Distributed Denial of Service Attack Detection Method Based on Long Short-Term Memory and Attention Model

Abstract

A distributed denial of service attack detection method based on long short-term memory and attention models is designed to detect distributed denial of service attacks in networks. The method is divided into the following steps: constructing a detection model for distributed denial of service attacks, using effective traffic feature extraction methods, and combining device monitoring and alarms. While generating alarms for abnormal traffic activity, it can not only make timely judgments on incoming data packets, but also identify the specific type of DDoS attack when attacked, providing more effective information for the design of traffic filtering rules for cleaning and filtering abnormal traffic. In addition, because the switch can capture all data packets passing through the device, it can achieve the effect of deploying a single detection host to detect multiple devices, effectively saving the cost of deploying the detection model.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a distributed denial of service attack detection method based on long short-term memory and attention models. Background Art

[0002] A distributed denial of service (DDoS) attack occurs when multiple attackers in different locations simultaneously launch an attack against one or more targets. Because the attacks originate from diverse locations, they are called distributed denial of service (DDoS) attacks. DDoS attacks have a long history and pose a threat to nearly every sector, including business, politics, finance, and even the military. Many DDoS attacks have caused major websites to become inoperable, disrupting user experience and causing significant losses. Therefore, research on DDoS attack detection technology is crucial.

[0003] Distributed denial of service attacks can forge source IP addresses during attacks, making them highly concealed and difficult to detect. This makes them one of the most difficult attacks to prevent. Existing research has proposed numerous detection techniques for DDoS attacks, which can be broadly categorized into three strategies: monitoring devices, session management, and traffic feature detection. Monitoring devices monitor data such as the server's central processing unit (CPU) load, the server's network bandwidth load, and application response time. These devices can detect unknown attacks. However, simply observing abnormal changes in the device itself cannot determine whether they are caused by a DDoS attack, nor can they identify the attack type. While session management techniques are effective in detecting DDoS attacks based on the TCP protocol, they are less effective for UDP-based attacks. Traffic feature detection is a knowledge-based detection method. It first collects various features of known DDoS attacks and then compares the packets currently in the network with these features. If the signature matches that of a DDoS attack, a DDoS attack can be detected. This detection method can accurately detect attack behavior, identify the attack type, and implement appropriate measures to prevent the attack. However, its drawback is that traffic feature extraction is difficult, making it less effective against attacks using large numbers of zombie machines. Therefore, it is important to design a detection technology for distributed denial of service attacks that can effectively extract traffic features and use traffic feature-based strategies. Summary of the Invention

[0004] In order to overcome the shortcomings of the above-mentioned background technology, the present invention provides a distributed denial of service attack detection method based on long short-term memory and attention model, aiming to achieve effective detection of distributed denial of service attacks.

[0005] In order to achieve the above technical objectives, the present invention provides the following technical solutions:

[0006] A distributed denial of service attack detection method based on long short-term memory and attention model includes the following steps:

[0007] 1) Construct a network structure for distributed denial of service attack detection;

[0008] 2) Launch different types of DDoS attacks on target hosts, including ICMP Flood, Smurf Attack, SYN Flood, and SYN-ACK Flood;

[0009] 3) Packet capture and forwarding: obtain all input data packets of the attacked host and forward them to the detection host;

[0010] 4) Preprocessing the data: the detection host converts the obtained data packets into a format suitable for model input;

[0011] 5) Training the model, input the prepared data set into the model for training;

[0012] 6) Perform attack detection, deploy the model on the detection host, and perform network attack detection on the network data flow.

[0013] Furthermore, the network structure for distributed denial of service attack detection described in step 1) includes a switch, a target host, a reflection amplification host, an attacking host, a client host, and a detection host. These devices form a local area network (LAN). All hosts are connected to the LAN via direct connections to the switch, and the hosts are not interconnected. The detection host and the target host are connected to the same switch. In this network structure, the switch not only interconnects physically connected devices but also captures and sends packets forwarded to the target host by the switch to the detection host. The target host is configured to provide services to other hosts, allowing other hosts to send packets to the target host to access it. The target host acts as a victim and is attacked by other hosts. The attacking host is capable of running attack scripts, and the reflection amplification host can be configured as a server (e.g., a domain name server, time server, or website server) during the attack process, providing reflection amplification for the DDoS attack. The client host is responsible for performing specific access to the target host during the attack to verify the success of the attack. The detection host uses a deployed detection algorithm to detect the data sent by the switch.

[0014] At the same time, the following settings are proposed for the network model of step 1) for the distributed denial of service attack detection problem:

[0015] 11) All devices in the network model have the ability to discover and connect to each other;

[0016] 12) The performance of the switch can ensure that the message forwarding to the detection host is not limited by bandwidth;

[0017] 13) The attacking host will not be restricted by its own firewall when running the DDoS attack script against the target host;

[0018] 14) The detection host will not communicate with other devices in the entire structure except for receiving data packets sent by the switch to the target host, preventing itself from being used as an amplification device for DDoS attacks;

[0019] 15) The reflection amplifier host does not use a firewall during operation.

[0020] In step 2), a DDoS attack is carried out on the target host of the network structure built in step 1); first, according to the type of DDoS attack, a corresponding attack script is written and deployed on the attacking host, and all attacking hosts attack the target host in the same time period.

