A detection method for collusion interest flooding attacks in named data networks

Abstract

The present invention discloses a method for detecting collusion interest flooding attack in named data network. The method extracts multi-dimensional network traffic features of all routers in an NDN network at the same time as the input of an RBF neural network model, uses a Gaussian function as the radial basis function of a hidden layer of the RBF neural network model to input all input samples in a training set into the RBF neural network model, uses a K-means algorithm to select h input samples from all input samples in the training set as clustering centers of the K-means algorithm, and determines the center of the radial basis function of the RBF neural network model according to the clustering centers; the present invention uses the RBF neural network algorithm to identify the differences between multi-dimensional network traffic features in different network states and classify them, thereby judging the state of the NDN network at each moment, and can more accurately distinguish normal network behavior from collusion interest flooding attack, so as to detect collusion interest flooding attack.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for detecting collusion interest flooding attacks in named data networks, which is suitable for detecting collusion interest flooding attacks. Background Art

[0002] With the continuous development of the Internet, more and more users are beginning to pay attention to the content itself, rather than focusing on the location or server where the content is stored. Therefore, a new network architecture optimized for content retrieval, Information-Centric Networking (ICN), has emerged. ICN overturns the original host-centric network architecture and adopts a protocol stack structure with information names as the core. ICN is a network paradigm based on data objects. Naming data objects is a key concept in ICN, which can identify data objects independently of their location. Therefore, ICN names each data object in the network instead of using IP addresses to name hosts and nodes.

[0003] Named Data Networking (NDN) is one of the most popular ICN instances today and a promising architecture for the future Internet. NDN is a network architecture characterized by "security by design" that takes named content as the primary element and verifies the binding between name and content. This structure enables it to protect itself from many types of network attacks. NDN uses the name of content data instead of the IP address in the traditional IP architecture to establish a connection. It consists of two types of transmission packets: interest packets and data packets. Interest packets are sent by users and store information about the requested data; data packets are sent by producers or cache routers and store the requested data. Each NDN router has three core components: the pending interest table (PIT), the forwarding information base (FIB), and the content store (CS). The PIT stores the content names of the interest packets that have been recently received but not yet satisfied. Once a matching data packet is returned, its corresponding PIT entry will be deleted. If a matching data packet is not returned for a long time, the PIT entry will expire. The FIB contains information about the delivery paths available for each prefix name and is used to map interest packets to one or more router interfaces. CS temporarily stores received data packets and serves subsequent interest packets requesting the same content. The content-oriented NDN architecture model allows users to focus more on target data rather than data storage location. Therefore, forwarding strategy plays an important role in adaptive and efficient data transmission in NDN. Although NDN solves many problems in IP-based networks, other security and privacy challenges still exist in NDN. Malicious users may exploit this feature of PIT to launch NDN-specific distributed denial of service (DDoS) attacks, called interest flooding attacks (IFA). Generally speaking, IFAs can be divided into three categories according to the type of content requested by malicious users: (1) existing or static; (2) dynamically generated; and (3) non-existent. Most researchers focus on the third type of IFA because it can cause great damage to NDN. However, a special new type of interest flooding attack is proposed, called Collusive Interest Flooding Attack (CIFA), which floods the router's resources by filling the NDN router's PIT with long-term malicious entries.With the help of collusion producers, malicious users can initiate CIFA by requesting the contents of types (1) and (2) as easily as IFA malicious users requesting type (3). CIFA malicious users send a series of different malicious interest packets to request real and different contents, and each malicious interest packet generates a unique PIT entry when passing through a routing node. Then, when the PIT entry is about to expire, the collusion producers generate corresponding collusion data packets with different contents for different malicious interest packets. In the next round of CIFA, the PIT space that has just released the malicious interest packet will be filled with new malicious interest packets again, resulting in intermittent overload of the PIT space and a large number of legitimate interest packets being discarded by malicious routing nodes. Finally, users will not be able to obtain the services of normal producers. With the help of collusion producers, CIFA is more concealed and deceptive than IFA. Most of the existing research schemes target traditional IFA and have good detection and defense effects. However, since the attack principle of CIFA attack is different from that of IFA, the detection scheme of IFA is not suitable for detecting CIFA. Moreover, most of the CIFA detection methods currently proposed have some problems, such as unreasonable feature extraction that makes it difficult to distinguish between normal network traffic and malicious traffic. Summary of the invention

[0004] The purpose of the present invention is to provide a method for detecting collusion interest flooding attacks in named data networks in view of the above-mentioned problems existing in the prior art.

