Intelligent DDoS attack detection method, equipment and system

Abstract

The present invention discloses an intelligent DDoS attack detection method, device and system, and belongs to the field of computer network security technology. The present invention comprises: collecting network traffic data, parsing the data packet header of the network traffic data, and generating each characteristic value of the data packet; performing feature processing and encoding on the data packet; forming a characteristic sequence of the characteristic values ​​in the data packet; inputting the characteristic sequence into a data processing neural network, and outputting a probability judgment result; using a cross entropy loss function to train network parameters; performing DDoS attack detection according to the output result, if the predicted probability outputted by the traffic packet characteristic sequence after the data processing neural network is greater than a preset prediction threshold, the traffic packet is classified as a DDoS attack traffic packet. The present invention can take into account the technical requirements of DDoS control in terms of sensitivity, accuracy, and large traffic processing.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network security, and in particular relates to an intelligent DDoS attack detection method, device and system. Background Art

[0002] Distributed denial of service (DDoS) attacks are an important and very harmful attack behavior. Attackers control multiple hosts and continuously consume the resources of the target, preventing the target resources from providing external services. DDoS can cause large-scale paralysis of service terminals or networks, trigger major security incidents, and cause serious economic losses to network operators.

[0003] Different from other malicious data tampering or hijacking attacks, DDoS attacks are simple and crude, with low attack costs, and can directly destroy the target. Especially in the industrial field, due to the time sensitivity of the network, DDoS attacks can block the operation of industrial infrastructure and cause major network security incidents or production safety accidents. Therefore, the destructive power of DDoS attacks in industrial control networks far exceeds that of traditional Ethernet.

[0004] In industrial networks, due to the particularity of applications, network traffic packets often contain a large amount of industrial control information. Professional technical protocols and data transmission methods are used, and the design of the application layer is different from that of traditional Ethernet. In addition, due to the use of engineer stations and host computers at different levels of industrial networks, data conversion and transmission are more complicated than traditional Ethernet. The encapsulation of network protocols usually brings complexity to application layer detection. In order to meet the application requirements of industrial field control systems, manufacturers have built corresponding industrial Ethernet protocols on top of Ethernet and TCP / IP protocols to improve the interoperability between different industrial products. Compared with computer network information systems, industrial control systems have higher requirements for real-time, stability, and security. The security protection equipment of existing information systems cannot meet the requirements of industrial control systems in terms of trouble-free operation time, etc., especially due to the convenience and low cost of DDoS attacks, which have become a common attack method used by malicious vandals. Due to the complexity of industrial control network traffic, conventional detection methods are difficult to perform comprehensive detection and protection at the application level. Therefore, based on traffic detection in industrial control networks, improving DDoS attack prevention has practical security protection needs and economic value.

[0005] In the process of flow-based detection, the feature objects contained in the data packets have certain logical relationships. At the same time, there are great differences in the number and type of data packets and data flows in a unit of time. The flow-based network security detection methods disclosed in the prior art partially adopt the context-related attention mechanism and the simplified LSTM technical architecture, and adopt a shallow CNN convolutional neural network. The detection method does not fully extract the flow features, the feature attention objects are relatively single, and the attention to the entire flow is insufficient. The continuous flow collection consumes a lot of resources for the context-related attention mechanism, and a large amount of initial data is required for training. Summary of the invention

[0006] The purpose of the present invention is to provide an intelligent DDoS attack detection method, device and system, which can take into account the technical requirements of DDoS control in terms of sensitivity, accuracy, large traffic processing, etc.

[0007] Specifically, on the one hand, the present invention provides an intelligent DDoS attack detection method, comprising:

[0008] Collect network traffic data, parse the packet headers of the network traffic data, and generate various characteristic values ​​of the data packets;

[0009] Perform feature processing and encoding on the data packets of network traffic data, including normalizing the packet size and number of packets, hashing the IP address and mapping it to a continuous digital space, binary encoding some feature values ​​in the network traffic packet, normalizing the TTL, converting the timestamp to relative time, and calculating the time difference of each traffic packet;

[0010] The feature values ​​after feature processing and encoding are normalized to form a feature vector, which is sorted and formed into a feature sequence;

[0011] Inputting the feature sequence into a data processing neural network for feature sequence training, including: inputting the feature sequence into the input layers of a Transformer network module and an LSTM network module respectively, implementing autonomous neural network learning under a self-attention mechanism at a spatial level of a data sequence in the Transformer network module, and implementing time dimension learning of data at a byte level and a data packet level in the LSTM network module; cascading the outputs of the Transformer network module and the LSTM network module, and then inputting them into a fully connected layer, the fully connected layer maps the weighted sum vector to a probability distribution of a predicted category, inputs it into a softmax classifier for classification, and uses dropout classification to output a probability judgment result; before outputting the probability judgment result, using a cross entropy loss function to train the parameters of the Transformer network module and the LSTM network module;

[0012] DDoS attack detection is performed based on the output results of the data processing neural network after feature sequence training. If the predicted probability of the traffic packet output by the data processing neural network after feature sequence training is greater than the preset prediction threshold, the traffic packet is classified as a DDoS attack traffic packet, otherwise it is classified as a normal traffic packet.

