Iot botnet ddos attack defense method, device and storage medium

Abstract

The application provides a kind of Internet of Things botnet DDoS attack defense method, device and storage medium, it is related to Internet of Things technical field, by the conversion relationship between sleeping device, normal device, latent device and attack device is constructed botnet DDoS attack attack-defense differential game model;Calculate attacker legal packet loss income, defender legal packet loss loss and attack cost and defense cost;According to the attacker legal packet loss income, defender legal packet loss loss and attack cost and defense cost, build instantaneous payment function;Solve the equilibrium solution of attack-defense zero-sum differential game model, obtain optimal saddle point strategy, analyze DDoS attack in Internet of Things botnet from the overall and dynamic point of view, to control the traffic that can be within the scope of victim processing to reach victim, while reducing the security loss of Internet of Things attack-defense system to a lower level.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and particularly relates to a method, device and storage medium for defending against DDoS attack of Internet of Things botnet. BACKGROUND

[0002] The operation mechanism of the Distributed Denial of Service (DDoS) attack of the Internet of Things botnet can be divided into two closely related stages: the botnet formation stage and the DDoS attack stage. In the first stage, the attacker mainly finds vulnerable Internet of Things devices by scanning the network, and then invades and controls these devices by opening the port or relying on the potential username and password to forcibly derive the management credentials. The newly recruited infected devices are malware, which has a dual purpose: to spread the infection by implanting malicious code into other Internet of Things devices, and to receive attack commands from the command and control server by parsing the domain name hardcoded in the executable file. It is worth noting that these invaded Internet of Things devices are in an inactive state for a long period of latency, until they are sold on the dark web, or are told to attack the target server (i.e. the victim) in the subsequent stage.

[0003] In the related art, the strategy of abstracting the attacker and the defender is adopted, the cost and the benefit are quantified according to the number of controlled devices or the link flow state, and the benefit functions of the two parties are defined. However, these strategies are based on the static analysis of the DDoS attack in the Internet of Things botnet, and the selected recovery defense strategy is not adjusted to the optimal according to the real-time network state, and the security loss of the Internet of Things attack-defense system is still at a high level. SUMMARY

[0004] The present application provides a method, device and storage medium for defending against DDoS attack of Internet of Things botnet, to solve the defect that the traditional method for defending against DDoS attack of Internet of Things botnet does not achieve real-time and optimal defense effect.

[0005] The present application provides a method for defending against DDoS attack of Internet of Things botnet, comprising:

[0006] constructing a botnet DDoS attack and defense differential game model based on the conversion relationship between the dormant devices, the normal devices, the latent devices and the attack devices;

[0007] calculating the attacker's legal packet loss benefit, the defender's legal packet loss loss, and the attack cost and the defense cost according to the botnet DDoS attack and defense differential game model;

[0008] constructing an instantaneous payment function according to the attacker's legal packet loss benefit, the defender's legal packet loss loss, and the attack cost and the defense cost;

[0009] According to the instantaneous payment function, a differential game model of attack and defense is constructed, and an equilibrium solution of the differential game model of attack and defense is solved to obtain an optimal saddle point strategy.

[0010] According to the application, a method for defending against a DDoS attack of an IoT botnet is provided.

[0011] Variables S(t), N(t), L(t) and A(t) are set to describe the number of devices in a sleeping state, a normal state, a latent state and an attack state at time t;

[0012] A state vector x(t) is defined as x(t) = {S(t), N(t), L(t), A(t)}, The change rates of the variables are represented, and the network size S(t)+N(t)+L(t)+A(t) at time t is a constant;

[0013] The differential equation set reflecting the dynamic change of the security state of the IoT device is:

[0014]

[0015] The parameter p represents the rate of device access to the network per unit time, the infection probability η is the probability that a device in the normal state N is infected by an adjacent device in the attack state A per unit time, the overall infection rate of each device from the normal state to the latent state is ηA(t); the attack strength of the attacker is reflected in the wake-up strength p(t); the parameter γ represents the wake-up success rate, p(t) and γ are both in [0, 1], and the overall state transmission rate of each device from the latent state to the attack state is γp(t); the recovery strength of the defender is q(t), and the corresponding device recovery rate is α, q(t) and α are both in [0, 1], and the overall state transmission rate of each device from the attack state to the sleeping state is αq(t); the recovery rate of the latent state device is β, and β is in [0, 1], and the overall state transmission rate of each device from the latent state to the sleeping state is βq(t);

