Low-rate denial of service attack detection method based on TCP time-frequency domain features

Abstract

This invention relates to the fields of software security and information system security technology, and provides a method for detecting low-rate denial-of-service (LDOS) attacks based on TCP time-frequency domain characteristics. This method aims to improve the robustness of LDoS attack detection and classification models based on machine learning algorithms, thereby enhancing the defense capabilities of servers and network applications. Based on the time-frequency domain characteristics of TCP traffic and an improved Stacking algorithm, this method analyzes the differences between normal traffic and traffic containing LDoS attacks in the time and frequency domains, constructs a network traffic feature set, and uses it for feature calculation of traffic data to extract the most useful information from the network traffic data, reducing the size of the network data. Simultaneously, the improved Stacking algorithm alleviates the imbalance problem of sample weights in the meta-model for traffic classification. Experimental results show that TF-Stacking has high detection accuracy and low false negative rate, and can effectively detect LDoS attacks.

Description

Technical Field

[0001] This invention relates to the fields of software security and information system security technology, and in particular to a method for detecting low-rate denial-of-service attacks based on TCP time-frequency domain characteristics. Background Technology

[0002] With the development of the internet, network security issues have become increasingly complex. Network infrastructure and online applications are often targets of security attacks, especially Denial of Service (DoS) attacks. Attackers primarily use flooding attacks to consume target system resources or disrupt target system services, preventing legitimate users from using the system normally. This type of flooding DoS attack exhibits distinct characteristics due to its high-speed traffic, and therefore can be identified using existing DoS detection strategies. As attack techniques continue to evolve, the forms of DoS attacks are also constantly changing. Low-rate DoS (LDoS) attacks are a special variant of DoS attacks. This type of DoS attack generates low-rate attack traffic that can be hidden within the normal Transmission Control Protocol (TCP), while simultaneously utilizing the adaptive mechanisms of network protocols to create false congestion in the network, impairing the connection quality between clients and servers, and preventing servers from providing normal services to users.

[0003] Compared to traditional high-rate denial-of-service (DoS) attacks, LDoS attacks are more stealthy and difficult to detect because they use low-rate attack traffic, sufficient to consume critical resources of the target system without triggering traditional DoS defense mechanisms. LDoS attacks pose a serious threat to modern network and cloud computing environments. Due to their low-rate characteristics, LDoS attacks often bypass traditional intrusion detection systems (IDS) and intrusion prevention systems (IPS), which typically focus more on high-rate attack traffic. Furthermore, LDoS attacks can exploit the shared resource nature of cloud computing environments, impacting multiple tenants or users by consuming shared resources. Traditional DoS attack detection methods face several difficulties in detecting LDoS attacks. Due to the low rate of the attack traffic, traditional intrusion detection systems often struggle to distinguish LDoS attack traffic from normal traffic. Additionally, LDoS attacks typically exploit specific weaknesses or vulnerabilities in the target system, making it difficult for traditional signature- or rule-based detection methods to accurately detect and identify these attacks.

[0004] To promptly detect and respond to LDoS attacks, researchers have proposed various detection methods and techniques. LDoS detection methods proposed in recent years can be categorized into three types: frequency domain-based methods, time domain-based methods, and methods based on traffic statistics analysis. Time domain-based detection research typically offers advantages such as simple and fast processing and intuitive features, but it may lack full utilization of the periodic spectral information when detecting LDoS attacks. This is because time domain analysis primarily focuses on the changes in the signal over time, neglecting the details of the signal spectrum. In contrast, frequency domain-based detection methods can better capture the spectral characteristics of LDoS attacks. Frequency domain analysis methods transform the signal into the frequency domain and reveal the periodic characteristics of LDoS attacks by analyzing spectral features. However, frequency domain analysis methods lack the characteristic information of the signal changing over time and cannot capture dynamic changes in the time domain.

[0005] To overcome the limitations of both time-domain and frequency-domain methods, time-frequency domain-based detection research has emerged. Time-frequency domain analysis methods can comprehensively consider the detailed information contained in the signal in both the time and frequency domains, effectively compensating for the shortcomings of traditional time-domain and frequency-domain methods. In LDoS attack detection, time-frequency domain-based methods can more comprehensively reveal the characteristics and patterns of LDoS attacks. By analyzing the changes in the signal in the time and frequency domains, both the time-domain dynamics and frequency-domain periodicity information of the signal can be captured simultaneously, thereby improving the detection capability of LDoS attacks. Therefore, this paper proposes an LDoS attack detection method based on time-frequency domain characteristics of network traffic. Summary of the Invention

[0006] The technical problem to be solved by this invention is to provide a method for detecting low-rate denial-of-service attacks based on TCP time-frequency domain characteristics, which can improve the robustness of LDoS attack detection and classification models based on machine learning algorithms and enhance the defense capabilities of servers and network applications.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0008] A method for detecting low-rate denial-of-service attacks based on TCP time-frequency domain characteristics includes the following steps:

[0009] Step 1: Collect traffic data to complete data collection and cleaning;

[0010] Step 2: Perform fragmentation processing on the raw network traffic data, that is, cut the data into multiple time segments according to the set time intervals. Each time segment is called a detection window.

