DDoS attack detection method and system for relay protection device

Abstract

The invention discloses a relay protection device DDoS attack detection method and system. The method comprises the following steps: acquiring a network message; preprocessing the network message to form 64 * 64 two-dimensional matrix data, inputting the 64 * 64 two-dimensional matrix data into the CNN neural network model, and performing reasoning analysis to obtain an attack type and a corresponding first attack probability value; the attack types comprise ARP, ICMP, UDP, TCPSYN, other attacks and normal traffic; carrying out attack type classification on the network messages according to protocol types, counting the number of various messages in a time window, and comparing the number of various messages with a corresponding security threshold to obtain a second attack probability based on a traffic threshold; and for each attack type, obtaining the probability of each attack type according to the first attack probability value and the second attack probability value in combination with the trust factor, and determining a DDoS attack detection result. And the advantages of the two are combined, so that the accuracy and robustness of DDoS attack detection are remarkably improved.

Description

TECHNICAL FIELD

[0001] The application relates to a DDoS attack detection method and system for a relay protection device, and belongs to the technical field of relay protection of a power system. BACKGROUND

[0002] With the deep integration of smart grids and information communication technologies, relay protection devices in power systems are gradually realizing networkization, automation and remote control. However, this high degree of informatization has also brought increasingly serious network security threats, especially distributed denial of service attacks (DDoS attacks), which have become one of the main attack means against the communication links of power systems. Once the communication link of a relay protection device is disturbed or blocked by a DDoS attack, the fault signal may not be uploaded in time or the control command may not be accurately issued, thereby affecting the normal operation of the relay protection and automation device, and even causing a large-scale power grid accident.

[0003] Existing DDoS attack detection methods mainly fall into two categories: one is a traditional method based on rules or thresholds, which mainly identifies abnormal traffic exceeding the threshold by setting thresholds for various protocols or communication traffic. This method is simple to implement and has low resource consumption, but its detection capability is limited and it is difficult to deal with complex, concealed or carefully constructed attack methods, and it is prone to false negatives and false positives; the other is an intelligent detection method based on machine learning or deep learning, which identifies attack features by training a model to improve detection accuracy and generalization ability, but this method relies on a large number of labeled samples and may be affected by changes in network traffic, and has certain application bottlenecks in actual embedded environments, such as limited computing resources and difficulty in model updating.

[0004] Therefore, the existing technology cannot balance detection accuracy and real-time performance in resource-constrained embedded power protection devices, and there is an urgent need for an efficient and reliable DDoS attack detection method that combines the advantages of traditional rule-based judgment and intelligent identification to meet the higher requirements of power systems for communication security of key devices. SUMMARY

[0005] Object: In view of at least one of the above technical problems, the application provides a DDoS attack detection method and system for a relay protection device, which aims to solve the problems of low identification accuracy, delayed response and poor adaptability of existing DDoS attack detection technologies in power protection devices, and is suitable for embedded power system equipment, can balance real-time performance and intelligence, and significantly improve network security protection level.

[0006] The technical solution adopted by the application is:

[0007] In a first aspect, the application provides a DDoS attack detection method for a relay protection device, comprising:

[0008] S1. Obtain the received network packets;

[0009] S2. Preprocess the network packets to form a 64×64 two-dimensional matrix data, input it into the CNN neural network model, and perform inference analysis to obtain the attack type and the corresponding first attack probability value. The attack types mentioned include ARP, ICMP, UDP, TCPSYN, other attacks, and normal traffic.

[0010] S3. Classify network packets according to protocol type, including ARP, ICMP, UDP, TCPSYN, other attacks, and normal traffic; count the number of each type of packet within a time window, and compare the number of each type of packet with the corresponding security threshold to obtain a second attack probability value based on the traffic threshold. ;

[0011] S4. For each attack type, based on the first attack probability value... Second attack probability value The probability of each attack type is obtained by combining the trust factor C. Based on the probability of each attack type Determine the DDoS attack detection results.

[0012] Secondly, this application provides a DDoS attack detection system for relay protection devices, including a processor and a storage medium;

[0013] The storage medium is used to store instructions;

[0014] The processor is configured to operate according to the instructions to execute the method according to the first aspect.

