A Real-Time and Efficient IoT DDoS Attack Detection Method and System

Abstract

This invention discloses a real-time and efficient method and system for detecting IoT DDoS attacks. The invention can be divided into a coarse-grained model training stage and a DDoS attack traffic detection stage. In the coarse-grained model training stage, learnable parameters in the probabilistic detection model and the flow-level detection model are trained based on known categories of IoT DDoS attacks and benign network traffic, thereby achieving automated DDoS attack detection. In the DDoS attack traffic detection stage, based on the trained probabilistic detection model and the flow-level detection model, features are extracted from real network traffic obtained in the network environment, and DDoS attack detection is completed. This invention enables the feature vectors after convolution operations to more accurately represent the characteristics of network traffic after feature weight fusion. It can achieve high-precision and high-efficiency detection of DDoS attack traffic, and can adapt to different network environments, exhibiting stronger generalization ability.

Description

Technical Field

[0001] This invention relates to constructing statistical and sequence features based on partial fields of network traffic data packets, and using artificial intelligence-related technologies to efficiently and effectively detect IoT DDoS attack traffic. Specifically, it relates to a real-time and efficient IoT DDoS attack detection method and system. Background Technology

[0002] This invention relates to the real-time and efficient detection of IoT DDoS attacks using traditional machine learning and deep learning techniques based on the statistical and sequential characteristics of network traffic. Since DDoS attacks disrupt the availability of essential services, their detection is crucial for IoT security. Specifically, with the emergence of malware used to infect IoT devices, more and more IoT devices are becoming infected, becoming part of botnets and potential accomplices in DDoS attacks launched by attackers, threatening the security of the entire internet. On the other hand, with the popularization of smart homes, home IoT devices are becoming increasingly common. Due to the limited security measures and computing power of home gateway routers, it is difficult to detect DDoS attacks launched by infected home IoT devices. Therefore, DDoS attacks using IoT devices have attracted considerable research attention from academia and industry. Previously, traditional DDoS attack detection techniques mostly employed heuristic methods; however, in recent years, with the development of artificial intelligence technology, many methods using traditional machine learning and deep learning have achieved good results in DDoS attack detection. However, as mentioned above, due to the limited computing power and storage space of home gateway routers, selecting appropriate artificial intelligence technologies and designing suitable models to achieve a DDoS attack detection method with high detection efficiency, high detection accuracy, and high robustness that can be deployed on home gateway routers remains a very important and open research problem. This invention uses the statistical and sequential characteristics of network traffic as input and attempts to use traditional machine learning and deep learning methods for more accurate and effective DDoS attack detection.

[0003] This invention designs and implements a novel IoT DDoS attack detection method and system. This method captures the collective behavior of network traffic for efficient batch detection and integrates the advantages of traditional machine learning and deep learning to achieve DDoS attack detection with higher accuracy, higher efficiency and stronger generalization ability. Summary of the Invention

[0004] The purpose of this invention is to design and implement a real-time and efficient IoT DDoS attack detection method and system, which ensures high detection accuracy while possessing high detection efficiency and strong generalization ability. To achieve the above objective, the technical solution adopted by this invention is as follows:

[0005] A real-time and efficient IoT DDoS attack detection method and system, characterized by including a coarse-grained and fine-grained model training stage and a DDoS attack traffic detection stage;

[0006] The coarse-grained and fine-grained model training phase includes three parts: (1) feature extraction of DDoS attack traffic, (2) coarse-grained detection model construction, and (3) fine-grained detection model construction.

[0007] DDoS attack traffic feature extraction includes the following steps:

[0008] 1) Using a set of known IoT devices as input, generate a sufficient number of DDoS attacks and benign network traffic samples to obtain partial field information for each data packet.

[0009] 2) Using the packet length of each data packet obtained in step 1), construct statistical characteristics of network traffic in units of time windows.

[0010] 3) Using the partial field information of each data packet obtained in step 1), construct the sequence characteristics of network traffic on a per-flow basis.

[0011] The specific steps for constructing a coarse-grained detection model are as follows:

[0012] 4) Using the network traffic statistics features obtained in step 2) as input, the constructed probability detection model is obtained by adopting the random forest algorithm in the traditional machine learning method.

[0013] The specific steps for constructing a fine-grained detection model are as follows:

[0014] 5) Using the network traffic sequence features obtained in step 3) as input, the constructed flow level detection model is obtained by training it using a neural network in deep learning.

