DDoS defense method for industrial internet

Abstract

The application discloses an industrial internet-oriented DDoS defense method, which processes network access flow through the data plane of a programmable switch, periodically counts data packets by using sketch data structure, and runs a defense program to quickly relieve attacks. A P4 runtime API of a control plane is used to dynamically change a defense strategy, a primitive placement mechanism is proposed to maximize the use of programmable switch performance, a redundant module of an edge server is used to supplement the relief process, a federal learning framework is introduced to deploy a local detection CNN model to supplement the detection process. In the industrial internet scene, the DDoS detection method based on the federal learning in the mechanism effectively solves the problems of new variant detection difficulty and machine learning model deployment difficulty of DDoS attacks; the DDoS relief strategy based on the programmable switch effectively solves the problems of heterogeneous DDoS attack types and dynamic relief difficulty and defense program deployment difficulty, and under the conditions of limited computing capacity and limited memory resources, the defense range is expanded, and dynamic and rapid relief of DDoS attacks is realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security in the Internet, and particularly relates to a DDoS defense method for the industrial Internet. BACKGROUND

[0002] With the breaking of the mode isolation between IT (Information Technology) networks and OT (Operational Technology) networks in the industrial Internet, security threats of the traditional Internet continue to penetrate and extend to the industrial field. Due to the traditional closed industrial network environment, the security protection capability of industrial equipment is generally weak, which further increases the attack surface of industrial systems and equipment. Among them, network attacks and abnormalities account for the largest proportion, and 95% of them are distributed denial of service attacks (DDoS).

[0003] DDoS attack is a network attack that makes the target load heavier and service paralyzed, and has the characteristics of high flow, diversity, dynamics and strong concealment. Its predecessor DoS (Denial of Service) attack emerged in the 1980s. Attackers use system vulnerabilities or protocol principles to send data packets to target servers / host computers, and try to prevent them from connecting with legitimate users and providing services by exhausting their network resources or computing resources. In the late 20th century, DDoS attack initiators were no longer limited to a single machine, but assigned a large number of machines to form a distributed network to launch a Flood attack with huge scale flow.

[0004] With the acceleration of the mode fusion process between IT networks and OT networks, more and more OT devices are exposed to the vision of IT network attackers, and the DDoS threat faced by the industrial Internet is increasing. The main reason for this phenomenon is the advantages of low cost, high destructive power and identity hiding of attackers. At the same time, the specific application, limited computing power and high security requirements of industrial Internet equipment make it difficult to deploy defense, further exacerbating the threat of DDoS attacks. Therefore, it has important theoretical significance and application value to carry out in-depth and thorough research on DDoS defense mechanism in the industrial Internet.

[0005] Currently, DDoS detection schemes have different implementations according to different environments. The ML method is suitable for deployment in the central server of the Internet exchange point, but its detection delay is high and is not suitable for deployment in the industrial internet device end. The FL method is relatively more suitable for industrial scenarios, but most of the current FL detection work still stays in the simulation environment and has not been truly deployed in the complete defense system; the essence of the SDN in the mitigation scheme still depends on CPU processing packets and is not suitable for industrial internet scenarios. Although the rise of programmable switches brings new possibilities, most existing mitigation methods based on programmable switches lack learning ability and adaptability.

[0006] For industrial scenarios, when performance and coverage are prioritized, deploying ML / FL detection models increases packet processing latency. Conversely, when ensuring the latency of packet processing is prioritized, programmable switches with high processing performance are used to design defense primitives, but defense strategies still rely on manual design by programmers, lacking automation and adaptability. Therefore, in view of the characteristics of DDoS attacks in industrial applications, such as diversity, dynamics, and lack of prior knowledge, and the characteristics of industrial internet DDoS defense deployment, such as difficulty, it is of important theoretical and application value to achieve precise detection and rapid mitigation of DDoS in industrial internet scenarios. SUMMARY

