A method and device for identifying persistent routing under link flooding attack

Abstract

The application discloses a kind of link flooding attack under the identification method and device of persistent routing, the method is first collected traffic data from SDN data plane, and the flow characteristics of each link are extracted by SDN controller, to construct flow characteristic dataset and training set;Then construct LSTM classification model and carry out offline training;Again in the flow characteristics of each link under the link flooding attack in SDN controller is input to the LSTM classification model trained, to obtain the flow class of the flow characteristics of each link, to construct flow characteristic class dataset;Finally, flow characteristic class dataset is traversed, and the flood proportion of each link is obtained, further identified and positioned to link flooding attack under persistent routing.The application can accurately identify persistent routing under link flooding attack under the mixed flow including link flooding attack attack flow and benign flow, and is conducive to enhancing the effectiveness and accuracy of persistent routing identification.

Description

Technical Field

[0001] This invention belongs to the field of information security, and in particular relates to a method and apparatus for identifying persistent routes under link flooding attacks. Background Technology

[0002] Link Flooding Attack (LFA) is a new type of Distributed Denial-of-Service (DDoS) attack used to flood and congest critical links in a network. LFA controls each zombie node to flood its intermediate persistent routes (PRs) into a congested state, disrupting end-to-end service connections between hosts and targets. This stealthy flood attack traffic is characterized by continuity, legitimacy, and low rates. The detailed steps of LFA are: (i) Link graph construction: First, the attacker controls the zombie nodes to run the traceroute program to retrieve links from the zombie nodes to the target server; then, some links that are more destructive and stable to the target are selected from the links, and a link graph is formed by removing transient links and retaining non-crossing target links reachable by the target with stable IP addresses; among them, stable and usually high-traffic-density links are the PRs to be attacked. (ii) Attack setup: The traffic density of a PR is defined as the number of links that a server can use to connect from its available zombie nodes to the target area. Attackers prefer links with high traffic density. Once a PR is attacked, the end-to-end link to the target area may be cut off. (iii) Coordination of zombie nodes: The attacker commands each zombie node to flood the target PR to the decoy server. The attacker can control the flooding rate in advance to ensure that the target link bandwidth is exhausted during the attack, causing PR congestion. PR congestion will lead to an increase in the packet loss rate of legitimate traffic, thereby preventing benign hosts from accessing the target server. LFA instances include Crossfire, Coremelt, etc. LFA consumes link bandwidth, unlike other fraudulent DDoS attacks such as VLAN hopping, ARP spoofing, and IP address spoofing. As a defender, identifying the victim PR is a common prerequisite for existing measures to combat LFA, such as mobile target defense, route ambiguity, and rerouting. Therefore, in order to ensure the effectiveness of the defense, PR identification must achieve the highest possible accuracy. If the defender cannot take corresponding countermeasures in time for each incorrectly identified PR, it may not be able to alleviate PR congestion. For the host, such an unprotected PR will suffer high latency or even interruption, which will then lead to a degraded quality of its upper-layer services or even make it unavailable.

[0003] Currently, there is no systematic design method for accurately identifying PRs from links. One intuitive approach for each link is to determine the ratio between flood flow and all flow on that link over a period of time. Due to the stealthy nature of floods, the challenges are twofold: first, accurately extracting effective key flow features; and second, accurately classifying flood attack flows and benign flows that are similar in packet rate and size, handling continuous time-series flow data, as most flood flows must persist over a period of time to cause damage to the target, unlike benign flows. To determine the ratio, models can be used to classify attack and benign flows to further identify victim PRs. Classification can employ existing machine learning models specifically designed for time series analysis, including Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) networks. However, achieving high accuracy with other models will also be challenging because stealthy flood flows and benign flows are very similar to each other. Examples include Support Vector Machines (SVMs), Convolutional Neural Networks (CNNs), and Deep Neural Networks (DNNs) that use Principal Component Analysis (PCA).

[0004] RNNs are a popular type of neural network that contains loops that allow information to be passed between adjacent neurons. To improve RNNs when processing time-series data, LSTMs avoid long-term data dependencies by addressing the vanishing and exploding gradient problems. Furthermore, LSTMs are low-cost due to their default handling of early information. Specifically, the structure of an LSTM consists of three stages: (i) a forget gate, which determines which old information needs to be cleared from the cell state; (ii) an input gate, which determines what new information can be stored in the cell state; and (iii) an output gate, which determines the output value.

