A decentralized network DDoS attack identification method based on a large language model
By using a large language model-based approach, BERT and bi-LSTM networks are employed to identify DDoS attacks in decentralized networks, overcoming the limitations of existing technologies in identifying and defending against DDoS attacks and achieving more efficient identification and defense results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-13
- Publication Date
- 2026-04-10
AI Technical Summary
Existing technologies struggle to effectively identify and defend against DDoS attacks in decentralized networks, especially since these attacks differ from those in traditional centralized networks in terms of targets, methods, and scope of impact. Existing methods have limitations and shortcomings.
We employ a large language model-based approach, which involves collecting network traffic data, pre-training and fine-tuning the model, using the BERT model to learn a general representation of encrypted traffic, and combining it with a bi-LSTM network to extract features. We then design a fine-tuned model with appropriate expressive power to identify decentralized network DDoS attacks.
It significantly reduces the amount of training data, improves the accuracy and efficiency of DDoS attack identification, enhances the network's prediction accuracy and generalization performance, and exhibits good robustness.
Smart Images
Figure CN116781341B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of decentralized network environment security, and particularly relates to a decentralized network DDoS attack identification method based on a large language model. BACKGROUND
[0002] A decentralized network is a flat network organization form that does not rely on any centralized server or agency, but is composed of a peer-to-peer network of multiple identical nodes. Decentralized networks have many advantages, such as resisting censorship, protecting privacy, saving resources, improving efficiency, etc.
[0003] However, decentralized networks also face some security threats and challenges, and DDoS attacks are one of them. DDoS attack is a distributed denial of service attack that uses a large number of malicious nodes to send a large number of invalid requests to the target node, causing the target node to be unable to respond to normal requests, thereby disrupting the operation of the network and reducing network stability.
[0004] DDoS attacks are very dangerous for decentralized networks, as they can lead to network fragmentation, performance degradation, data loss, trust collapse, etc. Therefore, timely identification and defense of DDoS attacks is an important task to ensure the security and stability of decentralized networks.
[0005] Compared with centralized network DDoS attacks, DDoS attacks in decentralized networks have some differences in attack targets, attack methods, attack effects, etc. For example, traditional centralized network DDoS attacks usually target a specific server or website, while decentralized network DDoS attacks usually target the entire network or a subnetwork; traditional centralized network DDoS attacks usually use botnets or hoppers and other large numbers of controlled devices to launch attacks, while decentralized network DDoS attacks usually use legitimate nodes or fake nodes to launch attacks; traditional centralized network DDoS attacks usually only affect the attacked object itself, while decentralized network DDoS attacks usually affect all related objects within the entire network or subnetwork. Therefore, timely identification and defense of DDoS attacks is an important task to ensure the security and stability of decentralized networks.
[0006] Currently, there are some methods for identifying and defending against DDoS attacks, but these methods have some limitations and deficiencies. Feature-based methods require pre-defined feature rules to determine whether there is a DDoS attack, but these rules may be incomplete or outdated, and cannot adapt to new or variant DDoS attacks. Anomaly-based methods require the establishment of a normal traffic model to detect abnormal traffic, but this model may not be accurate or stable, and cannot adapt to dynamic changes in traffic environment. Machine learning-based methods require a large amount of labeled data to train classifiers or detectors, but these data may be difficult to obtain or not representative, and cannot reflect the real traffic distribution. SUMMARY
[0007] In order to overcome the deficiencies of the prior art, the present application provides a decentralized network DDoS attack identification method based on a large language model, which can effectively detect and defend against the traffic generated by DDoS attacks in a decentralized network, aiming to improve the accuracy and efficiency of DDoS attack identification and provide a reference for network optimization.
