Ldos concealment attack detection method and device based on hierarchical features

Abstract

The application discloses a kind of LDoS covert attack detection method and device based on hierarchical features.The method includes based on semi-supervised spectral clustering model, normal traffic data is screened out, wherein the semi-supervised spectral clustering model is constructed according to LDoS attack packet macro feature, to represent the overall distribution of traffic data in a attack pulse time;After normal traffic data is screened out, the remaining traffic data is monitored based on the preset traffic time sequence of unsupervised LDoS attack, wherein the preset traffic time sequence is constructed by LDoS attack packet feature, for representing the specific features of each packet along with time sequence in a pulse time;According to the unsupervised LDoS attack monitoring, the LDoS covert attack detection result is obtainedThe application solves the technical problem that LDoS attack cannot be detected well. Through the two-layer LDoS attack feature description based on the application, LDoS covert attack detection is realized.

Description

Technical Field

[0001] This application relates to the field of network security, and more specifically, to a method and apparatus for detecting LDoS covert attacks based on hierarchical features. Background Technology

[0002] LDoS attacks are highly stealthy and destructive attacks.

[0003] It is necessary to accurately detect LDoS attacks and implement rapid defense.

[0004] There is currently no effective solution to the problem that related technologies cannot effectively detect LDoS attacks. Summary of the Invention

[0005] The main objective of this application is to provide a method and apparatus for detecting LDoS covert attacks based on hierarchical features, so as to solve the problem of the inability to detect LDoS attacks effectively.

[0006] To achieve the above objectives, according to one aspect of this application, a method for detecting LDoS covert attacks based on hierarchical features is provided.

[0007] The LDoS covert attack detection method based on hierarchical features according to this application includes:

[0008] Based on a semi-supervised spectral clustering model, normal traffic data is filtered out. The semi-supervised spectral clustering model is constructed according to the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse.

[0009] After filtering out normal traffic data, the remaining traffic data is subjected to unsupervised LDoS attack monitoring based on a preset traffic time series. The preset traffic time series is constructed through features within LDoS attack packets and is used to characterize the specific features of each packet in the time series within a pulse time.

[0010] The LDoS covert attack detection results are obtained based on the unsupervised LDoS attack monitoring.

[0011] Furthermore, the step of filtering out normal traffic data based on the semi-supervised spectral clustering model also includes: using the semi-supervised spectral clustering model to strengthen the supervision information of positive samples, removing outliers on the positive sample side, and filtering out most of the normal traffic data; the step of performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out the normal traffic data also includes: using the features within the traffic packets to construct a traffic time series for the remaining traffic data to achieve anomaly classification.

[0012] Furthermore, the macroscopic features of the LDoS attack packet include at least one of the following: available bandwidth percentage, small packet ratio, packet loss rate, flow duration, maximum packet, minimum packet, average packet value, and average / standard deviation of the time between sent packets; the internal features of the LDoS attack packet include at least one of the following: source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, whether it contains FIN, etc.

[0013] Furthermore, the step of filtering out normal traffic data based on the semi-supervised spectral clustering model includes: the step of constructing positive sample supervision information, which includes:

[0014] Perform simple clustering on the dataset to obtain the clustering result Q. int The category with the largest number of elements is selected and marked as the normal category of interest. The initialization limit for the number of supervisory information elements is M; the initialization set A is empty, and Q... int A certain number of positive samples are determined and added to set S; the current number of supervisory information items m = 0 is initialized.

[0015] When m ≤ M / 2, select the point x that is farthest from set A, i.e., x|d(x,A)=max(d y∈A (x,y)); Query whether x belongs to the positive sample. If it does, randomly select a point y from set A to construct a constraint supervision set 1, m = m + 1;

[0016] When M / 2 < m ≤ M, select the point x that is closest to set A, i.e., x|d(x,A) = min(d y∈A (x,y)), query whether x does not belong to the positive sample. If it does not belong, randomly select a point y from the subset A to construct a set of constraint supervision information 2, m=m+1;

[0017] Repeat the above steps to complete the construction of positive sample supervision information sets 1 and 2.

[0018] Furthermore, the step of filtering out normal traffic data based on a semi-supervised spectral clustering model includes: steps based on a semi-supervised spectral clustering algorithm.

[0019] The steps of the semi-supervised spectral clustering algorithm include:

[0020] Calculate the Euclidean distance between two points in the dataset. Form the distance matrix D;

[0021] Based on positive sample supervision information, outliers on the positive sample side are corrected, where if (x) i ,x j If ) belongs to set 1, then dist ij =0; if (xi ,x j If ) belongs to set 2, then dist ij =max(max(D) i ),max(D j ));

[0022] Construct a diagonal matrix S, The standardized Laplace matrix is ​​then P = S -1 / 2 (DS)S 1 / 2 Then, select the eigenvectors corresponding to the k smallest eigenvalues ​​of matrix P to form a feature matrix F. Standardize F by row and then perform row-wise clustering to obtain the clustering result Q = {q0, q1, ..., q...} l}, where q0 is the class of the positive sample.

[0023] Furthermore, the steps of the semi-supervised spectral clustering algorithm also include:

[0024] During the clustering process, a dynamic adaptive adjustment mechanism is used for the known label information in the dataset.