[0015] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0016] Fourthly, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0017] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0018] Beneficial Effects: The DDoS attack detection method and system for relay protection devices provided in this application have the following advantages: This application integrates traditional traffic threshold detection with neural network packet recognition. This method fully combines the advantages of both, utilizing neural networks to identify complex and disguised attack behaviors, while simultaneously using traditional threshold detection to identify abnormal traffic, thereby significantly improving the accuracy and robustness of DDoS attack detection. It can efficiently identify distributed denial-of-service (DDoS) attacks occurring in the network within a short time, thus effectively ensuring the communication security and operational stability of critical equipment in the power system. It is applicable to resource-constrained embedded power protection devices. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating a DDoS attack detection method for a relay protection device according to an embodiment of this application.

[0020] Figure 2 This is a schematic diagram of the operating environment architecture of a DDoS attack detection system for a relay protection device according to an embodiment of this application.

[0021] Figure 3 This is a schematic diagram of a CNN neural network model structure according to an embodiment of this application. Detailed Implementation

[0022] The present application will be further described below with reference to the accompanying drawings and embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present application, and should not be used to limit the scope of protection of the present application.

[0023] In the description of this application, "several" means one or more, "multiple" means two or more, "greater than," "less than," and "exceeding" are understood to exclude the stated number, while "above," "below," and "within" are understood to include the stated number. The use of "first" and "second" in the description is merely for distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the order of the indicated technical features.

[0024] In the description of this application, the terms "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0025] The term "and / or" simply describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0026] Example 1: This example provides a method for detecting DDoS attacks on relay protection devices, such as... Figure 1 As shown, it includes:

[0027] S1. Obtain the received network packets.

[0028] In some embodiments, in step S1, the system receives packet data from the network in real time through the network card as input to the entire detection process.

[0029] S2. Preprocess the network packets to form a 64×64 two-dimensional matrix data, input it into the CNN neural network model, and perform inference analysis to obtain the attack type and the corresponding first attack probability value. The attack types mentioned include ARP, ICMP, UDP, TCPSYN, other attacks, and normal traffic.

[0030] In some embodiments, step S2 involves preprocessing the network packets to form a 64×64 two-dimensional matrix data, including:

[0031] The received network packets are standardized to a length of 64 bytes: if the packet length is greater than 64 bytes, the first 64 bytes are truncated as features; if the packet length is less than 64 bytes, 0 to 64 bytes are padded to the end.

[0032] The 64 consecutively received messages are standardized and then cached sequentially to form a 64×64 two-dimensional matrix data.

[0033] In the time dimension, 64 consecutive frames of packets are buffered and sequentially combined to form a 64 × 64 two-dimensional matrix for subsequent convolutional neural network model analysis. This matrix preserves the time-series characteristics of the traffic, facilitating the model's identification of the spatiotemporal evolution of attack behavior.

[0034] Furthermore, network message preprocessing also includes removing redundant information from non-protocol fields, retaining only header fields and key feature fields for use as neural network input.

[0035] This application employs a resource-friendly Mini-CNN model to classify attack types from the aforementioned two-dimensional matrix data. In some embodiments, in step S2,

[0036] like Figure 3As shown, the CNN neural network model includes a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, and a second fully connected layer connected in sequence. The first convolutional layer uses eight 3×3 convolutional kernels, with one input channel, eight output channels, and an output feature map size of 8×64×64. The first pooling layer performs a 2×2 max pooling operation, with an output feature map size of 8×32×32. The second convolutional layer uses sixteen 3×3 convolutional kernels, with sixteen output channels and an output feature map size of 16×32×32. The second pooling layer outputs a feature map size of 16×16×16. After flattening, the model is connected to the first fully connected layer, with an output feature map size of 64×4096. The second fully connected layer outputs a feature map size of 6×64, corresponding to the six attack classification results of the message.

[0037] The convolutional layer is used to extract spatial local features from network packets, the pooling layer is used to compress the feature map size to reduce computational complexity, and the fully connected layer is used to discriminate the attack type of the extracted deep features.

[0038] Furthermore, the second fully connected layer outputs predicted values ​​for six attack types, including ARP attack, ICMP attack, UDP attack, TCPSYN attack, other types of attacks, and normal traffic. Each output node corresponds to one attack type, and the first attack probability value for the corresponding attack type is output through the Softmax function. .