[0016] The differential equation set reflecting the dynamic change of the security state of the IoT device is converted into a differential game model of attack and defense of an IoT botnet, and the six-tuple , where: P = {Pa, Pd} is the set of players in the differential game, where Pa is the attacker and Pd is the defender; Ω = {p(t), q(t) | p(t), q(t) ∈ [0, 1]} is the strategy space; the strategy p(t) of the attacker represents the intensity of the attacker to invest in waking up the latent device into the attack state; the strategy q(t) of the defender represents the ability of the defender to detect the malicious device and restore it to the dormant state; x(t) = {S(t), N(t), L(t), A(t)} is the device state space at time t; , represents the time derivative of the state variable; t ∈ [0, T] is a continuous variable, representing the time of the attack-defense differential game; , is defined as the payoff function caused by the interaction of attack and defense strategies in the Internet of Things network, where u(t) is the instantaneous payment function of the Internet of Things attack-defense system.

[0017] According to the application, a method for defending against a botnet DDoS attack in an Internet of Things is provided, wherein the attack cost and the defense cost are calculated according to a botnet DDoS attack attack-defense differential game model, and the method comprises the following steps:

[0018] The cost function is determined according to the strategy and the state, and the cost of the attacker and the defender is as follows:

[0019] c A (t) = C A p 2 (t) γ L(t)

[0020] C D (t) = C D q 2 (t) (α A(t) + β L(t))

[0021] Wherein, the cost c A (t) of the attacker to wake up the latent device is related to the wake-up intensity p(t), the number of latent devices L(t), the wake-up success rate γ and the wake-up cost constant C A of each device; the cost c D (t) of the defender to detect and restore the latent device and the attack device is related to the number of latent devices and attack devices L(t) and A(t), the attack state device recovery rate α and the latent state device recovery rate β, and the recovery cost constant C D of each device.

[0022] According to the application, a method for defending against a botnet DDoS attack in an Internet of Things is provided, wherein the legal packet loss income of the attacker and the legal packet loss loss of the defender are calculated according to a botnet DDoS attack attack-defense differential game model, and the method comprises the following steps: acquiring a legal packet loss function according to the botnet DDoS attack attack-defense differential game model;

[0023] According to the legitimate packet loss function, an attacker legitimate packet loss benefit and a defender legitimate packet loss loss are calculated.

[0024] According to the method for defending against the Internet of Things botnet DDoS attack, the legitimate packet loss function is:

[0025]

[0026] wherein, final flow f(t) reaching a victim per second is

[0027] f(t) = σδ1A(t) + δ2(N(t) + L(t))

[0028] σ represents a factor of amplifying DDoS, a number of malicious data packets initiated by each attack Internet of Things device is same and equal to δ1; a number of legitimate data packets initiated by each Internet of Things device in normal N(t) and latent L(t) states is same and equal to δ2, f TH is a maximum data packet processing threshold.

[0029] According to the method for defending against the Internet of Things botnet DDoS attack, the instantaneous payment function is constructed according to the attacker legitimate packet loss benefit, the defender legitimate packet loss loss and attack cost and defense cost, and the instantaneous payment function is:

[0030]

[0031] wherein, Gl(t) is the attacker legitimate packet loss benefit and the defender legitimate packet loss loss, c A (t) is the cost of the attacker waking up the latent device, c D (t) is the cost of the defender detecting and recovering the latent device and the attack device.

[0032] According to the method for defending against the Internet of Things botnet DDoS attack, the attack-defense zero-sum differential game model is constructed according to the instantaneous payment function, the equilibrium solution of the attack-defense zero-sum differential game is solved, and the optimal saddle point strategy is obtained, and the method comprises the following steps:

[0033] According to the instantaneous payment function, the target of the attacker and the target of the defender are obtained, and the attack-defense zero-sum differential game model is constructed based on the target of the attacker and the target of the defender.

[0034] The equilibrium of the differential game model is solved to obtain the saddle point strategy.

[0035] According to the method for defending against the Internet of Things botnet DDoS attack, the equilibrium of the differential game model is solved to obtain the saddle point strategy, and the method comprises the following steps:

[0036] transforming the solution of the differential game model into an optimization Hamilton equation;

[0037] discretizing the Hamilton equation using a Gauss-Seidel type implicit finite difference method to obtain a numerical solution of the optimal attack and defense strategy.

[0038] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the IoT botnet DDoS attack defense method according to any one of the above when executing the program.

[0039] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executable on a processor to implement the IoT botnet DDoS attack defense method according to any one of the above.

