A method for preventing DDoS attacks in edge computing based on anomaly detection and container isolation
Patent Information
- Application Number
- CN202211318783.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-10-26
- Publication Date
- 2026-09-01
- Estimated Expiration
- 2042-10-26
AI Technical Summary
[0004]但在实际中边缘中既要承担异常检测，又要进行资源分配，所消耗的资源必然会影响到节点中的任务，加剧任务间的资源竞争
[0065]1、将服务放在容器内部，进行隔离，利用基于容器的隔离来最大程度地减少DDoS攻击下的资源争用，并将资源动态分配给检测容器和服务容器，这种结构确保良性用户在DDoS攻击下依然得到不受干扰的服务质量 (QoS)。
Smart Images
Figure CN115865407B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method for preventing edge computing DDoS attacks based on anomaly detection and container isolation. Background Technology
[0002] Distributed Denial-of-Service (DDoS) attacks are among the most damaging cyberattacks. They aim to deplete server network bandwidth or system resources, and edge devices or IoT devices are increasingly becoming new targets of DDoS attacks. Compared to attacking cloud devices, DDoS attacks are cheaper and easier for hackers to succeed. Once some edge devices are attacked, it will cause the entire edge network service to malfunction, resulting in huge losses for service providers.
[0003] To mitigate DDoS attacks, many cloud computing-based methods exist, assuming sufficient resources are available in the cloud for allocation. In recent years, advancements in Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) technologies have made resource allocation and dynamic resource distribution possible. For DDoS issues in edge computing, much research has focused on virtualization technologies and collaborative approaches. This involves forwarding attack traffic from one edge node to another for processing when the node faces a DDoS attack.
[0004] However, in practice, the edge computing node must handle both anomaly detection and resource allocation. The resources consumed will inevitably affect the tasks within the nodes, exacerbating resource competition between tasks. At the same time, the cloud-edge collaboration approach makes it difficult to guarantee real-time performance.
[0005] Therefore, it is necessary to redesign the defense mechanism to adapt to the new challenges brought about by the edge environment, reduce DDoS attacks for service providers, provide security measures, and dynamically and effectively allocate resources for edge tasks. Summary of the Invention
[0006] The purpose of this invention is to provide a method for preventing DDoS attacks in edge computing based on anomaly detection and container isolation.
[0007] To achieve the above objectives, the technical solution of the present invention is as follows:
[0008] A method for preventing DDoS attacks in edge computing based on anomaly detection and container isolation, the method comprising the following steps:
[0009] Step 1: Use Docker to create containers, including white containers, gray containers, and detection containers. Benign user requests in the white container are sent directly to the white container, while all attack requests, along with those from benign users not in the white container, are sent to the gray container.
[0010] Step 2: Use a packet analyzer to capture a portion of the requests in the gray container and send them to the detection container. This is sampling detection because edge device resources are insufficient, and detecting all requests would consume too many resources.
[0011] Step 3: The detection container uses a self-updating anomaly detection method to detect whether there is a DDoS attack in the traffic flowing into the gray container. First, a detection period is set to detect the traffic, and then an anomaly detection algorithm is set to obtain the anomaly rate AR.
[0012] Step 4: Verify the accuracy of the anomaly rate AR using feature sets, detect malicious requests and filter benign requests, discard abnormal traffic, and then send the cleaned benign requests back to the white container for processing.
[0013] Step 5: After obtaining the accurate anomaly rate (AR), the sampled anomaly detection results are used to predict the current DDoS attack intensity. A Jackson network M / M / 1 queuing theory model is established, and the resource allocation of each container is calculated using the optimization objective. The Jackson network M / M / 1 queuing theory model is used for resource allocation in the edge system under DDoS attack because our optimization objective is to improve the service quality of benign requests under the condition of limited edge defense resources.
[0014] Step 6: Dynamically allocate the service rates of the three containers—gray container, detection container, and white container—to maximize the arrival rate of benign user requests.