[0005] Software-Defined Networking (SDN) controllers can use two common tools, OpenSketch and P4, to efficiently collect traffic characteristics at the flow-level granularity. For example, to capture these characteristics, OpenSketch leverages flow table entries from switches by aggregating traffic statistics. Additionally, P4, a programming language for data plane processing, provides a flexible way to capture traffic statistics and send them to the controller for analysis, although P4 is typically not used for processing raw traffic transmissions. The collected characteristics can then be stored in files for further analysis. For commercial SDN controllers, file storage size varies by manufacturer and model, typically ranging from tens to hundreds of gigabytes, depending on network size. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing technologies by providing a method and apparatus for identifying persistent routes under link flooding attacks. This invention can accurately identify persistent routes under link flooding attacks.

[0007] The objective of this invention is achieved through the following technical solution: The first aspect of this invention provides a method for identifying persistent routes under a link flooding attack, comprising the following steps:

[0008] (1) Collect traffic data of each link from the SDN data plane according to the preset sampling period, extract the flow characteristics of the traffic data of each link through the SDN controller to construct a flow characteristic dataset, and construct a training set based on the flow characteristic dataset;

[0009] (2) Construct an LSTM classification model based on the LSTM network, use the training set to train the LSTM classification model offline, and adjust the parameters of the LSTM classification model according to the loss function and accuracy of the LSTM classification model to obtain a trained LSTM classification model.

[0010] (3) Input the flow features of the traffic data of each link under the link flooding attack in the SDN network into the trained LSTM classification model to obtain the traffic category of the flow features of each link, so as to construct the flow feature category dataset.

[0011] (4) Obtain topology status information from the network topology and traverse the flow feature category dataset to obtain the flood ratio of each link. Obtain the persistent route storage set and its location information based on the topology status information and flood ratio to identify and locate the persistent route under the link flooding attack.

[0012] Further, step (1) includes the following sub-steps:

[0013] (1.1) Based on the open dataset CAIDA, a link flooding attack was simulated, and traffic data of each link was collected from the SDN data plane according to the preset sampling period, while the actual traffic category of the traffic data was marked.

[0014] (1.2) The SDN controller extracts features from the traffic data of each link to obtain the flow features of each link, and constructs a flow feature dataset based on the flow features of each link.

[0015] (1.3) Construct a training set based on the flow feature dataset and the flow category of the flow data.

[0016] Furthermore, the flow categories include flood flow and benign flow;

[0017] The flow characteristics include time, source IP, destination IP, protocol, and packet size.

[0018] Furthermore, the LSTM classification model includes an input layer, a first LSTM layer, a second LSTM layer, a first dense layer, a second dense layer, and an output layer; wherein, the input layer is used to input flow features, the first LSTM layer is an LSTM layer with 64 neurons, the second LSTM layer is an LSTM layer with 32 neurons, the first dense layer is a fully connected layer with 16 neurons connected by a ReLU activation function, the second dense layer is a fully connected layer with 1 neuron connected by a sigmoid activation function, and the output layer is used to output flow category prediction values.

[0019] Furthermore, obtaining the trained LSTM classification model specifically includes: setting the number of offline training rounds; in each round of training, inputting the flow features from the training set into the LSTM classification model to obtain the flow category prediction value; calculating the loss and accuracy of the LSTM classification model based on the flow category prediction value and the flow category in the training set; and updating the parameters of the LSTM classification model by backpropagation using the mini-batch gradient descent method based on the loss and accuracy of the LSTM classification model until the loss of the LSTM classification model is minimized and converged while the accuracy is maximized and remains unchanged, thereby obtaining the trained LSTM classification model.

[0020] Furthermore, the expressions for the loss and accuracy of the LSTM classification model are as follows:

[0021]

[0022]

[0023] Where L represents the loss of the LSTM classification model, A represents the accuracy of the LSTM classification model, and y piy represents the i-th predicted value of the traffic category in the links labeled α and β. ri This represents the i-th actual value of the traffic category in the links labeled α and β, where n is the number of actual values. v It represents the amount of traffic on that link.

