Active defense method, device, equipment and storage medium for DDoS attacks

Abstract

The present invention provides an active defense method, device, equipment and storage medium for DDoS attacks, which relates to the field of computer network technology, including: using edge nodes to collect real-time traffic information, and extracting feature vectors corresponding to the real-time traffic information; using a first detection model on the edge node to perform DDoS attack detection on the feature vector to obtain a first detection result; using a second detection model on a cloud node to detect the target feature vector corresponding to the abnormal traffic in the first detection result to obtain a second detection result; based on the second detection result, determining the degree of harm of the DDoS attack, and based on the degree of harm, generating a defense strategy and sending it to the edge node for attack defense. The present invention uses edge nodes to achieve early warning of attacks, and formulates precise defense strategies in combination with the detection results of cloud nodes, thereby achieving efficient detection and response of DDoS attacks.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to an active defense method, device, equipment and storage medium for DDoS attacks. Background Art

[0002] In the cloud computing environment, DDoS (distributed denial of service) attacks are a common network security threat. With the development of cloud computing technology, attackers are constantly updating their attack methods, which makes the traditional active defense method of DDoS attacks face some challenges.

[0003] Traditional active defense methods for DDoS attacks can usually only detect the attack after it has already occurred and has caused a certain impact on the system. The reason for this slow response is that they rely on monitoring and analyzing abnormal changes in traffic patterns. Once an anomaly is detected, it takes time to confirm the attack and take corresponding defensive measures. For dynamic resources and flexible network configurations in cloud computing environments, this delay may cause serious service interruptions. In addition, in cloud computing environments, normal traffic and attack traffic may have similar characteristics because cloud services usually aggregate multiple types of traffic from different users. This makes it difficult for feature-based or statistical methods to accurately distinguish normal behavior from malicious behavior, which may lead to false positives and false negatives. In addition, in large-scale cloud computing environments, processing and analyzing massive amounts of network traffic data requires a lot of computing resources and storage space. This not only increases costs, but may also have an impact on the performance of the cloud service itself. Summary of the invention

[0004] The present invention provides a method, device, equipment and storage medium for active defense against DDoS attacks, aiming to solve at least one of the above technical problems.

[0005] The present invention provides an active defense method for DDoS attacks, comprising:

[0006] Using edge nodes to collect real-time traffic information, and extracting feature vectors corresponding to the real-time traffic information;

[0007] Using a first detection model on the edge node, perform DDoS attack detection on the feature vector to obtain a first detection result;

[0008] Using a second detection model on the cloud node, the target feature vector corresponding to the abnormal traffic as the first detection result is detected to obtain a second detection result;

[0009] Based on the second detection result, the degree of harm of the DDoS attack is determined, and based on the degree of harm, a defense strategy is generated and sent to the edge node for attack defense.

[0010] According to an active defense method for DDoS attacks provided by the present invention, the second detection model is optimized based on the following steps:

[0011] Acquire a historical feature vector set cached on a cloud node, wherein the historical feature vector set includes a plurality of historical feature vectors;

[0012] Performing feature fusion on the target feature vector corresponding to the first detection result of abnormal traffic and the historical feature vector set to obtain a fused feature vector set;

[0013] Based on the fused feature vector set, training and optimization are performed to obtain the second detection model.

[0014] According to an active defense method for DDoS attacks provided by the present invention, the first detection result is that the target feature vector corresponding to the abnormal traffic is subjected to feature fusion with the historical feature vector set cached on the cloud node to obtain the fused feature vector, including:

[0015] Determining the number of features based on the target feature vector and the historical feature vector set;

[0016] Determining a weight of the target feature vector and a weight of any of the historical feature vectors;

[0017] Based on the number of features, the weight of the target feature vector and the weights of all the historical feature vectors, feature fusion is performed on the target feature vector and the historical feature vector set to obtain the fused feature vector set.

[0018] According to an active DDoS attack defense method provided by the present invention, determining the degree of harm of the DDoS attack based on the second detection result includes:

[0019] Based on the second detection result, determine an attack feature vector, wherein the attack feature vector includes at least one or more of an attack type, an attack traffic size, and an important coefficient of an attacked service;

[0020] The attack feature vector is input into a preset harm degree analysis model to obtain the harm degree of the DDoS attack.

