Ldos detection method, device and storage medium in a network slice environment

Abstract

The application provides a LDoS detection method and device in a network slice environment and a storage medium, relates to the technical field of communication network security, and comprises the following steps: obtaining traffic data and link state information from a honeypot network slice; inputting the traffic data into a detection model to obtain a first detection result; obtaining a throughput sequence according to the link state information; identifying the change of the throughput according to the throughput sequence to obtain a second detection result; and obtaining an attack identification result according to the first detection result and the second detection result. The data is obtained from the honeypot network slice that attracts network attacks, which is conducive to distinguishing normal and malicious traffic and improving the accuracy of attack detection. The first detection result is obtained by detecting whether an attack is received from the feature angle of the traffic data, and the second detection result is obtained by detecting whether an attack is received from the abnormal change angle of the link, the attack identification result is obtained by combining the two, and the accuracy of LDoS attack detection and identification is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication network security, and in particular to a LDoS detection method, device and storage medium in a network slice environment. BACKGROUND

[0002] Low-rate Denial of Service (LDoS) attack is a special type of DoS attack, which usually uses a large number of legitimate requests or occupies system resources to make the target system overload, so as to cause the service unavailable, and has the characteristics of periodicity and concealment, and mainly aims at Transmission Control Protocol (TCP). The TCP protocol uses an adaptive congestion control mechanism to ensure the performance and reliability of transmission, but this mechanism is easy to be used by LDoS attack. LDoS attack uses the congestion control mechanism of TCP to send high-intensity periodic traffic. Under the trigger of LDoS attack traffic, the congestion control mechanism is repeatedly triggered, so that the throughput of the target network is reduced, the delay is increased, and the transmission performance of the network is affected.

[0003] LDoS attack process: LDoS periodically bursts high-intensity attack data stream with short duration, which causes a large number of packet loss of normal TCP flow, so that the congestion control mechanism is forced to enter slow start, and the compression window causes traffic loss; after entering the slow start, LDoS attack stops the attack, and when the TCP flow slowly recovers to be normal, the next LDoS attack period starts, and the high-intensity attack data stream continues to attack, causing the next round of congestion control; so the TCP flow repeatedly enters the vicious cycle state of "congestion avoidance" and "congestion recovery", which causes the throughput of the TCP flow to be greatly reduced.

[0004] In the prior art, the detection of LDoS attack depends on a static attack feature database, and the adaptive ability is poor for the change or new type of attack mode, and the accuracy of distinguishing normal traffic and malicious traffic is low, especially in a complex network environment such as a network slice environment. Therefore, how to effectively detect and defend LDoS attack, especially in the network slice environment, becomes a problem to be solved. SUMMARY

[0005] The present application provides a LDoS detection method, device and storage medium in a network slice environment, to solve the defect that the prior art cannot effectively identify LDoS attack.

[0006] The present application provides a LDoS detection method in a network slice environment, comprising:

[0007] Obtain traffic data and link state information from a honeypot network slice;

[0008] Input the traffic data into a detection model to obtain a first detection result, the detection model being configured to process the traffic data through multiple weak classifiers and weight the processing result to obtain the first detection result;

[0009] Obtain a throughput sequence according to the link state information;

[0010] Identify a change in throughput according to the throughput sequence to obtain a second detection result;

[0011] Obtain an attack identification result according to the first detection result and the second detection result;

[0012] The honeypot network slice is a logical network configured to attract network attacks to obtain attack traffic.

[0013] According to the present application, a network slice environment LDoS detection method is provided, and the second detection result is obtained by identifying a change in throughput according to the throughput sequence, which includes:

[0014] Initialize a counter and set the count value of the counter to zero;

[0015] Select a throughput value from the throughput sequence as a current element;

[0016] Calculate the average value and variance value of the throughput values in a preset window centered on the current element;

[0017] Determine whether the current element is less than the product of the previous throughput value and a preset coefficient, or whether the average value is less than a first preset threshold and the variance value is greater than a second preset threshold;

[0018] If yes, the count value of the counter is incremented by one, and if no, the count value of the counter is set to zero;

[0019] When the count value of the counter is greater than a third preset threshold, the attack is identified as the second detection result.