[0025] Define p(y) i (z) represents the sample y i The similarity with class z, i.e., considered as sample y i The probability of belonging to category q:

[0026]

[0027] The dataset is first clustered using the aforementioned clustering algorithm, yielding the clustering result Q = {q0, q1, ..., q}. l}, calculate the maximum number of labels in each category, Maxnum(Q[a]). i ∈q i ]), as the tag c for this class;

[0028] For a subset of samples with known labels, y = [l1, l2, ..., l n After clustering, it is divided into y' = [l, l] r ,l k ,...,l h ], l * Representing different categories;

[0029] Use label list A to mark whether the partitioning of positive sample points is correct or not. The element a in label list A is... i The meaning is:

[0030]

[0031] The loss for clustering positive samples with known labels is:

[0032] Use label list B to indicate whether the partitioning of negative sample points is correct or not. The element b in label list B is used to indicate whether the partitioning of negative sample points is correct or not. i The meaning is:

[0033]

[0034] The clustering loss for negative samples with known labels is:

[0035] The overall loss function is obtained as follows:

[0036] Furthermore, the step of performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out normal traffic data includes:

[0037] A traffic flow is represented by an intra-packet feature as a time series T = {t1, t2, ..., t} l}, where t represents a data packet at a certain moment, containing n-dimensional features. For each dimension, a shapelet based on a preset traffic time series is calculated, yielding:

[0038]

[0039] Among them, (s1…s n ) represents the set of Shapelets for each dimension in the time series, a matrix Each column represents a shapelet sequence for each dimension, with a maximum number of k. The shapelet is used as the maximal region molecular sequence, and each dimension in its set should be uncorrelated.

[0040] Furthermore, it also includes: constructing a 3D projection matrix in a multidimensional time series.

[0041] Initialize 3D projection matrix The number of samples is m, the maximum number of shapelets is q, and the maximum length of each shapelet sequence is p;

[0042] exist In this process, one Shapelet sequence is selected from each column to form the first Shapelet projection plane. Loop until If all sequences in the array are retrieved or the set conditions are met, then q projection surfaces are formed, denoted as {S}. 1 ,S 2 ,…,S q};

[0043] Project each sample (n×m) onto q projection planes (n×p) to construct the projection matrix.

[0044] To achieve the above objectives, according to another aspect of this application, a hierarchical feature-based LDoS covert attack detection device is provided.

[0045] The hierarchical feature-based LDoS covert attack detection device according to this application includes: a screening module for filtering out normal traffic data based on a semi-supervised spectral clustering model, wherein the semi-supervised spectral clustering model is constructed based on the macroscopic features of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse time; a monitoring module for performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out normal traffic data, wherein the preset traffic time series is constructed through features within LDoS attack packets to characterize the specific features of each packet within a pulse time; and a result output module for obtaining the LDoS covert attack detection result based on the unsupervised LDoS attack monitoring.

[0046] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is provided, wherein a computer program is stored therein, and the computer program is configured to execute the method at runtime.

[0047] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the method.

[0048] The LDoS covert attack detection method and apparatus based on hierarchical features in this application adopts a semi-supervised spectral clustering model to filter out normal traffic data. After filtering out normal traffic data, unsupervised LDoS attack monitoring is performed on the remaining traffic data based on a preset traffic time series. This achieves the goal of obtaining the LDoS covert attack detection result based on the unsupervised LDoS attack monitoring, thereby realizing the technical effect of attack detection based on two-layer LDoS attack feature description, and thus solving the technical problem of being unable to detect LDoS attacks well. Attached Figure Description

[0049] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application. In the drawings:

[0050] Figure 1 This is a schematic diagram of the hardware structure of the LDoS covert attack detection method based on hierarchical features according to an embodiment of this application;

[0051] Figure 2 This is a flowchart illustrating the LDoS covert attack detection method based on hierarchical features according to an embodiment of this application;

[0052] Figure 3 This is a schematic diagram of the structure of a hierarchical feature-based LDoS covert attack detection device according to an embodiment of this application;

[0053] Figure 4 This is a schematic diagram of the electronic device structure of the LDoS covert attack detection method based on hierarchical features according to an embodiment of this application. Detailed Implementation

[0054] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0055] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0056] In this application, the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "middle," "vertical," "horizontal," "lateral," and "longitudinal" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are primarily for the purpose of better describing this application and its embodiments, and are not intended to limit the indicated device, element, or component to having a specific orientation, or to be constructed and operated in a specific orientation.

[0057] Furthermore, in addition to indicating location or positional relationship, some of the aforementioned terms may also have other meanings. For example, the term "above" may also be used in some cases to indicate a certain dependency or connection relationship. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0058] Furthermore, the terms "installation," "setup," "equipped with," "connection," "linking," and "socketing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral structure; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium, or an internal connection between two devices, components, or parts. Those skilled in the art can understand the specific meaning of these terms in this application based on the specific circumstances.

