A Detection Method for Slow HTTP Denial of Service Attacks in Backbone Networks

Abstract

The present invention discloses a detection method for slow HTTP denial of service attacks (Slow HTTP DoS, SHD) in a backbone network. The method proposed by the present invention can complete the detection of three different types of SHD attacks. The detection method in the present invention is divided into an offline training stage and an online detection stage. In the offline training stage, according to the attack characteristics of different SHD types, several representative unidirectional traffic feature data are extracted and corresponding feature groups are constructed. These features can effectively deal with the situation where there is a large amount of unidirectional traffic in the backbone network nodes; the public backbone network traffic data set is systematically sampled and the data is stored in combination with the Count‑min Sketch technology, which greatly improves the problem that the backbone network requires large computing power and high storage space; finally, a specific machine learning method is used for training to obtain an attack detection model. The present invention can be used for SHD attack behavior detection and early warning in massive traffic scenarios such as backbone networks, providing a basis for maintaining the security status of the network.

Description

Technical Field

[0001] The invention relates to a detection method for slow HTTP denial of service attacks in a backbone network, and belongs to the technical field of network space security. Background Art

[0002] Today, DDoS has become one of the most direct and wide-ranging attacks on the Internet. Since traditional DDoS, such as SYN Flood, often generates a large amount of traffic during attacks, the detection technology for these large-volume DDoS has become increasingly mature, so attackers have designed many new types of DDoS attacks, which are more advanced and beneficial to attackers than traditional methods. SHD is one of the low-rate, low-volume, and covert attacks at the application layer. The target of SHD may often be located at the key nodes of the backbone network, and the traffic passing through the key nodes of the backbone network is very large, making the proportion of SHD traffic even smaller. Detecting SHD traffic in the backbone network is challenging, but it can strengthen the security line of the backbone network and avoid a large amount of losses caused by the attack. Therefore, it is of great significance to efficiently detect slow HTTP denial of service attacks in the backbone network.

[0003] In recent years, some scholars have proposed several detection methods for SHD. Most of the existing methods observe detailed bidirectional flow data such as the number of uplink and downlink data packets, uplink and downlink TTL, and uplink and downlink packet intervals, and select some features from them to fully characterize the state of each flow. These methods can achieve relatively ideal results in small-scale networks with low traffic, but the network speed in today's backbone networks is very fast, and the data volume per second of important network nodes can usually reach Gbps or even higher. The following existing SHD attack detection methods have certain limitations in backbone networks with large traffic.

[0004] (1) Detection method based on potential traffic patterns.

[0005] This method requires careful observation of the attack behavior and traffic patterns of SHD, and the use of rigorous mathematical methods to infer the underlying mathematical laws in the SHD traffic patterns, such as the periodicity of SHD traffic, the relationship between the lengths of data packets, the relationship between the intervals between data packets, etc. This method can achieve relatively ideal results in a non-sampling environment, but in an environment such as a backbone network that requires large-scale sampling, the traffic pattern after sampling will change. The lower the sampling rate, the greater the change in the traffic pattern, which becomes unstable, and the detection rate of this method will also drop sharply. Therefore, this method is difficult to apply to the detection of SHD attacks in backbone networks.

[0006] (2) Detection methods based on artificial intelligence.

[0007] This method uses artificial intelligence to classify traffic. Scholars usually manually or automatically find some features of SHD traffic. This method takes advantage of the powerful learning ability of artificial intelligence and the superior performance of specific algorithms in classification problems, so it can achieve good results in detection accuracy. However, the existing methods using artificial intelligence are difficult to apply to backbone networks. On the one hand, due to the complexity of the algorithm itself, the existing detection methods using deep learning are difficult to achieve real-time detection for the massive data in the backbone network. On the other hand, the existing detection methods using machine learning basically select a large number of parameters as feature data, which will further increase the amount of calculation, making it difficult to apply to the backbone network. Too many features also mean that they are not representative enough and are not conducive to the analysis of traffic in the subsequent defense stage. In addition, these methods are all based on bidirectional traffic, and do not take into account the situation where only unidirectional traffic can be captured, that is, asymmetric routing, but asymmetric routing is relatively common in backbone networks. Therefore, the existing methods based on artificial intelligence are difficult to apply to the detection of SHD attacks in backbone networks.

