Attack traffic detection method, device, equipment and storage medium

Abstract

Embodiments of the present application provide a kind of attack flow detection method, device, equipment and storage medium, the method comprises: obtaining the first telemetry data packet of multiple switches;First telemetry flow feature is extracted from the first telemetry data packet;Determine graph structure feature according to first telemetry flow feature;Extract the adjacent feature in graph structure feature;Adjacent feature and first telemetry flow feature are input into the flow graph structure detection model pre-trained, and output detection loss value;According to detection loss value and target loss value determine detection result;Wherein, target loss value is the loss value obtained by flow graph structure detection model in training stage;Wherein, detection result includes first telemetry flow feature is attack flow or non-attack flow.The attack flow detection accuracy of the present application embodiment can be improved by the way that the telemetry flow feature is detected by the flow graph structure detection model pre-trained.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for detecting attack traffic. Background Technology

[0002] In recent years, Distributed Denial of Service (DDoS) attacks have become an extremely serious security threat in cybersecurity, posing a significant challenge to the information and property security of governments, enterprises, and even individuals, and thus have received widespread attention. The purpose of a DDoS attack is to send a large number of invalid requests to a target website or server, preventing it from responding properly to requests from legitimate users. DDoS attacks have several types, which can be broadly categorized into three types: bandwidth-consuming, resource-consuming, and vulnerability-triggered. Bandwidth-consuming attacks include flood attacks and amplification attacks. The former sends a large amount of traffic to a compromised victim system through botnets, while the latter maliciously amplifies traffic to limit the victim system's bandwidth. Resource-consuming attacks consume a large amount of network and device resources through legitimate or forged requests to paralyze the network and system. Vulnerability-triggered attacks cause system crashes and service paralysis by triggering vulnerabilities.

[0003] Existing DDoS detection methods primarily target known DDoS attacks. However, new types of DDoS attacks, designed by attackers, are constantly emerging. These new types of DDoS attacks typically employ novel technologies or methods, making them difficult to detect and prevent using traditional defenses. Furthermore, these attacks are highly stealthy, making them difficult to discover and track. Therefore, traditional supervised learning methods are not entirely suitable for detecting unknown DDoS attack traffic. Additionally, existing technologies, after detecting DDoS attack traffic, do not process it, lacking a complete and effective solution for addressing DDoS attack traffic. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and storage medium for detecting attack traffic, which can improve the accuracy of attack traffic detection.

[0005] In a first aspect, embodiments of this disclosure provide a method for detecting attack traffic, comprising: acquiring first telemetry data packets from multiple switches; extracting first telemetry traffic features from the first telemetry data packets; determining graph structure features based on the first telemetry traffic features; extracting adjacency features from the graph structure features; inputting the adjacency features and the first telemetry traffic features into a pre-trained traffic graph structure detection model, and outputting a detection loss value; determining a detection result based on the detection loss value and a target loss value; wherein the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; wherein the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic.

[0006] Secondly, embodiments of this disclosure also provide an attack traffic detection device, comprising: a telemetry data packet acquisition module for acquiring first telemetry data packets from multiple switches; a telemetry traffic feature extraction module for extracting first telemetry traffic features from the first telemetry data packets; a graph structure feature determination module for determining graph structure features based on the first telemetry traffic features; an adjacency feature extraction module for extracting adjacency features from the graph structure features; a detection loss value output module for inputting the adjacency features and the first telemetry traffic features into a pre-trained traffic graph structure detection model and outputting a detection loss value; and a detection result determination module for determining a detection result based on the detection loss value and a target loss value; wherein the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; and wherein the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic.

[0007] Thirdly, embodiments of this disclosure also provide an electronic device, the electronic device comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the attack traffic detection method as described in embodiments of this disclosure.

[0008] Fourthly, embodiments of this disclosure also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the attack traffic detection method as described in embodiments of this disclosure.

[0009] The technical solution of this invention involves acquiring first telemetry data packets from multiple switches; extracting first telemetry traffic features from the first telemetry data packets; determining graph structure features based on the first telemetry traffic features; extracting adjacency features from the graph structure features; inputting the adjacency features and the first telemetry traffic features into a pre-trained traffic graph structure detection model, and outputting a detection loss value; determining a detection result based on the detection loss value and a target loss value; wherein the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; and wherein the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic. This embodiment of the invention improves the accuracy of attack traffic detection by using a pre-trained traffic graph structure detection model to detect attack traffic based on telemetry traffic features. Attached Figure Description

[0010] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0011] Figure 1 This is a schematic diagram of the attack traffic detection method provided in an embodiment of the present invention;

[0012] Figure 2 This invention provides a schematic diagram of a flow graph structure detection model.

[0013] Figure 3 A schematic diagram illustrating the effect of the attack traffic detection method provided in this embodiment of the invention;

[0014] Figure 4 This is a schematic diagram of an attack traffic detection device provided in an embodiment of the present invention;

[0015] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0016] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0017] It should be understood that the various steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect. The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". It should be noted that the concepts of "first," "second," etc., mentioned in this disclosure are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies. It should be noted that the modifications "a" and "a plurality" mentioned in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless explicitly indicated otherwise in the context, they should be understood as "one or more". It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of data) shall comply with the requirements of applicable laws, regulations, and relevant provisions.

[0018] Figure 1 This is a schematic flowchart of an attack traffic detection method provided in an embodiment of the present invention. This embodiment is applicable to processing DDoS attack traffic in a wide area network. The method can be executed by an attack traffic detection device, which can be implemented in software and / or hardware, optionally through an electronic device, such as a mobile terminal, PC, or server. Figure 1 As shown, the method includes:

[0019] S110: Obtain the first telemetry data packets from multiple switches.

[0020] In this context, the switch can be a programmable switch, and the telemetry data packet can be understood as a data packet carrying telemetry instructions that is forwarded and processed by the programmable switch in an in-band network telemetry (INT) architecture. In practical applications, telemetry data packets can be generated based on INT technology. Specifically, the first telemetry data packet from the switch is obtained through the southbound application programming interface (API) via the SDN (Software-Defined Networking Controller) controller.