[0011] Step 3: Using the detection window as the basic unit for feature extraction, extract M time-domain features and N frequency-domain features for all detection windows, resulting in a feature vector of length M+N for each detection window; assign a label to each detection window based on whether the timestamp matches the LDoS attack initiation time to indicate the detection window category; the extracted feature data are used as training data for subsequent model training and test data for the attack detection phase.

[0012] Step 4: The Stacking algorithm is adopted, which includes a base model in the first layer and a meta-model in the second layer. During training, the training data is used as input, and a weight is assigned to the prediction result of each base model. The weight is combined with the prediction result to form the features of the meta-model. Then, the meta-model algorithm is trained on these features. By comparing the experimental results and performance of different meta-model algorithms, the algorithm with the best performance is selected as the final meta-model algorithm. The Stacking model parameters are adjusted according to the training data features and corresponding labels to train the LDoS detection model.

[0013] Step 5: Input the test data into the trained LDoS detection model for classification to identify LDoS attacks, and finally output the classification results.

[0014] Furthermore, in step 3, the time-domain features include: mean, variance, average deviation, TCP traffic percentage, correlation coefficient between preceding and following sequences, and coefficient of variation; the frequency-domain features include: peak frequency, peak power spectral density, low-frequency power, power spectral entropy, average power, and peak bandwidth.

[0015] Furthermore, in step 4, given the training set D = {(X1, Y1), (X2, Y2), ..., (X... n Y n )}, X i Y is the feature vector of the i-th sample. i These are the corresponding labels, i = 1, ..., n, where n is the number of samples; K-fold cross-validation is used to validate the m base models (B1, B2, ..., B...). m Training is performed; the Stacking algorithm steps are as follows:

[0016] Step 4.1: Divide the training data into K equal and mutually exclusive subsets D1, D2, ..., D... k ;

[0017] Step 4.2: Select K-1 subsets as the training set D train The remaining subset serves as the verification set D. val Using D train Base model B j Training is performed to obtain the prediction result P.j1 P j2 , ..., P jn ;

[0018] Step 4.3: Repeat step 4.2m times to obtain the prediction results of m models on the Kth fold of training data;

[0019] Step 4.4: Repeat steps 4.2 to 4.3K times to obtain the prediction results of m models for all training data;

[0020] Here, we iterate through the K subsets, selecting one subset each time as the validation set and using the remaining K-1 subsets as the training set. Therefore, we need to repeat this process K times.

[0021] The prediction results P of each base model jk As a column of the new feature matrix, it forms a new feature matrix X. new as follows:

[0022]

[0023] In the formula, p ij Let represent the prediction result of the j-th base model for the i-th sample, i = 1, ..., n, j = 1, ..., m;

[0024] Step 4.5: Use the prediction results from Step 4.5 as input to the meta-model to train the meta-model. By adjusting and optimizing the parameters of the meta-learner, a complete Stacking ensemble learning model is trained.

[0025] Furthermore, a weight is assigned to the prediction result of each base model to reflect its reliability; assuming the dataset size is n, the number of base models is m, and the primary classifier of the base models is L... i (x), after K-fold cross-training, the probability estimate P of the base model on the training set is obtained. i The weight calculation method is as follows:

[0026] 1) Calculate the classifier's performance on P. i The probability estimation bias ε i The calculation formula is as follows:

[0027]

[0028] Among them, y x P represents the actual label value of the x-th sample. ix P represents i The x-th element in;

[0029] 2) Regarding the probability estimation bias ε i The exponential decay transformation is calculated using the following formula:

[0030]

[0031] Where, r i θ represents the probability estimation bias after exponential decay transformation, and θ is the decay rate control parameter.

[0032] 3) Standardized operations are as follows:

[0033]

[0034] Where, ω i For the primary classifier L i The weights of (x), r j The probability estimation bias of the j-th classifier after exponential decay transformation.