[0024] Further, the step of obtaining topology status information from the network topology and traversing the flow feature category dataset to obtain the flood ratio of each link specifically includes: obtaining topology status information from the network topology, which includes router numbers and port numbers; determining the routing link index of the link based on the router number and port number; traversing the links in the flow feature category dataset; initializing the index set according to the routing link index; initializing the persistent route storage set to an empty set; and initializing the quantity of flood traffic and benign traffic on the link to 0; traversing the flow features of each link; determining whether the traffic category of each flow feature is flood traffic; if the traffic category is flood traffic, incrementing the quantity of flood traffic by 1; otherwise, incrementing the quantity of benign traffic by 1; and calculating the flood ratio of each link based on the quantity of flood traffic and the quantity of benign traffic.

[0025] Furthermore, the step of obtaining a persistent route storage set and its location information based on topology status information and flood ratio to identify and locate persistent routes under link flooding attacks specifically includes: sorting the routes in ascending order of flood flow volume and updating the route link index corresponding to the flow characteristics of the links in the index set; determining whether the flood ratio on the link is greater than a preset flood ratio threshold; if the flood ratio is greater than the preset flood ratio threshold, saving the updated route link index, the flood flow volume, and the benign flow volume of the link to the persistent route storage set; and identifying and locating persistent routes under link flooding attacks based on the persistent route storage set.

[0026] A second aspect of the present invention provides an apparatus for identifying persistent routes under a link flooding attack, comprising one or more processors and a memory, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-described method for identifying persistent routes under a link flooding attack.

[0027] A third aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used to implement the above-described method for identifying persistent routes under a link flooding attack.

[0028] The beneficial effects of this invention are that it first extracts the flow characteristics of links in the network, then uses LSTM to accurately classify the traffic with time-series characteristics, and finally identifies and locates persistent routes under link flooding attacks. This enhances the effectiveness and accuracy of the persistent route identification method, providing a prerequisite for subsequent defense methods, such as mobile target-based defense, route ambiguity, and rerouting, so as to take measures to effectively alleviate congestion. This can further solve the security defense problem of LFA, reduce the congestion caused by this type of attack on the attacked network, and ultimately cause attackers to lose interest in the attack target. This invention can also accurately identify persistent routes under link flooding attacks even under mixed traffic including link flooding attack traffic and benign traffic constructed based on CAIDA traffic trajectories of the real Internet. Attached Figure Description

[0029] Figure 1 This is a schematic diagram illustrating the process of a link flooding attack in this invention;

[0030] Figure 2 This is a structural block diagram of the persistent route identification method under link flooding attack according to the present invention;

[0031] Figure 3 This is a schematic diagram of the operation of the LSTM classification model in this invention;

[0032] Figure 4 This is a schematic diagram of the LSTM classification model in this invention;

[0033] Figure 5 This is a schematic diagram of a persistent route identification device under a link flooding attack according to the present invention. Detailed Implementation

[0034] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0035] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular forms “a,” “the,” and “the” used in this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0036] It should be understood that although the terms first, second, third, etc., may be used in this invention to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of this invention, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0037] The present invention will now be described in detail with reference to the accompanying drawings. Unless otherwise specified, the features of the following embodiments and implementations can be combined with each other.

[0038] In the Internet, for the attack of invisible link flooding, defenders need to accurately identify the persistent routes (PRs) of victims outside the links. Therefore, the method for identifying persistent routes under link flooding attacks in SDN (Software-Defined Networking) networks of the present invention can accurately distinguish between flood flow characteristics and benign characteristics in time series. This identification method uses Long-Short-Term Memory (LSTM) networks to effectively identify persistent routes (PRs) under invisible link flooding attacks (LFA).

[0039] See Figure 2 The method for identifying persistent routes under link flooding attacks according to the present invention specifically includes the following steps:

[0040] (1) Collect traffic data of each link from the SDN data plane according to the preset sampling period, extract the flow characteristics of the traffic data of each link through the SDN controller to construct a flow characteristic dataset, and construct a training set based on the flow characteristic dataset.

