Distributed denial of service attack detection method based on moving target defense system

Abstract

The invention provides a distributed denial of service attack detection method based on a moving target defense system. The method comprises the following steps: acquiring a characteristic index of a target proxy server of the moving target defense system in a target time period and the number of users pre-allocated to the target proxy server; determining a load factor of the target proxy server in the target time period based on the characteristic index and the user number; comparing the load factor of the target proxy server with load factors of other proxy servers in the target time period to obtain a space comparison result; comparing the load factor of the target proxy server with load factors of the target proxy server in other time periods to obtain a time comparison result; and determining the proxy server suffering from the distributed denial attack according to the time comparison result and the space comparison result. According to the invention, the accuracy of distributed denial of service attack detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a distributed denial of service attack detection method based on a mobile target defense system. Background Art

[0002] As wireless networking technology continues to advance, the size of botnets comprised of IoT devices continues to grow. This expansion leads to an increasing threat of distributed denial-of-service attacks, posing a significant risk to the internet community.

[0003] However, existing mobile target defense system implementations primarily focus on detecting distributed denial-of-service attacks on proxy servers from a single user's perspective, such as capacity token technology. This approach is highly coupled with the services the system needs to protect and suffers from a high false positive rate in practical applications.

[0004] It can be seen that the distributed denial of service attack detection method based on the mobile target defense system in the related art has a technical problem of low accuracy. Summary of the Invention

[0005] The present invention provides a distributed denial of service attack detection method based on a mobile target defense system, which is used to solve the defect of low accuracy in the distributed denial of service attack detection method based on a mobile target defense system in the prior art, and achieves a balance between speed and accuracy in the distributed denial of service attack detection method.

[0006] The present invention provides a distributed denial of service attack detection method based on a mobile target defense system, comprising the following steps: obtaining characteristic indicators of a target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; comparing the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a space comparison result; and determining the proxy server that suffers from a distributed denial of service attack based on the time comparison result and the space comparison result.

[0007] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, the method of obtaining characteristic indicators of the target proxy server of the mobile target defense system within a target time period includes: obtaining the number of synchronous data packets, the amount of data transmitted by a single connection, the average amount of data transmitted between connections, the number of established transmission control protocol connections, and the number of packets transmitted by a single connection of the target proxy server of the mobile target defense system within the target time period; and using the number of synchronous data packets, the amount of data transmitted by the single connection, the average amount of data transmitted between the connections, the number of established transmission control protocol connections, and the number of packets transmitted by the single connection as characteristic indicators of the target proxy server of the mobile target defense system within the target time period.

[0008] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, the load factor of the target proxy server within the target time period is determined based on the characteristic indicator and the number of users, including: determining a weight vector based on the number of users and multiple preset parameters; and determining the product of the weight vector and the characteristic indicator as the load factor of the target proxy server within the target time period.

[0009] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, the load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a time comparison result, including: the load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a spatial comparison result, including: constructing a spatial load factor sequence based on the load factor of the target proxy server and the load factors of other proxy servers within the target time period; determining a normal distribution probability density function of the spatial load factor sequence; determining an abnormal spatial load factor in the normal distribution probability density function that is less than a preset threshold; and using the proxy server corresponding to the abnormal spatial load factor as an abnormal proxy server, wherein the preset threshold is negatively correlated with the number of spatial load factors in the spatial load factor sequence.

[0010] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, the load factor of the target proxy server is compared with the load factors of other time periods of the target proxy server to obtain a time comparison result, including: constructing a time load factor sequence based on the load factor of the target proxy server and the load factors of other time periods of the target proxy server; determining the mean and variance of the time load factor sequence; determining the absolute value of the difference between each time load factor in the time load factor sequence and the mean; determining an abnormal time load factor whose absolute value is less than the product of the variance and a preset constant; and using the proxy server corresponding to the abnormal time load factor as an abnormal proxy server.

[0011] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, after determining the proxy server suffering from the distributed denial of service attack based on the time comparison result and the spatial comparison result, the method also includes: destroying and recreating the proxy server suffering from the distributed denial of service attack based on a preset shuffling algorithm; and reallocating users corresponding to the proxy server suffering from the distributed denial of service attack to the newly created proxy server.