[0021] S120. Extract the first telemetry flow characteristics from the first telemetry data packet.

[0022] The first telemetry traffic feature can include attack traffic features and non-attack traffic features. In this embodiment, the SDN controller can extract telemetry information (switch status information) from the first telemetry data packet and sample from the telemetry information according to a set sampling strategy to obtain the first telemetry traffic feature.

[0023] Optionally, the method for extracting the first telemetry traffic feature from the first telemetry data packet may be: extracting the first telemetry information of the switch from the first telemetry data packet; sampling the telemetry information according to a set sampling frequency to obtain the second telemetry information; and extracting the first telemetry traffic feature from the second telemetry information.

[0024] It should be noted that in practical applications, network traffic is massive, and using INT on large-scale networks presents two problems: firstly, the CPU and memory costs of the SDN controller are high; secondly, INT telemetry packets require additional bandwidth. To alleviate these problems, a sampling strategy is executed after the first telemetry information is extracted. By deploying INT on all switches to obtain the state of the entire network, each telemetry packet will have its metadata forwarding header written according to the INT instructions in the telemetry packet. Since the state of the switches is obtained through telemetry packets, the time interval between adjacent telemetry packets passing through the same switch is very small. Therefore, the states of the same switch obtained by adjacent telemetry packets are very similar, which means that some of the obtained data is redundant, causing unnecessary consumption of network bandwidth and computing resources. To avoid redundancy, a trade-off is made between state granularity and bandwidth consumption. A sampling frequency can be set to sample the first telemetry information, as follows:

[0025] Among them, R INT The number of sampled data packets, i.e. η represents the coefficient for adjusting the sampling interval, N″ represents the total number of data packets, and ΔT represents the specified time period. This indicates the total number of data packets collected within a specified time period (e.g., a unit of time). After obtaining the number of sampled data packets, it can be used to determine the number of packets collected based on R. INT Determine the sampling frequency, and sample the first telemetry information according to the set sampling frequency or by random sampling to obtain the second telemetry information. Extract the first telemetry flow characteristics from the second telemetry information and convert them into a three-dimensional vector, denoted as X∈R. f×|V|×t Where f is the number of features for each node, V is the number of nodes, and t is the number of time slices. A node is a switch node.

[0026] For example, converting the first telemetry traffic feature into a three-dimensional vector can be done as follows: Assuming a simple network topology consisting of 4 switches, firstly, collect metrics such as packet counts and latency measurements for each switch in the network at different time intervals. Assume this information is collected every 200 milliseconds, for a total of 1 minute, resulting in 5 time intervals. Represent the data as a feature vector, and then represent the collected data as a feature vector for each switch in each time interval. For example, the feature vector of switch S1 in time interval 1 could be [100, 5, 10], where the first element represents the number of transmitted packets, the second element represents the latency, and the third element represents some other metric features. Finally, a three-dimensional vector F is constructed, where this three-dimensional vector F is generated in time interval 1. The dimension of this vector is f × |V| × t, where f is the number of features collected by each switch (in the example, f = 3), |V| is the total number of switches (in the example, |V| = 4), and t is the number of time intervals, i.e., the number of time slices (in the example, t = 5). In this embodiment, the process of obtaining the three-dimensional vector X can also be achieved as follows: After obtaining the first telemetry information, set the time slice size T. stice (For example, 200ms) Calculate the average value of the state information of each switch within each time slice, thereby obtaining the feature vector D of all individual switches within a single time slice, and then obtaining the final three-dimensional feature vector X. This can reduce the operating cost of the SDN controller's central processing unit and memory, and reduce additional bandwidth consumption.

[0027] The first telemetry traffic characteristic (i.e., switch status information) includes, but is not limited to, the following characteristics: queuing delay, buffer delay, link delay, input / output buffer depth, entropy, unidirectional and bidirectional flow traffic, etc. Queuing Delay: Queuing delay is the amount of time a data packet waits in a queue before it can be transmitted through the network. It is an indicator of network performance and is affected by factors such as network congestion and the workload of network devices. The queuing delay of a data packet is calculated as the difference between the time it is about to be transmitted on the network and the time it arrives in the queue. This can be expressed as: Queuing Delay = Time about to be transmitted on the network - Time arriving in the queue. Buffer Delay: Buffer delay is the amount of time a data packet waits in a buffer before it is transmitted through the network. Buffers are used in switches and other network devices to temporarily store data packets when the device is busy or the network is congested. The buffer delay of a data packet can be calculated as the difference between the time it is about to be transmitted on the network and the time it arrives in the buffer. This can be expressed as: Buffer Delay = Time about to be transmitted on the network - Time arriving in the buffer. Link Delay: Link delay is the time it takes for a data packet to be transmitted through a specific link in the network. Link latency is affected by various factors, including the distance between the devices at both ends of the link, the link bandwidth, and the type of media used to transmit data packets. Link latency can be calculated as the difference between the time it takes for a data packet to be received at the other end and the time it takes to travel through the link. This can be expressed as: Link Latency = Receive Time at Another End - Link Transmission Time. Input / Output Buffer Depth: Input / output buffer depth is the current depth or occupancy of the input and output buffers on a switch or other network device. Buffer depth provides insight into the current workload and number of devices. Higher buffer depths indicate network congestion or other issues affecting network performance. Input or output buffer depth can be calculated as the difference between the maximum capacity of the buffer and its current occupied capacity. This can be expressed as: Input / Output Buffer Depth = Maximum Capacity - Current Occupancy.

[0028] The entropy of the source IP address can be calculated using the following formula:

[0029] Where N′ is the number of distinct source IP addresses, and p(i) is the probability of the i-th source IP address appearing. A higher entropy value indicates a more random source IP address. Since DDoS attacks typically involve a large number of packets with the same source IP address, calculating the entropy value of the source IP address can detect whether a DDoS attack has occurred. A lower entropy value indicates that the IP address is the one initiating the DDoS attack.

