An abnormal flow detection method under DDoS attack

Abstract

The application discloses an abnormal flow detection method under DDoS attack, utilizes a data structure combined by CM Sketch, Bloom Filter and a hash table, counts the number of different source IPs corresponding to each destination IP, distinguishes normal flow and potential DDoS attack targets, the design greatly reduces memory occupation, and meanwhile, high accuracy is maintained; in addition, the application also considers IP storage of data packets, and realizes specific identification and storage of DDoS flow on a programmable switch, and excellent flexibility and scalability are exhibited.

Description

Technical Field

[0001] This invention belongs to the field of network measurement technology, and more specifically, relates to a method for detecting abnormal traffic under DDoS attacks. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks are one of the most significant threats to modern networks. By manipulating massive amounts of internet traffic, they exhaust the network resources of the attacked network, posing a serious threat to both legitimate users and network operators. With the increasing number of internet-based services, the harm caused by DDoS attacks has become increasingly severe. Therefore, methods for detecting and identifying DDoS attacks have attracted widespread attention in order to effectively combat this type of attack.

[0003] Several technologies are currently available for detecting DDoS traffic. Traditional methods primarily rely on detecting anomalies in the state of each flow, but this often struggles to balance accuracy and scalability in high-speed networks. Another sketch-based measurement method maintains a counter to count the fan-out of traffic for each source-destination address pair. While it offers some accuracy, it can lead to high memory consumption and significant access overhead. Therefore, an effective method needs to strike a balance between memory consumption and accuracy, while maintaining good scalability.

[0004] In recent years, the development of programmable networks has provided new possibilities for abnormal traffic measurement. However, most current detection methods are executed at the controller level, requiring the controller to periodically collect traffic information from network devices to monitor network status. This not only increases network communication overhead but also causes detection latency and reduces detection performance. Furthermore, many DDoS attacks utilize IP address spoofing, forging the victim's IP address to send requests to the server, making tracing the source IP of the DDoS attack often ineffective and difficult to respond to effectively. To address these issues, this paper leverages the advantages of programmable switches to perform detection at the switch level, improving detection flexibility. Simultaneously, it incorporates efficient data structures such as sketch to collect statistical data, thereby saving memory usage. This approach aims to overcome the bottlenecks of traditional methods, making DDoS attack detection more efficient, accurate, and scalable. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for detecting abnormal traffic under DDoS attacks. It utilizes a combined data structure to achieve accurate counting and statistics of network flows, reducing memory resource consumption. At the same time, it writes the IP addresses of suspicious DDoS attacks into a hash table, which has significant advantages in terms of flexibility and scalability.

[0006] To achieve the above-mentioned objective, the present invention provides a method for detecting abnormal traffic under a DDoS attack, characterized by comprising the following steps:

[0007] (1) Deploy data structures on the switch;

[0008] (1.1) Deploy a Bloom Filter structure on the switch;

[0009] The Bloom Filter structure consists of A binary array of bits and It consists of several different unbiased hash functions; each bit of the binary array is numbered 0~ ; Each of the unbiased hash functions has a distinct structure, denoted as _____. Each hash function calculates a hash value of [0, ... The integers within the range are corresponding one-to-one with the bit numbers of the binary array;

[0010] (1.2) Deploy a hash structure on the switch;

[0011] A hash structure contains a hash function. and associated hash function A hash table; a hash table contains Each bucket is numbered 0~ Each bucket contains two fields: one for storing the IP address of the data packet. Another field is used to store The count values ​​corresponding to different source addresses;

[0012] (1.3) Deploy a minimum count sketch structure on the switch;

[0013] Minimum count sketch structure is composed of hash functions and It consists of several counters; the minimum count sketch is as follows: OK Column structure, each row has There are several counters, numbered sequentially from left to right. ; A sketch of min-counting corresponding to each hash function. Okay, and hash functions They are independent of each other, and the hash value calculated by each hash function is in the range [0, ... The integer within ] and Each counter number corresponds to one;

[0014] (2) DDoS traffic statistics based on data structures;

[0015] (2.1) Initialize the data structure;

[0016] Before the measurement begins, initialize the binary array in the Bloom Filter structure. The value of the bit is 0, the count value of the second field of each bucket in the hash table in the initialization hash structure is 0, and the count value of each counter in the minimum count sketch structure is 0.

