DDoS attack detection method, device and system

Abstract

The present invention belongs to the field of network security, and in particular relates to a DDoS attack detection method, device, and system. The method includes: performing data preprocessing on traffic data to achieve digitization of non-numerical features, feature selection, data set division, and data feature standardization; performing tensor modeling to model the preprocessed traffic data to form tensor data; performing multiple denoising on the tensor data, and establishing a classifier to detect DDoS attacks. By performing data preprocessing on traffic data to achieve digitization of non-numerical features, feature selection, data set division, and data feature standardization, the efficiency of subsequent data processing can be improved; performing tensor modeling to model the preprocessed traffic data to form tensor data can facilitate the improvement of data analysis efficiency; performing multiple and multi-dimensional denoising on the tensor data, and establishing a classifier to detect DDoS attacks, it is possible to accurately analyze normal data and DDoS attack data.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a DDoS attack detection method, device and system. Background Art

[0002] Today, high-speed and widely connected networks not only bring convenience to people but also create favorable conditions for cyberattacks. In particular, the shift of many tasks from offline to online has led to an exponential increase in cyber intrusions. In the cybersecurity field, distributed denial-of-service (DDoS) attacks, due to their stealth and effectiveness, have become the most popular attack method. These attacks aim to consume network bandwidth or system resources, causing network or system overloads and disruption of normal network services, posing a serious threat to internet security. Kaspersky's latest annual DDoS Attack Report shows that the scale of DDoS attacks has increased dramatically over the past two years. As individuals and countries become increasingly dependent on network infrastructure and services, the need for effective solutions to prevent DDoS attacks is growing. Summary of the Invention

[0003] In order to solve or improve the above problems, the present invention provides a DDoS attack detection method and system. The specific technical solutions are as follows:

[0004] The present invention provides a DDoS attack detection method, comprising: performing data preprocessing on traffic data to achieve numeration of non-numerical features, feature selection, data set partitioning, and data feature standardization; performing tensor modeling to model the preprocessed traffic data into tensor data; performing denoising on the tensor data, and establishing a classifier to detect DDoS attacks.

[0005] Preferably, the data set division includes: dividing the data set into a training set and a test set by k-fold cross validation.

[0006] Preferably, the data preprocessing of the traffic data is also used to delete invalid data.

[0007] Preferably, the data feature standardization includes:

[0008] By formula Complete the standardization of data features, where nom(X [m，n] ) is the standardized feature, mean(X [：，n] ) is feature X [：，n] The mean, std(X [：，n] ) is the standard deviation.

[0009] Preferably, the tensor modeling comprises: converting the pre-processed data matrix of the flow data into Folded into an R+1 dimensional tensor Among them, N1×…×N R =N;

[0010] Correspondingly, the denoising of the tensor data includes: implementing multi-dimensional sub-tensor spatial smoothing and denoising through sub-tensor smoothing, MDLP-based T-SVD denoising and reconstruction and updating of tensors; Perform the sub-tensor spatial smoothing and denoising on all data instances to obtain a denoised tensor; and restore the denoised tensor to matrix data.

[0011] Preferably, the multi-dimensional sub-tensor spatial smoothing and denoising is achieved by sub-tensor smoothing, MDLP-based T-SVD denoising and reconstruction and updating of tensors, including: the sub-tensor smoothing includes: Smoothing along the rth dimension gives L r smooth sub-tensors The smooth sub-tensor Superimpose along the second dimension to obtain a smooth tensor of dimension R+1 The MDLP-based T-SVD denoising includes: using the MDLP-based T-SVD to denoise the tensor The smooth tensor of dimension r Denoising to get tensor The reconstructing and updating tensor includes: Divide into N along r dimension r Subtensor Update the smoothing sub-tensor from each of the Reconstruct the tensor The sub-tensor smoothing process, the MDLP-based T-SVD denoising and the reconstruction and updating of the tensor are repeated for all modalities to achieve the sub-tensor spatial smoothing and denoising.

[0012] Preferably, the tensor All data instances of the sub-tensor space are smoothed and denoised to obtain a denoised tensor, including: After smooth reconstruction of all modes, the final T-SVD denoising is performed; the tensor All data instances Repeat the sub-tensor spatial smoothing and denoising to obtain the denoised tensor where m∈{1,…,M}.

[0013] Preferably, the classifier is based on at least one of a gradient boosting decision tree, a support vector machine, a logistic regression, a random forest, a linear discriminant dimensionality reduction algorithm, and extreme gradient boosting.

