DOS attack detection method based on spectral physical characteristics in optoelectronic fusion network

Abstract

The present invention relates to a DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network, and belongs to the field of network information security. The present invention establishes a DOS attack on the existing optical network infrastructure. After the data signal under the DOS attack and the normal data signal are transmitted through the optical fiber, the spectrum will change to different degrees. Different spectral information reflects whether an attack has occurred. The BP neural network's super learning ability is then used to learn and identify whether an attack has occurred. The model is simple and the recognition accuracy is high. Compared with other detection methods for information obtained after optoelectronic conversion, this method detects DOS attacks earlier by detecting the spectrum before optoelectronic conversion, which is a more efficient detection method.

Description

Technical Field

[0001] The invention belongs to the field of network information security and relates to a DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network. Background Art

[0002] DOS attack is an attack generated by maliciously analyzing the defects of TCP / IP protocol and vulnerabilities in the operating system. With the increasing demand for digital tools in recent years, the Internet industry has ushered in sustained high-speed growth. DOS attacks are difficult to trace, highly concealed, highly concurrent, and cause great harm to network security, so they have become the preferred means of hacker attacks. The defense technology of DOS attacks mainly includes three aspects: DOS attack detection technology, DOS attack source tracking technology, and DOS attack packet filtering technology. Among them, attack detection technology is the basis of attack source tracking technology and attack packet filtering technology. Only by quickly and accurately detecting the occurrence of attacks can attack source tracking and attack packet filtering be implemented in time. Research shows that in 2021, 80% of DOS attacks lasted less than 5 minutes, and high-frequency instantaneous attacks accounted for a high proportion. Therefore, the faster and more accurate detection of the occurrence of DOS attacks is a research focus.

[0003] Most of the current research objects for DOS attack detection are based on the characteristics of network traffic or highly preprocessed standard data sets. Checking the characteristics of network traffic, the content of data packets, or tracking protocol status can help attack detection, but these methods require a lot of calculations, and the data objects of these studies are processed in the electrical domain, time domain, and frequency domain. In addition to the above three domains, signal processing is also an important dimension in the optical domain. Optical fiber communication is a telecommunications network with optical fiber as the main medium. In the past three decades, optical fiber has become an important medium for transmitting large amounts of data through aggregated Internet, mobile backhaul, and core networks. More than 90% of Internet data in the world will be transmitted through optical fiber. Therefore, the data generated by the DOS attacker must be transmitted through optical fiber. In the past, the research objects of DOS attack detection were all data obtained after the signal was transmitted through optical fiber for photoelectric conversion. If the characteristics of data information in the optical domain are directly considered, there is no need to wait for photoelectric conversion, and information can be extracted faster, thereby detecting DOS attacks faster. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network. The method obtains spectral information of DOS attack data and normal data from the optical domain, then preprocesses the data, and finally detects whether a DOS attack occurs in the network through a BP neural network.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network comprises the following steps:

[0007] S1: A spectrum analyzer is placed before the modulation and demodulation point. The spectrum analyzer collects spectrum information of the flow data at fixed time windows. The spectrum information includes energy information corresponding to each frequency point, and a spectrum data set is obtained.

[0008] S2: Perform data preprocessing on the spectral data set to ensure that the data collected in each time window has the same data dimension after processing;

[0009] S3: normalize the preprocessed data and use the normalized spectral information as the final data set;

[0010] S4: Build three machine learning models, XGBoost, LightGBM and BP neural network, respectively, for attack detection. Compare the detection accuracy DR, false alarm rate FAP and false negative rate FRR indicators of various models to verify the advantages of BP neural network model and the ability of spectrum as detection indicator.

[0011] S5: Randomly take out 70% of the data from the data set as the training set, and bring them into the three machine learning models for model training, and obtain the DOS attack detection model respectively;

[0012] S6: Detection stage: The remaining 30% of the data set is used as a test set and brought into the DOS attack detection model for detection. According to the detection results, it is determined whether an attack has occurred, and the detection accuracy rate DR, false alarm rate FAP and missed alarm rate FRR indicators are obtained.

[0013] Optionally, in S1, the modulation and demodulation point is an edge modem at the server end, and a spectrum analyzer is placed in front of the edge modem to collect spectrum data. The collected n groups of window data sets V = {V1, V2, ..., V n}, the collected data of each group has W = {W1, W2, …, W2}-dimensional attribute features.

[0014] Optionally, in S2, the dimensional characteristics of each group of collected data are inconsistent, and the data is preprocessed; the spectral information is represented as energy information corresponding to each frequency point, and the number of frequency points is first determined, that is, the dimensional characteristics of the data are determined; then the spectral information of the determined frequency points is collected, and if the data in a certain window does not have the spectral information of the required frequency point, the spectral information of the surrounding frequencies is added and averaged, and the obtained data is the required spectral information.

[0015] Optionally, in S3, the spectral data of each group is normalized: Normalizing the data is beneficial for the initialization of the machine learning algorithm, adjusting the learning rate value, and speeding up the search for the optimal solution.

