DDoS attack cloud edge cooperation defense method and system based on neural network

Abstract

The application discloses a DDoS attack cloud-edge cooperation defense method and system based on a neural network, wherein a plurality of SOM models are trained in the cloud, an optimal SOM output layer structure is determined by means of entropy measurement, a network controller in an SDN is registered in advance in the cloud, model parameters are issued and deployed to the SDN network controller registered in advance in the cloud, the traffic of the physical equipment of the edge of the network is detected and screened in multiple stages in a time manner, the network traffic is divided into three types of normal, abnormal and suspicious by the SOM model, and the network traffic of the suspicious type is further identified in a fine-grained manner by a KD tree. The SOM training and DDoS detection method based on the cloud-edge cooperation is suitable for an industrial internet scene of an SDN network architecture, can effectively detect the incoming network packets in real time on the basis of reasonably utilizing the computing power of the physical resources of the edge network, and improves the identification accuracy.

Description

Technical Field

[0001] This invention belongs to the field of network security incident detection, and in particular relates to a cloud-edge collaborative defense method and system for DDoS attacks based on neural networks. Background Technology

[0002] Software-defined networking (SDN) separates the control plane from the data plane, with routing algorithms implemented in a centralized framework and switches only handling forwarding, thus enabling programmable, flexible, and reliable network services. Today, SDN, combined with edge computing, is being applied in the Industrial Internet. As the number of devices connected to the internet continues to increase, SDN's centralized control framework makes it vulnerable to large-scale DDoS attacks such as buffer saturation and flow table overflows. Therefore, defending against large-scale DDoS attacks is a current challenge for network security, making network traffic inspection paramount.

[0003] Current DDoS detection schemes for SDN networks are mainly divided into statistical schemes, machine learning-based schemes, and artificial neural network-based schemes.

[0004] Non-patent literature 1 (RF Fouladi, et al., “A DDoS attack detection and defense scheme using time-series analysis for SDN,” Journal of Information Security and Applications, vol. 54, 2020.) uses filters and sets dynamic thresholds to detect real-time abnormal changes. Although the scheme is efficient and direct, improper threshold settings in statistical methods can affect the judgment results.

[0005] Non-patent literature 2 (RFFouladi, et al., “A DDoS attack detection and defense scheme using time-series analysis for SDN,” Journal of Information Security and Applications, vol.54, 2020.) deployed a KNN-based detector in the edge network controller, which can achieve high-precision anomaly detection. However, it introduces a large detection delay due to the need to calculate distance and places a significant computational burden on the edge network controller.

[0006] Non-patent literature 3 (TMNam, PHPhong, TDKhoa et al., “Self-organizing map-based approaches in DDoS flooding detection using SDN,” 2018.) combines SOM with KNN to improve SOM detection accuracy. However, the topology of the SOM map needs to be set manually, which can affect the detection results.

[0007] Based on the information in the above literature, there are still many problems in the current DDoS detection schemes of SDN networks. Among them, the setting of important parameter thresholds relies heavily on human experience, which has a significant impact on the final accuracy. In addition, the detection method has a large computational burden and high detection latency. Summary of the Invention

[0008] The purpose of this invention is to address the problems of low accuracy, excessive edge network control resources consumed by model training, and high detection latency in existing SOM-based DDoS attack handling methods. It proposes an SDN cloud-edge collaborative identification system for DDoS attacks based on information entropy SOM, which solves the difficulty of selecting the topology structure of traditional SOM neurons and improves the accuracy of SOM detection.

[0009] The objective of this invention is achieved through the following steps:

[0010] S1. Preprocessing the DDoS traffic dataset: For the M nodes in the DDoS traffic dataset, filter the network traffic features to obtain the feature variables of each node, and compress the feature values;

[0011] S2. Determine the range of the number of neurons in the trained SOM output layer topology based on the ideal number of clusters in the DDoS traffic dataset.

[0012] S3. Create the SOM model and train it to obtain the parameters of the trained SOM model.

[0013] S4. Filter the trained SOM model parameters by the data mapping type and the inaccuracy coefficient of the SOM model to obtain the optimal SOM model parameters.

[0014] S5. Model the weight coordinates of the output layer neurons of the SOM model according to the Euclidean distance using a KD tree.

