—has been proposed by the academic community and has attracted widespread attention. Unlike traditional DDoS attacks that directly consume the target server's CPU, memory, and other resources, LFA does not directly attack the target server. Instead, it concentrates on flooding critical links in the network, cutting off the target area's connection to the external network, indirectly preventing the target area from providing services to the outside world. Therefore, LFA has a severe impact on organizations that rely on backbone network critical links for energy distribution, financial transactions, government services, and remote industrial activities. Currently, existing LFA defense solutions are mainly divided into two categories:

[0003] (1) Data plane defense based on programmable switches: Ripple and Mew utilize programmable distributed defense primitives to develop defense strategies, including defense rules for detecting and mitigating different types of LFAs. For example, source and destination IP address pairs containing more than 1000 low-rate traffic (≤1KB) are considered Crossfire attacks. However, these rules rely on empirical static thresholds, which are difficult to determine in practice. Furthermore, threshold-based methods struggle to distinguish whether congestion is caused by LFAs, resulting in poor accuracy.

[0004] However, despite the line-speed processing capabilities of programmable switches (PLS) and their ability to analyze each data packet in real time, they face the following key challenges when independently performing attack defense tasks: ① Lack of a global network perspective: PLS can only perceive data flow information flowing locally and cannot obtain the global network topology and cross-device traffic distribution. This local perspective limits its ability to identify distributed attack behaviors, especially in LFA attacks, where attack traffic is distributed across multiple paths, making it difficult for a single switch to accurately determine the attack attributes of the traffic. ② Strictly limited computing and storage resources: PLS is designed for high-speed forwarding, thus facing strict constraints on computing and storage resources. On-chip storage such as SRAM and TCAM has limited capacity, and switches can only perform simple arithmetic and logical operations, unable to support complex statistical analysis algorithms.

[0005] (2) Control plane defense based on SDN controller: Ravi monitors changes in nine metrics on congested links, such as average link utilization and standard deviation of sent bytes, and determines whether LFA has occurred based on thresholds. Rasool uses LFA attack traffic to train an ANN module to mine the deep features of LFA attack flows to distinguish them from normal traffic. Kim focuses on network topology confusion and uses routing spoofing to induce attackers to generate incorrect topology information. Chen models the interaction between LFA attackers and defenders as a Bayesian game and proposes a random rerouting mechanism that increases the attacker's attack cost until it becomes unbearable and they abandon the attack. Rezapour continuously recalculates network paths after an attack to reroute data flows. The source IP address that changes the destination IP to cope with rerouting events is suspected of being an attack flow.

[0006] For the aforementioned control plane defense method based on SDN controllers, although the controller possesses powerful computing capabilities and a global perspective, concentrating all defense functions on the control plane also presents significant problems: ① Excessive management bandwidth overhead: If all traffic information is sent to the controller for analysis, the management bandwidth overhead between the controller and the switch will increase significantly. A large number of traffic statistics and status query requests will consume valuable southbound interface bandwidth resources, thereby affecting normal forwarding bandwidth and negatively impacting the overall forwarding performance of the network. ② Excessive defense response time: The complete process of collecting information from the data plane, sending it to the controller, performing complex analysis, and issuing defense strategies often results in excessively long response delays. Since LFA attacks can cause link congestion in a short time, excessively long response delays may cause defense measures to fail.

[0007] Therefore, while existing defense methods against link flooding attacks can detect whether a network is under attack to some extent, they are unable to provide efficient and accurate defense due to problems such as low accuracy, high network resource consumption, and high response latency. Summary of the Invention

[0008] To address the shortcomings of the existing technologies, this invention proposes a link flooding attack defense method and system based on a data plane programmable SDN through an innovative numerical control plane collaborative architecture and intelligent defense algorithm. The aim is to build a link flooding attack defense system with high accuracy, low resource overhead, and fast response capabilities, providing an effective technical means to cope with increasingly complex network security threats.

[0009] On one hand, this invention proposes a link flooding attack defense method based on a programmable SDN data plane. The method is implemented using an SDN architecture, which includes a programmable data plane and a control plane. The control plane and the programmable data plane interact with each other via a southbound interface. The control plane includes a controller, and the programmable data plane includes switches and links that support data plane programming. The method includes the following steps:

[0010] An online clustering algorithm based on weighted Manhattan distance is used to perform real-time clustering analysis on Traceroute data packets passing through each switch. Suspicious links are located by identifying malicious clusters, and alarm information is sent to the controller.

[0011] Based on alarm information, link status data of all links are collected and a link attribute graph sequence is generated. An abnormal link is identified by using a spatiotemporal dual attention detection model based on GAT-Seq2Seq to obtain the attack path.

[0012] Based on the reinforcement learning-based attack traffic identification method, the link flooding attack flow is identified by dynamically adjusting the traffic priority on the attack path, and the link flooding attack flow is dropped at the source switch of the attack path.

[0013] Furthermore, the specific content of using the online clustering algorithm based on weighted Manhattan distance to perform clustering analysis on the traceroute packets passing through each switch is as follows: For any switch, traceroute packets passing through that switch are collected in real time, and four-dimensional features are extracted from the collected traceroute packets to obtain a four-dimensional feature set of the traceroute packets; wherein the four-dimensional feature set includes: source IP address Destination IP address TTL value and data packet size ;

[0014] Set a capacity limit as Cluster set And the initial state of this cluster set is ;

[0015] For any traceroute packet If Traceroute data packets For the first arriving data packet, the first cluster is created directly for that data packet. and update If Traceroute data packets If it is not the first data packet to arrive, then calculate the Traceroute data packet separately. The weighted Manhattan distance to each cluster in the current cluster set;

[0016] If a Traceroute data packet exists With clusters If the weighted Manhattan distance is zero, then the Traceroute data packet will be... Classified into clusters Otherwise, it is a Traceroute packet. Create a new cluster and update the cluster set. until the cluster set Until the capacity limit is reached;

[0017] When clusters are set Once the capacity limit is reached, for each newly arrived Traceroute data packet, the weighted Manhattan distance between the Traceroute data packet and each cluster in the cluster set is calculated, and the Traceroute data packet is assigned to the cluster with the smallest weighted Manhattan distance. At the same time, the feature range and data packet counter of the cluster are updated; wherein the data packet counter is used to record the total number of data packets belonging to the cluster.

[0018] Furthermore, the specific content of identifying suspicious links by recognizing malicious clusters and sending alarm information to the controller is as follows:

[0019] For the current cluster set Arbitrary clusters in Calculate time slice Intra-cluster Cluster anomaly ;

[0020] For the current set of clusters All clusters are sorted in ascending order according to cluster anomaly to obtain an ordered sequence, and the quartiles of the ordered sequence are calculated.

[0021] The interquartile range is calculated using the quartiles, and then the upper bound outlier threshold is obtained. ;

[0022] For the current cluster set Random clusters ,when At that time, determine the cluster. This is a malicious cluster;

[0023] When the switch identifies a malicious cluster, it locates a suspicious link based on that cluster and constructs a lightweight digest packet based on that suspicious link. As an alarm message, the alarm message is then sent to the controller; whereby For the switch ID; Port ID; For timestamps.

[0024] Furthermore, based on alarm information, link status data of all links is collected and a link attribute graph sequence is generated. Anomaly link identification is then performed on the link attribute graph sequence using a spatiotemporal dual-attention detection model based on GAT-Seq2Seq, yielding the specific content of the attack path:

[0025] Based on alarm information, the controller dynamically calculates the sampling interval according to network traffic load. The data is then sent to the switch, which determines the frequency based on the sampling interval. Insert the INT instruction into the data packet;

[0026] Data packets carrying INT instructions collect link status data according to the INT instructions during transmission along the link;

[0027] Treating each link in the data plane as a node, for any node... According to the node Link state data generation node In time slice eigenvectors ,and ;in Indicates time slice Inner Passage Node The number of traceroute packets; Indicates time slice Queue length within: Indicates time slice Intra-queue latency; Indicates time slice Buffer delay within; Indicates time slice Internal link utilization; Indicates time slice Intra-link latency;

[0028] The relationships between links are viewed as edges between nodes, and the relationships are determined based on all nodes, all edges, and all nodes in time slices. eigenvectors to construct time slices Link attribute diagram Thus, we obtain the following: A sequence of link attribute graphs for consecutive time slices; where Represents a set of nodes; Represents the set of edges; Indicates time slice The node feature matrix;

[0029] The obtained link attribute graph sequence is input into the spatiotemporal dual attention detection model based on GAT-Seq2Seq for abnormal link identification, and the abnormal probability of each link is output.

[0030] For any link, if the probability of anomaly in the link is greater than a preset probability threshold, then the link is considered an attack path; otherwise, the link is considered a normal link.

[0031] Furthermore, the spatiotemporal dual attention detection model based on GAT-Seq2Seq includes, in sequence: an input module, a spatial feature extraction module based on GAT, an FNN feature fusion module, a temporal feature extraction module based on the Seq2Seq framework, and an output module.

