DDoS attack detection and mitigation method based on P4 programmable switch

Abstract

The present invention belongs to the technical field of network traffic monitoring, and specifically discloses a DDoS attack detection and mitigation method based on a P4 programmable switch, comprising the following steps: obtaining a network flow, and storing the network flow according to a multi-level Sketch data structure; calculating the normalized network traffic information entropy according to the source IP address of the network flow; determining the network state according to the normalized network traffic information entropy and a preset adaptive threshold, and determining the finite state machine state of each time window according to the network state, and executing the corresponding DDoS processing mechanism in each time window; wherein the time window is the time interval for obtaining the network flow, and the time window includes; determining the access control method for the network flow according to the network state. The present invention can improve the detection efficiency of abnormal traffic. It solves the problem of low efficiency in abnormal traffic detection in the prior art.

Description

Technical Field

[0001] The invention belongs to the technical field of network traffic monitoring, and in particular relates to a DDoS attack detection and mitigation method based on a P4 programmable switch. Background Art

[0002] As network traffic increases exponentially, services such as blockchain and large artificial intelligence models that rely on consumable resources such as computing power and network bandwidth are growing exponentially. Distributed Denial of Service (DDoS) attacks are one of the serious threats to current network stability. This attack method is initiated by many different infected hosts, sending a large amount of excess traffic to the victim and exhausting its network and computing resources, resulting in large-scale network service interruptions. Therefore, once a DDoS attack occurs, it may cause huge losses to enterprises, institutions, individuals and other parties. A common DDoS attack method is to use a large number of infected zombie machines to send seemingly legitimate traffic, which is enough to exhaust the bandwidth of the target network equipment and servers, causing service interruptions. Attackers may also send incomplete data packets, aiming to quickly consume the computing, storage and transmission resources of the target system.

[0003] Building a DDoS attack detection and mitigation method is the key to ensuring normal network services. The basis for building a DDoS attack detection and mitigation method is to design a solution that can detect DDoS attacks in a timely and accurate manner and achieve high-efficiency, low-overhead, and adaptive DDoS attack mitigation.

[0004] There are two main methods for detecting DDoS attacks: highly specialized hardware and software that is executed on a server. Detection methods based on highly specialized hardware have the disadvantages of high capital expenditures and operating costs. Software-based methods include using the traditional Simple Network Management Protocol (SNMP) and OpenFlow of Software Defined Network (SDN). Both detection methods require frequent communication between network services and network devices, and require the processing of monitoring data in the controller. Analyzing each transmitted data packet will incur a lot of overhead in transmitting, storing, and processing information related to the network status, which may cause network congestion or increase detection delays.

[0005] Solutions based on traditional SDN are difficult to meet the requirements of network speed and detection accuracy, latency and throughput. P4 (Programming Protocol-Independent Packet Processors) is a programming language used to control the packet forwarding plane in network devices such as routers and switches. The emergence of data plane programmable switches makes it possible to migrate DDoS attack detection to the switch itself using languages ​​such as P4. However, existing DDoS attack detection methods based on programmable switches have problems: general traffic detection requires reporting data to the control plane each time and performing calculations on the control plane, resulting in low communication and computing efficiency and heavy load; current DDoS attack solutions only focus on traffic statistics and ignore the decision-making value brought by the specific information of large flows.

[0006] Sketch is a hash-based data structure. By setting a hash function, key-value data with the same hash value is stored in the same bucket to reduce space overhead. The data value in the bucket is the measurement result, which is an approximation of the true value. The use of technologies such as opening up two-dimensional address space and multiple hashing can reduce hash conflicts and improve the accuracy of measurement results. Making full use of Sketch's features and applying them reasonably to network monitoring can effectively improve detection efficiency and network security protection performance. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the present invention provides a DDoS attack detection and mitigation method based on a P4 programmable switch, which solves the problem of low efficiency in detecting abnormal traffic in the prior art.

[0008] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a DDoS attack detection and mitigation method based on a P4 programmable switch, comprising the following steps:

[0009] S1. Obtain the network flow and store it according to the multi-level Sketch data structure;

[0010] S2. Calculate the normalized network traffic information entropy based on the source IP address of the network flow;

[0011] S3. Determine the network state according to the normalized network traffic information entropy and the preset adaptive threshold, determine the finite state machine state of each time window according to the network state, and execute the corresponding DDoS processing mechanism in each time window;

[0012] The time window is the time interval for obtaining network flow, and the time window includes indivual;

[0013] S4. Determine the access control method for the network flow according to the network status.

