A Reflection Amplification Attack Detection Method Based on Frequency Domain Analysis and Inter-flow Characteristics

Abstract

This invention discloses a reflection amplification attack detection method based on frequency domain analysis and inter-flow features. The method includes: converting packet-level data generated at the network interface into continuous flow-level data over time; establishing a window mechanism based on the flow-level data to extract flow-level frequency domain features and inter-flow features within a spatial window; concatenating the flow-level frequency domain features and inter-flow features; and obtaining the attack detection result of the spatial window based on the concatenation result. This invention achieves high real-time performance and high accuracy in the detection process, and provides more comprehensive fine-grained classification information.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method for detecting reflection amplification attacks based on frequency domain analysis and inter-stream characteristics. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks are easy to launch and extremely destructive network attacks. In such attacks, multiple controlled hosts send a large number of connection requests to the same target (such as a web server, DNS server, or other network asset), causing the target to eventually exhaust its computing resources to process these requests and become unable to respond to legitimate requests.

[0003] In recent years, some new and notable distributed denial-of-service (DDoS) attacks have relied on reflection and amplification mechanisms, a form of attack known as reflection-amplified DDoS attacks. Attackers send carefully crafted request packets with spoofed source IPs to specific public servers (such as NTP servers), which then forward responses to the target victim. These selected public servers often amplify traffic, allowing attackers to generate attack traffic several times greater than the original by sending only a few requests, until the target machine is crippled. Due to the low resource consumption and high stealth provided to the attack source by reflection-amplified DDoS attacks, network security incidents using this method are becoming increasingly frequent.

[0004] Since DRDoS attack mechanisms inherently require the support of source IP spoofing techniques, the most effective way to counter such attacks is to disable source IP spoofing traffic at the network transmission stage (e.g., on the ISP side). Although many specific methods and measures to counter DRDoS attacks at the source based on the above principles have been proposed, these measures do not bring actual benefits to the implementers (e.g., ISPs) and consume additional computing resources. Therefore, the actual deployment and use of such countermeasures / blocking measures are uneven, and effective endpoint attack detection and mitigation methods remain necessary.

[0005] Currently, there are three main problems with the detection methods for DRDoS attacks: (1) The detection granularity is too fine, which cannot meet the real-time requirements of denial-of-service attacks; (2) The detection model is not good enough, resulting in low precision and recall rates; (3) It can only distinguish between DRDoS and benign traffic, and cannot classify different types of DRDoS attacks in detail, so it cannot provide further decision support information for IDS or network administrators. Summary of the Invention

[0006] This invention addresses the problems faced by traditional DRDoS detection technologies by designing a DRDoS attack detection and fine-grained classification method based on frequency domain analysis, inter-flow features, and deep learning. This method achieves high real-time performance and accuracy in the detection process and provides more comprehensive fine-grained classification information.

[0007] The technical solution of this invention is as follows:

[0008] A method for detecting reflection amplification attacks based on frequency domain analysis and inter-flow characteristics, the method comprising:

[0009] Convert packet-level data generated at the network interface into continuous stream-level data over time.

[0010] A windowing mechanism is built on the flow-level data to extract the flow-level frequency domain features and inter-flow features within the spatial window;

[0011] The flow-level frequency domain features and inter-flow features are spliced ​​together;

[0012] Based on the splicing result, the attack detection result of the spatial window is obtained.

[0013] Furthermore, before establishing a windowing mechanism based on the flow-level data to extract the flow-level frequency domain features and inter-flow features within the spatial window, the method further includes:

[0014] The flow-level data is binary-classified using a decision tree classifier to obtain flow classification results; wherein, the flow classification results include: benign flow or suspicious flow;

[0015] If the inter-flow data is suspicious, the process jumps to the windowing mechanism built on the flow-level data to extract the flow-level frequency domain features and inter-flow features within each spatial window.

[0016] Furthermore, the extraction of flow-level frequency domain features within the spatial window includes:

[0017] Extract the feature matrix D of the spatial window;

[0018] The feature matrix D is compressed to obtain the dimensionality-reduced feature matrix D. ′ ;

[0019] In the feature matrix S ′ Perform a discrete Fourier transform on each feature to obtain the corresponding frequency domain feature;

[0020] After converting the feature values ​​of the frequency domain features to the real number domain by taking the modulus, logarithmic operations are performed bit by bit to obtain the flow level frequency domain features within the spatial window.