[0032] The input module is used to input the link attribute graph sequence and transmit it to the GAT-based spatial feature extraction module, while simultaneously extracting the node feature matrix from the link attribute graph sequence. As a feature of the original link state;

[0033] The spatial feature extraction module based on GAT updates the feature vectors of each node in the link attribute graph sequence using a GAT structure based on a multi-head attention mechanism, and generates a node embedding representation that integrates neighborhood information by stacking multiple layers of GAT structures based on a multi-head attention mechanism. ;

[0034] The FNN feature fusion module uses a feedforward neural network to integrate the original link state features. Node embedding representation that integrates neighborhood information Perform deep fusion to generate a fused embedded representation. ;

[0035] The temporal feature extraction module based on the Seq2Seq framework uses a GRU-based Seq2Seq framework to perform fusion embedding representation. Perform time-series feature modeling to generate output sequences;

[0036] The time feature extraction module based on the Seq2Seq framework includes an encoder and a decoder; wherein the encoder is used to extract each time slice... Fusion Embedded Representation After being expanded into a one-dimensional vector, it is input into the GRU chain to extract temporal information step by step, generating a hidden state sequence. ;

[0037] The decoder is: for the first in the GRU chain... One GRU unit, using the softmax function to compute the hidden state sequence. Current decoding state of the current GRU unit Attention weights ; Utilize the hidden state of the previous GRU unit for output The final output of the previous GRU unit and hidden state sequence Current decoding state of the current GRU unit Attention weights Generate the final output of the current GRU unit. By integrating the final outputs of all GRU units in the GRU chain, the output sequence is obtained.

[0038] The output module uses a fully connected layer and a sigmoid activation function to map the output sequence and generate the anomaly probability for each node.

[0039] Furthermore, the node embedding representation that integrates neighborhood information The generation method is as follows:

[0040] For any node and nodes neighboring nodes And there are , Represents a node The set of first-order neighbors; Represents a node and neighboring nodes The edge between;

[0041] For any GAT structure based on the multi-head attention mechanism, the multi-head attention mechanism is used to compute the nodes separately. The node is updated by calculating the attention coefficients between itself and its neighboring nodes, and then using these attention coefficients to perform weighted aggregation of the features of the neighboring nodes. The feature vectors are used as the set of feature vectors output by the GAT structure based on the multi-head attention mechanism;

[0042] By stacking The GAT structure, based on a multi-head attention mechanism, propagates and fuses features from multi-hop neighbors layer by layer to generate node embedding representations that incorporate neighborhood information. .

[0043] Furthermore, the specific content of identifying link flooding attack flows by dynamically adjusting the traffic priority on the attack path according to the reinforcement learning-based attack traffic identification method, and discarding the link flooding attack flows at the source switch of the attack path, is as follows: initializing the agent and defining the agent's state space, action space and reward function; wherein the agent is used to learn the traffic priority allocation strategy.

[0044] A policy function is randomly generated and iteratively trained and optimized until the iteration termination condition is met, resulting in the optimal policy function. The specific content of each iteration process is as follows: the agent generates and executes the priority adjustment action for the current moment based on the current policy function, obtains the current reward value, generates the state for the next moment using a lightweight traffic statistics framework based on UnivMon+, and optimizes the policy function based on the current reward value. The iteration termination condition is the convergence of the reward function.

[0045] The agent adjusts the traffic priority on the attack path according to the optimal policy function and generates the agent state for the next time step using a lightweight traffic statistics framework based on UnivMon+. Based on the agent state for the next time step, it readjusts the traffic priority on the attack path according to the trained policy function, completing one iteration process. When the traffic priority on the attack path is continuous... When there is no change in the cycle, all low-priority traffic on the attack path is treated as a link flooding attack flow, and this link flooding attack flow is dropped at the source switch of the attack path.

[0046] Furthermore, the state space includes: priority level, byte transmission rate change value, data packet transmission rate change value, consistency cumulative score value, sequence similarity measure value, average byte transmission rate change value per traffic, average data packet transmission rate change value per traffic, information entropy change value based on destination IP address, variance change value based on destination IP address, information entropy change value based on source port, cardinality change value based on source port, and information entropy change value based on destination port.

[0047] The action space is represented as follows: ;in This indicates that the current traffic is assigned a high priority. This indicates that the current traffic is assigned a low priority.

[0048] The reward function is: for any traffic If traffic For legitimate flows and for intelligent agents to act as flows. Assign high priority or traffic For attack flow and the agent is the traffic If a low priority is assigned, the current reward value is 0; if the traffic... For attack flow and the agent is the traffic Assign high priority or traffic For legitimate flows and for intelligent agents to act as flows. If a low priority is assigned, the current reward value is the penalty value. ;in Indicates the base penalty coefficient; Indicates as of Constantly monitor this traffic The total number of decisions; Indicates as of Constantly monitoring traffic The cumulative number of incorrect decisions.

[0049] Furthermore, the lightweight traffic statistics framework based on UnivMon+ employs the Augmented Sketch stream processing framework, including parallel processing... The layer is a hybrid structure consisting of a min-heap and a Count Sketch data structure; wherein the min-heap is used to record the number of times high-frequency traffic occurs in the current sampling layer; and the Count Sketch data structure is used to estimate the frequency of low-frequency traffic that is not recorded in the min-heap.

[0050] Upon receiving a data packet, each layer first checks whether the data packet meets the sampling conditions and determines the target sampling layer to process the data packet.

[0051] Check the flow to which the packet belongs. If the packet has already been recorded in the min-heap of the target sampling layer, update the counter in the heap; otherwise, use the Count Sketch data structure to determine the stream to which the packet belongs. Frequency estimation is performed, and the set of Heavy Hitters is identified and saved in real time through hash mapping and counter update mechanism. The saved set of Heavy Hitters is then used as the output of the target sampling layer.

[0052] According to the Layer output Calculate the flow moment of this layer Using a recursive formula from the first... The process begins by recursively calculating the flow moment at each layer, and the moment estimate is obtained when the recursion reaches layer 0. According to moment estimation Generate the state of the agent in the next moment.

[0053] On the other hand, the present invention proposes a link flooding attack defense system based on data plane programmable SDN, which is used to implement the link flooding attack defense method based on data plane programmable SDN. The system includes: an attack alarm module, an attack confirmation module, and an attack flow identification module.

[0054] The attack warning module is used to collect Traceroute data packets in real time and perform cluster analysis using an online clustering algorithm based on weighted Manhattan distance. Then, it uses the cluster anomaly index and interquartile range detection algorithm to identify malicious clusters, thereby locating suspicious links and sending alarm information to the attack confirmation module.

[0055] The attack confirmation module collects link status data of all links based on alarm information and generates a link attribute graph sequence. It uses a spatiotemporal dual attention detection model based on GAT-Seq2Seq to identify abnormal links in the link attribute graph sequence, obtains the attack path, and transmits it to the attack flow identification module.

[0056] The attack flow identification module is used to identify link flooding attack flows by dynamically adjusting the traffic priority on the attack path according to the reinforcement learning-based attack traffic identification method, and to discard the link flooding attack flow at the source switch of the attack path.

[0057] The beneficial effects of adopting the above technical solution are as follows:

[0058] (1) Numerical control plane collaborative defense architecture: This invention constructs a numerical control plane collaborative defense system: the attack alarm module is deployed on the P4 switch to achieve millisecond-level threat perception, the attack confirmation module performs in-depth analysis on the SDN controller, and the attack flow identification module achieves precise defense through intelligent traffic scheduling. This layered design ensures both real-time performance and detection accuracy.

[0059] (2) Data plane real-time attack alarm mechanism: This invention designs a lightweight online clustering algorithm adapted to P4 switches. The algorithm extracts the four-dimensional features of Traceroute data packets and performs real-time clustering analysis using weighted Manhattan distance. Then, it judges the abnormal clustering pattern through the cluster anomaly index. It can quickly identify malicious probe packet clusters under online conditions and realize early warning of attacks.

[0060] (3) Attack confirmation method based on spatiotemporal feature fusion: The GAT-Seq2Seq spatiotemporal dual attention attack detection model proposed in this invention captures the spatial dependency relationship of the link topology through the GAT layer, extracts the temporal evolution law through Seq2Seq, and introduces the attention mechanism to solve the information bottleneck problem, thereby achieving accurate reconstruction of the attack path and accurate location of the attack source.

[0061] (4) Accurate identification of attack flow based on deep reinforcement learning: Due to the essential difference of attack flow without congestion feedback, this invention dynamically adjusts traffic priority through PPO algorithm, that is, designs a twelve-dimensional state space to cover the dynamic behavior of single flow and global features, observes the difference in traffic response to priority changes, and effectively suppresses attack flow while ensuring the quality of service of legitimate traffic.

[0062] (5) Fine-grained traffic measurement based on the lightweight traffic statistics framework of UnivMon+: In view of the limitations of the traditional OpenFlow switch flow table statistics field with limited capacity and only able to perform aggregation matching, this invention deploys a lightweight Sketch data structure in the SRAM / TCAM memory of the P4 switch and uses a hierarchical sampling structure to realize real-time information statistics for each traffic flow forwarded at high speed, breaking through the limitation of the traditional architecture that cannot obtain fine-grained single-flow statistics information.

[0063] (6) INT adaptive sampling mechanism: The present invention designs an intelligent INT sampling strategy, which dynamically adjusts the sampling interval to cope with different network load conditions. When the network is under high load, the sampling frequency is reduced to reduce system overhead, and when the network is under low load, the sampling frequency is increased to capture key information, thus solving the resource pressure and bandwidth occupation problem of telemetry data processing in large-scale network environments. Attached Figure Description

[0064] Figure 1 This is a flowchart of the link flooding attack defense method based on data plane programmable SDN in this embodiment;

[0065] Figure 2 This is a schematic diagram of the sampling process of the adaptive sampling mechanism based on traffic load in this embodiment;

[0066] Figure 3 This is the overall framework diagram of the spatiotemporal dual attention detection model based on GAT-Seq2Seq in this embodiment;

[0067] Figure 4 This is a schematic diagram of the spatial feature extraction module based on GAT in this embodiment;

[0068] Figure 5 This is a schematic diagram of the time feature extraction module based on the Seq2Seq framework in this embodiment;

[0069] Figure 6 This is a flowchart illustrating the attack traffic identification method based on reinforcement learning in this embodiment.