[0014] The beneficial effects of the above scheme are:

[0015] (1) The present invention can simplify the network architecture and reduce the cost of dedicated hardware. By completely entrusting the monitoring and calculation tasks of network traffic to the data plane of the programmable switch, the dedicated hardware cost can be significantly reduced. In this mode, the data plane not only performs its traditional forwarding function, but also assumes the responsibility of traffic monitoring and preliminary analysis. It can also simplify the network architecture, reduce the complexity and maintenance cost of the system, and thus maximize cost-effectiveness.

[0016] (2) The present invention can reduce communication requirements and system overhead. The computational tasks required to evaluate the network status through information entropy are fully integrated into the data plane, avoiding the switch from reporting the monitoring results to the controller every time and completing the information entropy calculation in the controller, thereby reducing the need for frequent communication between the two. Such division of labor can optimize network performance and improve response speed.

[0017] (3) The present invention can improve the accuracy, adaptability and scalability of DDoS attack detection and defense. It monitors network traffic through an innovative multi-level Sketch data structure and combines it with an adaptive threshold defense method. The method can dynamically adjust the detection standard according to the actual changes in network traffic, thereby ensuring the accuracy and adaptability of DDoS attack detection and mitigation.

[0018] (4) The present invention can make full use of Sketch traffic information. By designing a multi-level Sketch data structure for DDoS attack detection and defense tasks, the present invention can store network traffic information in Sketch while detecting DDoS attacks. Security managers can formulate corresponding DDoS attack mitigation strategies based on the traffic information stored in Sketch and the actual situation.

[0019] Furthermore, in step S1, the network flow is stored according to the multi-level Sketch data structure, specifically including:

[0020] S11. According to the multi-level Sketch data structure, the network flow is divided into large flow and small flow;

[0021] S12, using the Ostracism solution to downgrade the large flow that does not meet the preset large flow conditions to a small flow, and obtain the final large flow and the final small flow;

[0022] S13. Use a multi-level storage solution to store the final large flow, and use a multi-level counter to store the final small flow.

[0023] Furthermore, in step S13, a multi-level storage solution is used to store the final large stream, specifically including:

[0024] use A hash table is used to store, update and query the final large flow;

[0025] in, Hash tables correspond to hash functions, and The two hash functions are completely different;

[0026] Each hash table contains hash slots.

[0027] Furthermore, using The hash table updates the final large flow, including:

[0028] S131, obtaining the flow identification information of the final large flow;

[0029] S132. Determine the hash value of the final large flow according to the flow identification information;

[0030] S133, according to the hash value, use the preset position determination formula to determine the final large flow The storage location in the hash table;

[0031] The position determination formula is:

[0032]

[0033] in, Indicates The location information of the hash slots in the hash table, Represents a hash value, Indicates The number of hash slots in the hash table;

[0034] S134. When no data is stored in the storage location, the final large stream is stored in the storage location;

[0035] When data is stored in the storage location, and the flow identification information is the same as the flow identification information of the data stored in the storage location, updating the count value of the final large flow;

[0036] When data is stored in the storage location, and the flow identification information is different from the flow identification information of the data stored in the storage location, the count value of the final large flow is updated, and the storage location is updated.

[0037] Further, in step S134, updating the storage location specifically includes:

[0038] When the count value of the final large flow is less than the preset large flow condition, the storage location of the final large flow is updated to the next hash table of the storage location, or the storage location of the final large flow is updated to a multi-level counter;

[0039] When the final count value of the large flow is greater than or equal to the preset large flow condition, the storage location of the data stored in the storage location is updated to the next hash table of the storage location, or the data stored in the storage location is downgraded to a small flow for storage.

[0040] Furthermore, the data stored in the storage location is downgraded to a small stream for storage, specifically including:

[0041] S1341, mapping and sampling the data stored in the storage location;

[0042] S1342. Record and store the data stored in the storage location according to the mapping sampling.

[0043] The beneficial effect of the above further scheme is: designing a "multi-level Sketch" data structure, distinguishing and recording large flows and small flows in network traffic, and processing large flows and small flows differently. Through precise traffic monitoring, the detection accuracy of DDoS attacks is significantly improved, and the false alarm and missed alarm rate is effectively reduced, thereby ensuring the service quality of the network.

[0044] Furthermore, step S2 specifically includes:

[0045] S21. Obtain the number of packets of the network flow within any time window;

[0046] S22, obtaining the source IP address;

[0047] S23, according to the number of data packets and the source IP address, and using the flow information entropy calculation formula, determine the flow information entropy within any time window;

[0048] The calculation formula of traffic information entropy is:

[0049]

[0050] in, represents the traffic information entropy, Indicates the number of packets in the data flow within the current time window. represents the entropy norm calculated based on the size of the data stream;

[0051] S24, calculating normalized network traffic information entropy according to the traffic information entropy and using a normalized information entropy calculation formula;

[0052] The default normalized information entropy calculation formula is:

[0053]

[0054] in, represents the normalized network traffic information entropy, Indicates the number of data flows in the current time window. Indicates the traffic information entropy in the current time window.