[0041] (1.1) Based on the open dataset CAIDA, a link flooding attack was simulated, and traffic data of each link was collected from the SDN data plane according to the preset sampling period, while the traffic category of the traffic data was marked.

[0042] In this embodiment, since persistent route identification needs to be performed under a link flooding attack environment, it is necessary to simulate a link flooding attack to obtain traffic data. Specifically, a link flooding attack is simulated based on the open dataset CAIDA to obtain traffic data, and the process of the link flooding attack is as follows: Figure 1As shown, the traffic category corresponding to the traffic data can be determined when simulating a link flooding attack. Then, link traffic data is collected from the SDN data plane according to a preset sampling period, and the traffic category of the traffic data is marked. The traffic data includes background traffic and attack traffic; the open dataset CAIDA includes TCP packets and UDP packets, both of which are composed of real link flooding attack traffic, with TCP packets and UDP packets accounting for approximately 62.9% and 34.9% respectively; the traffic categories include flood traffic and benign traffic.

[0043] It should be understood that the sampling period can be set according to actual needs. For example, traffic data of each link can be collected periodically from the SDN data plane every 3 to 5 seconds in each round. Numbers can be used as markers for traffic categories. For example, a marker of 1.0 indicates that the traffic category is flood traffic, and a marker of 0.0 indicates that the traffic category is benign traffic. Of course, other numbers or symbols can also be used for marking.

[0044] (1.2) The SDN controller extracts features from the traffic data of each link to obtain the flow features of each link, and constructs a flow feature dataset based on the flow features of each link.

[0045] It should be understood that the SDN controller can use two commonly used tools, OpenSketch and P4, to effectively collect traffic features at the flow level. Therefore, in this embodiment, the SDN controller can be used to extract the flow features of the link's traffic data.

[0046] Specifically, the flow characteristics of the link include the flow header information and throughput in the time series of traffic data. Each flow characteristic includes time, source IP, destination IP, protocol, and packet size, and each flow characteristic is represented as f. α, = (t, s, d, p, l), representing the link index of the β-th port of the α-th router, where t, s, d, p, and l represent time, source IP, destination IP, protocol, and packet size, respectively. Each link flow function file can be stored on a local disk or a remote server, and all flow characteristic information for each link is captured in S. α, In, that is, S α, ={f α,}, construct a flow feature dataset S based on all flow features of each link. f That is, all flow characteristics of all links are stored in S f ={S α,}, such as a flow characteristic f on a certain link. 2, =(1.00865,167843841,167843842,6,588, stored in S) 2, middle.

[0047] It's important to note that in large-scale networks with high traffic, storage performance bottlenecks may lie in space and I / O speed, which can affect switch interaction speed. To address this, SDN controllers employ state-of-the-art high-performance storage devices, such as solid-state drives or distributed storage systems, and promptly delete unnecessary old files to improve switch interaction speed.

[0048] (1.3) Construct a training set based on the flow feature dataset and the flow category of the flow data.

[0049] In this embodiment, the true traffic categories of the traffic data are marked during the link flooding attack simulation process. Therefore, the true traffic categories of the flow features of the traffic data can be determined. Then, a certain proportion, such as 2 / 3, of the flow features and their corresponding traffic categories are selected from the flow feature dataset to construct a training set. This training set can be represented as S. f ′ ={S ′ α,}, where S ′ α, ={f ′ α,}, f ′ α, =(t,s,d,p,l,y) r ), y r For flow features, the flow category is defined; the flow feature includes the flow category y. r The following is represented as f ′ α, All flow characteristics of the link include traffic category y r Then it is represented as S ′ α, .

[0050] (2) Construct an LSTM classification model based on the LSTM network, use the training set to train the LSTM classification model offline, and adjust the parameters of the LSTM classification model according to the loss function and accuracy of the LSTM classification model to obtain a trained LSTM classification model.

[0051] In this embodiment, the structure of the LSTM classification model is as follows: Figure 4As shown, this LSTM classification model includes an input layer, a first LSTM layer, a second LSTM layer, a first dense layer, a second dense layer, and an output layer. The input layer is used to input flow features. The first LSTM layer is an LSTM layer with 64 neurons, the second LSTM layer is an LSTM layer with 32 neurons, the first dense layer is a fully connected layer with 16 neurons connected by a ReLU activation function, and the second dense layer is a fully connected layer with 1 neuron connected by a sigmoid activation function. The output layer is used to output flow category predictions.