[0016] Optionally, in S4, XGBoost is a method based on an optimized gradient boosting decision tree (GBDT), which reduces the fitting residual by finding a suitable function;

[0017] BP neural network is a fully connected multi-layer feedforward neural network that uses the error back propagation algorithm; it contains an input layer, a hidden layer, and an output layer, where the input layer is responsible for receiving input data, the hidden layer processes the input data, and the output layer outputs the final result; the training of BP neural network is also a supervised learning process, which is divided into two stages: forward propagation of information and backward propagation of error.

[0018] Optionally, in S5, the data will be labeled with two labels: attack data and normal data. Before obtaining the training set, the data set will be disrupted to make the data set disordered, thereby enhancing the training effect of the model.

[0019] Optionally, in S6, the calculation formulas for the detection accuracy rate DR, the false alarm rate FAP and the missed alarm rate FRR are respectively:

[0020]

[0021] TP represents the number of positive samples predicted as positive samples, FP represents the number of negative samples predicted as positive samples, FN represents the number of positive samples predicted as negative samples, TN represents the number of negative samples predicted as negative samples, N is the total number of samples in the sample data set, normal data is positive, and DOS attack data is negative; when the detection model detects window data as attack data for multiple consecutive times, it will be judged as attacked, otherwise it will be judged as normal data.

[0022] The beneficial effects of the present invention are:

[0023] 1) Traditional DOS detection is performed after obtaining information after photoelectric conversion. In order to detect DOS attacks as early as possible, the method proposed in the present invention is to detect DOS attacks earlier by detecting the spectrum before photoelectric conversion. This is a more efficient detection method based on the existing optical network infrastructure.

[0024] 2) Most of the current research objects for DOS attack detection are based on the characteristics of network traffic or highly pre-processed standard data sets. In addition to detecting DOS attacks earlier by detecting the spectrum in the underlying optical network, it can also reduce the pressure of information processing after photoelectric conversion. A variety of machine learning algorithms were used for comparison to verify the feasibility of spectral information as a DOS attack detection indicator and that BP neural network is more suitable for DOS attack detection, ensuring faster detection of attacks while having high accuracy.

[0025] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0027] Figure 1 This is a diagram of the DOS attack detection framework based on spectral physical characteristics;

[0028] Figure 2 It is a data extraction block diagram of spectral features;

[0029] Figure 3 This is a comparison chart of spectral data;

[0030] Figure 4 It is a DOS attack detection solution based on machine learning. DETAILED DESCRIPTION

[0031] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0032] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0033] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0034] Figure 1 This is a DOS attack detection framework diagram based on spectral physical characteristics. The DOS attack is established on the existing optical network, taking into account that the attack data and normal data have different optical signal characteristics when they are transmitted in the optical fiber after the optical-electrical conversion. Normal data and the data generated by the attacker will first pass through the router device, and then the router will transmit the data to the modem for conversion from electrical signal to optical signal. Then the signal will be transmitted to the Internet. When transmitting in the Internet, the data will pass through the routing device and modulation and demodulation preparation many times, and the data will also undergo multiple optical signal-electrical signal and electrical signal-optical signal conversions until it reaches the server.

[0035] Traditional DOS detection is performed after obtaining information after photoelectric conversion. In order to detect DOS attacks as early as possible, the method proposed by the present invention is to detect DOS attacks earlier by detecting the spectrum before photoelectric conversion. This is a more efficient detection method based on the existing optical network infrastructure. The detection process is as follows: first, a spectrum analyzer will be placed in front of the modem on the server side. The spectrum analyzer will extract the spectrum signal of the optical signal transmitted in the receiving end link, periodically extract the required spectrum information, store the collected spectrum data, pre-process the data, and train the attack detection model with the processed data. Attack detection is performed through the trained DOS attack detection model to determine whether the transmitted data is attack data. If it is determined to be attack data within multiple consecutive time windows, attack defense is performed; if it is determined to be a normal attack, data transmission is performed normally. Compared with obtaining data features only after modulating and demodulating the signal, detecting the signal at the optical layer will give priority to completing the detection of data, and can determine whether an attack has occurred more quickly, which will give the device end more time to respond to the attack.

[0036] Figure 2 The data extraction block diagram of the spectral feature is shown in Figure 1. Since it is difficult to build an actual attack system to obtain spectral information and there is no real spectral data set for DOS attacks, it is necessary to reconstruct the spectral data through the existing DOS attack data. In the present invention, a modulation system is built to model the real communication environment. In the simulation, the extraction of spectral data first requires obtaining the original data, collecting all network data packets circulating in each window according to the divided window size, extracting the data content of the data packet, and processing the data and bringing it into the built modulation system to obtain the spectral features corresponding to all window data.