[0030] One-way and two-way traffic: By analyzing one-way and two-way traffic flows through a switch, we can gain insights into the nature of traffic passing through the switch and use it as part of a feature vector to distinguish between DDoS attack traffic and normal traffic. The number of one-way flows can be calculated as the number of unique source IP address and destination IP address pairs that transmit traffic in a single direction, while the number of two-way flows can be calculated as the number of unique source IP address and destination IP address pairs that transmit traffic in both directions.

[0031] S130. Determine the graph structure characteristics based on the first telemetry flow characteristics.

[0032] In this embodiment, node features and edge features of the switch can also be extracted from telemetry information, thereby determining graph structure features based on node features, edge features, and the first telemetry traffic features. Optionally, the graph structure features can be determined based on the first telemetry traffic features by: extracting node features and edge features from the second telemetry information; and determining the graph structure features based on the first telemetry traffic features, node features, and edge features. Specifically, before the traffic graph structure detection model learns, graph structure data, i.e., graph structure features, needs to be defined and denoted as graph G = (V, E, X, A), where node feature V changes over time, and V is a programmable switch. Edge feature E is a set of edges of V, i.e., the connections between programmable switches. X is a three-dimensional vector of the first telemetry traffic features, and A is the adjacency vector of graph G.

[0033] S140. Extract the adjacency features from the graph structure features.

[0034] Among them, the adjacency feature can be represented by the adjacency vector A.

[0035] S150. Input the adjacency features and the first telemetry flow features into the pre-trained flow graph structure detection model and output the detection loss value.

[0036] The traffic graph structure detection model can be a graph variational autoencoder (GUE) model with adversarial properties, comprising a GUE module and an adversarial learning module. The model includes an encoder, a decoder, and a discriminator, with the encoder connected to both the decoder and discriminator. The GUE module can consist of an encoder and a decoder, while the adversarial learning module can consist of an encoder and a discriminator. The generator in the adversarial learning module generates sample data, while the discriminator distinguishes between the generated data and real data. In this model, the generator in the adversarial learning module is shared with the encoder in the GUE module. In the adversarial learning module, the generator generates fake data, and the discriminator uses this data to distinguish between real and fake data. During continuous training, the generator continuously learns to generate more realistic fake data, while the discriminator continuously improves its judgment ability, reaching a balance point. Ultimately, the generator can generate data that is very similar to real data. Specifically, the adjacency vector A and the three-dimensional vector X corresponding to the first telemetry flow feature can be input into the pre-trained flow graph structure detection model to output the detection loss value.

[0037] S160. Determine the detection result based on the detection loss value and the target loss value.

[0038] The target loss value is the loss value obtained by the traffic graph structure detection model during the training phase. The detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic. Specifically, if the detection loss value is less than or equal to the target loss value, the detection result is non-attack traffic. If the detection loss value is greater than the target loss value, the detection result is attack traffic. Optionally, inputting the adjacency feature and the first telemetry traffic feature into the pre-trained traffic graph structure detection model and outputting the detection loss value includes: inputting the adjacency feature and the first telemetry traffic feature into the encoder to obtain latent features; inputting the latent features into the decoder and discriminator respectively to obtain a first loss value and a second loss value, where the first loss value and the second loss value are the detection loss value. Optionally, determining the detection result based on the detection loss value and the target loss value includes: if the sum of the first loss value and the second loss value is less than or equal to the target loss value, the output detection result is non-attack traffic; if the sum of the first loss value and the second loss value is greater than the target loss value, the output detection result is attack traffic.

[0039] It should be noted that the first loss value can be determined based on the loss function of the graph variational autoencoder module, and the second loss value can be determined based on the loss function of the adversarial learning module. In this embodiment, by using both the first and second loss values ​​for judgment, the detection accuracy of the traffic graph structure detection model can be improved.

[0040] Optionally, the adjacency features and the first telemetry flow features are input into the encoder to obtain latent features. This can be achieved by: inputting the adjacency features and the first telemetry flow features into a first graph convolutional network to obtain first graph convolutional features; inputting the adjacency features and the first telemetry flow features into a second graph convolutional network to obtain second graph convolutional features; and determining latent features based on the first and second graph convolutional features. Optionally, the decoder includes at least two cascaded graph convolutional networks; the discriminator includes at least two cascaded perceptron layers. The encoder includes both a first graph convolutional network and a second graph convolutional network.

[0041] For example, Figure 2 This is a schematic diagram of a flow graph structure detection model provided in an embodiment of the present invention. For example... Figure 2 As shown, the encoder uses two GCNs (Graph Convolutional Networks) as encoders, and the formula for the encoder GCN is as follows:

[0042]

[0043] Where X represents the feature vector of the graph convolutional network, i.e., the three-dimensional vector of the first telemetry flow feature, and A represents the adjacency feature, i.e., the adjacency vector of graph G. D is the degree vector. A degree vector is a vector representing the degree of each node (i.e., the number of edges connecting that node) in an undirected or directed graph. ReLU() represents the Rectified Linear Unit (ReLU) function, which maps input values ​​less than 0 to 0 and leaves input values ​​greater than or equal to 0 unchanged. W0 and W1 represent the weight vectors to be learned; they are learnable parameters. During training, the representational power of the GCN is adjusted by continuously updating the values ​​of W0 and W1.

[0044] The adjacency vector A and the three-dimensional vector X corresponding to the first telemetry flow feature are input into the first graph convolutional network to obtain the first graph convolutional feature GCN. μ (X,A) is used to input the adjacency vector A and the three-dimensional vector X corresponding to the first telemetry flow feature into the second graph convolutional network to obtain the second graph convolutional feature GCN. σ For graph convolutional networks (X,A), the latent features z can be obtained based on the convolutional features of the first and second graphs. In graph convolutional networks, the latent features z typically refer to the vector representation obtained after embedding each node of the graph.