[0005] The above-mentioned purpose of the present invention is achieved by the following technical means:

[0006] A method for detecting a named data network collusion interest flooding attack comprises the following steps:

[0007] Step 1: Build an NDN network and simulate the collusion interest flooding attack environment;

[0008] Step 2: extract the multi-dimensional network traffic features of all NDN routers in the NDN network at set time intervals, use the multi-dimensional network traffic features as input samples, and use all input samples at the same time as a training set or a test set to obtain multiple training sets and test sets, and generate a true class label for each training set and each test set;

[0009] Step 3: Build an RBF neural network model, input each training set and the corresponding true class label into the RBF neural network model in turn, and perform iterative training on the RBF neural network model;

[0010] Step 4: Collect the multi-dimensional network traffic characteristics of all NDN routers in the actual NDN network at the same time as samples to be processed, input the samples to be processed into the trained RBF neural network model, obtain the predicted probability vector y corresponding to the samples to be processed, and convert the predicted probability vector y into an output class label. According to the output class label, the network status of the NDN network at the corresponding time is judged.

[0011] As mentioned above, step 1 includes the following steps:

[0012] Step 1.1: The user sends an interest packet to the upstream NDN router to request the corresponding content. The users include legitimate users and malicious users. The interest packets include legitimate interest packets and malicious interest packets. Legitimate users send legitimate interest packets at a constant rate. The requested existing content follows the Zipf distribution. Malicious users send a small number of interest packets at a rate lower than the rate at which legitimate users send malicious interest packets during the attack period.

[0013] Step 1.2: When a data packet sent by a producer or other NDN router reaches a downstream NDN router, a normal producer generates a corresponding data packet in response to the data content corresponding to the legitimate interest packet; a colluding producer generates a corresponding data packet in response to the data content corresponding to the malicious interest packet.

[0014] As mentioned above, step 2 specifically includes the following steps:

[0015] Step 2.1, set a router number for each NDN router, count the data of all NDN routers once every set time interval, extract the number of InInterests, OutInterests, PIT entries, and interest packet satisfaction of each NDN router within the set time interval as a set of multi-dimensional network traffic features, and record the corresponding router number;

[0016] Step 2.2: Arrange each set of multi-dimensional network traffic features in the following manner to form input samples, and record the router number corresponding to each input sample:

[0017] [Number of InInterests, Number of OutInterests, Number of PIT Entries, Interest Package Satisfaction];

[0018] Step 2.3: Take all input samples at the same time as a training set or a test set to obtain multiple training sets and test sets. Assign a true class label to each training set and each test set according to whether the NDN network is suffering from a collusion interest flooding attack at the corresponding time. The true class label includes normal state 0 and abnormal state 1.

[0019] As mentioned above, step 3 specifically includes the following steps:

[0020] Step 3.1, construct an RBF neural network model, input a training set and the corresponding true class label into the RBF neural network model, use the K-means algorithm to select h input samples from all input samples in the training set as the clustering center of the K-means algorithm, and determine the center of the radial basis function of the RBF neural network model according to the clustering center;

[0021] Step 3.2, calculate the width coefficient σ, the width coefficient σ is calculated based on the following formula:

[0022]

[0023] In the formula, c max is the maximum distance between h cluster centers;

[0024] Step 3.3: Use the least squares method to calculate the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer. ij The initial value of , and then in each round of training, the optimizer will update the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer through the MSE loss function and the back propagation algorithm. ij , which eventually makes the weights from the i-th neuron in the hidden layer to different neurons in the output layer different;

[0025] Step 3.4: According to the center and width coefficient of the radial basis function, and the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer ij Calculate the output probability value y j , all output probability values ​​y j Construct the predicted probability vector y;

[0026] Step 3.5: Input each training set into the RBF neural network model in turn to execute steps 3.1 to 3.4, and iteratively train the RBF neural network model according to the true class labels corresponding to each training set.

[0027] As mentioned above, step 3.1 specifically includes the following steps:

[0028] Step 3.1.1, use Gaussian function as the radial basis function of the hidden layer of the RBF neural network model. The Gaussian function is based on the following formula:

[0029] Gaussian function Based on the following formula:

[0030]

[0031] Where r is the input sample x p To cluster center c iThe Euclidean distance, r, is based on the following formula:

[0032] r=||x p -c i ||i=1,2,...,h;p=1,2,...,m

[0033] In the formula, x p is the input sample in the training set, p is the sequence number of the input sample in the training set, m is the number of input samples in the training set, c i is the cluster center, i is the serial number of the cluster center;