[0008] The detection of SHD attacks in backbone networks places high standards and requirements on the accuracy of the methods, the adaptability of the network environment, and the efficiency of the calculations. The current difficulties can be summarized as follows: (1) The backbone network environment further reduces the proportion of SHD traffic, making it more concealed; (2) Existing methods are only applicable to small networks that use full traffic. Using full traffic in the backbone network will consume a lot of resources and make it difficult to achieve real-time detection. In the case of low sampling rates, the accuracy of existing methods cannot meet the detection requirements; (3) Most existing methods are based on bidirectional flow data and do not take into account that the traffic passing through key nodes of the backbone network is often unidirectional, that is, they do not take into account the asymmetry of routing. If the method cannot solve any of these three difficulties, it may result in the attack traffic not being accurately detected or detected in a timely manner, which in turn leads to problems such as node downtime and inability to communicate normally between networks.

[0009] The detection method for SHD attacks provided by the present invention can solve the difficulty in effectively discovering SHD traffic in the backbone network in the current network security field. Summary of the invention

[0010] To solve the above problems, the present invention discloses a detection method for slow HTTP denial-of-service attacks (SlowHTTP DoS, SHD) in the backbone network. According to different utilization methods of the protocol, common SHD attacks can be divided into Slow Header (Slowloris), Slow Message Body (RUDY), and SlowREAD. The method proposed by the present invention can respectively complete the detection of these three different attacks. The detection method in the present invention is divided into an offline training stage and an online detection stage. In the offline training stage, according to the attack characteristics of different SHD types, several representative unidirectional traffic feature data are extracted and corresponding feature groups are constructed. These features can effectively cope with the situation of a large amount of unidirectional traffic existing in backbone network nodes; the public backbone network traffic dataset is systematically sampled and combined with the Count-min Sketch technology to store data, which greatly improves the problem of large computational requirements and high storage space in the backbone network; finally, a specific machine learning method is used for training to obtain an attack detection model. In the online detection stage, similar data preprocessing is performed on the traffic captured in the actual backbone network nodes to obtain traffic feature vectors, which are input into the attack detection model to detect whether there is attack traffic in the current traffic. The present invention can be used for the detection and early warning of SHD attack behaviors in scenarios with massive traffic such as backbone networks, providing a basis for maintaining the security of the network.

[0011] To achieve the purpose of the present invention, the specific technical steps of the solution are as follows: A detection method for slow HTTP denial-of-service attacks in the backbone network, the method comprising the following steps:

[0012] Step (1) Obtain the currently publicly available authoritative backbone network dataset and attack dataset, and extract the traffic data therein; according to specific scenario requirements, perform systematic sampling on the traffic at a ratio to obtain the sampled traffic data; Sampling can reduce the massive computational requirements brought by backbone network traffic on the one hand, and reduce the required storage space on the other hand;

[0013] Step (2) Analyze the principle of SHD attacks, extract several unidirectional traffic feature data that can reflect the overall characteristics of the attacks, such as the number of TCP packets without payload, the number of TCP packets with payload, the <IP, port> distribution of the traffic, etc., and based on the original feature data, expand specific unidirectional traffic feature data according to the differences of different SHD attack types, so as to construct a feature group for each SHD attack;

[0014] Step (3) extracts and stores the feature data described in step (2) based on the sampled traffic and according to different attack types using the Farm hash function, Bitmap, and a custom Count-min Sketch data structure. The custom Sketch structure can also reduce storage overhead.

[0015] Step (4) adding labels to the feature data according to the actual type of traffic to form a labeled feature vector, where the labels include three types of attack traffic and normal traffic;

[0016] Step (5) In order to further improve the processing speed, the present invention selects a machine learning algorithm with lower complexity, and inputs the feature vector obtained in step (4) into the machine learning algorithm for training to obtain the traffic models of three SHD attacks;

[0017] Step (6) captures real-time traffic from the real backbone network node, and performs traffic sampling and feature data acquisition operations according to the processes of steps (1) and (3), respectively. The feature data here can still be obtained from unidirectional traffic;

[0018] Step (7) inputs the unlabeled feature vector generated in real time into the three attack traffic models obtained in step (5), and labels the feature vector accordingly based on the predicted output of the model to identify the corresponding traffic type, and performs subsequent defense work according to the generated results.