[0059] With the improvement of security protection measures, a new type of DDoS attack has quietly emerged: LDoS (Low-rate Denial-of-Service attack). Unlike DDoS attacks, LDoS attacks (belonging to the category of flood attacks, but with a transmission rate of less than 1000bps) are very stealthy. They often originate from multiple different attack sources, with single LDoS attack pulses of relatively small average traffic connected in a certain organization, forming a pulse train with a certain period. These attacks can penetrate the network core, forming a stack at the target, causing bottleneck link blockage or service quality degradation at the target terminal, resulting in incalculable damage and loss. Therefore, it is also called a degradation attack [References]. LDoS attack traffic is concentrated in rectangular pulses, sending many data packets within a short pulse duration and repeating them within the pulse period. Therefore, the energy of the attack depends on the amplitude and duration of the rectangular pulse, i.e., the time average of the LDoS attack traffic within the rectangular pulse. The principle of LDoS attacks is not to drastically consume network resources and capacity, but to target the adaptive mechanisms widely used on the Internet to ensure network fairness and stability, reducing resource utilization through protocol vulnerabilities. Typically, LDoS attackers periodically send legitimate traffic to attack the target. Each attack pulse causes the target's adaptive mechanism to provide negative feedback based on the attacker's intent, thus adaptively halting or reducing service quality. After each mechanism adjustment, the target needs time to recover service. (Therefore, during periodic attacks, the target's service quality remains low.) LDoS attacks are simple to organize, achieving destructive effects simply by sending pulses. This means hackers can launch attacks without controlling a large number of machines, making it easier to achieve their goals.

[0060] The inventors discovered that, firstly, LDoS attacks only require causing link congestion to achieve their attack objective. Therefore, they can use any legitimate protocol traffic from the network layer to the application layer, exhibiting the same behavioral characteristics as ordinary TCP or UDP-based applications. This allows them to be completely hidden within background network traffic, resulting in extremely high stealth. Consequently, there is no publicly available, unified feature description, making feature extraction difficult and thus detection challenging.

[0061] Secondly, LDoS attacks have lower average traffic and fewer packets. From the perspective of attack traffic, LDoS attack traffic is a periodic pulse of traffic. During an attack cycle, attack traffic exists only for about one-fifth of the time, and the average traffic within that cycle is even lower than the average of normal traffic. From the perspective of attack methods, LDoS attacks can employ a distributed attack approach, with attackers widely distributed at the end of the target router to aggregate the attack traffic. Therefore, the attack traffic is more dispersed throughout the network, resulting in lower average traffic and making it more difficult to detect.

[0062] Finally, the stealth of LDoS attacks allows them to easily evade detection by traditional DoS attack detection mechanisms. Even if an LDoS attack occurs, the network system does not completely crash; the most significant impact is slower system performance and reduced service quality (data updates, webpage refreshes, etc.). Therefore, network administrators of large-scale cloud platforms or data centers often attribute such situations to system failures or network line faults, ignoring the attack itself.

[0063] Given that LDoS attacks are highly covert and destructive, this application requires accurate detection of LDoS attacks and rapid defense against them.

[0064] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0065] like Figure 1 As shown in the embodiments of this application, it includes: user 200 and service server 100. The LDoS attack traffic is concentrated in a rectangular pulse, sending many data packets within a short pulse duration and repeating the transmission within the pulse period.

[0066] like Figure 2 As shown, the method includes the following steps S201 to S203:

[0067] Step S201: Based on a semi-supervised spectral clustering model, normal traffic data is filtered out. The semi-supervised spectral clustering model is constructed based on the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse.

[0068] Step S202: After filtering out normal traffic data, unsupervised LDoS attack monitoring is performed on the remaining traffic data based on a preset traffic time series. The preset traffic time series is constructed by the features within the LDoS attack packets and is used to characterize the specific features of each packet in the time series within a pulse time.

[0069] Step S203: Based on the unsupervised LDoS attack monitoring, obtain the LDoS covert attack detection result.

[0070] As can be seen from the above description, this application achieves the following technical effects:

[0071] By employing a semi-supervised spectral clustering model to filter out normal traffic data, and then performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out normal traffic data, the goal of obtaining the LDoS covert attack detection result based on the unsupervised LDoS attack monitoring is achieved. This realizes the technical effect of attack detection based on two-layer LDoS attack feature description, and thus solves the technical problem of being unable to detect LDoS attacks well.

[0072] In step S201 above, normal traffic data is filtered out based on a semi-supervised spectral clustering model. That is to say, the goal of normal traffic filtering based on semi-supervised spectral clustering is to ensure that the filtered normal traffic is close to 100% accurate. Therefore, when constructing the supervision information, the main consideration is to strengthen the supervision information of positive samples and remove outliers on the positive sample side to ensure the purity of the filtered normal traffic.

[0073] In some embodiments, the semi-supervised spectral clustering model is constructed based on the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse. Through extensive simulations of LDoS attacks and analysis of traffic characteristics, the macroscopic characteristics describe the overall distribution of traffic within an attack pulse. These characteristics are based on statistical representations, including available bandwidth percentage, small packet ratio, packet loss rate, flow duration, maximum / minimum packet size, average packet size, and average / standard deviation of the time between transmitted packets.

[0074] In step S202 above, since a positive sample was generated in the above steps, after filtering out the normal traffic data, the remaining traffic data is subjected to unsupervised LDoS attack monitoring based on a preset traffic time series.

[0075] It should be noted that the preset traffic time series is constructed using features within LDoS attack packets to characterize the specific features of each packet within a pulse time period.