[0070] Figure 7 This is a schematic diagram of the programmable packet scheduling process based on a P4 switch in this embodiment;

[0071] Figure 8 This is a schematic diagram of traffic measurement based on the lightweight traffic statistics framework of UnivMon+ in this embodiment.

[0072] Figure 9 This is a schematic diagram of the link flooding attack defense system based on data plane programmable SDN in this embodiment. Detailed Implementation

[0073] To facilitate understanding of this application, specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. The following embodiments are illustrative of the invention but are not intended to limit its scope. Rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of this application.

[0074] Given the limitations of single-plane defense, multi-plane collaboration becomes a key approach to overcoming the aforementioned challenges. This implementation, through reasonable functional division and collaborative mechanism design, can fully leverage the advantages of both planes: 1) Finding a balance between detection accuracy and response time: The data plane is responsible for lightweight initial alerts, quickly detecting potential threats; the control plane is responsible for in-depth analysis, providing highly accurate attack determination. This layered architecture ensures both rapid response and detection accuracy. 2) Optimized resource utilization: Computationally intensive tasks are rationally allocated to the control plane, while latency-sensitive tasks are reserved for the data plane, achieving efficient utilization of network resources and avoiding overload of either plane.

[0075] Example 1:

[0076] This embodiment presents a link flooding attack defense method based on a programmable SDN data plane. The method is implemented using an SDN architecture, which includes a programmable data plane and a control plane. The control plane and the programmable data plane interact via a southbound interface. The control plane includes a controller for centralized management of network policies, monitoring traffic status, and dynamically issuing flow table rules. The programmable data plane includes switches and links that support data plane programming, used to perform packet forwarding, local anomaly detection, and lightweight alarms according to the rules issued by the controller. Figure 1 As shown, the method includes the following steps:

[0077] An online clustering algorithm based on weighted Manhattan distance is used to perform real-time clustering analysis on Traceroute data packets passing through each switch. By identifying malicious clusters, suspicious links are located and alarm information is sent to the controller.

[0078] For any switch, real-time acquisition of traceroute data packets passing through the switch is performed, and four-dimensional feature extraction is performed on the acquired traceroute data packets to obtain the four-dimensional feature set of the traceroute data packets.

[0079] The four-dimensional feature set includes: source IP address Destination IP address TTL value and data packet size .

[0080] Set a capacity limit as Cluster set And the initial state of this cluster set is .

[0081] For any traceroute packet If Traceroute data packets For the first arriving data packet, the first cluster is created directly for that data packet. and update If Traceroute data packets If it is not the first data packet to arrive, then calculate the Traceroute data packet separately. The weighted Manhattan distance to each cluster in the current cluster set.

[0082] (1)

[0083] in Indicates Traceroute data packets With clusters The weighted Manhattan distance, and ; Represents a four-dimensional feature set Any feature in; Representation of features The weight vector can be optimized through experiments; Indicates Traceroute data packets With clusters For features The one-dimensional distance, and we have:

[0084] (2)

[0085] in Indicates Traceroute data packets In features Eigenvalues ​​on; Represents clusters In features The maximum value on; Represents clusters In features The minimum value on.

[0086] If a Traceroute data packet exists With clusters If the weighted Manhattan distance is zero, then the Traceroute data packet will be... Classified into clusters Otherwise, it is a Traceroute packet. Create a new cluster and update the cluster set. until the cluster set Until the capacity limit is reached.

[0087] When clusters are set Once the capacity limit is reached, for each newly arrived Traceroute data packet, the weighted Manhattan distance between the Traceroute data packet and each cluster in the cluster set is calculated, and the Traceroute data packet is assigned to the cluster with the smallest weighted Manhattan distance. At the same time, the feature range and data packet counter of the cluster are updated; wherein the data packet counter is used to record the total number of data packets belonging to the cluster.

[0088] For each feature dimension The minimum and maximum values ​​of the clusters are updated using a range expansion strategy, with the specific update rules as follows:

[0089] (3)

[0090] For the current cluster set Random clusters Calculate time slice Intra-cluster Cluster anomaly .

[0091] (4)

[0092] in Indicates belonging to a cluster The total number of traceroute packets; As an adjustment factor, this embodiment takes into account the computational resource constraints of the programmable data plane and adopts a shift operation-based adjustment factor setting. By shifting to the right The bit is multiplied by The operation; Represents clusters In features The evaluation function value on, and we have:

[0093] (5)

[0094] in This represents the binary XOR operation.

[0095] In this implementation, a Cluster Anomaly Score (CAS) is defined to quantitatively evaluate the degree of anomaly in each cluster. It is important to note that, considering the computational resource constraints of the programmable data plane, a shift-based adjustment factor is used. In actual deployment, the appropriate factor should be selected based on the network environment and the number of feature dimensions. Value, making This metric is always true. Its design is based on the observation that malicious probe traffic often exhibits high consistency in its characteristics, resulting in lower evaluation function values ​​for clusters. Furthermore, because attackers control a large number of botnets to launch probes, the number of packets belonging to malicious clusters is usually large. In contrast, normal network traffic typically exhibits greater randomness and diversity across various feature dimensions, leading to relatively higher evaluation function values, while the number of packets within a single cluster is relatively limited. Therefore, the higher the cluster anomaly score, the greater the likelihood that the cluster contains malicious probe traffic.

[0096] For the current set of clusters The cluster anomalies of all clusters are sorted in ascending order to obtain an ordered sequence, and the quartiles of the ordered sequence are calculated.

[0097] Calculate the first quartile Location for:

[0098] (6)

[0099] in Represents the current set of clusters. The number of clusters in; if If it is an integer, then the first quartile ,like If it is a decimal, then let And there are:

[0100] (7)

[0101] in Indicates that the index value in the ordered sequence is Cluster anomaly; Indicates that the index value in the ordered sequence is Cluster anomaly.

[0102] Third quartile With the first quartile The calculation method is the same, but the third and quartiles Location for:

[0103] (8)

[0104] In this embodiment, since the programmable data plane does not support floating-point representation or arithmetic operations such as division and modulo, fixed-point representation and integer arithmetic are used in actual implementation to approximate the operation. For example, shift operations are used to optimize the division by 4 operation. .

[0105] The interquartile range is calculated using the quartiles, and then the upper bound outlier threshold is obtained. .

[0106] (9)

[0107] (10)

[0108] in Indicates the interquartile range; This represents the outlier coefficient, which is usually 1.5 or 3.

[0109] For the current cluster set Random clusters ,when At that time, determine the cluster. This is a malicious cluster.

[0110] When the switch identifies a malicious cluster, it locates the suspicious link based on the malicious cluster and constructs a lightweight digest packet. As an alarm message, the alarm message is then sent to the controller; whereby For the switch ID; Port ID; For timestamps.

[0111] In this embodiment, once the interquartile range (ICM) anomaly detection algorithm identifies a malicious cluster, the programmable data plane immediately sends an alarm message to the controller to trigger the subsequent fine-grained attack confirmation process. By analyzing the common anomaly characteristics of all paths in the malicious cluster, the physical location (switch + port) of the suspicious link is located. To achieve an efficient alarm upload mechanism, the digest() method provided by P4 is used to construct a lightweight digest data packet, i.e., the alarm message, and send it to the controller. The controller obtains the link identification information in the digest data packet by parsing the digest message, and locates the specific network location that may be under attack.

[0112] Based on alarm information, link status data of all links are collected and a link attribute graph sequence is generated. An abnormal link is identified by using a spatiotemporal dual attention detection model based on GAT-Seq2Seq to obtain the attack path.

[0113] This paper proposes an efficient link-state acquisition and modeling method using in-band network telemetry (INT). An adaptive sampling mechanism based on traffic load is described in this embodiment. Figure 2 As shown, the core idea of ​​this mechanism is to dynamically adjust the sampling interval based on network traffic density, minimizing redundant acquisition and effectively reducing bandwidth overhead while ensuring measurement accuracy. Based on the collected multidimensional state data and other attributes calculated from these states, a link graph structure and node feature representation are constructed, providing a data foundation for the input of subsequent attack detection models.

[0114] Based on alarm information, the controller dynamically calculates the sampling interval according to network traffic load. The data is then sent to the switch, which determines the frequency based on the sampling interval. Insert the INT instruction into the data packet.

[0115] (11)

[0116] in Indicates the sampling interval; and All represent adjustment coefficients; Indicates time slice The total number of data packets passing through the switch reflects the current network traffic load. Indicates time slice The variance of internal traffic variation is used to measure the degree of fluctuation in network status. When the network is under high load, Larger, corresponding Increase the sampling frequency to avoid excessive INT overhead; when the network load is low but the state changes drastically, Smaller Larger Accordingly, the sampling frequency is reduced and increased to capture rapidly changing network states.

[0117] Data packets carrying INT instructions collect link status data according to the INT instructions during transmission along the link.

[0118] Based on the link state data obtained using the aforementioned INT adaptive sampling method, it is necessary to organize the discrete link state information into a link graph structure and construct corresponding node feature representations. Since the execution flow of a link flooding attack has strict temporal dependencies, namely:

[0119] (1) During the attack preparation phase, the attacker obtains network topology information through large-scale traceroute probing, which causes a sharp increase in traceroute traffic on the relevant links. After the topology collection is completed, the attack moves to the path analysis phase, and the probing traffic quickly drops back to normal levels, forming a typical timing pattern of "first rise and then fall".