[0052] Specifically, the stream feature dataset S f Each flow feature f of each link in the data α, Input into the LSTM classification model, x i For interlayer parameters, first S f The input layer has a weight of w1 and an output value of x1, calculated as x1,w1 = Input(S f x1 passes through the first LSTM layer with connection weight w2. This first LSTM layer accepts x1 and generates x2, calculated as x2,w2 = LSTM(64,5,x1). x2 passes through the second LSTM layer with connection weight w3. This second LSTM layer accepts x2 and generates x3, calculated as x3,w3 = LSTM(32,5,x2). x3 passes through the first dense layer with connection weight w4. This first dense layer accepts x3 and generates x4, calculated as x4,w4 = Dense(16,relu,x3). x4 passes through the second dense layer with connection weight w5. This second dense layer accepts x4 and generates x5, calculated as x5,w5 = Dense(1,sigmoid,x4). x5 is then passed through the output layer to obtain the traffic category prediction value y. p The calculation formula is y p =x5. The predicted traffic category value y was obtained. p Each flow feature is denoted as f″′ α,β =(t,s,d,p,l,y) p The predicted traffic category value y was obtained. p The flow characteristics of each link are denoted as S″′. α,β ={f″′ α,β}, thus obtaining the traffic category prediction value y p The stream feature dataset is denoted as S f "′={S″′ α,β}

[0053] In this embodiment, obtaining the trained LSTM classification model specifically includes: setting the number of offline training rounds; during each training round, inputting the flow features from the training set into the LSTM classification model to obtain the predicted flow category values; calculating the loss and accuracy of the LSTM classification model based on the predicted flow category values ​​and the flow categories in the training set; and updating the parameters of the LSTM classification model using mini-batch gradient descent backpropagation based on the loss and accuracy of the LSTM classification model until the loss of the LSTM classification model is minimized and converged while the accuracy is maximized and remains unchanged, thereby obtaining the trained LSTM classification model.

[0054] Furthermore, the loss function of the LSTM classification model is expressed as:

[0055]

[0056] Where L represents the loss of the LSTM classification model, y pi y represents the i-th predicted value of the traffic category in the links labeled α and β. ri This represents the i-th actual value of the traffic category in the links labeled α and β, where n is the number of actual values. v It represents the amount of traffic on that link.

[0057] Furthermore, the accuracy of the LSTM classification model is expressed as:

[0058]

[0059] Where A represents the accuracy of the LSTM classification model, y pi y represents the i-th predicted value of the traffic category in the links labeled α and β. ri This represents the i-th actual value of the traffic category in the links labeled α and β, where n is the number of actual values. v It represents the amount of traffic on that link.

[0060] The classification model has customized inner parameters, is effectively trained offline, and classifies attack traffic from feature data mixed with benign traffic online, determining the flood flow ratio at each stage. A schematic diagram of the LSTM classification model operation is shown below. Figure 3 As shown. Specifically, the offline training rounds are set. In each round of training, all flow features extracted from each link (links are identified by two bits α and β, where α and β are the router number and port number, respectively) are used as input to the LSTM classification model, i.e., the training set S f ′ The flow features are input into the LSTM classification model to obtain the predicted flow category value, denoted by y. p This indicates that the training set contains flow features and their corresponding true flow categories y. rPredicted value y based on traffic category p and the actual traffic category y r Calculate the loss and accuracy of the LSTM classification model. Based on the loss and accuracy of the LSTM classification model, use mini-batch gradient descent to backpropagate and update the parameters of the LSTM classification model, minimizing the loss and maximizing the accuracy. Simultaneously, save the optimal parameters of the LSTM classification model, including all model parameters such as model weights and structure, in M. p In the formula, M is used for calculation. p =Model.save(w1,w2,w3,w4,w5) contains all the parameters of the LSTM classification model, which can represent the LSTM classification model. After multiple rounds of training, the result remains unchanged after a certain value after each round of training. That is, when the loss of the LSTM classification model is minimized and converged and the accuracy is maximized without change, it means that the optimal limit has been reached, and the iterative training is stopped. The parameters of the LSTM classification model at this time are the parameters of the best-performing round among all the rounds. In this way, the trained LSTM classification model can be obtained.

