A method to resist DDoS attacks based on physical layer properties

Abstract

The present invention discloses a method for resisting DDoS attacks based on physical layer attributes. By utilizing user-specific physical layer attributes (the uniqueness of the communication channel attribute TA and the hardware attribute CFO under ideal conditions), two different schemes of cascade detection and joint detection are proposed through physical layer device fingerprints of two different granularities, so that base stations with different computing capabilities can adopt different modes. The purpose of illegal users wanting to interrupt legitimate services by using a large number of random access requests is utilized. While ensuring low cost, a clustering algorithm is used to distinguish between legitimate and illegal users. The computational complexity is low, and DDoS attack detection is achieved in the random access phase of the 5G NR network. This fundamentally fills the gap in detecting DDoS attacks by illegal users before the RRC connection request is sent. At the same time, due to the low computational complexity, low computational overhead and low cost, a satisfactory balance between computational overhead and security level is achieved. The method is suitable for detecting DDoS attacks by illegal users in 5G massive connection scenarios.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a method for resisting DDoS attacks based on physical layer properties. Background Art

[0002] Massive machine-type communications is one of the three key scenarios for 5G (fifth-generation) network design. It aims to provide widespread wireless connectivity for tens of billions of devices. However, while enabling the Internet of Everything, supporting a large number of connected devices also presents significant opportunities for attackers, particularly in distributed denial-of-service (DDoS) attacks. The main DDoS attack security threats currently present in 5G networks include:

[0003] 1) Before the Radio Resource Control (RRC) connection request is sent, in the initial stage of random access, a malicious user sends a large number of random access preamble sequences (RAPreamble, i.e., Msg1) to the base station in a short period of time, causing the base station to continuously reserve resources for the malicious user to wait for the malicious user's access, occupying the preamble and preventing other legitimate users from accessing.

[0004] 2) Malicious RRC signaling exchanged between the RRC Connection Request and access stratum (AS) security activation can be used to launch a Distributed Denial of Service (DDoS) attack against a 5G base station (gNB). For example, an attacker could compromise a large number of IoT devices by repeatedly sending access request messages, flooding the gNB with random access requests within a short period of time, and occupying the preamble, preventing other healthy IoT devices from accessing the gNB. Malicious RRC signaling can also be constructed to attack the gNB.

[0005] 3) After AS security activation, IoT devices can be maliciously exploited to send a large number of signaling or user data packets to the gNB. For example, they can send a large amount of RRC signaling or UP data such as RRC re-establishment / RRC recovery / user plane data packets, causing the gNB to exhaust process resources and cause a denial of service.

[0006] In the existing technology, there are two main solutions for 5G network anti-DDOS attack:

[0007] The first method mainly utilizes two thresholds. The gNB can detect RRC resume / RRC re-establishment, RRC messages sent on SRB1, and NAS messages transmitted through SRB2. Then, if the total number of messages received by the base station within a period of time exceeds threshold 1, the base station starts tracking each UE. If the number of messages received with the same UE temporary identifier also exceeds threshold 2, the UE is marked as an attacking or misbehaving user, and the information about the attacking UE is reported to the 5GC.

[0008] The second method is that RAN can identify users with abnormal behavior through traffic detection mechanism. At the same time, since current terminal users support mobility, in order to protect neighboring RANs and try to shorten the detection time of neighboring RANs, the original RAN will report the list of UE IDs with abnormal behavior to its neighboring RANs.

[0009] Existing DDoS attack detection solutions only address DDoS attacks that occur after AS security is activated and after the RRC connection request is sent, but before AS security is activated. In other words, they primarily address the security threats 2) and 3). The first solution addresses the third of these security threats, while the second solution primarily addresses the second and third of these threats. However, preventing and detecting DDoS attacks before the RRC connection request is sent remains an open question. If a malicious user sends a large number of random access preamble sequences to the base station during the random access phase, causing the base station to reserve resources, existing solutions will not be able to address this issue. Furthermore, the threshold for the first solution remains to be determined, and how to synchronize the list within the RAN in the second solution remains to be determined. Therefore, a practical solution to the first security threat is needed. Summary of the Invention

[0010] In response to the above technical problems, the present invention provides a method for resisting DDoS attacks based on physical layer properties. This solution performs DDoS attack detection in the first step of random access, when the Msg1 message is sent, before the RRC connection request is sent, thus filling the gap in this area in practical applications.

[0011] In order to achieve the above object, the present invention provides the following technical solutions:

[0012] A method for resisting DDoS attacks based on physical layer properties. The base station operates in two modes and includes the following steps:

[0013] S1. Set a threshold, Threshold, which indicates the maximum number of random accesses that can be initiated by the same UE.

[0014] S2. The UE sends a random access preamble Msg1 to the base station gNB.