[0015] The DDoS attack traffic detection phase includes the following steps:

[0016] 6) Using the network traffic data to be tested as input, perform a query on the knowledge database;

[0017] 7) Extract features from the network traffic to be tested according to steps 1), 2), and 3) to obtain the statistical and sequence features of the network traffic to be tested;

[0018] 8) Using the network traffic features obtained in step 7) as input, coarse-grained detection is performed through the probability detection model obtained in step 4), with the detection unit being a time window. Finally, the coarse-grained detection results are obtained, and the knowledge database is updated.

[0019] 9) Using the network traffic sequence features of the benign window obtained in step 8) as input, fine-grained detection is performed through the flow-level detection model obtained in step 5). The detection unit is a single network traffic flow. Finally, fine-grained detection results are obtained and the knowledge database is updated.

[0020] A real-time and efficient IoT DDoS attack detection method and system, characterized by comprising a DDoS attack traffic feature extraction module, a coarse-grained detection model construction module, and a fine-grained detection model construction module for the coarse-grained and fine-grained detection model training phases, and a knowledge database query module, a DDoS attack traffic feature extraction module, and a coarse-grained DDoS attack flow detection module for the DDoS attack traffic detection phase; wherein,

[0021] The DDoS attack traffic feature extraction module is responsible for extracting statistical features at the time window level and sequence features at the single traffic level from the input raw IoT DDoS attack and benign network traffic data.

[0022] The coarse-grained detection model building module in the coarse-grained detection model training phase is responsible for training the probability detection model based on the statistical characteristics of network traffic using the random forest algorithm in traditional machine learning methods, for use in the DDoS attack traffic detection phase.

[0023] The fine-grained detection model building module in the coarse-grained detection model training phase is responsible for training the flow-level detection model based on the sequence characteristics of network traffic using deep learning methods and a neural network generated with sequence feature weights, for use in the DDoS attack traffic detection phase.

[0024] The knowledge database query module in the DDoS attack traffic detection phase is responsible for intercepting or allowing network traffic based on the five-tuple information of network traffic, using blacklist and whitelist mechanisms.

[0025] The coarse-grained DDoS attack detection module in the DDoS attack traffic detection phase is responsible for performing coarse-grained detection on network traffic in units of time windows based on the probability detection model generated during the coarse-grained detection model training phase, and outputting the judgment results to update the knowledge database.

[0026] The fine-grained DDoS attack detection module in the DDoS attack traffic detection phase is responsible for performing fine-grained detection on network traffic within the benign window in the coarse-grained detection results, based on the flow-level detection model generated during the coarse-grained detection model training phase, on a per-traffic basis, and outputting the judgment results to update the knowledge database.

[0027] The key technical point of this invention is:

[0028] 1. A real-time and efficient IoT DDoS attack detection method and system is designed, which can achieve high-precision and high-efficiency detection of DDoS attack traffic, and can adapt to different network environments, with stronger generalization ability.

[0029] 2. This invention observes the collective behavior of DDoS attack traffic. By observing this collective behavior, this invention can detect multiple flows simultaneously, greatly improving detection efficiency. Therefore, this invention calculates the statistical characteristics of DDoS attack traffic based on a time window and uses these statistical characteristics as the collective behavior of DDoS attack traffic.

[0030] 3. A feature weight generation mechanism was designed. This mechanism can learn the importance of features in different sequences, so that the feature vector after convolution operation can more accurately represent the features of network traffic after feature weight fusion.

[0031] The method of this invention can solve the problem of efficient and high-precision detection when a DDoS attack occurs. Compared with the disclosed related technologies, it has the following advantages:

[0032] 1. A real-time and efficient IoT DDoS attack detection method and system are designed. Compared with previous methods, which lack generalization ability when the types of DDoS attacks and network environments change, this invention can adapt to different DDoS attacks and network environments, and has stronger generalization ability.

[0033] 2. This invention uses network traffic statistical characteristics calculated in time windows as a measure of collective network traffic behavior. These statistical characteristics are highly distinguishable between DDoS attacks and normal network environments. Through these statistical characteristics, batch detection of network traffic is possible, resulting in higher detection efficiency and accuracy. Attached Figure Description

[0034] Figure 1 This is a flowchart of the training phase of a coarse-grained detection model for a real-time and efficient IoT DDoS attack detection method.

[0035] Figure 2 This is a diagram of the neural network structure built by the fine-grained detection model.

[0036] Figure 3 This is a flowchart of the DDoS attack traffic detection stage of a real-time and efficient IoT DDoS attack detection method.