[0007] The purpose of the application is to solve the problems of DDoS attack detection difficulty and machine learning model deployment difficulty in the industrial internet scenario, DDoS attack type heterogeneity and dynamic mitigation difficulty, and defense program deployment difficulty in the prior art. A DDoS defense mechanism for the industrial internet is provided, an edge server is introduced, a CNN classification model is deployed on the server, a federated learning model is introduced, an adaptive device grouping algorithm is designed, the traffic of different devices is guided to the same edge server for local training, and the K-Means hierarchical clustering algorithm is used for global aggregation in the central server; the data plane uses P4 language to design a series of modular primitives, multiple primitives are combined into different defense strategies, the control plane reads the network status and the detection results returned by the FL detection model, and the defense strategy executed in the switch is adaptively and dynamically adjusted; the execution of the primitive is separately placed on the switch and the server, and the sketch data structure is used to store the traffic log. The DDoS detection method based on federated learning and the DDoS mitigation strategy based on programmable switches in the method realize precise detection and dynamic rapid mitigation of DDoS attacks under the conditions of training data transmission and privacy protection, limited computing power, and limited memory resources.

[0008] Technical scheme, in order to achieve the above purpose, the application provides a DDoS defense method for the industrial internet, which comprises the following steps:

[0009] S1, according to the primitive, the programmable switch accepts the data packet and periodically counts the data, and performs the operation corresponding to the strategy on the data packet of an identifiable type;

[0010] S2, the data packet that the defense program cannot recognize and is used for model training will be forwarded to the edge server to provide the machine learning model deployed by the subsequent federated learning framework with the recognition and training data;

[0011] S3, the edge server deploys the machine learning model of the federated learning framework by forwarding the pre-trained CNN model and using it to detect the data packet type that the switch cannot recognize;

[0012] S4, the edge server returns the inference result to the programmable switch, and writes the primitive into the programmable switch in the form of a table item according to the defense strategy, thereby updating the statistical rules of the primitive.

[0013] Further, the step S1 is specifically:

[0014] S11, the switch uses the modular defense primitive based on the P4 programming language, and deploys and runs the corresponding defense strategy on it for different types of DDoS attacks, and the mechanism designs two types of modular primitives, namely monitor primitive and action primitive, monitor primitive: aggregate(P), uses Bloom filter to store / count the data packets meeting condition P within a period of time; count(P), uses a register to count the number of data packets meeting condition P within a period of time after Hash; action primitive: forward() forwards the data packet, drop() discards the data packet, confuse() forwards to the edge server for further detection; CAPTCHA() sends an identity verification to the source IP of the data packet;

[0015] S12, the adaptive adjustment defense strategy mechanism dynamically adjusts the defense strategy on the programmable switch according to the monitoring result of the resident monitor primitive, in the data plane, for each type of data packet that can be used to launch an attack protocol, a resident monitor primitive is set to count the number of data packets of that type within a period of time; in the control plane, when the monitor primitive detects that the number of a certain data packet is greater than a preset value, the corresponding strategy is called, and each primitive is written into the running programmable switch in the form of a table item to process the data packet stream;

[0016] S13, to maximize the processing capacity of the switch, the primitives in the defense program are placed on the programmable switch and the edge server after being processed by the arrangement algorithm based on 0-1 integer linear programming, and the following 0-1 integer linear programming (ILP) problem is solved:

[0017] Using existing optimization tools to obtain the best primitive placement scheme, the problem needs to place P defense programs, each program has N p primitives, each primitive requires SRAM size SRAM p,n , requires the number of ALU ACTION p,n , the size of the traffic flowing through each primitive T p,n , the total available SRAM size of the switch SRAM, the total available state ALU number of the switch ACTION, the algorithm will arrange the strategy into two parts, the first part is the switch part and the second part is the server part, to avoid the data packet transmission back and forth between the server and the switch, to ensure that it is transmitted only once; and only when the nth primitive of the pth program is placed on the switch, define X p,n =1, otherwise =0, the last primitive of the pth program placed on the switch is the last primitive, the optimization goal is for all programs, the SRAM allocated to packet processing cannot exceed the total SRAM of the switch, SRAM constraint for all programs, the number of state ALUs allocated to packet processing cannot exceed the total number of state ALUs of the switch, state ALU number constraint

[0018] S14, to maximize the use of memory resources of the switch, the sketch-based data structure is used to compress traffic information, for the storage of data packets, the sketch data structure Bloom filter is introduced; initialization: at the beginning, initialize a 2 l bit array, the initial value is all 0; update: the five-tuple of each data packet , specifically including source IP, destination IP, source port, destination port, transmission protocol, a total of l bits as input, where each element occupies 32 bits, 32 bits, 16 bits, 16 bits, and 8 bits. After k Hash functions indexing into a 2 l bit array, the position marked by Hash calculation is 1, and in order to avoid collision, the hash function satisfies: for any hash function for different data packets the hash collision probability Pr[H(x)=H(y)]=1 / (2 n ); query: check whether a data packet is stored in the Bloom register, Hash calculation shows that any one position is 0, which means it is not stored; Hash calculation shows that the data packet is stored in the filter if all k bits are 1.

