A method for training a detection model of a DDOS attack and related devices

Abstract

The application discloses a DDOS attack detection model training method and related device, and relates to the network security detection technical field.In the application, based on the negotiation key between multiple local devices, the multiple local partial site sets are paired and masked encrypted, the multiple encrypted local partial site sets are obtained, and the multiple obtained local partial split benefit sets are paired and masked encrypted, the multiple encrypted local partial split benefit sets are obtained, so that the global split benefit set obtained by the aggregation server based on the multiple encrypted local partial split benefit sets is used to train the detection model of each local device. In this way, the local partial site sets and the local partial split benefit sets are paired and masked encrypted based on the negotiation key between the multiple local devices, so that the privacy of the local device data is improved.

Description

Technical Field

[0001] This application relates to the field of network security detection technology, and in particular to a method and apparatus for training a detection model for DDoS attacks. Background Technology

[0002] With the rapid development of communication and internet technologies, network scenarios and scale are constantly expanding, and the resulting network security issues are also on the rise. Among them, Distributed Denial of Service (DDoS) attacks are particularly destructive.

[0003] Specifically, DDoS attacks use a large number of botnets to send a large number of fake requests simultaneously to exhaust system resources, causing the system to be unable to respond to normal user requests, resulting in service paralysis or network paralysis. Therefore, the detection of DDoS attacks is of great significance for network security protection.

[0004] Currently, DDoS attack detection methods mainly rely on machine learning and deep learning. These two methods construct intrusion detection classifiers by selecting appropriate machine learning or deep learning models, and analyze the differences in features between normal and abnormal network traffic to determine the type of DDoS attack. However, these two methods require large-scale data, thus presenting the following problems: high data upload latency; privacy and security issues such as leakage of sensitive data during upload; and limited attack categories that can be detected.

[0005] Among them, the DDoS attack detection method based on federated learning trains the model locally and then the server averages the parameters of the models uploaded by each participant, which effectively solves the privacy leakage problem. It uses the data held by each participant to train the local model and share the model parameters, realizing multi-party joint modeling, and can complete joint training without uploading data.

[0006] However, using the above-mentioned DDoS attack detection model training method, since the server that calculates the average parameters of the model can obtain the model parameters of each participant, the local model can be reverse engineered to infer the feature information of the data used by the local model, thereby reducing the privacy of the data.

[0007] Therefore, using the above methods results in low data privacy. Summary of the Invention

[0008] This application provides a method and related apparatus for training a detection model for DDoS attacks, in order to improve data privacy.

[0009] In a first aspect, embodiments of this application provide a method for training a detection model for Distributed Denial-of-Service (DDoS) attacks, applicable to multiple local devices, including:

[0010] Receive the detection model training request sent by the aggregation server at a set time, and obtain a subset of DDoS attack data features from the detection model training request;

[0011] Based on the data features contained in the data feature subset and the number of quantiles corresponding to each feature, the DDoS sample data of multiple local devices are divided to obtain multiple local quantile sets. Among them, the data feature types of each DDoS sample data are the same, and each local quantile is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension.

[0012] Based on the negotiated key between multiple local devices, multiple local point sets are paired and masked for encryption to obtain encrypted local point sets, which are then sent to the aggregation server.

[0013] Based on the global quantile set returned by the aggregation server from multiple encrypted local quantile sets, the local splitting benefit set corresponding to the global quantile set is determined in multiple local devices; where each local splitting benefit represents the difference in prediction effect between a set time and the adjacent previous time.

[0014] The obtained sets of multiple local splitting profits are paired and masked for encryption to obtain multiple encrypted sets of local splitting profits, and then sent to the aggregation server.

[0015] The aggregation server uses the global splitting reward set, obtained from multiple encrypted local splitting reward sets, to train the detection models of multiple local devices.

[0016] Secondly, embodiments of this application also provide a DDoS attack detection model training device, applicable to multiple local devices, the device comprising:

[0017] The request receiving module is used to receive the detection model training request sent by the aggregation server at a set time, and to obtain a subset of DDoS attack data features from the detection model training request.

[0018] The data partitioning module is used to partition the DDoS sample data of multiple local devices based on the data features contained in the data feature subset and the number of their respective quantiles, and obtain multiple local quantile sets. Among them, the data feature types of each DDoS sample data are the same, and each local quantile is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension.

[0019] The first encryption module is used to perform paired mask encryption on multiple local point sets based on the negotiated key between multiple local devices, to obtain the encrypted multiple local point sets, and to send the encrypted multiple local point sets to the aggregation server.

[0020] The revenue determination module is used to determine the local split revenue set corresponding to the global quantile set in multiple local devices based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets; wherein, each local split revenue represents the difference in prediction effect between the set time and the adjacent previous time.

[0021] The second encryption module is used to perform pair mask encryption on the obtained multiple local split profit sets to obtain the encrypted multiple local split profit sets, and send the encrypted multiple local split profit sets to the aggregation server.

[0022] The model training module is used to train the detection models of multiple local devices based on the global splitting gain set obtained by the aggregation server from multiple encrypted local splitting gain sets.

[0023] In an optional embodiment, before receiving the detection model training request sent by the aggregation server at a set time, the first encryption module is further configured to:

[0024] For any two local devices among multiple local devices, perform the following operations respectively:

[0025] Based on the negotiated private key of a local device and the preset negotiated public key generation method, a negotiated public key of a local device is determined;

[0026] Determine the negotiation key between the two local devices based on the negotiation private key of another local device and the negotiation public key of another local device.

[0027] In one alternative embodiment, the subset of data features is obtained as follows:

[0028] According to the preset data feature sampling method, feature sampling is performed on the data feature set of DDoS attacks to obtain each data feature;

[0029] Based on each data feature, a subset of data features is generated.

[0030] In an optional embodiment, when performing paired mask encryption on multiple local point sets based on a negotiated key among multiple local devices to obtain encrypted multiple local point sets, the first encryption module is specifically used for:

[0031] Based on the negotiated key between multiple local devices, generate a pairing mask vector between multiple local devices;

[0032] Based on the obtained pairing mask vectors, pairing mask encryption is performed on each local site contained in the multiple local site sets to obtain the encrypted multiple local site sets.

[0033] In an optional embodiment, when performing paired mask encryption on each local point contained in multiple local point sets based on the obtained paired mask vectors, the first encryption module is specifically used for:

[0034] For each local locus contained in multiple local locus sets, perform the following operations respectively:

[0035] Determine the target local device corresponding to a local location, and at least one pairing mask vector between the target local device and other local devices among a plurality of local devices;

[0036] Based on a local partial site and at least one paired mask vector, the encrypted local partial site is obtained, and the encrypted local partial site is saved to the local partial site set corresponding to the target local device.