[0021] According to an active defense method for DDoS attacks provided by the present invention, the defense strategy is generated based on the degree of damage and sent to the edge node for attack defense, including:

[0022] Comparing the hazard level with a preset numerical threshold to obtain a comparison result;

[0023] Determine a defense strategy corresponding to the degree of harm based on the comparison result and the defense measure type, priority, and execution condition in each defense strategy stored on the cloud node;

[0024] The defense strategy corresponding to the degree of harm is sent to the edge node for attack defense.

[0025] According to an active defense method for DDoS attacks provided by the present invention, after generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense, the method further includes:

[0026] Obtain device status data of the DDoS monitoring device;

[0027] Determine a defense strategy feature vector corresponding to the defense strategy, wherein the defense strategy feature vector includes at least one or more of a defense measure type, a priority, and an execution condition;

[0028] Inputting the device status data and the defense strategy feature vector into a preset prediction model to obtain a defense effect prediction value output by the prediction model;

[0029] Determine the actual defense effect value based on device status data;

[0030] Based on the actual defense effect value and the defense effect prediction value, the defense strategy in the cloud node is dynamically optimized.

[0031] According to an active defense method for DDoS attacks provided by the present invention, after using a first detection model on an edge node to perform DDoS attack detection on the feature vector and obtaining a first detection result, the method further includes:

[0032] Based on the defense strategy stored in the edge node, defend against abnormal traffic in the first detection result, wherein the defense strategy stored in the edge node is to use the cloud node to periodically send the defense strategy to the edge node;

[0033] If the defense is successful, there is no need to perform the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result;

[0034] If the defense fails, or the amount of real-time traffic information exceeds the preset data threshold, the step of returning to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result.

[0035] The present invention also provides an active defense device for DDoS attacks, comprising:

[0036] A collection module, used to collect real-time traffic information using edge nodes, and extract feature vectors corresponding to the real-time traffic information;

[0037] A first detection module, configured to perform DDoS attack detection on the feature vector using a first detection model on the edge node to obtain a first detection result;

[0038] A second detection module is used to detect the target feature vector corresponding to the abnormal traffic as the first detection result by using the second detection model on the cloud node to obtain a second detection result;

[0039] The defense module is used to determine the degree of harm of the DDoS attack based on the second detection result, so as to generate a defense strategy based on the degree of harm and send it to the edge node for attack defense.

[0040] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the active defense method against DDoS attacks described above is implemented.

[0041] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the active defense method for DDoS attacks as described in any one of the above is implemented.

[0042] The active defense method, device, equipment and storage medium for DDoS attacks provided by the present invention include: using edge nodes to collect real-time traffic information and extracting feature vectors corresponding to the real-time traffic information; using a first detection model on the edge node to perform DDoS attack detection on the feature vector to obtain a first detection result; using a second detection model on a cloud node to detect the target feature vector corresponding to the abnormal traffic in the first detection result to obtain a second detection result; based on the second detection result, determining the degree of harm of the DDoS attack, and generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense. By using the first detection model on the edge node to perform DDoS attack detection on the feature vector, the low latency characteristics of the edge node are used to achieve early warning of DDoS attacks, thereby achieving efficient detection and response of DDoS attacks. In addition, a precise defense strategy is formulated in combination with the detection results of the cloud node to comprehensively improve the security and stability of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 It is a flow chart of the active defense method for DDoS attacks provided by the present invention;

[0045] Figure 2 It is a structural schematic diagram of the active defense device for DDoS attacks provided by the present invention;

[0046] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The terms used in one or more embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present invention. The singular forms of "a", "said" and "the" used in one or more embodiments of the present invention are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of the present invention refers to and includes any or all possible combinations of one or more associated listed items.

[0049] It should be understood that, although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present invention, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of the present invention, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "when..." or "when...".