[0015] An edge computing DDoS attack prevention method based on anomaly detection and container isolation is proposed. This method samples mixed traffic for detection within a set detection period, preferably using a self-updating anomaly detection method in step 3. The relevant parameters in this method include the sampling detection period T, detection CPU utilization, maximum number of packets or maximum packet capture time, and pre-trained model parameters. To enable the method to automatically update these parameters, an update mechanism is designed. Details are as follows:
[0016] First, the detection cycle is related to the detection anomaly rate; the higher the anomaly rate, the shorter the detection cycle. As shown in formula (1):
[0017] (1)
[0018] in, It is a parameter; when the anomaly rate AR is 0, =T, set the period according to the actual situation. The detected CPU utilization is idle CPU + server CPU utilization * 20%.
[0019] A single detection should be completed within period T, and the detection time is controlled by the maximum number of packets n or the maximum packet capture time t1. After testing, the packet capture time... Feature extraction time and inferred time All are directly proportional to the number of packages n, as shown in formula (2-4):
[0020] (2)
[0021] (3)
[0022] (4)
[0023] in, , , These are the parameters required for packet capture, feature extraction, and inference for each data packet, and can be measured experimentally. Since different packets can cause variations in these three parameters, a maximum packet capture time is limited. This ensures that the detection time does not exceed cycle T. Therefore, the total detection time is as shown in formula (5):
[0024] (5)
[0025] Therefore, the detection cycle is set based on the anomaly rate to achieve the purpose of parameter updates. Because edge services are a continuous process, failure to update parameters will lead to deviations in the inference results.
[0026] Furthermore, an edge computing DDoS attack prevention method based on anomaly detection and container isolation includes an anomaly detection algorithm in step 3 of the self-updating anomaly detection method to predict the current DDoS attack strength. The steps of the algorithm are as follows:
[0027] Input: Pre-trained model, sampling and detection period T, maximum number of packets Or the maximum packet capture time threshold
[0028] Output: Normal traffic, Abnormal rate (AR)
[0029] S1. Initialize the timer;
[0030] S2. Create the detection container dc;
[0031] S3, capture mixed traffic, achieve or
[0032] S4. Extract traffic features and use pre-trained inference to achieve anomaly rate accuracy (AR).
[0033] S5. Determine if AR < If the current container (DC) stops, proceed to S9. Otherwise, proceed to S6.
[0034] S6. Verify whether there are false alarms using the feature set. If so, stop the DC container and proceed to S9. Otherwise, proceed to S7.
[0035] S7. Activate the autoencoder, retrain the model, and update the pre-trained model parameters.
[0036] S8. Save the normal traffic, send it to the white container, and stop the DC container;
[0037] S9. Calculate the next cycle T according to formula (1), and start the timer. When the timer is greater than T, switch to S1.
[0038] Furthermore, an edge computing DDoS attack prevention method based on anomaly detection and container isolation is proposed. This method includes a verification method for anomaly detection results to reduce the false positive rate. Preferably, step 4 uses a feature set approach to verify the accuracy of the anomaly rate (AR), specifically as follows:
[0039] 1) Use another edge node to send normal traffic to the application deployed in the container, where an autoencoder running in the container uses this traffic to train the model;
[0040] 2) Use Keysight BreakingPoint software to generate an application on the DDoS attack container;
[0041] 3) Use the model trained by the autoencoder in the container to infer the attack traffic, select the 100 points with the largest outliers, analyze the 112 features of each of these 100 points, find the 5 features with the largest differences from the features corresponding to normal traffic, and take the top 5 features with the largest total of 500 features from the 100 points as the features of the DDoS attack.
[0042] 4) Use Keysight BreakingPoint software to generate various DDoS attacks, obtain the features according to step 3), and summarize these features to obtain a feature set;
[0043] 5) By comparing the DDoS feature set with the five features that have the greatest impact on the detection results, the interpretability of the detection results can be improved.
[0044] The specific method is as follows: When the detected traffic anomaly rate is greater than the threshold, extract the top 5 features with the largest detected traffic anomaly values according to step 3), and perform a 5-to-5 match with the features in the feature set. Use the number of matches / 5 as the matching degree. If at most one of the 5 features with the greatest impact in the detection results is in the feature set (20%), it indicates that the possibility of a false alarm is not high.