[0021] Furthermore, in step 2), the specific steps of carrying out a DDoS attack on the target host are as follows:

[0022] 21) After the network deployment is completed, set the IP address and subnet mask of all devices and turn off the automatic IP acquisition function;

[0023] 22) Write a corresponding attack script for the DDoS attack you want to detect: Write a corresponding attack script for each attack type. After writing it, run the script on an attacking host and observe the performance of the target host (CPU load, traffic input, service response time). Debug the script based on the performance of the target host to achieve the best attack effect.

[0024] 23) Configure the reflection amplification host: Before running the DDoS attack script based on reflection amplification, configure the required reflection amplification host according to the attack requirements. For example, when running a DNS amplification attack, configure the reflection amplification host as a domain name server;

[0025] 24) Run the DDoS attack script on the attacking host: Deploy the debugged DDoS attack script on each attacking host. All attacking hosts will run the same attack at the same time, with the target IP address set to the IP address of the target host. During each attack, the client host will access the target host using the same protocol as the attack type. The attack is considered successful only if the client host cannot access the target host or the target host responds with a significant delay.

[0026] In step 3), the data packets forwarded to the destination host are captured by tcpdump software in the switch, and the data packets are packaged and forwarded to the detection host.

[0027] In step 3), the data packet collection steps are specifically as follows:

[0028] 31) Establish communication between the switch and the detection host: Enable the SSH service function of the switch and configure the IP address, generate an encryption key, and configure the login password for SSH management; install Xshell software on the detection host and transmit the packets captured by the switch to the detection host through the SSH service enabled on the switch;

[0029] 32) Configure the switch and detection host software: Install tcpdump software on the switch. Install the wireshark tool on the detection host. Use Xshell software to remotely connect to the switch and obtain root privileges on the switch.

[0030] 33) Capture normal data packets: Enter the command to capture packets on the switch and transmit them back to the local server in the Xshell software on the detection host. This allows the tcpdump software installed on the switch to capture the data packets sent to the target host. These packets are then transferred to the wireshark software on the detection host via SSH and saved in a designated folder on the detection host. During the capture process, all attacking and client hosts access the services provided by the target host in a normal manner. The duration of the entire capture process is determined by the amount of data required.

[0031] 34) Launch an attack on the target host: Disconnect the physical connection between the switch and the outside world to prevent external interference with the attack process and to prevent the attack from interfering with the external network. After completing the normal data packet capture in step 33), the attack in step 2) is launched according to the rule that only one attack is carried out per round, and all attacking hosts attack the target host simultaneously. Each attack process will last for 1 hour before the next attack is launched;

[0032] 35) Capture abnormal data packets: While attacking, use the same command as that used in step 3) to capture normal data packets to capture abnormal data packets, and save the packets for recording to determine the corresponding attack type.

[0033] In step 4), the data package obtained in step 3) is converted into the model input format and divided into training and test sets. The specific steps are as follows:

[0034] 41) Classify the data packets: Classify the normal and abnormal data packets obtained by the packet capture according to the protocol type (ICMP, UDP, IP-in-IP, TCP, etc.) in the IP packet protocol, and sort the data packets with the same protocol according to the capture time and put them in the same folder, and attach the information of whether it is an abnormal data packet, which is recorded as y ij , where y ij There are only two values ​​0 and 1, 0 represents a normal data packet, 1 represents an abnormal data packet; i represents the i-th protocol; j represents the j-th packet under this protocol;

[0035] 42) Process the header of the core protocol of the data packet: extract the information of the data packet of each type of protocol, and extract the header of each message using the protocol (ICMP, UDP, IP-in-IP, TCP, etc.) according to the protocol type in the IP data packet. Save it as a binary number (the length of the header data of different protocols may be different, but the length of the header data of the same protocol is the same), which is recorded as x ij0 , where x ij0 It represents the binary value saved by each data packet in this step, i represents the i-th protocol; j represents the j-th packet under this protocol;

[0036] 43) Process the Ethernet frame header and IP message of the data packet: extract the destination MAC address (48 bits) and source MAC address (48 bits) in the Ethernet frame header of each data packet, a total of 96 bits, in the form of binary numbers; extract the service type (8 bits), identification (16 bits), flags (3 bits), fragment offset (13 bits), lifetime (8 bits), source IP address (32 bits), and destination IP address (32 bits) in each data packet, a total of 112 bits, in the form of binary numbers; save the above two parts of data separately and record them as x ij1 、 x ij2 , where x ij1 It represents the binary value stored in the Ethernet frame header of each data packet, x ij2 It represents the binary value of each data packet stored in the IP message, i represents the i-th protocol; j represents the j-th packet under this protocol;

[0037] 44) Process the data portion of the core protocol of the data packet: Extract information from the data packet of each protocol type, and count the data portion of each message using the protocol (ICMP, UDP, IP-in-IP, TCP, etc.) according to the protocol type in the IP data packet; the statistical data portion is the number of 0 to F in hexadecimal encoding and saved as a matrix as shown below:

[0038]

[0039] where x ij3 represents the matrix saved for each data packet in this step. The matrix consists of 4 rows and 4 columns. i represents the i-th protocol; j represents the j-th packet under this protocol; x0-xF represents the number of 0-F when the data part is encoded in hexadecimal (for example, x0 represents the number of hexadecimal 0s when the data part is encoded in hexadecimal);

[0040] 45) Convolution processing of data: Convolution of the corresponding data x in step 42) and step 43) ij0 、x ij1 and x ij2 Convert them into two-dimensional matrices of n×16, 12×8, and 14×8 respectively. Then perform different convolution calculations on the above three two-dimensional matrices to obtain three 4×4 matrices, and replace the convolution matrices with x ij0 、x ij1 and x ij2 .

