Distributed Denial of Service Attack Detection Method Based on Mobile Target Defense System
By calculating the load factor of the proxy server in the mobile target defense system and performing time and space comparisons, combined with an outlier filtering algorithm to identify distributed denial-of-service attacks, the problem of low accuracy in existing technologies is solved, and fast and accurate attack identification and user reassignment are achieved.
Patent Information
- Application Number
- CN202410991291.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-23
- Publication Date
- 2025-10-28
- Estimated Expiration
- 2044-07-23
AI Technical Summary
Existing distributed denial-of-service attack detection methods based on mobile target defense systems have low accuracy and are highly coupled with the services that the system needs to protect, resulting in a high false positive rate.
By obtaining the characteristic indicators and number of users of the target proxy server of the mobile target defense system, calculating the load factor and comparing them in time and space, the normal distribution and outlier screening algorithm are used to identify the attacked proxy server, designing a load factor calculation method independent of the number of users, and combining it with the shuffling algorithm to redistribute users.
It enables rapid and accurate identification of distributed denial-of-service attacks in mobile target defense systems, reduces false alarm rate and response speed, and optimizes the accuracy and efficiency of attack detection.
Smart Images
Figure CN119109612B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method for detecting distributed denial-of-service attacks based on a mobile target defense system. Background Technology
[0002] With the continuous advancement of wireless network technology, botnets composed of Internet of Things (IoT) devices are expanding in scale. This expansion has led to a growing threat of distributed denial-of-service (DDoS) attacks, posing a significant risk to the internet community.
[0003] However, existing mobile target defense systems primarily focus on detecting distributed denial-of-service attacks on proxy servers from a single user's perspective, such as capacity token technology. This approach is highly coupled with the services the system needs to protect and suffers from a high false positive rate in practical applications.
[0004] Therefore, it is evident that the distributed denial-of-service attack detection method based on the mobile target defense system in the relevant technologies has the technical problem of low accuracy. Summary of the Invention
[0005] This invention provides a distributed denial-of-service attack detection method based on a mobile target defense system, which addresses the shortcomings of existing distributed denial-of-service attack detection methods based on mobile target defense systems, such as low accuracy, and achieves a balance between speed and accuracy in distributed denial-of-service attack detection methods.
[0006] This invention provides a method for detecting distributed denial-of-service attacks based on a mobile target defense system, comprising the following steps: Obtaining characteristic indicators of a target proxy server within a target time period and the number of users pre-assigned to the target proxy server; determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a spatial comparison result; and determining the proxy server suffering from a distributed denial-of-service attack based on the time comparison result and the spatial comparison result.
[0007] According to the distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, the step of obtaining the characteristic indicators of the target proxy server of the mobile target defense system within a target time period includes: obtaining the number of synchronization data packets, the amount of data transmitted in a single connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol (TCP) connections, and the number of packets transmitted in a single connection of the target proxy server of the mobile target defense system within the target time period; and using the number of synchronization data packets, the amount of data transmitted in a single connection, the average amount of data transmitted between connections, the number of established TCP connections, and the number of packets transmitted in a single connection as the characteristic indicators of the target proxy server of the mobile target defense system within the target time period.
[0008] According to a distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, the step of determining the load factor of the target proxy server within the target time period based on the feature index and the number of users includes: determining a weight vector according to the number of users and a plurality of preset parameters; and determining the load factor of the target proxy server within the target time period by multiplying the weight vector by the feature index.
[0009] According to a distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, the step of comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result includes: the step of comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result includes: constructing a spatial load factor sequence based on the load factor of the target proxy server and the load factors of other proxy servers within the target time period; determining the normal distribution probability density function of the spatial load factor sequence; determining abnormal spatial load factors less than a preset threshold in the normal distribution probability density function; and identifying the proxy servers corresponding to the abnormal spatial load factors as abnormal proxy servers, wherein the preset threshold is negatively correlated with the number of spatial load factors in the spatial load factor sequence.