[0037] Figure 4 This is a system architecture diagram for a real-time and efficient IoT DDoS attack detection method. Detailed Implementation

[0038] The workflow of this invention can be divided into a coarse-grained model training phase and a DDoS attack traffic detection phase. In the coarse-grained model training phase, learnable parameters in the probabilistic detection model and the flow-level detection model are trained based on known categories of IoT DDoS attacks and benign network traffic, thereby achieving automated DDoS attack detection. In the DDoS attack traffic detection phase, based on the trained probabilistic detection model and the flow-level detection model, features are extracted from real network traffic obtained in the network environment, and DDoS attack detection is completed.

[0039] In the training phase of the coarse-grained and fine-grained detection model, the key technical aspect of this invention lies in the construction of the probabilistic detection model and the flow level detection model, the process of which is as follows: Figure 1 As shown. The input to the probabilistic detection model construction process is the statistical characteristics of network traffic, while the input to the flow-level detection model construction process is the sequential characteristics of network traffic. The output of the coarse-grained and fine-grained detection model training phase is the probabilistic detection model and the flow-level detection model that meet the requirements for DDoS attack traffic detection.

[0040] The specific implementation steps for the training phase of the coarse-grained and fine-grained detection model are as follows:

[0041] 1. Given a set of network traffic data packet sequences (The set contains) Network traffic, of which Representing the The first in the network traffic flow One data message, Representing the All network traffic (Data packets). First, the network traffic data packet sequence needs to be preprocessed to extract relevant statistical and sequence features.

[0042] The steps for extracting statistical features are as follows:

[0043] ① Obtain the set of data packet lengths belonging to the current time window based on the timestamp of the data packet. (The set contains) Network traffic, of which Representing the The first in the network traffic The length of a data message packet, Representing the All network traffic (Data message).

[0044] ②Based on the following formula, with data packet length as the attribute, construct four-dimensional statistical features: minimum packet length, average packet length, standard deviation of packet length, and kurtosis of packet length.

[0045]

[0046]

[0047]

[0048]

[0049] ③ Mark the time window according to the proportion of DDoS attack data packets in the current time window. If the proportion is greater than a given threshold... If the condition is met, the time window is marked as malicious; otherwise, it is marked as benign. (This step only occurs during the statistical feature extraction phase of the coarse-grained detection model training stage in this patent, and is not present in the DDoS attack traffic detection stage.)

[0050] ④ After processing all data packets in the current time window, slide to the next time window until all network traffic has been captured, ultimately obtaining a statistical feature set of DDoS attack traffic and benign traffic. (in, Indicates the first The four dimensions of characteristics of a time window Indicates a total of (One time window.)

[0051] Next, this invention extracts the sequence features of network traffic. It should be noted that the statistical features mentioned above are based on a time window, while the sequence features are based on each network traffic item. The specific steps are as follows:

[0052] Obtain the set of packet lengths of data packets belonging to the current time window based on the timestamp of the data packets. The set of IP flags in a data packet. The set of TCP flags in a data packet After processing all data packets in the current time window, slide to the next time window until all network traffic has been captured.

[0053] 2. After feature extraction, this invention constructs a coarse-grained detection model. The function of the coarse-grained detection model is to detect each time window as malicious or benign. This invention uses the random forest algorithm to construct the coarse-grained detection model, which combines the statistical feature set of each time window, i.e. Input the data and obtain the detection results for the time window. By continuously updating node information through multiple decision trees, the final random forest is obtained. The training parameters of the coarse-grained detection model are saved and used as the output of the probabilistic detection model.

[0054] 3. After constructing the coarse-grained detection model, this invention trains a fine-grained detection model. The fine-grained detection model is constructed using a deep neural network training method. The neural network structure of the flow-level detection model is as follows: Figure 2 As shown, the termination condition of the construction process is Before training a neural network, the trainable parameters in the neural network need to be initialized according to the hyperparameter settings. Neural network parameter initialization can be performed using methods such as loading existing model parameters, random initialization, or custom initialization. In this invention, random initialization is used to assign initial values ​​to the trainable parameters in the neural network.

[0055] If fine-tuning of the learnable parameters of the neural network in this invention is required after use, this step can be skipped. Instead of parameter initialization, the original parameters can be loaded directly, and the model effect can be adjusted based on the original parameters.

[0056] 4. Given a set of features from a network traffic sequence after feature extraction. , and 𝓣𝓕 As input data, the initial feature transformation operation performs a dimensionality transformation on the input data, first concatenating the three sets together to form a feature combination set. ,in For ease of understanding, subsequent steps will use combinations of single features. As the subject of discussion, the initial feature transformation operation of the present invention will be introduced.