[0055] The beneficial effect of the above further solution is that during the detection process, possible fluctuations of the network over time can be taken into account to a great extent. In order to reduce false alarms caused by using fixed thresholds in a dynamic environment, dynamic thresholds are used to monitor network traffic.

[0056] Further, in step S3, the network status is respectively The network status of a time window is determined based on the normalized network traffic information entropy and the preset adaptive threshold, including:

[0057] S31. According to a preset exponentially weighted moving average formula and a preset exponentially weighted moving average error formula, obtain an exponentially weighted moving average and an exponentially weighted moving average error of normalized network traffic information entropy of at least two time windows;

[0058] The default exponentially weighted moving average formula is:

[0059]

[0060] in, Indicates The exponentially weighted moving average of the time window, Indicates Normalized network traffic information entropy of time windows, represents the smoothing factor, Indicates Exponentially weighted moving average of time windows;

[0061] The preset exponentially weighted moving average error formula is:

[0062]

[0063] in, Indicates The exponentially weighted moving average error in the time window, express The exponentially weighted moving average of the time window, Indicates Normalized network traffic information entropy of time windows, represents the smoothing factor, Indicates The exponentially weighted moving average error of the time window;

[0064] S32, determining a preset adaptive threshold value according to the exponentially weighted moving average and the exponentially weighted moving average error;

[0065] S33, when The normalized network traffic information entropy of the time window is greater than that of the When the preset adaptive threshold of the time window is The network status of the time window is attacked, and the The preset adaptive threshold of a time window is adjusted according to the preset first threshold adjustment formula;

[0066] The preset first threshold adjustment formula is:

[0067]

[0068] in, Indicates The preset adaptive threshold of the time window, Indicates The exponentially weighted moving average of the time window, Indicates The exponentially weighted moving average error in the time window, represents the sensitivity coefficient;

[0069] When The normalized network traffic information entropy of the time window is less than or equal to the When the preset adaptive threshold of the time window is The network status of the time window is not attacked, and the The preset adaptive threshold of a time window is adjusted according to the preset second threshold adjustment formula;

[0070] The preset second threshold adjustment formula is:

[0071]

[0072] in, Indicates The preset adaptive threshold of the time window, Indicates Preset adaptive threshold for each time window.

[0073] Further, in step S3, the finite state machine state includes a security state, an attack defense state, and a defense cooling state, and the DDoS processing mechanism includes maintaining a security state and a defense state;

[0074] The finite state machine state of the first time window is a safe state, and the DDoS processing mechanism of the first time window is a safe state;

[0075] According to the network status, the finite state machine state of each time window is determined, and the corresponding DDoS processing mechanism is executed in each time window, including:

[0076] When When the network status of the time window is not attacked, determine the The finite state machine state of the time window is a safe state, and the DDoS processing mechanism executed is to maintain the safe state;

[0077] When When the network status of the time window is under attack, determine the The finite state machine state of the time window is the attack defense state, the DDoS processing mechanism executed is the defense state, and the The finite state machine state of the time window is the defense cooling state;

[0078] When When the network status in the first time window is under attack, the DDoS processing mechanism executed is in defense status; when the When the network status of the time window is not attacked, determine the The finite state machine state of the time window is a safe state, and the DDoS processing mechanism executed is to maintain the safe state.

[0079] The beneficial effect of the above further scheme is that it can be combined with the defense method, dynamically adjust the detection standard according to the actual changes in network traffic, and ensure the accuracy and adaptability of DDoS attack detection and mitigation.

[0080] Further, step S4 specifically includes:

[0081] S41, setting the priority of the network flow;

[0082] S42, after the time window ends, back up the network flow to obtain backup data;

[0083] S43. Design an access control list according to the priority and network status;

[0084] S44. Determine the access control method of the network flow according to the access control list.

[0085] The beneficial effect of the above further solution is that the access control table can be further designed according to the priority of the network flow, and different flow controls can be implemented for network flows of different priorities, thereby improving the operability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 A flowchart of a DDoS attack detection and mitigation method based on a P4 programmable switch;

[0087] Figure 2 It is a schematic diagram of the storage of large and small flows in a multi-level Sketch data structure;

[0088] Figure 3 Schematic diagram of the process of calculating normalized network traffic information entropy;

[0089] Figure 4 This is a state transition diagram of a finite state machine. DETAILED DESCRIPTION

[0090] Now, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the accompanying drawings are only exemplary and are intended to explain the principles and spirit of the present invention, rather than to limit the scope of the present invention.