[0040] The application provides an IoT botnet DDoS attack defense method, device and storage medium, which constructs a botnet DDoS attack and defense differential game model based on the conversion relationship among the dormant device, the normal device, the latent device and the attack device; calculates the attacker's legal packet loss income, the defender's legal packet loss loss, and the attack cost and the defense cost according to the botnet DDoS attack and defense differential game model; constructs an instantaneous payoff function according to the attacker's legal packet loss income, the defender's legal packet loss loss, and the attack cost and the defense cost; constructs an attack and defense zero-sum differential game model according to the instantaneous payoff function, solves the equilibrium solution of the attack and defense zero-sum differential game model, and obtains the optimal saddle point strategy, which analyzes the DDoS attack in the IoT botnet from the overall and dynamic perspectives, gives an IoT botnet DDoS attack security loss calculation method based on game theory, and solves the corresponding optimal recovery strategy, so that the traffic reaching the victim can be within the processing range of the victim, and the security loss of the IoT attack-defense system is reduced to a lower level. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0042] Figure 1 is a flowchart of the IoT botnet DDoS attack defense method provided by the embodiments of the application;

[0043] Figure 2This is a schematic diagram of an IoT botnet DDoS attack and defense scenario provided by an embodiment of the present invention;

[0044] Figure 3 This is a schematic diagram of the state transition of an Internet of Things device provided by an embodiment of the present invention;

[0045] Figure 4 It is a functional structure diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0047] Figure 1 The flowchart of the method for defending against DDoS attacks on IoT botnets provided by the embodiment of the present invention is as follows: Figure 1 As shown, the IoT botnet DDoS attack defense method provided by the embodiment of the present invention includes:

[0048] Step 101: Construct a botnet DDoS attack and defense differential game model based on the conversion relationships among dormant devices, normal devices, latent devices, and attacking devices.

[0049] Step 102: Calculate the attacker's legitimate packet loss gain, the defender's legitimate packet loss loss, and the attack and defense costs based on the botnet DDoS attack and defense differential game model.

[0050] Step 103: Construct an instantaneous payment function based on the attacker's legitimate packet loss income, the defender's legitimate packet loss loss, the attack cost, and the defense cost.

[0051] Step 104: construct an attack-defense zero-sum differential game model based on the instantaneous payoff function, solve the equilibrium solution of the attack-defense zero-sum differential game model, and obtain the optimal saddle point strategy.

[0052] The operation mechanism of IoT botnet DDoS attack can be divided into two closely related stages: botnet formation stage and DDoS attack stage. In the first stage, the attacker mainly looks for vulnerable IoT devices by scanning the network, and then invades and controls these devices by opening the port or relying on the potential username and password to force the derivation of its management credentials. The newly recruited infected devices are malware, with a dual purpose: to spread the infection by implanting malicious code into other IoT devices, and to receive attack commands from the command and control server by parsing the domain name hardcoded in the executable file. It is worth noting that these invaded IoT devices are in an inactive state for a long period of time, until they are sold on the dark web, or told to attack the target server (i.e. victim) in the subsequent stage. During the propagation of the botnet virus, the rational intelligent attacker will carefully select the victim, estimate its maximum packet processing threshold, which reflects the response capacity through P2P communication, and conduct a cost-benefit analysis before launching a DoS / DDoS attack. Finally, a large number of potential infected IoT devices are told to send malicious traffic to the victim. When the traffic arriving at the victim does not exceed the maximum packet processing threshold, i.e. the victim normal service, the attacker has nothing to gain. Otherwise, it will cause business delay or interruption, causing significant losses. This phenomenon is called threshold effect, which is one of the significant features of DDoS attack.

[0053] The traditional IoT botnet DDoS attack defense method adopts the strategy of abstracting the attacker and the defender, quantifies the cost and benefit according to the number of controlled devices or the link flow state, and defines the benefit function of both parties. But these strategies are based on the static analysis of DDoS attack in IoT botnet, and the selected recovery defense strategy is not adjusted to the optimal according to the real-time network state, and the security loss of IoT attack-defense system is still at a high level.

[0054] The method for defending against the DDoS attack of the IoT botnet provided by the embodiment of the present application constructs a defense-diff game model of the DDoS attack of the botnet based on the conversion relationship among the sleeping device, the normal device, the latent device and the attack device; calculates the legal packet loss income of the attacker, the legal packet loss loss of the defender and the attack cost and the defense cost according to the defense-diff game model of the DDoS attack of the botnet; constructs an instantaneous payment function according to the legal packet loss income of the attacker, the legal packet loss loss of the defender and the attack cost and the defense cost; constructs a defense-diff game model of zero sum according to the instantaneous payment function, solves the equilibrium solution of the defense-diff game model of zero sum, acquires the optimal saddle point strategy, analyzes the DDoS attack in the IoT botnet from the overall and dynamic angles, gives a security loss calculation method of the DDoS attack of the IoT botnet based on the game theory, and solves the corresponding optimal recovery strategy, so that the traffic reaching the victim can be within the processing range of the victim, and the security loss of the attack-defense system of the IoT is reduced to a low level.

