Method and apparatus for detecting a distributed denial of service (DDoS) attack

Abstract

This invention provides a method and apparatus for detecting Distributed Denial-of-Service (DDoS) attacks, relating to the field of network security technology. The method includes: determining the statistical characteristics of each network data stream; generating at least one associated flow sequence based on the statistical characteristics of each network data stream; inputting each associated flow sequence into a trained LSTM neural network model to obtain at least one sequence of predicted values ​​output by the LSTM neural network model; and determining whether each network data stream is DDoS attack traffic based on a preset threshold and the predicted values ​​included in each predicted value sequence. This invention achieves DDoS attack detection of network data streams by generating associated flow sequences based on the statistical characteristics of each network data stream and using these sequences as input data to an LSTM neural network model. This not only improves the accuracy of DDoS attack detection but also enhances the generalization ability of the detection model.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for detecting distributed denial-of-service (DDoS) attacks. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks are among the most common network attacks. In a DDoS attack, attackers use multiple attack sources to send a large number of invalid data packets into the network, consuming the target host's resources (such as CPU and network bandwidth), causing the target host to be unable to provide normal services to users. Therefore, timely and accurate detection of DDoS attacks is a prerequisite for effective defense.

[0003] Existing DDoS attack detection methods can be broadly categorized into two types. One more traditional type is rule-based (or expert knowledge-based) detection, which identifies data traffic matching certain rules as attack traffic. This method is easy to implement but lacks flexibility, and due to the diversity of real-world network attack characteristics, rules are difficult to fully cover, thus affecting detection effectiveness. The other type is machine learning-based detection, which uses data to train a model and then performs detection using the trained model. This method leverages machine learning's powerful ability to uncover hidden patterns and complex structures within large datasets, thus offering superior performance compared to rule-based methods.

[0004] However, machine learning methods typically treat network data as a series of traffic flows, using the statistical characteristics of each flow as model input and the basis for judging DDoS attacks. However, the statistical characteristics of a single data flow are insufficient to reflect the true intent of network communication, and it is difficult to determine whether traffic is legitimate or malicious based on a single flow in isolation. For example, the same HTTP request could be legitimate traffic or DDoS attack traffic automatically generated by software tools in different communications, depending not only on the data flow itself but also on the behavior of related data flows. When attack traffic and legitimate traffic have similar characteristics, the lack of consideration for related data flows leads to detection models that cannot accurately distinguish between them. Furthermore, because the true attack intent is not fully reflected in the input features of machine learning methods, the model overfits the training data, resulting in poor generalization ability. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and apparatus for detecting distributed denial-of-service (DDoS) attacks.

[0006] In a first aspect, the present invention provides a method for detecting distributed denial-of-service (DDoS) attacks, comprising:

[0007] The statistical characteristics of each network data stream are determined, including the source IP address, destination IP address, and time information of the network data stream.

[0008] Based on the statistical characteristics of each network data stream, at least one associated stream sequence is generated;

[0009] Each associated flow sequence is input into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence.

[0010] Based on a preset threshold and each predicted value included in each predicted value sequence, it is determined whether each network data stream is DDoS attack traffic.

[0011] Optionally, according to the distributed denial-of-service (DDoS) attack detection method provided by the present invention, generating at least one associated flow sequence based on the statistical characteristics of each network data flow includes:

[0012] Determine the minimum association time of the data stream and the maximum length of the associated stream sequence;

[0013] Based on the statistical characteristics of each network data stream, the minimum correlation time of the data stream, and the maximum length of the correlation stream sequence, at least one correlation stream sequence is generated;

[0014] In each associated flow sequence, the number of network data flows included is less than the maximum length of the associated flow sequence, the time interval between different associated flow sequences is greater than the minimum association time of the data flows, and the source IP address and destination IP address of each network data flow included in any associated flow sequence are the same.

[0015] Optionally, according to the distributed denial-of-service (DDoS) attack detection method provided by the present invention, before inputting each associated stream sequence into a trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, the method further includes:

[0016] Build an LSTM neural network model;

[0017] The LSTM neural network model is trained based on the objective loss function to obtain the trained LSTM neural network model.

[0018] The target loss function is determined based on the negative log-likelihood loss function and L2 regularization.

[0019] Optionally, according to the distributed denial-of-service (DDoS) attack detection method provided by the present invention, before training the constructed LSTM neural network model based on the target loss function to obtain the trained LSTM neural network model, the method further includes:

[0020] Determine the regularization parameters;

[0021] The target loss function is determined based on the regularization parameter, the L2 norm of the parameters to be learned in the LSTM neural network model, and the negative log-likelihood loss function.

[0022] Optionally, in the distributed denial-of-service (DDoS) attack detection method provided by the present invention, the expression of the target loss function is:

[0023]

[0024] Where, r t Indicates the predicted value; y t represents the true category, with a value of 1 or 0; m represents the maximum length of the associated stream sequence; λ represents the regularization parameter; Let L2 norm be the parameter W to be learned in the LSTM neural network model.

[0025] Optionally, according to the distributed denial-of-service (DDoS) attack detection method provided by the present invention, the method further includes:

[0026] The regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence are optimized based on the grid search method, and the optimal values ​​of the regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence are determined respectively.

[0027] Optionally, according to the distributed denial-of-service (DDoS) attack detection method provided by the present invention, the step of determining whether each network data stream is DDoS attack traffic based on a preset threshold and each predicted value included in each predicted value sequence includes:

[0028] Determine whether the target predicted value included in the target predicted value sequence is greater than the preset threshold;

[0029] If the target predicted value is determined to be greater than the preset threshold, the network data flow corresponding to the target predicted value is determined to be DDoS attack traffic;

[0030] Wherein, the target predicted value sequence is any one of the at least one predicted value sequence, and the target predicted value is any one of the predicted values ​​included in the target predicted value sequence.