[0037] In an optional embodiment, when training the detection models of multiple local devices based on the global splitting gain set obtained by the aggregation server from the encrypted multiple local splitting gain sets, the model training module is specifically used for:

[0038] From the set of global splitting rewards, determine the target global splitting reward that satisfies the preset global splitting reward conditions;

[0039] Based on the local sites corresponding to the global splitting gain of the target in multiple local devices, the detection models of each of the multiple local devices are trained.

[0040] In an optional embodiment, the model training module is further configured to:

[0041] If the target global split gain is less than the preset global split threshold, then training of the detection models for each of the multiple local devices will be stopped.

[0042] Thirdly, embodiments of this application also propose an electronic device, which includes a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor performs the steps of the DDoS attack detection model training method described in the first aspect.

[0043] Fourthly, embodiments of this application also propose a computer-readable storage medium comprising program code, which, when executed on an electronic device, causes the electronic device to perform the steps of the DDoS attack detection model training method described in the first aspect.

[0044] Fifthly, embodiments of this application also provide a computer program product, which, when invoked by a computer, causes the computer to execute the DDoS attack detection model training method steps as described in the first aspect.

[0045] The beneficial effects of this application are as follows:

[0046] In the DDoS attack detection model training method provided in this application embodiment, a detection model training request sent by an aggregation server at a set time is received, and a subset of DDoS attack data features is obtained from the detection model training request. Next, based on the data features contained in the subset and their corresponding number of quantiles, the DDoS sample data of multiple local devices are divided to obtain multiple local quantile sets. Then, based on the negotiated key between the multiple local devices, the multiple local quantile sets are paired and masked for encryption to obtain encrypted multiple local quantile sets, which are then sent to the aggregation server. Furthermore, based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets, the local splitting benefit set corresponding to the global quantile set in the multiple local devices is determined. Further, the obtained multiple local splitting benefit sets are paired and masked for encryption to obtain encrypted multiple local splitting benefit sets, which are then sent to the aggregation server. Finally, based on the global splitting benefit set obtained by the aggregation server according to the encrypted multiple local splitting benefit sets, the detection models of the multiple local devices are trained.

[0047] This approach, based on the negotiated key among multiple local devices, uses paired mask encryption to encrypt the local point set and the local splitting gain set. This avoids the technical drawback of existing technologies where the server calculating the average parameters of the model can obtain the model parameters of each participant, thus enabling reverse engineering of the local model to infer the characteristic information of the data used by the local model, thereby reducing the privacy of the data and improving the privacy of local device data.

[0048] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing this application. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0050] Figure 1 An exemplary schematic diagram of a Boosting algorithm model provided in an embodiment of this application is shown;

[0051] Figure 2 An exemplary schematic diagram of an optional system architecture to which embodiments of this application apply is shown;

[0052] Figure 3 An exemplary illustration shows a schematic diagram of an implementation process for a method of generating a negotiation key between local devices according to an embodiment of this application;

[0053] Figure 4 An exemplary schematic diagram illustrates the implementation flow of a DDoS attack detection model training method provided in an embodiment of this application;

[0054] Figure 5 An exemplary illustration shows a logical diagram of a method for obtaining a subset of data features provided in an embodiment of this application;

[0055] Figure 6 An exemplary schematic diagram illustrates a method for synchronizing a subset of data features according to an embodiment of this application;

[0056] Figure 7 An exemplary embodiment of this application provides a method based on... Figure 4 A logical diagram;

[0057] Figure 8 An exemplary schematic diagram of a DDoS attack detection model training device provided in an embodiment of this application is shown.

[0058] Figure 9 An exemplary schematic diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0060] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0061] Furthermore, the data collection, dissemination, and use in the technical solution of this application all comply with the requirements of relevant national laws and regulations.

[0062] To facilitate understanding by those skilled in the art, some of the nouns and terms involved in the embodiments of this application will be briefly described and explained as follows:

[0063] (1) Ensemble Learning: It is not a standalone machine learning model, but a framework that combines several weak classifiers in a certain way to make them perform more powerful functions as a whole. Among them, Boosting is a major category. The idea is as shown in 1: the weak classifiers are trained in a series of iterations. The later classifiers will focus on training the shortcomings of the previous classifiers. Finally, all the weak classifiers are combined to obtain the final strong learner.

[0064] (2) Extreme Gradient Boosting (XGBoost) model: It is an implementation of the Boosting algorithm and belongs to the optimized distributed gradient enhancement library. Its model adopts a simple binary classification regression tree and integrates the base models together by addition. At the same time, in order to optimize the calculation, the loss function is expanded to the second order by Taylor to perform approximate calculation.

[0065] When determining the tree structure, random column sampling (feature sampling) and feature value binning using local strategies are adopted, which greatly optimizes the training speed of the model and reduces the amount of computation.

[0066] (2) CICDDoS2019 dataset: contains the latest DDoS attacks, similar to real-world data, including network traffic analysis results, token streams based on timestamp sources, target intrusion prevention system (IPS) source and port protocols, and attacks, etc.

[0067] (3) CatBoost: The full name is Gradient Boosting + Categorical Features. It usually uses a complete binary tree. Its nodes are mirrored, which helps to avoid overfitting, increase reliability, and greatly speed up prediction.

[0068] (4) Federated Learning: is a distributed machine learning technology. Its core idea is to build a global model based on virtual fused data by training a distributed model among multiple data sources with local data, without exchanging local individual or sample data, but only by exchanging model parameters or intermediate results. This achieves a balance between data privacy protection and data sharing computing, namely, a new application paradigm of "data is available but not visible" and "data does not move but the model moves".

[0069] (5) Horizontal federated learning, also known as sample-partitioned federated learning, can be applied to scenarios where the datasets of the participants in federated learning have the same feature space and different sample spaces, similar to the situation of horizontally partitioning data in a tabular view.

[0070] In fact, the term "horizontal" comes from the term horizontal partition, which is widely used in traditional scenarios where database records are displayed in tabular form. For example, records in a table are divided into different groups by rows, and each row contains complete data characteristics.

[0071] (6) Security Model: In the security model, an honest and curious adversary is defined. Honesty and curiosity mean that the adversary must strictly adhere to the protocol's content, but can utilize any information obtained from the protocol for analysis. In the honest and curious security model, the adversary's goal is to obtain the data privacy information of the honest training participants, i.e., the local model parameters of the honest training participants. This is because data privacy information is obtained through reverse engineering of the local model parameters. Assume the adversary... It has the following capabilities: it can eavesdrop on all channels to obtain communication data; it can corrupt aggregation servers and one or more local devices to analyze or use heuristics to obtain the privacy information of the uncorrupted honest parties.