[0008] To achieve the above purpose, the present application provides the following technical solutions:
[0009] A decentralized network DDoS attack identification method based on a large language model, comprising the following steps:
[0010] (1) Network traffic data collection, including three parts: a. Collecting traffic generated during normal network use using a network traffic collector; b. Collecting public dataset traffic on the network, including different types of encrypted traffic data, for expanding the pre-training dataset; c. Collecting DDoS attack traffic in the decentralized network;
[0011] (2) Convert network traffic into word vectors similar to natural language;
[0012] (3) Pre-train the word vectors of unlabeled traffic data on the selected large language model (such as the bert model) to learn the general representation of encrypted traffic and save the pre-trained model parameters. The input data mainly includes parts a and b of step (1); neural network models have difficulty learning good results with small training sample sizes, and the purpose of pre-training is to use a large amount of easily accessible encrypted traffic to learn general knowledge of encrypted traffic. Through this prior knowledge, the training amount of the downstream task can be greatly reduced; the decentralized network DDoS attack traffic is also a type of encrypted traffic, but it is difficult to obtain. By learning a general representation method, the purpose of achieving good classification results using a small attack traffic dataset can be achieved.
[0013] (4) For the decentralized network DDoS attack, part of the traffic in step 1.c is input into the pre-trained model derived from step 3 through the processing of step 2, and the characteristics of the decentralized network DDoS attack traffic are learned;
[0014] (5) A bi-LSTM-based fine-tuning model with appropriate expression capability is designed to receive the feature representation output by step 4 and perform a prediction task, and the network parameters of the fine-tuning model are learned and optimized by comparing the prediction result with the actual label;
[0015] (6) For decentralized network DDoS attack traffic samples, after being converted into word vectors, they are input into the optimized fine-tuning model to evaluate the recognition effect of the fine-tuning model. Part of the evaluation traffic in step 1.c is classified and recognized through steps 2, 4 and 5, and the results are summarized to calculate the evaluation indicators.
[0016] (7) For a decentralized network traffic to be identified, after being converted into word vectors, it is input into the optimized fine-tuning model to identify whether it is decentralized network DDoS attack traffic.
[0017] Compared with the prior art, the present application has the following advantages:
[0018] (1) The use of large language model to train the general features of network traffic can significantly reduce the amount of training data required for training downstream tasks;
[0019] (2) The large language model is used to extract features from network traffic data, which can effectively identify the characteristics and behaviors of DDoS attacks, and improve the accuracy and efficiency of DDoS attack recognition;
[0020] (3) The bi-LSTM network can significantly improve the prediction accuracy and generalization performance of the network, and has good robustness. BRIEF DESCRIPTION OF DRAWINGS
[0021] Figure 1 is the model overall flowchart in the method described in the embodiments of the present application.
[0022] Figure 2 is the data collection schematic diagram in the method described in the embodiments of the present application.
[0023] Figure 3 is the traffic token process diagram in the method described in the embodiments of the present application.
[0024] Figure 4 is the flow cutting step diagram in the method described in the embodiments of the present application.
[0025] Figure 5 is the bi-LSTM fine-tuning model structure diagram in the method described in the embodiments of the present application.
[0026] Figure 6 is an example diagram of test results in the method described in the embodiments of the present application;
[0027] (a) accuracy comparison chart, (b) precision comparison chart, (c) recall rate comparison chart, (d) F1 value comparison chart. DETAILED DESCRIPTION
[0028] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application is further described in detail below by means of drawings and examples. However, it should be understood that the specific examples described herein are only used to explain the present application and do not limit the scope of the present application.
[0029] The present application discloses a decentralized network DDoS attack identification method based on a large language model, and the flow is as shown in Figure 1 The method consists of four parts: collection of traffic data, preprocessing of traffic data, pre-training model based on BERT, and fine-tuning model based on bi-LSTM.
[0030] Collection of traffic data:
[0031] The collection of traffic data mainly includes three parts: normal network traffic collection; decentralized network DDoS attack traffic collection; public data set download. Figure 2 The collected network traffic data is shown. ① Normal network environment traffic collection: the collection of normal network traffic is realized by setting up a traffic capture tool in the network, including the traffic of decentralized network and the traffic in the conventional centralized network. ② Decentralized network DDoS attack traffic collection: a decentralized network environment is built, and the nodes in the simulated environment are attacked, the node traffic in the attack process is collected, and this part of the traffic is labeled; ③ Public data set download: unmarked traffic is collected from public data sets. In order to ensure the security of communication, the collected communication data is usually encrypted traffic.