[0057] In this invention, 1D convolution is used to complete the dimensionality transformation and form transformation operations of the current step. Because... ,in The dimension size is Therefore, the input data for this step The dimension is The kernel size of the convolutional layer used is The number of channels (i.e., the number of convolutional kernels) is The output data dimension after convolution is ,Right now ( Dimensions ).

[0058] After the transformation of the convolutional layer is completed, non-linear activation functions and data normalization are required to optimize data distribution, accelerate the overall training speed of the neural network, and improve training results. This invention uses the ReLU (Rectified Linear Unit) function as the non-linear activation function and batch normalization as the data normalization method. Other methods can also be used for all steps in the network structure that require non-linear activation and normalization.

[0059] 5. In order to learn the weight of each sequence feature, the three sequence feature sets are... , and 𝓣𝓕 Divided into One branch, Each branch operates independently and performs feature operations in parallel.

[0060] Each branch contains two 1D convolutional layers: the kernel dimension of the first convolutional layer is... The number of channels in the convolution kernel is The kernel dimension of the second 1D convolutional layer is... The number of channels is The feature vector dimension after two convolution operations is... After the convolution operation, average pooling is used to average the feature vector values, resulting in a vector with dimension [missing value]. The output of .

[0061] Furthermore, after completing all convolutional operations, each branch uses batch normalization to adjust the distribution space of the features formed by that branch. Finally, the outputs of the three branches are concatenated to obtain a dimension of [dimensionality missing]. Feature weights.

[0062] 6. After completing the initial feature transformation and generating sequence feature weights, this invention uses weighted summation to merge the feature vectors after the initial feature transformation into a weighted feature vector. For a single network traffic flow, given the set of feature vectors generated by each branch... ( Dimensions Branch weight set ( Dimensions Then, the feature vector corresponding to this network traffic can be represented as: Output data The dimension is .

[0063] 7. After completing the weighted feature fusion, the network traffic has been converted into corresponding feature vectors. To map the semantic information represented by the feature vector values ​​to DDoS attack traffic and benign network traffic, this invention uses a fully-connected layer to map from feature vectors to network traffic type inference. For a single network traffic item, the output dimension is... Since the final detection results only show DDoS attack traffic or benign network traffic, The dimension with the largest value represents the detection result of whether the network traffic is a DDoS attack traffic in this calculation. For the set of detection results of all network traffic participating in the current iteration, a loss function can be calculated to evaluate the degree of fit between the current calculation result and the actual data. The loss function used in this invention is the cross-entropy function.

[0064] 8. After completing feature classification, determine whether the neural network calculation result meets the termination condition. (a) If the calculation result satisfies the termination condition If the neural network training process is stopped, the flow-level detection model containing the neural network parameter values ​​will be output for fine-grained detection in the DDoS attack traffic detection stage; (b) if the calculation result does not meet the termination condition, the loss function value will be calculated based on the network classification result, the neural network parameters will be updated using backpropagation, and the process will return to step (4) initial feature transformation and repeat steps (4)-(8). Termination condition The settings may include, but are not limited to, the following conditions: reaching the maximum iteration period, reaching the expected loss function value, reaching the expected statistical evaluation index, etc.

[0065] The workflow of the DDoS attack traffic detection phase is as follows: Figure 3 As shown, this stage uses the parameters of the probability detection model and flow-level detection model obtained in the coarse-grained detection model training stage as a basis and network traffic as input to perform DDoS attack detection on the captured network traffic.

[0066] 1. This invention adds a knowledge database to the DDoS attack traffic detection stage, storing the five-tuple information of network traffic (source IP address, destination IP address, source port, destination port, and transport layer protocol) through whitelist and blacklist policies. Each time network traffic is acquired, it is first checked whether it is in the knowledge database. If it is in the blacklist, it is directly detected as DDoS attack traffic; if it is in the whitelist, it is directly detected as benign traffic.

[0067] 2. Network traffic not found in the knowledge database is handed over to the feature extraction module. First, the duration of the preset time window is determined. Following the feature extraction steps described in the training phase of the coarse-grained and fine-grained detection model above, the statistical features and sequence features of network traffic are extracted.