[0072] (7) Not a Number (NaN): is a type of value in computer science that represents an undefined or unrepresentable value and is often used in floating-point arithmetic.

[0073] Furthermore, based on the above explanations of terms and related terminology, the design concept of the embodiments of this application will be briefly introduced below:

[0074] In related technologies, when classifying and detecting DDoS attacks, there are including but not limited to the following four classification and detection methods: 1. Classification of existing technical solutions; 2. DDoS attack detection scheme based on machine learning; 3. DDoS attack detection scheme based on federated learning; 4. XGBoost combined with federated learning scheme.

[0075] For example, in the classification of existing technical solutions, they can be classified according to the detection location, including source detection, intermediate network detection, and end detection technologies. From the source to the end, the detection effectiveness increases sequentially, but the detection timeliness decreases sequentially. They can also be classified according to the DDoS attack protocol layer, which can be divided into DDoS attack detection methods at the data link layer, network layer, transport layer, and application layer. Furthermore, they can be classified according to the detection algorithm, which can be divided into identification technologies based on traditional statistical methods and detection technologies based on machine learning.

[0076] When using machine learning-based DDoS attack detection solutions, the model can be trained based on the hash value changes of individual blocks in the configuration file, combined with the CICDDoS2019 dataset. Since DDoS attacks are usually carried out using captured devices, the configuration files of infected devices will change, and this change is also very valuable for analysis, which can improve the detection accuracy of specific devices in a more targeted manner.

[0077] In the federated learning-based DDoS attack detection scheme, feature selection is performed on the CICDDoS2019 dataset using CatBoost. Then, combined with algorithms from the field of image recognition, the input data is transformed into two-dimensional data. Channel mixer and token mixer are used to fuse information in the spatial and channel domains respectively. Finally, a multilayer perceptron algorithm is used to achieve fitting with the label.

[0078] In the XGBoost-feeded learning approach, the initiator uses its own feature data to create the first decision tree. Then, the initiator and collaborators work together to sequentially build the m-th decision tree, where m = 2, 3, ..., M, and M is the total number of training decision trees, thus training an XGBoost-based federated learning model. Further, during the construction of the m-th decision tree, the initiator calculates the optimal features and feature thresholds for each real node sample space, and simultaneously matches an additional node sample space as a pseudo-node sample space for each set of optimal features and feature thresholds, sending it to the corresponding feature holder. The feature holder then partitions the current node sample space based on the received features and feature thresholds and notifies the initiator of the result. Finally, the federated learning model trained above is used to predict the label of the object to be predicted.

[0079] Clearly, the above-mentioned classification and detection methods for DDoS attacks still have the following problems:

[0080] 1. The problem of data silos.

[0081] Before adopting federated learning technology, protecting the data privacy of individual devices meant either having the device train its own detection model and perform detection itself, or having the operator deploy the detection model.

[0082] However, the downside of doing this is that the amount of data will be limited to a single device, which means a limited amount of data. Although the model trained with such data may have more specialized detection capabilities for the trainer's specific device, the model's versatility and robustness will also be significantly reduced. The amount of data a model has is usually the competitive advantage of a model's detection capabilities.

[0083] If a detection model is jointly trained by merging data with other data owners, the trainer may end up receiving plaintext data from both parties, thus compromising data privacy.

[0084] 2. Insufficient protection of privacy.

[0085] In existing federated learning-based DDoS attack detection models, trainers train the model locally, and then the server averages the parameters of the models uploaded by all parties. By using the data held by each participant, the local model is trained and the model parameters are shared, enabling multi-party joint modeling without the need to upload data.

[0086] As can be seen, since the server that calculates the average parameters of the model can obtain the model parameters of each participant, it is possible to reverse engineer the local model and infer the feature information of the data used by the local model, thereby reducing the privacy of the data.

[0087] 3. The model has limited applicability.

[0088] In DDoS attack detection scenarios, the data provider needs to train the data locally; however, the data provider is a network communication device with limited computing power.

[0089] Although deep learning training methods can achieve good fitting results, they also require high computing power. Among them, the Boosting algorithm performs well in tabular data, while deep learning is suitable for very large non-tabular datasets (such as tensors, images, audio, and text). DDoS attack datasets are tabular datasets, so the Boosting algorithm is more suitable for them.

[0090] In view of this, to solve the above problems, based on federated learning technology, secure aggregation schemes, and XGBoost ensemble learning schemes, this application proposes a method for training a DDoS attack detection model, specifically including: First, receiving a detection model training request sent by an aggregation server at a set time, and obtaining a subset of DDoS attack data features from the detection model training request; Second, based on the data features contained in the subset of data features and their corresponding number of quantiles, dividing the DDoS sample data of multiple local devices to obtain multiple local quantile sets; wherein, the data features of each DDoS sample data are of the same type, and each local quantile is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension; Then, based on the negotiated key between multiple local devices, dividing the multiple local quantile sets... A partial set of loci is paired and masked for encryption to obtain multiple encrypted local loci sets, which are then sent to an aggregation server. Next, based on the global loci set returned by the aggregation server using the encrypted local loci sets, the local splitting gain sets corresponding to the global loci sets in multiple local devices are determined. Each local splitting gain represents the difference in prediction performance between a given time step and the adjacent previous time step. Further, the obtained multiple local splitting gain sets are paired and masked for encryption to obtain multiple encrypted local splitting gain sets, which are then sent to the aggregation server. Finally, based on the global splitting gain set obtained by the aggregation server using the encrypted local splitting gain sets, the detection models of each of the multiple local devices are trained.

[0091] In particular, the preferred embodiments of this application will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments of this application and the features in the embodiments can be combined with each other without conflict.

[0092] See Figure 2The diagram illustrates a system architecture applicable to an embodiment of this application. This system architecture includes: an aggregation server 201, multiple local devices 202, and multiple local databases 203. The aggregation server 201 and the multiple local devices 202 can interact via a communication network. The communication network can employ wireless communication or wired communication methods. Furthermore, each local device 202 has a corresponding local database 203.

[0093] For example, the aggregation server 201 can access the network via cellular mobile communication technology and communicate with multiple local devices 202, wherein the cellular mobile communication technology includes, for example, 5th generation mobile network (5G) technology.

[0094] Optionally, the aggregation server 201 can access the network via short-range wireless communication and communicate with multiple local devices 202, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.