[0019] Furthermore, in step (1), the steps of obtaining the flow data used for training are as follows:

[0020] (1.1) Obtain authoritative backbone network data sets as background traffic. However, since the formats of backbone network data sets currently available on the Internet are not completely unified, it is necessary to select or organize data in a unified format according to actual needs for subsequent processing;

[0021] (1.2) Build a distributed attack environment to simulate real-time attacks, use authoritative SHD attack tools to implement three types of SHD attacks, obtain attack traffic, and unify the format with the background traffic in (1.1);

[0022] (1.3) Combine background traffic and attack traffic to obtain mixed traffic data. According to specific scenario requirements, The mixed flow is systematically sampled in proportion to obtain the sampled flow data.

[0023] Furthermore, in step (2), the steps of constructing corresponding feature groups according to the attack type are as follows:

[0024] (2.1) Analyze the overall principle of the SHD attack, observe the similar behaviors of different attack traffic, extract several unidirectional traffic feature data that can reflect common characteristics, and these features do not involve the specific content of the application layer, such as the number of TCP packets without payload, the number of TCP packets with payload, the <IP, port> distribution of the traffic, etc.;

[0025] (2.2) Since the characteristics of different types of SHD attacks are not exactly the same, it is necessary to utilize the differences they exhibit in traffic to further refine specific unidirectional traffic feature data for each attack, such as the packet sending rate, the number of packets with RWND value of 0, etc.;

[0026] (2.3) According to the attack type, combine the common characteristics of SHD with the corresponding specific features to construct a specific feature group for each attack.

[0027] Furthermore, in step (3), the steps of extracting data features and storing them are as follows:

[0028] (3.1) There are multiple storage units in the custom Count-min Sketch structure, and each storage unit contains several Bitmaps and counters to save various types of feature data; each time a packet is obtained, the Count-min Sketch structure is updated once;

[0029] (3.2) For the traffic distribution in step (2.1), it cannot be directly obtained. It is necessary to hash <IP, port>. In order to improve the processing speed and reduce memory consumption, the Farm hash function is used here, and then the hash value is mapped into the Bitmap of the custom Sketch according to specific processing rules. Finally, the number of 1s in the Bitmap is used to represent the traffic distribution;

[0030] (3.3) For other features in step (2), they can be directly obtained through specific formulas or stored using the counters in the custom Sketch;

[0031] (3.4) In the Count-min Sketch structure, it is required to extract data once after each keyword corresponding unit is updated k times. Therefore, when the unit corresponding to the same <protocol, IP> packet is updated cumulatively k times, a feature vector is obtained.

[0032] Furthermore, in step (4), the feature data is extracted using the <protocol, IP> of the data packet as a keyword, and when simulating an attack, each type of attack traffic is generated by a specific IP, so the feature data can be labeled with an attack type based on the <protocol, IP>. If the IP of the feature data does not belong to a specific attack IP, then the traffic is background traffic and can be identified as normal traffic.

[0033] Furthermore, in step (5), a machine learning algorithm is used to train the feature data. The selection of the algorithm needs to take into account processing speed, good classification performance, and the ability to prevent overfitting. In this step, a random forest algorithm is selected to train the sample features in step (4) to obtain traffic models for three types of SHD attacks.

[0034] Furthermore, in step (6), to detect whether there is SHD attack traffic in the backbone network, it is necessary to deploy relevant software and hardware at several important nodes of the backbone network, such as backbone network core routers, firewalls, large Web servers, etc., to capture real-time traffic data; the traffic data can be unidirectional, and its format should be consistent with step (1.1); The system samples the traffic in a certain proportion and extracts and stores the characteristic data of the sampled traffic according to step (3).

[0035] Furthermore, in step (7), the steps of predicting the current flow and taking corresponding measures are as follows:

[0036] (7.1) In the training phase, three traffic models of SHD attacks are obtained. Here, the feature data generated in real time are input into these three attack traffic models for prediction. The prediction results of all models are integrated, and the current feature data is labeled accordingly to complete the detection of SHD traffic.

[0037] (7.2) Execute the corresponding strategy according to the actual prediction results. If it is normal traffic, it will be released. If it is attack traffic, an alarm will be generated to notify the network administrator. In addition, since the feature data is extracted with <protocol, IP> as the keyword, it can be decided whether to output the corresponding attack IP according to actual needs, providing a basis for further defense operations.

