Data center power attack detection method and system

Abstract

The present invention discloses a data center power attack detection method and system. Through a GAN model based on reinforcement learning, the generator's ability to fit samples and the discriminator's judgment ability are utilized to generate simulated time series data; a GBDT model is used for power attack detection; a power management and control module is run on the server side, and client programs are run on other machines to collect client data; and a GBDT detection model is run in the data center to grant the power management module the power of power management. When a power attack event occurs, the additional power consumption is reduced and the pressure of the power attack is alleviated. The present invention provides effective and reliable training data, improves the accuracy of the detection model, and can overcome the problem of insufficient data samples for power attack detection in data centers.

Description

Technical Field

[0001] The present invention relates to a method for detecting power attacks in a data center, and in particular to a method and system for detecting power attacks using log data (including real data and generated data) generated by the data center. Background Art

[0002] In recent years, with the continuous development of big data and e-commerce, the demand for cloud services from major internet companies and telecommunications companies has grown rapidly. This has led to a significant increase in the number and size of data centers. As data center power distribution and cooling systems are nearing capacity, and upgrading data center power infrastructure is prohibitively expensive, most data center operators currently resort to oversubscription to save costs while accommodating more servers. The key idea behind oversubscription is to place servers in a data center whose peak power consumption exceeds the rated power consumption of the data center. Since data center servers rarely reach peak power consumption simultaneously, this approach allows for more servers without requiring upgrades to the power infrastructure. However, this approach can cause the total power consumption of the servers to exceed the rated power, potentially tripping circuit breakers at various levels of the data center.

[0003] From a security perspective, oversubscribing power exposes data centers to malicious workloads that could cause multiple servers to reach peak power consumption simultaneously. The creation of such malicious workloads is defined as a power attack. The attacker simply subscribes to the data center's services like a regular user, without requiring any privileges, to launch a powerful power attack. Due to the oversubscription of power, the target data center's power consumption is likely to exceed its rated power consumption, overloading circuits and tripping rack-level or even higher-level circuit breakers, leading to a power outage. The goal of a power attack is to disable power in the target data center, disrupting or even terminating services running on the servers. Power outages caused by power attacks not only endanger cloud service providers, leading to default and a reduction in their creditworthiness, but also inflict significant losses on the computing service owners of the servers affected by the power outage.

[0004] Detection of power attacks is of great significance to improving data center security and reducing losses. However, the difficulties of power detection in data centers are mainly as follows: (1) There are many types of attacks, and it is difficult to identify the attacker's specific attack method when attacked; (2) Power attack detection is mostly carried out on the types of attacks that have been discovered, making it difficult to prevent new attacks; (3) There is little data available for training, making it difficult to use traditional machine learning algorithms for detection. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to address the shortcomings of the existing technology and provide a data center power attack detection method and system. The generator can generate reliable simulated time series data, thereby solving the problem of insufficient data samples for power attack in data centers and improving the accuracy of power attack detection.

[0006] To solve the above problems, the solution adopted by the present invention is:

[0007] The present invention provides a data center power attack detection method, comprising the following steps:

[0008] S1: The SeqGAN (Sequence Generative Adversarial Networks) model is trained in the data generation module. In each round of training, the model inputs the real data of the data center during the power attack and the data generated by the generator in the previous round. The final generated data is obtained after the last round of training.

[0009] S2: In the machine learning module, the final data generated in S1 is used together with real data to train the GBDT detection model, which includes two parts: Classification and Regression Trees (CART) generation and fitting negative gradients;

[0010] S3: In the data import module, modify the configuration file of the log system. While writing logs to the database, input the data into the GBDT model trained in S2.

[0011] S4: Run the server side of the power control module on the server side, run the client program on other machines, and use the simulated annealing heuristic algorithm to find a suitable convergence point;

[0012] S5: Run the GBDT detection model trained in S2. When a power consumption anomaly or attack is detected, the power control module takes over power management of the connected systems. Repeat S4 periodically to find new convergence points.

[0013] Currently, there are relatively few methods for detecting power attacks in data centers. Most of them target specific types of power attacks, resulting in limited versatility and significant latency in detection results, hindering the effectiveness of power attack detection systems in preventing and mitigating them. Therefore, this paper proposes a highly versatile, low-latency detection method to improve the efficiency of data center power attack detection and reduce detection latency.