[0076] In some embodiments, the packet features describe the specific characteristics of each packet in the time sequence within a pulse time period, including source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, whether it contains FIN, and other features.

[0077] In step S203 above, the LDoS covert attack detection result is obtained based on the unsupervised LDoS attack monitoring.

[0078] Specifically, Phase 1 uses the statistical characteristics of the flow to accurately filter out most of the normal traffic, while Phase 2 will achieve a more refined classification of the remaining traffic.

[0079] Preferably, as a preferred embodiment, the macroscopic features of the LDoS attack packet include at least one of the following: available bandwidth percentage, small packet ratio, packet loss rate, flow duration, maximum packet, minimum packet, average packet value, and average / standard deviation of the time between sent packets; the internal features of the LDoS attack packet include at least one of the following: source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, whether it contains FIN, etc.

[0080] As a preferred embodiment, the step of filtering out normal traffic data based on the semi-supervised spectral clustering model further includes: using the semi-supervised spectral clustering model to strengthen the supervision information of positive samples, removing outliers on the positive sample side, and filtering out most of the normal traffic data; the step of performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out the normal traffic data further includes: using the features within the traffic packets to construct a traffic time series for the remaining traffic data to achieve anomaly classification.

[0081] In practical implementation, the method of this application consists of two stages. The first stage is normal traffic screening based on semi-supervised spectral clustering. The main purpose is to remove a large amount of normal traffic, approaching 100%, thereby reducing the difficulty of detecting subsequent LDoS attacks, without considering the accuracy of detecting abnormal traffic in the remaining traffic. The second stage is unsupervised LDoS attack monitoring based on M-shapelets.

[0082] In this preferred embodiment, the step of filtering out normal traffic data based on a semi-supervised spectral clustering model includes: the step of constructing positive sample supervision information.

[0083] The steps for constructing positive sample supervision information include:

[0084] Perform simple clustering on the dataset to obtain the clustering result Q. int The category with the largest number of elements is selected and marked as the normal category of interest. The initialization limit for the number of supervisory information elements is M; the initialization set A is empty, and Q... intA certain number of positive samples are determined and added to set S; the current number of supervisory information items m = 0 is initialized.

[0085] When m ≤ M / 2, select the point x that is farthest from set A, i.e., x|d(x,A)=max(d y∈A (x,y)); Query whether x belongs to the positive sample. If it does, randomly select a point y from set A to construct a constraint supervision set 1, m = m + 1;

[0086] When M / 2 < m ≤ M, select the point x that is closest to set A, i.e., x|d(x,A) = min(d y∈A (x,y)), query whether x does not belong to the positive sample. If it does not belong, randomly select a point y from the subset A to construct a set of constraint supervision information 2, m=m+1;

[0087] Repeat the above steps to complete the construction of positive sample supervision information sets 1 and 2.

[0088] In a preferred embodiment, the step of filtering out normal traffic data based on a semi-supervised spectral clustering model includes: a step based on a semi-supervised spectral clustering algorithm.

[0089] The steps of the semi-supervised spectral clustering algorithm include:

[0090] Calculate the Euclidean distance between two points in the dataset. Form the distance matrix D;

[0091] Based on positive sample supervision information, outliers on the positive sample side are corrected, where if (x) i ,x j If ) belongs to set 1, then dist ij =0; if (x i ,x j If ) belongs to set 2, then dist ij =max(max(D) i ),max(D j ));

[0092] Construct a diagonal matrix S, The standardized Laplace matrix is ​​then P = S -1 / 2 (DS)S 1 / 2 Then, select the eigenvectors corresponding to the k smallest eigenvalues ​​of matrix P to form a feature matrix F. Standardize F by row and then perform row-wise clustering to obtain the clustering result Q = {q0, q1, ..., q...} l}, where q0 is the class of the positive sample.

[0093] Semi-supervised spectral clustering methods eliminate outliers in positive samples by utilizing supervised information, thus improving classification accuracy. During clustering, the dataset contains a small amount of known label information. To enhance the utilization of this information, obtain more accurate clustering results, and facilitate faster algorithm convergence, a dynamic adaptive adjustment method is proposed.

[0094] As a preferred embodiment, the steps of the semi-supervised spectral clustering algorithm further include:

[0095] During the clustering process, a dynamic adaptive adjustment mechanism is used for the known label information in the dataset.

[0096] Define p(y) i (z) represents the sample y i The similarity with class z, i.e., considered as sample y i The probability of belonging to category q:

[0097]

[0098] The dataset is first clustered using the aforementioned clustering algorithm, yielding the clustering result Q = {q0, q1, ..., q}. l}, calculate the maximum number of labels in each category, Maxnum(Q[a]). i ∈q i ]), as the tag c for this class;

[0099] For a subset of samples with known labels, y = [l1, l2, ..., l n After clustering, it is divided into y' = [l, l] r ,l k ,...,l h ], l * Representing different categories;

[0100] Use label list A to mark whether the partitioning of positive sample points is correct or not. The element a in label list A is... i The meaning is:

[0101]

[0102] The loss for clustering positive samples with known labels is:

[0103] Use label list B to indicate whether the partitioning of negative sample points is correct or not. The element b in label list B is used to indicate whether the partitioning of negative sample points is correct or not. i The meaning is:

[0104]

[0105] The clustering loss for negative samples with known labels is:

[0106] The overall loss function is obtained as follows:

[0107] In a preferred embodiment, the step of performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out normal traffic data includes:

[0108] It is important to note that compared to global macroscopic features, LDoS attacks are more covert in terms of packet sequence features, making classification more difficult. Shapelets, a subsequence of a time series, also known as the maximum region molecular sequence, were first proposed in 2009. They represent a type of "local feature," offering finer local segmentation compared to classification algorithms that rely on "global features." They are more robust to noise and exhibit better robustness and accuracy. This application proposes an unsupervised LDoS attack monitoring model based on multidimensional shapelets, compared to the original one-dimensional sequence.