[0014] The present invention provides a DDoS attack detection device, comprising: a first unit for performing data preprocessing on traffic data to achieve numeration of non-numerical features, feature selection, data set partitioning, and data feature standardization; a second unit for performing tensor modeling to model the preprocessed traffic data into tensor data; and a third unit for denoising the tensor data and establishing a classifier to detect DDoS attacks.

[0015] The present invention provides a DDoS attack detection system, characterized by comprising: an SDN controller, communicating with a control plane and a data plane via an API interface; a switch, collecting data from the data plane based on INT technology; a control plane for executing the above-mentioned method and outputting anomaly monitoring results; and the SDN controller controlling the switch to block corresponding DDoS attacks based on the anomaly monitoring results.

[0016] The beneficial effects of the present invention are as follows: by preprocessing traffic data to achieve digitization of non-numerical features, feature selection, data set partitioning and data feature standardization, the efficiency of subsequent data processing can be improved; tensor modeling is performed to model the preprocessed traffic data to form tensor data, which can facilitate improving the efficiency of data analysis; the tensor data is denoised, and a classifier is established to detect DDoS attacks, which can accurately analyze normal data and DDoS attack data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a schematic diagram of a DDoS attack detection method according to the present invention;

[0018] Figure 2 is an overall architecture diagram according to the present invention;

[0019] Figure 3 is a schematic diagram of a DDoS attack detection system according to the present invention.

[0020] Description of main reference numerals:

[0021] 1-first unit, 2-second unit, 3-third unit. DETAILED DESCRIPTION

[0022] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0023] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0024] It should also be understood that the terms used in the present specification are only for the purpose of describing particular embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0025] It should be further understood that the term "and / or" used in the present description and appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0026] Numerous achievements have been made in the field of DDOS attack detection technology, but each has its own strengths and weaknesses. Most attack detection methods leveraging machine learning and deep learning fail to account for noise in datasets. Manually collecting and annotating data inevitably introduces noise into datasets, reducing data quality and potentially impairing the model's detection performance in real networks. Therefore, proper dataset denoising is crucial for improving data quality. However, with the rapid development of the internet, networks are growing in size and complexity. The large-scale heterogeneity of network data makes data processing more challenging.

[0027] In order to solve or improve the problems raised in the background, the present invention provides Figure 1 A DDoS attack detection method is shown, comprising: S1, performing data preprocessing on traffic data to digitize non-numerical features, perform feature selection, partition data sets, and standardize data features; S2, performing tensor modeling to model the preprocessed traffic data into tensor data; S3, performing denoising on the tensor data and establishing a classifier to detect DDoS attacks.

[0028] The steps of the DDoS attack detection method include:

[0029] (1) Data preprocessing: digitizing non-numerical features, feature selection, data set division, and data feature standardization.

[0030] (2) Data modeling: Here, large-scale heterogeneous network traffic data is modeled into tensor form.

[0031] (3) Data denoising: When using supervised machine learning for classification, the dataset is assumed to be noise-free. However, in reality, noise exists in the data. In this case, denoising is performed multiple times on each data instance to obtain better classification results. Note that the training data and test data are processed in the same way. Denoising is a hybrid denoising method that combines the T-SVD low-rank approximation algorithm with multidimensional subtensor smoothing, aiming to improve data quality and thus improve the classification performance of the classifier.

[0032] (4) Anomaly Detection: The principle of anomaly detection is consistent with traditional machine learning-based methods. A machine learning classifier is used to classify traffic data into two categories to detect abnormal traffic. Experiments have shown that the above-mentioned denoising process can improve the detection performance of the classifier. In addition, in a comparison test of many machine learning algorithms, the XGBoost algorithm was found to have the characteristics of fast detection time, high accuracy, and scalability. Therefore, XGBoost was selected as the classifier in the detection framework.

[0033] Compared with the prior art, the present invention has the following advantages:

[0034] 1. This invention retains the spatiotemporal characteristics of the original large-scale heterogeneous network data based on tensor modeling, and the entire framework has high security.

[0035] 2. This method fully considers the noise in the dataset and improves data quality based on a tensor decomposition algorithm. During the denoising process, it automatically selects the rank values ​​to retain based on the MDLP algorithm, achieving automatic denoising. Experiments show that this method significantly reduces the noise in the dataset.

[0036] 3. The present invention creatively improves the classification performance of the detection framework based on tensor decomposition and machine learning classification algorithms. Finally, compared with similar detection frameworks, the present invention has the advantages of being fast, scalable, and highly accurate.