[0013] Furthermore, at the input layer of the Transformer network module, an embedding operation is performed on the feature sequence to map the features into a low-dimensional vector space.

[0014] Furthermore, the Transformer network module implements autonomous learning of a neural network under a spatial hierarchical self-attention mechanism of a data sequence, including:

[0015] The Encoder part extracts features from the input feature sequence and generates a series of vector representations. Each vector contains an abstract representation of a continuous feature in the input feature sequence.

[0016] The self-attention mechanism calculates a similarity matrix based on the vector representation generated by the encoder and the decoder input vector at the current moment; calculates a weight matrix based on the similarity matrix to indicate the degree of attention paid by the model to each encoder vector; and calculates a weighted sum vector based on the weight matrix as the input of the decoder;

[0017] The Decoder classifies the data input by the Encoder and generates an output vector for each time step, indicating the classification result of the corresponding time step.

[0018] Furthermore, the LSTM network module implements the time dimension learning of data at the byte level and the packet level, including:

[0019] The feature sequence is input into the LSTM network. After the feature sequence is processed by input, forgetting, output concatenation, and aggregation in the LSTM network, the feature vector data of the data packet is output for the first time.

[0020] The feature vector data of the first output data packet is aggregated through time series and then input into the LSTM feature network again to generate data flow feature vector data.

[0021] Furthermore, the use of the cross entropy loss function to train the Transformer network module and the LSTM network module parameters includes:

[0022] Use the stochastic gradient descent algorithm to optimize the network parameters;

[0023] Use batch training method to divide a large number of traffic packets into several batches for training;

[0024] For each batch, the cross entropy loss between the predicted probability distribution of the output and the true labels is calculated, and the network parameters are updated.

[0025] Furthermore, the cross entropy loss function is:

[0026] Among them, y represents the expected output of the neuron, a represents the actual output of the neuron, , , e is a constant, , Z is a real number, w represents the weight of a single neuron, x is the input feature vector, and b identifies the bias parameter.

[0027] Furthermore, the partial characteristic values ​​include one or more of a port number, a protocol type, a TCP flag, a packet header length, and routing information.

[0028] On the other hand, the present invention also provides an intelligent DDoS attack detection device, including a memory and a processor; the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-mentioned intelligent DDoS attack detection method.

[0029] Further, the computer program includes a flow acquisition module, a data processing module, a training module and a detection and disposal module;

[0030] The traffic acquisition module is a hybrid 10 Gigabit Ethernet interface or a Gigabit Ethernet interface, and collects data traffic by mirroring network device traffic to this interface or connecting two interfaces in series to the detected network, and adopts a driven polling mode to start a frequent polling socket function, and continuously captures data on the hybrid 10 Gigabit Ethernet interface or the Gigabit Ethernet interface to obtain data, and then stores the intercepted data in a buffer of the traffic acquisition module, and at the same time sends the data queue to the data processing module according to the idle state of the data processing module;

[0031] The data processing module performs the feature processing and encoding on the data packet after receiving the data queue, and sends the formed feature sequence to the training module;

[0032] The training module performs feature sequence training of the data processing neural network, performs convolution processing on the feature sequence through the data processing neural network, generates a plurality of independent vectors of probability values ​​of each feature parameter, and inputs the probability values ​​into the detection and disposal module;

[0033] The detection and disposal module determines abnormal features by comparing the probability values ​​of the characteristic parameters with preset probability thresholds, and issues reminders, alarms, or sets interception strategies based on the abnormal features.

[0034] In another aspect, the present invention further provides an intelligent DDoS attack detection system, comprising an interface card, a processor, a memory and a data bus;

[0035] The interface card is an interface for data acquisition, and the original message data stream received from the interface card is temporarily stored in the memory;

[0036] The processor implements the steps of the above-mentioned intelligent DDoS attack detection method, provides processing of the original message data stream and performs feature sequence training of the data processing neural network;

[0037] The interface card, processor and memory are interconnected at high speed via the data bus.

[0038] The beneficial effects of the intelligent DDoS attack detection method, device and system of the present invention are as follows:

[0039] In response to the need for multi-head attention to multiple features in current network traffic detection, the self-attention mechanism of the Transformer network is introduced to enable the model to better learn the relationship between different features and improve the robustness and detection effect of the model.

[0040] By introducing the Transformer's self-attention mechanism, Attention mechanism, and the time dimension feature memory feature capability of the LSTM network module, the model can better learn the relationship between different features and the relationship between feature parameters at different times. By combining multiple features, network traffic can be analyzed more comprehensively, detection precision and accuracy can be improved, and the robustness and detection efficiency of the model can be improved.