[0120] (2) The performance indicators of the target area links exhibit distinctly different temporal characteristics at different attack stages. During the topology probing and target selection stages, the performance indicators of the target links, i.e., the attack paths, such as bandwidth utilization and queue length, remain stable. When the attackers begin to coordinate bot hosts to send massive amounts of low-speed streams, the performance of the target links deteriorates sharply, manifesting as abnormal phenomena such as a surge in link bandwidth utilization, a continuous increase in queue length, and a significant increase in link latency, exhibiting a temporal transition characteristic from "stable to surge".

[0121] Treating each link in the data plane as a node, for any node... According to the node Link state data generation node In time slice eigenvectors ,and ;in Indicates time slice Inner Passage Node The number of traceroute packets; Indicates time slice Queue length within: Indicates time slice Intra-queue latency; Indicates time slice Buffer delay within; Indicates time slice Internal link utilization; Indicates time slice Link latency within the network.

[0122] Based on the above time correlation analysis, six key features are selected to construct the feature vector of the node, namely:

[0123] (1) Passing through nodes Number of Traceroute packets In the P4 programmable data plane, Traceroute packets are identified by matching the IP protocol number and ICMP type field in the packet header extracted by the parser, and then... The counter performs counting and statistics.

[0124] (12)

[0125] in Indicates time slice Internal through nodes The total number of traceroute packets; Indicates time slice Internal through nodes The data packet index value; As an indicator function, when the data packet When using the Traceroute package The value is 1 if it is not 0 otherwise.

[0126] (2) Queue length This feature is achieved through the inherent metadata in the switch. This metadata records the queue depth at the time a packet leaves the queue, i.e., how many packets are still waiting in line when a packet leaves the queue. To smooth out instantaneous fluctuations and capture overall trends, time slices are calculated. The average queue length observed for all packets within the time slice is used as the time slice. queue length .

[0127] (13)

[0128] in Indicates time slice Internal through nodes The total number of data packets carrying INT instructions; Indicates time slice Internal through nodes The index value of the data packet carrying the INT instruction; Indicates the first The queue depth when a data packet carrying an INT instruction is dequeued.

[0129] (3) Queue delay This feature is achieved through inherent metadata. Precise measurement; this metadata records the time interval from when a data packet is added to the queue to when it leaves the queue, thus allowing for the calculation of time slices. The average queue delay within the time slice is used as the time slice. Intra-queue latency .

[0130] (14)

[0131] in Indicates the first Queue delay value for each data packet.

[0132] (4) Buffer delay This feature is obtained by calculating the difference between the exit timestamp and the entry timestamp of the data packet.

[0133] (15)

[0134] in Indicates the timestamp of the data packet leaving the switch; through inherent metadata. Obtain; This indicates the timestamp when the data packet entered the switch, through inherent metadata. Obtain.

[0135] (5) Link utilization : By statistical time slices Calculate the ratio of the number of bytes of traffic within the link to the link capacity.

[0136] (16)

[0137] in For data packets The size in bytes; This refers to the link bandwidth capacity. For time slices The length.

[0138] (6) Link delay This feature is calculated using the timestamp difference between adjacent switches in the INT mechanism. Specifically, when a data packet leaves the current switch, the egress timestamp is recorded, and when it arrives at the next-hop switch, the ingress timestamp is recorded. The difference between the two is the link delay, expressed as:

[0139] (17)

[0140] in For the first The timestamp of a data packet carrying an INT instruction leaving the current switch; This is the timestamp of the data packet arriving at the next-hop switch. Using the INT protocol, this timestamp information is encapsulated in the packet header and can be extracted and calculated at subsequent nodes.

[0141] The relationships between links are viewed as edges between nodes, and the relationships are determined based on all nodes, all edges, and all nodes in time slices. eigenvectors to construct time slices Link attribute diagram Thus, we obtain the following: A sequence of link attribute graphs for consecutive time slices; where Represents a set of nodes; Represents the set of edges; Indicates time slice The node feature matrix, containing all nodes in the time slice eigenvectors, and , Indicates the number of nodes.

[0142] In this embodiment, all abnormal links are obtained by binary classification of all nodes; finally, starting from an abnormal link, the relationship between links is traced to find continuous abnormal links and form a path.

[0143] The obtained link attribute graph sequence is input into a spatiotemporal dual attention detection model based on GAT-Seq2Seq for abnormal link identification, and the abnormal probability of each link is output.

[0144] Regarding the propagation characteristics of link flooding attacks in network topology and the temporal evolution patterns of attack traffic, such as... Figure 3 As shown, this embodiment proposes a spatiotemporal dual attention model, GAT-Seq2Seq, which combines Graph Attention Network (GAT) and Sequence to Sequence (Seq2Seq) models. This model can simultaneously capture the spatial dependencies between nodes in the network topology and the temporal patterns of traffic evolution, achieving accurate identification of abnormal links and reconstruction of attack propagation paths through deep fusion of spatiotemporal features.

[0145] The spatiotemporal dual attention detection model based on GAT-Seq2Seq includes, in sequence: an input module, a spatial feature extraction module based on GAT, an FNN feature fusion module, a temporal feature extraction module based on the Seq2Seq framework, and an output module.

[0146] The input module is used to input the link attribute graph sequence and transmit it to the GAT-based spatial feature extraction module, while simultaneously extracting the node feature matrix from the link attribute graph sequence. As a feature of the original link state.

[0147] The spatial feature extraction module based on GAT updates the feature vectors of each node in the link attribute graph sequence using a GAT structure based on a multi-head attention mechanism, and generates a node embedding representation that integrates neighborhood information by stacking multiple layers of GAT structures based on a multi-head attention mechanism. .

[0148] For any node and nodes neighboring nodes And there are , Represents a node The set of first-order neighbors; Represents a node and neighboring nodes The edges between them.

[0149] like Figure 4 As shown, for any GAT structure based on a multi-head attention mechanism, the multi-head attention mechanism is used to compute the nodes separately. The node is updated by calculating the attention coefficients between itself and its neighboring nodes, and then using these attention coefficients to perform weighted aggregation of the features of the neighboring nodes. The feature vectors are used as the set of feature vectors output by the GAT structure based on the multi-head attention mechanism.

[0150] (18)

[0151] (19)

[0152] (20)

[0153] in Indicates the first Normalized attention coefficients for each attention head; LeakyReLU is a non-linear activation function; Indicates the first The attention function of the first attention head is used to calculate the correlation between the feature vectors of two nodes. A single-layer feedforward neural network structure is employed. The weight vector of each attention head accomplish; Indicates the first A linear transformation matrix for each attention head; Representing neighboring nodes In time slice eigenvectors; Indicates the first Each node outputs attention. eigenvectors; For activation functions; Represents a node Updated feature vector; The total number of attention heads.

[0154] The advantages of multi-head attention mechanisms lie in allowing the model to capture multiple correlation patterns between links from different representation subspaces; enhancing the model's robustness and avoiding biases that may arise from a single attention head; and improving the model's ability to recognize complex attack patterns. However, considering the multi-hop propagation characteristics of link flooding attacks, a single-layer GAT may not be able to fully capture the dependencies between long-distance links. Therefore, a multi-layer GAT structure is adopted, through stacking... The attention layer in the layered graph expands the receptive field. Through multi-layer propagation, each node can aggregate information from a wider neighborhood, effectively capturing the remote propagation pattern of attack traffic.

[0155] By stacking The GAT structure, based on a multi-head attention mechanism, propagates and fuses features from multi-hop neighbors layer by layer to generate node embedding representations that incorporate neighborhood information. .

[0156] (twenty one)

[0157] in Represents the adjacency matrix; Indicates the first The set of feature vectors output by the GAT structure based on the multi-head attention mechanism; Indicates the first The set of feature vectors output by the GAT structure based on the multi-head attention mechanism; This indicates a stacking process, where the set of input feature vectors for each layer is built upon the set of output feature vectors for the previous layer. The set of feature vectors input to the first layer of the GAT structure based on multi-head attention mechanism, and has .

[0158] In this embodiment, after After layer GAT processing, each node obtains an embedded representation containing rich spatial information. However, these embedded representations mainly reflect the topological relationships between links, and may weaken the original temporal features of the nodes themselves during the aggregation of neighbor information. To compensate for the lost temporal features, a feature fusion module based on a feedforward neural network is designed to integrate the original link state features. Spatial embedding with GAT output The feedforward neural network employs a two-layer fully connected structure, achieving deep feature fusion through nonlinear transformation. This design preserves key information from the original temporal features while fully utilizing the spatial correlation features extracted by GAT, providing a more comprehensive and robust input representation for subsequent temporal modeling.

[0159] The FNN feature fusion module uses a feedforward neural network to integrate the original link state features. Node embedding representation that integrates neighborhood information Perform deep fusion to generate a fused embedded representation. .

[0160] (twenty two)

[0161] (twenty three)

[0162] in This indicates the blending characteristics after splicing; Indicates a splicing operation; This indicates that a feedforward neural network is used for deep fusion.

[0163] The temporal feature extraction module based on the Seq2Seq framework uses a GRU-based Seq2Seq framework to perform fusion embedding representation. Perform time-series feature modeling to generate output sequences.

[0164] To effectively capture long-term temporal dependencies, such as Figure 5 As shown, this embodiment employs a Seq2Seq framework based on GRU units to perform temporal modeling of the fused feature sequences. GRU, as a simplified variant of LSTM, maintains good long-term memory capabilities while having fewer parameters and faster training speed, making it particularly suitable for attack detection scenarios with high real-time requirements. However, traditional Seq2Seq models rely solely on the final hidden state of the encoder for decoding, and this information bottleneck problem is particularly prominent when processing long sequences. To overcome this information bottleneck problem, an attention mechanism is introduced into the decoder, enabling the decoding process to dynamically focus on information from different time steps in the encoder, thereby improving the model's ability to perceive sudden changes in link states and attack patterns.