[0037] The data set division includes: dividing the data set into a training set and a test set by using k-fold cross validation.

[0038] The data preprocessing for the traffic data is also used to delete invalid data.

[0039] The data feature standardization includes:

[0040] By formula Complete the standardization of data features, where nom(X [m，n] ) is the standardized feature, mean(X [：，n] ) is feature X [：，n] The mean, std(X [：，n] ) is the standard deviation.

[0041] The tensor modeling includes: converting the pre-processed data matrix of the flow data into Folded into an R+1 dimensional tensor Among them, N1×…×N R =N;

[0042] The denoising of the tensor data includes: implementing multi-dimensional sub-tensor spatial smoothing and denoising through sub-tensor smoothing, MDLP-based T-SVD denoising and reconstruction and updating of tensors; Perform the sub-tensor spatial smoothing and denoising on all data instances to obtain a denoised tensor; and restore the denoised tensor to matrix data.

[0043] The sub-tensor spatial smoothing and denoising is achieved by sub-tensor smoothing, MDLP-based T-SVD denoising and reconstruction and updating of tensors, including: the sub-tensor smoothing includes: Smoothing along the rth dimension gives L r smooth sub-tensors The smooth sub-tensor Superimpose along the second dimension to obtain a smooth tensor of dimension R+1 The MDLP-based T-SVD denoising includes: using the MDLP-based T-SVD to denoise the tensor The smooth tensor of dimension r Denoising to get tensor The reconstructing and updating tensor includes: Divide into N along r dimension r Subtensor Update the smoothing sub-tensor from each of the Reconstruct the tensor The sub-tensor smoothing process, the MDLP-based T-SVD denoising and the reconstruction and updating of the tensor are repeated for all modalities to achieve the sub-tensor spatial smoothing and denoising.

[0044] The pair of tensors All data instances of the sub-tensor space are smoothed and denoised to obtain a denoised tensor, including: After smooth reconstruction of all modes, the final T-SVD denoising is performed; the tensor All data instances Repeat the sub-tensor spatial smoothing and denoising to obtain the denoised tensor where m∈{1,…,M}.

[0045] The classifier is based on at least one of a gradient boosting decision tree, a support vector machine, a logistic regression, a random forest, a linear discriminant dimensionality reduction algorithm, and extreme gradient boosting.

[0046] Figure 2 The overall structure diagram of the present invention is as follows:

[0047] Step 1) Data preprocessing

[0048] In this step, the traffic data will be digitized, feature selected, data set divided, and data feature standardized. The details include:

[0049] ① Non-numeric data conversion

[0050] This step converts the non-numeric data in the dataset into numeric data. For example, the “normal” and “abnormal” labels of the dataset can be replaced with “0” and “1” respectively.

[0051] ②Data cleaning

[0052] This step will remove some meaningless data to avoid errors in subsequent classification. For example, such as Nan, Inf, -Inf, etc., which will cause errors in subsequent calculations, so these data are discarded.

[0053] ③ Feature selection

[0054] In existing network datasets, there are often a large number of features, but some features have little impact on the classification of the classifier, so these features can be deleted. For example, the data of some features are mostly 0.

[0055] ④Data segmentation

[0056] In this step, the data is split into training and test sets. The next step in this invention is to use k-fold cross-validation to segment the dataset. This method randomly divides the dataset into k blocks, selecting one of them at a time as the validation set, and the remaining k-1 blocks as the training set. In subsequent experiments, the classification evaluation index is averaged over the k-fold cross-validation.

[0057] ⑤Data standardization

[0058] Finally, before classification, the features of the training and test sets need to be normalized. This can improve the accuracy and convergence speed of the model. The DDoS attack dataset contains many outliers, which are generated by DDoS attacks. Therefore, normalization is chosen to preserve the original distribution. The normalization calculation method is as follows:

[0059] Among them, mean(X [：，n] ) is feature X [：，n]The mean, std(X [：，n] ) is the standard deviation.

[0060] Step 2) Tensor Modeling

[0061] Modeling large-scale heterogeneous network data into tensor form can better preserve the temporal and spatial characteristics of data compared to traditional matrix modeling, so that the characteristics of normal and abnormal traffic can be better identified in the later data mining algorithms. Specifically, the network traffic data matrix Folded into an R+1 dimensional tensor where N1×…×N R =N.