[0055] Based on any of the above embodiments, the IoT network and the devices therein are vulnerable to botnet attacks. IoT devices are easily infected and controlled by attackers (i.e., botmasters) and become botnet members (i.e., bots). After a certain period of accumulation of bots, the botmaster will wake up the bots to launch a DDoS attack and send malicious traffic to the victim. Unwoken bots and unattacked devices usually communicate with the victim and send legitimate traffic. The IoT botnet DDoS attack-defense scenario is shown in Figure 2 .

[0056] At the same time, the defender starts to detect and identify the bots, eliminates the infection by upgrading the firmware or installing patches, and restores the bots to normal devices waiting to rejoin the network. The strategic interaction of the attack and defense and the interests of both sides drive the continuous adjustment of the strategies of both sides, resulting in the dynamic security state of the IoT devices.

[0057] The embodiment of the present application is inspired by the existing epidemiology susceptible-exposed-infected-recovered (SEIR) model, and designs a sleeping-normal-latent-attack (SNLA) model to describe the dynamic security state of the IoT devices in Figure 2 The SNLA model includes:

[0058] (1) S refers to the sleeping device. The IoT device in the sleeping state indicates that it is not infected or is in the state of recovering from infection and waiting to rejoin the network.

[0059] (2) N refers to the normal device. The IoT device in the normal state is vulnerable to infection. It normally communicates with the victim and other devices in the IoT network and is vulnerable to infection.

[0060] (3) L refers to the latent device. The Internet of Things device in the latent state will be in an inactive state after being infected by malicious software such as the Mirai virus. It communicates normally with the victim, but can be awakened at any time by the attacker and prepare for attack.

[0061] (4) A refers to the attack device. The Internet of Things device is attacking the victim, indicating that it is under control, sending malicious traffic to the victim and spreading the infection to normal devices to provide income for the attacker.

[0062] The formation of a botnet is a dynamic and continuous process. Due to the spread of botnet viruses and attack-defense interactions, the number of devices in different security states is constantly changing.

[0063] The botnet DDoS attack and defense differential game model is constructed based on the conversion relationship between the dormant device, the normal device, the latent device and the attack device, comprising:

[0064] Variables S(t), N(t), L(t) and A(t) are set to describe the number of devices in the dormant, normal, latent and attack states at time t;

[0065] The state vector x(t) = {S(t), N(t), L(t), A(t)} is defined, The rate of change of each variable, the network size S(t) + N(t) + L(t) + A(t) at time t is a constant;

[0066] The differential equation set reflecting the dynamic changes of the security state of the Internet of Things device is:

[0067]

[0068] Where parameter p represents the rate of device access to the network per unit time, infection probability η is the probability of infection of a device in normal state N by an adjacent device in attack state A per unit time, the overall infection rate of each device from normal state to latent state is ηA(t); the attack strength of the attacker is reflected in the wake-up strength p(t); parameter γ represents the wake-up success rate, both p(t) and γ are in [0, 1], and the overall state transmission rate of each device from latent state to attack state is γp(t); the recovery strength of the defender is q(t), and the corresponding device recovery rate is α, both q(t) and α are in [0, 1], and the overall state transmission rate of each device from attack state to dormant state is αq(t); the recovery rate of the latent state device is β, and β is in [0, 1], and the overall state transmission rate of each device from latent state to dormant state is βq(t);

[0069] The differential equation set reflecting the dynamic change of the security state of the reflection Internet of Things device is converted into an Internet of Things botnet DDoS attack and defense differential game model, which is represented by a six-tuple , where: P = {Pa, Pd} is a player set of the differential game, where Pa is the attacker and Pd is the defender; Ω = {p(t), q(t) | p(t), q(t) ∈ [0, 1]} is a strategy space; the strategy p(t) of the attacker represents the intensity of the attacker in waking up the latent device into an attack state; the strategy q(t) of the defender represents the ability of the defender in detecting the malicious device and restoring it to a dormant state; x(t) = {S(t), N(t), L(t), A(t)} is a device state space at time t; , where: represents the time derivative of the state variable; t ∈ [0, T] is a continuous variable, representing the moment of the attack and defense differential game; , where: u(t) is an instantaneous payment function of the Internet of Things attack and defense system.

[0070] As shown in Figure 3 , when the Internet of Things device is subjected to a botnet DDoS attack, the state of the Internet of Things device is time-varying and changes between the above four states.

[0071] (1) S→N: The dormant device joins the network. The parameter p represents the rate of device access to the network per unit time.