[0165] The temporal feature extraction module based on the Seq2Seq framework consists of two parts: an encoder and a decoder.

[0166] The encoder described therein is: which converts each time slice Fusion Embedded Representation Expand into a one-dimensional vector The time sequence information is then extracted step by step from the GRU chain to generate a hidden state sequence. .

[0167] The decoder is: for the first in the GRU chain... One GRU unit, using the softmax function to compute the hidden state sequence. Current decoding state of the current GRU unit Attention weights , represented as:

[0168] (twenty four)

[0169] (25)

[0170] (26)

[0171] in This is the weight vector; Weight vector The elements in the table are used to represent the historical number. The time slice for the current time slice Influence factors of each prediction time slice; This is the normalized weight vector; Weight vector The elements in the table are used to represent the historical number. The time slice for the current time slice Influence factors of each prediction time slice.

[0172] Output using the hidden state of the previous GRU unit The final output of the previous GRU unit and hidden state sequence Current decoding state of the current GRU unit Attention weights Generate the final output of the current GRU unit. By integrating the final outputs of all GRU units in the GRU chain, the output sequence is obtained. .

[0173] In this embodiment, the final output of the GRU unit is determined by... , and The model is obtained by splicing together the data. Through the above-mentioned GRU-based Seq2Seq time feature extraction mechanism, the model can not only capture the long-term evolution trend of the link state, but also dynamically focus on key historical information through the attention mechanism, effectively improving the modeling ability of link flooding attack time sequence patterns.

[0174] The output module uses a fully connected layer and a sigmoid activation function to process the output sequence. The mapping generates the anomaly probability for each node, expressed as:

[0175] (27)

[0176] in Represents a node The probability of an anomaly, and ; Indicates the bias term; Indicates the weights of the fully connected layer; This represents the elements in the output sequence; This represents the sigmoid activation function.

[0177] In this embodiment, the entire GAT-Seq2Seq model is trained using an end-to-end supervised learning approach, with the optimization objective being to minimize the difference between the predicted anomaly probability and the true label. This design allows the model to fully utilize the spatial information of the network topology and the temporal information of traffic evolution, achieving accurate detection and path reconstruction of link flooding attacks. Specifically, CAIDA is used as the background traffic, and iperf3 is used to generate TCP / UDP attack traffic to construct the training dataset. Nodes representing model predictions The probability of an anomaly, This represents the true label of the node, with 1 for abnormal and 0 for normal. Mean Squared Error (MSE) is used as the loss function. By minimizing this loss function, the model can learn the mapping relationship between the spatiotemporal features of the link state and abnormal patterns, thereby achieving accurate detection of link flooding attacks. During training, the backpropagation algorithm is used to calculate gradients and update model parameters, gradually improving the model's detection accuracy.

[0178] For any link, if the probability of anomaly in the link is greater than a preset probability threshold, then the link is considered an attack path; otherwise, the link is considered a normal link.

[0179] Based on the reinforcement learning-based attack traffic identification method, the link flooding attack flow is identified by dynamically adjusting the traffic priority on the attack path, and the link flooding attack flow is dropped at the source switch of the attack path.

[0180] In this embodiment, due to the TCP congestion control mechanism, the sending rate of legitimate traffic gradually decreases when its priority is lowered, and conversely, gradually increases when its priority is higher. However, when the priority of attack traffic is lowered or higher, since it typically does not rely on the TCP congestion control mechanism, the sender does not adjust the traffic based on network feedback, and its flow rate does not show a significant trend. Given the dynamic fluctuations in traffic caused by the complex network environment, it may increase, decrease, or remain unchanged.

[0181] Therefore, this embodiment proposes an attack traffic identification method based on reinforcement learning by actively adjusting traffic priorities to induce different responses from legitimate and attack traffic, learning the complex mapping relationship between different responses and priority-controlled flow types. Figure 6 As shown, the red and yellow lines indicate the training process of the agent and the detection process of attack flows based on traffic scheduling according to the optimal policy function, respectively. First, the priorities of different traffic flows in the attacked link are dynamically adjusted to induce changes in the network state. The agent is rewarded for correct actions and penalized for incorrect actions. The agent then analyzes state characteristics such as changes in the transmission rates of different data flows and initiates updated traffic priority adjustments. This process is repeated until the agent gradually learns an optimal traffic scheduling policy. Under this policy, legitimate traffic naturally receives high priority to ensure efficient transmission, while attack traffic is given low priority, significantly limiting resource consumption.

[0182] Initialize the agent and define its state space, action space, and reward function; wherein the agent is used to learn traffic priority allocation strategies.

[0183] The state space includes: priority level, byte transmission rate change value, data packet transmission rate change value, consistency cumulative score value, sequence similarity metric value, average byte transmission rate change value per traffic, average data packet transmission rate change value per traffic, information entropy change value based on destination IP address, variance change value based on destination IP address, information entropy change value based on source port, cardinality change value based on source port, and information entropy change value based on destination port.

[0184] In this embodiment, due to the inherent difference of attack flows lacking congestion feedback, the PPO algorithm dynamically adjusts traffic priorities. A twelve-dimensional state space is designed to define the state representation of each flow, covering the dynamic behavioral characteristics of a single flow and the global characteristics of the overall traffic. The differences in traffic responses to priority changes are observed, effectively suppressing attack flows while ensuring the quality of service for legitimate traffic. For any flow... , will traffic The twelve characteristic indicators specifically include:

[0185] 1. Priority Level If the last time the traffic was... If assigned a high priority, then the traffic exist The priority level of time is If the last time the traffic was... If assigned a low priority, then .

[0186] 2. Byte transmission rate change value : By calculating the flow exist Byte transmission rate and flow rate at any given time exist Get traffic by byte transmission rate at any given time exist The change in the byte transmission rate at any given time.

[0187] 3. Changes in data packet transmission rate : By calculating the flow exist Data packet sending rate and traffic at any given time exist Traffic is obtained from the data packet sending rate at any given time. exist The change in the data packet transmission rate at any given time.

[0188] 4. Cumulative Consistency Score The cumulative consistency score directly reflects the degree of consistency between traffic priority adjustments and rate changes. That is, for any given time, if the traffic... Assigned with high priority and the byte transmission rate change value increases, or the traffic... When a data point is assigned a low priority and the byte transmission rate change value decreases, the change is considered consistent; in this case, the traffic... The current rating is 1. Conversely, if the traffic... Assigned as high priority but the byte transmission rate change value did not increase, or the traffic... If a data point is assigned a low priority but the byte transmission rate change value does not decrease, it is considered to have inconsistent changes; in this case, the traffic... The score at the current moment is 0. This is determined by calculating the flow. Until Average rating up to time and used as traffic exist Consistency cumulative score over time.

[0189] 5. Sequence similarity measure : Traffic Consistency cumulative score sequence Divided into the first half and the second half The similarity between two sequences is measured using the Dynamic Time Warping (DTW) method, which calculates the DTW distance between the sequences. The calculation method is as follows: Construct... and pairwise element distance matrix Construct the cumulative cost matrix using dynamic programming. From the end of the cumulative cost matrix Perform backtracking to find the optimal matching path The DTW distance between the two sequences is calculated along the optimal path and expressed as:

[0190] (28)

[0191] (29)

[0192] (30)

[0193] 6. Average change in transmission rate per byte of data For all currently monitored traffic The sum of the byte transmission rate changes at each moment is divided by the total number of currently monitored traffic to obtain the average byte transmission rate change per traffic stream.

[0194] 7. Average change in the transmission rate per data packet For all currently monitored traffic The sum of the data packet transmission rate changes at each moment is divided by the total number of currently monitored traffic to obtain the average data packet transmission rate change per traffic segment.

[0195] 8. Information entropy change value based on destination IP address First, the probability of each destination IP address is obtained by calculating the ratio of the number of occurrences of each destination IP address to the total number of data packets. Second, the probability of all destination IP addresses is used to calculate... The entropy value is calculated based on the destination IP address at each moment; finally, the calculation is performed. Entropy value based on destination IP address at any time The difference between the entropy values ​​based on the destination IP address at any given moment is obtained. The information entropy change value based on the destination IP address at any given time.

[0196] The Entropy value based on destination IP address at any time Represented as:

[0197] (31)

[0198] in It is the number of different destination IP addresses; For the first The probability of a destination IP address.

[0199] 9. Variance variation based on destination IP address First, by summing the frequency estimates of all destination IP addresses, the frequency of the destination IP address in the range of [the specified range] is calculated. The frequency estimate is the average value at each time point; secondly, based on the frequency estimates of all destination IP addresses and the destination IP addresses at... The frequency estimate of the average value at time point is calculated. The variance based on the destination IP address at each moment; finally, calculate... Variance based on destination IP address at any given time The difference between the variances of the destination IP addresses at each moment is obtained. The variance change value based on the destination IP address at any given time.

[0200] The Variance based on destination IP address at any given time Represented as:

[0201] (32)

[0202] in Indicates the first Frequency estimation of destination IP addresses; Indicates the destination IP address is in The average frequency estimate for each time point.

[0203] 10. Information entropy change value based on source port Similarly, by calculating the ratio of the occurrence frequency of each source port to the total number of data packets, the probability of each source port number is obtained; using the probabilities of all source port numbers, the following calculations are performed. The entropy value based on the source port number at any given moment; calculation The entropy value based on the source port number at any given time and The difference between the entropy values ​​based on the source port number at any given time is obtained. The information entropy change value based on the source port at any time.