[0062] Step 3) Data denoising

[0063] ① Sub-tensor smoothing:

[0064] The tensor Smoothing along the rth dimension gives L r (number of smooth blocks along the rth dimension of the tensor, r∈{1, 2, ..., R}) smooth sub-tensors The specific calculation formula is as follows:

[0065]

[0066] in is a tensor truncation along the rth dimension, and If these sub-tensors are superimposed along the second dimension, a smooth tensor of dimension R+1 is obtained:

[0067]

[0068] ②T-SVD denoising based on MDLP:

[0069] Using MDLP-based T-SVD The smooth tensor of dimension r Denoising to get tensor Right now The denoising algorithm is as follows:

[0070]

[0071] The minimum length description criterion (MDLP) calculation formula in line 8 of the algorithm is as follows:

[0072]

[0073] Among them, l i is a singular value (i∈{1,2,…,p},l1>l2>…>lp ), P is the number of singular values, and N is the length of the data set. The rank of the matrix A is: rank(A) = argmin(MDL(k)) + 1.

[0074] ③Reconstruct and update tensors:

[0075] Here we first use the smooth tensor after denoising To reconstruct and update the original tensor For a tensor of order R Easy to get:

[0076]

[0077] The above equation converts the tensor Divide into N along r dimension r Subtensor where k∈{1, 2, ..., N r Here, a mean-based update method is used to update each smooth sub-tensor Reconstruct. The k-th sub-tensor reconstruction calculation on the r-th dimension of the tensor is as follows:

[0078]

[0079] Among them, l′ k yes The effective number of smoothing operations in the nth dimension. This is the prerequisite for the existence of the above formula, otherwise no calculation will be performed.

[0080] ④For tensors Repeat the above steps ①②③ for all modes to perform sub-tensor spatial smoothing and denoising, where r∈{1, 2,…, R}).

[0081] ⑤For After all modes are smoothed and reconstructed, the final T-SVD denoising will be performed.

[0082] ⑥For All data instances Repeat the above steps ①②③④⑤ to get the denoised tensor where m∈{1,…,M}.

[0083] ⑦Denoised tensor Restore to matrix data

[0084] After the traffic data has been subjected to the above multiple denoising processes, the noise in the data set has been greatly attenuated. The output signal-to-noise ratio is used as an evaluation indicator for the noise reduction algorithm. The larger the output signal-to-noise ratio, the better the noise reduction effect. The calculation formula is as follows:

[0085]

[0086] in, is the denoised data, |·| F is the Frobenius norm.

[0087] The denoising algorithms of the present invention include HOOI, HOSVD, SVD, and MUDE. SVD is a matrix-based denoising algorithm, while MUDE is a multi-noise denoising algorithm based on spatial smoothing of submatrices and SVD low-rank approximation. Gaussian white noise ranging from -10dB to 10dB was added to the NSL-KDD dataset and then denoised. As shown in Table 1, the denoising algorithm proposed in this method performs better than similar algorithms.

[0088] Table 1 Denoising comparison experimental results

[0089] noise Proposed denoising algorithm SVD HOSVD HOOI MODE -10 -5.82 -8.25 -7.54 -7.54 -7.22 -8 -3.81 -6.25 -5.54 -5.54 -5.22 -6 -1.80 -4.25 -3.53 -3.53 -3.22 -4 0.21 -2.25 -1.54 -1.54 -1.22 -2 2.20 -0.25 0.46 0.46 0.79 0 4.16 1.75 2.46 2.46 2.79 2 6.10 3.75 4.47 4.47 4.79 4 8.10 5.76 6.47 6.47 6.79 6 10.10 7.76 8.47 8.47 8.77 8 12.06 9.76 10.47 10.47 10.75 10 14.02 11.76 12.48 12.48 12.70

[0090] Step 4) Anomaly Detection

[0091] Anomaly detection here essentially uses data mining algorithms to classify data. Two datasets were used: the relatively new CICDDoS2019 dataset, which covers a relatively comprehensive range of DDoS attack types. The other is the more classic NSL-KDD dataset, a commonly used dataset in the industry and used for comparison with similar algorithms. The classification evaluation metrics include Accuracy (Acc), Precision (Pre), Recall (Recall), False Alarm Rate (Far), and F1-score.

[0092] The data to be detected is classified into normal traffic and abnormal traffic through the classifier.