[0041] 46) Data fusion: merge the data x stored in step 44) and step 45) ij0 、x ij1 、 x ij2 and x ij3 and the corresponding label y ij Fusion, we get the following form:

[0042] (x ij ,y ij )

[0043] in The data extracted from the jth packet of the i-th protocol is a 4×4×4 matrix; and the label y ij Indicates whether the jth packet of the i-th protocol is an abnormal data packet;

[0044] 47) Make a data set: The fused data (x ij ,y ij ), arrange them in the order of the captured packets, and classify them into two categories: normal and abnormal. Then separate the abnormal data and normal data (xij ,y ij ) Under the condition that the order of the same type of data remains unchanged, the two types of data are randomly crossed to achieve the purpose of mixing, and the corresponding data set under the protocol is obtained:

[0045] D i =(X i , Y i )

[0046] where X i ={x ij}, Y i ={y ij}, i represents the i-th protocol.

[0047] In step 5), the model is trained using the data set obtained in step 4), and the model parameters are debugged according to the test results. The specific steps are as follows:

[0048] 51) Divide the data set: divide the data D generated by each type of protocol obtained in step 4) j , without disturbing the order, 80% is used as the training set and 20% for the test set to divide;

[0049] 52) Model construction: Connect the LSTM and AM algorithms in parallel. The connection method is: the input layer of the two is used as the input layer of the entire model, but the output layers of the two are added together to obtain the model output. The hidden layer of the model is the hidden layer of the LSTM and AM in parallel.

[0050] 53) Training model: Initialize the i-th protocol dataset D i Model m i , customize the number of training epochs, batch size, optimizer, learning rate and loss function. The optimizer uses stochastic gradient descent, the learning rate is set to the initial cosine learning rate of 0.1, the loss function adds a regularization parameter λ to the cross entropy function, and the model training objective is expressed as the following formula:

[0051]

[0052] Where p(·) represents the true label of the sample, q(·) represents the predicted probability of the model, and x ij represents the sample of protocol input i, φ represents the model parameter, and λ represents the regularization coefficient;

[0053] After training, save the original model m i ;

[0054] 54) Debug model: Test data set corresponding to the protocol Input the initial model m after training j , and obtain the accuracy of the corresponding prediction value by calculation; adjust the parameters of the model, only adjust one parameter at a time, train the model after adjustment, and then test to obtain the accuracy under this set of parameters; repeat this method of adjusting parameters, training, and testing to obtain a set of parameters with the highest accuracy, and obtain the model m under this set of parameters i .

[0055] 55) Obtain models for all protocol types: Repeat steps 53) and 54) for all captured and processed data sets to obtain a complete detection model M for DDoS attacks, where M = {m i}.

[0056] In step 6), the model is deployed in the switch and network attack detection is performed on the network data flow. The specific steps are as follows:

[0057] 61) Configure the target host traffic alarm system: Install Nagios software and its add-on program NRPE on the switch, and install Nagios software and its dependent software for web page display on the detection host. Using Nagios, configure the switch as a client and the detection host as a server to monitor each port on the switch. Set traffic alarm thresholds and issue an alarm when traffic exceeds the threshold.

[0058] 62) Establish a data preservation mechanism: Set the Wireshark on the detection host to automatically save files, and set it to automatically generate a new data packet file every time 1 second of data is captured, and automatically delete the oldest data file after every two such data files are generated;

[0059] 63) Establish a data preprocessing program: automatically obtain the first file in the folder where wireshark automatically saves files every second, and process all the data packets generated within 1 second according to the process in step 4) to obtain data X that can be input into the model j And by extracting the data from the protocol part of each data packet IP message, the protocol code c corresponding to each data packet is obtained. ij , get the data set (X i , C i ), where C i ={c ij}, i represents the i-th protocol, j represents the j-th packet under this protocol, and the data is saved in the folder where the input data of the detection model is stored;

[0060] 64) Model optimization: Write a protocol matching function and perform the corresponding detection operation after the protocol is matched. The specific operation is: loop once every 1 second to obtain the latest data in the folder where the input data is stored (X j , C j ) and used as the input of the detection model. i , C i ) in each c ij Do the matching and find the data (x ij , c ij ), and x ij Input to the detection model m of the i-th protocol i Make a judgment and get the corresponding detection result y ij , thereby determining whether the data is abnormal data generated under the i-th type of protocol, thereby achieving the detection effect;

[0061] 65) Automating the detection model: A Python script is written to call the module, enabling the target host's traffic alarm system (step 6) (step 61) to detect any alarm events. If an alarm event occurs, the scripted command is entered into the Xshell software on the detection host, which has established an SSH service with the switch, to capture the incoming traffic from the target host and transmit it back to the detection host. Wireshark is then enabled to automatically save data, a data preprocessor is run, and the optimized model (step 6) (step 6) (step 64) is enabled.