[0019] Further, the step S2 is specifically:

[0020] S21, for the data plane, programmable switch can not determine the abnormal traffic data packet, execute confuse() primitive copy forwarding to the edge server, using machine learning model detection;

[0021] S22, in order to provide reliable training data to the edge server model, configure the training server forwarding table on the programmable switch, different network protocol device data packet is forwarded to the same server storage, with packet protocol, destination device address as input, match training server forwarding table, forward to the corresponding edge server for storage training, due to the use of programmable switch, according to the performance of model training or the change of network situation, dynamic adjustment of training server forwarding table; for the programmable switch executing confuse primitive, the data packet to be detected is forwarded to the idle edge server detection model without training and detection task for classification.

[0022] Further, the step S3 is specifically:

[0023] S31, the edge server is deployed with a convolutional neural network model to detect traffic type, which is composed of input layer, hidden layer and output layer, wherein the hidden layer includes densely connected convolutional layer, max pooling layer and fully connected layer, the input layer performs packet analysis, feature extraction and coding organization on the industrial internet device inbound data packet forwarded from the switch to meet the CNN model input format; the convolutional layer processes the extracted feature matrix through 3x3 convolution kernel; the pooling layer uses the method of maximum pooling to reduce the dimension of the traffic feature, and selects the maximum value in the local area to realize feature dimension reduction; the fully connected layer expands all traffic feature maps into one-dimensional vector; the output layer obtains the label class by transforming the one-dimensional vector, uses softmax activation function to predict the class probability, and finally outputs the class label with the maximum probability distribution;

[0024] S32, before local training of the model, SMOTE-ENN sampling algorithm is used to preprocess the traffic data samples collected by the edge server, and oversampling technology is used to oversample the minority class. Wherein, the minority class refers to the sample type whose sample number accounts for less than 10% of the total number of samples, and the majority class refers to the sample type whose sample number accounts for more than 70% of the total number of samples. For each minority class sample x i ∈D minority , find its k nearest neighbor samples x i1 ,x i2 ,…,x ik , generate new synthetic samples x synth = x i + λ × (x ij -x i), wherein lambda is [0, 1], representing the interpolation ratio, x ij is a nearest neighbor sample of x i , by generating new synthetic samples between minority class samples to increase the number of minority class samples; according to the undersampling ratio m, the deletion samples are selected from the majority class samples, so that the number of the remaining majority class samples is m x |D minority |, using the edited nearest neighbor algorithm, the misclassified samples in the majority class samples are deleted, and the noise is removed by deleting different class samples in the majority class samples, so as to reduce the number of majority class samples;

[0025] S33, during local training of the model, the output result of the model is compared with the real label, the cross-entropy loss function is calculated, the gradient of the ability parameter is calculated according to the loss function by using the back propagation algorithm, the gradient is propagated back from the output layer to the input layer through the chain rule, the parameters of the model are updated, so that the loss function is reduced as much as possible, and the model parameters are updated according to the gradient of the parameters by using the stochastic gradient descent;

[0026] S34, in the federated learning framework, the model parameters of the edge server participating in the training in the t-th round are sent to the center server, and after the center server receives m local model parameters

[0027] {omega t,1 , omega t,2 , …, omega t,m}, K groups are obtained by K-Means clustering of the model parameters, the number of each group is denoted as n k , k is [1, K]; the K model parameters are obtained by averaging each group, and the average value omega t+1 of the K model parameters is used as the global model parameter of the next round.

[0028] Further, the step S4 is specifically:

[0029] S41, the server returns the inference result to the programmable switch, the control layer code calls the corresponding defense strategy, and the primitives are written into the running programmable switch in the form of table entries, and after the primitives are updated, the statistical rules of the new primitives are executed in the next statistical period.