[0014] The present invention first uses the SeqGAN model based on reinforcement learning to generate qualified data by leveraging the generator's ability to fit samples and the discriminator's judgment ability. Then, the gradient boosting decision tree (GBDT) model is used to detect power attacks. Thirdly, the power management and control module is run on the server side, and the client program is run on other machines to collect client data. Finally, the GBDT model is run in the data center to give the power management module the power to manage power. When a power attack occurs, the additional power consumption is reduced, alleviating the pressure of the power attack.

[0015] The specific implementation process of step S1 includes:

[0016] S1-1: During iterative training, the SeqGAN model calls the generator and discriminator multiple times;

[0017] S1-2: When generating running data, call the generator to generate multiple options and use the discriminator to score all the options;

[0018] S1-3: Select a better strategy based on the score and adjust the generator parameters to make the generated data more accurate.

[0019] This step generates accurate and reliable data on the data center's performance during power attacks through scoring and policy adjustments. The advantage is that generating a large amount of training data improves the accuracy of the detection model and also provides a foundation for training the GBDT detection model in S2.

[0020] The specific implementation process of step S2 includes:

[0021] S2-1: Find the best partition point and build CART;

[0022] S2-2: Minimize the loss function and fit the negative gradient.

[0023] The specific implementation process of step S3 includes:

[0024] S3-1: Modify the configuration file of the log system and change the output source of the log to both the database and the GBDT detection model;

[0025] S3-2: The GBDT detection model accepts input from the log source and performs detection based on this data.

[0026] The specific implementation process of step S4 includes:

[0027] S4-1: Using a Client-Server (C / S) structure, the server runs on a separate server and the client runs on other machines in the data center;

[0028] S4-2: Use the simulated annealing heuristic algorithm to find data aggregation points in the client machines so that the average transmission delay of all machines in the data center is minimized;

[0029] S4-3: After S4-2 is completed, a three-level architecture consisting of client, aggregation point, and server is formed. The client machine is connected to a currently designated aggregation point through the heartbeat mechanism and transmits the real-time data of the current machine to the aggregation point.

[0030] The specific implementation process of step S5 includes:

[0031] S5-1: Real-time data is transmitted from the client to the server through the aggregation point. When the GBDT model in S2 detects power anomalies, it will alert the power control module.

[0032] S5-2: When the power control module receives continuous abnormal detection, it takes defensive measures and sends signals to reduce power consumption step by step;

[0033] S5-3: Repeat S4 periodically (the cycle can be set to one day) to find a new convergence point.

[0034] The present invention also provides a data center power attack detection system, which includes a server device; the server device is configured or programmed to execute the steps of the above method.

[0035] Compared with the prior art, the present invention has the following advantages:

[0036] (1) The present invention generates data through GAN and uses it as the input of the GBDT detection model, overcoming the problem of too few data samples and low detection model accuracy in current power attack detection methods.

[0037] (2) This paper proposes the use of SeqGAN to generate time series data. Compared with the traditional GAN ​​network, SeqGAN can adjust the evaluation function and strategy in real time during training, and select the item with the highest score from multiple generation options, making the data more real and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a system architecture diagram for power attack detection.

[0039] Figure 2 This is a flow chart of the power attack detection method.

[0040] Figure 3 This is a diagram of the process of SeqGAN algorithm generating data.

[0041] Figure 4 This is the flow chart of the negative gradient fitting algorithm. DETAILED DESCRIPTION

[0042] like Figure 1 and Figure 2 As shown in FIG, a data center power attack detection method based on Generative Adversarial Networks (GAN) and Gradient Boosting Decision Tree (GBDT) includes the following steps:

[0043] S1: The SeqGAN model is trained in the data generation module. In each round of training, the model inputs the real data of the data center during the power attack and the data generated by the generator in the previous round. The final generated data is obtained after the last round of training.

[0044] S2: In the machine learning module, the final data generated in S1 is used together with the real data to train the GBDT detection model. The model includes two parts: CART regression tree generation and negative gradient fitting.

[0045] S3: In the data import module, modify the configuration file of the log system. While persisting the logs, input the log data into the GBDT model trained in S2.

[0046] S4: Run the server side of the power control module on the server side, run the client program on other machines, and use the simulated annealing heuristic algorithm to find a suitable convergence point;

[0047] S5: Run the GBDT detection model trained in S2. When a power consumption anomaly or attack is detected, the power control module takes over power management of the connected systems. Repeat S4 periodically to find new convergence points.