[0204] The Entropy value based on source port number at any given time Represented as:

[0205] (33)

[0206] in The number of different source port numbers; For the first The probability of each source port number.

[0207] 11. Radix change value based on source port Calculate the probability based on the source port number. The time is based on the base of the source port number, and is calculated. The radix of the time based on the source port number The difference between the base values ​​of the source port numbers at each moment is obtained. The base value changes based on the source port at any given time.

[0208] The The radix of the time based on the source port number Represented as:

[0209] (34)

[0210] 12. Information entropy change value based on destination port First, the probability of each destination port number is obtained by calculating the ratio of the number of occurrences of each destination port to the total number of data packets. Second, the probability of all destination port numbers is used to calculate... The entropy value is calculated based on the destination port number at each moment; finally, the entropy value is calculated. The entropy value based on the destination port number at any given time The difference between the entropy values ​​based on the destination port number at any given time is obtained. The information entropy change value based on the destination port at any time.

[0211] The Entropy value based on destination port number at any time Represented as:

[0212] (35)

[0213] in The number of different destination port numbers; For the first The probability of a destination port number.

[0214] The action space is represented as follows: ;in This indicates that the current traffic is assigned a high priority. This indicates that the current traffic is assigned a low priority.

[0215] In this embodiment, the action taken by the current traffic will directly affect the scheduling and processing of the target traffic in the network.

[0216] In traffic scheduling tasks, the reward function needs to guide the agent to prioritize the quality of service (QoS) of legitimate traffic while limiting the excessive consumption of network resources by attack traffic. The agent should learn to allocate high priority to legitimate traffic, reducing its queuing latency and packet loss rate, and to allocate low priority to attack traffic, increasing queuing latency and packet loss rate. When the agent performs a correct action, the reward value is set to 0, and the reward function requires no additional incentive. When the agent performs an incorrect action, an incremental penalty mechanism based on cumulative errors is applied. The core idea of ​​this mechanism is that if the agent frequently makes incorrect decisions, the error rate of traffic increases, and the penalty value will increase non-linearly, strengthening the negative feedback signal and driving the agent to adjust its strategy as quickly as possible by increasing the penalty.

[0217] The reward function is: for any traffic If traffic For legitimate flows and for intelligent agents to act as flows. Assign high priority or traffic For attack flow and the agent is the traffic If a lower priority is assigned, the current reward value will be... The value is 0; if the flow rate is 0. For attack flow and the agent is the traffic Assign high priority or traffic For legitimate flows and for intelligent agents to act as flows. If a lower priority is assigned, the current reward value will be... Penalty value ;in Indicates the base penalty coefficient; Indicates as of Constantly monitor this traffic The total number of decisions; Indicates as of Constantly monitoring traffic The cumulative number of incorrect decisions.

[0218] (36)

[0219] in This indicates the priority adjustment action at the current moment; Represents a set of attack flows; This represents the set of legal streams.

[0220] A policy function is randomly generated and optimized through iterative training until the iteration termination condition is met, resulting in the optimal policy function. The specific content of each iteration process is as follows: the agent generates and executes the priority adjustment action for the current moment based on the current policy function, obtains the current reward value, generates the state for the next moment using a lightweight traffic statistics framework based on UnivMon+, and optimizes the policy function based on the current reward value. The iteration termination condition is the convergence of the reward function.

[0221] It should be noted that the initial action selection is mainly based on random exploration, gradually transitioning to strategy-driven decision-making.

[0222] In this embodiment, the agent generates and executes the priority adjustment action for the current moment based on the policy function of the current iteration round. For example... Figure 7 As shown, for the V1Model architecture, the controller sends traffic scheduling decisions to the corresponding switches. A custom protocol header is defined in the P4 program to transmit priority information; specifically, a dedicated priority flag header is created. ,use The header field identifies the priority level of traffic. When the control plane issues a priority decision for a specific traffic flow, the control plane agent instructs the P4 program to fill the corresponding priority value into this field when processing data packets belonging to that traffic flow. This operation is typically performed in the matching-action table of the ingress pipeline. This is completed in the middle, matching relevant field information of the stream using methods such as longest prefix matching, and then executing an action. This is used to set fields in the PHV. The P4 program can read fields from the PHV container and map packets to different priority queues based on the values ​​of those fields, thus utilizing inherent metadata fields. This determines which priority queue the data packet should be sent to. During the outgoing pipeline stage, data packets are dequeued with strict priority to ensure that high-priority packets can preempt output port buffers currently occupied by low-priority packets; low-priority packets that the buffer cannot hold are discarded.

[0223] After the priority adjustment action is executed, the network environment state changes. At this time, the current reward value is calculated, and the agent state for the next moment is generated through traffic measurement methods. Addressing the limitations of traditional OpenFlow switch flow table statistics domains, which have limited capacity and can only perform aggregation matching, this embodiment combines the hierarchical architecture of the UnivMon general measurement framework to illustrate how to achieve fine-grained traffic feature collection and statistics, providing reliable data support for the state awareness of subsequent reinforcement learning models.

[0224] Currently, UnivMon, as a general-purpose traffic measurement algorithm, can simultaneously support multiple network measurement tasks. Through its unique Universal Sketch structure, it implements an efficient and scalable traffic measurement mechanism in the data plane. This structure employs a hierarchical sampling structure, consisting of... The layer Count Sketch data structure consists of, where the definition is... , The algorithm is a unique stream count. It consists of two phases: an online sketch update phase and an offline estimation query phase. The online sketch update phase involves the switch processing data packets in real time. For each data packet arriving, based on universal streaming theory, a probability-based hierarchical sampling strategy is first implemented, with the sampling probability of each layer being... , The specific implementation method is as follows: For the first Layer sketch, using An array of pairs of independent hash functions To decide whether to process the data packet tuple Sampling is performed if Then the data packet tuple will be added to the sampled sub-data stream. In the middle. Each sub-sketching structure independently maintains its sampling flow rate. The statistical information is used to identify and save the HeavyHitters set in real time in the form of a min-heap through hash mapping and counter update mechanism. , including from The important flow and frequency estimates were then obtained. The control plane was subsequently subjected to in-depth analysis and secondary calculations based on the aforementioned measurement data, deriving richer statistical characteristics.

[0225] However, a key challenge in implementing the UnivMon architecture is that the min-heap update operation is triggered only after each layer of the sub-sketch is updated. Since the counters in the sketch structure are shared by multiple flows, this design inevitably introduces measurement noise, which in turn affects the frequency accuracy of Heavy-Hitters. This noise directly impacts the accuracy of the final flow moment estimation. To address this issue, this embodiment makes a slight improvement to UnivMon, namely UnivMon+, as follows... Figure 8 As shown, the Augmented Sketch stream processing framework is adopted as the basic building block used in each layer. That is, the identification and counting logic of Heavy-Hitters is placed before the Count Sketch operation as a high-frequency filter.

[0226] The lightweight traffic statistics framework based on UnivMon+ employs the Augmented Sketch stream processing framework, including parallel processing... The layer is a hybrid structure consisting of a min-heap and a Count Sketch data structure; wherein the min-heap is used to record the number of times high-frequency traffic occurs in the current sampling layer; and the Count Sketch data structure is used to estimate the frequency of low-frequency traffic that is not recorded in the min-heap.

[0227] Upon receiving a data packet, each layer first checks whether the data packet meets the sampling conditions and determines the target sampling layer to process the data packet.

[0228] Check the flow to which the packet belongs. If the packet has already been recorded in the min-heap of the target sampling layer, update the counter in the heap; otherwise, use the Count Sketch data structure to determine the stream to which the packet belongs. Frequency estimation is performed, and the set of Heavy Hitters is identified and saved in real time through hash mapping and counter update mechanism. The saved set of Heavy Hitters is then used as the output of the target sampling layer.

[0229] In this embodiment, this improved design offers dual advantages: Firstly, because the min-heap structure provides a dedicated counter for high-frequency traffic, for packets whose flow is already recorded in the min-heap, the corresponding counter in the heap is updated directly, completely bypassing the Count Sketch sub-sketching process. This avoids estimation errors caused by hash collisions in the Count Sketch, thus significantly improving the accuracy of Heavy-Hitters frequency estimation. Secondly, since network traffic generally follows a long-tail distribution, with a reasonable heap size setting, most packets only need to update the min-heap structure, significantly reducing the number of memory accesses.

[0230] According to the Layer output Calculate the flow moment of this layer Using a recursive formula from the first... The process begins by recursively calculating the flow moment at each layer, and the moment estimate is obtained when the recursion reaches layer 0. According to moment estimation Generate the agent's state for the next moment.

[0231] In the offline analysis phase, based on the recursive computation framework proposed by Braverman, the HeavyHitters information from each level is cleverly integrated. Through mathematical transformations, various flow moment estimates from first order to higher order are derived. These flow moments are further transformed into network metrics such as entropy, cardinality, and variance. The HeavyHitters set is approximated in the min-heap of each layer during the update phase. And based on the sparsest subflow, i.e., the set of Heavy Hitters at the highest level. calculate Then, the recursive formula proposed by Braverman et al. is used to calculate the number of iterations from the first iteration. Flow moment of each layer from layer 0 to layer 0 Finally, the output moment estimate .

[0232] (37)

[0233] in Represents a stream Frequency estimation; To represent a monotonically increasing function, depending on different Definition, which can be achieved using stream frequency. Calculate the flow moment for different types of flow.