[0032] Preprocessing of traffic data:
[0033] The collected network traffic is saved locally, the unlabeled data is used for BERT model pre-training, and the labeled data is used for fine-tuning the model obtained by pre-training for decentralized network DDoS attack. Since encrypted traffic is very different from natural language and image, it does not contain human understandable content and explicit semantic units. In order to effectively utilize large language models for encrypted traffic classification, it is necessary to convert encrypted traffic into a token form similar to natural language part-of-speech tagging, Figure 3 The conversion process of traffic is shown. For unlabeled data, it can be directly converted into tokens after segmentation, and the segmentation method is as shown in Figure 4As shown; for labeled data, filtering operation needs to be performed after collection and then conversion, and the data label is marked by the collection process.
[0034] Traffic filtering mainly includes three steps: domain filtering, packet filtering and flow segmentation. The present application uses wireshark software to process the first two steps, and flow filtering is processed by Python script.
[0035] (1) Domain filtering
[0036] The main purpose of domain filtering is to filter out the traffic irrelevant to the target type; for example: DDoS attack traffic class, system application traffic class, etc. Here, the main impurities are filtered out, such as the traffic generated by the system itself, which essentially ensures that the data input into the model is as strongly related to the target class as possible, and weakly related / irrelevant to other classes. The present application filters out the data packets in the local area network and the background traffic generated by the system itself by using the filtering function of wireshark.
[0037] In order to further improve the relevance of the remaining data packets and applications, the present application uses session statistics, combined with network information, session length and packet number to perform secondary filtering on IP addresses, the purpose of which is to screen out irrelevant flows and small data related flows, and to retain large data related flows with more obvious behavior characteristics. Since it cannot be guaranteed that the collected background traffic contains all domains of irrelevant flows (the result of domain filtering is not necessarily all related flows), the purpose of secondary filtering is to sacrifice a part of related flows to ensure the purity of the data set as much as possible.
[0038] (2) Packet filtering
[0039] The purpose of packet filtering is to filter out data packets that do not contribute to the description of traffic characteristics, such as TCP handshake packets, retransmitted data packets and ACK data packets.
[0040] (3) Flow segmentation
[0041] The purpose of flow segmentation is to divide the data flow and divide the traffic of the target application according to the five-tuple and time interval. The flow in the present application represents the time sequence of TCP data packets exchanged between two peers during a single TCP session. The specific process is as shown in Figure 4 .
[0042] The conversion process of encrypted traffic is mainly used to embed the traffic data that the pre-trained model cannot process into the word vector, which consists of three steps: burst generation, burst token conversion and token embedding conversion.
[0043] (1) Burst generation
[0044] A BURST is defined as a group of time-adjacent network packets initiated from either the request or response side in a single flow. BURST sequences describe the network flow transmission pattern, which is viewed from the application layer perspective, as the Document Object Model (DOM) tree between webpages becomes diversified due to the individualization of network services. As the client rendering process separates the network data into different objects (e.g., text and images), the DOM structure generates semantically-aware segments and potentially influences the client’s resource requests. Each generated segment forms a network BURST, which contains a complete portion from a specific type of content in the DOM structure. A more accurate description of a burst is shown in equation (1):
[0045]
[0046] where m is the maximum number of packets from source to destination in one direction, n is the maximum number of packets from source to destination, and p represents a packet.
[0047] (2) Burst tokenization
[0048] To convert the BURST notation into a tokenized representation for pre-training, the BURST in hexadecimal needs to be decomposed into a sequence of units. For this, bi-grams are used to encode the hexadecimal sequence, where each unit consists of two adjacent bytes. Next, byte pair encoding is used to represent the tokens, where each token unit ranges from 0 to 65535, with the maximum value of the dictionary size represented as 65536. In addition, special tokens [CLS], [SEP], [PAD], and [MASK] are also needed for the training task. The first token of each sequence is always [CLS], and the last hidden layer state associated with this token is used to represent the complete sequence for the classification task. The token [PAD] is a padding symbol that satisfies the minimum length requirement. The sub-BURST pairs of BURST will be separated by [SEP]. The token [MASK] appears during pre-training to learn the context of the traffic.