[0095] This application embodiment does not impose any limitation on the number of communication devices involved in the above system architecture. For example, there may be more aggregation servers, or no aggregation servers, or other network devices may be included, such as... Figure 2 As shown, only the aggregation server 201 and multiple local devices 202 are described as examples. The following is a brief introduction to each of the above devices and their respective functions.

[0096] The aggregation server 201 is used to average the parameters of the local models uploaded by multiple local devices 202 to obtain the corresponding global model, and then send the global model back to the participants for the next round of model updates, or directly use it as the final training result.

[0097] In this embodiment of the application, both the local model and the global model are DDoS attack detection models, and the aggregation server 201 and multiple local devices 202 are both specifications of the security model.

[0098] Furthermore, the aggregation server 201 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0099] It should also be noted that in this embodiment, the aggregation server 201 should be semi-trusted (semi-honest or honest and curious), that is, the aggregation server 201 will strictly abide by the protocol requirements, but will privately calculate and analyze the information obtained in an attempt to obtain additional private information. In this embodiment, the aggregation server 201 is limited to semi-honest rather than malicious (i.e. dishonest) because a malicious server has the possibility of directly tampering with the aggregation results, and additional design is required to ensure the correctness of the aggregation results.

[0100] The local device 202 trains a local model using data stored in the local database 203 and encrypts the parameters using a secure aggregation scheme. By adopting an ensemble learning (e.g., XGBoost) training method, the local device 202 can still be applied to large datasets even with limited resources, making it very suitable for distributed network devices with limited computing power.

[0101] It is worth noting that, in this embodiment, the aforementioned multiple local devices 202 are used to receive a detection model training request sent by the aggregation server at a set time, and obtain a subset of DDoS attack data features from the detection model training request; based on the data features contained in the data feature subset and the number of quantiles corresponding to each, the DDoS sample data of each of the multiple local devices are divided to obtain multiple local quantile sets; based on the negotiated key between the multiple local devices, the multiple local quantile sets are paired and masked for encryption to obtain multiple encrypted local quantile sets, and the encrypted multiple local quantile sets are sent to the aggregation server; based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets, the local splitting benefit set corresponding to the global quantile set in the multiple local devices is determined; the obtained multiple local splitting benefit sets are paired and masked for encryption to obtain multiple encrypted local splitting benefit sets, and the encrypted multiple local splitting benefit sets are sent to the aggregation server; finally, based on the global splitting benefit set obtained by the aggregation server according to the encrypted multiple local splitting benefit sets, the detection models of each of the multiple local devices are trained.

[0102] The local database 203 is used to store data log information of network traffic received by the local device 202, including: source Internet Protocol (IP) address, destination IP address, port number and other characteristic information of the traffic. Since these are the basic information of network communication, the characteristic types among the local databases 203 can be easily guaranteed to be consistent, thus meeting the prerequisite requirements of horizontal federated learning. It should be noted that, in this embodiment of the application, for ease of description and understanding, the local database can also be referred to as DDoS sample data.

[0103] For example, DDoS sample data can be the CICDDoS2019 dataset, which includes 12 attack categories such as PortMap, NETBIOS, and LDAP. As shown in Table 1, some features of the dataset are listed. It can be seen that the network data features obtained by local devices are usually common basic features. The above-mentioned local devices can easily maintain consistency. Therefore, it meets the requirement of high overlap in feature dimensions among local devices (participants) in horizontal federated learning.

[0104] Table 1. Some features of the CICDDoS2019 dataset

[0105]

[0106] It should be noted that before training the DDoS attack detection model, the DDoS sample data needs to be preprocessed and automatically tuned.

[0107] For example, CICDDoS2019 has a sufficient amount of data, and samples with missing features can be removed. However, the XGBoost algorithm is compatible with samples with missing features. When calculating these samples, all the data without features are processed uniformly, and all are calculated once on the left and right sides of the split point, and then arranged according to the largest final value.

[0108] Next, the data features can be initially screened graphically, thereby directly removing meaningless or overly uniformly distributed features, such as timestamps (in this embodiment, the time sequence relationship is not utilized, so the analysis space of timestamps is limited) and flow IDs. Conversely, some features, such as average traffic packet size and total number of forwarded packets, are clearly identifiable on the image and are not removed.

[0109] Secondly, the data needs to be made continuous and standardized. Continuous means converting non-continuous values ​​into continuous values, such as converting Boolean values ​​to 0 and 1, NaN to 0, and converting string-formatted enumeration values ​​(such as data labels) into natural numbers. Standardization means unifying the range of data values ​​to the interval [0, 1]. It should be noted that making the data continuous and standardized not only facilitates programming but also prevents certain features from taking too large a range, which could have an excessively significant impact on the final result. Alternatively, data standardization methods such as MinMax can be used.

[0110] In addition, the random search cross-validation method can be used to achieve hyperparameter tuning. Compared with grid search tuning, random search tuning can cover more different coordinates in each dimension and has a better automatic tuning effect when the hyperparameter dimension is high.

[0111] The following describes the DDoS attack detection model training method provided by the exemplary embodiments of this application in conjunction with the above system architecture and with reference to the accompanying drawings. It should be noted that the above system architecture is only shown for the purpose of understanding the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0112] It should be noted that before receiving the detection model training request sent by the aggregation server at a set time, the negotiation key between the above-mentioned multiple local devices needs to be determined in advance so that the following can be done: generate the corresponding pairing mask vector, and encrypt the pairing mask of multiple local point sets according to the negotiation key between the above-mentioned multiple local devices to obtain the encrypted multiple local point sets, and / or encrypt the obtained multiple local split gain sets with pairing masks to obtain the encrypted multiple local split gain sets.

[0113] In one alternative implementation, when generating the negotiation key among the plurality of local devices, for any two of the local devices, refer to... Figure 3 As shown, the execution entity takes two local devices as an example and performs the following operations respectively:

[0114] S301: Determine a local device's negotiation public key based on a local device's negotiation private key and a preset negotiation public key generation method.

[0115] For example, one of the two local devices mentioned above is denoted as... ,in , This indicates the number of local devices. Since Diffie-Hellman key negotiation is possible between local devices, during key negotiation, after determining the public cyclic group G and generator g, the number of local devices... Generate a negotiated private key locally. Calculate the negotiated public key Then, according to the preset public key generation method, the negotiation public key is calculated. and publicly disclose their negotiation public key. .

[0116] S302: Determine the negotiation key between two local devices based on the negotiation private key of another local device and the negotiation public key of a local device.

[0117] For example, the other local device among any two local devices mentioned above is denoted as... Local devices Received from local device Negotiated public key After that, it can be based on its own negotiated private key. Generate local device With local devices Negotiation key between It should also be noted that if it is a local device... Received from local device Negotiated public key Then local device With local devices Negotiation key between = This means that the local device can be represented as a whole. With local devices The negotiation key between them is: .