[0045] The encoder's function is to encode the three-dimensional vector X corresponding to the first telemetry flow feature into a latent feature z. This process is denoted as q(z|G), which represents the posterior probability distribution of the latent feature z given a graph G. The specific formula is as follows:

[0046] q(z|G)=Ν(μ(G),σ 2 (G))

[0047] Where μ(G) and σ 2 (G) represent the convolutional features GCN of the first graph. μ The mean of (X,A) and the second graph convolutional feature GCN σ The variance of (X,A) is given by N(), which represents a Gaussian distribution. Finally, the latent feature z is a random variable obtained by sampling from the posterior probability distribution q(z|G), representing the latent representation of the input data in the latent space.

[0048] The decoder in the graph variational autoencoder module is a graph generator whose purpose is to reconstruct the graph structure from latent features z. In the graph variational autoencoder module, the decoder's input is the latent features z output by the encoder. The decoder's task is to reconstruct a graph G' from the latent features z, denoted as p(G'|z), which represents the probability distribution for generating a graph G' given the latent features z. The probability distribution conditioned on the latent features is represented by the following function:

[0049]

[0050] Where p(g) i″ |z) represents the i″-th node g in the generated graph G'. i″ The probability p(G′|z) is the product of the probability distributions of all nodes in the graph.

[0051] The graph variational autoencoder module describes the reconstructed adjacency vector through a variational lower bound of non-attack traffic. Figure 2 The difference between A′ in the vector and the original adjacency vector A is considered. The smaller the value of the variational lower bound, the more likely it is non-attack traffic (normal traffic), and vice versa.

[0052] The loss function of the graph variational autoencoder module is evaluated by using the variational lower bound. Since the training data all come from non-attack traffic (normal traffic), the smaller the value of the variational lower bound obtained after calculation, the more likely it is to be normal traffic, and vice versa. The specific function is expressed as follows.

[0053] L AE =E q(z|G) [logp(G′|z)]-KL(q(z|G)||p(z))

[0054] LAE is the loss function of the graph variational autoencoder module, where G represents the graph structure features and z represents the latent features; q(z|G) is the conditional distribution, representing the posterior probability distribution of the latent feature z given the graph G; p(G′|z) is the generative model, representing the distribution of the generated graph G′ given the latent feature z; p(z) is the prior distribution, i.e., the distribution of the latent feature z; KL(q(z|G)||p(z)) is the KL divergence, used to evaluate the difference between the posterior probability distribution q(z|G) and the distribution p(z) of the latent feature z. E q(z|G) [·] represents the expectation of q(z|G) given a graph G.

[0055] In the training process of a traffic graph structure detection model, an adversarial training mechanism can be introduced. This mechanism involves incorporating an adversarial learning module during model training, consisting of a generator and a discriminator. The generator is the encoder part of the graph variational encoder module, while the discriminator, implemented using a multi-layer perceptron (MLP), distinguishes between real and generated data. Its input is the latent feature z from the output of the graph variational autoencoder. In each iteration, the generator produces a batch of data samples, and the discriminator classifies these samples. The generator aims to generate samples that increasingly resemble real data, while the discriminator aims to accurately distinguish between real and generated data. This adversarial training mechanism allows the generator to gradually learn more regularized representations, improving the model's generalization ability. It's important to note that adversarial training is a training method in machine learning designed to improve the model's robustness against adversarial attacks. An adversarial attack is a type of attack against machine learning models that, by adding small perturbations to the input, can deceive the model into producing incorrect outputs. The purpose of adversarial training mechanisms is to enhance the robustness of the model, enabling it to classify correctly even when the input contains a certain degree of perturbation.

[0056] L AD This represents the loss function of the adversarial learning module, and the function is expressed as follows:

[0057]

[0058] Among them, E z～p(z) E represents the expected value of the latent eigenvector sampled from the prior distribution p(z). z～p(z)Let represent the expected value of the latent feature vector sampled from the posterior distribution q(z|G) of the graph variational autoencoder, and Z represent the vector randomly sampled from the prior distribution p(z). G(Z) represents the fake sample generated by the generator G with input Z. D(Z) represents the discrimination result of the discriminator D on the real sample with input Z (i.e., the probability of a real sample). D(G(Z)) represents the discrimination result of the discriminator D on the generated sample with input G(Z) (i.e., the probability of a fake sample). The comprehensive loss function L is composed of the loss function of the graph variational autoencoder module and the loss function of the adversarial learning module, and is specifically expressed as: L = L AE +L AD

[0059] In the testing phase, a smaller value of the comprehensive loss function indicates a higher likelihood of non-attack traffic, and vice versa. The traffic graph structure detection model is trained so that edges in the neighborhood of information nodes in the complete set can be aggregated and computed. The encoder of the graph variational autoencoder module uses two parallel GCNs to compute the mean and variance of the distribution. Both GCNs use 128 hidden units and the ReLU function as the activation function for the hidden layers. The decoder of the graph variational autoencoder module consists of two cascaded GCNs, both using 128 hidden units, with Sigmoid as the activation function for the decoder output layer. For regularization, a dropout mechanism with a rate of 0.2 is used between all GCN layers. The loss function L of the graph variational autoencoder is... AE The Adam optimizer is used during the backward gradient descent propagation phase, with a learning rate of 0.01. The discriminator in the adversarial learning module is constructed from five fully connected perceptron MLP layers, each using 128 hidden units and ReLU as the activation function. Dropout at a rate of 0.3 is used between all perceptron layers. The loss function L for adversarial learning is... AD The Adam optimizer is used in the backward selection gradient descent propagation phase, with a learning rate of 0.001.