[0031] Secondly, the present invention also provides a distributed denial-of-service (DDoS) attack detection device, comprising:

[0032] The determination module is used to determine the statistical characteristics of each network data stream, wherein the statistical characteristics include the source IP address, destination IP address and time information of the network data stream;

[0033] A generation module is used to generate at least one associated stream sequence based on the statistical characteristics of each network data stream;

[0034] The acquisition module is used to input each associated flow sequence into the trained LSTM neural network model to acquire at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence.

[0035] The judgment module is used to determine whether each network data stream is a DDoS attack traffic based on a preset threshold and each predicted value included in each predicted value sequence.

[0036] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the distributed denial-of-service (DDoS) attack detection method as described in the first aspect.

[0037] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the distributed denial-of-service (DDoS) attack detection method as described in the first aspect.

[0038] The Distributed Denial-of-Service (DDoS) attack detection method and apparatus provided by this invention generates at least one associated flow sequence based on the source IP address, destination IP address, and time information of each network data flow. Since the network data flows included in the same associated flow sequence have strong temporal correlation, while the network data flows included in different associated flow sequences have weaker temporal correlation, attack detection based on associated flow sequences can effectively distinguish between attack traffic and normal traffic with similar network data flow characteristics. Furthermore, each associated flow sequence is used as input data for an LSTM neural network model that has the characteristic of remembering information. DDoS attack detection of each network data flow is realized based on the LSTM neural network model, which not only improves the accuracy of DDoS attack detection but also improves the generalization ability of the detection model. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0040] Figure 1 This is one of the flowcharts of the Distributed Denial-of-Service (DDoS) attack detection method provided by the present invention;

[0041] Figure 2 This is a schematic diagram of the overall structure of the LSTM neural network provided by the present invention;

[0042] Figure 3 This is a schematic diagram of the unit structure of the LSTM neural network provided by the present invention;

[0043] Figure 4 This is the second flowchart of the distributed denial-of-service (DDoS) attack detection method provided by the present invention;

[0044] Figure 5 This is a schematic diagram of the structure of the distributed denial-of-service (DDoS) attack detection device provided by the present invention;

[0045] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0047] To facilitate a clearer understanding of the various embodiments of the present invention, some relevant background knowledge will be introduced as follows.

[0048] Distributed Denial-of-Service (DDoS) attack: A malicious act that overwhelms a target server or its related infrastructure with massive amounts of internet traffic, disrupting the target server's services or normal network traffic. DDoS attacks typically utilize multiple hijacked computer systems as attack sources to achieve their effect. These machines can be computers, as well as other networked resources such as Internet of Things (IoT) devices.

[0049] Traffic flow: In packet-switched networks, a traffic flow is a series of data packets from a source host to a destination device, which can be another host, a multicast group, or a broadcast domain. Real-time flow measurement system RFC 2722 defines a traffic flow as "artificial logic equivalent to a call or connection."

[0050] Long Short-Term Memory (LSTM) neural networks are artificial neural networks used in artificial intelligence and deep learning. Unlike standard feedforward neural networks, LSTMs have feedback connections, allowing them to process not only single data points but also entire data sequences. LSTM networks are well-suited for classification, processing, and prediction based on time-series data because there may be lags of unknown duration between important events in a time series. For example, LSTMs are used in handwriting recognition, speech recognition, machine translation, and robot control.

[0051] The following is combined with Figures 1-6 This invention describes the distributed denial-of-service (DDoS) attack detection method and apparatus provided by the present invention.

[0052] Figure 1 This is one of the flowcharts illustrating the Distributed Denial-of-Service (DDoS) attack detection method provided by this invention, such as... Figure 1 As shown, the method includes:

[0053] Step 100: Determine the statistical characteristics of each network data stream, including the source Internet Protocol (IP) address, destination IP address, and time information of the network data stream;

[0054] Step 110: Based on the statistical characteristics of each network data stream, generate at least one associated stream sequence;

[0055] Step 120: Input each associated flow sequence into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence;

[0056] Step 130: Based on the preset threshold and each predicted value included in each predicted value sequence, determine whether each network data stream is DDoS attack traffic.

[0057] Specifically, in this embodiment of the invention, in order to overcome the shortcomings of existing machine learning-based DDoS detection methods, which cannot accurately distinguish between attack traffic and normal traffic with similar data flow characteristics, and because the true attack intent of network communication cannot be fully reflected in the input features of existing machine learning methods, leading to overfitting of the detection model to the training data and poor generalization ability of the obtained detection model, this invention generates at least one associated flow sequence based on the source IP address, destination IP address, and time information of each network data flow. Since the network data flows included in the same associated flow sequence have strong temporal correlation, while the temporal correlation between network data flows included in different associated flow sequences is weak, attack detection based on associated flow sequences can effectively distinguish between attack traffic and normal traffic with similar network data flow characteristics. Furthermore, each associated flow sequence is used as input data for an LSTM neural network model with information memory characteristics. DDoS attack detection of each network data flow is achieved based on the LSTM neural network model, which not only improves the accuracy of DDoS attack detection but also improves the generalization ability of the detection model.

[0058] It is understandable that a network data stream is a series of data packets from a source host to a destination device, which have the same source IP address, destination IP address, source port number, destination port number, and communication protocol.