[0109] A traffic flow is represented by an intra-packet feature as a time series T = {t1, t2, ..., t} l}, where t represents a data packet at a certain moment, containing n-dimensional features. For each dimension, a shapelet based on a preset traffic time series is calculated, yielding:

[0110]

[0111] Among them, (s1…s n ) represents the set of Shapelets for each dimension in the time series, a matrix Each column represents a shapelet sequence for each dimension, with a maximum number of k. The shapelet is used as the maximal region molecular sequence, and each dimension in its set should be uncorrelated.

[0112] As a preferred embodiment, the method further includes: constructing a 3D projection matrix in the multidimensional time series.

[0113] Initialize 3D projection matrix The number of samples is m, the maximum number of shapelets is q, and the maximum length of each shapelet sequence is p;

[0114] exist In this process, one Shapelet sequence is selected from each column to form the first Shapelet projection plane. Loop until If all sequences in the array are retrieved or the set conditions are met, then q projection surfaces are formed, denoted as {S}. 1 ,S2 ,…,S q};

[0115] Project each sample (n×m) onto q projection planes (n×p) to construct the projection matrix.

[0116] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0117] According to embodiments of this application, a hierarchical feature-based LDoS covert attack detection device for implementing the above-described method is also provided, such as... Figure 3 As shown, the device includes:

[0118] The filtering module 301 is used to filter out normal traffic data based on a semi-supervised spectral clustering model, wherein the semi-supervised spectral clustering model is constructed according to the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse time.

[0119] The monitoring module 302 is used to perform unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out normal traffic data. The preset traffic time series is constructed by the features within the LDoS attack packets and is used to characterize the specific features of each packet in the time series within a pulse time.

[0120] The result output module 303 is used to obtain the LDoS covert attack detection result based on the unsupervised LDoS attack monitoring.

[0121] The filtering module 301 uses a semi-supervised spectral clustering model to filter out normal traffic data. In other words, the goal of normal traffic filtering based on semi-supervised spectral clustering is to ensure that the filtered normal traffic is close to 100% accurate. Therefore, when constructing the supervision information, the focus is on strengthening the supervision information of positive samples and removing outliers from the positive sample side to ensure the purity of the filtered normal traffic.

[0122] In some embodiments, the semi-supervised spectral clustering model is constructed based on the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse. Through extensive simulations of LDoS attacks and analysis of traffic characteristics, the macroscopic characteristics describe the overall distribution of traffic within an attack pulse. These characteristics are based on statistical representations, including available bandwidth percentage, small packet ratio, packet loss rate, flow duration, maximum / minimum packet size, average packet size, and average / standard deviation of the time between transmitted packets.

[0123] Since positive samples were found in the above steps, the monitoring module 302 performs unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series after filtering out normal traffic data.

[0124] It should be noted that the preset traffic time series is constructed using features within LDoS attack packets to characterize the specific features of each packet within a pulse time period.

[0125] In some embodiments, the packet features describe the specific characteristics of each packet in the time sequence within a pulse time period, including source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, whether it contains FIN, and other features.

[0126] The result output module 303 obtains the LDoS covert attack detection result based on the unsupervised LDoS attack monitoring.

[0127] Specifically, Phase 1 uses the statistical characteristics of the flow to accurately filter out most of the normal traffic, while Phase 2 will achieve a more refined classification of the remaining traffic.

[0128] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0129] An embodiment of this application also provides an electronic device, which specifically includes the following:

[0130] Processor 601, memory 602, communications interface 603, and bus 604;

[0131] The processor 601, memory 602, and communication interface 603 communicate with each other through the bus 604; the communication interface 603 is used to realize information transmission between the hierarchical feature-based LDoS covert attack detection device, online business system, client equipment, and other participating institutions.

[0132] The processor 601 is used to call the computer program in the memory 602. When the processor executes the computer program, it implements all the steps in the hierarchical feature-based LDoS covert attack detection method in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0133] Based on a semi-supervised spectral clustering model, normal traffic data is filtered out. The semi-supervised spectral clustering model is constructed according to the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse.

[0134] After filtering out normal traffic data, the remaining traffic data is subjected to unsupervised LDoS attack monitoring based on a preset traffic time series. The preset traffic time series is constructed through features within LDoS attack packets and is used to characterize the specific features of each packet in the time series within a pulse time.

[0135] The LDoS covert attack detection results are obtained based on the unsupervised LDoS attack monitoring.