[0061] It should be understood that, due to the time-series and continuous nature of flow information, in order to accurately and efficiently calculate the proportion of flood flow later, an LSTM classification model is used for offline training to obtain a trained LSTM classification model. This trained LSTM classification model is then used online to predict the flow category, enabling accurate and efficient calculation of the proportion of flood flow later. The LSTM classification model can automatically store the parameters with the best training results after training.

[0062] For example, 1.0 or 0.0 are used as labels to indicate the final classification result, i.e., 1.0 represents flood flow and 0.0 represents benign flow. In this embodiment, when the number of rounds reaches 3, the training set accuracy of the LSTM classification model can reach a maximum of [missing value]. When using a separate dataset as a validation set, the accuracy reaches a maximum of 99.009%. Correspondingly, the loss of the LSTM classification model during training can be reduced to [amount missing]. During testing, the loss of the LSTM classification model can be reduced to 0.998%, thus the LSTM classification model can be trained more effectively on time series data, with higher convergence rate and lower loss rate.

[0063] (3) Input the flow features of the traffic data of each link under the link flooding attack in the SDN network into the trained LSTM classification model to obtain the traffic category of the flow features of each link, so as to construct the flow feature category dataset.

[0064] Specifically, the traffic data of each link under the link flooding attack in the collected SDN network is extracted by SDN control to obtain the flow features of each link. The flow features of each link are then input into the trained LSTM classification model to obtain the flow category of each link's flow features, that is, whether it is flood flow or benign flow.

[0065] It should be understood that the flow feature category dataset contains all flow features of all links and their corresponding traffic categories, and the flow feature category dataset is denoted as S. f "′={S″′ α,β},S″′ α,β ={f″′ α,β},f″′ α,β =(t,s,d,p,l,y) p ).

[0066] (4) Obtain topology state information from the network topology and traverse the flow feature category dataset to obtain the flood ratio of each link. Based on the topology state information and the flood ratio, obtain the persistent route storage set and its location information to identify and locate persistent routes under link flooding attacks. The topology state information includes router number α and port number β.

[0067] In this embodiment, topology status information is obtained from the network topology, and the flow feature category dataset is traversed to obtain the flood ratio of each link. Specifically, this includes: obtaining topology status information from the network topology, which includes router numbers and port numbers; determining the routing link index of the link based on the router number and port number; traversing the links in the flow feature category dataset; initializing the index set according to the routing link index; initializing the persistent route storage set to an empty set; and initializing the quantity of flood traffic and benign traffic on the link to 0; traversing the flow features of each link; determining whether the traffic category of each flow feature is flood traffic; if the traffic category is flood traffic, incrementing the quantity of flood traffic by 1; otherwise, incrementing the quantity of benign traffic by 1; and calculating the flood ratio of each link based on the quantity of flood traffic and the quantity of benign traffic.

[0068] Specifically, it is necessary to prepare a pre-classified stream feature category dataset S. f "′={S″′ α,β} and the corresponding index set S t A persistent route store S that stores persistent routes by location index p S p Initially, the set is empty. The first n will be captured within 3 to 5 seconds. f Each link file contains an index (v) of the flow characteristic file on each link. α,β Place it into the corresponding index set St In the middle, for S t Each v in α,β Define the flood ratio and initialize ρ a =0. Then, it first enters an outer loop, which iterates through the traffic on all links, v α,β It is the routing link index of the β-th port of the α-th router, v α,β Used as a link identifier, n t It is the amount of flood flow, n n It is the amount of benign traffic on each link, n v This is the total number of traffic characteristics in the current link. Initial value: S f "′={S″′ α,β}, S t ={v α,β}, S p ={}, n t =0, n n =0. Then, the second inner loop iterates through each flow feature on each link, checking if the label of the traffic category for each flow feature is 1.0. If the label of the traffic category is 1.0, i.e., y... p =1.0, then the flood flow rate is increased by 1, i.e., n t =n t +1; otherwise, increment the number of benign traffic by 1, i.e., n. n =n n +1. Then, calculate the flood proportion on each link based on the amount of flood flow and the amount of benign flow.