[0017] (2.2) Set the timer, with an initial value of 0, to time the time when the switch starts and stops receiving data packets;

[0018] (2.3) When the timer starts, when the data packet arrives at the switch, it first passes through the Bloom Filter structure to extract the source IP address of the data packet. and destination IP address Then combine them into source and destination IP pairs. Then through an unbiased hash function The mapping is performed, where each hash function maps the source and destination IP pairs to a position in a binary array, totaling... At each position, then read... The value at each position, if If not all values ​​are 1, meaning there are 0s, it indicates that the source and destination IPs are not all equal. The first arrival will If the value of each position is set to 1, then proceed to step (2.3); otherwise, the switch discards the data packet and continues to receive the next data packet, then repeats step (2.2).

[0019] (2.3) Pair the source and destination IP addresses of the data packets. Input a hash structure to extract the destination IP address of the data packet. And used as a hash function The input is hashed to obtain the hash value. ;

[0020] hash value The hash table is used as an index for each bucket to query the hash table, find the corresponding bucket number, and then read the IP address of the bucket in the first field. If the read IP address is the same as the destination IP address of the data packet, it means that the hash table already stores the same IP address. The count value of the second field of the bucket is incremented by 1, the counting ends, and the next data packet is received, returning to step (2.2). If the read IP address is empty or the read IP address is not the same as the destination IP address of the data packet, it means that the query failed, and step (2.4) is performed.

[0021] (2.4) Pair the source and destination IP addresses of the data packets. Input a minimum count sketch structure and extract the destination IP address of the data packet. And respectively used as hash functions The input is hashed to obtain the hash value. ;

[0022] hash value As an index, the counter corresponding to each row in the minimum count sketch is retrieved, and then the count value of each counter is read and denoted as... ;

[0023] Reading Select the minimum value from the count values. The minimum value is the number of different source IPs that the destination IP connects to. ;

[0024] Minimum value With preset threshold In comparison, if If the data packet is received correctly, the switch discards it and continues to receive the next data packet, then returns to step (2.2); otherwise, it uses the hash value calculated in step (2.3). Find the corresponding bucket for the index, then write the destination IP address of the data packet into the first field of the bucket, increment the count value of the second field of the bucket by 1, end the statistics, continue to receive the next data packet, and return to step (2.2).

[0025] (3) Detection of abnormal traffic under DDoS attack;

[0026] When the timer reaches its end time, the destination IP addresses stored in the hash table of the hash structure are counted. Each destination IP is a victim IP under a DDoS attack, and its corresponding data packet is an abnormal data packet.

[0027] The objective of this invention is achieved as follows:

[0028] This invention discloses a method for detecting abnormal traffic under DDoS attacks. It utilizes a data structure combining CM Sketch, Bloom Filter, and hash table to count the number of different source IPs corresponding to each destination IP, thus distinguishing normal traffic from potential DDoS attack targets. This design not only significantly reduces memory usage but also maintains high accuracy. Furthermore, the invention addresses the IP storage issue of data packets and implements the specific identification and storage of DDoS traffic on a programmable switch, demonstrating excellent flexibility and scalability. Attached Figure Description

[0029] Figure 1 is a schematic diagram of the DDoS problem model.

[0030] Figure 2 This is a flowchart of an abnormal traffic detection method under a DDoS attack according to the present invention.

[0031] Figure 3 This is a diagram illustrating the process of a Bloom Filter structure processing data packets.

[0032] Figure 4 This is a schematic diagram of a hash table structure.

[0033] Figure 5 This is a schematic diagram of inserting a CM sketch structure.

[0034] Figure 6 This is a diagram illustrating the processing of data packet 4.

[0035] Figure 7 This is a flowchart of the processing of data packet 1.

[0036] Figure 8 This is a flowchart of the processing of data packet 3. Detailed Implementation

[0037] The specific embodiments of the present invention will now be described with reference to the accompanying drawings to enable those skilled in the art to better understand the invention. It should be particularly noted that in the following description, detailed descriptions of known functions and designs that might obscure the main content of the invention will be omitted here.