[0035] Furthermore, the base models include: Gaussian Naive Bayes, Random Forest, Support Vector Machine, K-Nearest Neighbors, and Gradient Boosting Decision Tree; the meta-model candidate models include: Logistic Regression, Naive Bayes, K-Nearest Neighbors, and Support Vector Machine.

[0036] Compared with the prior art, the beneficial effects of the present invention are:

[0037] This invention first slices the raw traffic, analyzing and extracting six features each in the time and frequency domains of the traffic slices. Based on the feature set, network traffic data is processed, including feature calculation and feature normalization. This invention uses the Stacking algorithm as the classifier of the detection model, which can fully utilize the advantages of multiple base learners and improve the overall prediction performance by combining their prediction results. To address the problem of unbalanced sample weights in the meta-model of the traditional Stacking algorithm, a sample weight adjustment algorithm is proposed. Experimental results show that the TF-Stacking method can effectively detect LDoS attack traffic with a low false negative rate. Attached Figure Description

[0038] Figure 1 This is a flowchart of the LDoS attack detection process of the present invention.

[0039] Figure 2(a) shows the time-domain distribution of normal TCP traffic.

[0040] Figure 2(b) shows the time-domain distribution of TCP traffic during an LDoS attack.

[0041] Figure 3(a) shows the frequency domain distribution of normal TCP traffic.

[0042] Figure 3(b) shows the frequency domain distribution of TCP traffic during an LDoS attack.

[0043] Figure 4 This is the weighted stacking algorithm framework for the base model of this invention. Detailed Implementation

[0044] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0045] This invention proposes an attack detection method based on TCP time-frequency domain features and an improved Stacking algorithm (TF-Stacking), which can identify LDoS at the transport layer.

[0046] Under the influence of LDoS attacks, TCP data streams exhibit two anomalies in the time and frequency domains.

[0047] This invention analyzes the data distribution of TCP data streams under LDoS attacks to extract abnormal features. By improving the Stacking algorithm for classification and detection, it can accurately learn these abnormal features, thus gaining the ability to detect traffic containing LDoS attack signals.

[0048] like Figure 1 As shown, this invention presents a low-rate denial-of-service attack detection method based on TCP time-frequency domain features. The detection process includes four steps: data preprocessing, feature extraction, model training, and attack detection. The specific process is as follows:

[0049] Step 1: Collect traffic data to complete data collection and cleaning.

[0050] Step 2: Perform fragmentation processing on the raw network traffic data, that is, cut the data into multiple segments according to a certain time interval. Each such time segment is called a detection window.

[0051] Sharding can break down long-term continuous traffic into discrete data segments, resulting in several detection windows. Detection windows are the basic units for feature extraction, model training, and attack detection.

[0052] In this embodiment, TCP packets are sampled at 100ms intervals, and the detection window size is set to 10s. The experimental dataset consists of 5000 detection windows, containing 1500 positive samples and 3500 negative samples. The dataset is divided into training and test sets in a 7:3 ratio using stratified sampling to ensure that the ratio of positive to negative samples in the training and test sets is approximately equal, thereby reducing the bias of class imbalance in model evaluation.

[0053] Step 3: Using the detection window as the basic unit for feature extraction, extract 6 time-domain features and 6 frequency-domain features from all detection windows. Each detection window will yield a feature vector of length 12.

[0054] The time-domain characteristics are: (1) mean; (2) variance; (3) average deviation; (4) TCP traffic share; (5) correlation coefficient between preceding and following sequences; (6) coefficient of variation.

[0055] The frequency domain characteristics are: (1) peak frequency; (2) peak power spectral density; (3) low frequency power; (4) power spectral entropy; (5) average power; (6) peak width.

[0056] Each detection window is assigned a label based on whether its timestamp matches the time of an LDoS attack, indicating the window category. The extracted feature data is used in subsequent model training and attack detection phases.

[0057] Figure 2(a) and 2(b) Figure 2(a) shows a time-domain comparison of TCP traffic under normal and LDoS attack conditions. As shown in Figure 2(a), when the network is in a normal state, TCP traffic data is generally high and relatively concentrated. This indicates that normal TCP traffic is transmitted in a relatively stable manner within the network, without significant fluctuations or drastic changes, which is consistent with normal network behavior patterns. The TCP congestion control mechanism can stably maintain smooth traffic transmission. As shown in Figure 2(b), under the influence of LDoS, the traffic data shows significant changes. The influx of attack pulses leads to increased overall traffic fluctuations and a decrease in overall throughput. Periodic short-duration high-rate attack pulses repeatedly trigger the adaptive mechanism of the TCP protocol, causing TCP traffic data to continuously fall into a cycle of "decline-increase-decline." This abnormal distribution of traffic data is caused by an LDoS attack and is significantly different from normal traffic distribution.