[0068] 3. The coarse-grained DDoS attack traffic detection module uses a probabilistic detection model generated during the training phase of the coarse-grained and fine-grained detection model. Based on preprocessed network traffic statistical characteristics, it performs coarse-grained detection, classifying time windows as malicious or benign. Network traffic detected as being within a malicious window is completely blocked and not subjected to fine-grained detection; its five-tuple is then updated in the knowledge database's blacklist. Network traffic detected as being within a benign window will undergo fine-grained detection.

[0069] 4. The fine-grained DDoS attack traffic detection module is based on the flow-level detection model generated during the training phase of the coarse-grained detection model. It takes the sequence features of network traffic within the benign window from the coarse-grained detection results as input to perform fine-grained flow-level detection, classifying each piece of network traffic as either a DDoS attack or benign. The five-tuple of network traffic detected as a DDoS attack is updated to the blacklist in the knowledge database, while the five-tuple of network traffic detected as benign is updated to the whitelist.

[0070] In practical applications, this invention can restart the training phase to adjust and retrain the neural network based on factors such as the detection performance on different datasets and changes in DDoS attack methods. Through multiple iterations of the training and detection phases, the parameters of the probabilistic detection model and the flow-level detection model used in this invention are updated to ensure that the performance of this invention meets the requirements for DDoS attack detection.

[0071] In conjunction with the aforementioned real-time and efficient IoT DDoS attack detection method, this invention also discloses a real-time and efficient IoT DDoS attack detection method and system. This system mainly consists of two stages: a coarse-grained detection model training stage and a DDoS attack traffic detection stage. The system architecture is shown in the diagram below. Figure 4 As shown.

[0072] 1. Coarse-grained and fine-grained detection model training phase: First, taking IoT DDoS attacks and benign network traffic as input, the statistical and sequence features of network traffic are extracted by (1) the DDoS attack traffic feature extraction module. (2) The coarse-grained detection model construction module is responsible for training the probability detection model based on the statistical features of network traffic using the random forest algorithm in traditional machine learning methods, for use in the DDoS attack traffic detection phase. (3) The fine-grained detection model construction module is responsible for training the flow-level detection model based on the sequence features of network traffic using deep learning methods and a neural network with sequence feature weights, for use in the DDoS attack traffic detection phase.

[0073] 2. DDoS Attack Traffic Detection Phase: The DDoS attack traffic detection phase takes unknown IoT DDoS attacks to be detected and benign network traffic data as input. (1) The query module of the knowledge database is responsible for intercepting and allowing network traffic based on the five-tuple information of network traffic using blacklist and whitelist mechanisms. (2) The DDoS attack traffic feature extraction module extracts the statistical and sequence features of network traffic. (3) The coarse-grained DDoS attack detection module is responsible for performing coarse-grained detection of network traffic in units of time windows based on the probability detection model generated in the coarse-grained and fine-grained detection model training phase, and outputting the discrimination results to update the knowledge database. (4) The fine-grained DDoS attack detection module is responsible for performing fine-grained detection of network traffic in benign windows in the coarse-grained detection results in units of single traffic flow based on the flow-level detection model generated in the coarse-grained and fine-grained detection model training phase, and outputting the discrimination results to update the knowledge database.

[0074] This invention conducts extensive instance verification on two open encrypted application traffic datasets: the first encrypted application traffic dataset and the Mon(IoT)r encrypted application traffic dataset. First, both datasets are divided into different bidirectional flows based on the five-tuple information (i.e., [source IP, destination IP, source port, destination port, transport layer protocol]). Then, the Ethernet layer in each packet is removed from the datagram, and the IP address is randomized. For the first encrypted application traffic dataset, which contains network traffic generated by 21 encrypted application devices, this invention selects 14 categories to form the first experimental dataset, named AppTrace-I. Similarly, for the Mon(IoT)r encrypted application dataset, which contains the same 26 encrypted applications, 13 categories are selected from these 26 categories to form the second experimental dataset, named AppTrace-II. The specific encrypted application traffic information used in the two datasets is shown in Tables 1 and 2, respectively. For each encrypted application category, this invention randomly selected samples of three thousand flows. In addition, to ensure the reliability of the validation, this invention conducts five-fold cross-validation on two datasets, with the ratio of training set, validation set and test set being three:one:one.

[0075] Table 1: Names of various encrypted application categories and their corresponding byte stream counts in AppTrace-I, where K represents...

[0076]

[0077] Table 2: Names of various encrypted application categories in AppTrace-II and their corresponding byte stream counts, where K represents

[0078]

[0079] The experiment demonstrates the classification performance of different classifiers formed by two hyperparameters, including: (1) different values ​​of message length (using...). (2) Different values ​​of message byte count (using) (to represent); for hyperparameters Its value range is set to {4, 8}. For hyperparameters... The value range is set to {64, 128, 256}. Experiments are conducted under different hyperparameter settings, and the present invention is compared with existing deep learning-based encryption application traffic classification methods under conditions of insufficient network traffic data.