[0038] Example

[0039] In this embodiment, there is a significant difference between normal traffic and DDoS attack traffic. During normal communication, the source host and the destination host send data packets to communicate; during a DDoS attack, a large number of hosts send data packets to a single host.

[0040] Based on the attack principles of Distributed Denial-of-Service (DDoS) attacks, in scenarios where multiple source and destination hosts send data packets, IP addresses are used as identifiers for different hosts. We focus on the destination host from which multiple different source hosts send a large number of data packets, and identify it as a DDoS victim. As mentioned earlier, this invention addresses the statistical analysis of the number of different sources corresponding to a single destination IP address. In this embodiment, the problem model is as follows: Figure 1 As shown. In a network where data packets are sent from numerous different source and destination hosts, Indicates source host 1, This represents destination host 1, and the diagram shows that... Different source hosts to destination hosts Sending data packets, Different source hosts to destination hosts Sending data packets, Different source hosts to destination hosts Sending data packets. This invention requires locating certain destination hosts. ,That And store its IP address.

[0041] Below we combine Figure 2 This invention provides a detailed description of an abnormal traffic detection method under a DDoS attack, which specifically includes the following steps:

[0042] (1) Deploy data structures on the switch;

[0043] In this embodiment, the data structure includes a Bloom Filter structure, a Hash table structure, and a CM sketch structure. The Bloom Filter structure is used to filter packets with the same source and destination IPs. The Hash table structure is used to store the address of the destination IP under a DDoS attack and the overflow count value for this destination IP. The CM sketch structure is used to record ordinary destination addresses and to provide a basis for subsequent traffic statistics operations.

[0044] Below, we will describe the three data structures in detail:

[0045] (1.1) Deploy a Bloom Filter structure on the switch;

[0046] The Bloom Filter structure consists of A binary array of bits and It consists of several different unbiased hash functions; each bit of the binary array is numbered 0~ ; Each of the unbiased hash functions has a distinct structure, denoted as _____. Each hash function calculates a hash value of [0, ... The integers within the range are corresponding one-to-one with the bit numbers of the binary array;

[0047] In this embodiment, as Figure 3 As shown in the figure This represents a data packet containing a set of source and destination IP pairs. Indicates the source IP address. This indicates the destination IP address. There are a total of 6 data packets, numbered 1-6. and These represent different host numbers; assuming the DDoS threshold for this group of packets is 2. Deploy one... =14-bit binary array and =Three different unbiased hash functions, with array indices from 0 to 13, and the binary array is initially set to 0; the three unbiased hash functions have different structures, denoted as . ;

[0048] (1.2) Deploy a hash table structure on the switch;

[0049] The hash table structure contains a hash function. and associated hash function A hash table; a hash table contains Each bucket is numbered 0~ Each bucket contains two fields: one for storing the IP address of the data packet. Another field is used to store The count values ​​corresponding to different source addresses;

[0050] In this embodiment, as Figure 4 As shown, deploy a hash function. And 4 buckets, labeled from left to right The hash value calculated by the hash function is an integer in the range [0, 3], which corresponds one-to-one with the four buckets.

[0051] (1.3) Deploy the CM sketch structure on the switch;

[0052] The structure of CM sketch is composed of hash functions and It consists of several counters; the CM sketch structure is as follows: OK Column structure, each row has There are several counters, numbered sequentially from left to right. ; A sketch of min-counting corresponding to each hash function. Okay, and hash functions They are independent of each other, and the hash value calculated by each hash function is in the range [0, ... The integer within ] and Each counter number corresponds to one;

[0053] In this embodiment, as Figure 5 As shown, the CM sketch structure is a 3-row, 5-column structure. Each row has 5 counters, labeled 0, 1, ... 4 from left to right. Each row deploys a hash function, and the hash value calculated by each hash function is an integer in the range [0, 4], corresponding to the 5 counter numbers.

[0054] (2) DDoS traffic statistics based on data structures;

[0055] (2.1) Initialize the data structure;

[0056] Before the measurement begins, initialize the binary array in the Bloom Filter structure. The value of the bit is 0, the count value of the second field of each bucket in the hash table in the initialization hash structure is 0, and the count value of each counter in the minimum count sketch structure is 0.