[0041] The self-attention mechanism of the Transformer network has great advantages in feature extraction after data packet disassembly. In addition, the mechanism has the characteristics of associating and identifying multiple parameters of data packet flow and dynamically combining and identifying data packet feature vectors.

[0042] The LSTM network extracts the differences between data sequences in terms of traffic classification. The LSTM network utilizes the structured characteristics of network data traffic, constructs feature relationships beyond data packets, and realizes classification and probabilistic output in the time dimension. It has great advantages in describing the characteristics between traffic and traffic.

[0043] Compared with traditional statistical methods based on protocols, in order to fully explore the spatial and temporal dimension discrimination capabilities in network data packet sequences, the present invention adopts intelligent learning methods in both spatial and temporal dimensions, targeting the differences in the forces of spatial characteristics of data messages and the cumulative learning effects of different data packets and flow data in time. It expands the spatial and temporal attention of traffic and data packet feature models in network security protection, so as to improve the detection capabilities of multi-head attention of abnormal traffic in space and the detection capabilities of temporal change characteristics, and can better extract and detect network attack traffic. This method has relatively high sensitivity and accuracy in detecting system attacks.

[0044] In view of the traffic network characteristics, the present invention provides a targeted traffic packet normalization processing method, such as hash processing of IP addresses and encoding processing of characteristic values ​​in traffic packets, so as to make the processing process more explicit and facilitate the construction of feature sequences, so as to improve the comprehensiveness and accuracy of data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a flow chart of an intelligent DDoS detection method according to an embodiment of the present invention.

[0046] Figure 2 This is an example of a data packet according to an embodiment of the present invention.

[0047] Figure 3 It is a schematic diagram of the autonomous learning network model structure of an embodiment of the present invention.

[0048] Figure 4 It is a schematic diagram of the composition of an intelligent DDoS detection system according to an embodiment of the present invention.

[0049] Figure 5 It is a schematic diagram of the composition of an intelligent DDoS detection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The present invention is further described in detail below in conjunction with embodiments and with reference to the accompanying drawings. Example

[0051] One embodiment of the present invention is an intelligent DDoS attack detection method for continuously learning DDoS attack behaviors and suppressing the success probability of DDoS attacks. Figure 1 As shown, the intelligent DDoS attack detection method of the present invention comprises the following steps:

[0052] Step S101: Collect network traffic data, parse the data packet header of the network traffic data, and generate various characteristic values ​​of the data packet.

[0053] The various characteristic values ​​of data packets in network traffic data include: timestamp, source IP address, destination IP address, source port number, destination port number, protocol type, packet size, number of packets, TCP flag, TTL, packet header length, and routing information.

[0054] Step S102: feature processing and encoding of data packets of network traffic data, including:

[0055] S102-1: Normalize the packet size and the number of packets of the data packet. The specific method is as follows:

[0056] ① Count the average packet size and number of all traffic packets;

[0057] ② Normalize the packet size and number of packets collected in real time in the traffic packet. The normalization formula is: ;

[0058] Among them, M represents the size or number of traffic packets after normalization, X1 is the packet size or number of packets collected in real time in the traffic packet, μ is the mean packet size, and σ is the variance.

[0059] S102-2: Perform hash processing on the IP address and map it into a continuous digital space. The digital space includes a source address space and a target address space.

[0060] Hash the IP address to digitally store and quickly find the IP address in the traffic signature. Map the address to a specific field length in the digital space for storage and memory, and construct the source address space and the destination address space.

[0061] For example, the source address space is a significant feature for detecting DDoS and cannot be hidden. When a DDoS attack is carried out with a forged source address, the entropy of the source and destination address space will change dramatically (extremely decrease or increase). By continuously training traffic features such as address and duration through the feature network, the probability of detecting a DDoS attack will continue to approach accuracy.

[0062] S102-3: Binary encode some characteristic values ​​in the network traffic packet (including but not limited to port number, protocol type, TCP flag, packet header length, routing information), the specific method is as follows:

[0063] ① Determine the encoding length of each characteristic value; for example, the port number is represented using 16-bit binary.

[0064] ② Binary encode each characteristic value; for example, port number 80 is encoded as 01010000 00000000.

[0065] ③ Combine the binary codes of each eigenvalue into a vector as the eigenvector of the traffic packet.

[0066] The selection of eigenvalues ​​is closely related to the location and method of the detection and defense process, and detection and defense can usually be performed at the far end, middle end, or end.

[0067] S102-4: Normalize TTL (Time To Live, the survival time of a data packet in the network). The specific method is as follows:

[0068] ①Count the maximum and minimum TTL values ​​of all traffic packets;

[0069] ② Normalize the TTL of each traffic packet. The normalization formula is: ;

[0070] Among them, N represents the normalized TTL, X2 is the TTL of the traffic packet, and TTL max Is the maximum value of TTL, TTL min It is the minimum value of TTL.