[0136] Based on the above, the implementation principle of this application is as follows:

[0137] This application first simulates numerous LDoS attacks and analyzes the traffic characteristics. The invention proposes a Layer 2 LDoS attack feature description, including macroscopic features and intra-packet features. Macroscopic features describe the overall traffic distribution within an attack pulse, based on statistical characteristics such as available bandwidth percentage, small packet ratio, packet loss rate, flow duration, maximum (minimum) packet, average packet size, and average / standard deviation of time intervals between sent packets. Intra-packet features describe the specific characteristics of each packet within the pulse over a time series, including source address, destination address, packet direction, packet size, whether it contains an ACK, whether it contains an RST, and whether it contains a FIN.

[0138] The proposed LDoS covert attack detection method based on two-layer features mainly consists of two stages. The first stage is normal traffic screening based on semi-supervised spectral clustering, with the main goal of removing a large amount of normal traffic to nearly 100%, reducing the difficulty of subsequent LDoS attack detection, without considering the accuracy of abnormal traffic detection in the remaining traffic. The second stage is unsupervised LDoS attack monitoring based on M-shapelet.

[0139] (1) Normal flow screening based on semi-supervised spectral clustering

[0140] Considering that spectral clustering methods are more adaptable to data distributions, have the ability to identify non-convex clusters, can cluster on sample spaces of arbitrary shapes, and converge to the global optimum, this paper proposes a semi-supervised spectral clustering-based method for initial screening of normal traffic. The goal of Phase 1 is to ensure that the selected normal traffic is close to 100% accurate. Therefore, when constructing the supervision information, the focus is on strengthening the supervision information of positive samples and removing outliers from the positive sample side to ensure the purity of the selected normal traffic.

[0141] The method for constructing positive sample supervision information is as follows:

[0142] Perform simple clustering on the dataset to obtain the clustering result Q. int The category with the largest number of occurrences is selected and marked as the normal category of interest. The number of supervisory information items is initially limited to M; the initial set A is empty, and simple expert knowledge rules are used in Q. int A certain number of positive samples are determined and added to set S; the current number of supervisory information is initialized to m = 0.

[0143] When m ≤ M / 2, select the point x that is farthest from set A, i.e., x|d(x,A)=max(d y∈A (x, y)); Query whether x is a positive sample. If it is, randomly select a point y from set A to construct a constraint supervision set 1, m = m + 1. Return to step 2.

[0144] When M / 2 < m ≤ M, select the point x that is closest to set A, i.e., x|d(x,A) = min(d y∈A Given (x, y), query whether x is not a positive sample. If not, randomly select a point y from subset A to construct a constraint supervision information set 2, m = m + 1. Return to step 3;

[0145] Repeat the above steps to complete the construction of the positive sample supervision information set. The supervision information set includes two sets: set 1 consists of samples that are both positive but far apart, and set 2 consists of one positive sample and another sample of other types that are very close together.

[0146] The semi-supervised spectral clustering algorithm is as follows:

[0147] Calculate the Euclidean distance between two points in the dataset, denoted as . Form a distance matrix D (adjacency matrix W).

[0148] Based on positive sample supervision information, correct outliers on the positive sample side. If (x i ,x j If ) belongs to set 1, then dist ij =0; if (x i ,x j If ) belongs to set 2, then dist ij =max(max(D) i ),max(D j )).

[0149] Construct a diagonal matrix S, The standardized Laplace matrix is ​​then P = S -1 / 2 (DS)S 1 / 2 .

[0150] Select the eigenvectors corresponding to the k smallest eigenvalues ​​of matrix P to form a feature matrix F. Standardize F by row and then perform clustering by row to obtain the clustering result Q = {q0, q1, ..., q l}, where q0 is the class of the positive sample.

[0151] Semi-supervised spectral clustering methods eliminate outliers in positive samples by utilizing supervised information, thus improving classification accuracy. During clustering, the dataset contains a small amount of known label information. To enhance the utilization of this information, obtain more accurate clustering assignments, and facilitate faster algorithm convergence, a dynamic adaptive adjustment mechanism is proposed.

[0152] First, define p(y) i (z) represents the sample y i The similarity to class z can also be seen as the similarity of sample y. i The probability of belonging to category q.

[0153]

[0154] The specific method of the adaptive adjustment mechanism is as follows:

[0155] 1) Perform the first clustering on the dataset using Algorithm 1, obtaining the clustering result Q = {q0, q1, ..., q}. l}, calculate the maximum number of labels in each category, Maxnum(Q[a]). i ∈q i ]), as the label c of this class. For a subset of samples y = [l1, l2, ..., l] with known labels. n After clustering, it is divided into y' = [l, l] r ,l k ,...,l h ], l * They represent different categories.

[0156] 2) Use label list A to mark whether the partitioning of positive sample points is correct or not. The element a in label list A... i The meaning is:

[0157]

[0158] The clustering loss for positive samples with known labels is:

[0159] 3) Use label list B to mark whether the partitioning of negative sample points is correct or not. The element b in label list B... i The meaning is:

[0160]

[0161] The clustering loss for negative samples with known labels is:

[0162] The overall loss function is:

[0163] (2) Unsupervised LDoS attack monitoring based on M-shapelet

[0164] Phase 1 uses the statistical characteristics of flows to accurately filter out most of the normal traffic. Phase 2 will achieve a more refined classification of the remaining traffic. Therefore, in Phase 2, packet features within the flow will be used to construct a time series of traffic to achieve anomaly classification. The packet features used in this paper mainly include: source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, and whether it contains FIN, etc.