[0059] Optionally, network data can be collected and the collected network data can be divided into multiple network data streams using the CICFlowMeter (traffic feature extraction tool).

[0060] Optionally, statistical features of each network data stream can be extracted, which may include, but are not limited to, the source IP address, destination IP address, and time information of the network data stream.

[0061] Optionally, in this embodiment of the invention, the time information may be the time corresponding to the data packets included in each network data stream.

[0062] Optionally, the statistical characteristics of network data flows may also include the duration of the network data flow, the total number of forward packets, the total number of backward packets, the maximum length of forward packets, the minimum length of forward packets, the average length of forward packets, the maximum length of backward packets, the minimum length of backward packets, and the average length of backward packets.

[0063] Understandably, the statistical characteristics of a single network data stream are insufficient to reflect the true intent of network communication, and it is difficult to determine whether a single network data stream is normal or attack traffic in isolation. Attack intent is usually reflected in multiple consecutive network data streams, which exhibit some temporal correlation. In particular, DDoS attacks are often launched using automated tools, which generate a large number of nearly identical or similar data streams in a short period of time. This means that there is a correlation between the data streams used in DDoS attacks, and effectively mining and analyzing this correlation is key to distinguishing between normal and attack traffic during attack detection.

[0064] Therefore, in this embodiment of the invention, at least one associated flow sequence is generated based on the statistical characteristics of each network data flow, namely, based on the source IP address, destination IP address and time information of each network data flow. This associated flow sequence can reflect the temporal correlation between each network data flow, effectively distinguishing between attack traffic and normal traffic with similar data flow characteristics. In particular, it can effectively distinguish between a large number of almost identical or similar attack data flows generated by automated tools, thereby improving the accuracy of DDoS attack detection.

[0065] It is understandable that in at least one associated flow sequence generated based on the statistical characteristics of each network data flow, each associated flow sequence includes multiple network data flows, and the multiple network data flows included in the same associated flow sequence have a strong temporal correlation, while the network data flows included in different associated flow sequences have a weak temporal correlation.

[0066] Furthermore, in this embodiment of the invention, each generated associated flow sequence can be input into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model. Then, based on a preset threshold and the predicted values ​​included in each predicted value sequence, it can be determined whether each network data flow is a DDoS attack flow. By utilizing the information memory characteristics of the LSTM neural network, the patterns and possible attack intentions contained in the network data flow over a longer period can be mined. By fully reflecting these patterns and possible attack intentions in the model input data, the obtained LSTM neural network detection model can be applied to different data inputs, thereby improving the generalization ability of the detection model.

[0067] It is understood that, in the embodiments of the present invention, each time an associated flow sequence is input to the LSTM neural network model, the LSTM neural network model will output a predicted value sequence, that is, the associated flow sequence and the predicted value sequence correspond one-to-one.

[0068] Optionally, the preset threshold can be adaptively set based on actual applications, and the embodiments of the present invention do not impose specific limitations on this.

[0069] Preferably, in this embodiment of the invention, the preset threshold is 0.5.

[0070] The Distributed Denial-of-Service (DDoS) attack detection method provided by this invention generates at least one associated flow sequence based on the source IP address, destination IP address, and time information of each network data flow. Since the network data flows included in the same associated flow sequence have strong temporal correlation, while the network data flows included in different associated flow sequences have weaker temporal correlation, attack detection based on associated flow sequences can effectively distinguish between attack traffic and normal traffic with similar network data flow characteristics. Furthermore, each associated flow sequence is used as input data for an LSTM neural network model that has the characteristic of remembering information. DDoS attack detection of each network data flow is realized based on the LSTM neural network model, which not only improves the accuracy of DDoS attack detection but also improves the generalization ability of the detection model.

[0071] Optionally, generating at least one associated stream sequence based on the statistical characteristics of each network data stream includes:

[0072] Determine the minimum association time of the data stream and the maximum length of the associated stream sequence;

[0073] Based on the statistical characteristics of each network data stream, the minimum correlation time of the data stream, and the maximum length of the correlation stream sequence, at least one correlation stream sequence is generated;

[0074] In each associated flow sequence, the number of network data flows included is less than the maximum length of the associated flow sequence, the time interval between different associated flow sequences is greater than the minimum association time of the data flows, and the source IP address and destination IP address of each network data flow included in any associated flow sequence are the same.

[0075] Specifically, in this embodiment of the invention, the minimum association time and the maximum length of the associated flow sequence of the data flow can be determined first, and then each network data flow can be transformed into at least one associated flow sequence based on the source IP address, destination IP address, time information, minimum association time and the maximum length of the associated flow sequence of each network data flow.

[0076] Optionally, each network data stream can first be divided into different data stream lists based on its source IP address and destination IP address. In a data stream list, the source IP address and destination IP address of each network data stream are the same. Then, the interval time between adjacent network data streams in each data stream list is calculated. That is, the temporal correlation of adjacent network data streams in each data stream list is analyzed to determine the minimum correlation time of the data streams. Based on the minimum correlation time of the data streams, each network data stream in each data stream list is divided into a series of associated flow sequences.

[0077] It is understandable that for two adjacent associated flow sequences, the time interval between the last network data stream in the preceding associated flow sequence and the first network data stream in the following associated flow sequence is greater than the minimum association time of the data streams, resulting in weaker temporal correlation between different associated flow sequences, while stronger temporal correlation exists between network data streams within the same associated flow sequence. Optionally, in this embodiment of the invention, the number of network data streams included in each generated associated flow sequence is less than the maximum length of the associated flow sequence.