[0071] S102-5: Convert the timestamp to relative time and calculate the time difference of each traffic packet. The specific method is as follows:

[0072] ① Select a starting time point for data acquisition. This starting time point is also the starting point for the LSTM network module in the detection device to obtain data frames, and record the current starting time value.

[0073] ② Calculate the time difference of each traffic packet, that is, the timestamp of the traffic packet minus the timestamp of the starting time point.

[0074] ③ Take the absolute value of the time difference of each traffic packet as an item in the sequence.

[0075] Step S103: normalizing the feature values ​​in the feature-processed and encoded data packets to form a feature vector, sorting them and forming a feature sequence.

[0076] Step S104: input the feature sequence into the data processing neural network for feature sequence training.

[0077] like Figure 3 As shown in the figure, the data processing neural network used for feature training consists of a Transformer network module, an LSTM network module, a fully connected layer, softmax, and dropout. The feature sequence is input into the input layer of the Transformer network module and the LSTM network module respectively, the output of the Transformer network module and the LSTM network module are cascaded, then input into the fully connected layer, input into the softmax classifier for classification, and the dropout classification is used to output the probability judgment result.

[0078] Among them, the Transformer network module implements autonomous learning of the neural network under the self-attention mechanism at the spatial level of the data sequence; the LSTM network module implements learning of the time dimension of data at the byte level and the packet level; the fully connected layer plays a classification role in the entire network to classify the feature data output; softmax provides a weighted attenuation of the loss function of the classified data to construct a regression model; dropout provides regularization technology to avoid overfitting of the model and accelerate the rapid convergence of the network model.

[0079] The following steps S104-1 and S104-2 can be performed simultaneously.

[0080] S104-1: Input the feature sequence to the input layer of the Transformer network module. In the input layer of the Transformer network module, embed the feature sequence and map the features to a low-dimensional vector space. The specific process of implementing autonomous learning of the neural network under the spatial hierarchical self-attention mechanism of the data sequence in the Transformer network module is as follows:

[0081] ① The Encoder extracts features from the input feature sequence and generates a series of vector representations. Each vector contains an abstract representation of a continuous feature in the input sequence.

[0082] ② The self-attention mechanism calculates the similarity matrix based on the vector representation generated by the Encoder and the Decoder input vector at the current moment. Then, the self-attention mechanism calculates the weight matrix based on the similarity matrix, which indicates the degree of attention the model pays to each Encoder vector. Finally, the self-attention mechanism calculates the weighted sum vector based on the weight matrix as the input of the Decoder.

[0083] ③Decoder classifies the data input by Encoder and generates an output vector for each time step, which represents the classification result of the corresponding time step.

[0084] S104-2: Input the feature sequence into the LSTM network module, and the specific process of implementing the time dimension learning of data at the byte level and the data packet level in the LSTM network module is as follows:

[0085] ① Input the feature sequence into the LSTM network. After the data is processed by input, forgetting, output concatenation, and aggregation in the LSTM network, the feature vector data of the data packet is output for the first time.

[0086] ② After the feature vector data of the first output data packet is aggregated through time series, it is input into the LSTM feature network again to generate data flow feature vector data.

[0087] S104-3: After cascading the output data of the LSTM network module and the output data of the Transformer network module, the data is input into the fully connected layer, which maps the weighted sum vector to the probability distribution of the predicted category; the data is input into the softmax classifier for classification, and then input into the dropout module for output. Before outputting the probability judgment result, the parameters of the Transformer network module and the LSTM network module are trained using the cross entropy loss function, with the goal of minimizing the difference between the predicted probability distribution and the true category.

[0088] The specific method of using the cross entropy loss function to train data to process neural network parameters is as follows:

[0089] ① Use stochastic gradient descent or other optimization algorithms to optimize network parameters;

[0090] ② Use batch training method to divide a large number of traffic packets into several batches for training;

[0091] ③For each batch, the cross entropy loss between the output predicted probability distribution and the true label is calculated, and the network parameters are updated.

[0092] Preferably, the cross entropy loss function is:

[0093]

[0094] Among them, y represents the expected output of the neuron, a represents the actual output of the neuron, , , e is a constant, , Z is a real number, w represents the weight of a single neuron, x is the input feature vector, and b identifies the bias parameter.

[0095] By taking partial derivatives of w and b, we can calculate the convergence of the C function, as shown in the following formula.

[0096]

[0097]

[0098] The cross entropy loss function is used to train the autonomous learning network module. The greater the difference between the expectation and the actual value, the greater the gradient, the faster the training network converges, and the faster and more accurate the detection speed in DDoS detection.

[0099] Data is obtained from the network, and the input value is the characteristic value encoding in the traffic data. After data processing, the output result of the neural network is the probability value. Each batch of data is continuously input into the network, and the parameters w and b in Z are iteratively optimized to make the network detection more accurate.

