A ddos attack detection method based on context-aware reinforcement and k-means++ clustering

Abstract

The application develops a DDOS attack detection method based on context perception reinforcement and K-Means++ clustering, first, the encoder uses a pre-trained convolutional network to perform feature mapping on the input request packet, based on context perception, integrates the requests in a period of time according to the time sequence, obtains a feature matrix, and performs self-supervised feature reinforcement to strengthen the differences between respective features. Finally, unsupervised clustering is performed on the sample set, and the distance comparison between the sample and the normal cluster and the noise cluster finally achieves the purpose of abnormal DDOS flow detection.

Description

Technical Field

[0001] This invention belongs to the field of network technology and security, specifically, it is an attack detection method. Background Technology

[0002] As a new type of DoS attack, DDoS attacks involve extremely high bandwidth usage. GitHub, for example, suffered a bandwidth attack of up to 1.35Tbps in a single moment, and subsequent attacks against large websites such as Google also reached bandwidths of up to 1Tbps. A DDoS attack controls a large number of compromised machines, simultaneously sending useless requests to the target system. This massive distributed request traffic causes the target system to denial of service, paralyzing business systems and resulting in significant economic losses.

[0003] Currently, there are many DDoS detection solutions based on unit-time traffic, such as a cross-plane collaborative DDoS detection method for SDN and an AI-based DDoS detection method. These solutions have a broad scope for DDoS detection, with most focusing on detecting transport layer DDoS attacks and connection-based DDoS attacks, and performing well in handling floods such as Syn Flood, Ack Flood, and UDP Flood.

[0004] However, these solutions do not perform well in detecting malformed packet attacks, HTTP GET Flood, HTTP POST Flood, and CC attacks. In fact, malformed packet attacks, such as the Christmas tree attack, send TCP packets with all six flag bits (URG, ACK, PSH, RST, SYN, FIN) set to 1. The target system needs to perform complex processing on this packet. The server first uses `tcp_v4_do_rcv()`, which calls `tcp_check_req()` to acknowledge the packet. During the `tcp_check_req()` acknowledgment process, flag bits are polled, which can cause authentication conflicts, resulting in multiple TCP connection attempts and consuming server resources 2-3 times that of normal packets. Summary of the Invention

[0005] Based on this, the present invention develops a DDoS attack detection method based on context-aware enhancement and K-Means++ clustering. Attack detection is achieved through two parts: a enhancement encoder and K-Means++ clustering. The enhancement encoder includes enhancement encoder feature identification and enhancement encoder context enhancement, and the K-Means++ clustering algorithm is used to detect the feature matrix. Specifically, the method includes the following steps:

[0006] Step 1: Strengthen encoder feature identification, obtain traffic request packets, and mark the information of the request packets.

[0007] Further, step 1 includes: marking the information of the request packet with eight dimensions of digital features, including packet size, number of service type identifier bits, number of packets carrying service type identifier, packet arrival time, packet processing time, packet header information, packet arrival interval, and packet combination characteristics, and generating corresponding feature maps.

[0008] Furthermore, enhancing encoder feature identification specifically includes: representing the input request packet using a high-dimensional vector set through the encoder; specifically, the sequence of input request packets is represented as: c = (c1, ..., c2). n The encoder is: X = Encoder(x) = C k (C k-1 (...C1(x))), C k A convolutional block consists of several convolutional layers, each followed by batch normalization and an activation function. The convolutional block also includes a squeeze-and-excision module and a skip-connection residual summation operation. Squeeze-and-excision model the interdependencies between channels and adaptively re-corrects the feature response strengths between channels using the network's global loss function; that is, it uses a self-attention mechanism to analyze and evaluate the inconsistency in importance between information. The request packet represented by the encoder is then: X = (X1, ..., X...). n ), .

[0009] Step 2: Enhance the encoder's context-aware enhancement by integrating requests over a period of time according to their time series to obtain their feature matrix; further, obtaining the corresponding enhanced feature matrix includes: Let X i Let i be the feature mapping of the i-th data packet, then we have Calculate the average of n data packets calculate Finally, we get A′ i =min+A i Complete matrix strengthening, A′ i To fully represent the differences between features, the enhancement matrix is ​​added to the original matrix, thereby eliminating some complementary regions.

[0010] Step 3: Use the K-Means++ clustering algorithm to detect the feature matrix and determine whether a DDoS attack has occurred.