[0057] (2.2) Set the timer, with an initial value of 0, to time the time when the switch starts and stops receiving data packets;

[0058] (2.3) When the timer starts, when the data packet arrives at the switch, it first passes through the Bloom Filter structure to extract the source IP address of the data packet. and destination IP address Then combine them into source and destination IP pairs. Then through an unbiased hash function The mapping is performed, where each hash function maps the source and destination IP pairs to a position in a binary array, totaling... At each position, then read... The value at each position, if If not all values ​​are 1, meaning there are 0s, it indicates that the source and destination IPs are not all equal. The first arrival will If the value of each position is set to 1, then proceed to step (2.3); otherwise, the switch discards the data packet and continues to receive the next data packet, then repeats step (2.2).

[0059] In this embodiment, as Figure 3 As shown, packet 1's corresponding IP pair is mapped into the Bloom Filter structure, and the hash results are 1, 8, and 9. These correspond to array indices; reading the value is 0 (the result after setting the bits in the diagram), so the three bits are set to 1. Packets 2, 3, 4, and 5 are processed similarly. When packet 6 enters the Bloom Filter, because it shares the same IP pair as packet 1, the mapped value is 1, so it doesn't proceed to further processing. The packets after the Bloom Filter are 1-5.

[0060] (2.3) Pair the source and destination IP addresses of the data packets. Input a hash structure to extract the destination IP address of the data packet. And used as a hash function The input is hashed to obtain the hash value. ;

[0061] hash value The hash table is used as an index for each bucket to query the hash table, find the corresponding bucket number, and then read the IP address of the bucket in the first field. If the read IP address is the same as the destination IP address of the data packet, it means that the hash table already stores the same IP address. The count value of the second field of the bucket is incremented by 1, the counting ends, and the next data packet is received, returning to step (2.2). If the read IP address is empty or the read IP address is not the same as the destination IP address of the data packet, it means that the query failed, and step (2.4) is performed.

[0062] In this embodiment, as Figure 6 As shown, when packet 4 arrives, the IP address exists in the hash table. The query returned the bucket's IP address and... Since the results are the same, the query is successful. The second field in the bucket is incremented by 1, the statistics are terminated, data packet 5 is received again, and the process returns to step (2.2).

[0063] In this embodiment, as Figure 7 When the data packet 1 shown enters, it is with A query is performed for the key. Since this is the first time the hash table is accessed, it does not contain any stored IP addresses, so the query fails and proceeds to step S2.4. The same logic applies to packets 2 and 3.

[0064] (2.4) Pair the source and destination IP addresses of the data packets. Input a minimum count sketch structure and extract the destination IP address of the data packet. And respectively used as hash functions The input is hashed to obtain the hash value. ;

[0065] hash value As an index, the counter corresponding to each row in the minimum count sketch is retrieved, and then the count value of each counter is read and denoted as... ;

[0066] Reading Select the minimum value from the count values. The minimum value is the number of different source IPs that the destination IP connects to. ;

[0067] Minimum value With preset threshold In comparison, if If the data packet is received correctly, the switch discards it and continues to receive the next data packet, then returns to step (2.2); otherwise, it uses the hash value calculated in step (2.3). Find the corresponding bucket for the index, then write the destination IP address of the data packet into the first field of the bucket, increment the count value of the second field of the bucket by 1, end the statistics, continue to receive the next data packet, and return to step (2.2).

[0068] In this embodiment, as Figure 8 As shown, when data packet 3 arrives, it will... The input hash results are 0, 1, 0. The corresponding counter values ​​for each row in the minimum count sketch are 3, 3, 3. The minimum value of these three numbers is recorded as... Compare it with the threshold =2 for comparison. If it is greater than the threshold, use the hash value H as the index to find the corresponding bucket, write it into the IP value, and increment the count value by 1. For example Figure 7 As shown, when data packet 1 reaches the minimum count sketch, it will... The hash result obtained as input is 0, 1, 0. The counter value corresponding to each row in the minimum count sketch is 1, 1, 1. The minimum value is less than the threshold, so the data packet is discarded and the process continues to step 2.2.

[0069] (3) Detection of abnormal traffic under DDoS attack;

[0070] When the timer reaches its end time, the destination IP addresses stored in the hash table of the hash structure are counted. Each destination IP is the victim IP under the DDoS attack, and its corresponding data packet is an abnormal data packet. In this embodiment, the victim's destination IP is... .