[0049] (3) Token embedding conversion
[0050] A complete token embedding representation includes three parts: token content embedding, token position embedding, and token segment embedding. The three-part embedding information will be further aggregated in the word embedding layer of the pre-training model.
[0051] a. Token content embedding
[0052] The token contains the original information of the datagram, which is derived through the burst tokenization step, and the dimension of the embedding is set to 768.
[0053] b. Token position embedding
[0054] As the transmission of traffic data is closely related to the order, large language models use position embeddings to ensure that the model pays attention to the temporal relationship of tokens. We assign a H-dimensional vector to each input token to represent its position information in the sequence, and set the embedding dimension H to 768.
[0055] c. Token segment embedding
[0056] Token segment embedding is used to record the context information of traffic for large language models, also a 768-dimensional vector, during the fine-tuning phase, a segment of flow is represented as a classification task.
[0057] BERT-based pre-training model:
[0058] The BERT-based pre-training model of the present application is a bidirectional encoder model based on Transformer, which can encode and decode the input word token sequence and output the same or similar word token sequence. The BERT model is composed of the following parts:
[0059] Word embedding layer: This layer is responsible for converting the input tokens into a sequence of word embedding vectors, i.e., mapping each token to a high-dimensional vector space reflecting its semantic and syntactic features. The word embedding layer will also add position embedding and segment embedding to increase position and context information. The complete tokenization data is taken as the original input in this step. The first set of embedding vectors is randomly initialized, with embedding dimension D = 768. After N times of Transformer encoding, the final token embedding is obtained.
[0060] Transformer encoder layer: This layer is stacked by multiple Transformer encoder units, each of which is composed of multi-head self-attention mechanism and feedforward neural network. The Transformer encoder layer can perform bidirectional self-attention calculation on the input word embedding vector sequence and output the encoded hidden state vector sequence.
[0061] Transformer decoder layer: This layer is stacked by multiple Transformer decoder units, each of which is composed of multi-head self-attention mechanism, multi-head encoder-decoder attention mechanism and feedforward neural network. The Transformer decoder layer can perform bidirectional self-attention calculation on the encoded hidden state vector sequence and output the decoded hidden state vector sequence.
[0062] Output layer: This layer is responsible for converting the decoded hidden state vector sequence into the output part-of-speech tag sequence, that is, mapping each hidden state vector to a part-of-speech tag to reflect its semantic and grammatical features. For the present application, the output layer reflects the overall features of the extracted traffic, and the original output layer usually uses a fully connected layer and a softmax function to implement, and the present application uses a bi-LSTM network architecture more sensitive to time series features to perform the final classification task.
[0063] In the present application, large-scale unlabeled traffic data is used for pre-training to learn the representation of general encrypted traffic and save the pre-trained model parameters. Specifically, the unlabeled traffic data is converted into a token sequence and input into the BERT model. The BERT model outputs the same or similar part-of-speech tag sequence according to the input, and calculates the loss function.
[0064] The loss function is an index reflecting the consistency between the input and the output. In the present application, the pre-training process involves two training tasks, which are to learn the contextual dependence between traffic bytes by predicting the covered tokens, and to learn the correct transmission order by predicting the homologous BURST. The loss function is designed according to the two task objectives.
[0065] Masked BURST model:
[0066] The task of this masked BURST model is similar to the masked language model (MLM) used by BERT, and the difference between the two is that the objects are different. During pre-training, each token in the input token sequence is randomly masked with a probability of 15%. Masking means that this token will be replaced by a [MASK] token with a probability of 80%, a randomly selected token with a probability of 10%, and remain unchanged with a probability of 10%. The model is trained to predict the masked position according to the context. For an input sequence X with k tokens masked, the negative log-likelihood function is used as the loss function, defined as shown in equation (2):
[0067]
[0068] In the formula, θ represents the set of trainable parameters of the BERT model, and the probability P is modeled by the BERT model with θ. represents the token sequence after masking, MASK i represents the token at the i-th position in the token sequence after masking.