[0012] The present invention also provides a distributed denial of service attack detection device based on a mobile target defense system, comprising the following modules: an acquisition module, used to obtain the characteristic indicators of the target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; a first determination module, used to determine the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; a first comparison module, used to compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; a second comparison module, used to compare the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a spatial comparison result; a second determination module, used to determine the proxy server that suffers a distributed denial of service attack based on the time comparison result and the spatial comparison result.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, it implements any of the above-described distributed denial of service attack detection methods based on a mobile target defense system.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the distributed denial of service attack detection method based on a mobile target defense system as described in any one of the above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements any of the above-described distributed denial of service attack detection methods based on a mobile target defense system.

[0016] The distributed denial of service attack detection method based on a mobile target defense system provided by the present invention determines the load factor of a target proxy server within a target time period based on characteristic indicators and the number of users, thereby converting the problem of detecting a server currently under attack into a problem of screening outliers in a data sequence; the load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a time comparison result; the load factor of the target proxy server is compared with the load factors of the target proxy server in other time periods to obtain a spatial comparison result. Thus, by comparing the load factors of different proxy servers in a temporal and spatial manner, the proxy server currently under attack can be accurately determined; and the proxy server suffering from a distributed denial of service attack is determined based on the time comparison result and the spatial comparison result. This solves the technical problem of low accuracy in the distributed denial of service attack detection method based on a mobile target defense system in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 It is a flow chart of the distributed denial of service attack detection method based on the mobile target defense system provided by the present invention.

[0019] Figure 2 It is a schematic diagram of the working principle of the proxy server detection model for detecting distributed denial of service attacks in the mobile target attack defense system provided by the present invention.

[0020] Figure 3 This is the overall structural diagram of the mobile target attack defense system based on the multi-proxy server switching strategy provided by the present invention.

[0021] Figure 4The invention provides a distributed denial of service attack detection device based on a mobile target defense system.

[0022] Figure 5 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0024] With the continuous advancement of wireless network technology, the scale of botnets composed of IoT devices continues to grow. This expansion has led to an increasing threat of distributed denial of service (DDoS) attacks, posing a significant risk to the internet community. The proxy-based mobile target defense system is considered an effective defense against DDoS attacks. This system consists of a cluster of secret proxy servers, the addresses of which must be obtained by users from a controller server, as the availability of individual proxy servers to users is constantly changing. Therefore, when a proxy server is under DDoS attack, its assigned users are reassigned to other proxy servers, rendering the DDoS traffic ineffective. Therefore, proxy servers currently under DDoS attack are crucial for mitigating the impact of DDoS attacks in the mobile target defense system.

[0025] However, existing mobile target defense system implementations primarily focus on detecting DDoS attacks on proxy servers from a single user's perspective, such as capacity token technology. This approach is highly coupled to the services being protected and suffers from high false positive rates in practical applications. Other commercially available DDoS attack detection methods tend to leverage traditional statistical techniques or emerging machine learning technologies to identify patterns within various packets and traffic flows. However, these approaches fail to fully exploit the unique characteristics of the mobile target defense architecture, thus failing to achieve optimal performance in DDoS attack detection.

[0026] In summary, optimizing existing mobile target defense systems to accurately detect proxy servers attacked by distributed denial-of-service (DDoS) tools has significant research and practical value. In an embodiment of the present invention, a DDoS attack detection method with protection service independence is proposed. This method enables rapid and accurate identification of servers currently under DDoS attack within a proxy server cluster within a mobile target defense system based on a multi-proxy switching strategy. This embodiment transforms the problem of detecting servers currently under attack into the problem of filtering outliers in a data sequence that conforms to a normal distribution. A load factor calculation method independent of the number of users is proposed. During the load factor calculation process, a weight vector incorporating a normalization method is used to mitigate the impact of the number of users and the size of different eigenvalues ​​on cross-server calculations. By adjusting the dimensionality of the eigenvector types and fine-tuning the weight vector incorporating the normalization method, a balance is achieved between the speed and accuracy of the attack detection algorithm, optimizing both attack response speed and false positive and false negative detection rates compared to commonly used attack detection schemes in similar technologies.

[0027] refer to Figure 1 , Figure 1 : is a flow chart of a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, such as Figure 1 As shown, the method includes the following steps.

[0028] Step 101: Acquire characteristic indicators of a target proxy server of a mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server.

[0029] In an embodiment of the present invention, a distributed denial of service attack is identified based on the inherent architectural characteristics of a mobile target defense system using a multi-agent strategy.