[0011] Furthermore, the feature matrix detection using the K-Means++ clustering algorithm includes: randomly selecting a sample point A′ from the dataset. iAs the first initial cluster center, calculate the shortest distance between each sample and the existing cluster centers, denoted by D(x); then calculate the probability that each sample point will be selected as the next cluster center. Finally, the sample point corresponding to the highest probability value is selected as the next cluster center. The cluster with more samples is the normal cluster, and the others are noise clusters. The average distance from the sample to the normal cluster and the noise cluster is calculated. When this distance is greater than a preset threshold, it is determined to be abnormal data due to environmental change; otherwise, the distance from the center of the noise cluster is judged. If it is less than the threshold, it is noise; otherwise, it can be determined that a DDoS attack has occurred.

[0012] The DDoS attack detection method based on context-aware enhancement and K-Means++ clustering of this invention has the following advantages:

[0013] Using context-aware enhancement improves clustering accuracy and greatly helps reduce false positive rates. Therefore, context-aware enhancement is beneficial for obtaining differentiated content, and it is particularly helpful for subsequent clustering and detection work in situations where the protocol characteristics and content characteristics of the request packets in this DDoS attack are unknown.

[0014] Unlike detection methods based on unit time flow, this method is based on text clustering, does not need to be limited by thresholds, and can detect faster and earlier than existing methods.

[0015] Using the unsupervised K-Means++ clustering algorithm, DDoS attack packets can be distinguished in a lightweight manner with less human intervention. This method only needs to add a small number of typical malicious packets and ambiguous packets as noise, eliminating the need for manually collecting a large number of normal and malicious packets, as well as manually annotating the text features extracted from the database.

[0016] Compared with other K-Means algorithms, the K-Means++ used in this study is further optimized, which solves the drawback of incorrect convergence in initial cluster centers, improves accuracy by 1 / 3 and has a faster detection speed, and has superior performance.

[0017] This patent focuses on detecting attacks such as Frag Flood, Smurf, Stream Flood, Land Flood malformed packet attacks, HTTP Get Flood, HTTP Post Flood, and CC attacks. It also demonstrates superior detection performance against transport layer DDoS attacks and connection-based DDoS attacks. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the DDoS attack detection method based on context-aware reinforcement and K-Means++ clustering in this application.

[0020] Figure 2 This is a flowchart of the vector extraction process for this application.

[0021] Figure 3 This is a flowchart of the clustering process for this application.

[0022] Figure 4 This study presents a comparative experiment on the detection of attacks such as transport layer DDoS attacks and connection-based DDoS attacks. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. Figure 1 The flowchart of the DDoS attack detection method based on context-aware reinforcement and K-Means++ clustering is shown, which includes the following steps.

[0024] Step 1: Strengthen encoder feature identification, obtain traffic request packets, and mark the information of the request packets.

[0025] Enhance encoder feature identification to obtain traffic request packets. The information in these packets is labeled with eight dimensions of numerical features, including packet size, number of service type identifier bits, number of packets carrying the service type identifier, packet arrival time, packet processing time, packet header information, packet arrival interval, and packet combination characteristics. The specific extraction process is as follows: Figure 2 As shown, the corresponding feature maps are generated. The input request packet sequence is represented as: c = (c1,...,c n The encoder's job is to represent the input x using a high-dimensional vector set: X = (X1, ..., X...). n Therefore, the encoder is defined as: X = Encoder(x) = C k (C k-1 (...C1(x))), where each C... kThis represents a convolutional block, comprising several convolutional layers, each followed by batch normalization and an activation function. The convolutional block also includes a squeeze-and-excision module and a skip connection (residual summation) operation. Traditional methods pass the feature maps of the CNN network to the next layer with equal weights. Squeeze-and-excision, however, models the interdependencies between channels and adaptively re-corrects the feature response strengths between channels using the network's global loss function; that is, it uses a self-attention mechanism to analyze and evaluate the inconsistent importance of information.

[0026] Step 2: Enhance the encoder's context awareness by integrating requests over a period of time according to the time series to obtain the corresponding enhanced feature matrix.