[0015] S3. After receiving Msg1, the gNB determines whether the base station is a small base station. If so, it adopts Mode 1 and executes this step. Otherwise, it adopts Mode 2 and executes step S8. It automatically calculates TA and records all TA values ​​received within a period of time to obtain an N-dimensional vector TA = [TA0, TA1, ..., TA N-1 ];

[0016] S4, one-dimensional clustering based on TA;

[0017] S5. If the number of elements in a certain class Number1 is greater than the threshold Threshold, it is determined that there may be a malicious user in the class, and step S6 is executed; otherwise, it is determined that there is no malicious user and access is allowed;

[0018] S6. Track the UEs whose TA values ​​are in the class of possible malicious users, extract the CFO values ​​from the Msg1 messages sent by these UEs, and obtain an N-dimensional vector ε = [ε0, ε1, ..., ε N-1 ], one-dimensional clustering based on ε;

[0019] S7. If the number of elements in a certain category, Number2, is greater than the threshold, the user with the CFO value of this category is determined to be a malicious user and its access request is rejected. Otherwise, its access request is accepted.

[0020] S8. The base station continuously obtains the TA value and CFO estimation value of the received signal and defines a 2×N matrix A = [TA ε] T , where TA and ε represent N sample values ​​of the timing advance and carrier frequency offset from the user terminal, respectively, and TA = [TA0, TA1, ..., TA N-1 ],ε=[ε0,ε1,…,ε N-1 ];

[0021] S9, perform two-dimensional clustering based on matrix A;

[0022] S10. If the total number of matrices A in a certain category, Number3, is greater than a threshold, the user of the matrix A in this category is determined to be a malicious user, and its access request is rejected; otherwise, its access request is accepted.

[0023] Furthermore, in step S4, the TA values ​​are divided into K categories in total, and the TA values ​​are classified into one category using the K-Means clustering method based on the N-dimensional vector TA.

[0024] Furthermore, in step S6, the CFO values ​​are divided into M categories in total, and the CFO values ​​are classified into one category using the K-Means clustering method based on the N-dimensional vector ε.

[0025] Furthermore, the estimation and processing of the CFO value in step S6 is embedded in the signal processing of the receiver.

[0026] Furthermore, the method for obtaining the CFO value in step S6 is to measure the CFO using a time domain method or a frequency domain method using repeated resources, or to estimate the CFO using a training sequence with a pilot inserted, or to track the CFO using an extended Kalman filter, or to estimate the CFO based on AVR.

[0027] Furthermore, in step S9, the values ​​of the two-dimensional matrix A are divided into P categories in total. Based on the two-dimensional matrix A, the values ​​of A are classified using the K-Means clustering method.

[0028] Furthermore, the K value is determined according to the resolution of the TA in the cell, K = cell radius / resolution of the TA value.

[0029] Furthermore, the values ​​of M and P are the average number of users initiating random access in the 5G cell.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] Compared with existing DDoS attack detection schemes in 5G NR networks, the physical layer attribute-based DDoS attack resistance method provided by the present invention fundamentally fills the gap in detecting illegal user DDoS attacks before the RRC connection request is sent. It utilizes user-specific physical layer attributes (the uniqueness of the communication channel attribute TA and the hardware attribute CFO under ideal conditions) and proposes two different schemes of cascade and joint detection through two physical layer device fingerprints of different granularities. This allows base stations with different computing capabilities to adopt different modes. It takes advantage of the fact that illegal users want to interrupt legitimate services with a large number of random access requests. While ensuring low cost, it uses a clustering algorithm to distinguish between legitimate and illegal users, with low computational complexity, to achieve DDoS attack detection in the random access phase of the 5G NR network. At the same time, due to its low computational complexity, low computational overhead, and low cost, it achieves a satisfactory balance between computational overhead and security level, making it suitable for detecting illegal user DDoS attacks in 5G massive connection scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0033] Figure 1A diagram of a mode selection process of a base station provided in an embodiment of the present invention;

[0034] Figure 2 This is a flow chart of a method for resisting DDoS attacks based on physical layer attributes provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0036] Base stations are categorized into small base stations and macro base stations. Small base stations are those with significantly smaller transmission power, coverage, and user capacity than traditional macro base stations, and with limited computing and storage capabilities.

[0037] The method for resisting DDoS attacks based on physical layer attributes of the present invention uses two working modes of the base station, Mode 1 and Mode 2. Figure 1 As shown in , if the base station is a small base station with weak computing and storage capabilities, then Mode 1 is adopted, otherwise Mode 2 is adopted. Figure 2 As shown, the method specifically includes the following steps:

[0038] S1. Set a threshold Threshold, which indicates the maximum number of random accesses that can be initiated by the same UE (given in the SIB1 scheduling information sent by the network side).

[0039] S2. The UE sends a random access preamble (i.e., Msg1, RA Preamble) to the base station gNB.

[0040] S3. After receiving Msg1, the gNB determines whether the base station is a small base station. If it is, it adopts Mode 1 and executes this step. Otherwise, it adopts Mode 2 and executes step S8. It automatically calculates TA (Time Advance) and records all TA values ​​received within a period of time to obtain an N-dimensional vector TA = [TA0, TA1, ..., TA N-1 ].