[0020] According to the present application, a network slice environment LDoS detection method is provided, and the second detection result is obtained by identifying a change in throughput according to the throughput sequence, which includes:

[0021] Obtain attack data from the honeypot network slice as sample data;

[0022] Train a preset original model according to the sample data, and use the trained model as a new detection model.

[0023] The application provides a LDoS detection method in a network slice environment, wherein a preset original model is trained according to sample data, and a trained model is used as a new detection model, and the method comprises the following steps:

[0024] Obtaining a classifier number value;

[0025] Setting a corresponding sample weight value for the sample data;

[0026] Training an original model according to the sample data and the corresponding sample weight value, and obtaining a weak classifier;

[0027] Obtaining a classification result and an error rate of the weak classifier according to the weak classifier and the sample data;

[0028] Calculating an important weight corresponding to the weak classifier according to the error rate;

[0029] Updating the sample weight value according to the classification result to obtain a new weak classifier, until the number of weak classifiers reaches the classifier number value;

[0030] Combining the weak classifiers according to the corresponding important weights, obtaining a strong classifier, and using the strong classifier as a new detection model.

[0031] The application provides a LDoS detection method in a network slice environment, wherein sample data comprises a plurality of features, the original model is trained according to the sample data and the corresponding sample weight value, and a weak classifier is obtained, and the method comprises the following steps:

[0032] The features in the sample data are sorted according to importance, a preset number of features are selected in sequence, the original model is trained, the trained original model is used as a weak classifier.

[0033] The application provides a LDoS detection method in a network slice environment, wherein the original model is a decision tree in the step of training an original model according to the sample data and the corresponding sample weight value, and obtaining a weak classifier, and the detection model is an XGBoost model.

[0034] The application provides a LDoS detection method in a network slice environment, wherein the attack recognition result is obtained according to the first detection result and the second detection result, and the method comprises the following steps:

[0035] When the first detection result and the second detection result both represent that an attack is suffered, the LDoS attack is taken as the attack recognition result.

[0036] The application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the LDoS detection method in the network slice environment according to any one of the above when executing the program.

[0037] The application further provides a non-transitory computer-readable storage medium, which stores a computer program, wherein the computer program is executable on a processor to implement the LDoS detection method in the network slice environment according to any one of the above.

[0038] The application further provides a computer program product, comprising a computer program, wherein the computer program is executable on a processor to implement the LDoS detection method in the network slice environment according to any one of the above.

[0039] The application provides an LDoS detection method, device and storage medium in a network slice environment, which has at least the following beneficial effects: the traffic data and link state data are obtained from the honeypot network slice for detection, since the honeypot network slice is a logical network specially used for attracting network attacks, normal traffic usually accesses the honeypot network slice less, which is conducive to distinguishing normal traffic and malicious traffic in the network slice environment and improving the accuracy of attack detection. The traffic data is processed by a detection model, a plurality of weak classifiers obtain a first detection result by weighting the detection results of the traffic data, and whether an attack is received is detected from the feature angle of the traffic data. Meanwhile, the throughput sequence is processed to obtain a second detection result according to the change of the throughput, and whether an attack is received is detected from the abnormal change angle of the link. The first detection result and the second detection result are combined to obtain an attack recognition result, which is conducive to improving the accuracy of LDoS attack detection and recognition, improving the detection effect, and achieving the purpose of effectively identifying LDoS attacks. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0041] Figure 1 is a schematic diagram of the change of attack traffic and the change of TCP traffic when LDoS attack;

[0042] Figure 2 is one of the flowcharts of the LDoS detection method in a network slice environment provided by the application;

[0043] Figure 3is a flowchart of a network slice environment LDoS detection method provided by the present application;