[0062] The present invention has the following beneficial effects: it constructs a detection model for distributed denial of service attacks, uses effective traffic feature extraction methods, and incorporates device monitoring and alarms. This not only generates alarms for abnormal traffic activity, but also enables timely identification of incoming data packets and identifies the specific type of DDoS attack when an attack occurs, providing more effective information for designing traffic filtering rules to clean and filter abnormal traffic. Furthermore, because the switch can capture all data packets passing through the device, a single detection host can monitor multiple devices, effectively reducing the cost of deploying the detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a network model diagram for the distributed denial of service attack detection problem;

[0064] Figure 2 Extract processing diagram for data packets in data processing;

[0065] Figure 3 This is the neural network structure diagram of the detection model;

[0066] Figure 4 Flowchart for the detection model;

[0067] Figure 5 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0068] In order to more clearly describe the technical content of the present invention, further description is given below in conjunction with specific examples.

[0069] Reference Figures 1 to 4 A distributed denial of service attack detection method based on long short-term memory and attention models. This method addresses the problem of distributed denial of service attack detection by capturing data packets input to the target host and using a data processing method based on the network protocol format. This method reduces data redundancy while retaining valid information more completely. In the actual deployment of the model, a traffic alarm system is used to issue an alarm when the input traffic value in the target host reaches a certain threshold, and immediately capture and detect the input traffic. While achieving timely judgment of DDoS attack events, it can also avoid the resource consumption caused by long-term packet capture and detection. When extracting data packet features, a parallel neural network structure based on long short-term memory and attention models is used to effectively extract data features, effectively improving the detection rate of DDoS attack events.

[0070] A distributed denial of service attack detection method provided by an embodiment of the present invention includes the following steps:

[0071] Step 1) Construct a network structure for distributed denial of service attack detection. The structure includes a switch, a target host, a reflection amplification host, an attack host, a client host, and a detection host. The above devices form a local area network. All hosts here are connected to the local area network by directly connecting to the switch, and the hosts are not connected to each other. The detection host and the target host are connected to the same switch. In this network structure, in addition to realizing the function of interconnecting physically connected devices, the switch also needs to capture the data packets forwarded to the target host through the switch and send them to the detection host. The target host is configured to provide services to other hosts. Other hosts can send packets to the target host to achieve the purpose of access. The target host plays the role of a victim and is attacked by other hosts. The attack host has the ability to run attack scripts. The reflection amplification host can be configured as a server in the attack process (for example: domain name server, time server, website server), providing reflection amplification for DDoS attacks. The client host is responsible for making specific visits to the target host during the attack to verify whether the attack is successful. The detection host detects the data sent by the switch through the deployed detection algorithm. For example Figure 1As shown, the network model for the distributed denial of service attack detection problem in step 1) is described as follows:

[0072] 11) All devices in the network model have the ability to discover and connect to each other;

[0073] 12) The switch can forward messages to the detection host without being restricted by bandwidth;

[0074] 13) The attacking host will not be restricted by its own firewall when running the DDoS attack script against the target host;

[0075] 14) The detection host will not communicate with other devices in the entire structure except for receiving data packets sent by the switch to the target host, preventing itself from being used as an amplification device for DDoS attacks;

[0076] 15) The reflection amplifier host does not use a firewall during operation.

[0077] Step 2) The specific process of launching a DDoS attack on the target host is as follows:

[0078] 21) After the network deployment is completed, set the IP address and subnet mask of all devices and turn off the automatic IP acquisition function;

[0079] 22) Write a corresponding attack script for the DDoS attack you want to detect: Write a corresponding attack script for each attack type. After writing it, run the script on an attacking host and observe the performance of the target host (CPU load, traffic input, service response time). Debug the script based on the performance of the target host to achieve the best attack effect.

[0080] 23) Configure the reflection amplification host: Before running the DDoS attack script based on reflection amplification, configure the required reflection amplification host according to the attack requirements. For example, when running a DNS amplification attack, configure the reflection amplification host as a domain name server;

[0081] 24) Run the DDoS attack script on the attacking host: Deploy the debugged DDoS attack script on each attacking host. All attacking hosts will run the same attack at the same time, with the target IP address set to the IP address of the target host. During each attack, the client host will access the target host using the same protocol as the attack type. The attack is considered successful only if the client host cannot access the target host or the target host responds with a significant delay.

[0082] Step 3): The specific process of collecting data packets is as follows:

[0083] 31) Establish communication between the switch and the detection host: Enable the SSH service function of the switch and configure the IP address, generate an encryption key, and configure the login password for SSH management; install Xshell software on the detection host and transmit the packets captured by the switch to the detection host through the SSH service enabled on the switch;

[0084] 32) Configure the switch and detection host software: Install tcpdump software on the switch. Install the wireshark tool on the detection host. Use Xshell software to remotely connect to the switch and obtain root privileges on the switch.