[0050] Figure 1 FIG. 1 is a flow chart of the active defense method for DDoS attacks provided by the present invention. Figure 1 As shown in the figure, the active defense method for this DDoS attack includes:

[0051] Step S11, using edge nodes to collect real-time traffic information, and extracting feature vectors corresponding to the real-time traffic information;

[0052] It should be noted that real-time traffic information refers to detailed information about data packets transmitted in the network, which is usually collected from various edge nodes of the network. Edge nodes refer to servers or devices located at the edge of the network, which can directly interact with end users or other parts of the network, so they can capture network traffic data in real time. The feature vector includes feature information such as packet size, frequency, source IP address distribution, request type, protocol type, and port number.

[0053] Specifically, the edge node collects real-time traffic information in real time, and then preprocesses the real-time traffic information; for example, preprocessing operations such as cleaning, deduplication and normalization are performed on the real-time traffic information. Further, various features are extracted from the preprocessed real-time traffic information, and the feature vector is constructed based on the various features.

[0054] Step S12, using a first detection model on the edge node to perform DDoS attack detection on the feature vector to obtain a first detection result;

[0055] It should be noted that a first detection model for traffic detection is deployed on the edge node, and the real-time traffic data is classified and detected by using the first detection model, so that DDoS attacks can be discovered and responded to in a timely manner. Among them, the first detection model can be a support vector machine algorithm model, and the training process of the first detection model is as follows: collect multiple traffic sample information, and extract the sample feature vector of each traffic information, and then train the first detection model based on the sample feature vector and the label corresponding to the traffic sample information. In more detail: by finding a hyperplane in the high-dimensional space, normal traffic and attack traffic are effectively separated. The algorithm formula is as follows:

[0056]

[0057] The constraints are set as:

[0058] ≥0,i=1,......,n

[0059] w represents the direction of the hyperplane, which determines the decision boundary of the classification. In DDoS detection, it reflects the separation of normal traffic and attack traffic in the feature space.

[0060] b represents the distance between the hyperplane and the origin. In the binary classification problem, it determines the classification threshold.

[0061] C represents the regularization parameter, which is used to control the complexity and generalization ability of the model. A larger C value will make the model more complex and may overfit the training data; a smaller C value may lead to underfitting.

[0062] Represents a slack variable, which is used to handle nonlinearly separable or noisy data. In DDoS detection, it allows the algorithm to tolerate outliers to a certain extent, thereby improving the robustness of the model.

[0063] Represents the sample label, which is used to indicate whether each sample is normal traffic or attack traffic. During the training process, these labels are known and used to guide the algorithm to learn classification rules.

[0064] Represents a sample feature vector, which contains key feature information extracted from network traffic. These features are essential for distinguishing normal traffic from attack traffic. Common feature information includes packet size, frequency, source IP address distribution, request type, etc.

[0065] Specifically, the first detection model on the edge node is used to perform DDoS attack detection on the feature vector to obtain a first detection result. Thus, in DDoS attack detection, the edge node collects and analyzes the network traffic flowing through it, utilizes the low latency characteristics of edge computing, identifies abnormal traffic patterns, and thus promptly discovers and responds to DDoS attacks.

[0066] Step S13, using the second detection model on the cloud node, detecting the target feature vector corresponding to the abnormal traffic in the first detection result to obtain a second detection result;

[0067] It should be noted that the cloud node, as a processing center, is responsible for receiving traffic data reported by each edge node.

[0068] Specifically, after receiving the first detection result reported by the edge node as the target feature vector corresponding to the abnormal traffic, the cloud node uses the second detection model on the cloud node to detect the target feature vector corresponding to the first detection result as the abnormal traffic, and obtains the second detection result, so as to formulate a precise defense strategy in combination with the detection result of the cloud node, so as to comprehensively improve the security and stability of the entire system.

[0069] Step S14: determining the degree of harm of the DDoS attack based on the second detection result, generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense.

[0070] It should be noted that the degree of harm is a quantitative measure, such as a damage score, risk level coefficient, or direct severity score. Defense strategies include but are not limited to traffic cleaning, traffic suppression, IP blacklisting, resource isolation, redundant bandwidth (providing additional network bandwidth to absorb attack traffic), and other decisions.