[0021] Furthermore, the feature matrix S is compressed to obtain the dimensionality-reduced feature matrix Si.′ ,include:

[0022] Based on the training data, the principal component matrix P of the spatial window is obtained;

[0023] Calculate the mean of the feature matrix D;

[0024] Subtracting the mean from the feature matrix S and then performing matrix multiplication with the pseudo-inverse of the principal component matrix P yields the dimensionality-reduced feature matrix S. ′ .

[0025] Furthermore, the inter-flow characteristics include: time-related inter-flow characteristics, source port number change-related inter-flow characteristics, forward packet count-related inter-flow characteristics, and other inter-flow characteristics; wherein, the time-related inter-flow characteristics include: window duration, minimum interval of flow time, maximum interval of flow time, mean of flow time, and standard deviation of flow time; the forward packet count-related inter-flow characteristics include: mean of forward packet count, standard deviation of forward packet count, and volatility of forward packet count; and the other inter-flow characteristics include: flow count per second, packet count per second, user-generated traffic count, and concurrent connection count.

[0026] Furthermore, the extraction of source port number change-related inter-flow features within the spatial window includes:

[0027] Based on statistical characteristics, five counter-form features of the spatial window are obtained; wherein, the five counter-form features include: the number of consecutive equal source ports, the number of consecutive increasing / decreasing source ports, the number of non-consecutive equal source ports, the number of non-consecutive increasing source ports, the number of non-consecutive decreasing source ports, and the number of source port mutations.

[0028] Based on the five counter form characteristics, determine whether the source port number has a continuous changing trend but some values ​​are lost in the middle, so as to obtain the packet loss rate characteristics;

[0029] The five counter format features and the packet loss rate are used as inter-flow features related to the source port number change of this spatial window.

[0030] Furthermore, obtaining the attack detection result of the spatial window based on the splicing result includes:

[0031] The splicing result is input into a detection model, which is a trained deep network with residual structure;

[0032] Based on the output of the detection model, the attack detection result of the spatial window is obtained.

[0033] A reflection amplification attack detection device based on frequency domain analysis and inter-flow characteristics, the device comprising:

[0034] The structure conversion module is used to convert packet-level data generated at the network interface into continuous stream-level data in a time series.

[0035] The feature extraction module is used to build a window mechanism based on the flow-level data, extract the flow-level frequency domain features and inter-flow features within the spatial window, and then concatenate the flow-level frequency domain features and inter-flow features.

[0036] An attack detection module is used to obtain the attack detection result of the spatial window based on the splicing result.

[0037] A computer device, characterized in that the computer device comprises: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the reflection amplification attack detection method based on frequency domain analysis and inter-flow characteristics as described above.

[0038] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the reflection amplification attack detection method based on frequency domain analysis and inter-flow characteristics as described above.

[0039] Compared with existing technologies, the frequency domain features and inter-stream features of the present invention have strong feature benefits, thereby improving the precision, recall and f1 value of attack detection. Attached Figure Description

[0040] Figure 1 Overview of the system architecture of this invention.

[0041] Figure 2 The system processing flowchart of this invention.

[0042] Figure 3 Window load variation.

[0043] Figure 4 Horizontal comparison results (the oblique bar chart is from this invention).