[0091] Example 1

[0092] like Figure 1 As shown, a DDoS attack detection and mitigation method based on a P4 programmable switch includes the following steps:

[0093] S1. Obtain the network flow and store it according to the multi-level Sketch data structure.

[0094] In this embodiment, in step S1, the network flow is stored according to the multi-level Sketch data structure, specifically including:

[0095] S11. According to the multi-level Sketch data structure, the network flow is divided into large flow and small flow;

[0096] S12, using the Ostracism solution to downgrade the large flow that does not meet the preset large flow conditions to a small flow, and obtain the final large flow and the final small flow;

[0097] S13. Use a multi-level storage solution to store the final large flow, and use a multi-level counter to store the final small flow.

[0098] In this embodiment, in step S13, a multi-level storage solution is used to store the final large stream, specifically including:

[0099] use A hash table is used to store, update and query the final large flow;

[0100] in, Hash tables correspond to hash functions, and The two hash functions are completely different;

[0101] Each hash table contains hash slots.

[0102] For example, according to the multi-level Sketch data structure, the network flow is divided into large flows (i.e., fine-grained parts) and small flows (i.e., coarse-grained parts) for separate storage. For example, considering the proportion of different flows in the network, a multi-level storage solution can be designed for large flows, and the Ostracism solution can be used to downgrade or expel large flows that do not meet the conditions to the small flow part. The Sketch data structure that can be used for small flows is a mapping mechanism that uses the PCSA method for flow cardinality measurement. The expelled flow information is stored in The decrement ratio is stored in a multi-stage counter.

[0103] For example, Figure 2 As shown, Figure 2 The following is a schematic diagram of the storage of large and small flows in a multi-level Sketch data structure. Figure 2 In the fine-grained part, L hash tables are used to track the flows that occupy a large amount of bandwidth. Each hash table uses a different hash function. Each bucket can store a flow ID ( ), positive and negative count values. Positive records the number of packets belonging to the current flow, while negative records the number of other packets.

[0104] Moreover, when the positive or negative is greater than or equal to the preset large flow condition, the current flow will be downgraded or expelled to the coarse-grained part; the coarse-grained part adopts the mapping mechanism of the flow cardinality measurement method PCSA to degrade the expelled flow. The decreasing ratio is stored in a multi-level counter to handle small flows. The i-th level stores the flow Specifically, each data packet of any flow can be The probability of is mapped to the i-th layer, then the i-th layer will be expected to record ( N is the total number of packets) packets.

[0105] This method allows the coarse-grained part to estimate the size of large and small flows with less memory usage.

[0106] In this embodiment, use The hash table updates the final large flow, including:

[0107] S131, obtaining the flow identification information of the final large flow;

[0108] S132. Determine the hash value of the final large flow according to the flow identification information;

[0109] S133, according to the hash value, use the preset position determination formula to determine the final large flow The storage location in the hash table;

[0110] The position determination formula is:

[0111]

[0112] in, Indicates The location information of the hash slots in the hash table, Represents a hash value, Indicates The number of hash slots in the hash table;

[0113] S134. When no data is stored in the storage location, the final large stream is stored in the storage location;

[0114] When data is stored in the storage location, and the flow identification information is the same as the flow identification information of the data stored in the storage location, updating the count value of the final large flow;

[0115] When data is stored in the storage location, and the flow identification information is different from the flow identification information of the data stored in the storage location, the count value of the final large flow is updated, and the storage location is updated.

[0116] In this embodiment, in step S134, updating the storage location specifically includes:

[0117] When the count value of the final large flow is less than the preset large flow condition, the storage location of the final large flow is updated to the next hash table of the storage location, or the storage location of the final large flow is updated to a multi-level counter;

[0118] When the final count value of the large flow is greater than or equal to the preset large flow condition, the storage location of the data stored in the storage location is updated to the next hash table of the storage location, or the data stored in the storage location is downgraded to a small flow for storage.

[0119] In this embodiment, the data stored in the storage location is downgraded to a small stream for storage, specifically including:

[0120] S1341, mapping and sampling the data stored in the storage location;

[0121] S1342. Record and store the data stored in the storage location according to the mapping sampling.