[0058] Figure 3(a) and 3(b) This is a comparison of TCP traffic in the frequency domain under normal conditions and under an LDoS attack. In the frequency domain, the energy distribution of a signal reflects the signal strength at different frequencies. The Fourier transform converts the time-series signal of network traffic into a spectral representation, obtaining the spectral characteristics of the traffic, and then analyzes these characteristics. As shown in Figure 3(a), normal TCP traffic has a relatively uniform distribution in the frequency domain with small fluctuations. As shown in Figure 3(b), under an LDoS attack, TCP traffic exhibits significantly different characteristics in the frequency domain compared to the normal situation. The power spectral density shows a significant increase, especially in the low-frequency range. In an LDoS attack, the attacker's goal is to cause a denial-of-service attack by sending periodic pulses. To achieve this goal, the attack traffic sent by the attacker typically has a low attack frequency, so as to repeatedly trigger the adaptive mechanism of the TCP protocol. Therefore, the attack traffic is more distributed in the lower frequency bands.

[0059] Step 4: During training, use labeled training data as input and adjust the Stacking model parameters according to the features of the training data and the corresponding labels to train a model that can detect LDoS.

[0060] Given a training set D = {(X1, Y1), (X2, Y2), ..., (X... n Y n )}, X i Y is the feature vector of the i-th sample. i These are the corresponding labels. K-fold cross-validation is used to validate m base models (B1, B2, ..., B...). m (Training)

[0061] The Stacking algorithm steps are as follows:

[0062] (1) Divide the training data into K equal and mutually exclusive subsets D1, D2, ..., D... k .

[0063] (2) Select K-1 subsets as training set D train The remaining subset serves as the verification set D. val Using D train Base model B j Training is performed to obtain the prediction result P. j1 P j2 , ..., P jn .

[0064] (3) Repeat step (2) m times to obtain the prediction results of m models on the k-th fold training data.

[0065] (4) Repeat steps (2) to (3) K times to obtain the prediction results of m models on all training data. P represents the prediction result of each base model. jk As a column of the new feature matrix, it forms a new feature matrix X. new as follows:

[0066]

[0067] (5) The prediction results in (4) are used as the input of the meta-model to train the meta-model. By adjusting and optimizing the parameters of the meta-learner, a complete and fully trained Stacking ensemble learning model is successfully trained.

[0068] Each base model's prediction is assigned a weight to reflect its reliability. Assume the dataset size is N, the number of base models is T, and the primary classifier of the base models is L. i (x), after K-fold cross-training, the base model's probability estimate P on the training set. i Pim P represents i The weight of the m-th element in the dataset is calculated as follows:

[0069] (1) Calculate the probability estimation bias of the classifier in Pi using the following formula:

[0070]

[0071] Among them, y x P represents the actual label value of the x-th sample. ix P represents i The x-th element in.

[0072] (2) Apply an exponential decay transformation to the probability estimation bias, and the calculation formula is as follows:

[0073]

[0074] Where, r i θ represents the probability estimation bias after exponential decay transformation, and θ is the decay rate control parameter.

[0075] (3) To improve the performance of the meta-classifier, ensure that different features follow a probability distribution, and enable it to better capture the correlation between features, a standardization operation is required:

[0076]

[0077] Where, ω i For the primary classifier L i The weights of (x), r j The probability estimation bias of the j-th classifier after exponential decay transformation.

[0078] For the primary classifier L i For (x), when the probability estimation bias is relatively low, the probability estimation bias r after the exponential decay transformation is... i The value will be relatively large, and the weight will also be correspondingly large. Therefore, this weight can be understood as the credibility of the base model. Figure 4 The framework of the base model weighted stacking algorithm is described. This algorithm is a heterogeneous ensemble algorithm consisting of two layers. Figure 4As shown, the first layer contains five base models: Gaussian Naive Bayes (GNB), Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Gradient Boosting Decision Tree (GBDT). During training, each base model is assigned a weight, which is combined with the prediction results to form the features of the meta-model. The second layer is the meta-model, with candidate models including Logistic Regression (LR), Naive Bayes (NB), K-Nearest Neighbors (KNN), and Support Vector Machine (SVM). During the training of the second layer, the prediction results of the base models in the first layer and their corresponding weights are used as features of the meta-model, and then the meta-model algorithm is used to train on these features.

[0079] The training objective of the meta-model is to obtain the optimal fusion strategy by learning the weights and prediction results of the base models, thereby improving the overall performance of the model. Finally, by comparing the experimental results and performance of different meta-model algorithms, the algorithm with the best performance is selected as the final meta-model algorithm.