[0041] S4. Perform one-dimensional clustering based on TA. Specifically, TA values ​​are divided into K categories. Based on the N-dimensional vector TA, a K-Means clustering method is used to classify them. If a hierarchical clustering algorithm is used that does not require knowing the number of categories in advance, K categories do not need to be set in advance. The K value is determined based on the resolution of the TA in the actual cell. The K value actually represents the categories of TA values ​​that can be distinguished in the cell. Therefore, K = cell radius / TA value resolution. The TA resolution is generally 78m. For example, in a small cell with a typical 5G cell radius of 780m, K is 10.

[0042] S5. If the number Number1 of elements in a certain category is greater than the threshold Threshold, it is determined that there may be malicious users in the category, and step S6 is executed; otherwise, it is determined that there are no malicious users and access is allowed.

[0043] S6. Track the UEs whose TA values ​​are in the class of possible malicious users, extract the CFO values ​​from the Msg1 messages sent by these UEs, and obtain an N-dimensional vector ε = [ε0, ε1, ..., ε N-1 ], performing one-dimensional clustering based on ε. Specifically, the CFO values ​​are divided into M categories, and the K-Means clustering method is used based on the N-dimensional vector ε to classify them. If an algorithm such as a hierarchical clustering algorithm is used that does not require a known number of categories, M categories do not need to be set in advance. The value of M is the average number of users initiating random access in a 5G cell under normal circumstances.

[0044] 3) Taking advantage of the fact that illegal users want to interrupt legitimate services with a large number of random access requests, a simple clustering algorithm is proposed, and two modes that can be adopted by base stations with different computing capabilities are proposed to achieve a satisfactory balance between security level and computing overhead.

[0045] 4) This patent can be applied to DDoS attack detection in the random access phase of 5G NR networks, with low cost and small computational overhead, and achieves a satisfactory balance between security level and computational overhead through two schemes.

[0046] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for resisting DDoS attacks based on physical layer properties, characterized in that: The base station operates in two modes, including the following steps: S1. Set a threshold, Threshold, which indicates the maximum number of random accesses that can be initiated by the same UE. S2. The UE sends a random access preamble Msg1 to the base station gNB. S3. After receiving Msg1, the gNB determines whether the base station is a small base station. If so, it adopts Mode 1 and executes this step. Otherwise, it adopts Mode 2 and executes step S8. It automatically calculates TA and records all TA values ​​received within a period of time to obtain an N-dimensional vector TA = [TA0, TA1, ..., TA N-1 ]; S4, one-dimensional clustering based on TA; S5. If the number of elements in a certain class Number1 is greater than the threshold Threshold, it is determined that there may be a malicious user in the class, and step S6 is executed; otherwise, it is determined that there is no malicious user and access is allowed; S6. Track the UEs whose TA values ​​are in the class of possible malicious users, extract the CFO values ​​from the Msg1 messages sent by these UEs, and obtain an N-dimensional vector ε = [ε0, ε1, ..., ε N-1 ], one-dimensional clustering based on ε; S7. If the number of elements in a certain category, Number2, is greater than the threshold, the user with the CFO value of this category is determined to be a malicious user and its access request is rejected. Otherwise, its access request is accepted. S8. The base station continuously obtains the TA value and CFO estimation value of the received signal and defines a 2×N matrix A = [TAε] T , where TA and ε represent N sample values ​​of the timing advance and carrier frequency offset from the user terminal, respectively, and TA = [TA0, TA1, ..., TA N-1 ],ε=[ε0,ε1,…,ε N-1 ]; S9, perform two-dimensional clustering based on matrix A; S10. If the total number of matrices A in a certain category, Number3, is greater than a threshold, the user of the matrix A in this category is determined to be a malicious user, and its access request is rejected; otherwise, its access request is accepted.

2. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: In step S4, the TA values ​​are divided into K categories in total, and the TA values ​​are classified into one category using the K-Means clustering method based on the N-dimensional vector TA.

3. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: In step S6, the CFO values ​​are divided into M categories in total, and the CFO values ​​are classified into one category using the K-Means clustering method based on the N-dimensional vector ε.

4. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: The estimation and processing of the CFO value in step S6 is embedded in the signal processing of the receiver.

5. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: The method for obtaining the CFO value in step S6 is to measure the CFO using a time domain method or a frequency domain method using repeated resources, or to estimate the CFO using a training sequence with a pilot inserted, or to track the CFO using an extended Kalman filter, or to estimate the CFO based on an AVR.

6. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: In step S9, the values ​​of the two-dimensional matrix A are divided into P categories in total. Based on the two-dimensional matrix A, the values ​​of A are classified using the K-Means clustering method.

7. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: The K value is determined according to the resolution of the TA in the cell, K = cell radius / resolution of the TA value.

8. The method for resisting DDoS attacks based on physical layer attributes according to claim 1, characterized in that: The values ​​of M and P are the average number of users initiating random access in the 5G cell.

Images