[0039] More specifically, the CNN neural network model is used to classify and identify network packets to detect the presence of DDoS attacks. The model input is a 64×64 two-dimensional matrix of data ( , The output is a 6-category classification result, including ARP, ICMP, UDP, TCP SYNC, Other Attacks, and Normal. In the first convolutional layer, for each convolutional kernel... , The characteristic matrix obtained after the volume is =ReLU( * + (i=1,2,3,...8). ReLU represents the activation function, retaining values ​​greater than or equal to 125, and setting it to 0 for values ​​less than 125. The pooling layer compresses the size of the feature matrix, reducing the dimension to 32x32. The second convolutional layer is similar to the first, except that it uses 16 groups of 3×3 convolutional kernels, and its output feature matrix... =ReLU( Finally, after flattening and two fully connected layers, we obtain the classification vector array A. The predicted attack probability for each class is... = Where i = 0, 1, 2, 3, 4, 5. In actual deployment, the chip manufacturer's solutions can be referenced to optimize the CNN inference calculation process and achieve efficient and accurate operation.

[0040] The CNN neural network model described in this application is pre-trained. The model can be trained using the TensorFlow framework. The CIC-DDoS2019 dataset is used for training, and normal traffic messages during the operation of the relay protection device can be added as supplements.

[0041] Based on the intelligent judgment of the neural network model, the system simultaneously performs traditional traffic statistical analysis.

[0042] S3. Classify network packets according to protocol type (ARP, ICMP, UDP, TCPSYN, other attacks, and normal traffic) to determine the attack type. The corresponding attack types include ARP, ICMP, UDP, TCPSYN, other attacks, and normal traffic. Count the number of each type of packet within a time window (e.g., 50ms), and compare the number of each type of packet with the corresponding security threshold to obtain a second attack probability value based on the traffic threshold. ;

[0043] In step S3, the number of each type of packet is compared with the corresponding security threshold to obtain a second attack probability value based on the traffic threshold. ,include:

[0044] For each protocol type of message, the ratio of the number of messages to the corresponding security threshold is calculated and used as the second attack probability value. .

[0045] In traditional threshold determination, the security threshold for each protocol type is dynamically configured based on the maximum security processing capacity that the system can handle.

[0046] Next, to improve the robustness and reliability of the overall judgment, this application proposes a fusion-based comprehensive judgment method. The first attack probability value output by the CNN neural network is fused with the second attack probability value from traditional threshold detection, and the final probability of each attack type is obtained using the following method.

[0047] S4. For each attack type, based on the first attack probability value... Second attack probability value The probability of each attack type is obtained by combining the trust factor C. Based on the probability of each attack type Determine the DDoS attack detection results.

[0048] In some embodiments, based on a first attack probability value Second attack probability value The probability of each attack type is obtained by combining the trust factor C. ,include:

[0049] .

[0050] It should be noted that the trust factor C is a weighted parameter with a value between 0 and 1 based on system experience, and the trust factor C ∈ [0,1].

[0051] In step S4, the probability of each attack type is determined... Determine the DDoS attack detection results, including:

[0052] If the probability of an attack type If the probability exceeds the threshold, it is determined that a DDoS attack has occurred, and the attack type is output as the DDoS attack type.

[0053] In some embodiments, the probability threshold is 50%. When the probability threshold (e.g., 50%) is exceeded, the system considers a DDoS attack to be present, outputs the corresponding attack type, and triggers the protection mechanism to respond.

[0054] The DDoS attack detection method for relay protection devices described in this application is executed in real time through an embedded platform, featuring low latency and high processing efficiency, and is suitable for network security protection of critical nodes in relay protection devices.

[0055] Example 2: Based on Example 1, this example provides a DDoS attack detection system for relay protection devices, including a processor and a storage medium;

[0056] The storage medium is used to store instructions;

[0057] The processor is configured to operate according to the instructions to execute the method according to Embodiment 1.

[0058] In some embodiments, such as Figure 2 The diagram shows the operational environment architecture of the DDoS attack detection system in this embodiment. The entire system operating environment can be divided into three layers from bottom to top: the device layer, the driver layer, and the application layer. These layers work together through data flow and control interfaces to achieve efficient and accurate DDoS attack detection. The NPU / CPU is responsible for performing tasks such as data preprocessing, deep learning model inference, and logic control. The network interface card (NIC) is responsible for receiving raw data packets from external network traffic, serving as the system's front-end data input source.