[0038] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects.

[0039] (1) The present invention proposes a method for quickly and accurately detecting slow HTTP denial of service attacks in scenarios where there is massive traffic, such as backbone networks. The method can analyze the traffic statistical characteristics on the current backbone network and, based on these characteristic data, efficiently detect SHD traffic, providing data basis for network security personnel.

[0040] (2) The present invention conducts in-depth observation and analysis of the characteristics of SHD traffic, extracts a few highly representative features, and combines sampling technology to effectively address the problem of high computational complexity caused by massive traffic in the backbone network. Even at low sampling rates, these features can still maintain good robustness and effectively detect SHD traffic. In addition, the present invention uses a custom Count-min Sketch structure to record traffic information, which greatly reduces storage overhead.

[0041] (3) All features extracted by the present invention can be obtained from unidirectional traffic, which means that even if there are a large number of asymmetric routes on the backbone network and the key nodes of the backbone network can only capture unidirectional flow data, the method of the present invention is still effective. Most existing studies are based on bidirectional traffic and do not take into account the situation of unidirectional traffic, which is more common in practice. In addition, since only unidirectional traffic is needed, the present invention does not need to perform flow grouping operations, which can further speed up the detection time and enable network security personnel to take defensive measures more promptly, which is also highly consistent with the needs of the backbone network.

[0042] (4) The method of the present invention can extract the required features without reading specific plaintext information at the application level. SHD attacks are located at the application layer, where the data may be encrypted. Existing methods that use plaintext information to distinguish cannot effectively deal with encrypted situations. The method of the present invention avoids using plaintext information at the application layer, so even if the data is encrypted, it can still stably detect attack traffic, adapting to the current trend of more and more encrypted traffic in the backbone network. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a system framework diagram of a detection method for slow HTTP denial of service attacks in backbone networks;

[0044] Figure 2 It is a custom Count-min Sketch structure diagram;

[0045] Figure 3 Update the process map for Bitmap;

[0046] Figure 4 This is the topology diagram of the attack environment. DETAILED DESCRIPTION

[0047] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0048] Embodiment: The present invention provides a method for detecting slow HTTP denial of service attacks in a backbone network, and its overall system structure is as follows: Figure 1 As shown in the figure, it includes the following steps:

[0049] Step (1): Obtain the currently publicly available authoritative backbone network dataset and attack dataset, and extract the traffic data therein; according to specific scenario requirements, systematically sample the traffic according to a certain ratio to obtain the sampled traffic data; Sampling can reduce the massive computational amount brought by the backbone network traffic on the one hand, and also reduce the required storage space on the other hand.

[0050] In one embodiment of the present invention, the steps for obtaining the traffic data used for training are as follows:

[0051] (1.1) Obtain the authoritative backbone network dataset as background traffic. However, since the forms of the backbone network datasets publicly available on the Internet currently are not completely unified, it is necessary to select or organize the data in a unified format according to actual needs for subsequent processing. Here, the MAWI dataset is selected.

[0052] (1.2) Build a distributed attack environment to simulate real-time attacks, use the authoritative SHD attack tool to implement three types of SHD attacks, obtain the attack traffic, and unify it with the format of the background traffic in (1.1). Here, the slowhttptest tool is selected; in this example, the hosts with IP addresses in the 192.168.137.0 / 24 network segment implement the Slowloris attack, the hosts with IP addresses in the 192.168.138.0 / 24 network segment implement the RUDY attack, the hosts with IP addresses in the 192.168.139.0 / 24 network segment implement the SlowREAD attack, and the IP address of the attacked host is 192.168.102.1.

[0053] (1.3) Merge the background traffic and the attack traffic to obtain the mixed traffic data. Some parameters of the mixed traffic are shown in Table 1; according to specific scenario requirements, set n to 64, and systematically sample the mixed traffic according to a certain ratio to obtain the sampled traffic data. of the ratio to obtain the sampled traffic data.

[0054] Table 1: Some parameters of the mixed traffic

[0055]

[0056] Step (2): Analyze the principle of the SHD attack, extract several unidirectional traffic feature data that can reflect the overall characteristics of the attack, such as the number of TCP packets without payload, the number of TCP packets with payload, the <IP, port> distribution of the traffic, etc., and on the basis of the original feature data, according to the differences of different SHD attack types, expand specific unidirectional traffic feature data, so as to construct a feature group for each SHD attack.