[0030] Beneficial effects, compared with the prior art, the beneficial effects of the present application are:

[0031] (1) In view of the problems of difficulty in deployment of machine learning detection model under industrial scene, data transmission and data privacy, and low model performance, an edge server is introduced, a CNN classification model is deployed on the server, a federated learning model is introduced, an adaptive device grouping algorithm is designed, the traffic of different devices is guided to the same edge server for local training, and a K-Means hierarchical clustering algorithm is used in global aggregation of the center server, so as to provide real-time DDoS attack accurate detection service for industrial internet devices.

[0032] (2) In view of the problems of DDoS diversity and dynamics, a series of modular primitives are designed by using P4 language in the data plane, different defense strategies are combined by using the primitives, the network status and the detection results returned by the FL detection model are read by the control plane, and the defense strategies executed in the switch are adaptively and dynamically adjusted; in view of the problems of computing capacity and memory limitation, the execution of the primitives is divided and placed on the switch and the server, the sketch data structure is used to store the traffic log, and dynamic and rapid DDoS attack mitigation is realized. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 The system architecture diagram of the DDoS defense mechanism for industrial internet of the present application is shown in the figure.

[0034] Figure 2 The model training workflow diagram of the DDoS detection method based on federated learning in the DDoS defense mechanism for industrial internet of the present application is shown in the figure.

[0035] Figure 3 The workflow diagram of traffic detection and mitigation in the DDoS defense mechanism for industrial internet of the present application is shown in the figure. DETAILED DESCRIPTION

[0036] The present application will be further illustrated in combination with the drawings and specific embodiments, and it should be understood that the following specific embodiments are only used to illustrate the present application and not used to limit the scope of the present application.

[0037] Embodiment 1

[0038] The present application proposes a DDoS defense mechanism for industrial internet, and the specific architecture is as shown in the figure. Figure 1As shown, the whole system is divided into three parts: central server, edge server and programmable switch. The programmable switch is responsible for controlling the industrial internet device inbound traffic, which is the first line of defense of the defense system, and various defense programs are deployed and can be dynamically adjusted. The edge server is responsible for model reasoning for traffic that cannot be recognized by the programmable switch, and the detection result is returned to the programmable switch in the form of P4 table item to update the defense program. During training, each edge server trains and updates its local model, and uploads the local model parameters to the central server. The central server is responsible for aggregating the global model, and can monitor the network status on the programmable switch and manually adjust the strategy.

[0039] The application provides an industrial internet-oriented DDoS defense method, which comprises the following steps:

[0040] S1, at the programmable switch, according to the primitive, the data packet is accepted and the data is periodically counted, and the operation corresponding to the strategy is performed on the data packet of the recognizable type;

[0041] S2, the data packet that cannot be recognized by the defense program and is used for model training will be forwarded to the edge server to provide identification and training data for the machine learning model deployed in the subsequent federated learning framework;

[0042] S3, the edge server deploys a machine learning model in a federated learning framework, pre-trains a CNN model through the forwarded traffic, and uses it to detect the data packet type that cannot be recognized at the switch;

[0043] S4, the edge server returns the inference result to the programmable switch, and writes the primitive into the programmable switch in the form of table item according to the defense strategy, so as to update the statistical rule of the primitive.

[0044] Further, the step S1 is specifically:

[0045] S11, the switch uses the modular defense primitive based on P4 programming language, and designs a targeted defense strategy for different types of DDoS attacks and deploys and runs it on the switch. Two types of modular primitives are designed, which are monitor primitive and action primitive. The monitor primitive is: aggregate (P), which uses a Bloom filter to store / count data packets meeting condition P within a period of time; count (P), which uses a register to count the number of data packets meeting condition P within a period of time; the action primitive is: forward() forwards the data packet, drop() discards the data packet, confuse() forwards to the edge server for further detection, and CAPTCHA() sends an identity verification to the data packet source IP;