[0044] Figure 4 is a flowchart of a network slice environment LDoS detection method provided by the present application;

[0045] Figure 5 is a flowchart of a network slice environment LDoS detection method provided by the present application;

[0046] Figure 6 is a flowchart of a network slice environment LDoS detection method provided by the present application;

[0047] Figure 7 is a flowchart of a network slice environment LDoS detection method provided by the present application;

[0048] Figure 8 is a structural diagram of an electronic device provided by the present application;

[0049] Figure 9 is a structural diagram of an electronic device provided by the present application; DETAILED DESCRIPTION

[0050] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0051] Reference Figure 1 , the change of attack traffic and the change of TCP traffic under LDoS attack. Wherein R represents the peak rate of attack traffic, T represents the period of attack, L represents the burst traffic duration of attack traffic in each period. The ratio L / T should be at a very small average low rate to avoid being detected. During the attack traffic burst, the victim switch buffer is full of attack packets, resulting in a large number of data packet losses of benign TCP traffic, and TCP packets are forced to be retransmitted continuously, triggering the congestion control mechanism and reducing the TCP throughput.

[0052] The network slice environment LDoS detection method provided by the present application will be described below. Figures 2-5 The network slice environment LDoS detection method provided by the present application comprises the following steps:

[0053] S100: obtaining traffic data and link state information from the honeypot network slice;

[0054] S200: input the traffic data into a detection model to obtain a first detection result, the detection model being configured to process the traffic data through multiple weak classifiers and weight the processing result to obtain the first detection result;

[0055] S300: obtain a throughput sequence according to the link state information;

[0056] S400: identify a change in throughput according to the throughput sequence to obtain a second detection result;

[0057] S500: obtain an attack identification result according to the first detection result and the second detection result;

[0058] The honeypot network slice is a logical network for attracting network attacks to obtain attack traffic.

[0059] The traffic data and the link state data are obtained from the honeypot network slice for detection. Since the honeypot network slice is a logical network specially used for attracting network attacks, normal traffic usually accesses the honeypot network slice less, which is conducive to distinguishing normal traffic and malicious traffic in the network slice environment and improving the accuracy of attack detection. The traffic data is processed by the detection model, and the detection results of the traffic data are weighted by multiple weak classifiers to obtain the first detection result, which detects whether an attack is received from the perspective of the characteristics of the traffic data. At the same time, the throughput sequence is processed to obtain the second detection result according to the change in throughput, which detects whether an attack is received from the perspective of abnormal changes in the link. The first detection result and the second detection result are combined to obtain the attack identification result, which is conducive to improving the accuracy of LDoS attack detection and identification, improving the detection effect, and achieving the purpose of effectively identifying LDoS attacks.

[0060] It can be understood that after obtaining the traffic data and the link state data from the honeypot network slice, the process of obtaining the first detection result and the process of obtaining the second detection result can be performed in parallel, and the order of obtaining the first detection result and the second detection result is not limited.

[0061] In the network slice environment, the entire network resource is divided into multiple independent and virtual logical networks, which are called network slices. Each network slice can have its own specific configuration, performance and security policy and operates independently of other network slices. A logical network specially set for attracting network attacks, i.e., a honeypot network slice, is set up. Obvious protection vulnerabilities and virtual high-value resources can be set in the honeypot network slice to achieve the effect of attracting attacks. When an LDoS attack occurs, attack traffic is attracted to the honeypot network slice. The traffic data and the link state information are obtained from the honeypot network slice, which can more accurately detect and identify LDoS attacks.

[0062] In some embodiments of the present application, before obtaining the traffic data and the link state information from the honeypot network slice, further comprising: creating a logical network for attracting network attacks to obtain attack traffic as the honeypot network slice.