[0057] In one embodiment of the present invention, the steps of constructing corresponding feature groups according to attack types are as follows:

[0058] (2.1) Analyze the overall principle of SHD attacks, observe the similar behaviors of different attack traffic, and extract several unidirectional traffic feature data that can reflect common characteristics. These features do not involve the specific content of the application layer, such as the number of TCP packets without payload, the number of TCP packets with payload, the <IP, port> distribution of the traffic, etc.;

[0059] (2.2) Since the characteristics of different types of SHD attacks are not exactly the same, it is necessary to utilize the differences they exhibit in traffic to further refine specific unidirectional traffic feature data for each attack, such as the packet sending rate, the number of packets with RWND value of 0, etc.;

[0060] (2.3) According to the attack type, combine the common characteristics of SHD with the corresponding specific characteristics to construct specific feature groups for each attack; Table 2 lists some feature names and their meanings.

[0061] Table 2: Some Feature Names and Their Meanings

[0062] Feature Name meaning Pck_0 Number of TCP packets sent without load Pck_1 The number of TCP packets sent with load Pck_SYN Number of TCP packets with the SYN flag set to 1 RWND_0 The number of TCP packets with RWND 0 S_Disp The dispersion of source IP and port D_Disp Dispersion of destination IP and ports Pck_spd TCP packet sending rate Len_std Standard deviation of TCP packet length

[0063] In step (3), based on the sampled traffic, according to different attack types, use the Farm hash function, Bitmap, and a custom Count-min Sketch data structure to extract and store the feature data described in step (2). The custom Sketch structure can also reduce the storage overhead;

[0064] In one embodiment of the present invention, the steps of extracting and storing data features are as follows:

[0065] (3.1) There are multiple storage units in the custom Count-min Sketch structure. Each storage unit contains several Bitmaps and counters to save various types of feature data; each time a packet is obtained, the Count-min Sketch structure is updated once. Figure 2 Shows the custom Count-min Sketch structure and the update process;

[0066] (3.2) For the traffic distribution in step (2.1), it cannot be directly obtained. The <IP, port> needs to be hashed. To improve the processing speed and reduce memory consumption, here, in order to save the computational amount and storage space, a 32-bit Farm hash function is selected. Then, according to specific processing rules, the hash value is mapped into the Bitmap of the custom Sketch. Finally, the number of 1s in the Bitmap is used to represent the traffic distribution. Figure 3 Shows the structure and update process of the Bitmap;

[0067] (3.3) For other features in step (2), they can be directly obtained through specific formulas or stored using the counters in the custom Sketch. Table 3 shows the meanings, types, and the sizes of the spaces occupied by the contents in the custom Sketch;

[0068] Table 3: Contents of the Custom Count-min Sketch

[0069] Contents meaning type Space occupied Np Number of TCP packets sent counter 1 byte Pck_0 Number of TCP packets sent without load counter 1 byte Pck_1 The number of TCP packets sent with load counter 1 byte Pck_SYN Number of TCP packets with the SYN flag set to 1 counter 1 byte RWND_0 The number of TCP packets with RWND 0 counter 1 byte SourceBitmap Bitmap for recording the distribution of the <IP, port> of the record source Bitmap 2 bytes SourceBitmap Bitmap for recording the <IP, port> distribution for the purpose of recording Bitmap 2 bytes

[0070] (3.4) In the Count-min Sketch structure, it is required to extract data once after each keyword-corresponding unit is updated k times. Therefore, when the unit corresponding to the same <protocol, IP> data packet is updated cumulatively k times, a feature vector is obtained. Here, k is set to 100.

[0071] Step (4) According to the actual type of traffic, add labels to the feature data to form a labeled feature vector. The labels include three types of attack traffic and normal traffic;

[0072] In an embodiment of the present invention, the feature data is extracted with the <protocol, IP> of the data packet as the keyword. And during the simulated attack, each type of attack traffic is generated by the hosts in the three network segments of 192.168.137.0 / 24, 192.168.138.0 / 24, and 192.168.139.0 / 24. Therefore, the attack type labels can be added to the feature data according to the <protocol, IP>. If the IP of the feature data does not belong to these three network segments or 192.168.102.1, then the traffic is background traffic and can be marked as normal traffic.