[0045] Furthermore, an edge computing DDoS attack prevention method based on anomaly detection and container isolation aims to dynamically allocate resources between the detection container and the service container after the anomaly detection results are verified in the above steps. This maximizes the arrival rate of benign user requests. The optimal target method in step 5 is shown in Equation 6.
[0046] (6)
[0047] in, The service rates of the three containers—gray container, detection container, and white container—that need optimization are as follows. This represents the arrival rate of normal requests and DDoS requests, while U represents the total service rate of edge nodes. Slightly smaller than U, q is the proportion of white users, p is the proportion of packets intercepted by the detection container, and r represents the proportion of benign requests.
[0048] Furthermore, according to our tests, the total service rate U of the edge nodes is related to the CPU allocation. They form a linear relationship, as shown in formula (7):
[0049] (7)
[0050] Furthermore, to ensure that each container receives a reallocated CPU value, a more reasonable resource allocation method is needed. Therefore, step 6 also includes a resource allocation algorithm, the steps of which are as follows:
[0051] Input: Service request,
[0052] Output: gray container gc, white container wc, and the CPU allocation rate of the detected container dc;
[0053] S1. Initialization: Start the GC and WC containers;
[0054] S2. Determine the sampling period T, the maximum number of packets n, or the maximum packet capture time. threshold ;
[0055] S3. Obtain the anomaly rate AR based on the anomaly detection algorithm;
[0056] S4. Predict the arrival rate of DDoS attacks. ;
[0057] S5. Solve formula (6) using a linear programming solver to obtain the optimal result. ;
[0058] S6. Calculate according to formula (7) The corresponding container CPU allocation rate;
[0059] S7. Stop the gc and wc containers;
[0060] S8. Reallocate the CPU for each container and return to step 1 to reinitialize.
[0061] Preferably, an edge computing DDoS attack prevention method based on anomaly detection and container isolation is proposed. The method uses container technology to isolate DDoS attacks, and puts the anomaly detection algorithm into a container for isolation, reducing the impact on other tasks in the node, because containers have the characteristics of fast startup speed, low resource consumption, and mutual isolation of applications.
[0062] Preferably, an edge computing DDoS attack prevention method based on anomaly detection and container isolation is provided. The anomaly detection uses an unsupervised method, and a pre-trained model is trained using normal traffic. When the anomaly rate is high enough and the false alarm rate is considered low, the anomaly detection training model is activated, the model parameters are updated, and the detection speed is improved.
[0063] This invention employs container isolation technology. Traffic from legitimate users flows into a white container, while the rest enters a gray container. Some traffic is then extracted from the gray container and sent to a detection container. Inside the detection container, a self-updating anomaly detection method based on an autoencoder is used to detect malicious requests and filter benign requests, i.e., discarding abnormal traffic. The cleaned-up benign requests are then sent back to the white container for processing. Finally, a queuing theory-based resource balancing strategy is proposed to address resource contention in edge servers. We use sampled anomaly detection results to predict the current DDoS attack intensity, and then combine queuing theory to calculate the resource allocation for each container, achieving dynamic resource allocation and adjustment. This method solves the problem that in edge servers, the resources consumed by both anomaly detection and resource allocation inevitably affect tasks within nodes, exacerbating resource contention between tasks.
[0064] Advantages of this invention:
[0065] 1. By placing services inside containers for isolation, container-based isolation can minimize resource contention during DDoS attacks, and resources can be dynamically allocated to detection containers and service containers. This structure ensures that benign users still receive uninterrupted Quality of Service (QoS) during DDoS attacks.
[0066] 2. Resource allocation is performed using the Jackson network M / M / 1 queuing theory model. The optimization goal is to improve the service quality of benign requests under the condition of limited edge defense resources.
[0067] 3. A self-updating mechanism was designed for parameters such as sampling detection period T, detection CPU utilization, maximum number of packets or maximum packet capture time, and pre-trained model parameters, based on the anomaly detection rate, to improve the anomaly detection speed.