[0093] ①The impact of denoising on classification:

[0094] Here, we use the CICDDoS2019 dataset to observe the impact of denoising on XGBoost classification performance. Table 2 shows that good denoising can improve detection results, and the denoising algorithm proposed in this paper significantly improves classification results. However, it may also damage the data, making the detection results worse than those of the original data.

[0095] Table 2 Effect of denoising on XGBoost classifier

[0096] Acc Pre Recall Far F1-score Raw data 90.95％ 83.96％ 81.58％ 6.55％ 78.02％ Proposed algorithm 99.53％ 99.10％ 98.55％ 0.22％ 98.82％ SVD 94.45％ 95.99％ 77.60％ 1.22％ 83.19％ HOSVD 99.03％ 97.11％ 98.18％ 0.75％ 97.63％ HOOI 99.01％ 97.05％ 98.14％ 0.77％ 97.58％ MODE 99.50％ 99.19％ 98.34％ 0.20％ 98.76％

[0097] Next, the core denoising algorithm of the present invention was used to denoise the NSL-KDD dataset and the CICDDoS2019 dataset respectively, and then classified using some classic data mining algorithms (gradient boosted decision tree (GBDT), support vector machine (SVD), logistic regression (LR), random forest (RF), linear discriminant dimensionality reduction algorithm (LDA), extreme gradient boosting (XGB)). The results are shown in Tables 3 and 4. It can be found that the denoising algorithm combined with XGBoost can achieve higher detection accuracy in a shorter time.

[0098] Table 3 CICDDoS experimental results

[0099]

[0100]

[0101] Table 4 NSL-KDD experimental results

[0102] Acc Pre Recall Far F1-score Time GBDT 97.30％ 97.91％ 96.20％ 1.79％ 97.07％ 34.02 Support Vector Machine 98.19％ 98.30％ 97.79％ 1.47％ 98.05％ 49 LR 94.54％ 94.65％ 93.56％ 4.60％ 94.10％ 0.54 LDA 94.49％ 94.40％ 93.71％ 4.48％ 94.06％ 0.28 RF 97.13％ 99.56％ 94.26％ 0.36％ 96.78％ 19.11 XGB 98.73％ 99.00％ 98.25％ 0.86％ 98.63％ 3

[0103] Finally, in order to better measure the performance of the DDoS attack detection framework of the present invention, the entire framework is also compared with the latest related detection models based on the NSL-KDD dataset. The comparison results are shown in Table 5, where FN represents the number of features used. It can be found that the detection framework of the present invention is superior to other classification models in terms of accuracy. Although MCLP has a slight advantage in recall rate, its false alarm rate is higher. Similarly, SFS-MLP has a lower false alarm rate, but other indicators are not as good as the framework of the present invention, especially the recall rate. LDA is close to the performance of the present invention because it denoises the dataset. In general, the framework proposed in this solution has higher accuracy, recall rate, F1-Score and lower false alarm rate, which is attributed to the core denoising algorithm in the present invention.

[0104] Table 5 Comparison of similar monitoring frameworks on the NSL-KDD dataset

[0105]

[0106]

[0107] The above experiments all show that:

[0108] ① Using tensors to model large-scale heterogeneous network data can better mine the spatiotemporal characteristics of the data, making the data more secure.

[0109] ② The tensor-based denoising algorithm in the present invention can effectively attenuate the noise in the data set, thereby improving the detection performance of the classifier;

[0110] ③ The present invention's innovative architecture that combines tensor decomposition with machine learning classification algorithms can more accurately identify DDoS attacks in large-scale network data. The framework also has certain noise resistance, higher overall security, and faster speed.

[0111] The present invention provides Figure 3 A DDoS attack detection device includes: a first unit 1 for performing data preprocessing on traffic data to achieve numeration of non-numerical features, feature selection, data set partitioning, and data feature standardization; a second unit 2 for performing tensor modeling to model the preprocessed traffic data into tensor data; and a third unit 3 for denoising the tensor data and establishing a classifier to detect DDoS attacks.

[0112] The present invention provides a DDoS attack detection system, characterized by comprising: an SDN controller, communicating with a control plane and a data plane via an API interface; a switch, collecting data from the data plane based on INT technology; a control plane for executing the above-mentioned method and outputting anomaly monitoring results; and the SDN controller controlling the switch to block corresponding DDoS attacks based on the anomaly monitoring results.