[0165] A flow can be represented by in-packet features as a time series T = {t1, t2, ..., t} l Let t represent a data packet at a certain moment, containing n-dimensional features. For each dimension, calculate the Shapelet to obtain:

[0166]

[0167] Among them, (s1…s n ) represents the set of shapelets for each dimension in the time series, a matrix Each column represents a shapelet sequence in each dimension, with a maximum number of k.

[0168] As a maximal region molecular sequence, each dimension of a shapelet set should be highly uncorrelated. Therefore, in a multidimensional time series, a 3D projection matrix is ​​constructed. The specific method is as follows:

[0169] Initialize 3D projection matrix The number of samples is m, the maximum number of shapelets is q, and the maximum length of each shapelet sequence is p.

[0170] exist In this process, a shapelet sequence is selected from each column to form the first shapelet projection plane. Loop until If all sequences in the array are retrieved or the set conditions are met, then q projection surfaces are formed, denoted as {S}. 1 ,S 2 ,…,S q}

[0171] Each sample (n×m) is projected onto q projection planes (n×p), and the projection formula is: To facilitate finding the minimum value, the formula is simplified to:

[0172] Constructing the projection matrix

[0173] When calculating the shapelet projection surface, to ensure the maximum projection, i.e., the maximum possible classification probability, we need to ensure that the shapelet projection surfaces are as dissimilar as possible to each other. Therefore, we construct the shapelet similarity matrix: To ensure that the projected surfaces are dissimilar to each other, i.e., to minimize the similarity, is expressed as:

[0174] Define the classification matrix c represents the number of label categories. To minimize the classification error, we obtain...

[0175] Finally, the classification model is:

[0176] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for detecting LDoS covert attacks based on hierarchical features, characterized in that, include: Based on a semi-supervised spectral clustering model, normal traffic data is filtered out. The semi-supervised spectral clustering model is constructed according to the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse. The macroscopic characteristics of LDoS attack packets include at least one of the following: percentage of available bandwidth, small packet ratio, packet loss rate, flow duration, maximum packet, minimum packet, average packet value, and average / standard deviation of the time between sent packets. The steps of a semi-supervised spectral clustering algorithm include: Calculate the Euclidean distance between two points in the dataset. This forms a distance matrix D; Based on positive sample supervision information, outliers on the positive sample side are corrected, where if If it belongs to the positive sample supervision information set 1, then ;like If it belongs to the positive sample supervision information set 2, then ; Construct a diagonal matrix S, Then the standardized Laplace matrix is Then, select the eigenvectors corresponding to the k smallest eigenvalues ​​of matrix P to form a feature matrix F. Standardize F by row and then perform clustering by row to obtain the clustering results. , The category of positive samples; During the clustering process, a dynamic adaptive adjustment mechanism is used for the known label information in the dataset. definition To represent sample y i The similarity with class z, i.e., considered as sample y i The probability of belonging to category q: The dataset is first clustered using the aforementioned clustering algorithm to obtain the clustering results. The category with the largest amount of label data in each category of results is counted. , as the tag c of this class; For a portion of the samples with known labels After clustering, it was divided into , Representing different categories; Use label list A to mark whether the partitioning of positive sample points is correct or not. The elements in label list A are... The meaning is: The loss for clustering positive samples with known labels is: ; Use label list B to indicate whether the partitioning of negative sample points is correct or not. The elements in label list B... The meaning is: The clustering loss for negative samples with known labels is: , The overall loss function is obtained as follows: ; After filtering out normal traffic data, the remaining traffic data is subjected to unsupervised LDoS attack monitoring based on a preset traffic time series. The preset traffic time series is constructed by LDoS attack packet features to characterize the specific features of each packet in the time series within a pulse time. The LDoS attack packet features include at least one of the following: source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, and whether it contains FIN. Unsupervised LDoS attack monitoring of remaining traffic data based on preset traffic time series includes: representing a time series of a traffic flow using in-packet features. Let t represent a data packet at a certain moment, containing n-dimensional features. For each dimension, calculate the traffic time series shapelet based on the preset parameters to obtain: in, A matrix representing the set of Shapelets for each dimension over time. Each column represents a shapelet sequence for each dimension, with a maximum number of k. The shapelet is used as the maximal region molecular sequence, and each dimension in its set should be independent. Constructing a 3D projection matrix in a multidimensional time series : Initialize 3D projection matrix The number of samples is m, the maximum number of shapelets is q, and the maximum length of each shapelet sequence is p; exist In this process, one Shapelet sequence is selected from each column to form the first Shapelet projection plane. , loop, until If all sequences in the sequence are retrieved or the set conditions are met, then q projection surfaces are formed, which are... ; Each sample (n×m) is projected onto q projection planes (n×p), and the projection formula is: ， To find the minimum value, the formula becomes continuous as follows: ， Constructing the projection matrix ; When finding the shapelet projection plane, construct the shapelet similarity matrix: , To minimize the similarity, it is expressed as: , Define the classification matrix Let c represent the number of label categories. To minimize the classification error, we obtain... , Finally, the classification model is: Based on the unsupervised LDoS attack monitoring, the LDoS covert attack detection results are obtained.