[0060] Optionally, for training the traffic graph structure detection model, the training method can be as follows: acquire second telemetry data packets from multiple switches containing non-attack traffic; extract second telemetry traffic features from the second telemetry data packets, and divide the second telemetry traffic features into a training sample feature set and a test sample feature set; determine training graph structure features based on the second telemetry traffic features in the training sample feature set; extract training adjacency features from the training graph structure features; determine test graph structure features based on the second telemetry traffic features in the test sample feature set; extract test adjacency features from the test graph structure features; and combine the training adjacency features with the training sample feature set. The second telemetry flow feature is input into the flow graph structure detection model to obtain a training loss value; the training parameters of the flow graph structure detection model are updated according to the training loss value to train the flow graph structure detection model; if the training loss value reaches the convergence condition, the training of the flow graph structure detection model is stopped to obtain a pre-trained flow graph structure detection model; the training loss value that reaches the convergence condition is used as the target loss value; the test adjacency feature and the second telemetry flow feature in the test sample feature set are applied to the pre-trained flow graph structure detection model to obtain a test loss value; the test detection result is determined based on the test loss value and the target loss value.

[0061] In this embodiment, during the training phase of the traffic graph structure detection model, the dataset consists of second telemetry data packets from multiple switches representing normal traffic (non-attack traffic). Second telemetry traffic features are extracted from these data packets. These features can be divided into a training sample feature set and a test sample feature set in an 8:2 ratio. Training graph structure features are determined based on the second telemetry traffic features in the training sample feature set. Training adjacency features are extracted from these training graph structure features. Test graph structure features are determined based on the second telemetry traffic features in the test sample feature set. Test adjacency features are extracted from these test graph structure features. The training adjacency features and the second telemetry traffic features from the training sample feature set are input into the traffic graph structure detection model to obtain a training loss value. The training parameters of the traffic graph structure detection model are updated based on the training loss value to train the model. If the training loss value reaches the convergence condition, the training of the traffic graph structure detection model is stopped, resulting in a pre-trained traffic graph structure detection model. The training loss value that reaches the convergence condition is used as the target loss value. The training parameters can be W0 and W1 in the encoder. The convergence condition can be that the training loss value reaches a minimum or a local minimum. The minimum or local minimum of the training loss value can be obtained using gradient descent and the Adam optimizer. The test adjacency features and the second telemetry traffic features in the test sample feature set are applied to the pre-trained traffic graph structure detection model to obtain a test loss value. If the test loss value is less than or equal to the target loss value, the output test detection result is non-attack traffic; if the test loss value is greater than the target loss value, the output test detection result is attack traffic.

[0062] It should be noted that if the traffic graph structure detection model is a graph variational autoencoder model with adversarial properties, then during the training phase, the decoder of the graph variational autoencoder module outputs a first training loss value, and the discriminator in the adversarial learning module outputs a second training loss value. The sum of the first and second training losses is used as the training loss value. During the testing phase, the decoder of the graph variational autoencoder module outputs a first test loss value, and the discriminator in the adversarial learning module outputs a second test loss value. The sum of the first and second test losses is used as the test loss value. It should also be noted that if the test accuracy of the traffic graph structure detection model is less than the set target accuracy during the testing phase, relevant adjustments are made, and the traffic graph structure detection model is retrained. For example, relevant adjustments may include adjusting the learning rate, optimizing weights W0 and W1, increasing the number of training epochs, adjusting the gradient descent algorithm, etc., but this embodiment does not limit these adjustments.

[0063] In this embodiment, the traffic graph structure detection model can be a graph variational autoencoder model with adversarial properties. This is an effective solution for perceiving unknown DDoS attack traffic. This model can be applied to anomaly detection and cluster analysis. The adversarial graph autoencoder model can also be used for anomaly detection tasks, such as detecting abnormal nodes or edges in graph data. Its basic idea is to use the encoder and decoder to reconstruct the normal graph structure, while there will be a large reconstruction error for abnormal graph structures. The discriminator can provide additional adversarial loss, making it easier to distinguish between normal and abnormal samples in the latent features. DDoS attack traffic is often caused by a large number of malicious nodes sending a large number of requests in a short period of time to paralyze the target system. The adversarial graph autoencoder can preserve the complex relationships between nodes in the graph, thus enabling better detection of DDoS attack traffic. Furthermore, because the adversarial graph autoencoder model introduces an adversarial training mechanism, adversarial training enhances the model's robustness, making it better suited to complex data and uncertainties in real-world scenarios. This makes it more suitable for detecting unknown DDoS attack traffic, improving accuracy. Therefore, the adversarial graph autoencoder model can more robustly identify attack traffic when detecting unknown types of DDoS attack traffic. Additionally, the adversarial graph autoencoder model avoids overfitting and exhibits better generalization ability.

[0064] The technical solution of this disclosure involves acquiring first telemetry data packets from multiple switches; extracting first telemetry traffic features from the first telemetry data packets; determining graph structure features based on the first telemetry traffic features; extracting adjacency features from the graph structure features; inputting the adjacency features and the first telemetry traffic features into a pre-trained traffic graph structure detection model, and outputting a detection loss value; determining a detection result based on the detection loss value and a target loss value; wherein the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; and wherein the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic. This disclosure improves the accuracy of attack traffic detection by using a traffic graph structure detection model to detect attack traffic based on telemetry traffic features.

[0065] Optionally, after determining the detection result based on the detection loss value and the target loss value, the method further includes: if the detection result is attack traffic, determining the source switch based on the graph structure features corresponding to the attack traffic; and discarding the data packets of the source switch; wherein the data packets include the first telemetry data packets. In this embodiment, the source switch is determined by the graph structure features corresponding to the attack traffic, so that the data packets of the source switch can be processed, thereby discarding data packets containing attack traffic at the source. In this embodiment, after determining the source switch, all data packets of the source switch can be discarded, or the data packets of the source switch can be discarded according to a set packet loss rate.