[0034] Step 3.1.2: Initialize the RBF neural network model. First, randomly select h input samples in the training set as the clustering center c of the K-means algorithm. i , and then construct h cluster sets V i , each cluster center c i Corresponding to a cluster set V i , and finally initialize the number of iterations to 0;

[0035] Step 3.1.3: Group all input samples of the training set according to the nearest neighbor rule. First, calculate the input sample x in the training set. p and cluster center c i The Euclidean distance between them, and then the input sample x in the training set p Assign to the nearest cluster center c i The corresponding cluster set V i middle;

[0036] Step 3.1.4: Finally, re-adjust the cluster center c i , first calculate each cluster set V i The average value of all input samples in , and then each cluster set V i The average value of all input samples in is taken as the corresponding cluster set V i The new cluster center c i ,

[0037] If the Euclidean distances between the new cluster centers and the original cluster centers corresponding to all cluster sets are less than or equal to the preset threshold, or the number of iterations exceeds the set maximum value, then each cluster set V i The corresponding new cluster center c i As the centers of the radial basis functions,

[0038] If the Euclidean distance between the new cluster center and the original cluster center corresponding to any cluster set is greater than the preset threshold, and the number of iterations is less than or equal to the set maximum value, then increase the number of iterations by 1, and then return to step 3.1.3 to replace the input sample x in the training set.p Reassign to the new cluster center c that is closest to i The corresponding cluster set V i middle.

[0039] As mentioned above, the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer ij The initial value of is based on the following formula:

[0040]

[0041] Where j is the serial number of the neuron in the output layer, n is the number of neurons in the output layer, and the number of n is the same as the number of class labels.

[0042] Output probability value y as above j Based on the following formula:

[0043]

[0044] In the formula, each output probability value y j The output probability value corresponding to a class label.

[0045] As mentioned above, step 4 specifically includes the following steps:

[0046] Step 4.1, collect the multi-dimensional network traffic characteristics of all NDN routers in the actual NDN network at the same time as the samples to be processed, input the samples to be processed into the trained RBF neural network model to execute steps 3.1 to 3.4, and obtain the prediction probability vector y corresponding to the samples to be processed;

[0047] Step 4.2: The maximum output probability value y in the predicted probability vector y j The corresponding class label is used as the output class label corresponding to the sample to be processed;

[0048] Step 4.3: When the output class label is in the normal state 0, the actual NDN network at the corresponding moment is not subjected to the collusion interest flooding attack; when the output class label is in the abnormal state 1, the actual NDN network at the corresponding moment is subjected to the collusion interest flooding attack.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] The present invention uses the RBF neural network algorithm to identify the characteristics of network traffic, which can more accurately distinguish normal network behavior from network attacks. The RBF neural network algorithm is used to identify the differences between multi-dimensional network traffic characteristics in different network states and classify them, thereby judging the state of the NDN network at each moment to detect collusion interest flooding attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flow chart of the detection method of the present invention;

[0052] Figure 2 A schematic diagram of the collusion interest flooding attack of the present invention;

[0053] Figure 3 This is a schematic diagram of the structure of the NDN network during simulation analysis in Example 1 of the present invention;

[0054] Figure 4 This is a simulation result diagram of the PIT occupancy rate and interest packet satisfaction of the bottleneck router Router1 at the same attack rate in the simulation analysis in Example 1 of the present invention. DETAILED DESCRIPTION

[0055] In order to facilitate those skilled in the art to understand and implement the present invention, the present invention is further described in detail below in conjunction with embodiments. The embodiments described herein are only used to illustrate and explain the present invention and are not intended to limit the present invention.

[0056] Embodiment 1:

[0057] A method for detecting a named data network collusion interest flooding attack comprises the following steps:

[0058] Step 1: Build an NDN network and simulate the collusion interest flooding attack (CIFA) environment, including the following steps:

[0059] Step 1.1: Users (including legitimate and malicious users) send interest packets to the upstream NDN router to request corresponding content. Legitimate users send legitimate interest packets at a constant rate, and the requested content follows the Zipf-Mandelbort distribution. At the same time, with the help of colluding producers, malicious users send a small amount of malicious interest packets at a rate lower than that of legitimate users during the attack period.

[0060] The interest packet is sent by the user, and the interest packet stores information related to the content requested by the user;

[0061] When the interest packet arrives at the NDN router, the NDN router first queries the CS table to see if there is a matching data packet based on the interest packet content. If so, it forwards the matching data packet to respond to the user;

[0062] The CS table temporarily receives and stores data packets sent by producers (including normal producers and colluding producers) or other NDN routers. The data packets in the CS table are used to match the content of the interest packets.