[0063] Reference Figure 3 In some embodiments of the LDoS detection method in a network slice environment of the present application, the S400 comprises:

[0064] S410: initialize a counter and set the count value of the counter to zero;

[0065] S420: sequentially select a throughput value from the throughput sequence as a current element;

[0066] S430: calculate the average value and the variance value of the throughput values in a preset window centered on the current element;

[0067] S440: determine whether the current element is less than the product of the previous throughput value and a preset coefficient, or the average value is less than a first preset threshold and the variance value is greater than a second preset threshold;

[0068] S450: if yes, the count value of the counter is incremented by one, and if no, the count value of the counter is set to zero;

[0069] S460: when the count value of the counter is greater than a third preset threshold, the attack is suffered as the second detection result.

[0070] According to the characteristics of high burst traffic and low average rate of LDoS attacks, and the characteristics of throughput reduction under the action of TCP protocol congestion control mechanism when LDoS attacks occur, the throughput sequence is processed to determine whether an attack is received. If the throughput value as the current element is less than the product of the previous throughput value and a preset coefficient, it means that the throughput value decreases significantly, which may be attacked. Or the average value is less than a first preset threshold and the variance is greater than a second preset threshold, which means that the average rate is low and there is a large difference in burst traffic, which may be attacked. By counting the number of consecutive occurrences of the above two cases, when the cumulative number is greater than a third preset threshold, it is considered to be attacked, and the information of suffering attack is generated as the second detection result.

[0071] In this way, based on the characteristics of LDoS attacks, the throughput sequence is detected to determine whether an attack is received from the perspective of abnormal changes in the link, and through the counting cumulative manner, the probability of false positives is reduced, which is conducive to improving the accuracy of detection.

[0072] It should be emphasized that, by presetting the number of windows, the present application processes the throughput value of a window segment in a manner that balances the real-time and sensitivity of detection, avoids excessive number of throughput values being processed simultaneously, causes the sampling rate to be too low, reduces the sensitivity to changes in throughput values, avoids processing each throughput value, causes the sampling rate to be too high, and leads to frequent processing that reduces real-time performance. In this way, by presetting the number of windows, a corresponding number of throughput values are selected for calculation and processing, which can ensure the sensitivity to changes in throughput values and also moderate the sampling rate, thereby having good real-time performance.

[0073] The preset number of windows can be set according to requirements, for example, it can be 3. In order to facilitate understanding, an example is used for illustration: the throughput sequence includes X1, X2, X3, …, Xn, according to the preset number of windows, the initial current element is selected, assuming that the preset number of windows is 3, X2 is selected as the initial current element, and X1, X2, X3 are selected for calculating the average value and the variance value. When X2 is less than the product of X1 and the preset coefficient, the count value of the counter is incremented by one, or when the average value is less than the first preset threshold and the variance is greater than the threshold, the count value of the counter is incremented by one. Then, X3 is selected as the current element, and the above steps are repeated until the throughput sequence is traversed, and in the case of a preset number of 3, Xn-1 is completed as the current element. In the above process, when the count value of the counter is greater than the third preset threshold, it is considered to be attacked.

[0074] The preset coefficient, the first preset threshold, the second preset threshold, and the third preset threshold can be set according to the actual application environment.

[0075] Reference Figure 4 In some embodiments of the LDoS detection method in a network slice environment of the present application, further comprising:

[0076] S600: Obtain attack data from the honeypot network slice as sample data;

[0077] S700: Train the preset original model according to the sample data, and use the trained model as the new detection model.

[0078] In the process of real-time detection, that is, the process of detecting traffic data and detecting the throughput sequence by the detection model, when an attack is detected, attack data is obtained from the honeypot network slice as sample data, and the preset original model is trained using the sample data to obtain an updated and optimized detection model. In this way, based on the attack data obtained from the actual network environment as sample data for training, the detection model can adapt to changes or new attack patterns, which is beneficial to enhancing the real-time performance and adaptability of the detection model for attack detection.

[0079] It can be understood that, initially, the existing data is used to train the original model to obtain an initial detection model, and in subsequent application in the actual network, sample data is obtained from the honeypot network slice to further train and update the detection model, so that the detection model can adapt to changes and new LDoS attacks and perform effective detection.