[0046] S12, the adaptive adjustment defense strategy mechanism adjusts the defense strategy on the programmable switch according to the monitoring result of the resident monitor primitive. In the data plane, the resident monitor primitive is set for each type of data packet that can be used to launch an attack protocol to count the number of data packets of the type within a period of time; in the control plane, when the monitor primitive detects that the number of a certain type of data packet is greater than a preset value, the corresponding strategy is called, and each primitive is written into the running programmable switch in the form of a table item to process the data packet flow;

[0047] S13, the primitive runtime maximizes the processing capacity of the switch by using 0-1 integer linear programming to place the primitives in the defense program on the programmable switch and the edge server after processing by the arrangement algorithm. The specific solution is as follows 0-1 integer linear programming (ILP) problem:

[0048] The optimal primitive placement scheme is obtained by using existing optimization tools. In the problem, P defense programs need to be placed, each program has N p primitives, each primitive requires SRAM size SRAM p,n , requires the number of ALU calculation units ACTION p,n , the flow size T p,n flowing through each primitive, the total available SRAM size of the switch is SRAM, the total available state ALU number of the switch is ACTION, the algorithm arranges the strategy into two parts, the first part is the switch part and the second part is the server part, to avoid transmitting data packets back and forth between the server and the switch, and to ensure that the data packets are transmitted only once; and only when the nth primitive of the pth program is placed on the switch, define X p,n = 1, otherwise = 0, when the last primitive of the pth program is placed on the switch, the optimization goal is for all programs, the SRAM allocated for data packet processing cannot exceed the total SRAM of the switch, SRAM constraint for all programs, the number of state ALUs allocated for data packet processing cannot exceed the total number of state ALUs of the switch, state ALU number constraint

[0049] S14, to maximize the use of memory resources of the switch, the sketch-based data structure is used to compress traffic information. For data packet storage, the sketch data structure Bloom filter is introduced; initialization: at the beginning, a 2 l bit array is initialized, and the initial value is all 0; update: each data packet five-tuple, specifically including source IP, target IP, source port, target port, transmission protocol, a total of l bits as input, wherein each element respectively occupies 32 bits, 32 bits, 16 bits, 16 bits, and 8 bits. After k Hash functions indexing to 2 l bit array, the position marked by Hash calculation is 1, and in order to avoid collision, the Hash function satisfies: for any one Hash function for different data packets Hash collision probability Pr[H(x)=H(y)]=1 / (2 n ); query: check whether a data packet is stored in the Bloom register, if any one position is 0 after Hash calculation, it indicates that it is not stored; if k bits are all 1 after Hash calculation, it indicates that the data packet is stored in the filter.

[0050] Further, the step S2 is specifically:

[0051] S21, for abnormal traffic data packets that the programmable switch cannot judge on the data plane, execute the confuse() primitive to copy and forward them to the edge server for detection by using a machine learning model;

[0052] S22, in order to provide reliable training data for the edge server model, configure a training server forwarding table on the programmable switch to forward device data packets with different network protocols to the same server for storage, taking the data packet protocol and destination device address as input, matching the training server forwarding table, and forwarding to the corresponding edge server for storage and training, and due to the use of the programmable switch, the training server forwarding table is dynamically adjusted according to the performance of the model training or the change of the network situation; for the programmable switch executing the confuse primitive, the data packet to be detected is forwarded to the idle edge server detection model without training and detection tasks for classification.

[0053] Further, the step S3 is specifically:

[0054] S31, a convolutional neural network model is deployed on the edge server to detect traffic types, which is composed of an input layer, a hidden layer and an output layer, wherein the hidden layer includes densely connected convolutional layers, max-pooling layers and fully connected layers, the input layer performs packet parsing, feature extraction and encoding and a series of preprocessing operations to meet the input format of the CNN model on the industrial internet device inbound packet forwarded from the switch; the convolutional layer processes the extracted feature matrix through a 3x3 convolution kernel; the pooling layer uses the max-pooling method to reduce the dimension of the traffic features, and selects the maximum value in the local area to realize feature dimension reduction; the fully connected layer expands all traffic feature maps into a one-dimensional vector; the output layer obtains the label class by transforming the one-dimensional vector, uses the softmax activation function to predict the class probability, and finally outputs the class label with the maximum probability distribution;