[0080] Step 5: Using the preprocessed and feature-extracted data, input it into the trained detection model for classification to identify LDoS attacks. Finally, the detection model outputs the classification results.

[0081] Experimental results show that the detection model has high accuracy and low false alarm rate, and can effectively detect LDoS attacks in the network.

Claims

1. A method for detecting low-rate denial-of-service attacks based on TCP time-frequency domain characteristics, characterized in that, Includes the following steps: Step 1: Collect traffic data to complete data collection and cleaning; Step 2: Perform fragmentation processing on the raw network traffic data, that is, cut the data into multiple time segments according to the set time intervals. Each time segment is called a detection window. Step 3: Using the detection window as the basic unit for feature extraction, extract M time-domain features and N frequency-domain features for all detection windows, resulting in a feature vector of length M+N for each detection window; assign a label to each detection window based on whether the timestamp matches the LDoS attack initiation time to indicate the detection window category; the extracted feature data are used as training data for subsequent model training and test data for the attack detection phase. Step 4: The Stacking algorithm is adopted, which includes a base model in the first layer and a meta-model in the second layer. During training, the training data is used as input, and a weight is assigned to the prediction result of each base model. The weight is combined with the prediction result to form the features of the meta-model. Then, the meta-model algorithm is trained on these features. By comparing the experimental results and performance of different meta-model algorithms, the algorithm with the best performance is selected as the final meta-model algorithm. The Stacking model parameters are adjusted according to the training data features and corresponding labels to train the LDoS detection model. Step 5: Input the test data into the trained LDoS detection model for classification to identify LDoS attacks, and finally output the classification results; In step 4, given the training set D = { (X1, Y1), (X2, Y2), ..., (X... n Y n )}, X i Y is the feature vector of the i-th sample. i These are the corresponding labels, i=1,…n, where n is the number of samples; K-fold cross-validation is used to validate m base models (B1, B2,…, B…). m Training is performed; the Stacking algorithm steps are as follows: Step 4.1: Divide the training data into K equal and mutually exclusive subsets D1, D2, ..., D... k ; Step 4.2: Select K-1 subsets as the training set D train The remaining subset serves as the verification set D. val Using D train Base model B j Training is performed to obtain the prediction result P. j1 P j2 , ..., P jn ; Step 4.3: Repeat step 4.2 m times to obtain the prediction results of m models on the Kth fold of training data; Step 4.4: Repeat steps 4.2 to 4.3 K times to obtain the prediction results of m models for all training data; The prediction results P of each base model jK As a column of the new feature matrix, it forms a new feature matrix X. new as follows: ； In the formula, Let represent the prediction result of the j-th base model for the i-th sample, i=1,…n, j=1,…m; Step 4.5: Use the prediction results from Step 4.4 as input to the meta-model, train the meta-model, and train the complete Stacking ensemble learning model by adjusting and optimizing the parameters of the meta-learner. Each base model's prediction is assigned a weight to reflect its reliability; assuming the dataset size is n, the number of base models is m, and the primary classifier L of the base models... i (x), after K-fold cross-training, the probability estimate P of the base model on the training set is obtained. i The weight calculation method is as follows: 1) Calculate the classifier's performance on P. i Probability estimation bias The calculation formula is as follows: ； in, P represents the actual label value of the x-th sample. ix P represents i The x-th element in; 2) Bias in probability estimation The exponential decay transformation is calculated using the following formula: ； in, This represents the probability estimation bias after the exponential decay transformation. This is the decay rate control parameter; 3) Standardized operations are as follows: ； For the primary classifier L i The weight of (x), The probability estimation bias of the j-th classifier after exponential decay transformation.

2. The method for detecting low-rate denial-of-service attacks based on TCP time-frequency domain characteristics according to claim 1, characterized in that, In step 3, the time-domain features include: mean, variance, average deviation, TCP traffic percentage, correlation coefficient between preceding and following sequences, and coefficient of variation; the frequency-domain features include: peak frequency, peak power spectral density, low-frequency power, power spectral entropy, average power, and peak bandwidth.

3. The low-rate denial-of-service attack detection method based on TCP time-frequency domain characteristics according to claim 1, characterized in that, The base models include: Gaussian Naive Bayes, Random Forest, Support Vector Machine, K-Nearest Neighbors, and Gradient Boosting Decision Tree; the meta-model candidate models include: Logistic Regression, Naive Bayes, K-Nearest Neighbors, and Support Vector Machine.

Images