[0069] In this embodiment, a persistent route storage set and its location information are obtained based on topology status information and flood ratio to identify and locate persistent routes under link flooding attacks. Specifically, this includes: sorting the routes in ascending order of flood flow volume and updating the route link index corresponding to the flow characteristics of the links in the index set; determining whether the flood ratio on the link is greater than a preset flood ratio threshold; if the flood ratio is greater than the preset flood ratio threshold, saving the updated route link index, the flood flow volume, and the benign flow volume of the link to the persistent route storage set; and identifying and locating persistent routes under link flooding attacks based on the persistent route storage set.

[0070] Specifically, first press n t ascending pairs of S f Sort by "′ and in S t The routing link index v corresponding to the flow characteristics of the updated link. α,βThen, the flood ratio on the link is compared with a preset flood ratio threshold. If the flood ratio is greater than the preset threshold, it indicates that the link has flood traffic, suggesting an attack traffic intrusion. The link's routing index, the amount of flood traffic, and the amount of benign traffic need to be saved to the link information parameter r and then placed into S. p ={r}, where r = (v α,β ,n t ,n n This process continues until all links have been traversed, at which point the loop ends, ultimately yielding sorted persistent routing information of the attacked system, along with location information v. α,β This traceability allows for efficient and dynamic identification and location of persistent routes under link flooding attacks, further enabling the identification of which persistent routes in the network topology are under attack. For example, for links 2-6, ρ a =88.9%, the flood ratio of this link is greater than the flood ratio threshold, so the link has been attacked and is identified as a persistent route. The location is port 6 of router 2. Detailed defense measures can be taken for the specific location later.

[0071] It should be noted that the flood proportion threshold can be set to 0 or a non-zero value less than 1. This is because in some cases, a flood proportion less than 1 can be considered approximately indicative of no link flooding attack. For example, if the link experiences flooding traffic, then ρ... a It could be 82.6, 95.2, or any other non-zero value greater than 1.

[0072] This invention first extracts the flow characteristics of links in the network, then uses LSTM to accurately classify the traffic with time-series characteristics, and finally identifies and locates persistent routes under link flooding attacks. This enhances the effectiveness and accuracy of the persistent route identification method, providing a prerequisite for subsequent defense methods, such as mobile target-based defense, route ambiguity, and rerouting, so as to take measures to effectively alleviate congestion. This can further solve the security defense problem of link flooding attacks, reduce the congestion caused by such attacks on the attacked network, and ultimately cause attackers to lose interest in the attack target. This invention can also accurately identify persistent routes under link flooding attacks in mixed traffic including link flooding attack traffic and benign traffic constructed based on CAIDA traffic trajectories of the real Internet.

[0073] Corresponding to the embodiments of the persistent route identification method under the aforementioned link flooding attack, the present invention also provides embodiments of the persistent route identification device under the link flooding attack.

[0074] See Figure 5The present invention provides a persistent route identification device under a link flooding attack, comprising one or more processors and a memory, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the persistent route identification method under a link flooding attack in the above embodiment.

[0075] The embodiments of the persistent route identification device under link flooding attacks of the present invention can be applied to any device with data processing capabilities, such as a computer. The device embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 5 The diagram shown is a hardware structure diagram of any data processing-capable device where the persistent route identification device under a link flooding attack of the present invention is located, except... Figure 5 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0076] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0077] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0078] This invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the persistent route identification method under link flooding attacks described in the above embodiments.