[0072] (2) N→L: The normal device is infected and enters a latent state, waiting for the attacker to wake up. The infection probability η is the probability that a device in the normal state (N) is infected by a neighboring device in the attack state (A) per unit time. Therefore, the overall infection rate of each device from the normal state to the latent state is ηA(t).

[0073] (3) L→A: The latent device is woken up by the attacker and starts attacking by sending malicious traffic to the victim.

[0074] The attack intensity of the attacker is reflected in the wake-up intensity p(t); the parameter γ represents the wake-up success rate, and both p(t) and γ are within [0, 1]. Therefore, the overall state transmission rate of each device from the latent state to the attack state is γp(t).

[0075] (4) A→S: The defender mitigates the infection by restarting or firmware upgrade and restores the Internet of Things device from the attack state (A) to the dormant state (S) waiting to join the network. The recovery strength of the defender is q(t), and the corresponding device recovery rate is α, both q(t) and α are within [0, 1]. Therefore, the overall state transmission rate of each device from the attack state to the dormant state is αq(t).

[0076] (5) L→S: The defender detects the attacker-controlled device in the latent state (L) and then applies the security policy and restores it to the dormant state (S). The recovery rate of the latent device is β, and β is in [0, 1]. It is worth noting that due to the difficulty of detecting the latent device, the successful recovery rate of the latent device is much lower than that of the attack device. Therefore, α-β, the overall state transmission rate of each device from the latent state to the dormant state is βq(t).

[0077] Therefore, the SNLA model proposed by the embodiment of the present application is different from the classic SEIR model in three aspects: (1) considering the case that the latent device continuously joins the network and enters the dormant state; (2) the transition from state I to state R is not in this model, because considering the emergence of new vulnerabilities and the continuous variation of viruses, permanent immunity of the device is unrealistic; (3) the conversion from the attack state (A) to the dormant state (S) is added to describe that the malicious device has cleared the infection and waits to join the Internet of Things network.

[0078] The Internet of Things botnet DDoS attack usually first experiences a botnet formation stage. Then, the rational attacker chooses a favorable opportunity to wake up the latent device to launch a DDoS attack, which is the DDoS attack stage. The awakening intensity p(t) and the recovery intensity q(t) are the strategies of attack and defense. When the two parties interact strategically, the profit-oriented attacker constantly changes the number of robots invested by adjusting p(t). At the same time, the defender changes q(t) to reduce the loss caused by the attack, and artificially intervenes in the formation of the botnet.

[0079] In order to better simulate the real-time dynamics and continuous characteristics of the actual botnet DDoS attack scene, two-person differential game is adopted to analyze the continuous attack and defense interaction from the overall and dynamic perspective. In addition, the optimal recovery strategy can also be obtained by solving the equilibrium solution to guide the deployment of effective defense policy.

[0080] Specifically, the Internet of Things botnet DDoS attack and defense differential game model can be expressed as a six-tuple Wherein

[0081] (1) P = {Pa, Pd} is the player set of the differential game, wherein Pa is the attack side and Pd is the defense side.

[0082] (2) Ω = {p(t), q(t) | p(t), q(t) ∈ [0, 1]} is the strategy space. The strategy p(t) of the attacker represents the intensity of the attacker's investment to wake up the latent device into the attack state. The strategy q(t) of the defender represents the ability of the defender to detect malicious devices (i.e., devices in the attack or latent state) and restore them to the dormant state.

[0083] (3) x(t) = {S(t), N(t), L(t), A(t)} is the device state space at time t.

[0084] (4) denotes the time derivative of the state variable. The security state evolution of the Internet of Things network is described by the above differential equation set.

[0085] (5) t ∈ [0, T] is a continuous variable, representing the moment of attack-defense differential game.

[0086] (6) defined as the profit function caused by the interaction of attack and defense strategies in the Internet of Things network, where u(t) is the instantaneous payment function of the Internet of Things attack and defense system.

[0087] Based on any of the above embodiments, the attack cost and defense cost are calculated according to the zombie network DDoS attack and defense differential game model, comprising:

[0088] The cost function is determined according to the strategy and state, and the cost of the attacker and the defender is:

[0089] c A (t) = C A p 2 (t) γ L(t)

[0090] C D (t) = C D q 2 (t) (a A(t) + β L(t)

[0091] Where, the cost of the attacker to wake up the latent device c A (t) is related to the wake-up intensity p(t), the number of latent devices L(t), the wake-up success rate γ, and the wake-up cost constant C A of each device; the cost of the defender to detect and recover latent devices and attack devices c D (t) is related to the number of latent devices and attack devices L(t) and A(t), the attack state device recovery rate α and the latent state device recovery rate β, and the recovery cost constant C D of each device.