[0015] S6. Package and distribute the trained SOM model parameters, KD tree, and sets of neurons of different mapping types to the controller cluster of the SDN edge network.

[0016] S7. Standardize the acquired network traffic characteristics and send them to the controller cluster for traffic type determination.

[0017] Furthermore, the network traffic characteristics specifically include: protocol name, destination port, network flow duration, average packet size (APS), network packet transmission rate (PR), and network flow byte transmission rate (BR), where APS, PR, and BR are calculated using the following formulas:

[0018]

[0019]

[0020]

[0021] Further, the specific steps in S2 are as follows: The training dataset is divided into groups 1 to k using the K-means++ clustering algorithm. m There are *i* clusters, and a sample point is randomly selected from the DDoS traffic dataset. The i-th cluster is denoted as C. i The corresponding cluster center point is denoted as U. i Define the clustering coefficient SSE k For each cluster C i From the point in the cluster to its cluster center U i The sum of the distances reflects the degree of clustering in this cluster:

[0022]

[0023] Based on the elbow method, the lower bound of the search range of the SOM model is taken as the point where the clustering coefficient decreases the most, denoted as α, and is calculated by the following formula:

[0024]

[0025] The upper bound of the SOM model search range is taken as the point where the clustering coefficient decreases gradually, denoted as β, and is calculated by the following formula:

[0026]

[0027] Furthermore, the creation of the SOM model includes: creating a two-dimensional output layer topology S = L*R satisfying α ≤ S ≤ β, and for each neuron W i The 6-dimensional variable is assigned a random initial value W. i =(w i1 ,w i2 ,w i3 ,w i4 …w6)1≤i≤S.

[0028] Furthermore, the specific steps for training the SOM are as follows:

[0029] For each SOM model within the range, train the model. Calculate the distance from each node to a neuron in the training dataset. Take the neuron with the minimum distance as the weight of the mapping neuron, denoted as W. z The formula for calculating the distance from each node to the neuron is as follows:

[0030] Dis(U i -W i )=‖U i -W i ||;

[0031] For U i The weights of each mapped neuron are updated based on the neighborhood aggregation function η and the learning rate α:

[0032] W z (t+1)=W z (t)+η(t)*α(t)(U i (t)-W z (t)).

[0033] Furthermore, the specific steps for filtering the parameters of the trained SOM model are as follows:

[0034] Based on the label of each data point in the training set, the network traffic type is statistically mapped, and the quantity of normal traffic is denoted as a. i The number of abnormal traffic instances is denoted as b. i ENT is calculated based on the information entropy function. i Used to measure the number of neurons W in each SOM model i The mapping type, the greater the information entropy, the greater the mapping uncertainty of the neuron, when a i =b i When ENT = 0, the neuron is not mapped to any data in the training set. i Denoteed as 1, the uncertain right boundary is The information entropy function is:

[0035]

[0036] When ENT i When a ∈ [0,T], if i <b i The neuron mapping type is abnormal network traffic; if a i >b i The neuron in this case is mapped to normal traffic; the neuron in other cases is mapped to suspicious traffic and needs to be judged a second time; the set of neurons for normal network traffic is denoted as NN, the set of neurons for abnormal network traffic is denoted as AN, and the set of neurons for suspicious network traffic is denoted as SN.

[0037] Define the inaccuracy coefficient SF L*R The accuracy of each SOM model is calculated, and the SOM model with the lowest inaccuracy coefficient is selected as the final application model. The total number of neurons in the output layer is N = L * R. The formula for calculating the uncertainty coefficient is as follows:

[0038]

[0039] Furthermore, the specific steps in S5 are as follows:

[0040] S51. Based on the Euclidean distance, model the output layer neuron weight coordinates of the SOM model using a KD tree, and calculate the W of each neuron according to the following formula. i Weight value per dimension w ij Let k be the feature dimension with the largest variance.

[0041]

[0042] S52. Let the set of N neurons in the output layer be denoted as W = {W1, W2, ... W...} N Arrange the N neurons in ascending order according to the weight values ​​of the k-th dimension, and calculate the median m of the weight values ​​of the k-th dimension in the set;

[0043] S53. Divide the neurons of the output layer into two parts according to the weight of the k-th dimension of the set. Specifically, the points with the weight value of the k-th dimension greater than m form a subset of neurons; the neurons with the weight value less than or equal to m form another subset of neurons, and store them in the first leaf node of the KD tree.