[0122] For example, this embodiment can continue to combine Figure 2 To analyze, Figure 2 In, use The following steps can be used to update and query the final large flow using a hash table:

[0123] 1) Update operation (UPDATE_ML): Given a stream ID The data packet uses the hash function to calculate the hash value according to the flow ID to confirm the position of the bucket in the i-th level hash table of the fine-grained part, that is, ,in, Indicates The location information of the hash slots in the hash table, Represents a hash value, Indicates The number of hash slots in the hash table. Update operations can include:

[0124] ①When the bucket is empty, insert ( , 1, 0);

[0125] ②When bucket is not empty, assume that there is ( , 1, 0). If the stream ID ( ) and the stream ID in the bucket ( ) are the same, then positive increases by 1; if the flow ID ( ) is different from the stream ID in the bucket, after updating positive, and , To preset large flow conditions, the flow is inserted into the next level or into the coarse-grained part. , evict the current stream in the bucket ( ) to the next level or coarse-grained part, bucket is set to ( , 1, 1).

[0126] Optionally, if the evicted flow is inserted into the next level or coarse-grained part, the next level iterates and executes step ②, or the coarse-grained part counter calculates the corresponding counter specific to the evicted flow add .

[0127] ③ If the stream 𝑓 is not inserted into the fine-grained part, execute the coarse-grained part step (i) mapping sampling and step (ii) recording. As shown below:

[0128] (i) Mapping sampling: For each packet , through the hash function H calculate:

[0129]

[0130] calculate Get data packet The number of mapped layers, returned in binary form The position of the first 1 from the right (such as ),Regulation This method allows each data packet to be The probability of mapping to the logistic i Layers (logical layers d-1 to d+n-2 correspond to physical layers 0 to n-1. Therefore, packets The condition for successful mapping sampling is d-1≤i≤d+n-2, and the number of physical layers mapped to Sketch is j=i-d+1)

[0131] (ii) Record: If the data packet If the sampling is successful, it will be mapped to the physical layer j, according to the data packet The label f ​​of the flow to which it belongs is calculated Get its index at layer j, corresponding to the position calculator Because the data packet is The probability of being mapped to the jth layer, then the update operation will return the estimated value of the flow f given by this layer .

[0132] Exemplarily, the query operation (QUERY_ML) may include: given a flow ID, if the flow does not exist in the fine-grained part, the coarse-grained part returns its flow size and other information. If the flow exists in the l-th level hash table of the fine-grained part, find out whether the flow exists in the l-th level and later coarse-grained part Sketch, and return the sum of all these hash tables. In the coarse-grained part Sketch, for any flow f, use the n+1-level array to query and return the estimated value of flow f. For each level counter j, calculate ,use As the estimated value of the size of flow f at the jth layer, finally, take the minimum value of the estimated value of the n+1 layer As the coarse-grained part Sketch estimates the size of the flow f, namely:

[0133] .

[0134] The accuracy analysis of the multi-level Sketch in this embodiment is as follows: When the coarse-grained part is the same as a coarse-grained part Sketch, all the flows of the fine-grained part are inserted into the coarse-grained part, and the result obtained is equal to the result recorded using the coarse-grained part Sketch. The process of inserting the flows in the fine-grained part into the coarse-grained part is equivalent to re-capturing these flows using the coarse-grained part Sketch after sorting the flows, and according to the update method of the coarse-grained part Sketch, it will not affect the update result of the coarse-grained part Sketch.

[0135] S2. Calculate the normalized network traffic information entropy based on the source IP address of the network flow.

[0136] In this embodiment, step S2 specifically includes:

[0137] S21. Obtain the number of packets of the network flow within any time window;

[0138] S22, obtaining the source IP address;

[0139] S23, according to the number of data packets and the source IP address, and using the flow information entropy calculation formula, determine the flow information entropy within any time window;

[0140] The calculation formula of traffic information entropy is:

[0141]

[0142] in, represents the traffic information entropy, Indicates the number of packets in the data flow within the current time window. represents the entropy norm calculated based on the size of the data stream;

[0143] S24, calculating normalized network traffic information entropy according to the traffic information entropy and using a normalized information entropy calculation formula;

[0144] The default normalized information entropy calculation formula is:

[0145]

[0146] in, represents the normalized network traffic information entropy, Indicates the number of data flows in the current time window. Indicates the traffic information entropy in the current time window.

[0147] For example, within a time window, the data plane counts the number of packets in the flow , using the source IP address As the stream ID ( ), update the "Multi-level Sketch" and HyperLogLog algorithm registers. At the end of the time window, use the values ​​in the "Multi-level Sketch" and HyperLogLog algorithm registers for further calculations to calculate the Time windows Traffic information entropy on and normalized information entropy . Use normalized information entropy to characterize the network in a time window ( ) within the traffic statistics characteristics.