[0068] 4. By constructing a feature set and using the feature set to improve the accuracy of the anomaly rate results detected by the autoencoder, the false alarm rate is reduced. Attached Figure Description
[0069] Figure 1 This is a schematic diagram of an edge computing DDoS attack prevention method based on anomaly detection and container isolation according to the present invention.
[0070] Figure 2 This is a flowchart of the self-updating anomaly detection method of the present invention.
[0071] Figure 3 This is a schematic diagram of the algorithm of the present invention running in a container.
[0072] Figure 4 This is a queuing theory model diagram of the present invention.
[0073] Figure 5 This is a test scenario diagram of the present invention. Detailed Implementation
[0074] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention.
[0075] An edge computing DDoS attack prevention method based on anomaly detection and container isolation uses Docker to create containers, including white containers, gray containers, and detection containers. The key feature is that requests from benign users in the white container are directly sent to the white container, ensuring a certain level of performance for edge services even under heavy DDoS attacks. Therefore, all attack requests, along with those from benign users not in the white container, are sent to the gray container.
[0076] Our strategy utilizes a packet analyzer (such as Wireshark https: / / www.wireshark.org) to capture a subset of requests from the gray container and send them to the detection container. An autoencoder-based approach is used to detect malicious requests and filter benign requests, i.e., dropping abnormal traffic. The cleaned-up benign requests are then sent to the white container for processing.
[0077] Finally, a resource balancing strategy based on queuing theory is proposed to address resource contention in edge servers. We utilize sampled anomaly detection results to predict the current DDoS attack intensity, and then combine queuing theory to calculate the resource allocation for each container, achieving dynamic resource allocation and adjustment.
[0078] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings.
[0079] We use container isolation, where containers operate independently. In the face of a DDoS attack, shutting down the service is tantamount to a successful attack; continuing to operate the service results in DDoS traffic consuming resources and users experiencing service disruptions. Furthermore, mitigating DDoS attacks at the edge can lead to performance degradation, as the resource consumption of mitigation strategies is significant. Therefore, we employ container technology. Containers offer advantages such as fast startup, low resource overhead, and application isolation. By placing services within containers for isolation, we can limit DDoS traffic resource consumption during DDoS attacks.
[0080] according to Figure 1 Using Docker container technology, three containers are created: a gray container, a white container, and a detection container. User requests from the white container enter the white container, where edge servers process the requests. Other traffic enters the gray container, where edge servers also process the requests. The detection container's role is to determine if there is a DDoS attack in the traffic flowing into the gray container. If so, it predicts the current DDoS intensity based on the detection results and isolates the anomaly detection algorithm within the container to reduce the impact on other tasks on the node. To determine whether the mixed traffic from edge devices contains DDoS attack traffic, traffic is sampled for detection. Parameters such as the sampling detection period T are set. Since the frequency of DDoS attacks on general devices is not high, continuously running detection would waste a lot of resources. Therefore, a lightweight, self-updating DDoS attack detection method needs to be designed. Algorithm 1 is designed to detect whether a DDoS attack has occurred and the intensity of the attack. To enable our anomaly detection method to automatically update parameters, an update mechanism is designed to be used in conjunction with Algorithm 1, and this is named: A Self-Updating Anomaly Detection Method. To determine whether the mixed traffic of edge devices contains DDoS attack traffic, the traffic is sampled and detected. Parameters such as the sampling detection period T are set, and Algorithm 1 is used to detect whether a DDoS attack has occurred.
[0081] The parameters related to this method are: sampling and detection period T, detection CPU utilization, maximum number of packets or maximum packet capture time, and pre-trained model parameters.
[0082] 1. Self-updating mechanism:
[0083] First, the detection cycle is related to the anomaly rate. We believe that the higher the anomaly rate, the shorter the detection cycle. As shown in formula (1):
[0084] (1)
[0085] in, It is a parameter; when the anomaly rate AR is 0, =T, set the period according to the actual situation. The CPU utilization rate is measured as idle CPU + server CPU utilization * 20%. A single detection should be completed within period T. The detection time is controlled by the maximum number of packets n or the maximum packet capture time t1. After testing, the packet capture time... Feature extraction time and inferred time All are directly proportional to the number of packages n, as shown in formula (2-4):
[0086] (2)
[0087] (3)
[0088] (4)
[0089] in, , , These are the parameters required for packet capture, feature extraction, and inference for each data packet, and can be measured experimentally. Since different packets can cause variations in these three parameters, a maximum packet capture time is limited. This ensures that the detection time does not exceed cycle T. Therefore, the total detection time is as shown in formula (5):
[0090] (5)
[0091] Therefore, the detection cycle is set according to the anomaly rate to achieve the purpose of parameter updating, because edge service is a continuous process, and failure to update parameters will lead to deviations in the inference results.