[0010] According to a distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, the step of comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a time comparison result includes: constructing a time load factor sequence based on the load factor of the target proxy server and the load factors of the target proxy server in other time periods; determining the mean and variance of the time load factor sequence; determining the absolute value of the difference between each time load factor in the time load factor sequence and the mean; determining abnormal time load factors whose absolute value is less than the product of the variance and a preset constant; and identifying the proxy server corresponding to the abnormal time load factor as an abnormal proxy server.
[0011] According to the present invention, a method for detecting distributed denial-of-service attacks based on a mobile target defense system, after determining the proxy server suffering from a distributed denial-of-service attack based on the time comparison result and the spatial comparison result, the method further includes: destroying and creating a new proxy server suffering from a distributed denial-of-service attack based on a preset shuffling algorithm; and reassigning the users corresponding to the proxy server suffering from the distributed denial-of-service attack to the newly created proxy server.
[0012] The present invention also provides a distributed denial-of-service attack detection device based on a mobile target defense system, comprising the following modules: an acquisition module, used to acquire characteristic indicators of a target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; a first determination module, used to determine the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; a first comparison module, used to compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; a second comparison module, used to compare the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a spatial comparison result; and a second determination module, used to determine the proxy server suffering from a distributed denial-of-service attack based on the time comparison result and the spatial comparison result.
[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the distributed denial-of-service attack detection method based on the mobile target defense system described above.
[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the distributed denial-of-service attack detection method based on the mobile target defense system as described above.
[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the distributed denial-of-service attack detection method based on the mobile target defense system described above.
[0016] This invention provides a distributed denial-of-service (DDoS) attack detection method based on a mobile target defense system. Based on characteristic indicators and the number of users, it determines the load factor of a target proxy server within a target time period. This transforms the problem of detecting a currently attacked server into an outlier filtering problem in a data sequence. The load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a temporal comparison result. The load factor of the target proxy server is also compared with the load factors of the target proxy server in other time periods to obtain a spatial comparison result. Therefore, by comparing the load factors of different proxy servers in both temporal and spatial modes, the proxy server currently under attack can be accurately identified. Based on the temporal and spatial comparison results, the proxy server suffering from a DDoS attack is determined. This solves the technical problem of low accuracy in related DDoS attack detection methods based on mobile target defense systems. Attached Figure Description
[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0018] Figure 1 This is a flowchart illustrating the distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention.
[0019] Figure 2 This is a schematic diagram illustrating the working principle of the proxy server detection model for detecting distributed denial-of-service attacks in the mobile target attack defense system provided by this invention.
[0020] Figure 3 This is the overall structure diagram of the mobile target attack defense system based on the multi-proxy server switching strategy provided by the present invention.
[0021] Figure 4This invention provides a distributed denial-of-service attack detection device based on a moving target defense system.
[0022] Figure 5 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation
[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0024] With the continuous advancement of wireless network technology, botnets composed of IoT devices are expanding in scale. This expansion has led to a growing threat of distributed denial-of-service (DDoS) attacks, posing a significant risk to the internet community. Proxy-based mobile target defense systems are considered an effective defense against DDoS attacks. This system comprises a secret cluster of proxy servers, whose addresses users must obtain from a controller server, as the availability of a single proxy server to a user is constantly changing. Therefore, when a proxy server is under DDoS attack, users assigned to it should be reassigned to other proxy servers, rendering DDoS traffic ineffective. Thus, proxy servers currently under DDoS attack are crucial for mitigating the impact of DDoS attacks within mobile target defense systems.
[0025] However, existing mobile target defense systems primarily focus on detecting distributed denial-of-service (DDoS) attacks on proxy servers from a single user's perspective, such as capacity token technology. This approach is highly coupled with the services the system needs to protect and suffers from a high false positive rate in practical applications. Furthermore, other DDoS attack detection methods on the market often rely on traditional statistical techniques or emerging machine learning technologies to identify patterns in various data packets and traffic. However, these methods fail to fully leverage the unique characteristics of the mobile target defense architecture, thus failing to achieve optimal performance in DDoS attack detection.