[0071] Specifically, based on the second detection result, an attack feature vector is determined, wherein the attack feature vector includes features such as the attack type, the attack traffic size, and the importance coefficient of the attacked service. In other embodiments, it may also include features such as the duration of the attack, the frequency of the attack, and the source of the attack. Then, the attack feature vector is input into a preset harm degree analysis model to obtain the harm degree of the DDoS attack. The algorithm formula of the harm degree analysis model is as follows:

[0072]

[0073] in, It is the model's predicted output for input x, indicating the degree of damage caused by the attack. It is an attack feature vector, including various features used to evaluate the severity of the attack, such as the attack type, attack traffic size, and the importance coefficient of the attacked service. is a parameter vector containing the weights that the model needs to learn. is the base of natural logarithms.

[0074] Furthermore, different defense strategies can be associated with different ranges of harm levels in advance. For example, if the value of the harm level is higher than the first numerical threshold, it means that the harm level of the attack is very large, and a more aggressive defense strategy can be selected, such as calling the traffic suppression capability or resource isolation of the cloud network end. If the value of the harm level is higher than the second numerical threshold and lower than the first numerical threshold, a milder defense strategy can be selected, such as calling the traffic cleaning capability of the cloud network end, where the first numerical threshold is greater than the second numerical threshold. If the value of the harm level is lower than the second numerical threshold, it means that the harm level of the attack is very small, and you can choose not to take any action, or add the attacker's IP address to the blacklist for monitoring. In this way, the harm level and impact range of the attack can be evaluated based on the detection results, and targeted defense strategies can be formulated.

[0075] The embodiment of the present invention, through the above scheme, includes: using edge nodes to collect real-time traffic information, and extracting feature vectors corresponding to the real-time traffic information; using the first detection model on the edge node to perform DDoS attack detection on the feature vector to obtain a first detection result; using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic in the first detection result to obtain a second detection result; based on the second detection result, determining the degree of harm of the DDoS attack, and generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense. The embodiment of the present invention uses the first detection model on the edge node to perform DDoS attack detection on the feature vector, so as to use the low-latency characteristics of the edge node to achieve early warning of the attack, thereby achieving efficient detection and response of DDoS attacks. And formulate a precise defense strategy in combination with the detection results of the cloud node to comprehensively improve the security and stability of the entire system.

[0076] In one embodiment of the present invention, the second detection model is optimized based on the following steps: obtaining a historical feature vector set cached on a cloud node, wherein the historical feature vector set includes multiple historical feature vectors; performing feature fusion on a target feature vector corresponding to abnormal traffic in the first detection result and the historical feature vector set to obtain a fused feature vector set; and training and optimizing based on the fused feature vector set to obtain the second detection model.

[0077] It should be noted that the second detection model can be a decision tree model. In one embodiment, the second detection model can be pre-trained based on the collected traffic information and the labels corresponding to the traffic information. It should be noted that at each node of the decision tree, the optimal partitioning feature and threshold are selected so that the partitioned subset reaches the optimal under the evaluation criteria. The partitioning process is repeated until the preset stop condition is met, for example, the model converges or the number of training iterations reaches a preset number. The algorithm formula of the decision tree is as follows: The decision tree is based on the feature at a certain node. and threshold The two subsets after the division can be expressed as:

[0078]

[0079]

[0080] Where x is the input feature vector, is the jth feature in the feature vector. The goal of the decision tree is to find the optimal partition feature j and threshold s so that the partitioned subsets are optimal under the information gain evaluation criterion. represents the jth feature in the feature vector. s represents the partition threshold, which is used to divide the feature space into two subsets. According to the characteristics The first subset after the threshold s is divided contains all the subsets that satisfy of the sample. According to the characteristics The second subset after the threshold s contains all the subsets that satisfy of the sample.

[0081] Specifically, obtain a set of historical feature vectors cached on the cloud node, wherein the set of historical feature vectors includes multiple historical feature vectors; fuse the target feature vector corresponding to the first detection result of abnormal traffic with the set of historical feature vectors cached on the cloud node to construct a more comprehensive fused feature vector set. Feature fusion helps to capture the correlation between different attack methods and improve detection accuracy. Effectively integrate feature vectors from different sources to improve the performance of subsequent analysis or models. The specific feature fusion process is as follows: first, determine the number of features based on the target feature vector and the set of historical feature vectors; then determine the weight of the target feature vector and the weight of any of the historical feature vectors, and the weight calculation formula is as follows:

[0082]

[0083] in, represents an attribute value of the i-th eigenvector, Represents weight, which refers to the ratio of the attribute value to the total value of all attributes.