[0069] Homologous BURST prediction model:
[0070] The dependency between the data packets in the BURST is understood by a homologous BURST prediction model. This model uses a binary classifier to predict whether two sub-BURSTs (denoted as sub-BURST below) come from the same source BURST. The input token sequence contains a set of sub-BURST pairs and the corresponding label y j ∈[0,1](0 represents a homologous sub-BURST pair, and 1 represents a non-homologous sub-BURST pair). The jth sub-BURST pair can be represented as:
[0071]
[0072] where it is assumed that a sub-BURST A is given, then the sub-BURST B following it has a 50% probability of being homologous and a 50% probability of following the sub-BURST of other BURST. The loss function in this task is defined as formula (3):
[0073]
[0074] where n represents the number of homologous predicted sub-BURST pairs.
[0075] The final training target of this pre-training model is the sum of the above two losses, defined as formula (4):
[0076] L=L1+L2 (4)
[0077] Fine-tuning model based on bi-LSTM:
[0078] Figure 5 The structure diagram of the fine-tuning model based on bi-LSTM of the present application is as shown in Figure 5 The fine-tuning model based on bi-LSTM of the present application is a bidirectional long short-term memory neural network model, which can classify and identify the input flow level representation and output a binary classification result (0 or 1). The linear classification layer of the original fine-tuning model is replaced by a bi-LSTM model, which extracts the timing characteristics through the bi-LSTM model, and achieves better results in the field of DDoS attack traffic classification. The bi-LSTM model is composed of the following parts:
[0079] Input layer: This layer is responsible for receiving the feature representation of the decentralized network DDoS attack traffic obtained after the BERT model, that is, the high-dimensional vector corresponding to each word class label or each word class label sequence.
[0080] bi-LSTM layer: This layer is composed of multiple bi-LSTM units, each of which is composed of a forward LSTM unit and a backward LSTM unit. The bi-LSTM layer can perform forward and backward scans on the input stream-level representation and extract time sequence features. The forward LSTM unit scans the input sequence from left to right and outputs the forward hidden state; the backward LSTM unit scans the input sequence from right to left and outputs the backward hidden state. The forward and backward hidden states are concatenated to obtain the output of the bi-LSTM layer.
[0081] Output layer: This layer is responsible for converting the output of the bi-LSTM layer into a binary classification result (0 or 1), i.e., determining whether the input data representation belongs to DDoS attack traffic.
[0082] In this application, for decentralized network DDoS attacks, the converted representation of the collected traffic is input into the fine-tuned BERT model to obtain the stream-level representation of the data, and then input into the bi-LSTM model. The bi-LSTM model outputs a binary classification result (0 or 1) based on the input and calculates the loss function. By optimizing the loss function, the bi-LSTM model parameters are adjusted, and the fine-tuned model parameters are saved. The fine-tuned model parameters can better adapt to the decentralized network DDoS attack scenario and extract the difference features between DDoS attack traffic and normal traffic.
[0083] Analysis and evaluation:
[0084] Test environment:
[0085] In order to test the vulnerability detection ability and detection overhead of the method of the present application, the scripts used by the model of the present application are mainly implemented based on Python language, and the version used is 3.9 version. All processes are run on a 12th Gen Intel(R)Core(TM) i5-12400 2.50GHz GPU NVDIA 2060Super 8G computer.
[0086] Data collection:
[0087] This data collection mainly includes multiple data sets with a total data size of
data size
[0088] Table 1 is the data set information
[0089] Dataset Size ISCXVPN2016 20GB CICIDS2017 10GB BOT-IoT 10GB Self-collected regular network traffic 15GB Self-collected decentralized network DDoS traffic 1GB
[0090] ISCXVPN2016 dataset, CICIDS2017 dataset and the collected normal network traffic are unlabeled traffic and are used for model pre-training process. The collected traffic contains rich network protocols, such as the new encryption protocol QUIC protocol based on UDP transmission, the TLS protocol, the FTP protocol, the HTTP protocol, the SSH protocol and the like common network protocols.