[0085] 33) Capture normal data packets: Enter the command to capture packets on the switch and transmit them back to the local server in the Xshell software on the detection host. This allows the tcpdump software installed on the switch to capture the data packets sent to the target host. These packets are then transferred to the wireshark software on the detection host via SSH and saved in a designated folder on the detection host. During the capture process, all attacking and client hosts access the services provided by the target host in a normal manner. The duration of the entire capture process is determined by the amount of data required.

[0086] 34) Launch an attack on the target host: Disconnect the physical connection between the switch and the external network to prevent external interference with the attack process and to prevent the attack from disrupting the external network. After completing step 33) to capture the normal data packets, the attack in step 2) is launched according to the rule that only one attack is carried out per round, and all attacking hosts attack the target host simultaneously. Each attack process will last for 1 hour before the next attack is launched.

[0087] 35) Capture abnormal data packets: While attacking, use the same command as that used in step 33) to capture normal data packets to capture abnormal data packets, and record the saved packets to determine the corresponding attack type.

[0088] Step 4) The data package obtained in step 3) is made into the format of model input and divided into training set and test set. Figure 2 The specific process is as follows:

[0089] 41) Classify the data packets: Classify the normal and abnormal data packets obtained by the packet capture according to the protocol type (ICMP, UDP, IP-in-IP, TCP, etc.) in the IP packet protocol, and sort the data packets with the same protocol according to the capture time and put them in the same folder, and attach the information of whether it is an abnormal data packet, which is recorded as y ij , where y ijThere are only two values ​​0 and 1, 0 represents a normal data packet, 1 represents an abnormal data packet; i represents the i-th protocol; j represents the j-th packet under this protocol;

[0090] 42) Process the header of the core protocol of the data packet: extract the information of the data packet of each type of protocol, and extract the header of each message using the protocol (ICMP, UDP, IP-in-IP, TCP, etc.) according to the protocol type in the IP data packet. Save it as a binary number (the length of the header data of different protocols may be different, but the length of the header data of the same protocol is the same), which is recorded as x ij0 , where x ij0 It represents the binary value saved by each data packet in this step, i represents the i-th protocol; j represents the j-th packet under this protocol;

[0091] 43) Process the Ethernet frame header and IP message of the data packet: extract the destination MAC address (48 bits) and source MAC address (48 bits) in the Ethernet frame header of each data packet, a total of 96 bits, in the form of binary numbers; extract the service type (8 bits), identification (16 bits), flags (3 bits), fragment offset (13 bits), lifetime (8 bits), source IP address (32 bits), and destination IP address (32 bits) in each data packet, a total of 112 bits, in the form of binary numbers; save the above two parts of data separately, and record them as xij1 and xj2. ij2 , where x ij1 It represents the binary value stored in the Ethernet frame header of each data packet, x ij2 It represents the binary value of each data packet stored in the IP message, i represents the i-th protocol; j represents the j-th packet under this protocol;

[0092] 44) Process the data portion of the core protocol of the data packet: Extract information from each protocol packet and, based on the protocol type in the IP packet, collect statistics on the data portion of each message using that protocol (ICMP, UDP, IP-in-IP, TCP, etc.). The statistical data is encoded in hexadecimal format as the number of 0 to F and saved as a matrix as shown below:

[0093]

[0094] where x ij3 Represents the matrix saved by each data packet in this step. The matrix consists of 4 rows and 4 columns. i represents the i-th protocol; j represents the j-th packet under this protocol; x0~x FRepresents the number of 0 to F when the data part is encoded in hexadecimal (for example, x0 represents the number of hexadecimal 0s when the data part is encoded in hexadecimal);

[0095] 45) Convolution processing of data: Convolution of the corresponding data x in step 42) and step 43) ij0 、x ij1 and x ij2 Convert them into two-dimensional matrices of n×16, 12×8, and 14×8 respectively. Then perform different convolution calculations on the above three two-dimensional matrices to obtain three 4×4 matrices, and replace the convolution matrices with x ij0 、x ij1 and x ij2 .

[0096] 46) Data fusion: merge the data x stored in step 44) and step 45) ij0 、 x ij1 、x ij2 and x ij3 and the corresponding label y ij Fusion, we get the following form:

[0097] (x ij ,y ij )

[0098] in The data extracted from the jth packet of the i-th protocol is a 4×4×4 matrix; and the label y ij Indicates whether the jth packet of the i-th protocol is an abnormal data packet;

[0099] 47) Make a data set: The fused data (x ij ,y ij ), arrange them in the order of the captured packets, and classify them into two categories: normal and abnormal. Then separate the abnormal data and normal data (x ij ,y ij ) Under the condition that the order of the same type of data remains unchanged, the two types of data are randomly crossed to achieve the purpose of mixing, and the corresponding data set under the protocol is obtained:

[0100] D i =(X i , Y i )

[0101] where X i ={x ij}, Y i ={y ij}, i represents the i-th protocol.

[0102] Step 5) Train the model and adjust the model parameters based on the test results. The specific process is as follows:

[0103] 51) Divide the data set: divide the data D generated by each type of protocol obtained in step 4) i , without disturbing the order, 80% is used as the training set and 20% for the test set to divide;

[0104] 52) Constructing the model: Figure 3 As shown in the figure, the LSTM and AM algorithms are connected in parallel. The connection method is: the input layer of the two is used together as the input layer of the entire model, but the output layers of the two are added together to obtain the output of the model, and the hidden layer of the model is obtained by parallelizing the hidden layers of the LSTM and AM.