[0044] Figure 5 Results of feature benefit analysis. Detailed Implementation

[0045] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0046] The DRDoS detection framework designed in this invention consists of three processing stages: data preparation, feature extraction, and detection. Figure 1 This is an overview diagram of the system architecture of the present invention. Figure 2This is a flowchart of the system processing of this invention. First, the main task of the data preparation stage is to transform the packet-level data structure generated at the network interface into a window-level data structure through a stream-level data structure. In this stage, the high-speed stream processing module first integrates the packet-level data structure into a stream-level data structure, and then the high-purity window generation module generates window-level data fragments that accurately describe the behavior patterns of network attackers for subsequent use. Second, the feature extraction stage aims to extract efficient and highly representative features to facilitate real-time and accurate processing in the detection stage. This invention uses a feature compression module to perform low-loss compression on the feature dimensions of a fragment, followed by low-loss compression on the sample quantity dimension using a frequency domain feature extraction module. Furthermore, the frequency domain features generated by the frequency domain feature extraction module are also a form of window-level feature (it is worth noting that the window-level features, user-level features, and inter-stream feature expressions mentioned in this invention all refer to the same type of feature), which can well represent the combination relationships between the various dimensions of the stream features. Then, to compensate for the potential imperfections of the frequency domain features in representing window-level features, this invention also needs to specifically extract a portion of inter-stream features to further enhance the feature representation capability. Finally, the detection phase uses the concatenation of frequency domain features and inter-flow features as input, and employs a deep residual network model to detect potential threats within the window. The following sections will describe each module of the detection framework of this invention in the order of the processing stages.

[0047] (I) Data Processing Stage

[0048] (1) High-speed stream processing module

[0049] For the DRDoS attack detection scenario targeted by this invention, traditional packet-level features are insufficient to reflect attacker behavior attributes and suffer from high redundancy and unacceptable concurrent processing volumes. Flow-level features have been proven to be a highly effective level for anomaly traffic detection. This invention uses a traffic 5-tuple (source IP, destination IP, source port, destination port, protocol number) to uniquely identify a network flow. In the high-speed traffic processing module, this invention uses a highly efficient tool—cicflowmeterv3—to generate flow-level data. This tool helps this invention automatically generate a continuous time-series flow-level data structure and includes m-dimensional descriptions of the flow's statistical characteristics (including duration, maximum packet length, etc.).

[0050] (2) High-purity window generation module

[0051] In order to characterize the behavioral features of potential attackers, this invention not only needs to use flow-level features, but also needs to further improve the analysis granularity. "Inter-flow features," which take the statistical information between multiple flows as the object of study, can describe user behavior features more macroscopically.

[0052] To extract inter-flow features, this invention requires building a windowing mechanism based on flow-level data, using a spatial window partitioning method to extract "inter-flow features". Assuming that each spatial window contains n flows, and each flow has m-dimensional features, then the size of the spatial window in this invention is n*m, referred to as the load of that spatial window.

[0053] However, a given window may naturally contain varying proportions of normal traffic and DRDoS attack traffic, affecting the purity of the behavior profile and making the traffic behavior within the window unpredictable. Ideally, the spatial window of this invention should contain only one type of DRDoS attack traffic, allowing the model to learn the high-purity attack behavior characteristics of different categories. Therefore, this invention needs to minimize the proportion of normal traffic within the spatial window; that is, it needs to implement a simple and effective filtering method with high recall for normal traffic. Fortunately, the binary classification problem between DRDoS attacks and normal traffic is relatively simple, and research on it is already quite mature. This invention uses a simple decision tree to classify benign traffic. Notably, the decision tree depth is only 3, with all other configurations remaining at a basic level, yet the recall rate for benign traffic reaches 99.86%. Benign traffic detected by this decision tree is directly released and does not participate in subsequent window construction. In this way, this invention not only generates a high-purity spatial window but also alleviates the processing pressure on the detection model and improves system throughput.

[0054] (II) Feature Extraction Stage

[0055] (1) Feature compression module

[0056] To more accurately and comprehensively characterize flow behavior patterns, this invention uses flow-level features (frequency domain form) and inter-flow features obtained from a spatial window. The original form of flow-level features consists of all independent values ​​within the window (each window contains n flows, and each flow has m-dimensional features), with a size of n*m, which this invention calls the window load. Increasing the number of samples n within the window can provide more sufficient evidence for identifying window behavior, but this will cause the window load to rise rapidly, resulting in a decrease in model detection efficiency. To solve this problem, this invention attempts to perform feature compression, that is, to reduce the value of m within a reasonable range. The new features should have the following advantages: (1) the features after dimensionality reduction are independent of each other; (2) the diversity of feature data after dimensionality reduction is maintained to the greatest extent. This invention uses principal component analysis (PCA) to generate low-dimensional features with the above characteristics, and uses singular value decomposition (SVD) to avoid the complex process of calculating the eigenvalue decomposition of the covariance matrix in PCA. During the training phase, the flow-level data is processed by the feature pre-compression module to generate a principal component matrix P(k*m), where k is the final feature dimension to be retained after dimensionality reduction. During the detection phase, after passing through the feature compression module, the original feature matrix S(n*m) is multiplied by the pseudo-inverse of the principal component matrix after subtracting its mean, and the resulting matrix is ​​dimensionality reduced to feature matrix S′(n*k).