[0092] II. Anomaly Detection Algorithm:
[0093] Algorithm 1 Anomaly Detection Algorithm
[0094] Input: Sampling and detection period T, maximum number of packets Or the maximum packet capture time threshold
[0095] Output: Normal traffic, Abnormal rate (AR)
[0096] 1: Initialization: Time = 0
[0097] 2: while t > T do
[0098] 3: Create a DDoS detection container (dc)
[0099] 4: Extract the data stream from the mixed stream, denoted as P, where the number of data packets is n.
[0100] 5: while t – T < or n< do
[0101] 6: t = t + 1
[0102] 7: end while
[0103] 8: Extract features npy from P
[0104] 9: Use a pre-trained model for inference, AR = autoencoder(npy)
[0105] 10: if AR > and through interpretive verification
[0106] 11: Believes they have suffered a DDoS attack.
[0107] 12: Activate the anomaly detection algorithm, retrain the model, and update the model parameters.
[0108] 13: Save the normal traffic in P and remove the abnormal traffic.
[0109] 14: Send normal traffic to the server
[0110] 15: else
[0111] 16: Return to step 1
[0112] 17: end if
[0113] 18: Turn off DC
[0114] 19: Return to step 1
[0115] 20: end while
[0116] 21: t = t + 1.
[0117] The entire self-update anomaly detection process is as follows: Figure 2 As shown.
[0118] After obtaining the anomaly rate AR, due to the lack of interpretability of deep learning algorithms, the obtained anomaly rate AR may not be accurate and may contain false alarms. If it is a normal interception, it will affect the quality of service.
[0119] To interpret the detection results of autoencoders and address the lack of interpretability in the application of deep learning methods for anomaly detection, anomaly detection algorithms require a reliable set of logic. Therefore, we propose using a feature set approach for verification. First, we use the software Keysight BreakingPoint to generate application-layer DDoS attacks. Keysight BreakingPoint is a professional software capable of generating various application-layer DDoS attacks. According to the paper DeepAID: interpreting and improving deep learning-based anomaly detection in security applications, 112 statistical features can be extracted from network traffic packets, and certain attacks are related to specific combinations of these features.
[0120] Therefore, the steps for constructing a feature set are as follows:
[0121] 1) Use another edge node to send normal traffic to the application deployed in the container, where an autoencoder running in the container uses this traffic to train the model.
[0122] 2) Use Keysight BreakingPoint software to generate the application on the DDoS attack container.
[0123] 3) Use the autoencoder-trained model in the container to infer the attack traffic, select the 100 points with the largest outliers, analyze the 112 features of each of these 100 points, find the 5 features with the largest differences from the features corresponding to normal traffic, and take the top 5 features with the largest total of 500 features from the 100 points as the features of the DDoS attack.
[0124] 4) Use Keysight BreakingPoint software to generate various DDoS attacks, obtain the features according to step 3), and summarize these features to obtain a feature set.
[0125] The purpose of this method is not to identify specific attack types, but to improve the interpretability of the detection results by comparing these DDoS feature sets with the five features that have the greatest impact on the detection results.
[0126] The specific solution is as follows: When the detected traffic anomaly rate exceeds the threshold, extract the top 5 features with the largest detected traffic anomalies according to step 3), and perform a 5-to-5 match with the features in the feature set. Use the number of matches / 5 as the matching degree. If at most one of the 5 most influential features in the detection results is in the feature set (20%), it indicates that the possibility of a false alarm is low.