[0078] It is understood that, in order to facilitate subsequent processing, the length of the associated flow sequence is limited in the embodiments of the present invention, that is, the number of network data streams included in each associated flow sequence is less than the maximum length of the associated flow sequence.

[0079] Optionally, in an embodiment of the present invention, the time interval between different associated flow sequences in at least one generated associated flow sequence is greater than the minimum associated time of the data flow, so that there is a weak time correlation between different associated flow sequences, while there is a strong time correlation between network data flows within the same associated flow sequence.

[0080] Optionally, in embodiments of the present invention, the source IP address and destination IP address of each network data stream included in any generated associated flow sequence are the same.

[0081] Optionally, the minimum association time of the data stream and the maximum length of the associated stream sequence can be adaptively set based on the actual application, and the embodiments of the present invention do not impose specific limitations on this.

[0082] The distributed denial-of-service (DDoS) attack detection method provided by this invention generates a sequence of associated flows based on the statistical characteristics of each network data flow, the minimum correlation time of the data flow, and the maximum length of the associated flow sequence. This allows the associated flow sequence to fully reflect the temporal correlation between each network data flow, as well as the patterns and possible attack intentions contained in each network data flow.

[0083] Optionally, before inputting each associated stream sequence into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, the method further includes:

[0084] Build an LSTM neural network model;

[0085] The LSTM neural network model is trained based on the objective loss function to obtain the trained LSTM neural network model.

[0086] The target loss function is determined based on the negative log-likelihood loss function and L2 regularization.

[0087] Specifically, in this embodiment of the invention, before inputting each associated stream sequence into the trained LSTM neural network model and obtaining at least one predicted value sequence output by the LSTM neural network model, an LSTM neural network model is first built, and the built LSTM neural network model is trained based on the target loss function to obtain the trained LSTM neural network model. The target loss function can be determined based on the negative log-likelihood loss function and L2 regularization.

[0088] It is understandable that L2 regularization can prevent overfitting of neural network models. Therefore, in this embodiment of the invention, by introducing L2 regularization into the target loss function, the generalization ability of the LSTM neural network model can be improved.

[0089] Optionally, the LSTM neural network model can be trained using an Adaptive Moment Estimation (Adam) optimizer based on the target loss function, with a learning rate of 0.001.

[0090] Figure 2 This is a schematic diagram of the overall structure of the LSTM neural network provided by the present invention, as shown below. Figure 2 As shown, an LSTM neural network is composed of a series of LSTM units connected together. The computation of each LSTM unit is not only based on the current input, but also on all previous inputs, thus achieving the effect of memorizing sequence information.

[0091] Figure 3 This is a schematic diagram of the unit structure of the LSTM neural network provided by the present invention, as shown below. Figure 3 As shown, in each LSTM unit, a cell state is introduced to remember sequence information, and control gate functions are used to adjust how the remembered information changes over time. The control gate functions include the input gate (i... t ), Forget Gate (f t) and output gate (o t Each control gate is calculated based on the following method:

[0092] (1) Forget gate: used to forget certain information from the past, and calculate f. t The percentage of information representing the past is retained can be calculated using the following formula:

[0093] f t =σ(W fx x t +W fh h t-1 +b f )

[0094] (2) Input gate: used to memorize certain information and calculate i t The formula for determining the proportion of current information that is subsequently used is as follows:

[0095] i t =σ(W ix x t +W ih h t-1 +b i )

[0096] (3) Information merging: According to the ratio calculated by the forget gate and the input gate, the past information c is merged. t-1 With current information x t The cells are merged to update their state, calculated using the following formula:

[0097] c t =f t *c t-1 +i t *tanh(W cx x t +W ch h t-1 +b c )

[0098] (4) Output gate: Calculate the current output value h t h t It is cell state c t A nonlinear transformation is performed, and the output value will be used for DDoS attack detection and classification. The calculation formula is as follows:

[0099] o t =σ(W ox x t +W oh h t-1 +b o )

[0100] h t=o t *tanh(c t )

[0101] (5) Calculation of prediction results: Based on the output value h of each LSTM unit t The prediction results are calculated using the following formula:

[0102]

[0103] In the above formula, σ is the sigmoid activation function, * indicates element-wise multiplication, and W and b with different indices are the weights and biases in the LSTM unit, respectively. Specifically, W fx and W fh These are the forget gates for input x t and the h output of the previous LSTM unit t-1 The weight, b f It is the bias of the forgetting gate; W ix and W ih These are the input gates paired with the input x. t and h t-1 The weight, b i It is the bias of the input gate; W cx and W ch These are the information merging parts for the input x t and h t-1 The weight, b c It is the bias of the information merging part; W ox and W oh These are the output gates paired with the input x. t and h t-1 The weight, b o It is the output gate bias. h is the output of the LSTM unit. t The weight, It calculates the bias of the prediction results.

[0104] Optionally, in this embodiment of the invention, the constructed LSTM neural network model may include two hidden layers, wherein the first hidden layer includes 96 neurons and the second hidden layer includes 48 neurons.

[0105] The distributed denial-of-service (DDoS) attack detection method provided by this invention improves the generalization ability of the LSTM neural network model by training the target loss function determined by the negative log-likelihood loss function and L2 regularization.

[0106] Optionally, before training the constructed LSTM neural network model based on the target loss function to obtain the trained LSTM neural network model, the method further includes:

[0107] Determine the regularization parameters;

[0108] The target loss function is determined based on the regularization parameter, the L2 norm of the parameters to be learned in the LSTM neural network model, and the negative log-likelihood loss function.