[0091] The collected decentralized network DDoS traffic and BOT-IoT dataset are labeled traffic and are used for model fine-tuning process. The collected DDoS attack traffic is based on simulated Ethereum and Hyperledger Fabric1.4 network environment, and the nodes in the network are attacked by DDoS attack using scripts, and the traffic is collected at the attacked end and network layer. The BOT-IoT dataset is also collected based on the decentralized network environment, and the DDoS attack traffic is collected to expand the traffic database of the application.
[0092] Data preprocessing:
[0093] The application deletes the address resolution protocol (ARP) and the dynamic host configuration protocol (DHCP) packets, which are irrelevant to the specific traffic of the transmission content. In order to avoid the influence of the packet header, the traffic used for training deletes the Ethernet header, the IP header and the TCP header of the protocol port, which may introduce bias interference in the limited set with strong identification information. In the fine-tuning stage, we randomly select up to 500 flows from each class in all datasets. Each dataset is divided into training set, validation set and test set according to the ratio of 8:1:1. For the collected decentralized network DDoS traffic, the normal traffic irrelevant to the attack process needs to be filtered out according to the filtering steps described above, and the attack traffic of DDoS is purified; all traffic data need to be converted into class natural language token form understandable by the model before entering the model.
[0094] Model pre-training:
[0095] The pre-training process of the model is as shown in Figure 1 The data used for pre-training includes ISCXVPN2016 dataset, CICIDS2017 dataset and the collected normal network traffic. The BERT model is used as the pre-training model, and the specific parameters are as shown in Table 2:
[0096] Table 2 is the selection of Bert model parameters
[0097] Parameter Value Word embedding dimension 768 Number of layers of transformer encoder 12 Number of heads of multi-head attention mechanism in encoder unit 12 Hidden layer dimension of feed-forward neural network in encoder unit 3072 Size of part-of-speech tag table 65536 Pre-training batch size 32 Pre-training learning rate 2e-5 Number of pre-training iterations 10
[0098] Model fine-tuning:
[0099] The pre-trained network is inputted with the processed decentralized network DDoS attack traffic and BOT-IoT dataset DDoS traffic, and different from the pre-training process, in order to enhance the generalization performance of the model and improve the sensitivity of the fine-tuned model to time sequence characteristics, a bi-LSTM network is additionally arranged in the fine-tuned model to perform a binary classification operation, and specific parameters of the related network are shown in Table 3.
[0100] Table 3 is the selection of bi-LSTM network parameters
[0101] Parameter Value Hidden layer dimension 256 Number of layers of LSTM unit 2 Fine-tuning batch size 64 Fine-tuning learning rate 2e-5 Number of fine-tuning iterations 3
[0102] Performance evaluation and evaluation indexes:
[0103] The model is trained and tested on the collected dataset, and compared with the following two comparison methods:
[0104] SVM (Support Vector Machine): a classic machine learning method, which uses a kernel function to map the input space to a high-dimensional feature space and finds the optimal hyperplane for classification.
[0105] CNN (Convolutional Neural Network): a deep learning method, which uses convolutional layers and pooling layers to extract local features of input data, and uses fully connected layers for classification.
[0106] The following four evaluation indexes are used to measure the performance of different methods in the decentralized network DDoS attack identification task:
[0107] Accuracy (Accuracy): represents the proportion of correctly classified samples in the total number of samples.
[0108] Recall (Recall): represents the proportion of correctly classified positive examples in all positive examples.
[0109] Precision (Precision): represents the proportion of correctly classified positive examples in all samples classified as positive examples.
[0110] F1 value (F1-score): represents the harmonic mean of recall and precision.