[0148] For example, Figure 3 As shown, Figure 3 Figure 1 is a flow chart for calculating the normalized network traffic information entropy. Figure 3 In the time window within, flow have packets and n different flows, where each flow is of size , then Shannon entropy can be defined as:

[0149]

[0150] Calculate the entropy norm based on the size of the flow Can be:

[0151]

[0152] Integrating the above formula, the calculation formula of Shannon entropy can be adjusted to:

[0153]

[0154] Since the P4 language does not support division operations, Expressed as , the calculation formula of Shannon entropy can be further expressed as:

[0155]

[0156] Normalized information entropy can be expressed as:

[0157]

[0158] After eliminating the division operation, the normalized information entropy can be expressed as:

[0159]

[0160] Therefore, according to the Time windows Traffic information entropy on and normalized traffic information entropy The derivation results show that when P4 language is used on the data plane to complete logarithmic operations, the traffic information entropy can be calculated based on Sketch and HyperLogLog data.

[0161] S3. Determine the network state according to the normalized network traffic information entropy and the preset adaptive threshold, and determine the finite state machine state of each time window according to the network state, and execute the corresponding DDoS processing mechanism in each time window; wherein the time window is the time interval for obtaining the network flow, and the time window includes indivual.

[0162] In this embodiment, in step S3, the network status is The network status of a time window is determined based on the normalized network traffic information entropy and the preset adaptive threshold, including:

[0163] S31. According to a preset exponentially weighted moving average formula and a preset exponentially weighted moving average error formula, obtain an exponentially weighted moving average and an exponentially weighted moving average error of normalized network traffic information entropy of at least two time windows;

[0164] The default exponentially weighted moving average formula is:

[0165]

[0166] in, Indicates The exponentially weighted moving average of the time window, Indicates Normalized network traffic information entropy of time windows, represents the smoothing factor, Indicates Exponentially weighted moving average of time windows;

[0167] The preset exponentially weighted moving average error formula is:

[0168]

[0169] in, Indicates The exponentially weighted moving average error in the time window, express The exponentially weighted moving average of the time window, Indicates Normalized network traffic information entropy of time windows, represents the smoothing factor, Indicates The exponentially weighted moving average error of the time window;

[0170] S32, determining a preset adaptive threshold value according to the exponentially weighted moving average and the exponentially weighted moving average error;

[0171] S33, when The normalized network traffic information entropy of the time window is greater than that of the When the preset adaptive threshold of the time window is The network status of the time window is attacked, and the The preset adaptive threshold of a time window is adjusted according to the preset first threshold adjustment formula;

[0172] The preset first threshold adjustment formula is:

[0173]

[0174] in, Indicates The preset adaptive threshold of the time window, Indicates The exponentially weighted moving average of the time window, Indicates The exponentially weighted moving average error in the time window, represents the sensitivity coefficient;

[0175] When The normalized network traffic information entropy of the time window is less than or equal to the When the preset adaptive threshold of the time window is The network status of the time window is not attacked, and the The preset adaptive threshold of a time window is adjusted according to the preset second threshold adjustment formula;

[0176] The preset second threshold adjustment formula is:

[0177]

[0178] in, Indicates The preset adaptive threshold of the time window, Indicates Preset adaptive threshold for each time window.

[0179] In this embodiment, in step S3, the finite state machine state includes a security state, an attack defense state, and a defense cooling state, and the DDoS processing mechanism includes maintaining a security state and a defense state;

[0180] The finite state machine state of the first time window is a safe state, and the DDoS processing mechanism of the first time window is a safe state;

[0181] According to the network status, the finite state machine state of each time window is determined, and the corresponding DDoS processing mechanism is executed in each time window, including:

[0182] When When the network status of the time window is not attacked, determine the The finite state machine state of the time window is a safe state, and the DDoS processing mechanism executed is to maintain the safe state;

[0183] When When the network status of the time window is under attack, determine the The finite state machine state of the time window is the attack defense state, the DDoS processing mechanism executed is the defense state, and the The finite state machine state of the time window is the defense cooling state;

[0184] When When the network status in the first time window is under attack, the DDoS processing mechanism executed is in defense status; when the When the network status of the time window is not attacked, determine the The finite state machine state of the time window is a safe state, and the DDoS processing mechanism executed is to maintain the safe state.