[0066] Optionally, determining the source switch based on the graph structure features corresponding to the attack traffic can be achieved by: determining the attacking switch and its associated edges based on the graph structure features; determining the attack path based on the attacking switch and associated edges; and determining the source switch based on the attack path. It should be noted that since the graph structure features contain node information, where V represents the programmable switch along the path, when the DDoS attack traffic is identified, it is possible to determine both the attacking switch along the attack traffic path (where the attacking switch contains the attack flow) and the path the attack flow traverses in the network. This path can be represented as p. i′,j′ =∑(v i′ ,r i′ )->(v j′ ,r j′ ),wherev i′ ,v j′ ∈V attack V attack It is the set of attack switches through which the attack traffic flows, p i′,j′ It is the attack path, r i′ This represents the proportion of attack traffic to the total traffic in the i′-th attacking switch. j′ This represents the proportion of attack traffic to total traffic in the j′-th attacking switch. When attack traffic simultaneously passes through attacking switch v... i′ and attack switch v j′ And if the forwarding rules are met, then it can be considered that (v i′ v j′ () is a hop in the attack path.

[0067] In this embodiment, the attacking switch is determined based on the graph structure features (such as edge features and node features) corresponding to the attack traffic, as well as the associated edges between the attacking switch and other switches. If there are multiple attacking switches, the attack path can be determined based on the multiple attacking switches and the associated edges corresponding to the multiple attacking switches, thereby determining the source switch of the attack traffic based on the attack path.

[0068] Optionally, the method for discarding data packets from the source switch can be as follows: Obtain the source IP address and / or destination IP address from the data packets of the source switch; if the source IP address and / or destination IP address are in a predefined whitelist, the data packet is identified as a reserved data packet; wherein, the predefined whitelist includes multiple IP addresses; and the reserved data packets are discarded according to a predefined packet loss rate. In this embodiment, the source IP address and / or destination IP address from the data packets of the source switch can be obtained; a pre-established whitelist can be obtained, and the source IP address and destination IP address are simultaneously matched against the IP addresses in the whitelist. If both the source IP address and destination IP address are in the whitelist, the data packet is identified as a reserved data packet; if either the source IP address or destination IP address, or neither the source IP address nor the destination IP address, is not in the whitelist, the data packet is identified as a discarded data packet and is discarded; after obtaining the reserved data packets, they are discarded according to a predefined packet loss rate to ensure the operation of normal services. The predefined whitelist includes multiple IP addresses; the IP addresses in the whitelist can be the IP addresses of commonly used service hosts, i.e., the IP addresses corresponding to normal traffic. It's important to note that to mitigate attack traffic, it's advisable to block as many attack flows as possible while minimizing the dropping of legitimate traffic. By identifying the attack path 'p,' more targeted packet loss strategies can be implemented to mitigate the attack. To reduce the chance of mistakenly dropping legitimate packets during packet loss, whitelists can be established and deployed on all switches based on prior knowledge. Specifically, the IP addresses of frequently used business hosts are added to the whitelist. The whitelist is then distributed to all switches or source switches by the SDN controller. If both the source and destination IP addresses of a packet match IP addresses in the whitelist, the packet is forwarded by the switch; otherwise, it is dropped according to the rule. However, simply using a whitelist to determine which packets to retain cannot protect against attackers launching DDoS attacks using IP addresses in the whitelist. If the IP addresses in the whitelist contain both legitimate business traffic and DDoS attack traffic, dropping all of them could completely paralyze legitimate business operations. To reduce the negative impact on normal business operations and avoid dropping all legitimate traffic, retained packets can be dropped according to a set packet loss rate. This controls the packet loss rate of the source switch, mitigating the attack traffic and ensuring that legitimate business requests are not affected.

[0069] Optionally, the method for determining the packet loss rate is as follows: determine a first parameter based on the packet retention rate of the source switch; determine a second parameter based on the entropy of the source IP addresses of the packets retained by the source switch; perform a weighted sum of the first and second parameters to obtain a third parameter; and determine the set packet loss rate based on the third parameter and a set upper limit value. In this embodiment, the first parameter (M) can be based on the packet retention rate of the source switch, i.e., the number of packets passing through the source switch per unit time; the second parameter (H) can be based on the entropy of the source IP addresses of the packets retained by the source switch; the third parameter (w) can be obtained by weighted sum of the first and second parameters; and the set packet loss rate can be determined based on the third parameter and a set upper limit value.

[0070] In this embodiment, the packet loss rate is set considering the characteristics of DDoS attack traffic, namely the changes in the entropy H of the source IP address of the data packets and the number of data packets M passing through the source switch per unit time. The formula for setting the packet loss rate is: r edge =k(ΔH,ΔM)

[0071] Where, r edge This represents the first packet loss rate of the source switch, where k is a function, ΔH is the change in entropy of the source IP address of the data packets, and ΔM is the change in the number of data packets passing through the source switch per unit time. During a DDoS attack, the H and M values ​​collected by some switches will increase rapidly. H and M are the entropy of the source IP address of the data packets per unit time and the number of data packets passing through the source switch per unit time, respectively. A rapid increase in H and M indicates that the switch is under attack. Therefore, the first packet loss rate r of this source switch... edge It is expected that the rate will increase rapidly to mitigate the attack. However, an excessively high drop rate will impact normal business requests; therefore, a capped value less than 1 is set for the initial drop rate. The specific formula for the function k is as follows:

[0072]

[0073] Where w is the weighted sum of ΔH and ΔM, w>0, and l is the upper limit of the packet loss rate, therefore r edge It falls within the interval [l-0.5, l), meaning k(w) is in [l-0.5, l), to ensure that normal requests are not affected.