[0044] S54. Repeat the operations of S52-S53 for the two obtained subsets of neurons and store them in the leaf nodes of the next generation until they can no longer be divided.

[0045] Furthermore, the step of sending the acquired network traffic to the controller cluster for traffic type determination specifically involves:

[0046] The edge network controller periodically retrieves network traffic from its subordinate OpenFlow switches, extracts the required network traffic features, and standardizes them into a 6-dimensional vector V. i The data is sent to the discriminator for judgment.

[0047] The neuron that matches the vector in the output layer of the SOM is the neuron with the smallest Euclidean distance, denoted as W. i :

[0048] If W i ∈NN, this traffic is normal network traffic;

[0049] If W i ∈AN, this traffic is abnormal network traffic;

[0050] If it does not belong to AN and NN, it is marked as suspicious traffic;

[0051] For questionable traffic, search the KD tree to find the g closest neuron nodes: g is a predefined hyperparameter;

[0052] If more than (g-1) / 2 of these nodes belong to the NN, then the traffic is marked as normal traffic.

[0053] Other situations are marked as abnormal traffic;

[0054] Network traffic marked as normal is allowed to pass, while network traffic marked as abnormal is blocked. The source IP address and source MAC address in the attack flow are used as matching fields to modify the corresponding action attribute in the flow table. The modified flow table is then sent to the OpenFlow switch to discard the attack flow.

[0055] On the other hand, this invention also provides a system for implementing a cloud-edge collaborative defense method against DDoS attacks based on neural networks, the system including a cloud model training module and an edge controller identification module;

[0056] The cloud-based model training module is used to determine the range of the number of neurons in the output layer topology of the trained SOM based on the ideal number of clusters in the DDoS traffic dataset; create and train the SOM model to obtain the trained SOM model parameters; filter the trained SOM model parameters by the data mapping type and the inaccuracy coefficient of the SOM model to obtain the optimal SOM model parameters; and model the output layer neuron weight coordinates of the SOM model according to the Euclidean distance using a KD tree.

[0057] The edge controller identification module is used to standardize the acquired network traffic characteristics and determine the traffic type.

[0058] Furthermore, the edge controller authentication module includes the following four sub-modules:

[0059] Network flow collection module: Used to communicate with the switch periodically to collect flow information, including IP protocol, IP source / destination address, source / destination port, number of received packets, number of received bytes, and duration. This flow information will be transmitted to the feature extractor for feature calculation, which helps to identify attack traffic.

[0060] Feature extraction module: Used to extract feature vectors from collected traffic information, calculate average packet size (APS), packet transmission rate (PR), and stream byte transmission rate (BR), and together with protocol name, destination port, and stream duration, form a 6-dimensional feature vector; network flows are classified through flow feature vectors, and the elements of the flow feature vectors are interconnected, collectively reflecting network state characteristics;

[0061] Anomaly detection module: Used to work with the improved SOM model and KD tree to detect network traffic; it consists of two stages: traffic classification and suspicious traffic filtering based on the SOM model, and suspicious traffic identification based on the KD tree.

[0062] Anomaly blocking execution module: When the anomaly detection module detects abnormal traffic, it sends the attack traffic information to the anomaly blocking execution module. The module uses the source IP address and source MAC address in the attack flow as matching fields, modifies the corresponding action attribute in the flow table, and sends the modified flow table to the OpenFlow switch to drop the attack flow.

[0063] The beneficial effects of this invention are:

[0064] In the DDoS detection process, a cloud-edge collaboration model can decouple the heavyweight model parameter calculation process from the lightweight network traffic detection process, thereby reducing the burden on the controller. Furthermore, the uncertainty calculation of information entropy is used to select the optimal training model from multiple SOM network topologies, reducing the impact of model initialization parameters on the final detection. Finally, in real-time network detection, KD-trees are deployed in the edge network controller instead of the traditional KNN clustering algorithm, avoiding the need to calculate distances between different points and accelerating matching efficiency. Attached Figure Description

[0065] Figure 1 A flowchart of a cloud-edge collaborative defense method for DDoS attacks based on neural networks provided in this embodiment of the invention;