[0071] Although the illustrative specific embodiments of the present invention have been described above to enable those skilled in the art to understand the invention, it should be understood that the invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the invention as defined and determined by the appended claims, and all inventions utilizing the concept of the present invention are protected.

Claims

1. A method for detecting abnormal traffic under a DDoS attack, characterized in that, Includes the following steps: (1) Deploy data structures on the switch; (1.1) Deploy a Bloom Filter structure on the switch; The Bloom Filter structure consists of A binary array of bits and It consists of several different unbiased hash functions; each bit of the binary array is numbered 0~ ; Each of the unbiased hash functions has a distinct structure, denoted as _____. Each hash function calculates a hash value of [0, ... The integers within the range are corresponding one-to-one with the bit numbers of the binary array; (1.2) Deploy a hash structure on the switch; A hash structure contains a hash function. and associated hash function A hash table; a hash table contains Each bucket is numbered 0~ Each bucket contains two fields: one for storing the IP address of the data packet. Another field is used to store The count values ​​corresponding to different source addresses; (1.3) Deploy a minimum count sketch structure on the switch; Minimum count sketch structure is composed of hash functions and It consists of several counters; the minimum count sketch is as follows: OK Column structure, each row has There are several counters, numbered sequentially from left to right. ; A sketch of min-counting corresponding to each hash function. Okay, and hash functions They are independent of each other, and the hash value calculated by each hash function is in the range [0, ... The integer within ] and Each counter number corresponds to one; (2) DDoS traffic statistics based on data structures; (2.1) Initialize the data structure; Before the measurement begins, initialize the binary array in the Bloom Filter structure. The value of the bit is 0, the count value of the second field of each bucket in the hash table in the initialization hash structure is 0, and the count value of each counter in the minimum count sketch structure is 0. (2.2) Set the timer, with an initial value of 0, to time the time when the switch starts and stops receiving data packets; (2.3) When the timer starts, when the data packet arrives at the switch, it first passes through the Bloom Filter structure to extract the source IP address of the data packet. and destination IP address Then combine them into source and destination IP pairs. Then through an unbiased hash function The mapping is performed, where each hash function maps the source and destination IP pairs to a position in a binary array, totaling... At each position, then read... The value at each position, if If not all values ​​are 1, meaning there are 0s, it indicates that the source and destination IPs are not all equal. The first arrival will If the value of each position is set to 1, then proceed to step (2.3); otherwise, the switch discards the data packet and continues to receive the next data packet, then repeats step (2.2). (2.3) Pair the source and destination IP addresses of the data packets. Input a hash structure to extract the destination IP address of the data packet. And used as a hash function The input is hashed to obtain the hash value. ; hash value The hash table is used as an index for each bucket to query the hash table, find the corresponding bucket number, and then read the IP address of the bucket in the first field. If the read IP address is the same as the destination IP address of the data packet, it means that the hash table already stores the same IP address. The count value of the second field of the bucket is incremented by 1, the counting ends, and the next data packet is received, returning to step (2.2). If the read IP address is empty or the read IP address is not the same as the destination IP address of the data packet, it means that the query failed, and step (2.4) is performed. (2.4) Pair the source and destination IP addresses of the data packets. Input a minimum count sketch structure and extract the destination IP address of the data packet. And respectively used as hash functions The input is hashed to obtain the hash value. ; hash value As an index, the counter corresponding to each row in the minimum count sketch is retrieved, and then the count value of each counter is read and denoted as... ; Reading Select the minimum value from the count values. The minimum value is the number of different source IPs that the destination IP connects to. ; Minimum value With preset threshold In comparison, if If the data packet is received correctly, the switch discards it and continues receiving the next data packet, then returns to step (2.2); otherwise, it uses the hash value calculated in step (2.3). Find the corresponding bucket for the index, then write the destination IP address of the data packet into the first field of the bucket, increment the count value of the second field of the bucket by 1, end the statistics, continue to receive the next data packet, and return to step (2.2). (3) Detection of abnormal traffic under DDoS attack; When the timer reaches its end time, the destination IP addresses stored in the hash table of the hash structure are counted. Each destination IP is a victim IP under a DDoS attack, and its corresponding data packet is an abnormal data packet.

Images