[0105] 53) Training model: Initialize the i-th protocol dataset D i Model m i , customize the number of training epochs, batch size, optimizer, learning rate and loss function. The optimizer uses stochastic gradient descent, the learning rate is set to the initial cosine learning rate of 0.1, the loss function adds a regularization parameter λ to the cross entropy function, and the model training objective is expressed as the following formula:

[0106]

[0107] Where p(·) represents the true label of the sample, q(·) represents the predicted probability of the model, and x ij represents the sample of protocol input, φ represents the model parameter, and λ represents the regularization coefficient.

[0108] After training, save the original model m i .

[0109] 54) Debug model: Test data set corresponding to the protocol Input the initial model m after training i , and calculate the accuracy of the corresponding prediction value. Adjust the parameters of the model, only adjust one parameter at a time, train the model after adjustment, and then test to get the accuracy under this set of parameters. Repeat this method of adjusting parameters, training, and testing to get a set of parameters with the highest accuracy, and obtain the model m under this set of parameters. i .

[0110] 55) Obtain models for all protocol types: Repeat steps 53) and 54) for all captured and processed data sets to obtain a complete detection model M for DDoS attacks, where M = {m i}.

[0111] Step 6) Deploy the model in the switch and perform network attack detection on the network data flow. The specific process is as follows:

[0112] 61) Configure the target host traffic alarm system: Install Nagios software and its add-on program NRPE on the switch, and install Nagios software and its dependent software for web page display on the detection host. Using Nagios, configure the switch as a client and the detection host as a server to monitor each port on the switch. Set traffic alarm thresholds and issue an alarm when traffic exceeds the threshold.

[0113] 62) Establish a data preservation mechanism: Set the Wireshark on the detection host to automatically save files, and set it to automatically generate a new data packet file every time 1 second of data is captured, and automatically delete the oldest data file after every two such data files are generated;

[0114] 63) Establish a data preprocessing program: automatically obtain the first file in the folder where wireshark automatically saves files every second, and process all the data packets generated within 1 second according to the process in step 4) to obtain data X that can be input into the model i And by extracting the data from the protocol part of each data packet IP message, the protocol code c corresponding to each data packet is obtained. ij , get the data set (X i , C i ), where C i ={c ij}, i represents the i-th protocol, j represents the j-th packet under this protocol, and the data is saved in the folder where the input data of the detection model is stored;

[0115] 64) Model optimization: Write a protocol matching function and perform the corresponding detection operation after the protocol is matched, such as Figure 4 The specific operation is as follows: Get the latest data in the folder where the input data is stored in a loop once every 1 second (X i , C i ) and used as the input of the detection model. i , C i ) in each c ij Do the matching and find the data (x ij , c ij ), and x ij Input to the detection model m of the i-th protocol i Make a judgment and get the corresponding detection result y ij, from this we can determine whether this data is abnormal data generated under the i-th type protocol, thereby achieving the detection effect.

[0116] 65) Automating the Detection Model: A Python script is written to call the module, enabling the target host's traffic alarm system (from step 61) to detect any alarm events. If an alarm event occurs, the script's pre-defined commands are entered into the Xshell software on the detection host, which has established an SSH service with the switch, to capture the incoming traffic from the target host and transmit it back to the detection host. Wireshark is then enabled to automatically save data, a data preprocessor is run, and the optimized model from step 64) is activated.

Claims

1. A distributed denial of service attack detection method based on long short-term memory and attention model, including the following steps: 1) Construct a network structure for distributed denial of service attack detection; 2) Launch different types of DDoS attacks on target hosts, including ICMP Flood, Smurf Attack, SYN Flood, and SYN-ACK Flood; 3) Packet capture and forwarding: obtain all input data packets of the attacked host and forward them to the detection host. The switch uses tcpdump software to capture the data packets forwarded to the destination host, package the data packets and forward them to the detection host. Data packet collection includes: 31) Establish communication between the switch and the detection host: Enable the SSH service function of the switch and configure the IP address, generate an encryption key, and configure the login password for SSH management; install Xshell software on the detection host and transmit the packets captured by the switch to the detection host through the SSH service enabled on the switch; 32) Configure the switch and detection host software: Install tcpdump software on the switch and wireshark on the detection host. Use Xshell software to remotely connect to the switch and obtain root privileges on the switch. 33) Capture normal data packets: Enter the command to capture packets on the switch and transmit them back to the local computer in the Xshell software on the detection host. The tcpdump software installed on the switch captures the data packets sent to the destination host, transmits them to the wireshark software on the detection host via SSH service, and saves them in a specified folder on the detection host. During the packet capture process, all attacking hosts and client hosts access the services provided by the target host in a normal manner. The duration of the entire packet capture process is determined by the amount of data required. 34) Launching an attack on the target host: Disconnect the physical connection between the switch and the outside world to prevent external networks from interfering with the attack process and to prevent the attack from interfering with the external network. After completing step 33) to capture the normal data packets, the attack in step 2) is launched according to the rule that only one attack is carried out per round, and all attacking hosts attack the target host simultaneously. Each attack process will last for 1 hour before the next attack is launched. 35) Capturing abnormal data packets: While attacking, use the same command as in step 33) to capture normal data packets to capture abnormal data packets, and record the saved packets to determine the corresponding attack type; 4) Preprocessing the data: the detection host converts the obtained data packets into a format suitable for model input; 5) Training the model, input the prepared data set into the model for training; 6) Perform attack detection, deploy the model on the detection host, and perform network attack detection on the network data flow.