[0118] Therefore, based on the negotiation key generation method described in S301~S302 above, the local device With local devices A successful negotiation can yield a consistent result, namely the negotiation key. Furthermore, the negotiated key result is known only between the two local devices and is not known to outsiders.

[0119] Furthermore, after determining the negotiation keys among the aforementioned multiple local devices, paired mask encryption can be performed on multiple local split point sets and multiple local split gain sets based on the obtained negotiation keys, thereby enabling the training of a DDoS attack detection model. (See [link to relevant documentation]). Figure 4 The diagram shown is an implementation flowchart of a DDoS attack detection model training method provided in this application embodiment. The execution entity is still the aforementioned multiple local devices. The specific implementation flow of this method is as follows:

[0120] S401: Receives a detection model training request sent by the aggregation server at a set time, and obtains a subset of DDoS attack data features from the detection model training request.

[0121] The aforementioned time setting represents the start time of the nth iteration training of the detection models of the aforementioned multiple local devices.

[0122] In one alternative implementation, when performing step S401, refer to... Figure 5As shown, the data feature subset is obtained in the following way: according to the preset data feature sampling method, the data feature set of DDoS attack is sampled to obtain each data feature, and then a data feature subset is generated based on each data feature.

[0123] For example, the above-mentioned preset data feature sampling method can be feature partial sampling, where feature partial sampling means that, in order to reduce the amount of computation, only (randomly) select a portion of the feature values ​​to train the new weak classifier each time a new weak classifier is trained.

[0124] To ensure consistency in the selected features across all participants, please refer to [reference needed]. Figure 6 As shown, a relatively efficient and simple master-slave model is usually used to maintain synchronization. That is, the process of randomly selecting features is carried out on the aggregation server, and then the aggregation server initiates synchronization to synchronize the randomly selected subset of data features to each local device (participant).

[0125] S402: Based on the data features contained in the data feature subset and the number of their respective quantiles, the DDoS sample data of multiple local devices are divided to obtain multiple local quantile sets.

[0126] Each DDoS sample data has the same data feature type, and each local partition is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension.

[0127] It should be noted that after the aggregation server obtains the subset of data features (each data feature), that is, after selecting the feature values, it needs to calculate the appropriate quantiles for the current data features. Among them, the quantiles are a key step in the training of the XGBoost model. It is necessary to calculate the splitting gain for each quantile and finally select the splitting point with the largest splitting gain as the tree structure of the weak classifier.

[0128] If the most basic greedy algorithm is used, then every existing quantile value in each data feature of the data feature subset needs to be tried. This is the most accurate calculation and can obtain the weak classifier with the best classification effect, but the cost is a huge amount of computation.

[0129] To reduce computational load, some computational accuracy is sacrificed. However, since weak classifiers do not require high computational accuracy, the overall model accuracy is not significantly reduced. Furthermore, the splitting reward is calculated using a fixed method, so the number of attempts at each quantile needs to be controlled.

[0130] In the XGBoost model, a local strategy is used to determine the bucket boundaries. That is, instead of trying every value of the data feature, the values ​​to be tried are selected more sparsely. Therefore, the finer the boundaries, the closer they are to the computationally intensive greedy algorithm, while the sparser the boundaries, the less computation is required, but the less likely it is to obtain the global optimum.

[0131] The local strategy refers to the need to reselect quantiles each time a new weak classification tree is trained. To maintain consistency in quantiles, the aggregation server needs to pre-determine a certain number of quantiles. As a hyperparameter, the aforementioned multiple local devices then select their respective quantiles based on the received data characteristics; for example, this can be denoted as... This means dividing the DDoS sample data of multiple local devices into multiple local site sets.

[0132] For example, after the aggregation server selects a subset of data features, since the weak classifier is a binary tree, only one quantile is needed to separate the two results. Therefore, it is necessary to determine a final data feature and its quantile as the splitting structure of the current leaf node.

[0133] For example, suppose the data feature subset includes two data features: inflow and outflow. First, taking inflow as an example, suppose the sample flow range is 0-10000, and the quantile is set to 4000. If the inflow of sample A is 3000, it will be classified into the <4000 category, and if the inflow of sample B is 8000, it will be classified into the >=4000 category, which is a binary classification problem. Next, once the quantile is determined, the value of the objective function can be calculated. The difference between the objective function value before setting the quantile (i.e., the previous time step) and the value after setting the quantile (i.e., the set time step) is the splitting gain. The larger the splitting gain, the better the effect of setting 4000 as the quantile.

[0134] To reduce computational cost, we cannot iterate through 0-10000. Instead, we randomly select some values ​​as quantiles, such as 1000, 4000, and 6000. We select the quantile with the highest splitting benefit from these three quantiles and compare it with the quantile with the highest splitting benefit from the outflow. If the splitting benefit of the inflow 4000 is the highest, then the splitting structure of the current leaf node is determined to be: inflow 4000.

[0135] S403: Based on the negotiated key between multiple local devices, pair mask encryption is performed on multiple local point sets to obtain encrypted multiple local point sets, and the encrypted multiple local point sets are sent to the aggregation server.

[0136] In one optional implementation, when performing step S403, after determining their respective local point sets, multiple local devices can generate pairing mask vectors between multiple local devices based on the negotiated key between the multiple local devices. Then, based on the obtained pairing mask vectors, they can perform pairing mask encryption on each local point contained in the multiple local point sets to obtain encrypted multiple local point sets.

[0137] For example, the aforementioned multiple local devices can utilize a pseudo-random number generator to generate paired mask vectors, i.e., each local device... Using a pseudo-random generator, to Generate a series of paired masks for the seed. The pseudo-random generator is used to expand the dimension. When the data to be encrypted is a vector, it can expand the seed of a single value into a random number of the entire vector.

[0138] Optionally, after generating the negotiation key between the multiple local devices, the aforementioned multiple local devices can directly generate the pairing mask vector between the multiple local devices, so that the pairing mask vector can be directly used for pairing mask encryption in the future, thereby improving the efficiency of model training to a certain extent.

[0139] In one optional implementation, when performing paired mask encryption on each local point contained in multiple local point sets based on the obtained paired mask vectors, the following operations are performed on each local point contained in the multiple local point sets: determining the target local device corresponding to a local point, and at least one paired mask vector between the target local device and other local devices among the multiple local devices; obtaining the encrypted local point based on a local point and at least one paired mask vector; and saving the encrypted local point to the local point set corresponding to the target local device, thereby uploading the local points using a secure aggregation method, that is, encrypting the data (local points) to be aggregated by each local device using paired mask encryption.