[0084] Furthermore, based on the number of features, the weight of the target feature vector and the weights of all the historical feature vectors, the target feature vector and the historical feature vector set are subjected to feature fusion to obtain the fused feature vector set. The formula is as follows:

[0085]

[0086] in, Represents the fused feature vector set. n represents the number of features of the feature vectors involved in the fusion. : represents the weight of the i-th eigenvector. : represents the target feature vector or historical feature vector involved in fusion. Furthermore, based on the fusion feature vector set, the second detection model is obtained through training and optimization.

[0087] Through the above scheme, the embodiment of the present invention realizes the feature fusion of the feature vector reported by the edge node and the historical feature vector already in the cloud node, and then trains the detection model according to the fused feature information, so that the model can capture the correlation between different attack methods and improve the detection accuracy.

[0088] In one embodiment of the present invention, after generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense, the method further includes:

[0089] Obtain device status data of a monitored DDoS device; determine a defense strategy feature vector corresponding to the defense strategy, wherein the defense strategy feature vector includes at least one or more of a defense measure type, a priority, and an execution condition; input the device status data and the defense strategy feature vector into a preset prediction model to obtain a defense effect prediction value output by the prediction model; determine an actual defense effect value based on the device status data; and dynamically optimize the defense strategy in the cloud node based on the actual defense effect value and the defense effect prediction value.

[0090] It should be noted that device status data includes data such as traffic size, traffic rate, traffic distribution, system resource usage (such as CPU utilization, memory utilization, etc.) and network device status (operating status, configuration information and performance indicators of network devices such as routers, switches and firewalls).

[0091] It should be noted that the defense strategy feature vector includes but is not limited to defense measure type, priority and execution conditions. The defense measure type refers to the specific method used to defend against DDoS attacks. For example, this may include traffic cleaning, rate limiting, firewall rules, IP blacklists, request verification, etc. Each measure type has its specific role and effect, and is suitable for different attack types and scenarios. Priority When implementing defense strategies, different measures may have different priorities. Measures with higher priorities should be triggered and executed first when an attack is detected to ensure rapid response and effective mitigation of the impact of the attack. For example, for some critical services, the most effective measures may need to be started first. The execution conditions can be traffic thresholds, attack types, system loads, time periods, etc. Only when these conditions are met will the corresponding defense measures be triggered. For example, rate limiting may only be enabled when the traffic exceeds a certain percentage, or certain defense strategies may only be applied when a specific type of attack is detected.

[0092] Specifically, the cloud node sends the formulated defense strategy to the DDoS device of the edge node for execution. At the same time, the defense effect of the DDoS device is monitored. Optionally, the device status data of the monitored DDoS device is obtained, and the actual defense effect value is analyzed based on the device status data, and the feedback is sent to the cloud node in real time for strategy adjustment.

[0093] In addition, in the cloud node, the device status data and the defense strategy feature vector are input into a preset prediction model to obtain a defense effect prediction value output by the prediction model. The preset prediction model is obtained through supervised training based on a large amount of collected device status data and defense strategy feature vectors.

[0094] Furthermore, in this embodiment, based on the actual defense effect value and the defense effect prediction value, the defense strategy in the cloud node is dynamically optimized to improve the defense effect, as follows:

[0095]

[0096] OS represents the optimal defense strategy. The defense strategy contains a vector of multiple features, such as defense measure type, priority, execution conditions, etc. The goal is to optimize the defense strategy by adjusting these features. The argmin function is used to minimize the objective function under a given loss function and regularization term. In this way, a defense strategy that can fit the training data well and is not too complicated can be obtained. LF represents the preset loss function, which is used to measure the difference between the predicted defense effect and the actual defense effect. PE represents the defense effect prediction value output by the prediction model. The defense effect predicted by the model based on the input defense strategy features and the DDoS device status. This is a numerical value that indicates the quality of the predicted defense effect. AE represents the actual defense effect value, which is the actual defense effect obtained by monitoring the DDoS device. This is a numerical value used to compare with the predicted defense effect. λ represents the preset regularization coefficient, which is used to control the weight of the regularization term. A larger λ value will make the model pay more attention to the regularization term to prevent overfitting; a smaller λ value will make the model pay more attention to the loss function to better fit the training data. RT represents the preset regularization term to prevent overfitting of the model.