[0111] Among them, the positive example refers to the DDoS attack traffic, and the negative example refers to the normal network traffic. The higher the four evaluation indexes, the better the performance of the method, and the specific test results are shown in Table 4. Figure 6
[0112] Summary:
[0113] The application is a decentralized network DDoS attack detection method based on a large language model, aiming to establish an efficient traffic monitoring system and a cooperative defense mechanism to identify and defend against DDoS attacks in a decentralized network.
[0114] In view of the network paralysis and failure problems that may be caused by DDoS attacks in a decentralized network, the application uses a method based on a large language model to detect DDoS attacks. Unlike traditional classifiers based on message length features, the application uses a pre-training-fine-tuning step to learn the features of complex traffic, thereby more accurately identifying DDoS attacks.
[0115] The test results of the application show that, under the same data set, the DDoS attack detector constructed by the application has a significant improvement in detection effect compared to traditional classifiers. Through real-time monitoring and identification of DDoS attack traffic, appropriate defense measures can be taken in a timely manner to ensure the security and stability of the network.
[0116] The technical solutions of the application can be modified or replaced by an ordinary skilled person, but cannot deviate from the spirit and scope of the application. The protection scope of the application shall be subject to the claims.
Claims
1. A decentralized network DDoS attack identification method based on a large language model, comprising the following steps: 1) Collect network traffic data, including unlabeled network traffic and decentralized network DDoS attack traffic; Label the collected decentralized network DDoS attack traffic; The unlabeled network traffic includes normal network traffic and various types of encrypted traffic in public datasets; the normal network traffic includes encrypted traffic in decentralized networks and encrypted traffic in centralized networks. 2) Convert the network traffic data collected in step 1) into a word vector sequence, which is used to embed the traffic data that the selected large language model cannot process into the word vector; 3) The large language model is pre-trained using word vector sequences obtained from unlabeled network traffic to learn a general representation of encrypted traffic; 4) Input the word vector sequence obtained by converting decentralized network DDoS attack traffic into the large language model pre-trained in step 3) to learn the characteristics of decentralized network DDoS attack traffic; 5) Input the features of the decentralized network DDoS attack traffic obtained in step 4) into the fine-tuning model based on bi-LSTM, perform the prediction task, compare the obtained prediction results with the corresponding labeled results, and then optimize the parameters of the fine-tuning model based on the comparison results. 6) For a decentralized network traffic to be identified, convert it into a word vector sequence and input it into the optimized fine-tuning model to identify whether it is decentralized network DDoS attack traffic.
2. The method according to claim 1, characterized in that, The method for converting collected network traffic data into word vector sequences is as follows: 21) Divide each flow in the collected network traffic data into multiple network bursts to obtain the burst sequence corresponding to the flow; the network burst is defined as a group of time-adjacent network data packets initiated from the requesting or responding end in a single flow. 22) Decompose the hexadecimal BURST sequence corresponding to each stream into a unit sequence, wherein each unit in the unit sequence consists of two adjacent bytes; then generate a token for the unit based on the encoding of the two bytes in the encoding dictionary; 23) For each token, determine its corresponding token content embedding, token position embedding, and token segment embedding, and generate the embedding representation of the token as a word vector; The word vector sequence is a token sequence.
3. The method according to claim 1 or 2, characterized in that, In step 2), the collected network traffic data is first subjected to domain filtering, packet filtering, and flow segmentation in sequence, dividing the collected network traffic data into multiple flows.
4. The method according to claim 3, characterized in that, The domain filtering method is as follows: First, filter out traffic that is not related to the target type; then, use the session statistics information in the traffic, combined with network information, session duration, and number of packets to perform secondary filtering on IP addresses, and filter out traffic that is not related to the target application and traffic with a data volume less than a set threshold.
5. The method according to claim 3, characterized in that, The packet filtering is used to filter out data packets that do not contain traffic characteristics.
6. The method according to claim 3, characterized in that, The method of flow segmentation is to divide the traffic of the target application into multiple flows based on 5-tuples and time intervals.
7. The method according to claim 1, characterized in that, The large language model mentioned is the BERT model.
8. A server, characterized in that, The method includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 7.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.