[0030] Among them, the Moving Target Defense (MTD) system continuously changes the target system environment or resource configuration, making it more difficult for attackers to exploit vulnerabilities and establish and maintain attack chains. This approach renders attacks based on known or unknown flaws in the target system ineffective and unreliable, significantly raising the barrier to entry and the cost of cyberattacks.

[0031] In this embodiment of the present invention, the collected characteristic indicators (characteristic factors) include the number of synchronized data packets, the amount of data transmitted per single connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol connections, and the number of packets transmitted per single connection. These characteristic factors are collected using a sliding time window (a specific time period). The number of users assigned to each proxy server is also collected.

[0032] Here, the Synchronize Sequence Numbers (SYN) packet is the first packet in the Transmission Control Protocol (TCP) connection establishment process, initiating the connection request. When establishing a normal TCP network connection between a client and a server, the client first sends a SYN message. The server acknowledges receipt with a "SYN+ACK" message, and the client responds with an Acknowledgement character (ACK) message. This establishes a reliable TCP connection between the client and server, allowing data to be transferred between them.

[0033] Step 102: Determine the load factor of the target proxy server within the target time period based on the characteristic index and the number of users.

[0034] In an embodiment of the present invention, the problem of detecting a server currently under attack is converted into a problem of screening outliers in a data sequence that conforms to a normal distribution.

[0035] It's important to note that determining whether a proxy server is under attack is a complex problem. Similar technical solutions use a capacity token issued by the authentication server to the proxy server upon completing authentication to determine whether a user has launched a distributed denial-of-service attack against the proxy server. This token contains the number of packets or bytes the user is allowed to send within the next session window.

[0036] However, this approach has two problems. First, it cannot identify certain types of distributed denial of service attacks, such as SYN flood attacks, which do not establish a complete TCP connection between the user and the proxy server. Second, this makes the defense system highly coupled with the network services it is protecting. Obviously, different network services have different requirements for the number of packets or bytes on the network, which means that the defense system must adapt to changes in business operations. This characteristic can also lead to a large number of false positives during peak business hours.

[0037] Therefore, the embodiment of the present invention identifies distributed denial of service attack traffic based on the special network architecture characteristic brought about by the mobile target attack defense system of proxy server cluster switching, that is, the presence of multiple proxy servers.

[0038] Specifically, a DDoS attacker aims to cause a proxy server or application server to enter a denial of service (DoS) state. This results in significantly different network / system parameters between the attacked server and servers not under DDoS attack. Given the presence of multiple proxy servers in a network environment, it is possible to design an attack score using these network / system parameters and compare the attack scores of different proxy servers to identify the proxy server currently under attack. However, this attack detection model results in a high false positive rate in practice. This is because user redistribution is introduced, and the number of users assigned to each proxy server naturally changes at different points in time. This violates an implicit assumption of the aforementioned attack detection model: that the number of users assigned to each proxy server is essentially the same. However, in practice, especially when the controller server attempts to identify malicious users through shuffling, it is easy for the number of users assigned to a particular proxy server to far exceed that of other proxy servers.

[0039] Therefore, in an embodiment of the present invention, the number of users is taken into consideration, the load factor of the target proxy server within the target time period is determined based on the characteristic index and the number of users, and a load factor calculation method independent of the number of users is proposed.

[0040] Step 103: Compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result.

[0041] Step 104: Compare the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a time comparison result.

[0042] refer to Figure 2 , Figure 2 This is a schematic diagram of the working principle of the proxy server detection model for detecting distributed denial of service attacks in the mobile target attack defense system provided by the present invention, which includes a proxy server cluster, a control server, the number of users, a feature vector, a load factor (including SYN packets, the amount of data per flow, the average amount of data, TCP flows, and the number of packets per flow), and a load factor calculation framework (including comparisons in the spatial direction and comparisons in the temporal direction).

[0043] In this embodiment of the present invention, various characteristic indicators collected from proxy servers in a time window are used to calculate the current load factor by combining these characteristics with the number of users assigned to the corresponding proxy server. The model determines which proxy server is currently under attack by comparing the load factors of different proxies in a temporal and spatial manner. Spatial comparison refers to comparing the load factors of different proxy servers at the same point in time, while temporal comparison compares the load factors of the same proxy server in different time windows.