[0140] For example, each of the aforementioned local devices uses the generated paired mask vector to encrypt the data to be aggregated (i.e., local locations), wherein the specific calculation formula for paired mask encryption is as follows:

[0141]

[0142] in, This represents a local portion of the encrypted data, i.e., the ciphertext. This indicates unencrypted partial locations, which are plaintext. Indicates local device With local devices Pairing mask vectors between them and , , This indicates the number of local devices.

[0143] Furthermore, multiple local devices can obtain encrypted sets of multiple local point locations and send these encrypted sets of multiple local point locations to the aggregation server.

[0144] S404: Based on the global quantile set returned by the aggregation server from the encrypted multiple local quantile sets, determine the local splitting benefit set corresponding to the global quantile set in multiple local devices.

[0145] The benefit of each local split is characterized by the difference in prediction performance between the detection model of the corresponding local device at a given time and the adjacent previous time.

[0146] In an optional embodiment, when performing step S404, after receiving the encrypted data (i.e., the encrypted set of multiple local quantiles) uploaded by each local device, the aggregation server can aggregate the encrypted data to obtain the corresponding aggregated plaintext (i.e., the global quantile set). The specific calculation formula for ciphertext aggregation is as follows:

[0147]

[0148] in, This represents the aggregation result of local quantiles at the same quantile location for the same data feature on various local devices. This represents a local portion of the encrypted data, i.e., the ciphertext. This represents unencrypted partial locations, i.e., plaintext. Indicates local device With local devices Pairing mask vectors between them and , , This indicates the number of local devices.

[0149] Furthermore, after calculating the sum of the quantiles of each local device on each data feature, the aggregation server divides the sum by the number of local devices to obtain the average value of the local quantiles, and uses this as the global quantile. Thus, the corresponding global quantile set is obtained, and the obtained global quantile set is distributed to each local device.

[0150] After receiving the global quantile set, each local device can calculate the splitting gain for each global quantile. The splitting gain refers to the magnitude of the decrease in the objective function after splitting at that quantile. No. Local splitting gains at quantiles in a round (i.e., at a given time). The calculation method is as follows:

[0151]

[0152] in, Indicates local device No. The partial splitting benefit of the wheel, Indicates local device The objective function result at the previous time step adjacent to the given time step. Indicates local device The result of the objective function at the set time, the objective function It consists of the loss function of the detection model and a regularization term to suppress the complexity of the detection model. It should also be noted that, in the embodiments of this application, the loss function of the detection model can be represented by the distance between the label value and the predicted value.

[0153] As can be seen, based on the above method steps, the aforementioned multiple local devices can obtain the local splitting benefit set corresponding to the global quantile set.

[0154] S405: Perform pairing mask encryption on the obtained multiple local split profit sets to obtain encrypted multiple local split profit sets, and send the encrypted multiple local split profit sets to the aggregation server.

[0155] In one optional implementation, when performing step S405, after determining their respective local splitting reward sets, multiple local devices can determine pairing mask vectors between multiple local devices based on the negotiated key between the multiple local devices. Based on each pairing mask vector, each local splitting reward contained in the multiple local splitting reward sets is encrypted with a pairing mask to obtain multiple encrypted local splitting reward sets, that is, the pairing mask encryption method with the same sampling local partitions is used, and then the encrypted multiple local splitting reward sets are sent to the aggregation server.

[0156] For example, after calculating the local splitting reward corresponding to each global quantile, each local device encrypts each local splitting reward using a paired mask to obtain an encrypted set of local splitting rewards. This will split the payout set. Uploaded to the aggregation server.

[0157] S406: Based on the global splitting gain set obtained by the aggregation server from the encrypted multiple local splitting gain sets, the detection models of multiple local devices are trained.

[0158] In an optional embodiment, when performing step S406, after receiving the encrypted data (i.e., multiple encrypted local splitting reward sets) uploaded by each local device, the server can aggregate the encrypted data to obtain the corresponding aggregated plaintext (i.e., the global splitting reward set). The calculation formula for the ciphertext aggregation remains the same:

[0159]

[0160] in, This represents the aggregated result of local splitting gains corresponding to the same global quantile for the same data feature on various local devices. This represents the encrypted local splitting reward, i.e., the ciphertext. This represents the unencrypted partial split reward, i.e., plaintext. Indicates local device With local devices Pairing mask vectors between them and , , This indicates the number of local devices.

[0161] Furthermore, after obtaining the corresponding aggregation results, the aggregation server averages the splitting rewards (for a given global quantile) to obtain the corresponding set of global splitting rewards. The benefit of each global split The calculation method is as follows:

[0162]

[0163] in, Indicates local device No. The global splitting benefit of the wheel, Indicates local device No. The partial splitting benefit of the wheel, This indicates the number of local devices.

[0164] Clearly, based on the above method steps, a safe average of local splitting gains is achieved, thereby obtaining the corresponding global splitting gains or a set of global splitting gains.

[0165] In one alternative implementation, after receiving the global splitting gain set, each local device can determine the target global splitting gain that meets the preset global splitting gain conditions from the global splitting gain set, and then train the detection model of each of the multiple local devices based on the local sites corresponding to the target global splitting gain in the multiple local devices.

[0166] Among them, the aforementioned preset global splitting reward condition can be: the largest splitting reward in the global splitting reward set.

[0167] Optionally, if the target global splitting gain is less than the preset global splitting threshold, then training the detection models of multiple local devices will be stopped, indicating that the detection models of each local device have been basically trained and the detection models have achieved a high prediction effect.

[0168] In a preferred implementation, the aggregation server obtains the global splitting reward set. Afterwards, the global split reward set can be directly accessed. The maximum global split gain is selected and used as the target global split gain that satisfies the preset global split gain conditions, and the quantile corresponding to the maximum global split gain is determined.

[0169] Next, the global split gain is verified. If the global split gain is less than the threshold set in the hyperparameters (i.e., the preset global split threshold), it means that the current model training effect is no longer significantly improved, and iterative training can be stopped; otherwise, model training can continue to achieve higher prediction accuracy.

[0170] Furthermore, the aggregation server adopts a master-slave synchronization method, using this quantile and its data characteristics as the splitting strategy for the global tree structure in this round, and synchronizing the global tree structure to each local device.

[0171] Based on the training results of the current model, each local device iteratively trains the next weak classifier, returns to the feature part for sampling, and repeats the subsequent steps until the improvement of the detection model training effect is no longer significant, thus achieving a high DDoS attack detection effect.