[0092] Based on any of the above embodiments, the legal packet loss profit of the attacker and the legal packet loss loss of the defender are calculated according to the zombie network DDoS attack and defense differential game model, comprising:

[0093] According to the zombie network DDoS attack and defense differential game model, the legal packet loss function is obtained;

[0094] According to the legal packet loss function, the legal packet loss profit of the attacker and the legal packet loss loss of the defender are calculated.

[0095] In the embodiments of the present application, the traffic reaching the victim includes malicious traffic sent by devices in the attack state (A) and possibly amplified by reflection servers to implement a distributed reflection denial of service attack, and legitimate traffic sent by devices in the normal (N) and latent (L) states.

[0096] Threshold effect is a significant feature of DDoS attacks, and the embodiments of the present application use traffic levels to represent a quantitative method of system packet loss. When the total number of packets received by the victim f(t) exceeds the maximum packet processing threshold, the packet buffer overflows and the victim randomly discards packets. If the discarded packets contain legitimate data, the attacker will benefit. When the total number of packets received by the victim f(t) does not exceed the maximum packet processing threshold, the packets are normally sent, and legitimate users can fully obtain the packets, while the defender obtains the benefits. The legitimate packet loss function is:

[0097]

[0098] where the final traffic reaching the victim per second f(t) is

[0099] f(t) = σδ1A(t) + δ2(N(t) + L(t))

[0100] σ represents the amplification factor of DDoS, the number of malicious packets initiated by each attacking IoT device is the same and equal to δ1; the number of legitimate packets initiated by each IoT device in the normal N(t) and latent L(t) states is the same and equal to δ2, f TH is the maximum packet processing threshold.

[0101] Legitimate packet loss, reduced attack cost, and increased defense cost are beneficial to the attacker and not beneficial to the defender. Therefore, the security loss of the IoT botnet DDoS attack defense system consists of three parts: the attacker's legitimate packet loss revenue, attack cost, and defense cost.

[0102] Payment function of IoT attack and defense system Limited by the differential equation set of the security state of the IoT device.

[0103] Based on any of the above embodiments, the instantaneous payment function is constructed according to the attacker's legitimate packet loss revenue, the defender's legitimate packet loss loss, and the attack cost and defense cost:

[0104]

[0105] where Gl(t) is the attacker's legitimate packet loss revenue and the defender's legitimate packet loss loss, c A (t) is the cost of the attacker waking up the latent device, cD (t) is the cost of defender to detect and recover the latent attack devices and attack devices.

[0106] According to any of the above embodiments, the method further comprises:

[0107] According to the instantaneous payoff function, the target of the attacker and the target of the defender are obtained, and the attack-defense zero-sum differential game model is constructed based on the target of the attacker and the target of the defender.

[0108] The saddle point strategy is obtained by solving the equilibrium of the differential game model.

[0109] In the embodiments of the present application, the target of the attacker is to maximize the revenue function U(t) of the Internet of Things attack-defense system, and the target of the defender is to minimize U(t).

[0110]

[0111] The problems (P1) and (P2) constitute an attack-defense zero-sum differential game. By solving the equilibrium of the differential game, the optimal strategy of both parties can be obtained. That is, the equilibrium solution (p (t), q (t)) is also called the saddle point strategy, which satisfies

[0112] U(p * (t),q * (t))≥U(p(t),q * (t)),

[0113] U(p * (t),q * (t))≤U(p * (t),q(t)).

[0114] The optimization of the problems (P1) and (P2) can be transformed into the optimization of Hamilton equation. By introducing the adjoint state vector λ(t)={λ S (t)、λ N (t)、λ L (t)、λ A (t)} and the state vector x(t), the instantaneous payoff function and the network security state evolution are integrated.

[0115] According to the present application, a method for defending against Internet of Things botnet DDoS attacks is provided, and the saddle point strategy is obtained by solving the equilibrium of the differential game model, which comprises:

[0116] The equilibrium of the differential game model is transformed into the optimization of Hamilton equation.

[0117]

[0118] Therefore, the attack strategy p(t) can be solved by The result is

[0119]

[0120] Since p(t)∈[0,1], the optimal attack strategy is

[0121]

[0122] Similarly, the defense strategy q(t) can be solved by The result is

[0123]

[0124] Since q(t)∈[0,1], the optimal defense mitigation strategy is

[0125]

[0126] The optimal strategy of the participant depends closely on the accompanying state vector λ and the state vector x. In addition, the state vector x can be obtained by solving the state differential equation, and the accompanying state vector λ(t) is The solution.