[0055] S32, before local training of the model, the SMOTE-ENN sampling algorithm is used to preprocess the traffic data samples collected by the edge server, and the over-sampling technology is used to over-sample the minority class. Wherein, the minority class refers to the sample type whose sample number accounts for less than 10% of the total number of samples, and the majority class refers to the sample type whose sample number accounts for more than 70% of the total number of samples. For each minority class sample p i ∈D minority , find its k nearest neighbor samples x i1 ,x i2 ,…,x ik , generate a new synthetic sample x synth = x i + λ × (x ij -x i ) according to the linear interpolation between its k nearest neighbor samples, wherein λ ∈ [0, 1] represents the interpolation ratio, and x ij is one of the nearest neighbor samples of x i , and the new synthetic sample is generated between the minority class samples to increase the number of minority class samples; according to the under-sampling rate m, select and delete samples from the majority class samples, so that the number of remaining majority class samples is m x |D minority |, use the edited nearest neighbor algorithm to delete misclassified samples in the majority class samples, and remove noise by deleting different class samples in the majority class samples to reduce the number of majority class samples;

[0056] S33, during local training of the model, the output result of the model is compared with the real label, the cross-entropy loss function is calculated, the gradient of the ability parameter is calculated according to the loss function by using the back propagation algorithm, the gradient is propagated back to the input layer from the output layer through the chain rule, the parameters of the model are updated to make the loss function as small as possible, and the model parameters are updated according to the gradient of the parameters by using the stochastic gradient descent;

[0057] S34, in the federated learning framework, the t-th round of training, the edge server participating in the training sends the model parameters of this round to the center server, and the center server receives the m local model parameters

[0058] {ω t,1 ,ω t,2 ,…,ω t,m} are clustered by K-Means to obtain K groups, and the number of each group is n k , k [1, K]; the average of each group is obtained as K model parameters, and the average ω t+1 of the K model parameters is used as the global model parameter of the next round.

[0059] Therefore, the model training workflow of the DDoS detection method based on federated learning in the DDoS defense mechanism of the industrial internet is as shown in Figure 2 In the network topology deployed by the application, the traffic may include normal benign traffic and DDoS attack traffic, so the proposed federated learning detection model can be used to train the classification model. In the process, the programmable switch forwards the data packet to different edge servers according to the forwarding table, which is used as the source data of the local training model of each switch; the SMOTE-ENN sampling algorithm is used to preprocess the local traffic data samples, eliminate the imbalance between benign and attack traffic, and improve the model performance; the deployed CNN algorithm is used to train the local model, and each edge server downloads the global model parameter from the center server. Input the processed data samples, and output the prediction results through parsing, extraction, convolution and other operations, compare with the real label and continuously update the model parameters, so that the loss function is as small as possible, and a local model with better performance is obtained; the model parameters of this round of training are sent to the center server, and the new global model parameters are obtained by K-Means clustering and averaging. Through continuous repetition of this process, multiple rounds of training are realized, and the model is continuously updated to improve its detection performance.

[0060] Further, the step S4 is specifically:

[0061] S41, the server returns the inference result to the programmable switch, the control layer code calls the corresponding defense strategy, and the primitive is written into the running programmable switch in the form of a table item. After updating the primitive, the statistical rules of the new primitive are executed in the next statistical period.

[0062] Therefore, the workflow of traffic detection and mitigation in the DDoS defense mechanism of the industrial internet is as shown in Figure 3The defense system is arranged in a network topology, a programmable switch data plane receives a data packet and periodic statistical data; according to a written defense program, the switch judges whether the data packet type is successfully identified. If the data packet is successfully judged to be benign traffic or malicious traffic, the processing operation written in the defense program is executed; if the data packet type cannot be judged, it is forwarded to a certain edge server according to a preset forwarding table; the edge server parses and extracts the data packet, detects the data packet type through a pre-trained CNN model; the inference result is returned to the programmable switch, which calls the corresponding defense strategy; the primitives are written in the form of table entries into the running programmable switch, and the corresponding operation is performed on the data packet. At the same time, the rules of data statistics will also be updated according to the updated primitives.

[0063] The mechanism realizes the accurate detection and rapid mitigation of DDoS in the industrial internet, proposes a DDoS accurate detection method based on federated learning, deploys a local model suitable for traffic classification, designs a global aggregation to cope with the data imbalance problem generated in the federated learning training process in the industrial scene; a DDoS mitigation strategy based on programmable switches is proposed, which is convenient for writing and deploying different targeted defense programs, and integrates the high hardware performance of edge servers and the processing capacity of switches with high throughput and low delay, and dynamically adjusts the defense strategy program on the programmable switch without interruption.