[0063] If there is no data packet matching the content of the Interest packet in the CS table, the NDN router continues to check whether there is a PIT entry matching the content name of the Interest packet in the PIT table. If so, the inbound interface of the Interest packet is added to the corresponding PIT entry in the PIT table and the Interest packet is discarded;

[0064] The PIT table stores the content names and inbound interfaces of received but unmatched Interest packets. The NDN router generates a separate PIT entry in the PIT table for each Interest packet requesting different content. Each PIT entry includes the content name of an Interest packet and multiple inbound interfaces. Once a matching data packet is returned, the corresponding PIT entry in the PIT table will be deleted. If no matching data packet is returned within the set lifetime, the PIT entry will expire. The PIT table will delete the expired PIT entry and discard the Interest packet corresponding to the deleted PIT entry.

[0065] When the space of the PIT table of the downstream routing node is filled with malicious interest packets jointly sent by multiple malicious users, the interest packets sent by legitimate users cannot be satisfied and are discarded.

[0066] If there is no PIT entry in the PIT table that matches the content name of the interest packet, the NDN router continues to check the FIB table. If there is content in the FIB table that matches the content name of the interest packet, a PIT entry is created for the interest packet in the PIT table, and then the interest packet is forwarded to all forwarding interfaces corresponding to the content name in the FIB table. If there is no content in the FIB table, the interest packet is discarded.

[0067] The FIB table stores information related to the available delivery paths for each content name (including the available forwarding interfaces and inbound interfaces for each content name), and is used to map the Interest packets to one or more NDN routers.

[0068] Step 1.2: When the downstream NDN router receives the data packet sent by the producer or other NDN routers, the normal producer generates a corresponding data packet based on the data content corresponding to the legitimate interest packet for reply to the legitimate interest packet sent by the legitimate user; and the colluding producer generates a corresponding data packet based on the data content corresponding to the malicious interest packet for reply to the malicious interest packet sent by the malicious user;

[0069] Data packets are sent by producers or NDN routers, and the data packets store the content requested by users.

[0070] After the downstream NDN router receives the data packet sent by the producer, it first checks the PIT table to see if there is a PIT entry that matches the content name carried by the data packet. If so, it forwards the data packet to all inbound interfaces recorded in the corresponding PIT entry and deletes the corresponding PIT entry.

[0071] If there is no PIT entry matching the content name carried by the data packet, the NDN router decides whether to cache the data packet in the CS table based on the cache replacement strategy. If not, the data packet is discarded.

[0072] Step 2: extract the multi-dimensional network traffic features of all NDN routers in the NDN network at set time intervals, use the multi-dimensional network traffic features as input samples, and use all input samples at the same time as a training set or a test set to obtain multiple training sets and multiple test sets, and generate a true class label for each training set and test set, specifically including the following steps:

[0073] Step 2.1, set a router number for each NDN router, count the data in all NDN routers once every set time interval (such as 10ms), extract the number of InInterests, OutInterests, PIT entries, and Satisfaction Rate of each NDN router within the set time interval as a set of multi-dimensional network traffic features, and record the corresponding router number;

[0074] Among them, the number of InInterests is the total number of data packets received by the NDN router, the number of OutInterests is the total number of interest packets sent by the NDN router, and the Satisfaction Rate is the satisfaction rate of the interest packets (that is, the number of InInterests divided by the number of OutInterests).

[0075] Step 2.2: Arrange each set of multi-dimensional network traffic features in the following manner to form input samples, and record the router number corresponding to each input sample:

[0076] [Number of InInterests, Number of OutInterests, Number of PIT Entries, Interest Package Satisfaction];

[0077] Step 2.3: Take all input samples at the same time as a training set or a test set to obtain multiple training sets and multiple test sets. A true class label is assigned to each training set and each test set according to whether the NDN network is suffering from a collusion interest flooding attack at the corresponding time. The true class label includes a normal state 0 and an abnormal state 1. The normal state 0 indicates that the NDN network is not suffering from a collusion interest flooding attack at the corresponding time, and the abnormal state 1 indicates that the NDN network is suffering from a collusion interest flooding attack at the corresponding time.

[0078] If the NDN network is not suffering from a collusion interest flooding attack at the current moment, the true class label corresponding to the training set or test set obtained at the corresponding moment is 0; if the NDN network is suffering from a collusion interest flooding attack at the current moment, the true class label corresponding to the training set or test set obtained at the corresponding moment is 1.

[0079] The training set is used to train the RBF neural network model, and the test set is used to evaluate the performance of the trained RBF neural network model.