[0059] The RAW packet driver provides the function of receiving and sending raw packets, allowing the system to process underlying network data directly without going through the TCP / IP protocol stack. The CNN / threshold detection module is the core functional module of this system, integrating deep learning and traditional detection algorithms to perform real-time analysis and judgment of potential DDoS attack behaviors in network traffic. The security firewall dynamically updates firewall policies based on detection results, enabling the blocking and isolation of suspicious attack sources.

[0060] Example 3: Based on Example 1, this example provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in Example 1.

[0061] Example 4: Based on Example 1, this example provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described in Example 1.

[0062] Example 5: Based on Example 1, this example provides a computer program product, including a computer program that, when executed by a processor, implements the method described in Example 1.

[0063] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0065] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0066] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0067] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting DDoS attacks on relay protection devices, characterized in that, include: S1. Obtain the received network packets; S2. Preprocess the network packets to form a 64×64 two-dimensional matrix data, input it into a CNN neural network model, and perform inference analysis to obtain the attack type and the corresponding first attack probability value. The attack types mentioned include ARP, ICMP, UDP, TCPSYN, other attacks, and normal traffic. S3. Classify network packets according to protocol type, including ARP, ICMP, UDP, TCPSYN, other attacks and normal traffic; The system then counts the number of various types of packets within the time window, compares the number of each type of packet with its corresponding security threshold, and obtains a second attack probability value based on the traffic threshold. ; S4. For each attack type, based on the first attack probability value... Second attack probability value The probability of each attack type is obtained by combining the trust factor C. Based on the probability of each attack type Determine the DDoS attack detection results.

2. The method according to claim 1, characterized in that, In S2, network packets are preprocessed to form a 64×64 two-dimensional matrix of data, including: The received network packets are standardized to a length of 64 bytes: if the packet length is greater than 64 bytes, the first 64 bytes are truncated as features; if the packet length is less than 64 bytes, 0 to 64 bytes are padded to the end. The 64 consecutively received messages are standardized and then cached sequentially to form a 64×64 two-dimensional matrix data.

3. The method according to claim 1, characterized in that, In S2, the CNN neural network model includes a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first fully connected layer, and a second fully connected layer connected in sequence. The first convolutional layer uses eight 3×3 convolutional kernels, has one input channel, eight output channels, and an output feature map size of 8×64×64. The first pooling layer uses 2×2 max pooling, and the output feature map size is 8×32×32. The second convolutional layer uses sixteen 3×3 convolutional kernels, has sixteen output channels, and an output feature map size of 16×32×32. The output feature map size of the second pooling layer is 16×16×16. After flattening, it is connected to the first fully connected layer, and the output feature map size is 64×4096. The output feature map size of the second fully connected layer is 6×64, corresponding to the six attack classification results of the message.

4. The method according to claim 3, characterized in that, The second fully connected layer outputs predicted values ​​for six attack types: ARP attack, ICMP attack, UDP attack, TCPSYN attack, other types of attacks, and normal traffic. Each output node corresponds to one attack type, and the first attack probability value for the corresponding attack type is output through the Softmax function. .

5. The method according to claim 1, characterized in that, The number of each type of message is compared with the corresponding security threshold to obtain a second attack probability value based on the traffic threshold. ,include: For each protocol type of message, the ratio of the number of messages to the corresponding security threshold is calculated and used as the second attack probability value. .

6. The method according to claim 1, characterized in that, Based on the first attack probability value Second attack probability value The probability of each attack type is obtained by combining the trust factor C. ,include: 。 7. The method according to claim 1 or 6, characterized in that, The trust factor C is a weighted parameter with a value between 0 and 1, based on system experience.

8. The method according to claim 1, characterized in that, Based on the probability of each attack type Determine the DDoS attack detection results, including: If the probability of an attack type If the probability exceeds the threshold, it is determined that a DDoS attack has occurred, and the attack type is output as the DDoS attack type.

9. The method according to claim 8, characterized in that, The probability threshold is 50%.

10. A DDoS attack detection system for relay protection devices, characterized in that, Including processor and storage media; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the method according to any one of claims 1 to 9.

Images