[0109] Specifically, in this embodiment of the invention, before training the LSTM neural network model based on the target loss function, the target loss function is first determined based on the regularization parameter, the L2 norm of the parameters to be learned in the LSTM neural network model, and the negative log-likelihood loss function, and then the LSTM neural network model is trained based on the target loss function.

[0110] It is understood that by introducing the L2 norm of the parameters to be learned in the LSTM neural network model into the target loss function, this invention can avoid overfitting of the LSTM neural network model and improve the generalization ability of the LSTM neural network model.

[0111] Optionally, the expression for the target loss function is:

[0112]

[0113] Where, r t Indicates the predicted value; y t represents the true category, with a value of 1 or 0; m represents the maximum length of the associated stream sequence; λ represents the regularization parameter; Let L2 norm be the parameter W to be learned in the LSTM neural network model.

[0114] Specifically, in this embodiment of the invention, an LSTM neural network model can be trained based on the target loss function as expressed above. As can be seen from the above expression, L2 regularization is introduced on the basis of the negative log-likelihood loss function, which can avoid overfitting of the LSTM neural network model and improve the generalization ability of the LSTM neural network model.

[0115] Optionally, the method further includes:

[0116] The regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence are optimized based on the grid search method, and the optimal values ​​of the regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence are determined respectively.

[0117] Specifically, in this embodiment of the invention, the regularization parameter λ, the minimum association time of the data stream, and the maximum length of the associated stream sequence can be optimized based on the grid search method, thereby determining the optimal value of the regularization parameter, the optimal value of the minimum association time of the data stream, and the optimal value of the maximum length of the associated stream sequence, respectively.

[0118] Optionally, the optimal value range of the regularization parameter is 0.1 to 0.5, the optimal value range of the minimum association time of the data stream is 0.1 seconds to 1 second, and the optimal value range of the maximum length of the association stream sequence is 30 to 80.

[0119] The distributed denial-of-service (DDoS) attack detection method provided by this invention optimizes the regularization parameter λ, the minimum correlation time of the data stream, and the maximum length of the correlation stream sequence based on the grid search method, which can further improve the accuracy of DDoS attack detection.

[0120] Optionally, determining whether each network data stream is DDoS attack traffic based on a preset threshold and each predicted value included in each predicted value sequence includes:

[0121] Determine whether the target predicted value included in the target predicted value sequence is greater than the preset threshold;

[0122] If the target predicted value is determined to be greater than the preset threshold, the network data flow corresponding to the target predicted value is determined to be DDoS attack traffic;

[0123] Wherein, the target predicted value sequence is any one of the at least one predicted value sequence, and the target predicted value is any one of the predicted values ​​included in the target predicted value sequence.

[0124] Specifically, in this embodiment of the invention, a preset threshold can be compared with each predicted value included in the target predicted value sequence. If it is determined that the target predicted value in the target predicted value sequence is greater than the preset threshold, the network data flow corresponding to the target predicted value is determined to be DDoS attack traffic. The target predicted value sequence is any one of at least one predicted value sequence output by the LSTM neural network model, and the target predicted value is any one of the predicted values ​​included in the target predicted value sequence.

[0125] The distributed denial-of-service (DDoS) attack detection method provided by this invention can accurately determine whether each network data stream is DDoS attack traffic by using a sequence of predicted values ​​output by a preset threshold and an LSTM neural network model.

[0126] Figure 4 This is the second flowchart of the Distributed Denial-of-Service (DDoS) attack detection method provided by this invention, as shown below. Figure 4As shown, the method includes:

[0127] Step 400: Data stream partitioning and feature extraction.

[0128] Optionally, network data can be collected, and the collected network data can be divided into multiple network data streams using the CICFlowMeter tool. 84 features can be extracted from each data stream as statistical features of each network data stream.

[0129] Step 410: Generate the associated stream sequence.

[0130] Optionally, in this embodiment of the invention, in order to determine the temporal correlation nature of network data streams, a series of interconnected network data streams are grouped into a correlation stream sequence to more accurately determine whether the network data stream is DDoS attack traffic.

[0131] Optionally, when generating associated flow sequences, the following two criteria can be followed: ① The associated flow sequences are data flows between the same pair of hosts, that is, they have the same source IP address and destination IP address; ② The associated flow sequences are adjacent in time.

[0132] Based on the two criteria mentioned above, an associated flow sequence generation algorithm can be used to generate associated flow sequences. In this algorithm, each network data flow is traversed. First, the source IP address and destination IP address of the traversed network data flow are extracted as the identifier seq_id of its associated flow sequence. Then, each network data flow is added to its corresponding list for temporary storage based on its seq_id. Thus, each list records a series of network data flows with the same source and destination IP addresses. Further, the time interval between adjacent network data flows in each list is calculated. A shorter time interval indicates a strong temporal correlation between network data flows, while a longer time interval indicates a weak or no temporal correlation. Therefore, the longest time interval between network data flows can be selected within a certain range as a boundary to divide the network data flows into associated flow sequences. Network data flows within each associated flow sequence have shorter time intervals and stronger temporal correlations, while network data flows in different associated flow sequences have longer time intervals and weaker or no temporal correlations.

[0133] Understandably, the associated flow sequence generation algorithm includes two parameters: the minimum association time τ between data flows and the maximum length m of the associated flow sequence. The time interval between network data flows must be at least τ before they are divided into different associated flow sequences; m is the maximum length of the associated flow sequence. For subsequent processing needs, the length of the associated flow sequence cannot be unlimited; once the maximum length m is reached, the associated flow sequence can be forcibly segmented.