[0057] (2) Frequency domain feature generation module

[0058] This invention uses Fourier transform on a set of time-continuous flow-level features to obtain their frequency domain features for DRDoS attack detection. The application of frequency domain features in this scenario has two major advantages: (1) Naturally forming inter-flow features. Given a set of time-series data a, a Fourier transform is performed on a to obtain A. Each data in A is the superposition effect of all data in a at this specific frequency; (2) Low redundancy. The frequency domain feature A generated according to the standard format has A[0] containing zero frequency terms (sum of signals), A[1:n / 2] containing positive frequency terms, and A[n / 2+1:] containing negative frequency terms. The positive and negative frequency terms of the frequency domain feature are dual, that is, this invention only needs to select half of them to represent all feature information.

[0059] In the frequency domain feature generation module, this invention first obtains a feature-compressed matrix S′, and then performs a discrete Fourier transform on each feature to obtain the corresponding frequency domain feature. Furthermore, the generated frequency domain feature is in complex form and cannot be directly used in the detection model. This invention uses a modulo operation to convert the feature values ​​to the real number domain.

[0060] Because the positive and negative frequency terms of the frequency domain features have duality, they are symmetrical in the real number space after modulo operations. Therefore, this invention only needs to take the first half to represent the overall data information. In addition, to make the frequency domain feature values ​​relatively stable, this invention performs logarithmic operations bit by bit on the results to obtain the final flow level features (frequency domain form).

[0061] It is worth noting that, such as Figure 3 As shown, after the original window data S passes through the feature compression module and the frequency domain feature generation module, its window load decreases significantly. However, the amount of effective information contained in the load (equivalent to the detection accuracy under the same model) is not significantly reduced. This point will be analyzed in detail in the subsequent beneficial effects section of this invention.

[0062] (3) Inter-flow feature generation module

[0063] The frequency domain features generated by the module above are an implicit representation of inter-flow features. To more comprehensively mine the correlation information between network flows in order to deeply characterize the behavioral patterns of potential DRDoS attackers, this invention also needs to explicitly create some meaningful inter-flow features (such as average flow duration, number of concurrent connections within a window, etc.). Figure 1 As shown, the inter-flow feature generation module receives data in a spatial window format, where each window contains n flows, and each flow contains m-dimensional statistical features. This invention extracts inter-flow features based on the spatial window format and defines inter-flow features as numerical values ​​that reflect the changes in one (or several) features among multiple flows.

[0064] Time-dependent inter-stream features. The time interval information of stream arrivals within a spatial window is an important feature describing user behavior. Assuming that the stream time interval can be obtained by subtracting the timestamps of each stream bit by bit, this invention uses the window duration, minimum, maximum, mean, and standard deviation of the stream time interval as time-dependent inter-stream features.

[0065] Source port number variation-related inter-flow features. In abnormal traffic detection tasks, port number features are usually discarded as interference features. However, in DRDoS attack detection scenarios, attack behavior is often automatically executed by attack scripts, and the generated traffic exhibits clear distinguishing characteristics in terms of source port number variation (e.g., random source port number, identical source port number, increasing or decreasing source port number). Source port number variation features describe user behavior patterns, rather than directly using the source port number value, and therefore do not affect the robustness of the detection model. This invention first extracts five counter-type features from the current spatial window: the number of consecutive equal source ports, the number of consecutive increasing / decreasing source ports, the number of non-consecutive equal source ports, the number of non-consecutive increasing / decreasing source ports, and the number of source port mutations (the ratio of the latter to the former is greater than a threshold). Then, this invention generates a packet loss rate feature, which is equivalent to: if the source port number shows a continuous changing trend but some intermediate values ​​are lost, then these flow processes are considered lost.