[0100] Step S105: Perform DDoS attack detection based on the output of the data processing neural network after feature sequence training. If the predicted probability of the data processing neural network after feature sequence training is greater than the preset prediction threshold, the traffic packet is classified as a DDoS attack traffic packet and defense processing is performed on the DDoS attack traffic packet. Otherwise, it is classified as a normal traffic packet and no processing is performed. The prediction threshold is set according to the actual scenario and requirements, such as 0.5. Example

[0101] Another embodiment of the present invention is as follows Figure 2 Taking the data packet shown in the figure as an example, the feature processing and encoding process of the data packet of network traffic data is described in detail, including the following steps:

[0102] 1. Normalize the traffic packet size, number of packets, and TTL

[0103] (1) Normalize the traffic packet size:

[0104] Formula: Normalized traffic packet size M = (traffic packet size X1-average traffic size μ) / standard deviation traffic size σ;

[0105] Specific calculation process:

[0106] ① Average flow size μ=(200+300+500+100+50+600+700+900+400+25) / 10=475;

[0107] ② Standard deviation flow size σ=sqrt(((200-475)^2+(300-475)^2+(500-475)^2+(100-475)^2+ (50-475)^2+(600-475)^2+(700-475)^2+(900-475)^2+(400-475)^2+(25-475)^2) / 10)≈287.23;

[0108] For example, for the first packet, the normalized traffic size M = (200-475) / 287.23 ≈ -0.961;

[0109] (2) Normalize the number of packets:

[0110] Formula: Normalized packet quantity = (packet quantity - average packet quantity) / standard deviation packet quantity;

[0111] Specific calculation process:

[0112] ①Average number of packages = (1+2+3+4+5+6+7+8+9+10) / 10=5.5;

[0113] ②Number of standard deviation packages = sqrt(((1-5.5)^2+(2-5.5)^2+(3-5.5)^2+(4-5.5)^2+(5-5.5)^2+(6-5.5)^2 + (7-5.5)^2 +(8-5.5)^2 +(9-5.5)^2 +(10-5.5)^2) / 10)≈2.872;

[0114] For example, for the first data packet, the normalized packet number = (1-5.5) / 2.872≈-1.569;

[0115] 2. IP address hash processing, taking the source IP address: 192.168.1.1 as an example:

[0116] ①Convert the source IP address into a byte array: [192,168,1,1];

[0117] ② Apply the SHA-256 hash function to calculate the hash value: SHA-256([192,168,1,1]) = 89c948893695af0788c0e1b07d1b4adbcfdf0f0d60f3f4e0b438c563b7211661;

[0118] ③Convert to binary representation: 100010011100100100100010001000110101100101010110111110100000011110001110000 000111011000001110110100011010111010111110110001111111000000011010110001110 0101110101;

[0122] 3. Binary encode the port number, protocol type, TCP flag, packet header length and routing information.

[0123] Take the port number: 80, protocol type: TCP, TCP flag: SYN, packet header length: 20, and routing information: RouterA as an example:

[0124] ① Binary encoding of port number:

[0125] Port number 80 converted to binary representation: 0101000000000000;

[0126] ② Protocol type binary encoding:

[0127] According to the binary encoding table corresponding to the TCP protocol, the encoding of TCP is: 0001;

[0128] ③TCP flag binary encoding:

[0129] According to the binary encoding table of TCP flags, the encoding of SYN is: 000010;

[0130] ⑤Binary encoding of packet header length:

[0131] The packet header length 20 is converted to binary representation: 00010100;

[0132] ⑥Binary encoding of routing information:

[0133] For the routing information "RouterA" in the example, you can use the encoding table or encoding rules to convert it. The encoding of RouterA is: 001;

[0134] ⑦ Combine the encoding results into a vector. Combine the above binary encoding results into a vector in order:

[0135] a.Port number encoding: 0000000001010000;

[0136] b. Protocol type code: 0001;

[0137] c.TCP flag code: 000010;

[0138] d. Packet header length code: 00010100;

[0139] e. Routing information code: 001;

[0140] f. The final feature vector is: 0000000001010000 0001 000010 00010100 001;

[0141] 4. Normalize TTL.

[0142] Formula: Normalized TTL = (TTL-minimum TTL) / (maximum TTL-minimum TTL);

[0143] Specific calculation process:

[0144] ①Minimum TTL=64;

[0145] ②Maximum TTL=128;

[0146] For example, for the first data packet, the normalized TTL = (64-64) / (128-64) = 0; 5. Calculate the time difference of each packet. In the sample data, select the timestamp 1622040676 as the starting time point. Calculate the time difference of each data packet, that is, the timestamp of the data packet minus the starting time point:

[0147] Timestamp sequence: [1622040676, 1622040681, 1622040686, 1622040691, 1622040696, 1622040701, 1622040706, 1622040711, 1622040716, 1622040721].