2. The distributed denial of service attack detection method based on long short-term memory and attention models as described in claim 1, wherein the network structure for distributed denial of service attack detection described in step 1) comprises a switch, a target host, a reflection amplification host, an attacking host, a client host, and a detection host, wherein the above devices constitute a local area network, wherein all hosts are connected to the local area network by directly connecting to the switch, and the hosts are not connected to each other; the detection host and the target host are connected to the same switch, and in this network structure, the switch not only realizes the function of interconnecting physically connected devices, but also captures data packets forwarded to the target host through the switch and sends them to the detection host; the target host is configured to provide services to other hosts, and other hosts can send packets to the target host to achieve access purposes. The target host acts as a victim and is attacked by other hosts; The attack host has the ability to run attack scripts. The reflection amplification host can be configured as a server during the attack process. The servers include: Domain name servers, time servers, and website servers provide reflection amplification for DDoS attacks; The client host is responsible for making specific access to the destination host during the attack to verify whether the attack is successful. The detection host detects the data sent by the switch through the deployed detection algorithm.

3. The distributed denial of service attack detection method based on long short-term memory and attention model according to claim 2, characterized in that: In step 2), a DDoS attack is launched against the target host of the network structure built in step 1). First, a corresponding attack script is written according to the DDoS attack type and deployed on the attacking host. All attacking hosts attack the target host in the same time period. The specific steps for launching a DDoS attack against the target host are as follows: 21) After the network deployment is completed, set the IP address and subnet mask of all devices and turn off the automatic IP acquisition function; 22) Write a corresponding attack script for the DDoS attack you want to detect: Write a corresponding attack script for each attack type. After writing it, run the script on an attacking host and observe the performance of the target host, including CPU load, traffic input, and service response time. Debug the script based on the performance of the target host to achieve the best attack effect. 23) Configure the reflection amplification host: Before running the DDoS attack script based on reflection amplification, configure the required reflection amplification host according to the needs of the attack; 24) Run the DDoS attack script on the attacking host: Deploy the debugged DDoS attack script on each attacking host; All attacking hosts run only the same attack at the same time, with the target IP address set to the IP address of the target host. While each attack is being carried out, the client host accesses the target host using the same protocol as the attack type. The attack is considered successful only when the client host cannot access the target host or the target host responds with a significant delay.

4. The distributed denial of service attack detection method based on long short-term memory and attention model according to claim 3, characterized in that: In step 4), the data packets collected in step 3) are converted into the model input format and divided into training and test sets. The specific steps are as follows: 41) Classify the data packets: Classify the normal and abnormal data packets obtained by packet capture according to the protocol type ICMP, UDP, IP-in-IP, and TCP in the IP message protocol, and sort the data packets with the same protocol according to the time of packet capture and put them in the same folder, and attach information on whether it is an abnormal data packet, recorded as y ij , where y ij There are only two values ​​0 and 1, 0 represents a normal data packet, and 1 represents an abnormal data packet; i represents the i-th protocol; j represents the j-th packet under this protocol; 42) Process the header of the core protocol of the data packet: extract information from the data packet of each type of protocol. According to the protocol type in the IP data packet, extract the header of each message using the protocol ICMP, UDP, IP-in-IP, TCP and save it as a binary number. The length of the header data of different protocols may be different, but the length of the header data of the same protocol is the same, which is recorded as x. ij0 , where x ij0 It represents the binary value saved by each data packet in this step, i represents the i-th protocol; j represents the j-th packet under this protocol; 43) Process the Ethernet frame header and IP message of the data packet: extract the 48-bit destination MAC address and the 48-bit source MAC address in the Ethernet frame header of each data packet, a total of 96 bits, in the form of binary numbers; extract the 8-bit service type, 16-bit identification, 3-bit flag, 13-bit fragment offset, 8-bit lifetime, 32-bit source IP address, and 32-bit destination IP address in the form of binary numbers of each data packet; save the above two parts of data separately and record them as x ij1 、x ij2 , where x ij1 It represents the binary value stored in the Ethernet frame header of each data packet, x ij2 It represents the binary value of each data packet stored in the IP message, i represents the i-th protocol; j represents the j-th packet under this protocol; 44) Processing the data portion of the core protocol of the data packet: Extract information from the data packet of each type of protocol, and based on the protocol type in the IP data packet, collect statistics on the data portion of each message using the protocol ICMP, UDP, IP-in-IP, and TCP; the statistical data portion is encoded in hexadecimal format, and the number of 0 to F is saved as a matrix as shown below: where x ij3 Represents the matrix saved by each data packet in this step. The matrix consists of 4 rows and 4 columns. i represents the i-th protocol; j represents the j-th packet under this protocol; x0~x F Represents the number of 0 to F when the data part is encoded in hexadecimal; 45) Convolution processing of data: Convolution of the corresponding data x in step 42) and step 43) ij0 、x ij1 and x ij2 Convert them into two-dimensional matrices of n×16, 12×8, and 14×8 respectively; then perform different convolution calculations on the above three two-dimensional matrices to obtain three 4×4 matrices, and replace the convolved matrices with x ij0 、x ij1 and x ij2 ; 46) Data fusion: merge the data x stored in step 44) and step 45) ij0 、x ij1 、x ij2 and x ij3 and the corresponding label y ij Fusion, we get the following form: (x ij ,and ij ) in The data extracted from the jth packet of the i-th protocol is a 4×4×4 matrix; and the label y ij Indicates whether the jth packet of the i-th protocol is an abnormal data packet; 47) Make a data set: The fused data (x ij ,y ij ), arrange them in the order of the captured packets, and classify them into two categories: normal and abnormal. Then separate the abnormal data and normal data (x ij ,y ij Under the condition that the order of the same type of data remains unchanged, the two types of data are randomly crossed to achieve the purpose of mixing, and the corresponding data set under the protocol is obtained: D i =(X i ,Y i ) where X i ={x ij }, Y i ={y ij }, i represents the i-th protocol.