[0172] Based on the training method for the DDoS attack detection model of S401~S406 mentioned above, please refer to... Figure 7As shown, taking two local devices, namely Local Device 1 and Local Device 2, as an example, federated learning technology is used to solve the data silo problem in the training of DDoS attack detection models. This not only increases the amount of data for training the detection model but also improves the quality and generality of the model. A secure aggregation technology combined with a machine learning scheme is adopted. Compared with existing technologies, an information-theoretically secure symmetric mask aggregation scheme is used, achieving stronger privacy protection. This allows each local device to jointly train the model without exposing normal traffic privacy, expanding the size of the dataset and training a more general and accurate detection model. Furthermore, it better suits the actual scenario of DDoS attack detection involving a wide range of devices and the need to protect customer traffic privacy. Compared with deep learning, XGBoost has the significant advantage of being applicable to large datasets even with limited resources, making it very suitable for distributed network devices with limited computing power.

[0173] In summary, the DDoS attack detection model training method provided in this application embodiment firstly receives a detection model training request sent by an aggregation server at a set time, and obtains a subset of DDoS attack data features from the detection model training request; secondly, based on each data feature contained in the data feature subset and its corresponding number of quantiles, the DDoS sample data of multiple local devices are divided to obtain multiple local quantile sets; then, based on the negotiated key between multiple local devices, the multiple local quantile sets are paired and masked for encryption to obtain encrypted multiple local quantile sets, and the encrypted multiple local quantile sets are sent to the aggregation server; furthermore, based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets, the local splitting benefit set corresponding to the global quantile set in multiple local devices is determined; further still, the obtained multiple local splitting benefit sets are paired and masked for encryption to obtain encrypted multiple local splitting benefit sets, and the encrypted multiple local splitting benefit sets are sent to the aggregation server; finally, based on the global splitting benefit set obtained by the aggregation server according to the encrypted multiple local splitting benefit sets, the detection models of multiple local devices are trained.

[0174] This approach, based on the negotiated key among multiple local devices, uses paired mask encryption to encrypt the local point set and the local splitting gain set. This avoids the technical drawback of existing technologies where the server calculating the average parameters of the model can obtain the model parameters of each participant, thus enabling reverse engineering of the local model to infer the characteristic information of the data used by the local model, thereby reducing the privacy of the data and improving the privacy of local device data.

[0175] Furthermore, based on the same technical concept, embodiments of this application provide a DDoS attack detection model training device, which is applied to multiple local devices. This DDoS attack detection model training device is used to implement the above-described method flow of embodiments of this application. See also... Figure 8 As shown, the DDoS attack detection model training includes: a request receiving module 801, a data partitioning module 802, a first encryption module 803, a profit determination module 804, a second encryption module 805, and a model training module 806, wherein:

[0176] The request receiving module 801 is used to receive the detection model training request sent by the aggregation server at a set time, and to obtain a subset of DDoS attack data features from the detection model training request.

[0177] The data partitioning module 802 is used to partition the DDoS sample data of multiple local devices based on the data features contained in the data feature subset and the number of their respective quantiles, to obtain multiple local quantile sets; wherein, the data feature types of each DDoS sample data are the same, and each local quantile is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension.

[0178] The first encryption module 803 is used to perform paired mask encryption on multiple local point sets based on the negotiated key between multiple local devices, to obtain the encrypted multiple local point sets, and to send the encrypted multiple local point sets to the aggregation server.

[0179] The revenue determination module 804 is used to determine the local split revenue set corresponding to the global quantile set in multiple local devices based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets; wherein, each local split revenue represents the difference in prediction effect between a set time and the adjacent previous time.

[0180] The second encryption module 805 is used to perform pairing mask encryption on the obtained multiple local split profit sets to obtain the encrypted multiple local split profit sets, and send the encrypted multiple local split profit sets to the aggregation server.

[0181] The model training module 806 is used to train the detection models of multiple local devices based on the global splitting gain set obtained by the aggregation server from the encrypted multiple local splitting gain sets.

[0182] In an optional embodiment, before receiving the detection model training request sent by the aggregation server at a set time, the first encryption module 803 is further configured to:

[0183] For any two local devices among multiple local devices, perform the following operations respectively:

[0184] Based on the negotiated private key of a local device and the preset negotiated public key generation method, a negotiated public key of a local device is determined;

[0185] Determine the negotiation key between the two local devices based on the negotiation private key of another local device and the negotiation public key of another local device.

[0186] In one alternative embodiment, the subset of data features is obtained as follows:

[0187] According to the preset data feature sampling method, feature sampling is performed on the data feature set of DDoS attacks to obtain each data feature;

[0188] Based on each data feature, a subset of data features is generated.

[0189] In an optional embodiment, when performing paired mask encryption on multiple local point sets based on a negotiated key among multiple local devices to obtain encrypted multiple local point sets, the first encryption module 803 is specifically used for:

[0190] Based on the negotiated key between multiple local devices, generate a pairing mask vector between multiple local devices;

[0191] Based on the obtained pairing mask vectors, pairing mask encryption is performed on each local site contained in the multiple local site sets to obtain the encrypted multiple local site sets.

[0192] In an optional embodiment, when performing paired mask encryption on each local point contained in multiple local point sets based on the obtained paired mask vectors, the first encryption module 803 is specifically used for:

[0193] For each local locus contained in multiple local locus sets, perform the following operations respectively:

[0194] Determine the target local device corresponding to a local location, and at least one pairing mask vector between the target local device and other local devices among a plurality of local devices;

[0195] Based on a local partial site and at least one paired mask vector, the encrypted local partial site is obtained, and the encrypted local partial site is saved to the local partial site set corresponding to the target local device.

[0196] In an optional embodiment, when training the detection models of multiple local devices based on the global splitting gain set obtained by the aggregation server from the encrypted multiple local splitting gain sets, the model training module 806 is specifically used for:

[0197] From the set of global splitting rewards, determine the target global splitting reward that satisfies the preset global splitting reward conditions;

[0198] Based on the local sites corresponding to the global splitting gain of the target in multiple local devices, the detection models of each of the multiple local devices are trained.

[0199] In an optional embodiment, the model training module 806 is further configured to:

[0200] If the target global split gain is less than the preset global split threshold, then training of the detection models for each of the multiple local devices will be stopped.

[0201] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the DDoS attack detection model training method provided in the above embodiments of this application. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 9 As shown, the electronic device may include:

[0202] At least one processor 901 and a memory 902 connected to at least one processor 901. In this embodiment, the specific connection medium between the processor 901 and the memory 902 is not limited. Figure 9 The example shown is the connection between processor 901 and memory 902 via bus 900. Bus 900 is... Figure 9 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 900 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 9 The character is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 901 can also be called a controller; there is no restriction on the name.