[0185] For example, Figure 4 As shown, Figure 4 This is a state transition diagram of a finite state machine. Figure 4 In the , when no alarm occurs, the network is considered safe; otherwise, the network is under DDoS attack. The network state is modeled as a finite state machine to control the detection mechanism. After the time window ends, the finite state machine is updated according to the network state. The network state starts from the safe state (SAFE). If no alarm occurs at the end of the time window, the safe state is maintained; otherwise, it is converted to the attack defense state (ATTACK DEFENSE). In the attack defense phase (ATTACK DEFENSE), the DDoS attack defense mechanism will be executed until the alarm is lifted, and then it will be converted to the defense cooling phase (DEFENSE COOLDOWN). In the defense cooling phase (DEFENSE COOLDOWN), the DDoS attack defense mechanism will continue to be executed. If no alarm occurs in this phase, it will be converted to the safe state (SAFE); otherwise, it will return to the attack defense phase (ATTACK DEFENSE). This mechanism design avoids premature defense degradation.

[0186] S4. Determine the access control method for the network flow according to the network status.

[0187] In this embodiment, step S4 specifically includes:

[0188] S41, setting the priority of the network flow;

[0189] S42, after the time window ends, back up the network flow to obtain backup data;

[0190] S43. Design an access control list according to the priority and network status;

[0191] S44. Determine the access control method of the network flow according to the access control list.

[0192] Exemplarily, during the attack defense and defense cooling stages, an access control mechanism for network traffic is designed to filter attack traffic while ensuring normal access to benign traffic.

[0193] For example, according to the "multi-level Sketch" update method, large flows are stored in the fine-grained part, and the hash table with a lower priority has a larger proportion of the traffic stored in the network; small flows are stored in the hash table with a higher priority or in the coarse-grained part to store calculation data. At the end, the fine-grained part of the "multi-level Sketch" is backed up, and the access control table is designed by comprehensively considering the network status. Different tags are given to the data packets of the data flows stored in the hash tables of different priorities. After the data packets are marked, the network administrator can take different security actions according to the access control policy, such as limiting the access of attack or suspicious traffic, and controlling the access of normal traffic of different priorities.

[0194] Example 2

[0195] A DDoS attack detection and mitigation system based on a P4 programmable switch, comprising:

[0196] The multi-level Sketch distribution module is used to obtain network flows and store them according to the multi-level Sketch data structure;

[0197] A normalized information entropy calculation module is used to calculate the normalized network traffic information entropy according to the source IP address of the network flow;

[0198] The DDoS adaptive threshold attack detection module is used to determine the network state according to the normalized network traffic information entropy and the preset adaptive threshold, and determine the finite state machine state of each time window according to the network state, and execute the corresponding DDoS processing mechanism in each time window; wherein the time window is the time interval for obtaining the network flow, and the time window includes indivual;

[0199] The DDoS attack mitigation module is used to determine the access control method for the network flow according to the network status.

[0200] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A DDoS attack detection and mitigation method based on a P4 programmable switch, characterized in that: The method comprises: S1. Obtaining a network flow, and storing the network flow according to a multi-level Sketch data structure; S2. Calculate the normalized network traffic information entropy according to the source IP address of the network flow; S3. Determine the network state according to the normalized network traffic information entropy and the preset adaptive threshold, determine the finite state machine state of each time window according to the network state, and execute the corresponding DDoS processing mechanism in each time window; Wherein, the time window is a time interval for obtaining the network flow, and the time window includes k, k≥2; In step S3, the network status are respectively The network state of a time window is determined according to the normalized network traffic information entropy and a preset adaptive threshold, specifically including: S31. According to a preset exponentially weighted moving average formula and a preset exponentially weighted moving average error formula, obtain an exponentially weighted moving average and an exponentially weighted moving average error of the normalized network traffic information entropy of the at least two time windows; The preset exponentially weighted moving average formula is: in, Indicates The exponentially weighted moving average of the time window, Indicates Normalized network traffic information entropy of time windows, represents the smoothing factor, Indicates Exponentially weighted moving average of time windows; The preset exponentially weighted moving average error formula is: in, Indicates The exponentially weighted moving average error in the time window, express The exponentially weighted moving average of the time window, Indicates Normalized network traffic information entropy of time windows, represents the smoothing factor, Indicates The exponentially weighted moving average error of the time window; S32, determining the preset adaptive threshold value according to the exponentially weighted moving average and the exponentially weighted moving average error; S33, when the The normalized network traffic information entropy of the time window is greater than the When the preset adaptive threshold of the time window is The network state of the time window is the attacked state, and the The preset adaptive threshold of a time window is adjusted according to the preset first threshold adjustment formula; The preset first threshold adjustment formula is: in, Indicates The preset adaptive threshold of the time window, Indicates The exponentially weighted moving average of the time window, Indicates The exponentially weighted moving average error in the time window, represents the sensitivity coefficient; When the The normalized network traffic information entropy of the time window is less than or equal to the When the preset adaptive threshold of the time window is The network status of the time window is not attacked, and the The preset adaptive threshold of a time window is adjusted according to the preset second threshold adjustment formula; The preset second threshold adjustment formula is: in, Indicates The preset adaptive threshold of the time window, Indicates Preset adaptive thresholds for time windows; S4. Determine an access control method for the network flow according to the network status.