[0044] Step 105: Determine the proxy server that suffers from the distributed denial of service attack based on the time comparison result and the space comparison result.

[0045] In the embodiment of the present invention, since there are many parameters that can affect the load factor, it can be considered that the measured load factor is normally distributed. This feature can quickly screen out load factors with large deviations during comparison, and use the proxy servers corresponding to the load factors with large deviations as proxy servers that suffer from distributed denial of service attacks.

[0046] Through the above steps of the embodiment of the present invention, the characteristic indicators of the target proxy server of the mobile target defense system in the target time period and the number of users pre-assigned to the target proxy server are obtained; based on the characteristic indicators and the number of users, the load factor of the target proxy server in the target time period is determined; the load factor of the target proxy server is compared with the load factors of other proxy servers in the target time period to obtain a time comparison result; the load factor of the target proxy server is compared with the load factors of other time periods of the target proxy server to obtain a space comparison result; based on the time comparison result and the space comparison result, the proxy server suffering from the distributed denial of service attack is determined. Thus, the problem of detecting the server currently under attack is converted into the problem of outlier screening in the data sequence, thereby solving the technical problem of low accuracy in the distributed denial of service attack detection method based on the mobile target defense system in the related art.

[0047] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, characteristic indicators of a target proxy server of the mobile target defense system within a target time period are obtained, including: Obtain the number of synchronized data packets, the amount of data transmitted by a single connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol connections, and the number of packets transmitted by a single connection of the target proxy server of the mobile target defense system within a target time period; The number of synchronized data packets, the amount of data transmitted by a single connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol connections, and the number of packets transmitted by a single connection are used as characteristic indicators of the target proxy server of the mobile target defense system within the target time period.

[0048] To design an appropriate attack detection algorithm, it's necessary to select feature metrics that can better reflect whether the current proxy server is experiencing a distributed denial of service (DDoS) attack. In related research, researchers used the BOUN (Distributed Denial of Service) attack dataset to calculate the information gain of different features. The information gain of a feature indicates the quality of information about whether a connection is a DDoS connection, and therefore measures the amount of information a feature provides about the classification.

[0049] Considering that all users who have obtained the proxy server address have been authenticated, the unique source feature is of little significance in the mobile target defense model scenario. Therefore, the embodiment of the present invention selects the following five characteristic values ​​to form the characteristic vector (characteristic index) F, namely SYN packets (number of synchronization packets), data volume of each flow (data volume transmitted by a single connection), average data volume (average data volume transmitted between connections), TCP flow (number of established Transmission Control Protocol connections) and number of packets per flow (number of packets transmitted by a single connection). These characteristic values ​​are all generated in a time window manner, where the data volume of each flow and the number of packets per flow take the maximum value within the current time window. For details, please refer to the following formula (1): (1)

[0050] in, represents the feature vector, Indicates the number of synchronous data packets, Indicates the amount of data for each flow, Indicates the average amount of data transmitted between connections. Indicates the number of established Transmission Control Protocol connections. Indicates the number of packets transmitted on a single connection.

[0051] It should be noted that three of the five selected parameters are not related to the number of users, but it is obvious that the number of SYN packets, the number of new TCP connections per second, and the number of TCP flows are related to the number of users assigned to the current proxy node.

[0052] According to the present invention, a distributed denial of service attack detection method based on a mobile target defense system is provided, which determines the load factor of a target proxy server within a target time period based on characteristic indicators and the number of users, including: Determine a weight vector based on the number of users and multiple preset parameters; The product of the weight vector and the characteristic index is determined as the load factor of the target proxy server in the target time period.

[0053] It's important to note that the units and magnitudes of the aforementioned parameters vary significantly. For example, the total data volume and the data volume per flow are both measured in bytes, with magnitudes ranging from approximately 10^3 to 10^7, while the number of packets per flow is typically small, around 10^1. The number of SYN packets and TCP flows varies with the number of users, typically being two to three times the number of users. Therefore, it's necessary to design a weight vector to control the contribution of each characteristic parameter to the final load factor.

[0054] The weight vector is determined based on the number of users and multiple preset parameters. For details, please refer to the following formula (2): (2)

[0055] in, represents the weight vector, Indicates the number of users, They represent preset parameters (constants) respectively.

[0056] The designed weight vector K is given by Formula 2. In the formula, a, b, c, d, and e are parameters, and only two weights include the number of users U assigned to the proxy server.