[0066] Figure 2 A flowchart of the SOM model training phase provided in an embodiment of the present invention;

[0067] Figure 3 A flowchart of the detection stage provided in an embodiment of the present invention;

[0068] Figure 4 The overall system architecture diagram provided for embodiments of the present invention;

[0069] Figure 5 This is a network topology diagram for the application scenario. Detailed Implementation

[0070] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0071] like Figure 1 As shown, the overall execution flow of the method of the present invention is as follows:

[0072] S1. Preprocessing the CICDDoS2019 dataset: For the M nodes in the DDoS traffic dataset, filter the network traffic features to obtain the feature variables of each node, and compress the feature values;

[0073] For N nodes in a DDoS traffic dataset stored in the database, filter the network traffic based on six characteristics: protocol name, destination port, network flow duration, average packet size (APS), packet transmission rate (PR), and network flow byte transmission rate (BR). The formulas for calculating APS, PR, and BR are as follows:

[0074]

[0075]

[0076]

[0077] Get each node V i 6-dimensional variable (v) i1 ′,v i2 ′,v i3 ′…v i6 ′), and assign each dimension feature value v ij The formula for compressing a value into the range of 0 to 1 is as follows:

[0078]

[0079] S2. Determine the range of the number of neurons in the trained SOM output layer topology based on the ideal number of clusters in the DDoS traffic dataset.

[0080] The range of the number of neurons in the SOM output layer topology during training should be determined by the ideal number of clusters in the DDoS traffic dataset. Here, we divide the training dataset into 1 to k clusters using the K-means++ clustering algorithm. m For each cluster, the specific steps are as follows:

[0081] Randomly select a sample point from the DDoS traffic dataset.

[0082] The i-th cluster is denoted as C. i The corresponding cluster center point is denoted as U. i Define the clustering coefficient SSE k For each cluster C i From the point in the cluster to its cluster center U iThe sum of the distances reflects the degree of clustering in this cluster:

[0083]

[0084] Based on the elbow method, the lower bound of the search range of the SOM model is taken as the point where the clustering coefficient decreases the most, denoted as α, and is calculated by the following formula:

[0085]

[0086] The upper bound of the SOM model search range is taken as the point where the clustering coefficient decreases gradually, denoted as β, and is calculated by the following formula:

[0087]

[0088] The ideal range of cluster centers for the DDoS traffic dataset is determined by using the K-means++ clustering algorithm and the rate of decrease of the sum of the distances of each sample point from its respective center point. This determines the search space of the SOM output layer, i.e., the range of the number of neurons in the output layer. Within the search space, training samples are input into the SOM classifier. The number of abnormal and normal samples mapped in each neuron is counted. The mapping type of each neuron is determined based on entropy measurement, which is divided into three categories: abnormal, normal, and questionable. Custom parameters are used to statistically measure the uncertainty and accuracy of the model, thereby selecting the optimal SOM output layer topology and model.

[0089] S3. Create the SOM model and train it to obtain the parameters of the trained SOM model.

[0090] Create a two-dimensional output layer topology S = L*R satisfying α ≤ S ≤ β, and for each neuron W i The 6-dimensional variable is assigned a random initial value W. i =(w i1 ,w i2 ,w i3 ,w i4 …w6)1≤i≤S;

[0091] like Figure 2 As shown, the SOM model is trained for each node within the range. In the training dataset, the distance from each node to a neuron is calculated, and the neuron with the minimum distance is taken as the weight of the mapping neuron, denoted as W. z The formula for calculating the distance from each node to the neuron is as follows:

[0092] Dis(U i -W i )=‖U i -W i ||;

[0093] For Ui The weights of each mapped neuron are updated based on the neighborhood aggregation function η and the learning rate α:

[0094] W z (t+1)=W z (t)+η(t)*α(t)(U i (t)-W z (t));

[0095] The steps of creating and training each initial SOM model within the search range are performed to obtain the final output model Δ. i .

[0096] S4. Filter the trained SOM model parameters by the data mapping type and the inaccuracy coefficient of the SOM model to obtain the optimal SOM model parameters.