[0080] Reference Figure 5 In some embodiments of the LDoS detection method in a network slice environment of the present application, the S700 comprises:

[0081] S710: obtaining a classifier number value;

[0082] S720: setting a corresponding sample weight value for the sample data;

[0083] S730: training the original model according to the sample data and the corresponding sample weight value to obtain a weak classifier;

[0084] S740: obtaining the classification result and the error rate of the weak classifier according to the weak classifier and the sample data;

[0085] S750: calculating the important weight corresponding to the weak classifier according to the error rate;

[0086] S760: updating the sample weight value according to the classification result to obtain a new weak classifier until the number of weak classifiers reaches the classifier number value;

[0087] S770: combining the weak classifiers according to the corresponding important weights to obtain a strong classifier and taking the strong classifier as a new detection model.

[0088] The original model is trained using sample data to obtain a weak classifier. Since the sample data used comes from a real-time honeypot network slice, the weak classifier obtained by training can better adapt to the current real-time network environment. According to the error rate of the sample data classification result of the weak classifier, the important weight corresponding to the weak classifier is generated, which can make the weak classifier with a low error rate have a higher important weight and have a greater influence on the final first detection result, which is beneficial to improve the accuracy of the first detection result. According to the classification result of the current weak classifier, the sample weight value of the sample data is updated, so that the sample data that is incorrectly classified has a larger sample weight value, i.e., more attention is paid to the sample data that is incorrectly classified, and the next weak classifier obtained by training according to the sample data and the updated sample weight value performs better on the sample data that is incorrectly classified, realizing the complementary effect between weak classifiers.

[0089] Therefore, the process of repeatedly training to obtain weak classifiers, setting important weights, and updating sample weight values is repeated, and after the number of weak classifiers equal to the number of classifiers is obtained, the strong classifier is obtained by weighting and combining the weak classifiers based on the important weights as the detection model. Since the performances of the classifiers are complementary and the adaptive weights are realized based on the error rate, the weight model is optimized, which can make the detection model accurately detect and identify attack data, and is beneficial to improve the accuracy of the detection model.

[0090] The number of classifiers can be pre-set according to the actual application environment.

[0091] In some embodiments of the present application, the important weight corresponding to the weak classifier can be calculated according to the error rate by the following formula:

[0092]

[0093] wherein, α t is the important weight, ∈ t is the error rate, and t is the serial number of the weak classifier.

[0094] In some embodiments of the present application, after the weak classifier is trained, the sample weight value can be obtained by sequentially calculating the following formula:

[0095]

[0096] z t = ω t+1 - S t

[0097]

[0098] ω t+1 = S t+1

[0099] wherein, α t is the important weight corresponding to the weak classifier, h t (x) is the function corresponding to the weak classifier, ω t is the current sample weight value, ω t+1 is the updated sample weight value, x is the sample data, z t , and S t are intermediate calculation quantities.

[0100] The calculation process of S t+1 is a step of smoothing the sample weight, so that the finally obtained sample weight value ω t+1 is kept within a specified range, ensuring stability.

[0101] It can be understood that the sample weight value ω0 can be assigned by random or based on feature value calculation at the initial time, and the subsequent updated sample weight value ω t The initial value S0 of the sample weight value ω t may be 0 or other set values.

[0102] In some embodiments of the LDoS detection method in the network slice environment, the sample data includes a plurality of features, and the S730 includes:

[0103] The features in the sample data are sorted according to importance, and a preset number of features are selected in turn to train the original model, and the trained original model is used as a weak classifier.

[0104] By sorting the features in the sample data according to importance, the top-ranked features are selected to train the original model, and the performance of the weak classifier obtained after training is better, which further improves the detection performance of the strong classifier, i.e., the detection model, and is beneficial to improve the detection accuracy.

[0105] In some embodiments of the application, the preset number of specific values can be set according to the convergence performance of the original model.