[0148] Time difference sequence: [0,5,5,5,5,5,5,5,5,5].

[0149] 5. All eigenvalues ​​form vectors

[0150] Combined with the data of the data packet, the normalized values ​​of the packet size, number of packets, TTL, source IP, destination IP, destination port number, protocol type, TCP flag, packet header length, and routing information are combined, and finally several sequences of the form [-0.961, -1.569, 0, 0.727, -1.242, 1.212, 1.515, 2.121, -0.303, -1.848] can be obtained as the input of the data processing neural network for learning and training. Example

[0151] Another embodiment of the present invention is an intelligent DDoS attack detection system, which implements the intelligent DDoS attack detection method of the present invention. Figure 4 As shown, it includes: an interface card 401, a processor 402, a data bus 403, and a memory 404.

[0152] The interface card 401 is an interface for acquiring data, and the mode and method of receiving data through the interface can usually be set on the user interaction interface. The intelligent DDoS attack detection system receives the original message data flow from the interface card and stores the data in the memory 404 .

[0153] Processor 402, which refers to a CPU or a GPU, mainly provides processing of original message data packets and data streams and supports the operation of a data processing neural network, implements the steps of the intelligent DDoS attack detection method of the present invention, provides processing of original message data streams, and executes feature sequence training of the data processing neural network.

[0154] The interface card 401, processor 402, and memory 404 in the detection device are interconnected at high speed via a data bus 403 to achieve data packets, computing instructions, and data exchange and transmission between networks.

[0155] The present invention adopts an autonomous learning network model to detect DDoS attacks, and the intelligent DDoS attack detection device controls the attack behavior. It can continuously track the characteristic values ​​including port number, protocol type, TCP flag, packet length, routing information, and destination address, and continuously learn and compare with the values ​​when there is no attack, so as to effectively detect the attack behavior. When the network is connected in series (a network connection method, the connection method is divided into series connection and bypass) into the intelligent DDoS attack detection device, if abnormal traffic is found, it is adjusted according to TCP retransmission randomization and source end WIN window, thereby greatly suppressing the effect of source end attack.

[0156] The attack detection device of the present invention comprises a memory and a processor; the memory stores a computer program for implementing an intelligent DDoS attack detection method, and the processor executes the computer program to implement the steps of the intelligent DDoS attack detection method. Figure 5 As shown, the computer program includes a traffic acquisition module 501, a data processing module 502, a training module 503, and a detection and disposal module 504.

[0157] The traffic acquisition module 501 is a hybrid 10 Gigabit Ethernet interface or a Gigabit Ethernet interface, and collects data traffic by mirroring the network device traffic to this interface or connecting the two interfaces in series to the detected network.

[0158] In the net_device structure of the operating system layer, promiscuity is set to greater than 0, and tcpdump is used to intercept the data on the promiscuous interface to obtain the original data message. The traffic acquisition module 501 collects various feature values ​​in the network traffic data, and obtains data such as timestamp, source IP address, destination IP address, source port number, destination port number, protocol type, packet size, TCP flag, number of packets, TTL, header length, routing information, etc. for each traffic packet. These feature values ​​provide basic information and transmission properties about the traffic packet.

[0159] The traffic acquisition module 501 uses a driven polling mode to start the busy polling on sockets function, continuously captures the data on the promiscuous interface to obtain data, and then stores the intercepted data in the buffer of the traffic acquisition module 501. At the same time, according to the idle state of the data processing module 502, the data queue is sent to the data processing module 502.

[0160] The data processing module 502 performs the feature processing and encoding on the data packet after receiving the data queue, including:

[0161] First, the packet size and the number of packets of the traffic packets are normalized in terms of mean value and variance to eliminate the scale differences between different traffic flows, so that the training module 503 can better learn the differences between different traffic flows.

[0162] Secondly, the data processing module 502 performs hash processing on the IP address and maps it into a continuous digital space; this can convert the discrete features of the IP address into continuous numerical features, which is conducive to the model learning the correlation of the IP address.

[0163] Then, the data processing module 502 performs binary encoding on the port number, protocol type, TCP flag, packet header length and routing information; converts each feature value into a binary representation to form a vector of a fixed length to represent the corresponding feature.

[0164] Next, the data processing module 502 normalizes TTL and maps the value range of TTL to between [0, 1]. Through normalization, the value of TTL can better adapt to the learning and prediction process of the model.

[0165] Finally, the timestamp is converted into relative time, and the time difference of each packet is calculated. By taking a certain time point as the starting point and calculating the time difference of each traffic packet, the time information can be converted into an item in the sequence, helping the model capture the time relationship between traffic packets.

[0166] The data processing module 502 sorts and combines the feature vectors. The processed feature values ​​are combined into a vector and sorted according to the sequence number of the packet to form an ordered feature sequence. The purpose of this is to maintain the order relationship between traffic packets and represent the features as an ordered feature sequence for subsequent model input and processing.