[0080] Step 3: construct an RBF neural network (radial basis function neural network) model, input each training set and the corresponding true class label into the RBF neural network model in turn, and iteratively train the RBF neural network model, specifically including the following steps:

[0081] Step 3.1: Build an RBF neural network model, then input a training set and the corresponding true class label into the RBF neural network model, use the K-means algorithm (k-means clustering algorithm) to select h input samples from all input samples in the training set as the clustering center of the K-means algorithm, and determine the center of the radial basis function of the RBF neural network model based on the clustering center, specifically including the following steps:

[0082] Step 3.1.1: Use Gaussian function as the radial basis function of the hidden layer of the RBF neural network model. Based on the following formula:

[0083]

[0084] Among them, σ is the width coefficient of the RBF neural network model, r is the Euclidean distance from the input sample in the training set to the selected cluster center, and r is based on the following formula:

[0085] r=||x p -c i ||i=1,2,...,h;p=1,2,...,m Formula (2)

[0086] In the formula, x p is the input sample in the training set, p is the sequence number of the input sample in the training set, m is the number of input samples in the training set, c i is the cluster center, i is the serial number of the cluster center, and h is the number of cluster centers.

[0087] Step 3.1.2: Initialize the RBF neural network model, that is, randomly select h input samples in the training set as the clustering center c of the K-means algorithm. i , construct h cluster sets V i , each cluster center ci Corresponding to a cluster set V i , initialize the number of iterations to 0;

[0088] Step 3.1.3: Group all input samples of the training set according to the nearest neighbor rule, that is, first calculate the input sample x in the training set p and cluster center c i The Euclidean distance between the input samples x in the training set p Assign to the nearest cluster center c i The corresponding cluster set V i middle;

[0089] Step 3.1.4: Finally, re-adjust the cluster center c i , that is, calculate each cluster set V i The average value of all input samples in , and each cluster set V i The average value of all input samples in is taken as the corresponding cluster set V i The new cluster center c i ,

[0090] If the Euclidean distances between the new cluster centers and the original cluster centers corresponding to all cluster sets are less than or equal to the preset threshold (such as 0.0001), or the number of iterations exceeds the set maximum value (such as 100), then each cluster set V i The corresponding new cluster center c i as the individual centers of the radial basis functions;

[0091] If the Euclidean distance between the new cluster center and the original cluster center corresponding to any cluster set is greater than the preset threshold, and the number of iterations is less than or equal to the set maximum value, then increase the number of iterations by 1, and then return to step 3.1.3 to replace the input sample x in the training set. p Reassign to the new cluster center c that is closest to i The corresponding cluster set V i middle.

[0092] The number of radial basis function centers is the same as the number of cluster centers.

[0093] Step 3.2, calculate the width coefficient σ, the width coefficient σ is calculated based on the following formula:

[0094]

[0095] Among them, c max There are h cluster centers c i The maximum distance between (i=1,2,...,h);

[0096] Step 3.3: Use the least squares method to calculate the weight ω between the i-th neuron in the hidden layer (i.e., the center of the radial basis function) and the j-th neuron in the output layer. ij The initial value of , and then in each round of training, the optimizer will update the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer through the MSE loss function (mean square error loss function) and the back propagation algorithm ij , which ultimately makes the weights between the i-th neuron in the hidden layer and different neurons in the output layer different, and the weights between the i-th neuron in the hidden layer and the j-th neuron in the output layer ω ij The initial value of is calculated based on the following formula:

[0097]

[0098] Wherein, j is the serial number of the neuron in the output layer, and n is the number of neurons in the output layer. The number of n is the same as the number of types of class labels. In this embodiment, n is 2.

[0099] Step 3.4: According to the center and width coefficient of the radial basis function, and the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer ij Calculate the output probability value y j , all output probability values ​​y j Construct the prediction probability vector y, y = [y1, y2, ..., y n ], output probability value y j Based on the following formula:

[0100]

[0101] Among them, each output probability value y j The output probability value corresponding to a class label. In this embodiment, n is 2, and y1 and y2 in the predicted probability vector y correspond to the probability value of the class label being 0 and the probability value of the class label being 1, respectively.

[0102] Step 3.5: Input each training set into the RBF neural network model in turn to execute steps 3.1 to 3.4, and then iteratively train the RBF neural network model according to the true class labels corresponding to each training set.

[0103] Each test set is input into the RBF neural network model to comprehensively evaluate the performance of the RBF neural network model, which specifically includes the following processes:

[0104] First, each test set is input into the trained RBF neural network model to obtain the prediction probability vector y corresponding to each test set.