5. The distributed denial of service attack detection method based on long short-term memory and attention model according to claim 4, characterized in that: In step 5), the model is trained using the data set obtained in step 4), and the model parameters are debugged according to the test results. The specific steps are as follows: 51) Divide the data set: divide the data D generated by each type of protocol obtained in step 4) i , without disturbing the order, 80% is used as the training set and 20% for the test set to divide; 52) Model construction: Connect the LSTM and AM algorithms in parallel. The connection method is: the input layer of the two is used as the input layer of the entire model, but the output layers of the two are added together to obtain the model output. The hidden layer of the model is the hidden layer of the LSTM and AM in parallel. 53) Training model: Initialize the i-th protocol dataset D i Model m i , customize the number of training epochs, batch size, optimizer, learning rate and loss function. The optimizer uses stochastic gradient descent, the learning rate is set to the initial cosine learning rate of 0.1, the loss function adds a regularization parameter λ to the cross entropy function, and the model training objective is expressed as the following formula: Where p(·) represents the true label of the sample, q(·) represents the predicted probability of the model, and x ij represents the sample of protocol input i, φ represents the model parameter, and λ represents the regularization coefficient; After training, save the original model m i ; 54) Debug model: Test data set corresponding to the protocol Input the initial model m after training i , and obtain the accuracy of the corresponding prediction value by calculation; adjust the parameters of the model, only adjust one parameter at a time, train the model after adjustment, and then test to obtain the accuracy under this set of parameters; repeat this method of adjusting parameters, training, and testing to obtain a set of parameters with the highest accuracy, and obtain the model m under this set of parameters i ; 55) Obtain models for all protocol types: Repeat steps 53) and 54) for all captured and processed data sets to obtain a complete detection model M for DDoS attacks, where M = {m i }.

6. The distributed denial of service attack detection method based on long short-term memory and attention model according to any one of claims 2, 3, 4, and 5, characterized in that: In step 6), the model is deployed in the switch and network attack detection is performed on the network data flow. The specific steps are as follows: 61) Configure the target host traffic alarm system: Install Nagios software and its add-on program NRPE on the switch, and install Nagios software and its dependent software for web page display on the detection host. Using Nagios software, configure the switch as a client and the detection host as a server to monitor each port on the switch. Set the flow alarm threshold and issue an alarm when the flow exceeds the threshold; 62) Establish a data preservation mechanism: Set the Wireshark on the detection host to automatically save files, and set it to automatically generate a new data packet file every time 1 second of data is captured, and automatically delete the oldest data file after every two such data files are generated; 63) Establish a data preprocessing program: automatically obtain the first file in the folder where wireshark automatically saves files every second, and process all the data packets generated within 1 second according to the process in step 4) to obtain data X that can be input into the model i And by extracting the data from the protocol part of each data packet IP message, the protocol code c corresponding to each data packet is obtained. ij , get the data set (X i ,C i ), where C i ={c ij }, i represents the i-th protocol, j represents the j-th packet under this protocol, and the data is saved in the folder where the input data of the detection model is stored; 64) Model optimization: Write a protocol matching function and perform the corresponding detection operation after the protocol is matched. The specific operation is: loop once every 1 second to obtain the latest data in the folder where the input data is stored (X i ,C i ) and used as the input of the detection model; the input data set (X i ,C i ) in each c ij Do the matching and find the data (x ij ,c ij ), and x ij Input to the detection model m of the i-th protocol i Make a judgment and get the corresponding detection result y ij , thereby determining whether the data is abnormal data generated under the i-th type of protocol, thereby achieving the detection effect; 65) Automatic execution of the detection model: By writing a Python script program, calling the module, opening the target host traffic alarm system in step 61), detecting whether an alarm event occurs, if an alarm event occurs, inputting the command pre-set in the script into the Xshell software of the detection host that has established an SSH service with the switch, so as to capture the traffic input to the target host and transmit it back to the detection host; then opening Wireshark to automatically save the data, running the data preprocessing program, and opening the optimized model in step 64).

Images