[0203] In this embodiment, the memory 902 stores instructions executable by at least one processor 901. By executing the instructions stored in the memory 902, the at least one processor 901 can execute a DDoS attack detection model training method described above. The processor 901 can implement... Figure 8 The functions of each module in the device shown.

[0204] The processor 901 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 902 and calling data stored in memory 902, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0205] In one possible design, processor 901 may include one or more processing units. Processor 901 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 901. In some embodiments, processor 901 and memory 902 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0206] The processor 901 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the DDoS attack detection model training method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0207] Memory 902, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 902 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 902 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 902 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0208] By designing and programming the processor 901, the code corresponding to the DDoS attack detection model training method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the code during runtime. Figure 4 The illustrated embodiment describes the steps of a DDoS attack detection model training method. How to design and program the processor 901 is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0209] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a DDoS attack detection model training method described above.

[0210] In some possible implementations, this application also provides a method for training a DDoS attack detection model that can be implemented as a program product including program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the method for training a DDoS attack detection model according to various exemplary embodiments of this application as described above.

[0211] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0212] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0213] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0215] Program code for performing the operations of this application can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0216] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0217] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0218] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0219] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for training a detection model for Distributed Denial-of-Service (DDoS) attacks, characterized in that, Applicable to multiple local devices, including: Receive a detection model training request sent by the aggregation server at a set time, and obtain a subset of DDoS attack data features from the detection model training request; Based on the data features contained in the data feature subset and the number of quantiles corresponding to each feature, the DDoS sample data of multiple local devices are divided to obtain multiple local quantile sets. Among them, the data feature types of each DDoS sample data are the same, and each local quantile is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension. Based on the negotiated key among the multiple local devices, the multiple local point set is paired and masked for encryption to obtain the encrypted multiple local point set, and the encrypted multiple local point set is sent to the aggregation server; Based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets, the local splitting benefit set corresponding to each of the multiple local devices in the global quantile set is determined; wherein, each local splitting benefit represents: the magnitude of the decrease in the objective function between the set time and the adjacent previous time, the objective function is composed of the loss function of the detection model and the regularization term to suppress the complexity of the detection model, and the loss function of the detection model is represented by the distance between the label value and the predicted value; The obtained multiple local splitting profit sets are paired and masked for encryption to obtain multiple encrypted local splitting profit sets, and the encrypted multiple local splitting profit sets are sent to the aggregation server; Based on the global splitting reward set obtained by the aggregation server according to the encrypted multiple local splitting reward sets, the detection models of the multiple local devices are trained. If the target global split gain is less than the preset global split threshold, then training of the detection models of the multiple local devices is stopped; wherein, the target global split gain is the largest global split gain in the set of global split gains.

2. The method as described in claim 1, characterized in that, Before receiving the detection model training request sent by the aggregation server at a set time, the method further includes: For any two of the plurality of local devices, perform the following operations respectively: Based on the negotiated private key of a local device and the preset negotiated public key generation method, the negotiated public key of the local device is determined; Based on the negotiation private key of another local device and the negotiation public key of the first local device, a negotiation key between the two local devices is determined.

3. The method as described in claim 1, characterized in that, The subset of data features is obtained in the following manner: According to a preset data feature sampling method, feature sampling is performed on the data feature set of the DDoS attack to obtain each data feature; Based on the aforementioned data features, a subset of data features is generated.

4. The method according to any one of claims 1-3, characterized in that, The step of performing paired mask encryption on the multiple local point sets based on the negotiated key among the multiple local devices to obtain the encrypted multiple local point sets includes: Based on the negotiation key among the multiple local devices, a pairing mask vector is generated among the multiple local devices; Based on the obtained pairing mask vectors, pairing mask encryption is performed on each local site contained in the multiple local site set to obtain the encrypted multiple local site set.

5. The method as described in claim 4, characterized in that, The step of performing paired mask encryption on each local point contained in the multiple local point sets based on the obtained paired mask vectors includes: For each local site contained in the plurality of local site sets, perform the following operations respectively: Determine a target local device corresponding to a local location, and at least one pairing mask vector between the target local device and other local devices among the plurality of local devices; Based on the one local partial site and the at least one paired mask vector, the encrypted local partial site is obtained, and the encrypted local partial site is saved to the local partial site set corresponding to the target local device.

6. The method according to any one of claims 1-3, characterized in that, The step of training the detection models of the multiple local devices based on the global splitting gain set obtained by the aggregation server from the encrypted multiple local splitting gain sets includes: From the set of global splitting rewards, determine the target global splitting reward that satisfies the preset global splitting reward conditions; Based on the local sites corresponding to the target global splitting gain among the multiple local devices, the detection models of each of the multiple local devices are trained.

7. A training device for a DDoS attack detection model, characterized in that, Applicable to multiple local devices, including: The request receiving module is used to receive the detection model training request sent by the aggregation server at a set time, and to obtain a subset of DDoS attack data features from the detection model training request. The data partitioning module is used to partition the DDoS sample data of multiple local devices based on the data features contained in the data feature subset and the number of their respective quantiles, to obtain multiple local quantile sets; wherein, each DDoS sample data has the same data feature type, and each local quantile is used to divide the samples in the DDoS sample data into two categories on the corresponding data feature dimension. The first encryption module is used to perform paired mask encryption on the multiple local point set based on the negotiated key between the multiple local devices to obtain the encrypted multiple local point set, and send the encrypted multiple local point set to the aggregation server. The revenue determination module is used to determine, based on the global quantile set returned by the aggregation server according to the encrypted multiple local quantile sets, the local split revenue set corresponding to each of the multiple local devices in the global quantile set; wherein, each local split revenue represents: the magnitude of the decrease in the objective function between the set time and the adjacent previous time, the objective function is composed of the loss function of the detection model and a regularization term to suppress the complexity of the detection model, and the loss function of the detection model is represented by the distance between the label value and the predicted value; The second encryption module is used to perform pairing mask encryption on the obtained multiple local split profit sets to obtain encrypted multiple local split profit sets, and send the encrypted multiple local split profit sets to the aggregation server. The model training module is used to train the detection models of the multiple local devices based on the global splitting gain set obtained by the aggregation server according to the encrypted multiple local splitting gain sets. The model training module is used to determine whether to stop training the detection models of the multiple local devices if the target global splitting gain is less than a preset global splitting threshold; wherein the target global splitting gain is the largest global splitting gain in the set of global splitting gains.

8. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the computer program product is invoked by a computer, it causes the computer to perform the method as described in any one of claims 1-6.

Images