[0073] Step (5) To further improve the processing speed, the present invention selects a machine learning algorithm with a lower complexity and inputs the feature vector obtained in step (4) into the machine learning algorithm for training to obtain traffic models for three types of SHD attacks;

[0074] In one embodiment of the present invention, a machine learning algorithm is used to train feature data. The selection of the algorithm needs to take into account processing speed, good classification performance, and the ability to prevent overfitting. In this step, a random forest algorithm is selected to train the sample features in step (4) to obtain traffic models of three SHD attacks.

[0075] Step (6) captures real-time traffic from the real backbone network node, and performs traffic sampling and feature data acquisition operations according to the processes of steps (1) and (3), respectively. The feature data here can still be obtained from unidirectional traffic;

[0076] In one embodiment of the present invention, to detect whether there is SHD attack traffic in the backbone network, it is necessary to deploy relevant software and hardware at several important nodes of the backbone network, such as backbone network core routers, firewalls, large Web servers, etc.; the traffic data can be unidirectional, and its format should be consistent with step (1.1); The attack relationship diagram of the backbone network can be simplified as follows: Figure 4 The network topology shown in the figure captures a total of 50 hosts accessing another node on the backbone network through key nodes of the backbone network, among which hosts 1 to 25 are normal users, and hosts 26 to 50 are attackers.

[0077] Step (7) inputs the unlabeled feature vector generated in real time into the three attack traffic models obtained in step (5), and labels the feature vector accordingly according to the predicted output of the model to identify the corresponding traffic type, and performs subsequent defense work according to the generated results;

[0078] In one embodiment of the present invention, the steps of predicting the current traffic and taking corresponding measures are as follows:

[0079] (7.1) In the training phase, three traffic models of SHD attacks are obtained. Here, the feature data generated in real time are input into these three attack traffic models for prediction. The prediction results of all models are integrated, and the current feature data is labeled accordingly to complete the detection of SHD traffic.

[0080] (7.2) Execute the corresponding strategy according to the actual prediction results. The traffic generated by hosts 1 to 25 is legitimate and is released normally. The traffic generated by hosts 26 to 50 is attack traffic. The current key node will generate an alarm to notify the network administrator. In addition, since the feature data is extracted with <protocol, IP> as the keyword, it can be decided whether to output the IP addresses of hosts 26 to 50 according to actual needs, providing a basis for further defense operations, such as adding these IP addresses to the blacklist.

[0081] The technical means disclosed in the scheme of the present invention are not limited to the technical means disclosed in the above-mentioned implementation mode, but also include technical schemes composed of any combination of the above-mentioned technical features. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also regarded as the protection scope of the present invention.

Claims

1. A method for detecting slow HTTP denial of service attacks in a backbone network, characterized in that: The method includes the following steps: Step (1) Obtain the currently public authoritative backbone network data set and attack data set, and extract the traffic data therein; according to the specific scenario requirements, The flow rate is systematically sampled in proportion to obtain the sampled flow data; Step (2): Analyze the principle of the SHD attack, extract several unidirectional traffic feature data that can reflect the overall characteristics of the attack, and on the basis of the original feature data, expand the unidirectional traffic feature data according to the differences of different SHD attack types, so as to construct a feature group for each SHD attack; Step (3): On the basis of the sampled traffic, according to different attack types, use the Farm hash function, Bitmap and the custom Count-min Sketch data structure to extract and store the feature data described in step (2). The custom Sketch structure also reduces the storage overhead; Step (4): According to the actual type of the traffic, add labels to the feature data to form a labeled feature vector. The labels include three types of attack traffic and normal traffic; Step (5): In order to further improve the processing speed, select a machine learning algorithm with lower complexity, and input the feature vector obtained in step (4) into the machine learning algorithm for training to obtain traffic models for the three SHD attacks; Step (6): Capture real-time traffic from real backbone network nodes, and perform traffic sampling and feature data acquisition operations respectively according to the processes of step (1) and step (3). The feature data here can still be obtained from unidirectional traffic; Step (7): Input the unlabeled feature vector generated in real time into the three attack traffic models obtained in step (5), and label the feature vector according to the prediction output of the model to identify the corresponding traffic type, and perform subsequent defense work according to the generated results; The specific steps of step (2) are as follows: (2.1) Analyze the overall principle of the SHD attack, observe the similar behaviors of different attack traffic, extract several unidirectional traffic feature data that can reflect the common characteristics, and these features do not involve the specific content of the application layer, such as the number of TCP packets without payload, the number of TCP packets with payload, and the <IP, port> distribution of the traffic; (2.2) Since the characteristics of different types of SHD attacks are not exactly the same, it is necessary to utilize the differences reflected in the traffic to further refine the unidirectional traffic feature data for each attack; (2.3) According to the attack type, combine the common characteristics of SHD with the corresponding specific features to construct a feature group for each attack.