[0097] Based on the label of each data point in the training set, the network traffic type is statistically mapped, and the quantity of normal traffic is denoted as a. i The number of abnormal traffic instances is denoted as b. i The ENT is calculated based on the following information entropy function. i Used to measure the number of neurons W in each SOM model i The mapping type, the greater the information entropy, the greater the mapping uncertainty of the neuron, when a i =b i When ENT = 0, the neuron is not mapped to any data in the training set. i Denoteed as 1, the uncertain right boundary is The set of neurons for normal network traffic is denoted as NN, the set of neurons for abnormal network traffic is denoted as AN, and the set of neurons for questionable network traffic is denoted as SN.

[0098]

[0099] When ENT i When a ∈ [0,T], if i <b i The neuron mapping type is abnormal network traffic; if a i >b i In this case, the neuron's mapping type is normal traffic; in other cases, the neuron's mapping type is considered suspicious traffic and requires secondary judgment.

[0100] Define the inaccuracy coefficient SF L*R The accuracy of each SOM model is calculated, and the SOM model with the lowest inaccuracy coefficient is selected as the final application model. The total number of neurons in the output layer is N = L * R. The formula for calculating the uncertainty coefficient is as follows:

[0101]

[0102] S5. Model the weight coordinates of the output layer neurons of the SOM model according to the Euclidean distance using a KD tree.

[0103] A KD-tree is constructed based on the neuron weight coordinates of the output layer of the SOM model. The KD-tree is an improvement on KNN. A balanced binary tree is constructed recursively to store the training data. Due to the large number of features in the DDoS traffic dataset, the binary tree divides the entire feature space into specific parts for fast query operations. The specific steps are as follows:

[0104] The output layer neuron weight coordinates of the SOM model are modeled using a KD tree based on Euclidean distance, and the W value of each neuron is calculated according to the following formula. i Weight value per dimension w ij Let k be the feature dimension with the largest variance.

[0105]

[0106] Let the set of N neurons in the output layer be denoted as W = {W1, W2, ... W...} N Arrange the N neurons in ascending order according to the weight values ​​of the k-th dimension, and calculate the median m of the weight values ​​of the k-th dimension in the set;

[0107] The neurons in the output layer are divided into two groups based on the weights in the k-th dimension of the set. Specifically, neurons with weights greater than m in the k-th dimension form one subset of neurons, and neurons with weights less than or equal to m form the other subset of neurons. These subsets are then stored in the initial leaf nodes of the KD-tree.

[0108] Repeat the above operation for the two subsets of neurons obtained and store them in the leaf nodes of the next generation until they can no longer be divided.

[0109] S6. Package and distribute the trained SOM model parameters, KD tree, and sets of neurons of different mapping types to the controller cluster of the SDN edge network.

[0110] After the cloud model training initialization is completed, the trained SOM model parameters, the sets of neurons AN, SN, NN, and the constructed KD tree are packaged and distributed to the controller cluster of the SDN edge network to complete the preparation work for network traffic detection.

[0111] S7. Standardize the acquired network traffic characteristics and send them to the controller cluster for traffic type determination.

[0112] like Figure 3As shown, the specific process is as follows: The edge network controller periodically pulls network traffic from the OpenFlow switches under its jurisdiction, extracts the required network traffic features, and standardizes them into a 6-dimensional vector V. i The data is sent to the discriminator for judgment.

[0113] The neuron that matches the vector in the output layer of the SOM is the neuron with the smallest Euclidean distance, denoted as W. i :

[0114] If W i ∈NN, this traffic is normal network traffic;

[0115] If W i ∈AN, this traffic is abnormal network traffic;

[0116] If it does not belong to AN and NN, it is marked as suspicious traffic;

[0117] For suspicious traffic, search the KD tree to find the g closest neuron nodes: g is a predefined hyperparameter. If more than (g-1) / 2 of these nodes belong to the NN, the traffic is marked as normal traffic.

[0118] Other situations are marked as abnormal traffic;

[0119] Network traffic marked as normal is allowed to pass, while network traffic marked as abnormal is blocked. The source IP address and source MAC address in the attack flow are used as matching fields to modify the corresponding action attribute in the flow table. The modified flow table is then sent to the OpenFlow switch to discard the attack flow.