[0066] Forward Packet Count Related Flow Features. In the study of DRDoS attack behavior, the variation characteristics of the forward (i.e., the direction in which the attacker sends packets to the victim) packet count can serve as an important basis for distinguishing different types of DRDoS attacks. This invention extracts the mean and standard deviation of the forward packet count, as well as the forward packet count volatility, as inter-flow features related to the forward packet count. The forward packet count volatility refers to the reciprocal of the number of most frequent forward packet counts for each flow within the current spatial window; a larger value indicates stronger volatility.

[0067] Other inter-flow features. This invention also selects some inter-flow features that have been proven effective in DRDoS attack detection scenarios by the academic community, including the number of flows per second, the number of packets per second, the number of user-generated traffic, and the number of concurrent connections within each spatial window. Thus, this invention extracts a total of 20-dimensional inter-flow features through the inter-flow feature extraction module.

[0068] (III) Testing Phase

[0069] The detection phase of this invention first receives multidimensional features generated by the frequency domain feature generation module and the inter-stream feature generation module, and concatenates them as input to the detection model. The detection model used in this invention is a deep network with a residual structure. This deep residual network mitigates performance degradation issues in deep networks through the stacking of residual structures and alleviates gradient explosion or vanishing gradient problems during training by adding Batch Normalization (BN) layers. To adapt the detection model to the data structure of the current task, this invention replaces the two-dimensional convolutional layers in the standard ResNet with one-dimensional convolutional layers, and sets the number of layers in the neural network to 18 to achieve a balance between model efficiency and detection accuracy. The output of the detection model will serve as the basis for further measures (such as blocking suspicious IPs) and provide reliable information for network security managers to adopt more refined defense measures against different types of DRDoS attacks.

[0070] In one embodiment, the system modules of this invention are written in Python 3.9, and the main libraries used include PyTorch, scikit-learn, and NumPy.

[0071] In the high-purity window generation module, to achieve a balance between performance and detection speed, the number of samples within the spatial window is set to 40. In the feature compression module, to minimize accuracy loss due to feature compression, the invention selects features with a variance contribution rate exceeding 0.995, thus retaining a final number of compressed features of 10, i.e., k equals 10. In the inter-stream feature generation module, based on preliminary experimental verification, the invention sets the source port mutation feature threshold to 20. In the detection module, the invention uses an 18-layer deep residual network, and to verify the superiority of the feature layer, it employs a standard, easily reproducible model structure—except for replacing the two-dimensional convolutional layers with one-dimensional convolutional layers, the network layer parameter settings are consistent with the standard ResNet18. The detector model is trained using the cross-entropy loss function, the Adam optimizer, and a learning rate of 0.001, with 50 training epochs. This invention divides the dataset into a training set, a validation set, and a test set in a ratio of 8:1:1. The detection model is trained on the training set within the detection module, and the results on the validation set are saved after each training round. Finally, the model that performs best on the validation set is used to test on the test set to obtain the final model evaluation.

[0072] The features of this invention will be further elaborated below through horizontal comparative analysis, self-multi-category comparative analysis, window size analysis, and feature benefit analysis.

[0073] Horizontal comparative analysis. This invention examines the system's attack detection capability by measuring precision, recall, and F1 score. Figure 4This paper presents comparative experimental results between this invention and two other outstanding models on macro-average evaluation metrics. The results show that this invention significantly outperforms the other two models in precision and F1 score, but is slightly inferior to RAD in recall. Compared to the RAD system, which also uses window-level features, although it achieves a recall of 0.99, its precision is only 0.8, indicating a relatively high false positive rate. Academic research typically uses the F1 score to comprehensively evaluate the false negative and false positive rates of a model. The experimental results show that the overall detection capability of the RAD model is significantly weaker than that of this invention. Compared to the RTIDS system, which also uses a deep learning detector, both systems show relatively balanced performance in precision and recall, but this invention improves across all three metrics by 3.93%–5.34%.