[0097] The embodiment of the present invention realizes learning and optimizing the relationship between the characteristics of the defense strategy and the DDoS attack mode through the above scheme, and realizes dynamic adjustment of the defense strategy to improve the defense effect.

[0098] In one embodiment of the present invention, after using a first detection model on an edge node to perform DDoS attack detection on the feature vector and obtaining a first detection result, the method further includes:

[0099] Based on the defense strategy stored in the edge node, defense is performed on the abnormal traffic in the first detection result, wherein the defense strategy stored in the edge node is to use the cloud node to periodically send the defense strategy to the edge node; if the defense is successful, there is no need to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic in the first detection result; if the defense fails, or the amount of real-time traffic information exceeds a preset data threshold, return to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic in the first detection result.

[0100] It should be noted that the cloud node regularly sends each defense strategy to the edge node for storage. After the first detection model on the edge node detects abnormal traffic, the abnormal traffic in the first detection result is defended based on the defense strategy stored in the edge node. In one embodiment, in order to reduce the computing resources of the cloud, if the defense is successful, there is no need to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic of the first detection result. In addition, if the defense fails, or the amount of real-time traffic information exceeds the preset data threshold, that is, the edge node cannot process a large amount of real-time traffic information in time, then return to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic of the first detection result. In other embodiments, the type of traffic detection corresponding to the need to be performed on the cloud node can also be pre-set. After using the first detection model on the edge node to perform DDoS attack detection on the feature vector and obtaining the first detection result, it is determined whether to use the second detection model on the cloud node to detect the traffic according to the type of traffic information.

[0101] The embodiment of the present invention uses the above-mentioned scheme to detect DDoS attacks on feature vectors using the first detection model on the edge node, so as to achieve early warning of attacks by utilizing the low-latency characteristics of the edge node, and can defend against abnormal traffic in the first detection result based on the defense strategy stored in the edge node.

[0102] The active defense device for DDoS attacks provided by the present invention is described below. The active defense device for DDoS attacks described below and the active defense method for DDoS attacks described above can be referenced to each other.

[0103] Figure 2 FIG. 1 is a schematic diagram of the structure of the active defense device for DDoS attacks provided by the present invention. Figure 2 As shown, an active defense device for DDoS attacks according to an embodiment of the present invention includes:

[0104] The collection module 21 is used to collect real-time traffic information using edge nodes and extract feature vectors corresponding to the real-time traffic information;

[0105] A first detection module 22, configured to perform DDoS attack detection on the feature vector using a first detection model on the edge node to obtain a first detection result;

[0106] The second detection module 23 is used to detect the target feature vector corresponding to the abnormal traffic as the first detection result by using the second detection model on the cloud node to obtain a second detection result;

[0107] The defense module 24 is used to determine the degree of harm of the DDoS attack based on the second detection result, so as to generate a defense strategy based on the degree of harm and send it to the edge node for attack defense.

[0108] The active defense device for DDoS attacks also includes:

[0109] The second detection model is optimized based on the following steps:

[0110] Acquire a historical feature vector set cached on a cloud node, wherein the historical feature vector set includes a plurality of historical feature vectors;

[0111] Performing feature fusion on the target feature vector corresponding to the first detection result of abnormal traffic and the historical feature vector set to obtain a fused feature vector set;

[0112] Based on the fused feature vector set, training and optimization are performed to obtain the second detection model.

[0113] The active defense device for DDoS attacks further comprises: determining a number of features based on the target feature vector and the historical feature vector set;

[0114] Determining a weight of the target feature vector and a weight of any of the historical feature vectors;

[0115] Based on the number of features, the weight of the target feature vector and the weights of all the historical feature vectors, feature fusion is performed on the target feature vector and the historical feature vector set to obtain the fused feature vector set.

[0116] The defense module 24 is also used to:

[0117] Based on the second detection result, determine an attack feature vector, wherein the attack feature vector includes at least one or more of an attack type, an attack traffic size, and an important coefficient of an attacked service;

[0118] The attack feature vector is input into a preset harm degree analysis model to obtain the harm degree of the DDoS attack.