[0105] Then the maximum output probability value y in the predicted probability vector y corresponding to each test set is j The corresponding class labels are used as the output class labels for each test set.

[0106] Finally, the accuracy ACC, false alarm rate (FAR), and miss alarm rate (MAR) between the output class label and the true class label corresponding to each test set are calculated. The accuracy ACC, false alarm rate FAR, and miss alarm rate MAR are calculated based on the following formulas:

[0107]

[0108] Among them, TP is the number of positive samples predicted correctly by the RBF neural network model (positive samples are test sets with the true class label of 1), TN is the number of negative samples predicted correctly by the RBF neural network model (negative samples are test sets with the true class label of 0), FP is the number of negative samples predicted incorrectly by the RBF neural network model, and FN is the number of positive samples predicted incorrectly by the RBF neural network model.

[0109] Step 4: Collect the multi-dimensional network traffic features of all NDN routers in the actual NDN network at the same time as samples to be processed, input the samples to be processed into the trained RBF neural network model, obtain the predicted probability vector y corresponding to the samples to be processed, and convert the predicted probability vector y into an output class label. According to the output class label, the network status of the NDN network at the corresponding time is judged, which specifically includes the following steps:

[0110] Step 4.1, collect the multi-dimensional network traffic characteristics of all NDN routers in the actual NDN network at the same time as the samples to be processed, input the samples to be processed into the trained RBF neural network model to execute steps 3.1 to 3.4, and obtain the prediction probability vector y corresponding to the samples to be processed;

[0111] Step 4.2: The maximum output probability value y in the predicted probability vector y j The corresponding class label is used as the output class label corresponding to the sample to be processed;

[0112] Step 4.3: When the output class label is in the normal state 0, the actual NDN network at the corresponding moment is not subjected to the collusion interest flooding attack; when the output class label is in the abnormal state 1, the actual NDN network at the corresponding moment is subjected to the collusion interest flooding attack.

[0113] Finally, the detection performance of the RBF neural network model is evaluated based on these evaluation indicators, and the method proposed in the present invention is compared with other typical detection methods, so as to more comprehensively evaluate the detection performance of the method proposed in the present invention.

[0114] like Figure 2 As shown in the figure, in the collusion interest flooding attack scenario, malicious users send malicious interest packets with small pulses, where the content requested by each malicious interest packet is different, and each malicious interest packet generates a separate PIT entry to fill up the PIT space of the NDN router. It can be seen from the figure that in the collusion interest flooding attack, the malicious users of the upstream link have little impact on the upstream NDN routers, but have a great impact on the bottleneck router Router1. Therefore, the only victim NDN router is the bottleneck router Router1. The space of the PIT table of the bottleneck router Router1 will be occupied by malicious interest packets for a long time, resulting in the discarding of legitimate interest packets in the NDN network and the inability to satisfy the requests of legitimate users. Since the bottleneck router Router1 is close to the producer and has a high sensitivity to changes in network traffic characteristics, the multi-dimensional network traffic characteristics of the bottleneck router Router1 can be extracted to analyze and compare the network traffic during the collusion interest flooding attack with the normal network traffic.

[0115] Finally, the feasibility performance simulation analysis of the method of the present invention is carried out. Figure 3 As shown, the present invention adopts a mesh structure as the structure of the NDN network, sets 16 users, including 12 legitimate users and 4 malicious users, sets 2 content producers, including a normal producer and a collusion producer, and sets 13 NDN routers. Legitimate users send interests at a constant rate, and the requested existing data content follows the Zipf distribution. The simulation duration is set to 80s, the collusion interest flooding attack starts at the 40th second and ends at the 70th second. An attack detection cycle is performed every 10ms (i.e., the multi-dimensional network traffic characteristics of all NDN routers in the NDN network are extracted every 10ms), and each hop of the data packet requires 10ms of transmission time. The PIT table includes 200 PIT entries, and the lifetime of each PIT entry is set to 4s.

[0116] Intermittently launch multiple rounds of collusion interest flooding attacks, including the following process:

[0117] First, in each round of collusion interest flooding attack, all malicious users send 50 interest packets within 1 second and wait for the response of the collusion producer. The NDN router will wait for the response of all interest data packets stored in the PIT. Then, within the next 4 seconds, the malicious users stop sending interest data packets, and the collusion producer responds with the corresponding data packets. Then repeat the above operations to start a new round of attack.