[0074] Multi-class comparative analysis was performed. Table 1 shows the performance of the system of this invention in various DRDoS attack categories under experimental scenarios, with an overall F1 score ranging from 92.37% to 100%. Regarding the detection of benign traffic, as mentioned in Section 2.2, to construct a high-purity spatial window, this invention used only a very simple shallow decision tree classifier, achieving a recall rate of 99.86%. This indicates that the invention has sufficient recall capability for benign traffic and rarely misclassifies it as a DRDoS attack. For DRDoS attacks other than those using SSDP and UDP protocols, this invention exhibits excellent detection capabilities (F1 score 99.60%-100%). Analysis of the model's confusion matrix revealed that the F1 scores for SSDP and UDP are not high because these two types of data are inherently difficult to distinguish. Overall, by calculating the macro-average index, the comprehensive detection capability F1 score of the system of this invention surpasses that of existing models, proving the effectiveness of inter-flow features and frequency domain features.

[0075] Table 1 shows the results of the multi-category comparison.

[0076]

[0077] Window size analysis. To effectively detect reflection-amplified DDoS attacks, this invention constructs continuous spatial windows over a time series to extract features between multiple streams. The size of the spatial window is one of the key parameters affecting detection performance and efficiency. Figure 5The detection performance of this invention is demonstrated under different window sizes. The line graph reflects the impact of window size on detection performance, with the three lines corresponding to the complete model, the spatial window using only statistical features, and the spatial window using only frequency domain features, respectively. It can be seen that as the window size increases, the amount of information contained within a single window increases, the ability to express the traffic behavior at that moment becomes stronger, and the model's detection performance is higher. After the window size exceeds 30, the increase in detection performance gradually slows down. It is worth noting that increasing the window size within a reasonable range can improve model detection performance. However, if the window size is increased excessively, it will not only cause the model to process a large amount of data at once, leading to congestion, but also introduce a greater risk of misclassification due to detecting more flows at once (multiple flows contained within a single window). Therefore, this invention ultimately chose a spatial window size of 40.

[0078] Feature Benefit Analysis. This invention considers the ratio between the amount of data for a certain type of feature and the model's detection performance to be an important indicator of feature quality, which is referred to as feature benefit. The smaller the amount of data for a certain type of feature, and the higher the model's detection performance at that time, the higher the feature benefit for that type of feature. Figure 5 The bar chart reflects the size of the actual data contained in the window under various conditions. The smaller the index, the faster the corresponding detection speed of the model. (1) The bar chart and the line chart have a corresponding relationship. It can be seen that as the window size increases, compared with the window of the original statistical feature, although the window of the frequency domain feature has the most significant reduction in window load index, it will bring a certain degree of accuracy loss. The full version of the system not only significantly reduces the window load (although slightly higher than the frequency domain window) but also has better detection performance, thus having the best feature benefits. (2) Observing only the bar chart, it can be found that the larger the window size, the more significant the reduction effect of the system of the present invention in window load compared with the original statistical feature window. The above two points fully illustrate that the frequency domain features and inter-flow features used in the present invention have strong feature benefits.

[0079] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of this disclosure. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for detecting reflection amplification attacks based on frequency domain analysis and inter-flow characteristics, characterized in that, The method includes: Convert packet-level data generated at the network interface into continuous stream-level data over time. A windowing mechanism is built on top of the flow-level data to extract flow-level frequency domain features and inter-flow features within the spatial window. The inter-flow features include: time-related inter-flow features, source port number change-related inter-flow features, forward packet count-related inter-flow features, and other inter-flow features. The time-related inter-flow features include: window duration, minimum flow time interval, maximum flow time interval, mean flow time, and standard deviation of flow time. The forward packet count-related inter-flow features include: mean forward packet count, standard deviation of forward packet count, and volatility of forward packet count. The other inter-flow features include: flow count per second, packet count per second, user-generated traffic count, and concurrent connection count. The flow-level frequency domain features and inter-flow features are spliced ​​together; Based on the splicing result, the attack detection result of the spatial window is obtained; The extraction of flow-level frequency domain features within the spatial window includes: Extracting the feature matrix of the spatial window ; For the feature matrix Compression is performed to obtain the dimensionality-reduced feature matrix. ; In the feature matrix Perform a discrete Fourier transform on each feature to obtain the corresponding frequency domain feature; After converting the feature values ​​of the frequency domain features to the real number domain by taking the modulus, logarithmic operations are performed bit by bit to obtain the flow level frequency domain features within the spatial window. Among them, the inter-flow features related to source port number changes within the spatial window are extracted, including: Based on statistical characteristics, five counter-form features of the spatial window are obtained; wherein, the five counter-form features include: the number of consecutive equal source ports, the number of consecutive increasing / decreasing source ports, the number of non-consecutive equal source ports, the number of non-consecutive increasing source ports, the number of non-consecutive decreasing source ports, and the number of source port mutations. Based on the five counter form characteristics, determine whether the source port number has a continuous changing trend but some values ​​are lost in the middle, so as to obtain the packet loss rate characteristics; The five counter format features and the packet loss rate are used as inter-flow features related to the source port number change of this spatial window.