[0057] The product of the weight vector and the characteristic index is determined as the load factor of the target proxy server in the target time period, which can be referred to the following formula (3): (3)

[0058] in, represents the load factor, represents the weight vector, Represents characteristic indicators.

[0059] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, the load factor of a target proxy server is compared with the load factors of other proxy servers within a target time period to obtain a spatial comparison result, including: Constructing a spatial load factor sequence based on the load factor of the target proxy server and the load factors of other proxy servers within the target time period; Determine the normal distribution probability density function of the spatial load factor sequence; Determining an abnormal spatial load factor in a normal distribution probability density function that is less than a preset threshold; The proxy server corresponding to the abnormal spatial load factor is regarded as the abnormal proxy server, wherein the preset threshold is negatively correlated with the number of spatial load factors in the spatial load factor sequence.

[0060] Refer to the following Algorithm 1, which is a load factor calculation method algorithm independent of the number of users provided by the present invention.

[0061] Input: feature vector ; Number of users ; Load factor sequence ; Proxy service cluster size ; Output: Set of proxy servers that were attacked ; for do

[0062]

[0063] Will Add to load factor sequence

[0064] Will Add to load factor sequence

[0065] end for

[0066] Pair Sequence Calculate the normal distribution probability density function for each value in

[0067] for do

[0068] if then

[0069] Will Add to Collection middle

[0070] end if

[0071] end for

[0072] for do

[0073] For the load factor sequence , calculate its mean and variance

[0074] if then

[0075] Will Add to Collection middle

[0076] end if

[0077] end for

[0078] The embodiment of the present invention provides a method for calculating a load factor that is independent of the number of users, and the pseudo code of the algorithm is shown in Algorithm 1.

[0079] The first for loop calculates the load factor of each proxy server using the feature vector, the number of users assigned to the proxy server, and the weight vector.

[0080] The second for loop is used for spatial comparison. After using the load factor on each proxy server, its value in the normal distribution probability density function is calculated. The subsequent loop uses the Chauvenet criterion to filter out values ​​with large errors. Proxy servers with such values ​​will be marked as being under attack.

[0081] Given that there are always fewer than 10 proxy servers running in the cluster, the Chauvenet criterion is used here. The Chauvenet criterion is a statistical method used to detect and exclude data points as outliers. Its basic idea is to calculate the deviation of a data point from the mean and normalize it to the unit of standard deviation. Generally speaking, if a data point's deviation exceeds a certain threshold, it can be considered an outlier and excluded.

[0082] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, the load factor of a target proxy server is compared with the load factor of the target proxy server in other time periods to obtain a time comparison result, including: constructing a temporal load factor sequence based on the load factor of the target proxy server and the load factors of the target proxy server in other time periods; Determine the mean and variance of the time load factor series; determining the absolute value of the difference between each time load factor in the time load factor series and the mean; determining an abnormal time load factor whose absolute value is less than the product of the variance and a preset constant; The proxy server corresponding to the abnormal time load factor is regarded as the abnormal proxy server.

[0083] Referring to Algorithm 1 above, the third for loop is used for time-based comparison. Since the time window is much smaller than the life cycle of the proxy server, the PauTa criterion is used here to detect outliers in the sequence.

[0084] Among them, the PauTa criterion, also known as the Laida criterion or 3 The criterion is mainly used in the field of data analysis and processing, especially when dealing with abnormal data or gross errors. The core idea of ​​this criterion is based on the characteristics of the normal distribution. By calculating the standard deviation of the data, a reasonable error range is determined, and then outliers outside this range are identified and eliminated.

[0085] According to a distributed denial of service attack detection method based on a mobile target defense system provided by the present invention, after determining the proxy server suffering from the distributed denial of service attack based on the time comparison result and the spatial comparison result, the method further includes: Destroy and rebuild proxy servers that suffer from distributed denial of service attacks based on a preset shuffling algorithm; Reassign users corresponding to the proxy server that is under distributed denial of service attack to the newly created proxy server.

[0086] In this embodiment of the present invention, Algorithm 1 is invoked at the end of a time window, when proxy servers upload their feature vectors from the previous time window. If the algorithm detects that some proxy servers are under a distributed denial-of-service attack, the shuffling algorithm is immediately initiated, as the attacked proxy servers will be destroyed and users will be reassigned to newly created proxy servers.