[0079] The computer-readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0080] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for identifying persistent routes under a link flooding attack, characterized in that, Includes the following steps: (1) Collect traffic data of each link from the SDN data plane according to the preset sampling period, extract the flow features of the traffic data of each link through the SDN controller to construct a flow feature dataset, and construct a training set based on the flow feature dataset; step (1) includes the following sub-steps: (1.1) Based on the open dataset CAIDA, a link flooding attack is simulated, and traffic data of each link is collected from the SDN data plane according to a preset sampling period. At the same time, the actual traffic category of the traffic data is marked; the traffic category includes flood traffic and benign traffic. (1.2) The SDN controller extracts features from the traffic data of each link to obtain the flow features of each link, and constructs a flow feature dataset based on the flow features of each link; the flow features include time, source IP, destination IP, protocol and packet size; (1.3) Construct a training set based on the flow feature dataset and the flow categories of the flow data; (2) Construct an LSTM classification model based on the LSTM network, use the training set to train the LSTM classification model offline, and adjust the parameters of the LSTM classification model according to the loss function and accuracy of the LSTM classification model to obtain a trained LSTM classification model. (3) Input the flow features of the traffic data of each link under the link flooding attack in the SDN network into the trained LSTM classification model to obtain the traffic category of the flow features of each link, so as to construct the flow feature category dataset. (4) Obtain topology status information from the network topology and traverse the flow feature category dataset to obtain the flood ratio of each link. Obtain the persistent route storage set and its location information based on the topology status information and the flood ratio in order to identify and locate the persistent route under the link flooding attack. The process of obtaining topology status information from the network topology and traversing the flow feature category dataset to obtain the flood ratio of each link specifically includes: obtaining topology status information from the network topology, which includes router numbers and port numbers; determining the routing link index of the link based on the router number and port number; traversing the links in the flow feature category dataset; initializing the index set according to the routing link index; initializing the persistent route storage set to an empty set; and initializing the quantity of flood traffic and benign traffic on the link to 0; traversing the flow features of each link; determining whether the traffic category of each flow feature is flood traffic; if the traffic category is flood traffic, incrementing the quantity of flood traffic by 1; otherwise, incrementing the quantity of benign traffic by 1; and calculating the flood ratio of each link based on the quantity of flood traffic and the quantity of benign traffic. The step of obtaining a persistent route storage set and its location information based on topology status information and flood ratio to identify and locate persistent routes under link flooding attacks specifically includes: sorting the routes in ascending order of flood flow volume and updating the route link index corresponding to the flow characteristics of the links in the index set; determining whether the flood ratio on the link is greater than a preset flood ratio threshold; if the flood ratio is greater than the preset flood ratio threshold, saving the updated route link index, the flood flow volume, and the benign flow volume of the link to the persistent route storage set; and identifying and locating persistent routes under link flooding attacks based on the persistent route storage set.

2. The method for identifying persistent routes under link flooding attacks according to claim 1, characterized in that, The LSTM classification model includes an input layer, a first LSTM layer, a second LSTM layer, a first dense layer, a second dense layer, and an output layer. The input layer is used to input flow features. The first LSTM layer is an LSTM layer with 64 neurons, the second LSTM layer is an LSTM layer with 32 neurons, the first dense layer is a fully connected layer with 16 neurons connected by a ReLU activation function, and the second dense layer is a fully connected layer with 1 neuron connected by a sigmoid activation function. The output layer is used to output flow category prediction values.

3. The method for identifying persistent routes under link flooding attacks according to claim 1, characterized in that, The specific steps for obtaining the trained LSTM classification model include: setting the number of offline training rounds; in each round of training, inputting the flow features from the training set into the LSTM classification model to obtain flow category prediction values; calculating the loss and accuracy of the LSTM classification model based on the flow category prediction values ​​and the flow categories in the training set; and updating the parameters of the LSTM classification model using mini-batch gradient descent backpropagation based on the loss and accuracy of the LSTM classification model, until the loss of the LSTM classification model is minimized and converged while the accuracy is maximized and remains unchanged, thus stopping the iterative training to obtain the trained LSTM classification model.

4. The method for identifying persistent routes under link flooding attacks according to claim 1 or 3, characterized in that, The expressions for the loss and accuracy of the LSTM classification model are as follows: Where L represents the loss of the LSTM classification model, and A represents the accuracy of the LSTM classification model. Indicates that it is marked as The i-th predicted value of the traffic category in the link. Indicates that it is marked as The i-th actual value of the traffic category in the link. It represents the amount of traffic on that link.

5. A device for identifying persistent routes under a link flooding attack, comprising one or more processors and a memory, characterized in that, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the persistent route identification method under the link flooding attack according to any one of claims 1-4.

6. A computer-readable storage medium, characterized in that, It stores a program that, when executed by a processor, is used to implement the method for identifying persistent routes under a link flooding attack as described in any one of claims 1-4.

Images