[0134] Specifically, the input to the associated flow sequence generation algorithm is: the various network data flows obtained in step 400. i (i = 1, 2, ... n), the minimum correlation time parameter τ of the data stream, and the maximum length parameter m of the correlation stream sequence; the output of the correlation stream sequence generation algorithm is: a list of correlation stream sequences, correlation_list; the correlation stream sequence generation algorithm specifically includes the following steps (1)-(3):

[0135] (1) Traverse each network data stream and extract the (source IP address, destination IP address) tuple of each network data stream as the identifier seq_id of the associated flow sequence;

[0136] (2) Based on the seq_id of the associated flow sequence, each network data flow is temporarily added to the corresponding list. This list is a temporary list consisting of a series of network data flows that have the same (source IP address, destination IP address) tuple. At the same time, the time interval between the newly added network data flow and the previous adjacent network data flow in the list is calculated and recorded;

[0137] (3) When the number of network data flows in the list reaches the maximum length parameter m of the associated flow sequence, find the two adjacent network data flows with the longest time interval from the list, and denote them as network data flows. p and network data flow q :

[0138] Case 1: If the time interval is greater than or equal to the minimum correlation time τ of the data flow, then use the network data flow... p and network data flow q The interval serves as a truncation, starting from the first network data stream in this temporary list and continuing until the network data stream flow. p Termination occurs when a sequence of associated flows has been generated. Simultaneously, the temporary list is updated, starting from the first network data flow and proceeding up to the last network data flow. p The terminated portion (i.e., the part of the associated flow sequence just generated) is deleted, and the remaining part is from the network data flow. q The initial portion is retained for subsequent processing.

[0139] Case 2: If the time interval is less than the minimum association time parameter τ of the data streams, the maximum length m of the associated stream sequence is used as the truncation, and all m network data streams in the temporary list are used as a single associated stream sequence. Simultaneously, the temporary list is updated to an empty list.

[0140] After processing all network data streams using the above steps, multiple associated stream sequences will be generated sequentially.

[0141] Step 420: Construct an LSTM neural network and train it using associated stream sequence data.

[0142] To detect and analyze the generated associated flow sequences and fully utilize their inherent temporal correlation properties, DDoS attack detection can be implemented based on an LSTM neural network, which has the ability to memorize sequence information. The input to the LSTM neural network is the statistical features of the associated flow sequences generated in step 400, which can be denoted as x1,…,x m , where each x i Both are vectors representing the characteristics of a network data stream in the associated stream sequence. The parameter m is the maximum length of the associated stream sequence. For associated stream sequences with a length less than m, null values ​​can be used to pad them to length m to ensure data alignment.

[0143] Step 430: Optimize the hyperparameters in the model.

[0144] Optionally, a grid search method can be used to optimize the three hyperparameters involved in the distributed denial-of-service (DDoS) attack detection method provided in this embodiment of the invention: the minimum data flow association time τ, the maximum length of the associated flow sequence m, and the regularization parameter λ. Preferably, τ = 0.5s, m = 50, and λ = 0.3 are determined as the optimal hyperparameters under the current model.

[0145] Step 440: Use the optimized model to detect DDoS attacks.

[0146] Specifically, after completing the training and hyperparameter optimization of the LSTM neural network model, DDoS attack detection can be performed based on the LSTM neural network model, including the following steps (1)-(3):

[0147] (1) The collected network data was divided into network data streams using the CICFlowMeter tool, and 84 features were extracted for each network data stream;

[0148] (2) Based on the obtained network data streams and their characteristics, a correlation stream sequence generation algorithm is used to generate a correlation stream sequence.

[0149] (3) Using the obtained associated flow sequence as input data, the trained LSTM neural network model is used to calculate the prediction result. For example, for the associated flow sequence (x1,…x…) m The predicted value sequence (r1,…r) is calculated using an LSTM neural network model. m For any one of the network data streams x, then t It can be based on its predicted value r t The relationship between r and the threshold of 0.5 determines whether the network data flow is DDoS attack traffic.t If the value is greater than the threshold of 0.5, then the network data stream x is determined to be... t For DDoS attack traffic, if r t If the value is less than the threshold of 0.5, then the network data stream x is determined to be... t This is normal traffic.

[0150] The Distributed Denial-of-Service (DDoS) attack detection method provided by this invention generates at least one associated flow sequence based on the source IP address, destination IP address, and time information of each network data flow. Since the network data flows included in the same associated flow sequence have strong temporal correlation, while the network data flows included in different associated flow sequences have weaker temporal correlation, attack detection based on associated flow sequences can effectively distinguish between attack traffic and normal traffic with similar network data flow characteristics. Furthermore, each associated flow sequence is used as input data for an LSTM neural network model that has the characteristic of remembering information. DDoS attack detection of each network data flow is realized based on the LSTM neural network model, which not only improves the accuracy of DDoS attack detection but also improves the generalization ability of the detection model.

[0151] The distributed denial-of-service (DDoS) attack detection device provided by the present invention is described below. The distributed denial-of-service (DDoS) attack detection device described below can be referred to in correspondence with the distributed denial-of-service (DDoS) attack detection method described above.

[0152] Figure 5 This is a schematic diagram of the structure of the distributed denial-of-service (DDoS) attack detection device provided by the present invention, as shown below. Figure 5 As shown, the device includes: a determining module 510, a generating module 520, an acquiring module 530, and a judging module 540; wherein:

[0153] The determining module 510 is used to determine the statistical characteristics of each network data stream, the statistical characteristics including the source IP address, destination IP address and time information of the network data stream;

[0154] The generation module 520 is used to generate at least one associated stream sequence based on the statistical characteristics of each network data stream;

[0155] The acquisition module 530 is used to input each associated flow sequence into the trained LSTM neural network model to acquire at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence.