[0080] First, some evaluation metrics were defined. For a metric derived from an encryption application... The generated traffic will be classified by the classifier into four possible outcomes:

[0081] (1) True Positive: Classified by the classifier as Class, and indeed made by cryptographic applications The resulting;

[0082] (2) False Positive: Classified by the classifier as Class, but not by cryptographic applications The resulting;

[0083] (3) True Negative: Classified by the classifier as not belonging to The class, and indeed not by an encrypted application. The resulting;

[0084] (4) False Negative: The classifier classifies a substance as not belonging to the classifier. Class, but it is indeed made by cryptographic applications Produced.

[0085] Based on the four scenarios described above, this invention can define three metrics to evaluate a classifier for cryptographic applications. The classification quality of the generated traffic is quantified by recall, precision, and F-measure, as shown in the following formulas:

[0086]

[0087]

[0088]

[0089] The experimental results of this invention on the two datasets AppTrace-I and AppTrace-II are shown in Table 3 and Table 4, respectively.

[0090] Table 3: Experimental results of this invention on AppTrace-I

[0091]

[0092] Table 4: Experimental results of this invention on AppTrace-II

[0093]

[0094] According to experimental results, for AppTrace-I, the classifier performs well across all... , With these values, recall, precision, and F1 score all ranged from 96.91% to 99.69%. The optimal parameters were... =4, When the value is 256, the corresponding recall, precision, and F1 score are 99.65% (±0.06), 99.69% (±0.04), and 99.67% (±0.06), respectively. For AppDataset-II, the classifier performs well in all... , With these values, recall, precision, and F1 score all ranged from 97.01% to 99.63%. The optimal parameters were... =4, When the number of responses is 256, the corresponding recall, precision, and F1 score are 99.54% (±0.15), 99.61% (±0.10), and 99.63% (±0.12), respectively.

[0095] Table 5: Comparative Experimental Results of Existing Deep Learning-Based Encryption Application Traffic Classification Methods

[0096]

[0097] As can be observed from Table 5, the classification performance of this invention on both experimental datasets is superior to existing deep learning-based classification methods and systems (EBSNN, DeepPacket): the results of this invention are higher than the other two methods in all three evaluation metrics.

[0098] Furthermore, by adding an unknown traffic detection module based on a confidence threshold, traffic with low confidence is classified as unknown device categories, making this invention adaptable to unknown traffic detection tasks. In the experiment, this invention set up two scenarios, A and B. Scenario A treats all device categories in AppTrace-I as known device categories and all device categories in AppTrace-II as unknown categories. Similarly, scenario B takes all device categories belonging to AppTrace-II as known device categories and all device categories belonging to AppTrace-I as unknown categories. The threshold was tentatively set to 0.999 in this invention. The results are shown in Table 6.

[0099] Table 6: Experimental Results of Unknown Flow Detection in this Invention

[0100]

[0101] For scenario A, the recall, precision, and F1 score are 91.69 (±1.45)%, 98.65 (±1.12)%, and 95.04 (±1.25)%, respectively. For scenario B, the recall, precision, and F1 score are 96.80 (±1.01)%, 77.69 (±2.56)%, and 86.20 (±1.87)%, respectively. This demonstrates that the present invention has excellent detection capabilities for unknown traffic. In real-time deployment, the present invention will reject these detected unknown traffic.