[0119] The defense module 24 is also used to:

[0120] Comparing the hazard level with a preset numerical threshold to obtain a comparison result;

[0121] Determine a defense strategy corresponding to the degree of harm based on the comparison result and the defense measure type, priority, and execution condition in each defense strategy stored on the cloud node;

[0122] The defense strategy corresponding to the degree of harm is sent to the edge node for attack defense.

[0123] The defense module 24 is also used to:

[0124] An acquisition module is used to obtain device status data of a DDoS monitoring device;

[0125] A first determination module is used to determine a defense strategy feature vector corresponding to the defense strategy, wherein the defense strategy feature vector includes at least one or more of a defense measure type, a priority, and an execution condition;

[0126] An input module, used to input the device status data and the defense strategy feature vector into a preset prediction model to obtain a defense effect prediction value output by the prediction model;

[0127] A second determination module is used to determine an actual defense effect value based on the device status data;

[0128] The optimization module is used to dynamically optimize the defense strategy in the cloud node based on the actual defense effect value and the defense effect prediction value.

[0129] The defense module 24 is also used to:

[0130] An edge node defense module, configured to defend against abnormal traffic in the first detection result based on a defense strategy stored in the edge node, wherein the defense strategy stored in the edge node is to periodically send the defense strategy to the edge node using the cloud node;

[0131] A defense success module, for if the defense is successful, there is no need to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result;

[0132] The return module is used to return to the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic whose first detection result is abnormal traffic if the defense fails or the amount of real-time traffic information exceeds the preset data threshold.

[0133] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0134] Figure 3 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 3 As shown, the electronic device may include: a processor 310, a memory 320, a communication interface 330 and a communication bus 340, wherein the processor 310, the memory 320 and the communication interface 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 320 to execute the active defense method for DDoS attacks.

[0135] In addition, the logic instructions in the above-mentioned memory 320 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0136] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the active defense method for DDoS attacks provided by the above methods.

[0137] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0138] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An active defense method for DDoS attacks, characterized in that: include: Using edge nodes to collect real-time traffic information, and extracting feature vectors corresponding to the real-time traffic information; Using a first detection model on the edge node, perform DDoS attack detection on the feature vector to obtain a first detection result; Using a second detection model on the cloud node, the target feature vector corresponding to the abnormal traffic as the first detection result is detected to obtain a second detection result; Based on the second detection result, determine the degree of harm of the DDoS attack, generate a defense strategy based on the degree of harm, and send it to the edge node for attack defense; The second detection model is optimized based on the following steps: Acquire a historical feature vector set cached on a cloud node, wherein the historical feature vector set includes a plurality of historical feature vectors; Performing feature fusion on the target feature vector corresponding to the first detection result of abnormal traffic and the historical feature vector set to obtain a fused feature vector set; Based on the fused feature vector set, training and optimizing to obtain the second detection model; The step of fusing the target feature vector corresponding to the first detection result of abnormal traffic with the historical feature vector set cached on the cloud node to obtain a fused feature vector includes: Determining the number of features based on the target feature vector and the historical feature vector set; Determining a weight of the target feature vector and a weight of any of the historical feature vectors; Based on the number of features, the weight of the target feature vector and the weights of all the historical feature vectors, performing feature fusion on the target feature vector and the historical feature vector set to obtain the fused feature vector set; The determining, based on the second detection result, the degree of harm of the DDoS attack includes: Based on the second detection result, determine an attack feature vector, wherein the attack feature vector includes at least one or more of an attack type, an attack traffic size, and an important coefficient of an attacked service; Inputting the attack feature vector into a preset harm degree analysis model to obtain the harm degree of the DDoS attack; The generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense includes: Comparing the hazard level with a preset numerical threshold to obtain a comparison result; Determine a defense strategy corresponding to the degree of harm based on the comparison result and the defense measure type, priority, and execution condition in each defense strategy stored on the cloud node; Sending a defense strategy corresponding to the degree of harm to the edge node for attack defense; After generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense, the method further includes: Obtain device status data of the DDoS monitoring device; Determine a defense strategy feature vector corresponding to the defense strategy, wherein the defense strategy feature vector includes at least one or more of a defense measure type, a priority, and an execution condition; Inputting the device status data and the defense strategy feature vector into a preset prediction model to obtain a defense effect prediction value output by the prediction model; Determine the actual defense effect value based on device status data; Dynamically optimize the defense strategy in the cloud node based on the actual defense effect value and the defense effect prediction value; After the first detection model on the edge node is used to perform DDoS attack detection on the feature vector and a first detection result is obtained, the method further includes: Based on the defense strategy stored in the edge node, defend against abnormal traffic in the first detection result, wherein the defense strategy stored in the edge node is to use the cloud node to periodically send the defense strategy to the edge node; If the defense is successful, there is no need to perform the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result; If the defense fails, or the amount of real-time traffic information exceeds the preset data threshold, the step of returning to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result.