[0234] In this embodiment, the improved UnivMon lightweight traffic statistics framework in the data plane is used to collect network environment information for calculating the state. By periodically polling the Sketch data structure, the controller calculates statistical values ​​from the raw measurement data, i.e., the number of packets or bytes, and then obtains multi-dimensional traffic statistical features, such as packet sending rate and byte sending rate based on the five-tuple dimension, entropy and variance based on the destination IP address dimension, entropy and cardinality based on the source port dimension, and entropy based on the destination port dimension. Based on the network environment information obtained from the current and previous decisions, the controller calculates network environment changes such as changes in byte sending rate, changes in packet sending rate, and changes in multi-dimensional traffic statistical features, i.e., calculates the new state, and calculates a reward value as an immediate reward for the previous action. The policy function is updated according to the state-action-reward sequence mentioned above. Through multiple rounds of interaction and parameter updates, the reward function gradually converges, at which point the policy function can accurately capture the response differences between legitimate and attack flows.

[0235] The agent adjusts the traffic priority on the attack path according to the optimal policy function and generates the agent state for the next time step using the improved UnivMon lightweight traffic statistics framework. Based on the agent state for the next time step, it readjusts the traffic priority on the attack path according to the trained policy function, completing one iteration process. When the traffic priority on the attack path is continuous... When there is no change in the cycle, all low-priority traffic on the attack path is treated as a link flooding attack flow, and this link flooding attack flow is dropped at the source switch of the attack path.

[0236] It should be noted that the first round of actions prioritizes traffic allocation randomly. At this point, the network environment enters a new state, and the agent uses the improved UnivMon lightweight traffic statistics framework to obtain the new state, providing network environment information for the deep reinforcement learning model to make appropriate traffic scheduling decisions.

[0237] Example 2:

[0238] This embodiment provides a link flooding attack defense system based on a data plane programmable SDN, used to implement the link flooding attack defense method based on a data plane programmable SDN, such as... Figure 9 As shown, the system includes: an attack alarm module, an attack confirmation module, and an attack flow identification module.

[0239] In this embodiment, the link flooding attack defense system is based on a numerical control plane collaborative architecture, deploying the attack alarm module on the P4 programmable switch data plane, and deploying the attack confirmation module and attack flow identification module on the SDN control plane.

[0240] The attack warning module is used to collect Traceroute data packets in real time and perform cluster analysis using an online clustering algorithm based on weighted Manhattan distance. Then, it uses the cluster anomaly index and interquartile range detection algorithm to identify malicious clusters, thereby locating suspicious links and sending alarm information to the attack confirmation module.

[0241] In this embodiment, the attack alert module is responsible for real-time attack alerts based on online clustering reasoning. The P4 switch extracts four-dimensional features from each Traceroute packet and performs real-time clustering analysis using a weighted Manhattan distance online clustering algorithm, achieving millisecond-level attack detection capability. The presence of abnormal clustering patterns is determined using cluster anomaly indicators and interquartile range detection algorithms. An attack alert is triggered when a cluster of highly similar probe packets is detected.

[0242] The attack confirmation module is used to collect link status data of all links based on alarm information and generate a link attribute graph sequence. It uses a spatiotemporal dual attention detection model based on GAT-Seq2Seq to identify abnormal links in the link attribute graph sequence, obtain the attack path, and transmit it to the attack flow identification module.

[0243] In this embodiment, the attack confirmation module is responsible for fine-grained attack confirmation based on spatiotemporal feature analysis. Upon receiving multiple link alarm messages, the controller initiates the fine-grained confirmation process. It constructs a link relationship graph based on the network topology, abstracting physical links into graph nodes. Adaptive sampling technology is used to collect multi-dimensional link state information in real time, obtaining a link state feature sequence. This sequence is then input into a spatiotemporal dual-attention detection model based on GAT-Seq2Seq for spatiotemporal analysis to identify all abnormal links traversed by the attack flow. This module combines INT and the GAT-Seq2Seq-based spatiotemporal dual-attention detection model, utilizing spatial attention to capture link topology correlations and temporal attention to learn attack evolution patterns. Ultimately, it reconstructs the complete attack path and accurately locates the attack source switch.

[0244] The attack flow identification module is used to identify link flooding attack flows by dynamically adjusting the traffic priority on the attack path according to the reinforcement learning-based attack traffic identification method, and to discard the link flooding attack flow at the source switch of the attack path.

[0245] In this embodiment, the attack flow identification module employs a deep reinforcement learning-based optimal traffic scheduling strategy to analyze the twelve-dimensional state characteristics of network traffic, generating priority adjustment decisions which are then sent by the controller to the P4 switch to dynamically adjust the packet queue priorities. It distinguishes between legitimate and attack traffic by leveraging the differences in congestion control responses between them, and uses dynamic priority allocation to differentiate between legitimate and attack traffic, effectively suppressing attack traffic while ensuring the normal transmission of legitimate traffic. Finally, the identified attack traffic is filtered at the attack source, thereby cutting off the attack path and reducing the likelihood of subsequent attacks.

[0246] Example 3:

[0247] This embodiment proposes an electronic device, including: one or more processors, and a memory, wherein the memory is used to store instructions, and when the instructions are executed by the one or more processors, the one or more processors execute the link flooding attack defense method based on data plane programmable SDN.

[0248] The electronic device may be a mobile phone, computer, or tablet computer, etc., and includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements a link flooding attack defense method based on a data plane programmable SDN as described in the embodiments. It is understood that the electronic device may also include input / output (I / O) interfaces and communication components.

[0249] The processor is used to execute all or part of the steps in the link flooding attack defense method based on data plane programmable SDN as described in the above embodiments. The memory is used to store various types of data, which may include, for example, instructions for any application or method in the electronic device, as well as application-related data.

[0250] The processor can be implemented as an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor, or other electronic components, and is used to execute the link flooding attack defense method based on data plane programmable SDN described in the above embodiments.

[0251] Example 4:

[0252] This embodiment proposes a computer-readable storage medium that stores executable instructions. When these instructions are executed, if they are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0253] The computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the link flooding attack defense method based on data plane programmable SDN described in various embodiments of this application.

[0254] The aforementioned storage media include: flash memory, hard disks, multimedia cards, card-type memory (e.g., SD (Secure Digital Memory Card) or DX (Memory Data Register, MDR) memory), random access memory (RAM), static random-access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, disks, optical discs, servers, APP (Application) application stores, and other media capable of storing program verification codes. These media store computer programs, which, when executed by a processor, can implement the various steps of the aforementioned link flooding attack defense method based on data plane programmable SDN.

[0255] Example 5:

[0256] This embodiment proposes a computer program product, including a computer program or instructions, which, when executed by a processor, implements the aforementioned link flooding attack defense method based on data plane programmable SDN.

[0257] Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a computer program product.

[0258] The various embodiments in this application are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0259] The scope of protection of this application is not limited to the embodiments described above. Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from the scope and spirit of this disclosure. If such modifications and variations fall within the scope of this disclosure and its equivalents, then the intent of this disclosure also includes these modifications and variations.

Claims

1. A method for defending link flooding attack based on data plane programmable SDN, based on an SDN architecture, the SDN architecture comprising a programmable data plane and a control plane, the control plane and the programmable data plane interacting with each other through a southbound interface; wherein the control plane comprises a controller, and the programmable data plane comprises switches and links supporting data plane programming, characterized in that, The method comprises the following processes: An online clustering algorithm based on weighted Manhattan distance is used to perform real-time clustering analysis on the Traceroute data packets passing through each switch, a suspicious link is located by identifying a malicious cluster, and alarm information is sent to the controller; Based on the alarm information, link state data of all links is collected and a link attribute graph sequence is generated, a time-space double attention detection model based on GAT-Seq2Seq is used to identify abnormal links of the link attribute graph sequence, and an attack path is obtained; According to an attack flow identification method based on reinforcement learning, the link flooding attack flow is identified by dynamically adjusting the flow priority on the attack path, and the link flooding attack flow is discarded at the source switch of the attack path.

2. The method of claim 1, wherein, The specific content of the online clustering algorithm based on weighted Manhattan distance for clustering analysis of the Traceroute data packets passing through each switch is that, for any switch, the Traceroute data packets passing through the switch are collected in real time, and four-dimensional feature extraction is performed on the collected Traceroute data packets to obtain a four-dimensional feature set of the Traceroute data packets; The four-dimensional feature set comprises a source IP address , a destination IP address , a TTL value , and a packet size . A cluster set with an upper limit of capacity is set , and the initial state of the cluster set is ; For any Traceroute packet , if the Traceroute packet is the first arrived packet, directly create the first cluster for the packet , and update ; If the Traceroute packet is not the first arriving packet, then the weighted Manhattan distance of the Traceroute packet from each cluster in the current cluster set is calculated, respectively. If there exists a Traceroute packet with a weighted Manhattan distance of zero to a cluster , then the Traceroute packet is assigned to the cluster ; otherwise, a new cluster is created for the Traceroute packet and the set of clusters is updated until the set of clusters reaches an upper capacity limit . When clusters are set Once the capacity limit is reached, for each newly arrived Traceroute data packet, the weighted Manhattan distance between the Traceroute data packet and each cluster in the cluster set is calculated, and the Traceroute data packet is assigned to the cluster with the smallest weighted Manhattan distance. At the same time, the feature range and data packet counter of the cluster are updated; wherein the data packet counter is used to record the total number of data packets belonging to the cluster.