[0127] The Hamiltonian equations are discretized using a Gauss-Seidel-like implicit finite difference method to obtain numerical solutions for the optimal attack and defense strategies.

[0128] The time interval [0, T] is discretized into n subintervals, each time step is μ. Then, k represents the kth time interval, i.e., k <n且k为自然数。

[0129] (1) Discrete form of the state vector: When the time step μ is small enough, the time derivative of the state vector x(t) can be approximated by its first-order forward difference

[0130]

[0131] Under the known boundary conditions x(0) = {S(0), N(0), L(0), A(0)}, the discrete state vector x(k+1) can be obtained iteratively as:

[0132]

[0133] (2) Discrete form of adjoint state vector: The discrete state vector x(k+1) can be used to solve the discrete adjoint vector λ(nk-1). Similarly, due to the transversality condition λ(T) = 0, when the time step μ is small enough, the time derivative of the adjoint vector λ(T) can be approximated by its first-order reverse difference, that is:

[0134]

[0135] f(t) < f TH (23) can be solved iteratively:

[0136]

[0137] f(t) < f TH (25) can be solved iteratively:

[0138]

[0139] (3) Discrete form of optimal attack and defense strategies: By discretizing the adjoint state vector λ and the state vector x, the discrete form of the attack strategy p(k+1) and the defense strategy q(k+1) can be obtained as

[0140]

[0141] Since the attack and defense strategies are both [0,1], the optimal defense mitigation strategy and the optimal attack wake-up strategy are:

[0142]

[0143] The method for defending against DDoS attacks of the Internet of Things zombie network provided by the embodiment of the application combines a differential game model and an epidemic model to jointly analyze DDoS attacks in the Internet of Things zombie network from the overall and dynamic perspectives; the incubation period of the controlled device and the threshold effect of the DDoS attack are considered, a method for calculating the security loss of the DDoS attack of the Internet of Things zombie network based on game theory is given, and the corresponding optimal recovery strategy is obtained by optimizing the income; the recovery defense strategy in the embodiment of the application aims to minimize the loss and cost, fully considers the intelligent strategy of the attacker, utilizes the maximum processing capacity of the victim, and through the timely feedback of the flow level payment function of the attack-defense system, guides the defense against DDoS attacks of the Internet of Things zombie network.

[0144] Figure 4 An example of an entity structure diagram of an electronic device is shown in FIG. 1. Figure 4As shown, the server can include: a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 complete mutual communication through the communications bus 440. The memory 430 includes a computer program, an operating system, and acquired graph structure data, and the processor 410 can call the logic instructions in the memory 430 to execute the Internet of Things botnet DDoS attack defense method, which includes: constructing a botnet DDoS attack defense differential game model based on the conversion relationship between the dormant device, the normal device, the latent device, and the attack device; calculating the attacker legal packet loss income, the defender legal packet loss loss, and the attack cost and the defense cost according to the botnet DDoS attack defense differential game model; constructing an instantaneous payment function according to the attacker legal packet loss income, the defender legal packet loss loss, and the attack cost and the defense cost; constructing an attack-defense zero-sum differential game model according to the instantaneous payment function, solving the equilibrium solution of the attack-defense zero-sum differential game model, and acquiring the optimal saddle point strategy.

[0145] In addition, the logic instructions in the memory 430 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the related art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0146] In another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the Internet of Things botnet DDoS attack defense method provided by the above method, and the method comprises: constructing a botnet DDoS attack defense differential game model based on the conversion relationship between the dormant device, the normal device, the latent device and the attack device; calculating the attacker's legal packet loss income, the defender's legal packet loss loss, and the attack cost and the defense cost according to the botnet DDoS attack defense differential game model; constructing an instantaneous payoff function according to the attacker's legal packet loss income, the defender's legal packet loss loss, and the attack cost and the defense cost; constructing an attack-defense zero-sum differential game model according to the instantaneous payoff function, solving the equilibrium solution of the attack-defense zero-sum differential game model, and obtaining the optimal saddle point strategy.