[0064] It should be noted that the above content only illustrates the technical idea of the present application, and cannot be used to limit the protection scope of the present application. For ordinary skilled persons in the technical field, under the premise of not departing from the principles of the present application, a number of improvements and refinements can be made, which fall within the protection scope of the claims of the present application.

Claims

1. An industrial internet-oriented DDoS defense method, characterized by, The method comprises the following steps: S1, according to the primitives, accepting data packets and periodically counting data, performing corresponding operations of the strategy on data packets of identifiable types at the programmable switch; S2, forwarding data packets that cannot be recognized by the defense program and used for model training to the edge server to provide identification and training data for the machine learning model deployed by the subsequent federated learning framework; S3, introducing the edge server to deploy the machine learning model of the federated learning framework, pre-training the CNN model through the forwarded traffic, and utilizing it to detect data packet types that cannot be recognized at the switch; S4, the edge server returns the inference result to the programmable switch, and writes the primitives into the programmable switch in the form of table entries according to the defense strategy, thereby updating the statistical rules of the primitives; The step S1 is specifically: S11: The switch utilizes the modular defense primitives based on the P4 programming language, designs specific defense strategies for different types of DDoS attacks, and deploys and runs them on the switch, designs two types of modular primitives, namely monitor primitives and action primitives, monitor primitives: aggregate(P), utilizes a Bloom filter to store / count data packets that meet condition P within a period of time; count(P), utilizes a register to count the number of data packets that meet condition P within a period of time after Hash; action primitives: forward() forwards data packets, drop() discards data packets, confuse() forwards to the edge server for further detection, and CAPTCHA() sends an identity verification to the source IP of the data packet; S12: The adaptive adjustment defense strategy mechanism dynamically adjusts the defense strategy on the programmable switch according to the monitoring results of the resident monitor primitives, on the data plane, for each type of data packet that can be used to launch an attack protocol, a resident monitor primitive is set to count the number of data packets of that type within a period of time; on the control plane, when the monitor primitive detects that the number of a certain type of data packet is greater than a preset value, the corresponding strategy is called, each primitive is written into the running programmable switch in the form of a table entry, and the data packet stream is processed; S13: To maximize the processing capacity of the switch, the primitives in the defense program are placed on the programmable switch and the edge server after being processed by the arrangement algorithm based on 0-1 integer linear programming, and the following 0-1 integer linear programming problem is specifically solved: To obtain the best placement of primitives using existing optimization tools, there are P defense programs to be placed in the problem, each program has N p primitives, each primitive requires SRAM size SRAM p,n , requires the number of ALU states ACTION p,n , the size of the traffic flowing through each primitive T p,n , the total available SRAM size of the switch SRAMsum, the total available state number of the switch ACTION, the strategy is arranged into two parts, the first part is the switch part and the second part is the server part, avoiding the data packet to be transmitted back and forth between the server and the switch, ensuring that it is transmitted only once; and only when the nth primitive of the pth program is placed on the switch, define X p,n = 1, otherwise = 0, when the last primitive of the pth program is placed on the switch, the last primitive is the last primitive, the optimization goal is For all programs, the SRAM allocated to packet processing cannot exceed the total SRAM of the switch, the SRAM constraint is For all programs, the number of state ALUs allocated to packet processing cannot exceed the total number of state ALUs of the switch, the state ALU number constraint S14: To maximize the use of memory resources of the switch, the sketch-based data structure is used to compress the flow information, and the sketch data structure Bloom filter is introduced for the storage of data packets; initialization: at the beginning, an array of 2 l bits is initialized, and the initial value is all 0; update: the five-tuple of each data packet , specifically including source IP, target IP, source port, target port and transmission protocol, a total of 1 bits, where each element occupies 32 bits, 32 bits, 16 bits, 16 bits and 8 bits, is taken as input, and the position marked as 1 in the array of 2 bits is indexed by k Hash functions l , and in order to avoid collision, the Hash function satisfies: for any Hash function , the Hash collision probability Pr[H(x) = H(y)] = 1 / (2 n ) for different data packets ; query: check whether a data packet is stored in the Bloom register or not, if any position is 0 by Hash calculation, it indicates that it is not stored; if all k bits are 1 by Hash calculation, it indicates that the data packet is stored in the filter. 