2. An active defense device for DDoS attacks, characterized in that: include: A collection module, used to collect real-time traffic information using edge nodes, and extract feature vectors corresponding to the real-time traffic information; A first detection module, configured to perform DDoS attack detection on the feature vector using a first detection model on the edge node to obtain a first detection result; A second detection module is used to detect the target feature vector corresponding to the abnormal traffic as the first detection result by using the second detection model on the cloud node to obtain a second detection result; A defense module, configured to determine the degree of harm of the DDoS attack based on the second detection result, and to generate a defense strategy based on the degree of harm and send it to the edge node for attack defense; The second detection model is optimized based on the following steps: Acquire a historical feature vector set cached on a cloud node, wherein the historical feature vector set includes a plurality of historical feature vectors; Performing feature fusion on the target feature vector corresponding to the first detection result of abnormal traffic and the historical feature vector set to obtain a fused feature vector set; Based on the fused feature vector set, training and optimizing to obtain the second detection model; The step of fusing the target feature vector corresponding to the first detection result of abnormal traffic with the historical feature vector set cached on the cloud node to obtain a fused feature vector includes: Determining the number of features based on the target feature vector and the historical feature vector set; Determining a weight of the target feature vector and a weight of any of the historical feature vectors; Based on the number of features, the weight of the target feature vector and the weights of all the historical feature vectors, performing feature fusion on the target feature vector and the historical feature vector set to obtain the fused feature vector set; The determining, based on the second detection result, the degree of harm of the DDoS attack includes: Based on the second detection result, determine an attack feature vector, wherein the attack feature vector includes at least one or more of an attack type, an attack traffic size, and an important coefficient of an attacked service; Inputting the attack feature vector into a preset harm degree analysis model to obtain the harm degree of the DDoS attack; The generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense includes: Comparing the hazard level with a preset numerical threshold to obtain a comparison result; Determine a defense strategy corresponding to the degree of harm based on the comparison result and the defense measure type, priority, and execution condition in each defense strategy stored on the cloud node; Sending a defense strategy corresponding to the degree of harm to the edge node for attack defense; After generating a defense strategy based on the degree of harm and sending it to the edge node for attack defense, the method further includes: Obtain device status data of the DDoS monitoring device; Determine a defense strategy feature vector corresponding to the defense strategy, wherein the defense strategy feature vector includes at least one or more of a defense measure type, a priority, and an execution condition; Inputting the device status data and the defense strategy feature vector into a preset prediction model to obtain a defense effect prediction value output by the prediction model; Determine the actual defense effect value based on device status data; Dynamically optimize the defense strategy in the cloud node based on the actual defense effect value and the defense effect prediction value; After the first detection model on the edge node is used to perform DDoS attack detection on the feature vector and a first detection result is obtained, the method further includes: Based on the defense strategy stored in the edge node, defend against abnormal traffic in the first detection result, wherein the defense strategy stored in the edge node is to use the cloud node to periodically send the defense strategy to the edge node; If the defense is successful, there is no need to perform the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result; If the defense fails, or the amount of real-time traffic information exceeds the preset data threshold, the step of returning to execute the step of using the second detection model on the cloud node to detect the target feature vector corresponding to the abnormal traffic as the first detection result.

3. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the program, the active defense method against DDoS attacks as claimed in claim 1 is implemented.

4. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the active defense method against DDoS attacks as claimed in claim 1 is implemented.

Images