[0167] The data processing module 502 sends the feature sequence formed after feature processing and encoding to the training module 503.

[0168] The training module 503 performs feature sequence training of the data processing neural network, and generates multiple independent vectors representing the features of the data packet through convolution processing of the features by the data processing neural network, including the probability value of each feature parameter, and the vectors are input into the detection and disposal module. Specifically, it includes:

[0169] Input the data into the Transformer network module and the LSTM network module;

[0170] In the Transformer network module, the feature sequence is input into the input layer of the Transformer network. In the input layer, the feature sequence is spatially embedded and the features are mapped into a low-dimensional vector space to facilitate network learning and processing.

[0171] Next, the Encoder part extracts features from the input sequence to generate a series of vector representations; each vector contains an abstract representation of a continuous feature in the input sequence; this can capture local features and correlation information in the input sequence.

[0172] In order to make full use of all the vector representations generated by the encoder, the self-attention mechanism is introduced. This mechanism calculates the similarity matrix based on the vector representation generated by the encoder and the decoder input vector at the current moment. Then, the weight matrix is ​​calculated based on the similarity matrix to indicate the degree of attention paid by the model to each encoder vector.

[0173] Then, the decoder part generates the output for classifying the input sequence. At each time step, an output vector is generated, which represents the classification result of the corresponding time step.

[0174] In the LSTM network module, the temporal characteristics of network data packets and network traffic packets are learned. 2 The features are converted into K×K feature maps, and then the features are reorganized through the LSTM network. In the first stage LSTM, the row vector of the feature scale (K, 1) is encoded as (K 2 ,1) ,In the second layer of LSTM, extract the flow dimension features and transform the data into K 2 Vector of feature parameters.

[0175] The softmax in the training module 503 provides a weighted attenuation of the loss function of the classified data to construct a regression model; the dropout in the training unit 503 provides a regularization technology to avoid overfitting of the model and accelerate the rapid convergence of the network model. In this way, the model can pay more attention to the features related to DDoS attack detection and improve the accuracy and effect of detection.

[0176] The data of the training module 503 includes the probability value of each characteristic parameter, and the data is input into the detection and processing module 504.

[0177] The detection and disposal module 504 determines the abnormal characteristics by comparing the probability value of the abnormal characteristic parameter with the preset probability threshold. For data with a high abnormal probability, on the one hand, for bypass traffic, reminders and alarms can be given on the detection interactive interface for the detected characteristic values; on the other hand, for the serially connected promiscuous network interface, an interception strategy can be set according to the characteristic value to intercept and discard the abnormal traffic.

[0178] Compared with traditional statistical methods based on protocols, in order to fully explore the spatial and temporal dimension discrimination ability in the network data packet sequence, the intelligent DDoS attack detection method, device and system of the present invention adopts intelligent learning methods in the two dimensions of time and space, and expands the spatial and temporal attention of the traffic and data packet feature models in network security protection, so as to improve the detection ability of abnormal traffic in space and the detection ability of temporal change characteristics, and can better extract and detect network attack traffic. The sensitivity and accuracy of this method in detecting system attacks are relatively high.

[0179] In view of the traffic network characteristics, the present invention provides a targeted traffic packet normalization processing method, such as hash processing of IP addresses and encoding processing of characteristic values ​​in traffic packets, so as to make the processing process more explicit and facilitate the construction of feature sequences to facilitate the comprehensiveness and accuracy of data processing.

[0180] Although the present invention has been disclosed as above with preferred embodiments, the embodiments are not intended to limit the present invention. Any equivalent changes or modifications made without departing from the spirit and scope of the present invention also belong to the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the content defined by the claims of this application.

Claims

1. An intelligent DDoS attack detection method, characterized in that: include: Collect network traffic data, parse the data packet header of the network traffic data, and generate various characteristic values ​​of the data packet, wherein the various characteristic values ​​include: timestamp, source IP address, destination IP address, source port number, destination port number, protocol type, packet size, number of packets, TCP flag, TTL, packet header length, and routing information; Perform feature processing and encoding on the data packets of network traffic data, including normalizing the packet size and number of packets, hashing the IP address, mapping it to a specific field length in a continuous digital space for storage and memory, constructing the source address space and the destination address space, binary encoding some feature values ​​in the network traffic packet, normalizing the TTL, converting the timestamp into relative time, and calculating the time difference of each traffic packet; The feature values ​​after feature processing and encoding are normalized to form a feature vector, which is sorted and formed into a feature sequence; Inputting the feature sequence into a data processing neural network for feature sequence training, including: inputting the feature sequence into the input layers of a Transformer network module and an LSTM network module respectively, implementing autonomous neural network learning under a self-attention mechanism at a spatial level of a data sequence in the Transformer network module, and implementing time dimension learning of data at a byte level and a data packet level in the LSTM network module; cascading the outputs of the Transformer network module and the LSTM network module, and then inputting them into a fully connected layer, the fully connected layer maps the weighted sum vector to a probability distribution of a predicted category, inputs it into a softmax classifier for classification, and uses dropout classification to output a probability judgment result; before outputting the probability judgment result, using a cross entropy loss function to train the parameters of the Transformer network module and the LSTM network module; DDoS attack detection is performed based on the output results of the data processing neural network after feature sequence training. If the predicted probability of the traffic packet output by the data processing neural network after feature sequence training is greater than the preset prediction threshold, the traffic packet is classified as a DDoS attack traffic packet, otherwise it is classified as a normal traffic packet.