[0120] On the other hand, embodiments of the present invention also provide a system for implementing a cloud-edge collaborative defense method against DDoS attacks based on neural networks, such as... Figure 4 As shown, the entire system is divided into a cloud training module and an edge controller identification module, with the OpenFlow switch below accepting and forwarding network traffic from various locations;

[0121] The cloud-based model training module is used to determine the range of the number of neurons in the output layer topology of the trained SOM based on the ideal number of clusters in the DDoS traffic dataset; create and train the SOM model to obtain the trained SOM model parameters; filter the trained SOM model parameters by the data mapping type and the inaccuracy coefficient of the SOM model to obtain the optimal SOM model parameters; and model the output layer neuron weight coordinates of the SOM model according to the Euclidean distance using a KD tree.

[0122] The edge controller identification module is used to standardize the acquired network traffic characteristics and determine the traffic type.

[0123] like Figure 3 As shown, when using a KD-tree to perform secondary judgment on abnormal traffic in the controller of the edge network, the KD-tree constructs a secondary judgment on network traffic with questionable detection results based on the 6-dimensional vector coordinates of each neuron. It constructs a binary tree to divide the entire feature space into specific parts for fast query operation, finds the g closest neuron nodes (g is a predefined hyperparameter), and if more than (g-1) / 2 of these nodes belong to the normal neuron set, the traffic is marked as normal traffic; otherwise, it is marked as abnormal traffic.

[0124] Furthermore, the edge controller authentication module includes the following four sub-modules:

[0125] Network flow collection module: Used to communicate with the switch periodically to collect flow information, including IP protocol, IP source / destination address, source / destination port, number of received packets, number of received bytes, and duration. This flow information will be transmitted to the feature extractor for feature calculation, which helps to identify attack traffic.

[0126] Feature extraction module: Used to extract feature vectors from collected traffic information, calculate average packet size (APS), packet transmission rate (PR), and stream byte transmission rate (BR), and together with protocol name, destination port, and stream duration, form a 6-dimensional feature vector; network flows are classified through flow feature vectors, and the elements of the flow feature vectors are interconnected, collectively reflecting network state characteristics;

[0127] Anomaly detection module: Used to work with the improved SOM model and KD tree to detect network traffic; it consists of two stages: traffic classification and suspicious traffic filtering based on the SOM model, and suspicious traffic identification based on the KD tree.

[0128] Anomaly blocking execution module: When the anomaly detection module detects abnormal traffic, it sends the attack traffic information to the anomaly blocking execution module, uses the source IP address and source MAC address in the attack flow as matching fields, modifies the corresponding action attribute in the flow table, and sends the modified flow table to the OpenFlow switch to drop the attack flow.

[0129] like Figure 5As shown, the patent's application scenarios are clearly and specifically described, dividing the overall business architecture into an application layer, a control plane, and a data plane. The application layer deploys a cloud server cluster for model training. The control plane includes a centralized controller for the edge network, which registers with and receives model parameters from the application layer and deploys edge network detection modules. In addition, the centralized controller manages the data plane switches via the OpenFlow protocol and uses embedded points to monitor network traffic information in real time. The data plane switches connect computers in multiple network environments, forwarding, routing, and intercepting network traffic.

[0130] This invention utilizes an SDN communication method to intercept DDoS attack traffic near the attack source, based on a cloud-edge dual-layer architecture for device access. It decouples the computational resources for SOM model training and inference through cloud-edge collaboration, enabling the cloud server to train model parameters and the SDN control layer to compute, infer, and classify network traffic. An SDN network comprises three architectural layers: the SDN application layer, the SDN controller layer, and the underlying physical network. The SDN network employs a control plane and data plane separation architecture. The controller layer contains several programmable centralized controllers, each managing several switches in the underlying physical network. This allows traditional switches to retain only basic traffic forwarding functions, while routing and other functions are transferred to the centralized controller. Communication between the controller and switches is via the OpenFlow network protocol. The SDN controller issues control commands, and the switches modify their flow table entries upon receiving commands to forward network data. This centralized supervisory control layer facilitates network traffic management, issuing control commands, and remotely controlling terminal devices, while utilizing the computing power of the SDN edge network controller for network traffic detection.