[0156] The judgment module 540 is used to determine whether each network data stream is DDoS attack traffic based on a preset threshold and each predicted value included in each predicted value sequence.

[0157] Specifically, the Distributed Denial-of-Service (DDoS) attack detection device provided in this embodiment of the invention can determine the statistical characteristics of each network data stream through the determining module 510. The statistical characteristics include the source IP address, destination IP address, and time information of the network data stream. Then, based on the statistical characteristics of each network data stream, the generating module 520 generates at least one associated flow sequence. Further, the acquiring module 530 inputs each associated flow sequence into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence. Finally, based on a preset threshold and the predicted values ​​included in each predicted value sequence, the judging module 540 judges whether each network data stream is DDoS attack traffic.

[0158] The distributed denial-of-service (DDoS) attack detection device provided by this invention generates at least one associated flow sequence based on the source IP address, destination IP address, and time information of each network data flow. Since the network data flows included in the same associated flow sequence have strong temporal correlation, while the network data flows included in different associated flow sequences have weaker temporal correlation, attack detection based on associated flow sequences can effectively distinguish between attack traffic and normal traffic with similar network data flow characteristics. Furthermore, each associated flow sequence is used as input data for an LSTM neural network model that has the characteristic of remembering information. DDoS attack detection of each network data flow is realized based on the LSTM neural network model, which not only improves the accuracy of DDoS attack detection but also improves the generalization ability of the detection model.

[0159] Optionally, the generation module is further configured to:

[0160] Determine the minimum association time of the data stream and the maximum length of the associated stream sequence;

[0161] Based on the statistical characteristics of each network data stream, the minimum correlation time of the data stream, and the maximum length of the correlation stream sequence, at least one correlation stream sequence is generated;

[0162] In each associated flow sequence, the number of network data flows included is less than the maximum length of the associated flow sequence, the time interval between different associated flow sequences is greater than the minimum association time of the data flows, and the source IP address and destination IP address of each network data flow included in any associated flow sequence are the same.

[0163] Optionally, the distributed denial-of-service (DDoS) attack detection device further includes a setup module and a training module;

[0164] The building module is used to build an LSTM neural network model;

[0165] The training module is used to train the constructed LSTM neural network model based on the target loss function, and obtain the trained LSTM neural network model.

[0166] The target loss function is determined based on the negative log-likelihood loss function and L2 regularization.

[0167] Optionally, before training the constructed LSTM neural network model based on the target loss function to obtain the trained LSTM neural network model, the training module is further configured to:

[0168] Determine the regularization parameters;

[0169] The target loss function is determined based on the regularization parameter, the L2 norm of the parameters to be learned in the LSTM neural network model, and the negative log-likelihood loss function.

[0170] Optionally, the expression for the target loss function is:

[0171]

[0172] Where, r t Indicates the predicted value; y t represents the true category, with a value of 1 or 0; m represents the maximum length of the associated stream sequence; λ represents the regularization parameter; Let L2 norm be the parameter W to be learned in the LSTM neural network model.

[0173] Optionally, the distributed denial-of-service (DDoS) attack detection device further includes an optimization module;

[0174] The optimization module is used to optimize the regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence based on the grid search method, and to determine the optimal values ​​of the regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence, respectively.

[0175] Optionally, the determination module is further configured to:

[0176] Determine whether the target predicted value included in the target predicted value sequence is greater than the preset threshold;

[0177] If the target predicted value is determined to be greater than the preset threshold, the network data flow corresponding to the target predicted value is determined to be DDoS attack traffic;

[0178] Wherein, the target predicted value sequence is any one of the at least one predicted value sequence, and the target predicted value is any one of the predicted values ​​included in the target predicted value sequence.

[0179] The distributed denial-of-service (DDoS) attack detection device provided by this invention generates at least one associated flow sequence based on the source IP address, destination IP address, and time information of each network data flow. Since the network data flows included in the same associated flow sequence have strong temporal correlation, while the network data flows included in different associated flow sequences have weaker temporal correlation, attack detection based on associated flow sequences can effectively distinguish between attack traffic and normal traffic with similar network data flow characteristics. Furthermore, each associated flow sequence is used as input data for an LSTM neural network model that has the characteristic of remembering information. DDoS attack detection of each network data flow is realized based on the LSTM neural network model, which not only improves the accuracy of DDoS attack detection but also improves the generalization ability of the detection model.

[0180] It should be noted that the distributed denial-of-service (DDoS) attack detection device provided in this embodiment of the invention can implement all the method steps implemented in the above-mentioned distributed denial-of-service (DDoS) attack detection method embodiment, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0181] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute the distributed denial-of-service (DDoS) attack detection method provided by the above methods, which includes:

[0182] The statistical characteristics of each network data stream are determined, including the source IP address, destination IP address, and time information of the network data stream.

[0183] Based on the statistical characteristics of each network data stream, at least one associated stream sequence is generated;

[0184] Each associated flow sequence is input into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence.

[0185] Based on a preset threshold and each predicted value included in each predicted value sequence, it is determined whether each network data stream is DDoS attack traffic.

[0186] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0187] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is able to execute the distributed denial-of-service (DDoS) attack detection method provided by the above methods, the method comprising:

[0188] The statistical characteristics of each network data stream are determined, including the source IP address, destination IP address, and time information of the network data stream.