[0087] refer to Figure 3 , Figure 3 This is the overall structural diagram of the mobile target attack defense system based on the multi-proxy server switching strategy provided by the present invention, which includes a user group, a user group mixed with spies, a robot network, a control server, a proxy server cluster (including proxy server 1, proxy server 2, proxy server i and proxy server n) and an application server.

[0088] In practical application scenarios, embodiments of the present invention propose a detection model for identifying servers in a system under distributed denial of service (DDoS) attack. This model leverages the inherent architectural characteristics of a mobile target defense system using a multi-agent strategy to identify DDoS attacks. Furthermore, a method for calculating a load factor independent of the number of users is proposed. During the load factor calculation process, a weight vector is designed that incorporates a normalization method. This is done to mitigate the impact of the number of users and varying eigenvalues ​​on cross-server calculations.

[0089] The detection model for identifying servers attacked by distributed denial of service (DDoS) in the aforementioned system includes a proxy server cluster, a control server, a feature factor collection and transmission framework, and a load factor calculation and screening system. The collected feature factors include the number of SYN packets, the amount of data transmitted per connection, the average amount of data transmitted between connections, the number of established TCP connections, and the number of packets transmitted per connection. These features are collected using a sliding time window. The number of users assigned to each proxy server is also determined.

[0090] The proxy server cluster load factor calculation and screening algorithm includes a load factor calculation algorithm for the number of users allocated on irrelevant proxy servers, and an outlier screening algorithm optimized by the Chauvenet and PauTa criteria in the normal distribution.

[0091] The present invention has the following technical effects: The present invention proposes a distributed denial of service attack detection method that is independent of the protection service. This method enables rapid and accurate identification of servers currently under distributed denial of service attacks within a proxy server cluster in a mobile target defense system based on a multi-proxy switching strategy. A detection model for identifying servers currently under distributed denial of service attack is designed, transforming the problem of detecting servers currently under attack into the problem of screening outliers in a normally distributed data sequence. The method also provides theoretical modeling and experimental verification, proposing a load factor calculation method that is independent of the number of users. During the load factor calculation process, a weight vector incorporating a normalization method is designed to mitigate the impact of the number of users and varying eigenvalues ​​on cross-server computations. Finally, the load factor calculation algorithm and outlier screening algorithm are carefully optimized. By adjusting the dimensionality of the eigenvector types and fine-tuning the weight vector incorporating the normalization method, the attack detection algorithm achieves a balance between speed and accuracy, outperforming commonly used attack detection schemes in similar technologies in terms of attack response speed and false positive and false negative detection rates.

[0092] The distributed denial of service attack detection device based on the mobile target defense system provided by the present invention is described below. The distributed denial of service attack detection device based on the mobile target defense system described below and the distributed denial of service attack detection method based on the mobile target defense system described above can be referenced to each other.

[0093] refer to Figure 4 , Figure 4 The distributed denial of service attack detection device based on the mobile target defense system provided by the present invention includes an acquisition module 401, a first determination module 402, a first comparison module 403, a second comparison module 404 and a second determination module 405.

[0094] An acquisition module 401 is used to obtain characteristic indicators of a target proxy server of a mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; a first determination module 402 is used to determine the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; a first comparison module 403 is used to compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; a second comparison module 404 is used to compare the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a space comparison result; a second determination module 405 is used to determine the proxy server that has suffered a distributed denial of attack based on the time comparison result and the space comparison result.

[0095] Specifically, the above-mentioned distributed denial of service attack detection device based on the mobile target defense system provided by the present invention can implement all the method steps implemented in the above-mentioned distributed denial of service attack detection method embodiment based on the mobile target defense system, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0096] Figure 5 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communications bus 540. The processor 510 may invoke logic instructions in the memory 530 to execute a distributed denial of service attack detection method based on a mobile target defense system. The method includes: obtaining characteristic indicators of a target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; determining a load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a temporal comparison result; and determining a proxy server suffering a distributed denial of service attack based on the temporal comparison result and the spatial comparison result.

[0097] Furthermore, the logic instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0098] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the distributed denial of service attack detection method based on the mobile target defense system provided by the above methods, the method including: obtaining the characteristic indicators of the target proxy server of the mobile target defense system within the target time period and the number of users pre-assigned to the target proxy server; based on the characteristic indicators and the number of users, determining the load factor of the target proxy server within the target time period; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; comparing the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a time comparison result; and determining the proxy server that suffers from the distributed denial of service attack based on the time comparison result and the spatial comparison result.