[0074] For example, Figure 3 This is a schematic diagram illustrating the effect of the attack traffic detection method provided in an embodiment of the present invention. Figure 3As shown, in the in-band network telemetry (INT) architecture, the SDN controller can obtain telemetry data packets from switches via the southbound API. The switch directly connected to the attacking host can be called the source switch, and the switch directly connected to the target client host can be called the destination switch. After obtaining the telemetry data packets, the SDN controller extracts features from them to obtain telemetry traffic features, and determines graph structure features based on these features. The adjacency features and telemetry traffic features are input into the traffic graph structure detection model, which outputs a detection loss value. The detection result is determined based on the detection loss value and the target loss value. If the detection result is attack traffic, the attacking switch and its associated edges are determined based on the graph structure features corresponding to the attack traffic. The attack path is determined based on the attacking switch and the associated edges. The source switch is then determined based on the attack path. After identifying the source switch, mitigation strategies are used to drop data packets from the source switch. These mitigation strategies include whitelisting and setting a packet loss rate.

[0075] Figure 4 This is a schematic diagram of an attack traffic detection device provided in an embodiment of the present disclosure, as shown below. Figure 4 As shown, the device includes: a telemetry data packet acquisition module 410, a telemetry traffic feature extraction module 420, a graph structure feature determination module 430, an adjacency feature extraction module 440, a detection loss value output module 450, and a detection result determination module 460; the telemetry data packet acquisition module 410 is used to acquire first telemetry data packets from multiple switches; the telemetry traffic feature extraction module 420 is used to extract first telemetry traffic features from the first telemetry data packets; the graph structure feature determination module 430 is used to determine graph structure features based on the first telemetry traffic features; the adjacency feature extraction module 440 is used to extract adjacency features from the graph structure features; the detection loss value output module 450 is used to input the adjacency features and the first telemetry traffic features into a pre-trained traffic graph structure detection model and output a detection loss value; the detection result determination module 460 is used to determine the detection result based on the detection loss value and a target loss value; wherein, the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; wherein, the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic.

[0076] The technical solution of this disclosure includes: acquiring first telemetry data packets from multiple switches via a telemetry data packet acquisition module; extracting first telemetry traffic features from the first telemetry data packets via a telemetry traffic feature extraction module; determining graph structure features based on the first telemetry traffic features via a graph structure feature determination module; extracting adjacency features from the graph structure features via an adjacency feature extraction module; inputting the adjacency features and the first telemetry traffic features into a pre-trained traffic graph structure detection model via a detection loss value output module, and outputting a detection loss value; and determining a detection result based on the detection loss value and a target loss value via a detection result determination module. The target loss value is the loss value obtained by the traffic graph structure detection model during the training phase. The detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic. This disclosure improves the accuracy of attack traffic detection by using a traffic graph structure detection model to detect attack traffic based on telemetry traffic features.

[0077] Optionally, the above apparatus further includes a source switch determination module and a discarding module; the source switch determination module is used to determine the source switch based on the graph structure features corresponding to the attack traffic if the detection result is attack traffic; the discarding module is used to discard data packets of the source switch; wherein, the data packets include the first telemetry data packets. Optionally, the telemetry traffic feature extraction module is specifically used to: extract first telemetry information of the switch from the first telemetry data packets; sample the telemetry information according to a set sampling frequency to obtain second telemetry information; and extract first telemetry traffic features from the second telemetry information. Optionally, the graph structure feature determination module is specifically used to: extract node features and edge features from the second telemetry information; and determine graph structure features based on the first telemetry traffic features, node features, and edge features.

[0078] Optionally, the traffic graph structure detection model includes an encoder, a decoder, and a discriminator, with the encoder connected to both the decoder and the discriminator. Optionally, the detection loss value output module is specifically used to: input the adjacency features and the first telemetry traffic features into the encoder to obtain latent features; input the latent features into the decoder and the discriminator respectively to obtain a first loss value and a second loss value, where the first loss value and the second loss value are the detection loss value. Optionally, the detection result determination module is specifically used to: if the sum of the first loss value and the second loss value is less than or equal to a target loss value, the output detection result is non-attack traffic; if the sum of the first loss value and the second loss value is greater than the target loss value, the output detection result is attack traffic. Optionally, the encoder includes a first graph convolutional network and a second graph convolutional network; optionally, the detection loss value output module is further configured to: input the adjacency feature and the first telemetry flow feature into the first graph convolutional network to obtain the first graph convolutional feature; input the adjacency feature and the first telemetry flow feature into the second graph convolutional network to obtain the second graph convolutional feature; and determine potential features based on the first graph convolutional feature and the second graph convolutional feature.

[0079] Optionally, the decoder comprises at least two cascaded graph convolutional networks; the discriminator comprises at least two cascaded perceptron layers. Optionally, the source switch determination module is specifically used to: determine the associated edges between the attacking switch and the attacking switch based on the graph structure features corresponding to the attack traffic; determine the attack path based on the attacking switch and the associated edges; and determine the source switch based on the attack path. Optionally, the discarding module is specifically used to: obtain the source IP address and / or destination IP address from the data packets of the source switch; if the source IP address and / or destination IP address is in a set whitelist, then the data packet is determined as a reserved data packet; wherein, the set whitelist includes multiple IP addresses;

[0080] The retained data packets are discarded according to a set packet loss rate. Optionally, the discarding module is further configured to: determine a first parameter based on the data packet retention rate of the source switch; determine a second parameter based on the entropy of the source IP address of the retained data packets of the source switch; perform a weighted summation of the first parameter and the second parameter to obtain a third parameter; and determine a set packet loss rate based on the third parameter and a set upper limit value.

[0081] The attack traffic detection device provided in this disclosure can execute the attack traffic detection method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of executing the method.

[0082] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Reference is made below. Figure 5It illustrates an electronic device suitable for implementing embodiments of the present disclosure (e.g., Figure 5 The diagram below shows the structure of the terminal device or server 500. The terminal device in this embodiment may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and vehicle terminals (e.g., vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0083] like Figure 5 As shown, electronic device 500 may include a processing unit (e.g., central processing unit, graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of electronic device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. An edit / output (I / O) interface 505 is also connected to bus 504.