Claims

1. A real-time and efficient method for detecting IoT DDoS attacks, characterized in that, This includes both coarse-grained and fine-grained model training phases and DDoS attack traffic detection phases. The coarse-grained and fine-grained model training phase includes three parts: (1) feature extraction of DDoS attack traffic; (2) coarse-grained detection model construction; and (3) fine-grained detection model construction. DDoS attack traffic feature extraction includes the following steps: Step 1) Using a set of known IoT devices' DDoS attacks and benign network traffic as input, obtain partial field information for each data packet; Step 2) Using the packet length of each data packet obtained in Step 1), construct statistical characteristics of network traffic in units of time windows; Step 3) Using the partial field information of each data packet obtained in Step 1), construct the sequence characteristics of network traffic on a per-flow basis; The specific steps for constructing a coarse-grained detection model are as follows: Step 4) Using the network traffic statistical features obtained in Step 2) as input, a coarse-grained detection model is constructed using the random forest algorithm. The statistical feature set of each time window is used as the input of the coarse-grained detection model to obtain the detection results of the time window. The node information is continuously updated through multiple decision trees to obtain the final random forest. The training parameters of the coarse-grained detection model are saved as the output of the probability detection model. The specific steps for constructing a fine-grained detection model are as follows: Step 5) Using the sequence features of network traffic obtained in Step 3) as input, a neural network is used for training to obtain the constructed flow level detection model; the specific operation method is as follows: 5-1) Using the network traffic sequence features obtained in step 3) as input, perform initial feature transformation to obtain the initial feature transformation feature vector; 5-2) Using the network traffic sequence features obtained in step 3) as input, perform an independent convolution operation on each feature to generate the feature weight value for each sequence feature; 5-3) Using the initial feature transformation vectors obtained in steps 5-1) and 5-2) and the feature weight values ​​of the sequence features, perform feature weighted fusion to obtain a weighted feature vector; 5-4) Using the weighted feature vector obtained in step 5-3) as input, the final feature classification vector is obtained through a classification layer and activation function. The semantic information represented by the feature vector value is correlated with DDoS attack traffic and benign network traffic to obtain the detection result of the network traffic. 5-5) Using the detection result set obtained in step 5-4) and real DDoS attacks and benign network traffic as input, calculate the classification accuracy and loss function value. If the indicators meet the termination condition... If the model building process stops and the streaming detection model is output, then stop the model building process and output the streaming detection model; if the metrics do not meet the termination conditions. Then repeat steps 5-2 to 5-5). The DDoS attack traffic detection phase includes the following steps: Step 6) Using the network traffic data to be tested as input, perform a query on the knowledge database; the specific operation method is as follows: The network traffic five-tuple information is stored using whitelist and blacklist policies: source IP address, destination IP address, source port, destination port, and transport layer protocol. Each time network traffic is acquired, it is first checked whether it is in the knowledge database. If it is in the blacklist, it is directly detected as DDoS attack traffic; if it is in the whitelist, it is directly detected as benign traffic. Step 7) Extract features from the network traffic to be tested according to steps 1), 2), and 3) to obtain the statistical and sequence features of the network traffic to be tested; Step 8) Using the network traffic characteristics obtained in Step 7) as input, coarse-grained detection is performed through the probability detection model obtained in Step 4). The detection unit is a time window. Finally, the coarse-grained detection result is obtained, and the knowledge database is updated. Step 9) Using the network traffic sequence features of the benign window obtained in Step 8) as input, fine-grained detection is performed through the flow-level detection model obtained in Step 5). The detection unit is a single network traffic flow. Finally, fine-grained detection results are obtained and the knowledge database is updated.

2. The real-time and efficient IoT DDoS attack detection method as described in claim 1, characterized in that, Step 2) The specific operation method for obtaining network traffic statistical features is as follows: 2-1) For the input network traffic, obtain the set of data packet lengths belonging to the current time window based on the timestamp of the data packets; 2-2) Using the packet length of data packets in the data packet length set as an attribute, construct four-dimensional statistical features, namely, minimum packet length. average package length Standard deviation of package length kurtosis of package length ; 2-3) Mark the time window according to the proportion of DDoS attack data packets in the current time window; if the proportion is greater than a given threshold... If the condition is met, the time window will be marked as a malicious window; otherwise, the time window will be marked as a benign window. 2-4) After processing the current time window, slide to the next time window until all network traffic is captured, and finally obtain the statistical feature set of DDoS attack traffic and benign traffic.

3. The real-time and efficient IoT DDoS attack detection method as described in claim 1, characterized in that, Step 3), the specific operation method for obtaining network traffic sequence features is as follows: 3-1) For the input network traffic, obtain the packet length, IP Flags, and TCP Flags set of the data packets belonging to the current time window based on the timestamp of the data packets; 3-2) Based on the five-tuple: source IP address, destination IP address, source port, destination port, and transport layer protocol, the data packets are split to obtain the packet length sequence, IP Flags sequence, and TCP Flags sequence for each traffic packet; 3-3) After processing the current time window, slide to the next time window until all network traffic is captured, and finally obtain the sequence feature set of DDoS attack traffic and benign traffic.