2. The intelligent DDoS attack detection method according to claim 1 is characterized in that: In the input layer of the Transformer network module, the feature sequence is embedded and the features are mapped into a low-dimensional vector space.

3. The intelligent DDoS attack detection method according to claim 2 is characterized in that: The Transformer network module implements autonomous learning of the neural network under the data sequence spatial hierarchical self-attention mechanism, including: The Encoder part extracts features from the input feature sequence and generates a series of vector representations. Each vector contains an abstract representation of a continuous feature in the input feature sequence. The self-attention mechanism calculates a similarity matrix based on the vector representation generated by the encoder and the decoder input vector at the current moment; calculates a weight matrix based on the similarity matrix to indicate the degree of attention paid by the model to each encoder vector; and calculates a weighted sum vector based on the weight matrix as the input of the decoder; The Decoder classifies the data input by the Encoder and generates an output vector for each time step, indicating the classification result of the corresponding time step.

4. The intelligent DDoS attack detection method according to claim 1 is characterized in that: The LSTM network module implements the learning of the time dimension of data at the byte level and the packet level, including: The feature sequence is input into the LSTM network. After the feature sequence is processed by input, forgetting, output concatenation, and aggregation in the LSTM network, the feature vector data of the data packet is output for the first time. The feature vector data of the first output data packet is aggregated through time series and then input into the LSTM feature network again to generate data flow feature vector data.

5. The intelligent DDoS attack detection method according to claim 1 is characterized in that: The use of the cross entropy loss function to train the Transformer network module and the LSTM network module parameters includes: Use the stochastic gradient descent algorithm to optimize the network parameters; Use batch training method to divide a large number of traffic packets into several batches for training; For each batch, the cross entropy loss between the predicted probability distribution of the output and the true labels is calculated, and the network parameters are updated.

6. The intelligent DDoS attack detection method according to claim 5, characterized in that: The cross entropy loss function is: Among them, y represents the expected output of the neuron, a represents the actual output of the neuron, , , e is a constant, , Z is a real number, w represents the weight of a single neuron, x is the input feature vector, and b identifies the bias parameter.

7. The intelligent DDoS attack detection method according to claim 1, characterized in that: The partial characteristic values ​​include one or more of a port number, a protocol type, a TCP flag, a packet header length, and routing information.

8. An intelligent DDoS attack detection device, characterized in that: It comprises a memory and a processor; the memory stores a computer program for implementing an intelligent DDoS attack detection method, and the processor executes the computer program to implement the steps of the intelligent DDoS attack detection method according to any one of claims 1 to 7.

9. The intelligent DDoS attack detection device according to claim 8, characterized in that: The computer program includes a flow acquisition module, a data processing module, a training module and a detection and disposal module; The traffic acquisition module is a hybrid 10 Gigabit Ethernet interface or a Gigabit Ethernet interface, and collects data traffic by mirroring network device traffic to this interface or connecting two interfaces in series to the detected network, and adopts a driven polling mode to start a frequent polling socket function, and continuously captures data on the hybrid 10 Gigabit Ethernet interface or the Gigabit Ethernet interface to obtain data, and then stores the intercepted data in a buffer of the traffic acquisition module, and at the same time sends the data queue to the data processing module according to the idle state of the data processing module; The data processing module performs the feature processing and encoding on the data packet after receiving the data queue, and sends the formed feature sequence to the training module; The training module performs feature sequence training of the data processing neural network, performs convolution processing on the feature sequence through the data processing neural network, generates a plurality of independent vectors of probability values ​​of each feature parameter, and inputs the probability values ​​into the detection and disposal module; The detection and disposal module determines abnormal features by comparing the probability values ​​of the characteristic parameters with preset probability thresholds, and issues reminders, alarms, or sets interception strategies based on the abnormal features.

10. An intelligent DDoS attack detection system, characterized in that: Includes interface card, processor, memory and data bus; The interface card is an interface for data acquisition, and the original message data stream received from the interface card is temporarily stored in the memory; The processor implements the steps of the intelligent DDoS attack detection method according to any one of claims 1 to 7, provides processing of the original message data stream and performs feature sequence training of the data processing neural network; The interface card, processor and memory are interconnected at high speed via the data bus.

Images