[0037] Figure 3The spectral data comparison diagram is shown in Figure 1. In order to analyze the changes in the spectral characteristics of network data when it is transmitted through optical fiber with or without DOS attacks, the present invention mainly obtains some DOS attack (sumrf and neptune) network data and normal network data for analysis. Neptune: The attacker uses the defects of the TCP protocol to send a large number of false TCP connection requests. Due to the exhaustion of TCP connection resources, the attacked server cannot respond to normal requests. Smurf: This attack combines IP spoofing and the echo request of the ICMP protocol. The attacker will inject a large amount of network traffic into the target system, making the target system unable to provide services to normal users. The selected time window size is 500ms. It can be seen from the comparison diagram that in all the measured frequency ranges, relative to the spectrum of normal data and Neptune attack, the spectral energy of Smurf attack has always been in a lower energy state, while the spectrum of normal data and Neptune attack has similar energy distribution in the frequency range; although the spectrum of normal data and Neptune attack is similar, it can still be seen that the spectrum of Neptune attack is more concentrated in the spectrum range, while the spectral energy of normal data is more evenly distributed in the spectrum range.

[0038] Figure 4 For a DOS attack detection scheme based on machine learning, the spectral data under DOS attack and the spectral data of normal data are used as input data. First, the input spectral data is preprocessed. Because the spectral data standards extracted from each time window are inconsistent, in order to reduce the computational complexity and improve the recognition accuracy, it is necessary to convert the data into the optimal format acceptable to the machine learning input through data preprocessing. Then the data needs to be labeled and standardized. Finally, the standardized data is input into various machine learning models for model establishment for DOS attack detection.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network, characterized by: The method comprises the following steps: S1: Place a spectrum analyzer before the modulation and demodulation point. The spectrum analyzer collects spectrum information of the flow data at fixed time windows. The spectrum information includes energy information corresponding to each frequency point, and obtains a spectrum data set. S2: Perform data preprocessing on the spectral data set to ensure that the data collected in each time window has the same data dimension after processing; S3: normalize the preprocessed data and use the normalized spectral information as the final data set; S4: Build three machine learning models, XGBoost, LightGBM and BP neural network, respectively, for attack detection. Compare the detection accuracy DR, false alarm rate FAP and false negative rate FRR indicators of various models to verify the advantages of BP neural network model and the ability of spectrum as detection indicator. S5: Randomly take out 70% of the data from the data set as the training set, and bring them into the three machine learning models for model training, and obtain the DOS attack detection model respectively; S6: Detection stage: The remaining 30% of the data set is used as a test set and brought into the DOS attack detection model for detection. According to the detection results, it is determined whether an attack has occurred, and the detection accuracy rate DR, false alarm rate FAP and missed alarm rate FRR indicators are obtained.

2. The DOS attack detection method based on spectral physical characteristics in the optoelectronic fusion network according to claim 1 is characterized in that: In S1, the modulation and demodulation point is the edge modem at the server end, and a spectrum analyzer is placed in front of the edge modem to collect spectrum data. The n sets of window data sets V collected are V = {V1, V2, ..., V n }, the collected data of each group has W = {W1, W2, …, W2}-dimensional attribute features.

3. The DOS attack detection method based on spectral physical characteristics in the optoelectronic fusion network according to claim 2 is characterized in that: In S2, the dimensional characteristics of each group of collected data are inconsistent, and the data is preprocessed; the spectrum information is represented by the energy information corresponding to each frequency point, and the number of frequency points is first determined, that is, the dimensional characteristics of the data are determined; Then the spectral information of the determined frequency points will be collected. If the data of a certain window does not have the spectral information of the required frequency point, the spectral information of the surrounding frequencies will be added and averaged, and the obtained data is the required spectral information.

4. The DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network according to claim 3 is characterized in that: In S3, the spectral data of each group is normalized: Normalizing the data is beneficial for the initialization of the machine learning algorithm, adjusting the learning rate value, and speeding up the search for the optimal solution.

5. The DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network according to claim 4 is characterized in that: In S4, XGBoost is a decision tree based on an optimized gradient boosting (GBDT), which reduces the fitting residual by finding a suitable function; BP neural network is a fully connected multi-layer feedforward neural network that uses the error back propagation algorithm; it contains an input layer, a hidden layer, and an output layer, where the input layer is responsible for receiving input data, the hidden layer processes the input data, and the output layer outputs the final result; the training of BP neural network is also a supervised learning process, which is divided into two stages: forward propagation of information and backward propagation of error.

6. The DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network according to claim 5 is characterized in that: In S5, the data will be labeled with two labels: attack data and normal data. Before obtaining the training set, the data set will be disrupted to make the data set disordered, thereby enhancing the training effect of the model.

7. The DOS attack detection method based on spectral physical characteristics in an optoelectronic fusion network according to claim 1 is characterized in that: In S6, the calculation formulas for the detection accuracy rate DR, the false alarm rate FAP and the missed alarm rate FRR are respectively: TP represents the number of positive samples predicted as positive samples, FP represents the number of negative samples predicted as positive samples, FN represents the number of positive samples predicted as negative samples, TN represents the number of negative samples predicted as negative samples, N is the total number of samples in the sample data set, normal data is positive, and DOS attack data is negative; when the detection model detects window data as attack data for multiple consecutive times, it will be judged as attacked, otherwise it will be judged as normal data.

Images