[0099] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the distributed denial of service attack detection method based on a mobile target defense system provided by the above-mentioned methods, the method comprising: obtaining characteristic indicators of a target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; comparing the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a time comparison result; and determining the proxy server that suffers from a distributed denial of service attack based on the time comparison result and the spatial comparison result.

[0100] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0101] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A distributed denial of service attack detection method based on a mobile target defense system, characterized in that: include: Acquire characteristic indicators of a target proxy server of a mobile target defense system within a target time period and the number of users pre-allocated to the target proxy server; Determining a load factor of the target proxy server within the target time period based on the characteristic index and the number of users; Comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; Compare the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a time comparison result; The proxy server that suffers from the distributed denial of service attack is determined according to the time comparison result and the space comparison result.

2. The distributed denial of service attack detection method based on the mobile target defense system according to claim 1 is characterized in that: The step of obtaining characteristic indicators of the target proxy server of the mobile target defense system within the target time period includes: Obtain the number of synchronized data packets, the amount of data transmitted by a single connection, the average amount of data transmitted between connections, the number of established transmission control protocol connections, and the number of packets transmitted by a single connection of the target proxy server of the mobile target defense system within a target time period; The number of synchronization data packets, the amount of data transmitted by the single connection, the average amount of data transmitted between the connections, the number of established transmission control protocol connections and the number of packets transmitted by the single connection are used as characteristic indicators of the target proxy server of the mobile target defense system within the target time period.

3. The distributed denial of service attack detection method based on the mobile target defense system according to claim 1 is characterized in that: The step of determining the load factor of the target proxy server within the target time period based on the characteristic index and the number of users includes: Determining a weight vector according to the number of users and a plurality of preset parameters; The product of the weight vector and the characteristic index is determined as the load factor of the target proxy server in the target time period.

4. The distributed denial of service attack detection method based on a mobile target defense system according to claim 1, characterized in that: The comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result includes: constructing a spatial load factor sequence based on the load factor of the target proxy server and the load factors of other proxy servers within the target time period; Determining a normal distribution probability density function of the spatial load factor sequence; Determining an abnormal spatial load factor in the normal distribution probability density function that is less than a preset threshold; The proxy server corresponding to the abnormal spatial load factor is used as an abnormal proxy server, wherein the preset threshold is negatively correlated with the number of spatial load factors in the spatial load factor sequence.

5. The distributed denial of service attack detection method based on the mobile target defense system according to claim 1 is characterized in that: The comparing the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a time comparison result includes: constructing a time load factor sequence based on the load factor of the target proxy server and the load factors of other time periods of the target proxy server; determining a mean and a variance of the time load factor series; determining an absolute value of a difference between each time load factor in the time load factor sequence and the mean; Determining an abnormal time load factor whose absolute value is less than a product of the variance and a preset constant; The proxy server corresponding to the abnormal time load factor is used as an abnormal proxy server.

6. The distributed denial of service attack detection method based on the mobile target defense system according to claim 1 is characterized in that: After determining the proxy server that suffers from the distributed denial of service attack according to the time comparison result and the space comparison result, the method further includes: Destroying and rebuilding the proxy server that suffers from the distributed denial of use attack based on a preset shuffling algorithm; The users corresponding to the proxy server subjected to the distributed denial of service attack are reallocated to the newly created proxy server.

7. A distributed denial of service attack detection device based on a mobile target defense system, characterized in that: include: An acquisition module, used to acquire characteristic indicators of a target proxy server of a mobile target defense system within a target time period and the number of users pre-allocated to the target proxy server; A first determination module, configured to determine a load factor of the target proxy server within the target time period based on the characteristic index and the number of users; A first comparison module, used to compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; A second comparison module, used to compare the load factor of the target proxy server with the load factors of other time periods of the target proxy server to obtain a spatial comparison result; The second determination module is used to determine the proxy server that suffers from the distributed denial of service attack according to the time comparison result and the space comparison result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the distributed denial of service attack detection method based on the mobile target defense system as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the distributed denial of service attack detection method based on a mobile target defense system as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the distributed denial of service attack detection method based on a mobile target defense system as described in any one of claims 1 to 6 is implemented.

Images