[0127] Meanwhile, to improve detection speed, we pre-train a model using unsupervised methods and normal traffic for inference. When the anomaly rate is high enough and we consider the false positive rate to be low, we activate the anomaly detection training model, train the pre-trained model using the removed normal traffic, and update the model parameters.
[0128] Anomaly rate (AR) is obtained through anomaly detection methods for containers. After verifying the accuracy of the AR using feature sets, a Jackson network M / M / 1 queuing theory model is established for resource allocation. Our optimization objective is to improve the service quality of benign requests under limited edge defense resources. Figure 4 As shown, where, The service rates of the three containers—gray container, detection container, and white container—that need optimization are as follows. This represents the arrival rate of normal requests and DDoS requests, while U represents the overall service rate. Slightly smaller than U, q represents the proportion of white users, p represents the proportion of packets intercepted by the detection container, and r represents the proportion of benign requests. Our optimization goal is to dynamically allocate... This maximizes the arrival rate of positive user requests, and the optimization objective is shown in formula (6):
[0129] (6)
[0130] According to our tests, the total service rate U of edge nodes is related to the CPU allocation. They form a linear relationship, as shown in formula (7):
[0131] (7)
[0132] in, These are the parameters we obtained during testing. The anomaly rate (AR) is approximated as the proportion of abnormal requests in the p-part of the gray container. Based on Algorithm 2, it can be calculated as follows: This gives you the CPU value that has been reallocated for each container.
[0133] Algorithm 2 Resource Allocation Algorithm
[0134] Input: Service request
[0135] Output: Gray container 'gc', white container 'wc', and the CPU allocation rate of container 'dc'.
[0136] 1. Initialization: Start the garbage collection (GC) and write-collection (WC) containers.
[0137] 2: Determine the sampling period T, the maximum number of packets n, or the maximum packet capture time. threshold
[0138] 3: Obtain the anomaly rate AR based on the anomaly detection algorithm.
[0139] 4: Predict the arrival rate of DDoS attacks
[0140] 5: Solve formula (6) using a linear programming solver to obtain the optimal solution.
[0141] 6: Calculate according to formula (7) Corresponding container CPU allocation rate
[0142] 7: Stop the GC and WC containers.
[0143] 8: Reallocate CPU for each container and return to step 1 to reinitialize.
[0144] The queuing model is used to optimize the objective and resource allocation algorithm because over-configuring defense resources on edge servers is uneconomical, as the defense mechanism may be idle most of the time. Transmitting DDoS traffic to other nodes also consumes the resources of those nodes and their forwarding resources; in a single-node scenario, forwarding traffic is simply impossible.
[0145] To evaluate the proposed solution, we designed scenarios, such as... Figure 5 As shown, experimental tests were conducted. All experiments were performed on an NVIDIA Jetson Xavier NX (Jetson for short) equipped with Jetpack 4.6. Jetson is a widely used MEC device with GPU capabilities in the industry, and the operating system was Ubuntu 18.04.
[0146] The experiment was run on two Jetson instances with the following roles: Jetson#1 as the server and Jetson#2 as the client. The client Jetson ran a socket program that generated sending intervals using an exponential distribution based on the arrival rate (slightly less than the service rate U), with a total number of tasks generated (70,000, approximately 15 minutes) and task difficulty between integers (2, 5000). Furthermore, the sending program was configured to send requests to both the white and gray containers. The server-side Jetson ran a socket program that computed and returned the largest prime number not exceeding the input number; this code was compiled into the gray and white containers using a Dockerfile. For isolation, three Docker containers were deployed on different ports on the server-side Jetson using Docker port mapping. The Docker version was 20.10.2, and each Jetson had 6 CPUs for testing.
[0147] We used KeysightBreakingPoint (https: / / www.keysight.com / us / en / products / network-security / breakpoint.html) to generate application-layer DDoS attacks. KeysightBreakingPoint is a professional software that can simulate various DDoS attacks and other attacks.
[0148] In our tests, the attack started at 2 minutes and 9 minutes and lasted for 5 minutes. The detection container captured a mix of client and DDoS traffic entering the container at a p-ratio. The container also sampled the received requests. The results showed that the detection container can receive and identify DDoS traffic, and the resources used by the container are controllable.