2.The DDoS defense method for industrial internet of claim 1, wherein, The step S2 is specifically: S21: For abnormal traffic data packets that cannot be judged by the programmable switch on the data plane, the confuse() primitive is executed to copy and forward them to the edge server for detection by the machine learning model; S22: In order to provide reliable training data for the edge server model, a training server forwarding table is configured on the programmable switch to forward network protocol different device data packets to the same server storage, taking the data packet protocol and the destination device address as inputs, matching the training server forwarding table, and forwarding to the corresponding edge server for storage training. Due to the use of the programmable switch, the training server forwarding table is dynamically adjusted according to the performance of the model training or the change of the network situation; for the programmable switch executing the confuse primitive, the data packet to be detected is forwarded to the idle edge server detection model without training and detection task for classification. 3.The industrial internet of things oriented DDoS defense method of claim 1, wherein, The step S3 is specifically: S31: deploying a convolutional neural network model on the edge server to detect traffic types, which is composed of an input layer, a hidden layer and an output layer, wherein the hidden layer includes densely connected convolutional layers, max-pooling layers and fully connected layers; the input layer performs packet parsing, feature extraction and coding organization on the industrial internet device inbound data packets forwarded from the switch to meet the CNN model input format; the convolutional layer performs higher feature processing on the extracted feature matrix through a 3x3 convolution kernel; the pooling layer uses the max-pooling method to reduce the dimension of the traffic features, and selects the maximum value in the local area to realize feature dimension reduction; the fully connected layer expands all traffic feature maps into a one-dimensional vector; the output layer obtains a label class by transforming the one-dimensional vector, uses a softmax activation function to predict the class probability, and finally outputs the class label with the maximum probability distribution; S32: Before local training of the model, the SMOTE-ENN sampling algorithm is used for preprocessing of the edge server collected traffic data samples, and an oversampling technique is used for oversampling of the minority class, wherein the minority class refers to a sample type whose sample number accounts for less than 10% of the total number of samples, and the majority class refers to a sample type whose sample number accounts for more than 70% of the total number of samples; for each minority class sample x i ∈D minority , find its k nearest neighbor samples x i1 ,x i2 ,…,x ik , generate a new synthetic sample x synt = x i + λ × (x ij -x i ) according to the linear interpolation between its k nearest neighbor samples, wherein λ ∈ [0, 1] represents the interpolation ratio, and x ij is one of the nearest neighbor samples of x i , new synthetic samples are generated between minority class samples to increase the number of minority class samples; according to the undersampling rate m, select and delete samples from the majority class samples, so that the number of remaining majority class samples is m × |D minority |, use the edited nearest neighbor algorithm to delete misclassified samples in the majority class samples, and delete different class samples in the majority class samples to remove noise, so as to reduce the number of majority class samples; S33: During local training of the model, the output result of the model is compared with the real label to calculate the cross-entropy loss function, the gradient of the ability parameter is calculated according to the loss function using the back propagation algorithm, the gradient is propagated from the output layer back to the input layer through the chain rule, the parameters of the model are updated so that the loss function is less than the preset value, and the model parameters are updated according to the gradient of the parameters using the stochastic gradient descent; S34: In the federated learning framework, the t-th round of training, the edge server participating in the training sends the model parameters of this round to the center server, and the center server receives m local model parameters {ω t,1 ,ω t,2 ,…,ω t,m} and performs K-Means clustering on the model parameters to obtain K groups, the number of each group is n k , k ∈ [1, K]; average each group to obtain K model parameters, and the average value ω t+1 of the K model parameters is used as the global model parameter of the next round.

4. The DDoS defense method for industrial internet of claim 1, wherein, The step S4 is specifically: S41: The server returns the inference result to the programmable switch, the control layer code calls the corresponding defense strategy, and the primitive is written into the running programmable switch in the form of a table item. After the primitive is updated, the statistical rules of the new primitive are executed in the next statistical period.

Images