[0118] Since the bottleneck router Router 1 is close to the producers (including legitimate producers and collusion producers), it is highly sensitive to changes in network traffic characteristics. Therefore, the multi-dimensional network traffic characteristics of the bottleneck router Router 1 can be analyzed and compared, thereby analyzing and comparing the network traffic during CIFA attacks with normal network traffic. In the simulation, the PIT occupancy rate and interest packet satisfaction of the bottleneck router Router 1 under the same attack rate were compared and analyzed.

[0119] from Figure 4 It can be clearly seen that the changes in the PIT occupancy rate and interest packet satisfaction rate of the bottleneck router Router1 under the attack state are significantly different from those under the normal state. During the attack phase, the PIT occupancy rate increases intermittently in the form of periodic pulses during the attack phase, and returns to normal after each attack. The interest packet satisfaction rate is the opposite. It decreases periodically during the attack phase and returns to normal after each attack. The malicious user launched an attack at the 40th second, and the malicious interest packets quickly filled the PIT space, causing the PIT occupancy rate to increase rapidly. At this time, the PIT space of the bottleneck router Router1 was intermittently overloaded, and a large number of normal interest packets were discarded by the malicious routing node, resulting in the legitimate user's request being affected, so the interest packet satisfaction rate dropped rapidly. At the 44th second, the collusion producer began to generate the corresponding collusion data packet in response, and the PIT occupancy rate and interest packet satisfaction rate returned to normal. After this state lasted for a few seconds, the malicious user launched the next round of attacks, and the PIT space of the bottleneck router Router1 was filled again, the PIT occupancy rate increased again, and the interest packet satisfaction rate dropped again, showing a periodic change.

[0120] In summary, the multi-dimensional network traffic features have obvious differences in normal and abnormal states. Using machine learning algorithms, models can be trained to identify and distinguish network traffic features in these different states. Therefore, the method of the present invention can monitor changes in traffic statistics, and attack detection can be regarded as classifying network traffic features, thereby determining the state of the network at each moment to achieve CIFA attack detection.

[0121] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0122] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0123] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0124] It should be noted that the embodiments described in the present invention are merely examples of the spirit of the present invention. Those skilled in the art may make various modifications or additions to the described embodiments or replace them in similar ways, but they will not deviate from the spirit of the present invention or exceed the scope defined by the attached claims.

Claims

1. A method for detecting collusion interest flooding attacks in named data networks, characterized in that: The following steps are involved: Step 1: Build an NDN network and simulate the collusion interest flooding attack environment; Step 2: extract the multi-dimensional network traffic features of all NDN routers in the NDN network at set time intervals, use the multi-dimensional network traffic features as input samples, and use all input samples at the same time as a training set or a test set to obtain multiple training sets and test sets, and generate a true class label for each training set and each test set; Step 3: Build an RBF neural network model, input each training set and the corresponding true class label into the RBF neural network model in turn, and perform iterative training on the RBF neural network model; Step 4: Collect the multi-dimensional network traffic characteristics of all NDN routers in the actual NDN network at the same time as samples to be processed, input the samples to be processed into the trained RBF neural network model, obtain the predicted probability vector y corresponding to the samples to be processed, and convert the predicted probability vector y into an output class label. According to the output class label, the network status of the NDN network at the corresponding time is judged. The step 3 specifically comprises the following steps: Step 3.1, construct an RBF neural network model, input a training set and the corresponding true class label into the RBF neural network model, use the K-means algorithm to select h input samples from all input samples in the training set as the clustering center of the K-means algorithm, and determine the center of the radial basis function of the RBF neural network model according to the clustering center; Step 3.2, calculate the width coefficient σ, the width coefficient σ is calculated based on the following formula: In the formula, c max is the maximum distance between h cluster centers; Step 3.3: Use the least squares method to calculate the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer. ij The initial value of , and then in each round of training, the optimizer will update the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer through the MSE loss function and the back propagation algorithm. ij , which eventually makes the weights from the i-th neuron in the hidden layer to different neurons in the output layer different; Step 3.4: According to the center and width coefficient of the radial basis function, and the weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer ij Calculate the output probability value y j , all output probability values ​​y j Construct the predicted probability vector y; Step 3.5: Input each training set into the RBF neural network model in turn to execute steps 3.1 to 3.4, and iteratively train the RBF neural network model according to the true class labels corresponding to each training set. The step 3.1 specifically includes the following steps: Step 3.1.1, use Gaussian function as the radial basis function of the hidden layer of the RBF neural network model. The Gaussian function is based on the following formula: Gaussian function Based on the following formula: Where r is the input sample x p To cluster center c i The Euclidean distance, r, is based on the following formula: r=∥x p -c i ∥i=1,2,...,h;p=1,2,...,m In the formula, x p is the input sample in the training set, p is the sequence number of the input sample in the training set, m is the number of input samples in the training set, c i is the cluster center, i is the serial number of the cluster center; Step 3.1.2: Initialize the RBF neural network model. First, randomly select h input samples in the training set as the clustering center c of the K-means algorithm. i , and then construct h cluster sets V i , each cluster center c i Corresponding to a cluster set V i , and finally initialize the number of iterations to 0; Step 3.1.3: Group all input samples of the training set according to the nearest neighbor rule. First, calculate the input sample x in the training set. p and cluster center c i The Euclidean distance between them, and then the input sample x in the training set p Assign to the nearest cluster center c i The corresponding cluster set V i middle; Step 3.1.4: Finally, re-adjust the cluster center c i , first calculate each cluster set V i The average value of all input samples in , and then each cluster set V i The average value of all input samples in is taken as the corresponding cluster set V i The new cluster center c i , If the Euclidean distances between the new cluster centers and the original cluster centers corresponding to all cluster sets are less than or equal to the preset threshold, or the number of iterations exceeds the set maximum value, then each cluster set V i The corresponding new cluster center c i As the centers of the radial basis functions, If the Euclidean distance between the new cluster center and the original cluster center corresponding to any cluster set is greater than the preset threshold, and the number of iterations is less than or equal to the set maximum value, then increase the number of iterations by 1, and then return to step 3.1.3 to replace the input sample x in the training set. p Reassign to the new cluster center c that is closest to i The corresponding cluster set V i middle.