2. The method according to claim 1, characterized in that: The method of filtering out normal traffic data based on the semi-supervised spectral clustering model also includes: The semi-supervised spectral clustering model strengthens the supervision information of positive samples, removes outliers on the positive sample side, and filters out most of the normal traffic data. The step of filtering out normal traffic data and then performing unsupervised LDoS attack monitoring on the remaining traffic data based on a preset traffic time series further includes: Use the features within the traffic packets to construct a time series of traffic data for the remaining traffic data to achieve anomaly classification.

3. The method according to claim 1, characterized in that, The step of filtering out normal traffic data based on the semi-supervised spectral clustering model includes: constructing positive sample supervision information. The steps for constructing positive sample supervision information include: Perform simple clustering on the dataset to obtain the clustering results. The category with the largest number of elements is selected and marked as the normal category of interest. The number of supervisory information elements is initially limited by M; the initial set A is empty. A certain number of positive samples are identified and added to set S; the current number of supervisory information items m=0 is initialized. When m ≤ M / 2, choose the point x that is farthest from set A, i.e. ; Inquire whether x belongs to the positive sample. If it does, randomly select a point y from set A to construct the positive sample supervision information set 1. ; When M / 2 < m ≤ M, choose the point x that is closest to set A, i.e. Let x be a positive sample. If x is not a positive sample, then randomly select a point y from subset A to construct positive sample supervision information set 2. ; Repeat the above steps to complete the construction of positive sample supervision information sets 1 and 2.

4. A hierarchical feature-based LDoS covert attack detection device, characterized in that, include: The filtering module is used to filter out normal traffic data based on a semi-supervised spectral clustering model, wherein the semi-supervised spectral clustering model is constructed according to the macroscopic characteristics of LDoS attack packets to characterize the overall distribution of traffic data within an attack pulse time; the macroscopic characteristics of LDoS attack packets include at least one of the following: available bandwidth percentage, small packet ratio, packet loss rate, flow duration, maximum packet, minimum packet, average packet value, average / standard deviation of time between sent packets; The steps of a semi-supervised spectral clustering algorithm include: Calculate the Euclidean distance between two points in the dataset. This forms a distance matrix D; Based on positive sample supervision information, outliers on the positive sample side are corrected, where if If it belongs to the positive sample supervision information set 1, then ;like If it belongs to the positive sample supervision information set 2, then ; Construct a diagonal matrix S, Then the standardized Laplace matrix is Then, select the eigenvectors corresponding to the k smallest eigenvalues ​​of matrix P to form a feature matrix F. Standardize F by row and then perform clustering by row to obtain the clustering results. , The category of positive samples; During the clustering process, a dynamic adaptive adjustment mechanism is used for the known label information in the dataset. definition To represent sample y i The similarity with class z, i.e., considered as sample y i The probability of belonging to category q: The dataset is first clustered using the aforementioned clustering algorithm to obtain the clustering results. The category with the largest amount of label data in each category of results is counted. , as the tag c of this class; For a portion of the samples with known labels After clustering, it was divided into , Representing different categories; Use label list A to mark whether the partitioning of positive sample points is correct or not. The elements in label list A are... The meaning is: The loss for clustering positive samples with known labels is: ; Use label list B to indicate whether the partitioning of negative sample points is correct or not. The elements in label list B... The meaning is: The clustering loss for negative samples with known labels is: , The overall loss function is obtained as follows: The monitoring module is used to perform unsupervised LDoS attack monitoring on the remaining traffic data after filtering out normal traffic data. The preset traffic time series is constructed by the features within the LDoS attack packets and is used to characterize the specific features of each packet in the time series within a pulse time. The features within the LDoS attack packets include at least one of the following: source address, destination address, packet direction, packet size, whether it contains ACK, whether it contains RST, and whether it contains FIN. Unsupervised LDoS attack monitoring of remaining traffic data based on preset traffic time series includes: representing a time series of a traffic flow using in-packet features. Let t represent a data packet at a certain moment, containing n-dimensional features. For each dimension, calculate the traffic time series shapelet based on the preset parameters to obtain: in, A matrix representing the set of Shapelets for each dimension over time. Each column represents a shapelet sequence for each dimension, with a maximum number of k. The shapelet is used as the maximal region molecular sequence, and each dimension in its set should be independent. Constructing a 3D projection matrix in a multidimensional time series : Initialize 3D projection matrix The number of samples is m, the maximum number of shapelets is q, and the maximum length of each shapelet sequence is p; exist In this process, one Shapelet sequence is selected from each column to form the first Shapelet projection plane. , loop, until If all sequences in the sequence are retrieved or the set conditions are met, then q projection surfaces are formed, which are... ; Each sample (n×m) is projected onto q projection planes (n×p), and the projection formula is: ， To find the minimum value, the formula becomes continuous as follows: ， Constructing the projection matrix ; When finding the shapelet projection plane, construct the shapelet similarity matrix: , To minimize the similarity, it is expressed as: , Define the classification matrix Let c represent the number of label categories. To minimize the classification error, we obtain... , Finally, the classification model is: ; The result output module is used to obtain the LDoS covert attack detection result based on the unsupervised LDoS attack monitoring.

5. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to perform the method according to any one of claims 1 to 3 when executed.

Images