[0189] Based on the statistical characteristics of each network data stream, at least one associated stream sequence is generated;

[0190] Each associated flow sequence is input into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence.

[0191] Based on a preset threshold and each predicted value included in each predicted value sequence, it is determined whether each network data stream is DDoS attack traffic.

[0192] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the aforementioned distributed denial-of-service (DDoS) attack detection methods, the method comprising:

[0193] The statistical characteristics of each network data stream are determined, including the source IP address, destination IP address, and time information of the network data stream.

[0194] Based on the statistical characteristics of each network data stream, at least one associated stream sequence is generated;

[0195] Each associated flow sequence is input into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence.

[0196] Based on a preset threshold and each predicted value included in each predicted value sequence, it is determined whether each network data stream is DDoS attack traffic.

[0197] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0198] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0199] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting distributed denial-of-service (DDoS) attacks, characterized in that, include: The statistical characteristics of each network data stream are determined, including the source IP address, destination IP address, and time information of the network data stream. Based on the statistical characteristics of each network data stream, at least one associated stream sequence is generated; Each associated flow sequence is input into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence. Based on a preset threshold and each predicted value included in each predicted value sequence, it is determined whether each network data stream is DDoS attack traffic. The generation of at least one associated stream sequence based on the statistical characteristics of each network data stream includes: Based on the source IP address and destination IP address of each network data stream, each network data stream is divided into different data stream lists. Among them, the source IP address and destination IP address of each network data stream included in a data stream list are the same. Analyze the temporal correlation of adjacent network data streams in each data stream list to determine the minimum correlation time of the data streams; Based on the minimum association time of data flows, each network data flow in each data flow list is divided into a sequence of associated flows; In each associated flow sequence, the number of network data flows included is less than the maximum length of the associated flow sequence, the time interval between different associated flow sequences is greater than the minimum association time of the data flows, and the source IP address and destination IP address of each network data flow included in any associated flow sequence are the same.

2. The Distributed Denial-of-Service (DDoS) attack detection method according to claim 1, characterized in that, Before inputting each associated stream sequence into the trained LSTM neural network model to obtain at least one predicted value sequence output by the LSTM neural network model, the method further includes: Build an LSTM neural network model; The LSTM neural network model is trained based on the objective loss function to obtain the trained LSTM neural network model. The target loss function is determined based on the negative log-likelihood loss function and L2 regularization.

3. The Distributed Denial-of-Service (DDoS) attack detection method according to claim 2, characterized in that, Before training the constructed LSTM neural network model based on the target loss function to obtain the trained LSTM neural network model, the method further includes: Determine the regularization parameters; The target loss function is determined based on the regularization parameter, the L2 norm of the parameters to be learned in the LSTM neural network model, and the negative log-likelihood loss function.

4. The Distributed Denial-of-Service (DDoS) attack detection method according to claim 3, characterized in that, The expression for the target loss function is: Where, r t Indicates the predicted value; y t represents the true category, with a value of 1 or 0; m represents the maximum length of the associated stream sequence; λ represents the regularization parameter; Let L2 norm be the parameter W to be learned in the LSTM neural network model.

5. The Distributed Denial-of-Service (DDoS) attack detection method according to claim 3, characterized in that, The method further includes: The regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence are optimized based on the grid search method, and the optimal values ​​of the regularization parameter, the minimum association time of the data stream, and the maximum length of the associated stream sequence are determined respectively.

6. The distributed denial-of-service (DDoS) attack detection method according to any one of claims 1-5, characterized in that, The step of determining whether each network data stream is DDoS attack traffic based on a preset threshold and each predicted value included in each predicted value sequence includes: Determine whether the target predicted value included in the target predicted value sequence is greater than the preset threshold; If the target predicted value is determined to be greater than the preset threshold, the network data flow corresponding to the target predicted value is determined to be DDoS attack traffic; Wherein, the target predicted value sequence is any one of the at least one predicted value sequence, and the target predicted value is any one of the predicted values ​​included in the target predicted value sequence.

7. A distributed denial-of-service (DDoS) attack detection device, characterized in that, include: The determination module is used to determine the statistical characteristics of each network data stream, wherein the statistical characteristics include the source IP address, destination IP address and time information of the network data stream; A generation module is used to generate at least one associated stream sequence based on the statistical characteristics of each network data stream; The acquisition module is used to input each associated flow sequence into the trained LSTM neural network model to acquire at least one predicted value sequence output by the LSTM neural network model, wherein the associated flow sequence corresponds one-to-one with the predicted value sequence. The judgment module is used to determine whether each network data stream is DDoS attack traffic based on a preset threshold and each predicted value included in each predicted value sequence. The generation of at least one associated stream sequence based on the statistical characteristics of each network data stream includes: Based on the source IP address and destination IP address of each network data stream, each network data stream is divided into different data stream lists. Among them, the source IP address and destination IP address of each network data stream included in a data stream list are the same. Analyze the temporal correlation of adjacent network data streams in each data stream list to determine the minimum correlation time of the data streams; Based on the minimum association time of data flows, each network data flow in each data flow list is divided into a sequence of associated flows; In each associated flow sequence, the number of network data flows included is less than the maximum length of the associated flow sequence, the time interval between different associated flow sequences is greater than the minimum association time of the data flows, and the source IP address and destination IP address of each network data flow included in any associated flow sequence are the same.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the distributed denial-of-service (DDoS) attack detection method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the distributed denial-of-service (DDoS) attack detection method as described in any one of claims 1 to 6.

Images