[0149] To evaluate performance, we compared our proposed strategy with the default FCFS strategy, where tasks were allocated in their original arrival order. The performance metrics we used during the evaluation included average queue length, average wait time for benign users, and average service rate for benign users. The results show that, in the face of DDoS attacks, the default FCFS strategy almost completely consumes resources due to DDoS traffic. In our strategy, container isolation prevents DDoS traffic from consuming resources indefinitely, reducing the impact on white-label containers. Detection containers effectively clean up DDoS traffic and improve the service rate for normal users.
[0150] In our experiments, we investigated the impact of various parameters, including attack intensity, task difficulty, task arrival rate, detection frequency, and detection accuracy, on the results. Higher attack intensity leads to a higher proportion of DDoS traffic and a greater impact on benign users. Higher task difficulty increases the average waiting time for benign users and reduces the service rate. A higher task arrival rate slightly increases the average queue length and average waiting time for benign users when it does not exceed the container service rate, but significantly increases when it does. A higher detection frequency consumes more resources but can shorten the DDoS detection time. Higher detection accuracy results in a higher average service rate for benign users.
[0151] Experimental results demonstrate the advanced nature of our anomaly detection method, container isolation method, resource allocation algorithm, and target optimization method, showcasing the robustness and practicality of our DDoS attack defense solution. This invention provides an edge computing DDoS attack prevention method based on anomaly detection and container isolation, which can be widely applied to edge devices, IoT devices, and internet peripherals, providing crucial support for the development of network informatization.
[0152] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for preventing DDoS attacks in edge computing based on anomaly detection and container isolation, the method comprising the following steps: Step 1: Use Docker to create containers, including white containers, gray containers, and detection containers. Benign user requests in the white container are sent directly to the white container, while all attack requests, along with those from benign users not in the white container, are sent to the gray container. Step 2: Use a packet analyzer to capture some of the requests from the gray container and send them to the detection container; Step 3: The detection container uses a self-updating anomaly detection method to detect whether there is a DDoS attack in the traffic flowing into the gray container. First, a detection period is set to detect the traffic, and then an anomaly detection algorithm is set to obtain the anomaly rate AR. Step 4: Verify the accuracy of the anomaly rate AR using feature sets, detect malicious requests and filter benign requests, discard abnormal traffic, and then send the cleaned benign requests back to the white container for processing. Step 5: After obtaining the accurate anomaly rate (AR), use the sampled anomaly detection results to predict the current DDoS attack intensity, establish a Jackson network M / M / 1 queuing theory model, and use the optimization objective to calculate the resource allocation of each container. Step 6: Dynamically allocate the service rates of the gray container, the detection container, and the white container to maximize the arrival rate of benign user requests; The self-updating anomaly detection method in step 3 includes parameters such as the sampling detection period T, detection CPU utilization, maximum packet count or maximum packet capture time, and pre-trained model parameters. To enable automatic parameter updates, an update mechanism is designed; the details are as follows: First, the detection cycle is related to the detection anomaly rate; the higher the anomaly rate, the shorter the detection cycle, as shown in formula (1): （1） in, It is a parameter; when the anomaly rate AR is 0, =T, set the cycle according to the actual situation; the detected CPU utilization is idle CPU + server CPU utilization * 20%; A single detection should be completed within a period T, and the detection time should be controlled by the maximum number of packets n or the maximum packet capture time t1; after testing, the packet capture time... Feature extraction time and inferred time All are directly proportional to the number of packages n, as shown in formula (2-4): （2） （3） （4） in, , , These are the parameters required for packet capture, feature extraction, and inference for each data packet, which can be measured experimentally. Since different packets may cause variations in these three parameters, a maximum packet capture time is limited. To ensure that the detection time does not exceed cycle T, the total detection time is as shown in formula (5): （5） Therefore, the detection cycle is set according to the anomaly rate to achieve the purpose of parameter updating; The self-updating anomaly detection method in step 3 further includes an anomaly detection algorithm, the steps of which are as follows: Input: Pre-trained model, sampling and detection period T, maximum number of packets Or the maximum packet capture time threshold Output: Normal traffic, Abnormal rate (AR) S1. Initialize the timer; S2. Create the detection container dc; S3, capture mixed traffic, achieve or S4. Extract traffic features and use pre-trained inference to achieve anomaly rate accuracy (AR). S5. Determine if AR < If the current container is stopped, proceed to S9; otherwise, proceed to S6. S6. Verify whether there is a false alarm by checking the feature set. If so, stop the DC container and proceed to S9; otherwise, proceed to S7. S7. Activate the autoencoder, retrain the model, and update the pre-trained model parameters. S8. Save the normal traffic, send it to the white container, and stop the DC container; S9. Calculate the next cycle T according to formula (1), and start the timer. When the timer is greater than T, switch to S1.