[0113] Similar to the practical application of other detection frameworks, this invention can be deployed on the SDN controller and communicate with the control plane and data plane through the controller's API interface to efficiently discover and handle DDoS attacks. The specific deployment on SDN is as follows:

[0114] Data collection deployment: Based on the P4 switch, INT technology is used to collect data from the data plane, reducing the resource consumption of traditional data collection on the controller and southbound interface bandwidth, and enabling data pre-processing as quickly as possible;

[0115] Attack Detection Deployment: We deploy detection algorithms through the northbound interface of the SDN control plane. To improve data quality, we first denoise the flow feature data collected by the data plane and then perform anomaly detection using a classification algorithm.

[0116] Attack mitigation deployment: When an anomaly is detected, an alarm is sent. We can find the attack source based on the abnormal flow ID and then send OpenFlow commands to control the P4 switch through the southbound interface of the SDN control plane to block the DDoS attack in time.

[0117] Those skilled in the art will appreciate that the units of the various examples described in conjunction with the embodiments disclosed in this embodiment can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition of each example has been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0118] In the embodiments provided in the present application, it should be understood that the division of units is merely a logical function division, and there may be other division methods in actual implementation, for example, multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored, etc.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and description of the present invention.

Claims

1. A DDoS attack detection method, characterized in that: include: Data preprocessing is performed on traffic data to achieve numeration of non-numerical features, feature selection, data set partitioning, and data feature standardization; Performing tensor modeling to model the pre-processed flow data into tensor data; The tensor modeling comprises: The data matrix of the preprocessed traffic data Folded into an R+1 dimensional tensor ,in, ; Correspondingly, denoising the tensor data includes: Multi-dimensional sub-tensor spatial smoothing and denoising is achieved through sub-tensor smoothing, MDLP-based T-SVD denoising and reconstruction and updating of tensors; the sub-tensor smoothing includes: Smoothing along the rth dimension gives smooth sub-tensors ; The smooth sub-tensor Superimpose along the second dimension to obtain a smooth tensor of dimension R+1 The MDLP-based T-SVD denoising includes: using the MDLP-based T-SVD to denoise the tensor The smooth tensor of dimension r Denoising to get tensor ; The reconstruction and update tensor includes: Divide along r dimension Subtensor , based on the mean update from each smooth sub-tensor Reconstruct the tensor Repeat the sub-tensor smoothing process, the MDLP-based T-SVD denoising, and the reconstruction and updating of the tensor for all modalities to achieve the multi-dimensional sub-tensor spatial smoothing and denoising; For the tensor Perform the multi-dimensional sub-tensor spatial smoothing denoising on all data instances to obtain a denoised tensor; Restoring the denoised tensor to matrix data; The tensor data is denoised, and a classifier is built to detect DDoS attacks.

2. The DDoS attack detection method according to claim 1, characterized in that: The data set division includes: The data set is split into training and test sets through k-fold cross validation.

3. The DDoS attack detection method according to claim 1, characterized in that: The data preprocessing for the traffic data is also used to delete invalid data.

4. The DDoS attack detection method according to claim 1, characterized in that: The data feature standardization includes: By formula Complete the standardization of data features, where nom(X [m，n] ) is the normalized feature, It is a feature The mean of is the standard deviation.

5. The DDoS attack detection method according to claim 1, wherein: The pair of tensors All data instances are subjected to the multi-dimensional sub-tensor spatial smoothing denoising to obtain a denoised tensor, including: The tensor After all modes are smoothed and reconstructed, the final T-SVD denoising is performed; For the tensor All data instances Repeat the multi-dimensional sub-tensor spatial smoothing denoising to obtain the denoised tensor ,in .

6. The DDoS attack detection method according to claim 5, characterized in that: The classifier is based on at least one of a gradient boosting decision tree, a support vector machine, a logistic regression, a random forest, a linear discriminant dimensionality reduction algorithm, and extreme gradient boosting.

7. A DDoS attack detection device, characterized in that: Using the method according to any one of claims 1 to 6, comprising: The first unit is used to perform data preprocessing on traffic data to achieve numeration of non-numerical features, feature selection, data set partitioning and data feature standardization; The second unit is used for performing tensor modeling to model the pre-processed flow data into tensor data; The third unit is configured to denoise the tensor data and establish a classifier to detect DDoS attacks.

8. A DDoS attack detection system, characterized in that: include: The SDN controller communicates with the control plane and data plane through API interfaces; The switch collects data from the data plane based on INT technology; The control plane is used to execute the method according to any one of claims 1 to 6 and output abnormal monitoring results; The SDN controller controls the switch to block the corresponding DDoS attack according to the abnormality monitoring result.

Images