2. The method as described in claim 1, characterized in that, Before establishing a windowing mechanism based on flow-level data to extract flow-level frequency domain features and inter-flow features within the spatial window, the process also includes: The flow-level data is binary-classified using a decision tree classifier to obtain flow classification results; wherein, the flow classification results include: benign flow or suspicious flow; If the flow-level data is suspicious, the process jumps to the windowing mechanism built on the flow-level data to extract the flow-level frequency domain features and inter-flow features within each spatial window.

3. The method as described in claim 1, characterized in that, The feature matrix Compression is performed to obtain the dimensionality-reduced feature matrix. ,include: Based on the training data, the principal component matrix of this spatial window is obtained. ; Calculate the feature matrix The mean; The feature matrix Subtracting the mean and then comparing it with the principal component matrix Matrix multiplication is performed on the pseudo-inverse matrix to obtain the dimensionality-reduced eigenma matrix. .

4. The method as described in claim 1, characterized in that, The attack detection result of the spatial window obtained based on the splicing result includes: The splicing result is input into a detection model, which is a trained deep network with residual structure; Based on the output of the detection model, the attack detection result of the spatial window is obtained.

5. A reflection amplification attack detection device based on frequency domain analysis and inter-flow characteristics, characterized in that, The device includes: The structure conversion module is used to convert packet-level data generated at the network interface into continuous stream-level data in a time series. The feature extraction module is used to build a window mechanism based on the flow-level data to extract flow-level frequency domain features and inter-flow features within the spatial window; and to concatenate the flow-level frequency domain features and inter-flow features; wherein, the inter-flow features include: time-related inter-flow features, source port number change-related inter-flow features, forward packet count-related inter-flow features, and other inter-flow features; the time-related inter-flow features include: window duration, minimum interval of flow time, maximum interval of flow time, mean of flow time, and standard deviation of flow time; the forward packet count-related inter-flow features include: mean of forward packet count, standard deviation of forward packet count, and volatility of forward packet count; the other inter-flow features include: flow count per second, packet count per second, user-generated traffic count, and concurrent connection count; An attack detection module is used to obtain the attack detection result of the spatial window based on the splicing result; The extraction of flow-level frequency domain features within the spatial window includes: Extracting the feature matrix of the spatial window ; For the feature matrix Compression is performed to obtain the dimensionality-reduced feature matrix. ; In the feature matrix Perform a discrete Fourier transform on each feature to obtain the corresponding frequency domain feature; After converting the feature values ​​of the frequency domain features to the real number domain by taking the modulus, logarithmic operations are performed bit by bit to obtain the flow level frequency domain features within the spatial window. Among them, the inter-flow features related to source port number changes within the spatial window are extracted, including: Based on statistical characteristics, five counter-form features of the spatial window are obtained; wherein, the five counter-form features include: the number of consecutive equal source ports, the number of consecutive increasing / decreasing source ports, the number of non-consecutive equal source ports, the number of non-consecutive increasing source ports, the number of non-consecutive decreasing source ports, and the number of source port mutations. Based on the five counter form characteristics, determine whether the source port number has a continuous changing trend but some values ​​are lost in the middle, so as to obtain the packet loss rate characteristics; The five counter format features and the packet loss rate are used as inter-flow features related to the source port number change of this spatial window.

6. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the reflection amplification attack detection method based on frequency domain analysis and inter-flow characteristics as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the reflection amplification attack detection method based on frequency domain analysis and inter-flow characteristics as described in any one of claims 1-4.

Images