[0131] The above embodiments are used to explain and illustrate the present invention, but not to limit the present invention. Any modifications and changes made to the present invention within the spirit and scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A neural network-based DDos attack cloud-edge collaborative defense method, characterized in that, The method comprises the following steps: S1, preprocessing the DDoS flow data set: selecting M nodes in the DDoS flow data set, screening network flow features, obtaining feature variables of each node, and compressing the feature values; S2, determining the neuron number range in the SOM output layer topology of the training from the ideal cluster number of the DDoS flow data set; S3, creating a SOM model and performing cloud training to obtain trained SOM model parameters; S4, screening the trained SOM model parameters through the mapping type of data and the inaccuracy coefficient of the SOM model to obtain optimal SOM model parameters; S5, modeling the output layer neuron weight coordinates of the SOM model according to the Euclidean distance; the specific steps are as follows: S51, according to the Euclidean distance, the output layer neuron weight coordinates of the SOM model are modeled according to a KD tree, and the weight of each neuron W is calculated according to the following formula i The variance of each weight value w ij of each dimension, and the feature dimension with the maximum variance is recorded as k; S52, the set of N neurons of the output layer is denoted as W = {W1, W2, … WN}, and the N neurons are arranged in ascending order according to the size of the weight values in the kth dimension, and the median m of the weight values in the kth dimension in the set is calculated. N} S53, dividing the output layer neurons into two parts according to the kth weight of the set, specifically: the points with the kth weight value greater than m constitute a neuron subset; the neurons with the kth weight value less than or equal to m constitute another neuron subset, which is stored in the primary leaf node of the KD tree; S54, repeating the operations of S52-S53 for the two obtained neuron subsets and storing them in the next generation of leaf nodes until they cannot be further divided; S6, packaging and distributing the trained SOM model parameters, the KD tree and the neuron set of different mapping types to the controller cluster of the SDN edge network; S7, standardizing the obtained network flow features and sending them to the controller cluster for flow type judgment and attack flow processing; the sending to the controller cluster for flow type judgment specifically comprises: The edge network controller periodically pulls the network traffic in the OpenFlow switch under its jurisdiction, extracts the required network traffic features and normalizes them into a 6-dimensional vector V i , which is sent to the discriminator for judgment. The matching neuron in the SOM output layer, i.e. the neuron with the smallest Euclidean distance to the vector, is calculated and denoted as W i : If W i ∈NN, the traffic is normal network traffic; If W i ∈ AN, the traffic is abnormal network traffic; If it does not belong to AN and NN, it is marked as suspicious flow; NN is the neuron set of normal network flow, and AN is the neuron set of abnormal network flow; For suspicious flow, g closest neuron nodes are found in the KD tree: g is a hyperparameter defined in advance; If more than (g-1) / 2 nodes belong to NN, the flow is marked as normal flow; In other cases, it is marked as abnormal flow; The network flow marked as normal is released, and the network flow marked as abnormal is intercepted; the source IP address and source MAC address in the attack flow are taken as matching fields, the corresponding action attribute in the flow table is modified by the matching fields, and the modified flow table is sent to the OpenFlow switch to discard the attack flow.

2. The neural network-based cloud-edge collaborative defense method against DDos attacks according to claim 1, characterized in that, The network flow features specifically include: protocol name, destination port, network flow duration, average packet size APS, packet transmission rate PR, and network flow byte transmission rate BR, wherein the calculation formulas of APS, PR and BR are as follows:

3. The neural network-based cloud-edge collaborative defense method against DDos attacks according to claim 1, characterized in that, The specific steps in S2 are as follows: The DDoS traffic dataset is divided into groups 1 to k using the K-means++ clustering algorithm. m There are *i* clusters, and a sample point is randomly selected from the DDoS traffic dataset. The i-th cluster is denoted as C. i The corresponding cluster center point is denoted as U. i Define the clustering coefficient SSE k For each cluster C i From the point in the cluster to its cluster center U i The sum of the distances reflects the degree of clustering in this cluster: Based on the elbow method, the lower bound of the SOM model search range is taken as the point at which the clustering coefficient decreases the fastest, denoted as α, and calculated by the following formula: The upper bound of the SOM model search range is taken as the point at which the clustering coefficient decreases gently, denoted as β, and calculated by the following formula:

4. The neural network-based DDos attack cloud-edge collaboration defense method according to claim 3, characterized in that, The creating SOM model includes: creating SOM two-dimensional output layer topology S=L*R satisfying α≤S≤β, and giving each neuron W i of 6-dimensional variable a random initial value W i =(w i1 ,w i2 ,w i3 ,w i4 …w6)1≤i≤S.