[0147] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0148] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus the necessary general hardware platform, and of course, can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0149] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for defending against DDoS attacks by an IoT botnet, characterized in that: include: Based on the conversion relationship between dormant devices, normal devices, latent devices, and attacking devices, a differential game model for attack and defense against botnet DDoS attacks is constructed. Specifically, the model includes: Set the variables S(t), N(t), L(t), and A(t) to describe the number of devices in the sleeping, normal, latent, and attack states at time t; Define the state vector x(t) = {S(t), N(t), L(t), A(t)}, Represents the rate of change of each variable, and the network size S(t) + N(t) + L(t) + A(t) at time t is a constant; The differential equations that reflect the dynamic changes in the security status of IoT devices are: ； The parameter ρ represents the rate at which devices access the network per unit time, the infection probability η is the probability per unit time that a device in the normal state N is infected by a neighboring device in the attack state A, and the overall infection rate of each device from the normal state to the latent state is ηA(t). The attacker's attack strength is reflected in the wake-up strength p(t). The parameter γ represents the wake-up success rate, with both p(t) and γ in the range [0, 1]. The overall state transfer rate of each device from the latent state to the attack state is γp(t). The defender's recovery strength is q(t), and the corresponding device recovery rate is α, with both q(t) and α in the range [0, 1]. The overall state transfer rate of each device from the attack state to the dormant state is αq(t). The latent state device recovery rate is β, with β in the range [0, 1]. The overall state transfer rate of each device from the latent state to the dormant state is βq(t). The differential equations reflecting the dynamic changes of the security status of IoT devices are converted into a differential game model of IoT botnet DDoS attack and defense, using the six-tuple Denote, where: P = {Pa, Pd} is the set of players in the differential game, where the attacker is Pa and the defender is Pd; Ω = {p(t), q(t)|p(t), q(t) ∈ [0, 1]} is the strategy space; t ∈ [0, T] is a continuous variable, representing the time of the differential game between attacker and defender; It is defined as the payoff function caused by the interaction of attack and defense strategies in the IoT network, where u(t) is the instantaneous payment function of the IoT attack and defense system; Calculate the attacker's legitimate packet loss gain, the defender's legitimate packet loss loss, and the attack and defense costs based on the botnet DDoS attack and defense differential game model; Constructing an instantaneous payment function based on the attacker's legitimate packet loss income, the defender's legitimate packet loss loss, the attack cost, and the defense cost; An attack-defense zero-sum differential game model is constructed according to the instantaneous payoff function, an equilibrium solution of the attack-defense zero-sum differential game model is solved, and an optimal saddle point strategy is obtained.

2. The IoT botnet DDoS attack defense method according to claim 1, characterized in that: The calculating of attack cost and defense cost according to the botnet DDoS attack and defense differential game model includes: The cost function is determined based on the strategy and state, and the costs for the attacker and defender are: ； in, A constant for the wakeup cost of each device, A constant cost for each device's recovery.

3. The method for defending against DDoS attacks of IoT botnets according to claim 1, wherein: The calculating of the attacker's legitimate packet loss gain and the defender's legitimate packet loss loss based on the botnet DDoS attack and defense differential game model includes: Obtaining a legitimate packet loss function based on the botnet DDoS attack and defense differential game model; The legitimate packet loss gain of the attacker and the legitimate packet loss loss of the defender are calculated according to the legitimate packet loss function.

4. The method for defending against DDoS attacks of IoT botnets according to claim 3, wherein: The legal packet loss function is: ； Among them, the final flow f(t) reaching the victim per second is ； σ represents the factor that amplifies DDoS. The number of malicious packets launched by each attacking IoT device is the same, which is equal to δ1. and lurking The number of legal data packets initiated in the state is the same and equal to δ2, The maximum packet processing threshold.

5. The method for defending against DDoS attacks of IoT botnets according to claim 4, wherein: The instantaneous payment function constructed according to the attacker's legitimate packet loss income, the defender's legitimate packet loss loss, the attack cost, and the defense cost is: ； in is the attacker's legitimate packet loss gain and the defender's legitimate packet loss loss, The cost of waking up a dormant device for an attacker, The cost to defenders of detecting and recovering both lurking and attacking devices.

6. The IoT botnet DDoS attack defense method according to claim 1, characterized in that: The method of constructing an attack-defense zero-sum differential game model based on the instantaneous payment function, solving the equilibrium solution of the attack-defense zero-sum differential game, and obtaining the optimal saddle point strategy includes: Obtaining the attacker's goal and the defender's goal according to the instantaneous payment function, and constructing an attack-defense zero-sum differential game model based on the attacker's goal and the defender's goal; By solving the equilibrium of the differential game model, the saddle point strategy is obtained.

7. The method for defending against DDoS attacks of IoT botnets according to claim 6, characterized in that: The method of obtaining the saddle point strategy by solving the equilibrium of the differential game model includes: Converting the equilibrium of the differential game model to an optimized Hamiltonian equation; The Hamiltonian equations are discretized using a Gauss-Seidel-like implicit finite difference method to obtain numerical solutions for the optimal attack and defense strategies.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for defending against DDoS attacks on an Internet of Things botnet as described in any one of claims 1 to 6 is implemented.

9. A non-transitory readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for defending against DDoS attacks on an Internet of Things botnet as claimed in any one of claims 1 to 6 is implemented.

Images