4. The real-time and efficient IoT DDoS attack detection method as described in claim 1, characterized in that, Step 5-1) The specific operation method for performing initial feature transformation on the network traffic sequence features obtained in step 3) is as follows: 5-1-1) Using the network traffic sequence features obtained in step 3) as input, concatenate the set of packet length sequences of network traffic, the set of IPFlags, and the set of TCP Flags together to form a feature combination set; 5-1-2) Using the feature combination set obtained in step 5-1-1) as input, perform the current dimensionality transformation and form transformation operations using 1D convolution; the kernel size of the convolutional layer used is... The number of channels is ; 5-1-3) After each convolution operation, the ReLU non-linear activation function and data normalization are required to optimize data distribution, accelerate the overall training speed of the neural network, and improve training effect.

5. The real-time and efficient IoT DDoS attack detection method as described in claim 1, characterized in that, Step 5-2) The specific operation method for generating sequence feature weights from the network traffic sequence features obtained in step 3) is as follows: 5-2-1) Using the network traffic sequence features obtained in step 3) as input, perform 1D convolution operations independently on the set of packet length sequences of network traffic, the set of IP Flags, and the set of TCP Flags in three branches; 5-2-2) For the convolution operation in step 5-2-1), each branch contains two 1D convolutional layers: the kernel dimension of the first convolutional layer is... The number of channels in the convolution kernel is ; The kernel dimension of the second 1D convolutional layer is... The number of channels is After the convolution operation, average pooling is used to average the value of the feature vector. 5-2-3) After each branch completes all convolution operations, batch normalization is used to adjust the distribution space of the features formed by the branch; the outputs of the three branches are concatenated to obtain the weight values ​​of the three sequence features.

6. The real-time and efficient IoT DDoS attack detection method as described in claim 1, characterized in that, The specific operation method for the weighted fusion of sequence features in step 5-3) is as follows: For a single network traffic flow, given the set of feature vectors generated by each branch... , Dimensions Branch weight set , Dimensions , Let be the sequence length, i.e., the maximum number of data packets acquired in a single network traffic flow. Then, the feature vector corresponding to this network traffic flow is represented as: Output data The dimension is .

7. The real-time and efficient IoT DDoS attack detection method as described in claim 1, characterized in that, The specific operation method for feature classification in step 5-4) is as follows: 5-4-1) Take the weighted feature vector of network traffic obtained in step 5-3) as input and flatten it into one dimension; 5-4-2) Using the one-dimensional vector obtained in step 5-4-1) as input, a fully connected layer is used to map the feature vector to the network traffic type; the number of fully connected layers and the number of neurons in each layer except the last layer can be set as needed, and the number of neurons in the last layer is... Since the final detection results only show DDoS attack traffic or benign network traffic, Then, the softmax activation function is used to control each value in the result within a certain range. Within the range, the dimension with the largest value represents the detection result of this operation on the network traffic.

8. A real-time and efficient IoT DDoS attack detection system that implements the method described in any one of claims 1-7, characterized in that, It includes modules for DDoS attack traffic feature extraction, coarse-grained detection model construction, and fine-grained detection model construction for the coarse-grained and fine-grained detection model training phases; and modules for knowledge database querying, DDoS attack traffic feature extraction, coarse-grained DDoS attack detection, and fine-grained DDoS attack detection for the DDoS attack traffic detection phase. The DDoS attack traffic feature extraction module is responsible for extracting statistical features at the time window level and sequence features at the single traffic level from the input raw IoT DDoS attack and benign network traffic data. The coarse-grained detection model building module in the coarse-grained detection model training phase is responsible for training the probability detection model based on the statistical characteristics of network traffic using the random forest algorithm in traditional machine learning methods, for use in the DDoS attack traffic detection phase. The fine-grained detection model building module in the coarse-grained detection model training phase is responsible for training the flow-level detection model based on the sequence characteristics of network traffic using deep learning methods and a neural network with sequence feature weights, for use in the DDoS attack traffic detection phase. The knowledge database query module in the DDoS attack traffic detection phase is responsible for intercepting or allowing network traffic based on the five-tuple information of network traffic, using blacklist and whitelist mechanisms. The coarse-grained DDoS attack detection module in the DDoS attack traffic detection phase is responsible for performing coarse-grained detection on network traffic in units of time windows based on the probability detection model generated in the coarse-grained detection model training phase, and outputting the discrimination results and updating the knowledge database. The fine-grained DDoS attack detection module in the DDoS attack traffic detection phase is responsible for performing fine-grained detection on network traffic within the benign window in the coarse-grained detection results, based on the flow-level detection model generated during the coarse-grained detection model training phase, on a per-traffic basis, and outputting the judgment results to update the knowledge database.

Images