[0106] In some embodiments of the LDoS detection method in the network slice environment, the S730, the original model is a decision tree.

[0107] By using a decision tree as an original model, a weak classifier is formed after training, and since the decision tree can effectively capture the nonlinear relationship in the data, it can flexibly divide the data space, adapt to various nonlinear relationships, and automatically learn and represent the interaction between features, meeting the needs of updating the detection model in the network slice environment.

[0108] The strong classifier, i.e., the detection model, formed by a plurality of weak classifiers based on the decision tree through importance weight weighting can be an XGBoost model. The XGBoost model has the advantages of high performance, regularization, feature importance evaluation, etc., and has excellent detection effect and detection time performance, meeting the needs of detecting LDoS attacks in the network slice environment.

[0109] It needs to be emphasized that although based on the XGBoost model, the application further optimizes the XGBoost algorithm, and since the data set is very unbalanced in the LDoS attack scene, specifically, the proportion of normal traffic is much larger than that of abnormal traffic. Based on this feature, when training the XGBoost model, the sample weight value of the sample data is adjusted according to the classification result of the weak classifier, so that the sample data judged as abnormal traffic has a higher sample weight value, and more attention is paid to the sample data suspected of abnormal traffic in the training process, which is adapted to the characteristics of the data set in the LDoS attack scene, and is beneficial to improve the performance of the XGBoost model in the LDoS attack detection application scene.

[0110] In some embodiments of the application, the detection model can also be obtained by using clustering algorithms, AdaBoost algorithms and the like.

[0111] In some embodiments of the network slice environment LDoS detection method of the application, the S500 comprises:

[0112] When the first detection result and the second detection result both indicate that an attack is suffered, the LDoS attack is regarded as the attack recognition result.

[0113] When the first detection result and the second detection result both indicate that an attack is suffered, the LDoS attack is regarded as the attack recognition result.

[0114] In some embodiments of the application, for the purpose of further improving security, when one of the first detection result and the second detection result indicates that an attack is suffered, the LDoS attack is regarded.

[0115] Reference Figure 6 The network slice environment LDoS detection method provided by the application can effectively detect the LDoS attack in real time to a certain extent, which can illustrate that the network slice environment LDoS detection method provided by the application can effectively detect the LDoS attack in real time.

[0116] The network slice environment LDoS detection method provided by the application detects the traffic data and link state information obtained from the honeypot network slice, and reference Figure 7 , the simulation sets the honeypot network slice and the case without the honeypot network slice, it can be seen that setting the honeypot network slice and obtaining information from the honeypot network slice to detect the LDoS attack can effectively improve the reliability of attack detection.

[0117] Figure 8 An example of a schematic diagram of a physical structure of an electronic device is shown in Figure 8 As shown, the electronic device can include a processor 810, a communications interface 820, a memory 830, and a communications bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communications bus 840. The processor 810 can invoke the logical instructions in the memory 830 to execute the network slice environment LDoS detection method described above.

[0118] The electronic device can be a controller in a software-defined network (SDN) environment, which executes the network slice environment LDoS detection method described above. The controller can obtain traffic data and link state data from a honeypot network slice for detection. Since the honeypot network slice is a logical network specifically designed to attract network attacks, normal traffic usually accesses the honeypot network slice less frequently, which is beneficial for distinguishing between normal traffic and malicious traffic in the network slice environment and improving the accuracy of attack detection. The detection model processes the traffic data, and multiple weak classifiers weight the detection results of the traffic data to obtain a first detection result, which detects whether an attack is received from the perspective of traffic data features. At the same time, the throughput sequence is processed to obtain a second detection result from the perspective of abnormal changes in the link according to the changes in the throughput. The first detection result and the second detection result are combined to obtain an attack recognition result, which is beneficial for improving the accuracy of LDoS attack detection and recognition, improving the detection effect, and achieving the purpose of effectively identifying LDoS attacks.