5. The neural network-based cloud-edge collaborative defense method against DDos attacks according to claim 1, characterized in that, The specific steps for training the SOM are as follows: The SOM model of each in the range is trained, the distance of each node in the DDos flow data set to the neuron is calculated, the neuron taking the minimum value of the distance is taken as the weight of the mapping neuron, denoted as W z The formula for calculating the distance of each node to the neuron is as follows: Dis(U i -W i ) = ‖U i -W i ‖; For U i Update the weights of each mapping neuron according to the neighborhood aggregation function η and the learning rate α: W z (t+1) = W z (t) + η(t) * α(t) * (U i (t) - W z (t)).

6. The neural network-based cloud-edge collaboration defense method against DDos attacks according to claim 1, characterized in that, The specific screening of the trained SOM model parameters is as follows: According to the label of each data in the training set, the normal traffic quantity is recorded as a i , the abnormal traffic quantity is recorded as b i , the information entropy function is used to calculate ENT i , which is used to measure the mapping type of the neuron W i in each SOM model. When the information entropy is larger, the mapping uncertainty of the neuron is larger. When a i =b i =0, the neuron is not mapped to any data in the training set, and ENT i is recorded as 1. The right boundary of uncertainty is The information entropy function is: When ENT i ∈[0,T], if a i <b i The neuron mapping type is abnormal network traffic; if a i >b i , the neuron mapping type is normal traffic; in the remaining cases, the mapping type of the neuron is suspicious traffic, which needs to be judged again; the neuron set of normal network traffic is denoted as NN, the neuron set of abnormal network traffic is denoted as AN, and the neuron set of suspicious network traffic is denoted as SN; Definition of inaccurate coefficient SF L*R For calculating the accuracy of each SOM model, the SOM model with the lowest inaccurate coefficient is taken as the final application model, and the total number of output layer neurons is N = L * R. The formula for calculating the inaccurate coefficient is as follows: 7.A neural network based DDos attack cloud-edge collaborative defense system for implementing the method of any one of claims 1-6. The system adopts a cloud model training module and an edge controller identification module. The cloud model training module is configured to determine a neuron quantity range in a SOM output layer topology of training according to an ideal cluster quantity of a DDos traffic data set; A SOM model is created and trained in the cloud to obtain trained SOM model parameters; the trained SOM model parameters are screened through a mapping type of data and an inaccuracy coefficient of the SOM model to obtain optimal SOM model parameters; and output layer neuron weight coordinates of the SOM model are modeled according to a Euclidean distance and a KD tree; The edge controller identification module is configured to standardize the obtained network traffic features, perform traffic type judgment, and process attack traffic. 8.The neural network based DDos attack cloud-edge collaboration defense system of claim 7, wherein, The edge controller identification module includes the following four sub-modules: A network stream collection module is configured to communicate with a switch at a regular time, collect stream information including an IP protocol, IP source / desination address, source / desination port, received packet number, received byte number, and time length, and transmit the stream information to a feature extractor to calculate features, which helps to identify attack traffic; A feature extraction module is configured to extract a feature vector from the collected traffic information, calculate an average network packet size APS, a network packet transmission rate PR, and a network stream byte transmission rate BR, and a protocol name, a destination port, and a network stream duration to jointly constitute a 6-dimensional feature vector; network streams are classified through the stream feature vector, and elements of the stream feature vector are interrelated and jointly reflect network state features; An anomaly detection module is configured to work with an improved SOM model and a KD tree to detect network traffic; The anomaly detection module includes two stages, i.e., a traffic classification and suspicious traffic filtering stage based on the SOM model and a suspicious traffic identification stage based on the KD tree; An anomaly blocking execution module is configured to send information of attack traffic to the anomaly blocking execution module when the anomaly detection module finds abnormal traffic; the anomaly blocking execution module is configured to take a source IP address and a source MAC address in attack stream as matching fields, modify a corresponding action attribute in a stream table, and send the modified stream table to an OpenFlow switch to discard the attack stream.

Images