2. The edge computing DDoS attack prevention method based on anomaly detection and container isolation according to claim 1, characterized in that: Step 4 uses a feature set approach to verify the accuracy of the anomaly rate (AR). The specific method is as follows: 1) Use another edge node to send normal traffic to the application deployed in the container, where an autoencoder running in the container uses this traffic to train the model; 2) Use Keysight BreakingPoint software to generate an application on the DDoS attack container; 3) Use the model trained by the autoencoder in the container to infer the attack traffic, select the 100 points with the largest outliers, analyze the 112 features of each of these 100 points, find the 5 features with the largest differences from the features corresponding to normal traffic, and take the top 5 features with the largest total of 500 features from the 100 points as the features of the DDoS attack. 4) Use Keysight BreakingPoint software to generate various DDoS attacks, obtain the features according to step 3), and summarize these features to obtain a feature set; 5) By comparing the DDoS feature set with the five features that have the greatest impact on the detection results, the interpretability of the detection results can be improved.
3. The edge computing DDoS attack prevention method based on anomaly detection and container isolation according to claim 1, characterized in that: The optimal objective method in step 5 is shown in formula (6): （6） in, The service rates of the three containers—gray container, detection container, and white container—that need optimization are as follows: This represents the arrival rate of normal requests and DDoS requests, while U represents the total service rate of the edge nodes. Slightly smaller than U, q is the proportion of white users, p is the proportion of packets intercepted by the detection container, and r represents the proportion of benign requests; The total service rate U of the edge nodes and the CPU allocation They form a linear relationship, as shown in formula (7): （7） in, These are parameters obtained during testing.
4. The edge computing DDoS attack prevention method based on anomaly detection and container isolation according to claim 1, characterized in that: Step 6 further includes a resource allocation algorithm, the steps of which are as follows: Input: Service request, Output: gray container gc, white container wc, and the CPU allocation rate of the detected container dc; S1. Initialization: Start the GC and WC containers; S2. Determine the sampling period T, the maximum number of packets n, or the maximum packet capture time. threshold ; S3. Obtain the anomaly rate AR based on the anomaly detection algorithm; S4. Predict the arrival rate of DDoS attacks. ; S5. Solve the formula using a linear programming solver: To obtain the optimal ;in, The service rates of the three containers—gray container, detection container, and white container—that need optimization are as follows: This represents the arrival rate of normal requests and DDoS requests, while U represents the total service rate of the edge nodes. Slightly smaller than U, q is the proportion of white users, p is the proportion of packets intercepted by the detection container, and r represents the proportion of benign requests; S6. According to the formula calculate The corresponding container CPU allocation rate, where, These are parameters obtained during testing; S7. Stop the gc and wc containers; S8. Reallocate the CPU for each container and return to step 1 to reinitialize.
5. The edge computing DDoS attack prevention method based on anomaly detection and container isolation according to claim 1, characterized in that: The method uses container technology to isolate DDoS attacks by placing the anomaly detection algorithm into a container for isolation, thereby reducing the impact on other tasks in the node.
6. The edge computing DDoS attack prevention method based on anomaly detection and container isolation according to claim 1, characterized in that: The anomaly detection uses an unsupervised method, training a pre-trained model using normal traffic. When the anomaly rate is high enough and the false alarm rate is considered low, the anomaly detection training model is activated, the model parameters are updated, and the detection speed is improved.