[0084] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0085] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0086] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0087] The electronic device provided in this embodiment and the attack traffic detection method provided in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0088] This disclosure provides a computer storage medium storing a computer program that, when executed by a processor, implements the attack traffic detection method provided in the above embodiments.

[0089] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0090] In some implementations, the client and server may communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol), and may interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks. The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0091] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages, and specialized programming languages ​​for network behavior levels such as the "P4" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider). The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this respect, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the figures. For example, two consecutively indicated blocks may actually execute substantially in parallel, or sometimes in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0092] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not necessarily limiting in certain circumstances; for example, the first acquisition unit can also be described as "a unit that acquires at least two Internet Protocol addresses." The functions described above can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), etc.

[0093] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

Claims

1. A method for detecting attack traffic, characterized in that, include: Acquire the first telemetry data packets from multiple switches; Extract the first telemetry traffic feature from the first telemetry data packet; Determine the graph structure features based on the first telemetry flow characteristics; Extract the adjacency features from the graph structure features; The adjacency features and the first telemetry flow features are input into the pre-trained flow graph structure detection model, and the detection loss value is output. The detection result is determined based on the detection loss value and the target loss value; wherein the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; wherein the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic; The flow graph structure detection model includes an encoder, a decoder, and a discriminator, with the encoder connected to the decoder and discriminator respectively. The encoder is used to obtain latent features based on the adjacency features and the first telemetry flow features. The decoder is used to reconstruct the graph structure from the latent features and obtain a first loss value based on the latent features. The discriminator is used to distinguish between real data and generated data and obtain a second loss value based on the latent features. The first loss value and the second loss value are the detection loss value. The traffic graph structure detection model is trained using non-attack traffic.

2. The method according to claim 1, characterized in that, After determining the detection result based on the detection loss value and the target loss value, the method further includes: If the detection result is attack traffic, the source switch is determined based on the graph structure features corresponding to the attack traffic; The data packets from the source switch are dropped; wherein the data packets include the first telemetry data packets.

3. The method according to claim 1, characterized in that, Extracting the first telemetry traffic feature from the first telemetry data packet includes: Extract the first telemetry information of the switch from the first telemetry data packet; The telemetry information is sampled according to a set sampling frequency to obtain second telemetry information; Extract the first telemetry flow feature from the second telemetry information.

4. The method according to claim 3, characterized in that, The graph structure features are determined based on the first telemetry flow characteristics, including: Extract node features and edge features from the second telemetry information; The graph structure features are determined based on the first telemetry flow characteristics, node characteristics, and edge characteristics.

5. The method according to claim 1, characterized in that, The step of determining the detection result based on the detection loss value and the target loss value includes: If the sum of the first loss value and the second loss value is less than or equal to the target loss value, the output detection result is non-attack traffic; If the sum of the first loss value and the second loss value is greater than the target loss value, the output detection result is the attack traffic.

6. The method according to claim 1, characterized in that, The encoder includes a first graph convolutional network and a second graph convolutional network; the adjacency features and the first telemetry flow features are input into the encoder to obtain latent features, including: The adjacency feature and the first telemetry flow feature are input into the first graph convolutional network to obtain the first graph convolutional feature; The adjacency features and the first telemetry flow features are input into the second graph convolutional network to obtain the second graph convolutional features; Potential features are determined based on the convolutional features of the first graph and the convolutional features of the second graph.

7. The method according to claim 1, characterized in that, The decoder comprises at least two cascaded graph convolutional networks; the discriminator comprises at least two cascaded perceptron layers.

8. The method according to claim 2, characterized in that, Determining the source switch based on the graph structure characteristics corresponding to the attack traffic includes: The attacking switch and its associated edges are determined based on the graph structure features corresponding to the attack traffic. The attack path is determined based on the attack switch and the associated edge; The source switch is determined based on the attack path.

9. The method according to claim 2, characterized in that, The packet dropping process for the source switch includes: Obtain the source IP address and / or destination IP address from the data packets of the source switch; If the source IP address and / or destination IP address is in the set whitelist, the data packet is determined to be a reserved data packet; wherein, the set whitelist includes multiple IP addresses; The reserved data packets are discarded according to the set packet loss rate.

10. The method according to claim 9, characterized in that, The method for determining the packet loss rate includes: The first parameter is determined based on the packet retention rate of the source switch; The second parameter is determined based on the entropy of the source IP address of the data packet retained by the source switch; The first and second parameters are weighted and summed to obtain the third parameter; The set packet loss rate is determined based on the third parameter and the set upper limit value.

11. A device for detecting attack traffic, characterized in that, include: The telemetry data packet acquisition module is used to acquire the first telemetry data packets from multiple switches. The telemetry traffic feature extraction module is used to extract the first telemetry traffic feature from the first telemetry data packet; The graph structure feature determination module is used to determine the graph structure features based on the first telemetry flow feature. The adjacency feature extraction module is used to extract the adjacency features from the graph structure features; The detection loss value output module is used to input the adjacency feature and the first telemetry flow feature into the pre-trained flow graph structure detection model and output the detection loss value. The detection result determination module is used to determine the detection result based on the detection loss value and the target loss value; wherein, the target loss value is the loss value obtained by the traffic graph structure detection model during the training phase; wherein, the detection result includes whether the first telemetry traffic feature is attack traffic or non-attack traffic; The flow graph structure detection model includes an encoder, a decoder, and a discriminator, with the encoder connected to the decoder and discriminator respectively. The encoder is used to obtain latent features based on the adjacency features and the first telemetry flow features. The decoder is used to reconstruct the graph structure from the latent features and obtain a first loss value based on the latent features. The discriminator is used to distinguish between real data and generated data and obtain a second loss value based on the latent features. The first loss value and the second loss value are the detection loss value. The traffic graph structure detection model is trained using non-attack traffic.

12. An electronic device, characterized in that, The electronic device includes: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the attack traffic detection method as described in any one of claims 1-10.

13. A storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the attack traffic detection method as described in any one of claims 1-10.

Images