2. The method according to claim 1, characterized in that In the step S1, storing the network flow according to the multi-level Sketch data structure specifically includes: S11, dividing the network flow into large flow and small flow according to the multi-level Sketch data structure; S12, using the Ostracism solution to downgrade the large flow that does not meet the preset large flow conditions to a small flow, and obtain the final large flow and the final small flow; S13. Use a multi-level storage solution to store the final large flow, and use a multi-level counter to store the final small flow.

3. The method according to claim 2, characterized in that In step S13, the use of a multi-level storage solution to store the final large stream specifically includes: use A hash table is used to store, update and query the final large flow; in, Hash tables correspond to hash function, and the The two hash functions are completely different; Each of the hash tables includes hash slots.

4. The method according to claim 3, characterized in that The use A hash table is used to update the final large flow, specifically including: S131, obtaining flow identification information of the final large flow; S132. Determine a hash value of the final large flow according to the flow identification information; S133, according to the hash value, using a preset position determination formula, determine the final large flow in the The storage location in the hash table; The position determination formula is: in, Indicates The location information of the hash slots in the hash table, Represents a hash value, Indicates The number of hash slots in the hash table; S134. When no data is stored in the storage location, storing the final large stream in the storage location; When data is stored in the storage location, and the flow identification information is the same as the flow identification information of the data stored in the storage location, updating the count value of the final large flow; When data is stored in the storage location, and the flow identification information is different from the flow identification information of the data stored in the storage location, the count value of the final large flow is updated, and the storage location is updated.

5. The method according to claim 4, characterized in that In step S134, updating the storage location specifically includes: When the count value of the final large flow is less than the preset large flow condition, the storage location of the final large flow is updated to the next hash table of the storage location, or the storage location of the final large flow is updated to the multi-stage counter; When the final count value of the large flow is greater than or equal to the preset large flow condition, the storage location of the data stored in the storage location is updated to the next hash table of the storage location, or the data stored in the storage location is downgraded to a small flow for storage.

6. The method according to claim 5, characterized in that Degrading the data stored in the storage location into a small stream for storage specifically includes: S1341, mapping and sampling the data stored in the storage location; S1342. Record and store the data stored in the storage location according to the mapping sampling.

7. The method according to claim 1, characterized in that The step S2 specifically includes: S21. Obtain the number of data packets of the network flow within any time window; S22, obtaining the source IP address; S23, according to the number of packets and the source IP address, and using the flow information entropy calculation formula, determine the flow information entropy within the arbitrary time window; The flow information entropy calculation formula is: in, represents the traffic information entropy, Indicates the number of packets in the data flow within the current time window. represents the entropy norm calculated based on the size of the data stream; S24. Calculate normalized network traffic information entropy based on the traffic information entropy and using a normalized information entropy calculation formula; The normalized information entropy calculation formula is: in, represents the normalized network traffic information entropy, Indicates the number of data flows in the current time window. Indicates the traffic information entropy in the current time window.

8. The method according to claim 1, characterized in that In step S3, the finite state machine state includes a security state, an attack defense state, and a defense cooling state, and the DDoS processing mechanism includes maintaining a security state and a defense state; The finite state machine state of the first time window is a safe state, and the DDoS processing mechanism of the first time window is a safe state; Determining the finite state machine state of each time window according to the network state, and executing the corresponding DDoS processing mechanism in each time window, specifically includes: When When the network status of the time window is not attacked, determine the The finite state machine state of the time window is a safe state, and the DDoS processing mechanism executed is to maintain the safe state; When When the network state of the first time window is in the attacked state, determine the The finite state machine state of the time window is the attack defense state, the DDoS processing mechanism executed is the defense state, and the The finite state machine state of the time window is the defense cooling state; When the When the network state in the first time window is in the attacked state, the DDoS processing mechanism executed is in the defensive state; when the first When the network status of the time window is not attacked, determine the The finite state machine state of the time window is a safe state, and the DDoS processing mechanism executed is to maintain the safe state.

9. The method according to claim 8, characterized in that The step S4 specifically includes: S41, setting the priority of the network flow; S42, after the time window ends, back up the network flow to obtain backup data; S43, designing an access control table according to the priority and the network status; S44. Determine the access control mode of the network flow according to the access control table.

Images