[0027] Among them, encoder context-aware enhancement integrates requests over a period of time according to time series and analyzes their digital feature matrix, such as... Figure 3 As shown. A self-attention mechanism is used to obtain the feature mapping of the context information of the request segment, resulting in an enhanced feature matrix. The specific algorithm for matrix enhancement is as follows: Let X... i Let i be the feature mapping of the i-th data packet, then we have Calculate the average of n data packets calculate Finally, we get A′ i =min+A i Matrix strengthening is completed. Where A′ i To fully represent the differences between features, the enhancement matrix is ​​added to the original matrix, which can eliminate some complementary regions. Since each vector may contain effective semantic information, average pooling can be used to process the feature matrix at the end.

[0028] Step 3: Use the K-Means++ clustering algorithm to detect the feature matrix and determine whether a DDoS attack has occurred.

[0029] Subsequently, the K-Means++ clustering algorithm was used to detect the feature matrix. A portion of the dataset was randomly selected as the training set, and a small amount of attack noise was added during training. The clustering was divided into normal clusters and noisy clusters, and a sample point A′ was randomly (uniformly distributed) selected from the dataset. i As the first initial cluster center; then calculate the shortest distance between each sample and the existing cluster centers, denoted by D(x); then calculate the probability that each sample point will be selected as the next cluster center. Finally, the sample point corresponding to the highest probability value is selected as the next cluster center. The cluster with more samples is the normal cluster, and the others are noise clusters. The average distance from the sample to the normal cluster and the noise cluster is calculated. When this distance is greater than a preset threshold, the data is considered abnormal data such as environmental changes. Otherwise, it is first determined whether the sample is close to a noise cluster. If so, it is considered noise; otherwise, it can be determined that a DDoS attack has occurred.

[0030] Figure 4 Comparative experiments are presented on the detection of transport layer DDoS attacks, connection-based DDoS attacks, and other attacks using the method of this invention. As can be seen from the figures, when facing malformed packets, transport layer DDoS attacks, connection-based DDoS attacks, and application layer attacks, the method used in this invention achieves better detection performance in terms of both attack detection time and accuracy.

[0031] This method significantly reduces the time required to detect malformed message attacks, HTTP Get Flood, HTTP Post Flood, CC attacks, etc., as detailed in Table 1. Figure 4 Malformed packets include, but are not limited to, Frag Flood, Smurf, Stream Flood, and Land Flood.

[0032] Table 1

[0033]

[0034] The embodiments described above merely illustrate the implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A DDoS attack detection method based on context-aware reinforcement and K-Means++ clustering, the method comprising: Step 1: Obtain traffic request packets, mark the information in the request packets, and strengthen the encoder feature identification; Step 2: Enhance the encoder's context awareness by integrating requests over a period of time according to the time series to obtain the corresponding enhanced feature matrix; Step 3: Use the K-Means++ clustering algorithm to detect the feature matrix and determine whether a DDoS attack has occurred; Step 1 includes: marking the information of the request packet with eight dimensions of digital features, including packet size, number of service type identifier bits, number of packets carrying service type identifier, packet arrival time, packet processing time, packet header information, packet arrival interval, and packet combination features, and generating corresponding feature maps; Enhancing encoder feature identification specifically includes: representing the input request packet using a set of high-dimensional vectors through the encoder; Step 3, using the K-Means++ clustering algorithm to detect the feature matrix, includes: randomly selecting a sample point A′ from the dataset. i As the first initial cluster center, calculate the shortest distance between each sample and the existing cluster centers, denoted by D. i (x) represents the probability that each sample point is selected as the next cluster center. Finally, the sample point corresponding to the maximum probability value is selected as the next cluster center. The cluster with more samples is the normal cluster, and the others are noise clusters. Calculate the average distance from the sample to the normal cluster and the noise cluster. If this distance is greater than a preset threshold, it is determined to be abnormal data due to environmental change. Otherwise, it is determined to be noise if the distance from the center of the noise cluster is less than the threshold. Otherwise, it can be determined that a DDoS attack has occurred.

2. The method according to claim 1, characterized in that, The input request packet sequence is represented as: c = (c1, ..., c2) n The encoder is: X = Encoder(x) = c k (c k-1 (...c1(x)), c k For a convolutional block, k = 1, ..., n, the request packet represented by the encoder is: X = (X1, ..., Xn) n ).

3. The method according to claim 2, characterized in that, In step 2, obtaining the corresponding enhancement feature matrix includes: Let X i Let i be the feature mapping of the i-th data packet, then we have Calculate the average of n data packets calculate Finally, we get A′ i =min+A i The matrix strengthening is completed, and the strengthened feature matrix is ​​obtained.

Images