[0048] The method first trains the SeqGAN model and generates reliable, realistic simulated time series data. Secondly, the simulated time series data and real data are used as inputs for the GBDT model training. Thirdly, the power management module is run on the server side, and the client program is run on other machines to collect client data. Finally, the GBDT detection model is run in the data center, granting the power management module power. In the event of a power attack, additional power consumption is reduced, alleviating the pressure of the attack.

[0049] The specific implementation process of step S1 includes:

[0050] S1-1: During iterative training, SeqGAN calls the generator and discriminator multiple times;

[0051] The principle diagram of SeqGAN is as follows Figure 3As shown in the figure. The difference from ordinary GAN is that in one iterative training, SeqGAN will call the generator G and discriminator D multiple times. Taking the generation of running data sequence as an example, each circle is a recorded operation, and the unbranched part in the right figure is the generated sequence;

[0052] S1-2: When generating running data, call the generator to generate multiple options and use the discriminator to score all the options;

[0053] The expected value of the rating is M(θ)

[0054]

[0055] Generate the expectation of the score of a complete sequence under the conditions of s0 and θ. θ For the generator, is the behavior value function of the sequence. This formula is the probability of the generator generating a certain z1 multiplied by the behavior value function. In this way, the probability of all z1s multiplied by V is obtained, and then summed up to obtain M(θ), which is the function that the generator wants to maximize.

[0056] The behavior value function uses the reinforcement algorithm and can be regarded as the return value of the discriminator D.

[0057]

[0058] Since the score generated by the incomplete sequence has no practical meaning, the score from z1 to z t-1 In the case of z t If it is not the last element of the entire sequence, the generated y t The behavior value function of z cannot be directly calculated. Therefore, Monte Carlo search is used to find the value of z. t The content after is completed to generate a complete sequence. Since Monte Carlo search is random, it is necessary to t Scores are calculated for all possible sequences and averaged.

[0059]

[0060] By using the above method, a complete sequence can be generated, and then the discriminator is trained as follows.

[0061]

[0062] After training the discriminator D for several rounds, a better discriminator D is obtained. At this time, the discriminator D is used to update the generator G. The update of the generator G can be regarded as a gradient descent.

[0063]

[0064] in

[0065]

[0066] α h Represents the learning rate.

[0067] S1-3: Select the best strategy based on the score and adjust the generator to make the generated data more accurate.

[0068] Based on S1-1 to S1-3, the steps for data generation using SeqGAN in this stage are:

[0069] S1-3-1: Randomly initialize the generator G and discriminator D parameters;

[0070] S1-3-2: Pre-train the generator G through maximum likelihood estimation to improve search efficiency;

[0071] S1-3-3: Use the pre-trained generator G to generate some data for pre-training the discriminator D by minimizing cross entropy;

[0072] S1-3-4: Start generating sequences and calculating scores;

[0073] S1-3-5: Update the parameters of generator G;

[0074] S1-3-6: Use the updated generator G to generate better sequences and train the discriminator D together with the real data;

[0075] S1-3-7: Determine whether θ converges. If so, end the process; otherwise, go to S1-3-4.

[0076] This step generates accurate and reliable data on data center indicators during power attacks through scoring and policy adjustments. The advantage is that generating a large amount of training data not only provides a training foundation for the GBDT detection model but also improves its accuracy.

[0077] The specific implementation process of step S2 includes:

[0078] S2-1: Find the best partition point and build a classification and regression tree;

[0079] The most important part of the regression tree algorithm is to find the best partition point. In the input space where the training data set is located, each area is recursively divided into two sub-areas and the output value of each sub-area is determined to construct a binary decision tree.

[0080] The steps for building a regression tree are as follows:

[0081] S2-1-1: Find the optimal segmentation variable j and segmentation point s, and solve

[0082]

[0083] For the optional split variable a and split point b, select the value pair (a, b) that makes the above formula reach the minimum value;

[0084] S2-1-2: Divide the entire space by the selected value pair (a, b) and calculate the corresponding output value

[0085] R1(a,b)={x|x (a) ≤b},R2(a,b)={x|x (a) >b}

[0086]

[0087] S2-1-3: Continue to call S2-1-1 and S2-1-2 for the two sub-areas until the stop condition is met;

[0088] S2-1-4: Divide the entire input space into M blocks, R1, R2, ..., R M , generate a decision tree

[0089]

[0090] S2-2: Minimize the loss function and fit the negative gradient;

[0091] Figure 4 This is a flow chart of the present invention fitting negative gradient, and the specific implementation steps are as follows:

[0092] The main steps of negative gradient fitting are as follows:

[0093] S2-2-1: Initialize f0(x)=0;

[0094] S2-2-2: For each region m, calculate the residual value, r mi =y i -f m-1 (x i ),i=1,2,…,N;

[0095] S2-2-3: Fitting residual r mi Learn a regression tree and get

[0096] S2-2-4: Update If every area has been traversed, go to S2-2-5, otherwise return to S2-2-2;

[0097] S2-2-5: Get the final boosting tree

[0098] The specific implementation process of step S3 includes:

[0099] S3-1: Modify the configuration file of the log system and change the output source of the log to both the database and the GBDT detection model;

[0100] S3-2: The GBDT detection model receives input data from the log and uses this data to detect power attacks.

[0101] The specific implementation process of step S4 includes:

[0102] S4-1: Using a Client-Server (C / S) structure, the server runs on a separate server and the client runs on other machines in the data center;

[0103] S4-2: Use the simulated annealing heuristic algorithm to find data aggregation points in the client machines so that the average transmission delay of all machines in the data center is minimized;

[0104] S4-3: After S4-2 is completed, a three-level architecture consisting of client, aggregation point, and server is formed. The client machine is connected to a currently designated aggregation point through the heartbeat mechanism and transmits the real-time data of the current machine to the aggregation point.

[0105] The specific implementation process of step S5 includes:

[0106] S5-1: Real-time data is transmitted from the client to the server through the aggregation point. When the GBDT model in S2 detects power anomalies, it will alert the power control module.

[0107] S5-2: When the power control module receives continuous abnormal detection, it takes defensive measures and sends signals to reduce power consumption step by step;

[0108] S5-3: Repeat S4 periodically (the cycle can be set to one day) to find a new convergence point.

Claims

1. A data center power attack detection method, characterized in that The method comprises the following steps: S1: The SeqGAN model is trained in the data generation module. In each round of training, the model inputs the real data of the data center during the power attack and the data generated by the generator in the previous round. The final generated data is obtained after the last round of training. S2: In the machine learning module, the final data generated in S1 is used together with the real data to train the GBDT detection model. The model includes two parts: CART regression tree generation and negative gradient fitting. S3: In the data import module, modify the configuration file of the log system. While writing logs to the database, input the data into the GBDT model trained in S2. S4: Run the server side of the power control module on the server side, run the client program on other machines, and use the simulated annealing heuristic algorithm to find the convergence point; S5: Run the GBDT detection model trained in S2. When a power consumption anomaly or power consumption attack is detected, the power control module takes over the power management of the connected systems and repeats S4 periodically to find a new convergence point. The specific implementation process of S1 includes: S1-1: During iterative training, the SeqGAN model calls the generator and discriminator multiple times; S1-2: When generating running data, call the generator to generate multiple options and use the discriminator to score all the options; The expected score is M(λ) Under the conditions of s0 and θ, the expectation of the score of generating a complete sequence, G θ For the generator, is the behavior value function of the sequence; S1-3: Select a better strategy based on the score and adjust the generator parameters to make the generated data more accurate; The specific implementation process of S2 includes: S2-1: Find the best partition point and build a classification and regression tree; S2-2: Minimize the loss function and fit the negative gradient; The specific implementation process of S4 includes: S4-1: Using a client-server architecture, the server runs on a separate server, and the client runs on other machines in the data center; S4-2: Use the simulated annealing heuristic algorithm to find data aggregation points in the client machines so that the average transmission delay of all machines in the data center is minimized; S4-3: After S4-2 is completed, a three-level architecture of client, aggregation point, and server is formed. The client machine is connected to a currently designated aggregation point through the heartbeat mechanism and transmits the real-time data of the current machine to the aggregation point; The specific implementation process of S5 includes: S5-1: Real-time data is transmitted from the client to the server through the aggregation point. When the GBDT model in S2 detects power anomalies, it alerts the power control module. S5-2: When the power control module receives continuous abnormal detection, it takes defensive measures and sends signals to reduce power consumption step by step; S5-3: Repeat S4 periodically to find a new convergence point.

2. The power attack detection method according to claim 1, characterized in that: The specific implementation process of S3 includes: S3-1: Modify the configuration file of the log system and change the output source of the log to both the database and the GBDT detection model; S3-2: The GBDT detection model accepts input from the log source and performs detection based on this data.

3. A data center power attack detection system, characterized in that: The invention comprises a server device; the server device is configured or programmed to execute the steps of the method according to any one of claims 1 to 2.

Images