3. The method of claim 2, wherein the method further comprises: The specific content of locating the suspicious link by identifying the malicious cluster and sending the alarm information to the controller is that: For the current cluster set Arbitrary clusters in Calculate time slice Intra-cluster Cluster anomaly ; all the clustering clusters in the current clustering cluster set all the clustering clusters in the current clustering cluster set, in ascending order of cluster anomaly degree, to obtain an ordered sequence and calculate quartiles of the ordered sequence; The interquartile range is calculated using quartiles, and an upper bound anomaly threshold is obtained ; For the current cluster set Random clusters ,when At that time, determine the cluster. This is a malicious cluster; When the switch identifies the malicious cluster, the suspicious link is located according to the malicious cluster, and a lightweight summary packet is constructed according to the suspicious link As the alarm information, the alarm information is further sent to the controller; wherein is a switch ID; is a port ID; is a timestamp.

4. The method of claim 3, wherein the method further comprises: The specific content of collecting the link state data of all links based on the alarm information, generating the link attribute graph sequence, and using the time-space double attention detection model based on GAT-Seq2Seq to identify abnormal links of the link attribute graph sequence to obtain the attack path is that: Based on the alarm information, the controller dynamically calculates the sampling interval according to network traffic load And issues to the switch, and is inserted by the switch in the data packet according to the sampling interval INT instruction; The data packets carrying the INT instruction collect the state data of each link node according to the INT instruction during transmission along the link; Each link in the data plane is regarded as a node, and for any node , the feature vector of the node in the time slice is generated according to the link state data of the node , and ; wherein represents the number of Traceroute data packets passing through the node in the time slice ; represents the queue length in the time slice : represents the queue delay in the time slice ; represents the buffer delay in the time slice ; represents the link utilization rate in the time slice ; represents the link delay in the time slice ; The relationships between links are viewed as edges between nodes, and the relationships are determined based on all nodes, all edges, and all nodes in time slices. eigenvectors to construct time slices Link attribute diagram Thus, we obtain the following: A sequence of link attribute graphs for consecutive time slices; where Represents a set of nodes; Represents the set of edges; Indicates time slice The node feature matrix; The obtained link attribute graph sequence is input into the time-space double attention detection model based on GAT-Seq2Seq for abnormal link identification, and the abnormal probability of each link is output. For any link, if the abnormal probability of the link is greater than a preset probability threshold, the link is an attack path; otherwise, the link is a normal link.

5. The method of claim 4, wherein the method further comprises: The time-space double attention detection model based on GAT-Seq2Seq comprises, which are connected in sequence: an input module, a spatial feature extraction module based on GAT, an FNN feature fusion module, a time feature extraction module based on a Seq2Seq framework, and an output module; The input module is used for inputting a link attribute graph sequence and transmitting to the GAT-based spatial feature extraction module, and simultaneously transmitting the node feature matrix in the link attribute graph sequence to the GAT-based spatial feature extraction module as an original link state feature. as an original link state feature. The GAT-based spatial feature extraction module adopts a GAT structure based on a multi-head attention mechanism to update feature vectors of each node in a link attribute graph sequence, and generates node embedding representation fused with neighborhood information by stacking a multi-layer GAT structure based on the multi-head attention mechanism ; The FNN feature fusion module adopts a feedforward neural network to fuse original link state features and node embedding representation fusing neighborhood information to perform deep fusion and generate a fused embedding representation ; The time feature extraction module based on the Seq2Seq framework adopts a Seq2Seq framework based on a GRU unit to fuse the embedding representation Time sequence feature modeling is performed to generate an output sequence. The time feature extraction module based on the Seq2Seq framework comprises two parts of an encoder and a decoder; wherein the encoder is: converting each time slice into a fusion embedding representation , and then inputting the one-dimensional vector after expansion into a GRU chain to extract time sequence information step by step and generate a hidden state sequence ; The decoder is: for the first GRU unit in the GRU chain, using a softmax function to calculate the attention weight of the current decoding state of the current GRU unit The hidden state sequence The attention weight of the current decoding state of the current GRU unit The hidden state output of the previous GRU unit The final output of the previous GRU unit And the hidden state sequence The attention weight of the current decoding state of the current GRU unit The final output of the current GRU unit is generated The output sequence is obtained by integrating the final outputs of all GRU units in the GRU chain​​ The output module uses a full connection layer and a Sigmoid activation function to map the output sequence and generate the abnormal probability of each node.

6. The method of claim 5, wherein the method further comprises: The fusion neighborhood information node embedding representation The generating method is as follows: For any node and its neighbor nodes , and there are , , denotes the first-order neighbor set of node ; denotes the edge between node and neighbor node ; For any GAT structure based on multi-head attention mechanism, the multi-head attention mechanism is used to respectively calculate the attention coefficients between the nodes and each neighbor node, and the features of the neighbor nodes are weighted and aggregated using the attention coefficients to update the feature vector of the node and serve as the feature vector set output by the GAT structure based on the multi-head attention mechanism. By stacking The layer is based on the GAT structure of the multi-head attention mechanism, propagates and fuses the features of multi-hop neighbors layer by layer, and generates node embedding representation fused with neighborhood information .

7. The method of claim 6, wherein the method further comprises: The specific content of the attack flow identification method based on reinforcement learning, which identifies the link flooding attack flow by dynamically adjusting the flow priority on the attack path, and discards the link flooding attack flow at the source switch of the attack path is that: an agent is initialized, and a state space, an action space, and a reward function of the agent are defined; wherein the agent is used to learn a flow priority allocation strategy; A strategy function is randomly generated, and the strategy function is optimized through iterative training until the iteration termination condition is met, and an optimal strategy function is obtained. Wherein the specific content of each iteration process is: the agent generates the priority adjustment action at the current time according to the current policy function and executes, obtains the current reward value and generates the state at the next time by using the lightweight traffic statistics framework based on UnivMon+, and optimizes the policy function according to the current reward value; The termination condition of the iteration is that the reward function converges; The agent adjusts the traffic priority on the attack path according to the optimal policy function, and generates the agent state at the next time by using the lightweight traffic statistics framework based on UnivMon+; Based on the agent state of the next moment, the traffic priority on the attack path is re-adjusted according to the trained policy function, and a round of iteration process is completed; when the traffic priority on the attack path is continuously unchanged for a plurality of rounds, all low-priority traffic on the attack path is taken as a link flooding attack flow, and the link flooding attack flow is discarded at the source switch of the attack path.

8. The method of claim 7, wherein the method further comprises: The state space includes: priority level, byte sending rate change value, packet sending rate change value, consistency cumulative score value, sequence similarity measure value, average per-flow byte sending rate change value, average per-flow packet sending rate change value, information entropy change value based on destination IP address, variance change value based on destination IP address, information entropy change value based on source port, cardinality change value based on source port and information entropy change value based on destination port; The action space is represented as: ; wherein represents assigning high priority to the current traffic; represents assigning low priority to the current traffic; The reward function is: for any flow , if the flow is a legal flow and the agent is the flow assigned with a high priority or the flow is an attack flow and the agent is the flow assigned with a low priority, the current reward value is 0; if the flow is an attack flow and the agent is the flow assigned with a high priority or the flow is a legal flow and the agent is the flow assigned with a low priority, the current reward value is a penalty value ; wherein represents a basic penalty coefficient; represents the total decision times of the flow up to the time point ; represents the cumulative error decision times of the flow up to the time point .

9. The method of claim 8, wherein the method further comprises: The UnivMon+ based lightweight traffic statistics framework adopts an Augmented Sketch stream processing framework, including parallel The mixed structure composed of a minimum heap and a Count Sketch data structure; wherein the minimum heap is used to record the number of times of high-frequency traffic appearing in the current sampling layer; and the Count Sketch data structure is used to estimate the frequency of low-frequency traffic not recorded in the minimum heap; Each layer first checks whether the data packet meets the sampling condition and determines the target sampling layer for processing the data packet; checking whether the flow to which the data packet belongs has been recorded in the minimum heap of the target sampling layer, and if so, updating the counter in the heap, and if not, using the Count Sketch data structure to record the flow to which the data packet belongs checking whether the flow to which the data packet belongs has been recorded in the minimum heap of the target sampling layer, and if so, updating the counter in the heap, and if not, using the Count Sketch data structure to record the flow to which the data packet belongs performing frequency estimation, and identifying and saving the Heavy Hitters set in real time through a hash mapping and counter updating mechanism, and grouping the saved Heavy Hitters set as the output of the target sampling layer According to the first The output of the layer The flow moment of the layer is calculated And starting from the first Layer, the flow moment of each layer is calculated recursively, and when the recursion reaches the 0th layer, the moment estimate According to the moment estimate The state of the agent at the next moment is generated.

10. A link flooding attack defense system based on data plane programmable SDN, for implementing the link flooding attack defense method based on data plane programmable SDN in any one of claims 1-9, characterized in that, The system comprises: an attack warning module, an attack confirmation module and an attack flow identification module; The attack warning module is used for collecting Traceroute data packets in real time, performing clustering analysis by using an online clustering algorithm based on weighted Manhattan distance, identifying malicious clustering clusters by using a cluster abnormality index and a quartile range detection algorithm, positioning suspicious links and sending warning information to the attack confirmation module; The attack confirmation module collects link state data of all links and generates a link attribute graph sequence based on the warning information, identifies abnormal links by using a spatiotemporal double-attention detection model based on GAT-Seq2Seq, obtains an attack path and transmits it to the attack flow identification module; The attack flow identification module is used for identifying link flooding attack flows by dynamically adjusting the traffic priority on the attack path according to an attack traffic identification method based on reinforcement learning, and discarding the link flooding attack flows at the source switch of the attack path.

Images