[0119] The execution process of the network slice environment LDoS detection method is deployed on the controller in the software-defined network environment, which is beneficial for making the entire detection process more integrated and efficient, and easy to implement and maintain in different network slices.

[0120] Reference Figure 9 is a schematic diagram of the overall architecture of the present application, wherein the control layer can correspond to the controller in the SDN environment, the link feature capture function can obtain link state information from the honeypot network slice, the controller interface is used to interface with the data layer, the packet feature function can obtain traffic data from the honeypot network slice, the positioning function is used to locate the attacked device according to the attack recognition result, the mitigation function is used to mitigate network congestion according to the attack recognition result, and the iteration function is used to iteratively update the detection model.

[0121] In addition, the logic instructions in the memory 830 described above can be implemented in the form of software functional units and sold or used as independent products, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0122] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the LDoS detection method in a network slice environment provided by the above-mentioned methods.

[0123] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the LDoS detection method in a network slice environment provided by the above-mentioned methods.

[0124] The device embodiments described above are only schematic, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0125] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the technical solutions described above essentially or the parts that contribute to the prior art can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments.

[0126] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features therein can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting LDoS in a network slicing environment, characterized in that, The method comprises: obtaining traffic data and link state information from a honeypot network slice; inputting the traffic data into a detection model to obtain a first detection result, the detection model being configured to process the traffic data through multiple weak classifiers and to obtain the first detection result by weighting the processing result; obtaining a throughput sequence according to the link state information; identifying a change in throughput according to the throughput sequence to obtain a second detection result; obtaining an attack identification result according to the first detection result and the second detection result; wherein the honeypot network slice is a logical network for attracting network attacks to obtain attack traffic; obtaining attack data from the honeypot network slice as sample data; training a preset original model according to the sample data, and taking the trained model as a new detection model; the method of identifying a change in throughput according to the throughput sequence to obtain a second detection result comprises: initializing a counter and setting the count value of the counter to zero; selecting a throughput value from the throughput sequence as a current element; calculating the average value and variance value of the throughput values in a preset window centered on the current element; determining whether the current element is less than the product of the previous throughput value and a preset coefficient, or whether the average value is less than a first preset threshold and the variance value is greater than a second preset threshold; if yes, increasing the count value of the counter by one, and if no, setting the count value of the counter to zero; when the count value of the counter is greater than a third preset threshold, identifying an attack as the second detection result; the method of obtaining an attack identification result according to the first detection result and the second detection result comprises: when the first detection result and the second detection result both represent an attack, identifying an LDoS attack as the attack identification result. 2.The LDoS detection method in a network slice environment according to claim 1, characterized in that, the method of training a preset original model according to the sample data and taking the trained model as a new detection model comprises: obtaining a classifier number value; setting a corresponding sample weight value for the sample data; training an original model according to the sample data and the corresponding sample weight value to obtain a weak classifier; obtaining the classification result and error rate of the weak classifier according to the weak classifier and the sample data; calculating the importance weight corresponding to the weak classifier according to the error rate; updating the sample weight value according to the classification result to obtain a new weak classifier until the number of weak classifiers reaches the classifier number value; combining the weak classifiers according to the corresponding importance weights to obtain a strong classifier and taking the strong classifier as a new detection model. 3.The LDoS detection method in a network slice environment according to claim 2, characterized in that, The sample data comprises multiple features, and the method of training an original model according to the sample data and the corresponding sample weight value to obtain a weak classifier comprises: sorting the features in the sample data according to importance, and training the original model with a preset number of features in turn to obtain a trained original model as a weak classifier. 4.The LDoS detection method in a network slice environment according to claim 2, characterized in that, The original model is a decision tree, and the detection model is an XGBoost model.

5. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the network slice environment LDoS detection method of any one of claims 1-4 when executing the program. 6.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the network slice environment LDoS detection method of any one of claims 1-4.

7. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the network slice environment LDoS detection method of any one of claims 1-4. The computer program is executed by the processor to implement the network slice environment LDoS detection method of any one of claims 1-4.

Images