2. A method for detecting slow HTTP denial of service attacks in a backbone network according to claim 1, characterized in that: The specific steps of step (1) are as follows: (1.1) Obtain an authoritative backbone network dataset as background traffic. Since the forms of the publicly available backbone network datasets on the Internet are not completely unified at present, it is necessary to select or organize the data in a unified format according to actual needs for subsequent processing; (1.2) Build a distributed attack environment to simulate real-time attacks, use authoritative SHD attack tools to implement three types of SHD attacks, obtain attack traffic, and unify it with the format of the background traffic in (1.1); (1.3) Combine the background traffic and attack traffic to obtain mixed traffic data. According to the specific scenario requirements, The mixed flow is systematically sampled in proportion to obtain the sampled flow data.

3. A method for detecting slow HTTP denial of service attacks in a backbone network according to claim 1, characterized in that: The specific steps of step (3) are as follows: (3.1) There are multiple storage units in the custom Count-min Sketch structure. Each storage unit contains several Bitmaps and counters to store various types of feature data. Each time a data packet is obtained, the Count-min Sketch structure is updated once. (3.2) For the traffic distribution in step (2.1), it cannot be directly obtained. The <IP, port> needs to be hashed. To improve the processing speed and reduce memory consumption, the Farm hash function is used here. Then, according to the processing rules, the hash value is mapped into the Bitmap of the custom Sketch. Finally, the number of 1s in the Bitmap is used to represent the traffic distribution. (3.3) For other features in step (2), they are directly obtained through formulas or stored using the counters in the custom Sketch. (3.4) In the Count-min Sketch structure, it is required to extract data once after each keyword corresponding unit is updated k times. Therefore, when the unit corresponding to the same <protocol, IP> data packet is updated cumulatively k times, a feature vector is obtained.

4. A method for detecting slow HTTP denial of service attacks in a backbone network according to claim 1, characterized in that: In step (4), the feature data is extracted with the <protocol, IP> of the data packet as the keyword. And during the simulated attack, each type of attack traffic is generated by the IP. Thus, the attack type label is added to the feature data according to <protocol, IP>. If the IP of the feature data does not belong to the attack IP, then this traffic is background traffic and can be marked as normal traffic.

5. A method for detecting slow HTTP denial of service attacks in a backbone network according to claim 1, characterized in that: In step (5), a machine learning algorithm is used to train the feature data. The selection of the algorithm needs to consider the processing speed, good classification performance, and the characteristic of preventing overfitting. In this step, the random forest algorithm is selected to train the sample features in step (4) to obtain the traffic models of three SHD attacks.

6. A method for detecting slow HTTP denial of service attacks in a backbone network according to claim 1, characterized in that: In step (6), to detect whether there is SHD attack traffic in the backbone network, relevant software and hardware deployment is required at important nodes of the backbone network to capture real-time traffic data; the traffic data can be unidirectional, and its format should be consistent with step (1.1); The system samples the traffic in a certain proportion and extracts and stores the characteristic data of the sampled traffic according to step (3).

7. A method for detecting slow HTTP denial of service attacks in a backbone network according to claim 1, characterized in that: Step (7) specifically includes the following sub-steps: (7.1) In the training stage, the traffic models of three SHD attacks are obtained. Here, the real-time generated feature data is respectively input into these three attack traffic models for prediction. The prediction results of all models are integrated to label the corresponding label for the current feature data, completing the detection of SHD traffic. (7.2) Corresponding strategies are executed according to the actual prediction results. If it is normal traffic, it is released. If it is attack traffic, an alarm is generated to notify the network administrator. In addition, since the feature data is extracted with <protocol, IP> as the keyword, according to actual needs, it is decided whether to output the corresponding attack IP to provide a basis for further defense operations.

Images