2. According to claim 1, a method for detecting a named data network collusion interest flooding attack is characterized in that: The step 1 comprises the following steps: Step 1.1: The user sends an interest packet to the upstream NDN router to request the corresponding content. The users include legitimate users and malicious users. The interest packets include legitimate interest packets and malicious interest packets. Legitimate users send legitimate interest packets at a constant rate. The requested existing content follows the Zipf distribution. Malicious users send a small number of interest packets at a rate lower than the rate at which legitimate users send malicious interest packets during the attack period. Step 1.2: When a data packet sent by a producer or other NDN router reaches a downstream NDN router, a normal producer generates a corresponding data packet in response to the data content corresponding to the legitimate interest packet; a colluding producer generates a corresponding data packet in response to the data content corresponding to the malicious interest packet.

3. According to claim 2, a method for detecting a named data network collusion interest flooding attack is characterized in that: The step 2 specifically includes the following steps: Step 2.1, set a router number for each NDN router, count the data of all NDN routers once every set time interval, extract the number of InInterests, OutInterests, PIT entries, and interest packet satisfaction of each NDN router within the set time interval as a set of multi-dimensional network traffic features, and record the corresponding router number; Step 2.2: Arrange each set of multi-dimensional network traffic features in the following manner to form input samples, and record the router number corresponding to each input sample: [Number of InInterests, Number of OutInterests, Number of PIT Entries, Satisfaction of Interest Package]; Step 2.3: Take all input samples at the same time as a training set or a test set to obtain multiple training sets and test sets. Assign a true class label to each training set and each test set according to whether the NDN network is suffering from a collusion interest flooding attack at the corresponding time. The true class label includes normal state 0 and abnormal state 1.

4. According to claim 1, a method for detecting a named data network collusion interest flooding attack is characterized in that: The weight ω between the i-th neuron in the hidden layer and the j-th neuron in the output layer ij The initial value of is based on the following formula: Where j is the serial number of the neuron in the output layer, n is the number of neurons in the output layer, and the number of n is the same as the number of class labels.

5. A method for detecting collusion interest flooding attacks in named data networks according to claim 4, characterized in that: The output probability value y j Based on the following formula: In the formula, each output probability value y j The output probability value corresponding to a class label.

6. A method for detecting a named data network collusion interest flooding attack according to claim 5, characterized in that: The step 4 specifically comprises the following steps: Step 4.1, collect the multi-dimensional network traffic characteristics of all NDN routers in the actual NDN network at the same time as the samples to be processed, input the samples to be processed into the trained RBF neural network model to execute steps 3.1 to 3.4, and obtain the prediction probability vector y corresponding to the samples to be processed; Step 4.2: The maximum output probability value y in the predicted probability vector y j The corresponding class label is used as the output class label corresponding to the sample to be processed; Step 4.3: When the output class label is in the normal state 0, the actual NDN network at the corresponding moment is not subjected to the collusion interest flooding attack; when the output class label is in the abnormal state 1, the actual NDN network at the corresponding moment is subjected to the collusion interest flooding attack.

Images