[0026] In summary, optimizing the accurate detection of proxy servers under attack by distributed denial-of-service (DDoS) tools in existing mobile target defense systems has significant research and practical value. This invention proposes a DDoS attack detection method with service independence, enabling rapid and accurate identification of servers under DDoS attacks within a current proxy server cluster in a mobile target defense system based on a multi-proxy switching strategy. This invention transforms the problem of detecting currently attacked servers into an outlier filtering problem within a normally distributed data sequence. Furthermore, it proposes a load factor calculation method independent of the number of users. During load factor calculation, a weight vector incorporating normalization mitigates the impact of user number and different feature value magnitudes on cross-server computation. By adjusting the dimensions of feature vector types and fine-tuning the weight vector incorporating normalization, a balance between speed and accuracy is achieved in the attack detection algorithm. This method optimizes commonly used attack detection schemes in similar techniques in terms of attack response speed and false positive and false negative rates.
[0027] refer to Figure 1 , Figure 1 This is a flowchart illustrating the distributed denial-of-service attack detection method based on a moving target defense system provided by the present invention, as shown below. Figure 1 As shown, the method includes the following steps.
[0028] Step 101: Obtain the characteristic indicators of the target proxy server of the mobile target defense system within the target time period and the number of users pre-assigned to the target proxy server.
[0029] In this embodiment of the invention, distributed denial-of-service attacks are identified based on the inherent architectural characteristics of a mobile target defense system that uses a multi-agent strategy.
[0030] Moving Target Defense (MTD) systems increase the difficulty for attackers to create and maintain attack chains by constantly changing the target system's environment or resource configuration. This approach renders attacks based on known or unknown vulnerabilities in the target system ineffective and unreliable, thus significantly raising the barrier to entry for cyberattacks and increasing the cost for attackers.
[0031] In this embodiment of the invention, the collected characteristic indicators (characteristic factors) include the number of synchronization data packets, the amount of data transmitted per connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol (TCP) connections, and the number of packets transmitted per connection. These characteristic factors are collected using a sliding time window (a specific time period). The number of users allocated on each proxy server is also collected.
[0032] Here, the SYN (Synchronize Sequence Numbers) packet is the first packet in the TCP (Transmission Control Protocol) connection establishment process, used to initiate a connection request. When establishing a normal TCP network connection between the client and server, the client first sends a SYN message, the server responds with a "SYN+ACK" message to indicate receipt, and finally the client responds with an ACK (Acknowledge character) message, thus establishing a reliable TCP connection between the client and server, allowing data to be transmitted between them.
[0033] Step 102: Based on the characteristic indicators and the number of users, determine the load factor of the target proxy server within the target time period.
[0034] In this embodiment of the invention, the problem of detecting a server currently under attack is transformed into the problem of outlier filtering in a data sequence that conforms to a normal distribution.
[0035] It's important to note that determining whether a proxy server is under attack is a rather complex issue. In similar technical solutions, an authentication server issues a capacity token to the proxy server upon completion of authentication to determine if a user has launched a distributed denial-of-service attack. This token contains the number of packets or bytes the user is allowed to send within the next session window.
[0036] However, this method has two problems. First, it cannot identify certain types of distributed denial-of-service attacks, such as SYN Flood attacks, which do not establish a complete TCP connection between the user and the proxy server. Second, this makes the defense system highly coupled with the network services it needs to protect. Obviously, different network services have different requirements for the number of data packets or bytes on the network, which means that the defense system must change with business changes. This characteristic may also lead to a large number of false positives during peak system traffic periods.
[0037] Therefore, embodiments of the present invention identify distributed denial-of-service attack traffic based on the special network architecture characteristics of the mobile target attack defense system with proxy server cluster switching—the existence of multiple proxy servers.
[0038] Specifically, the goal of a distributed denial-of-service (DDoS) attacker is to put a proxy server or application server into a denial-of-service state. This causes the attacked server to exhibit significant differences in network / system parameters compared to servers not affected by the DDoS attack. Given the existence of multiple proxy servers in a network environment, it is entirely possible to design an attack scoring system using these network / system parameters and identify the proxy server currently under attack by comparing the attack scores of different proxy servers. However, this attack detection model leads to a high false positive rate in practice. This is because user reallocation is actually introduced; the number of users assigned to each proxy server naturally changes at different points in time, which violates an implicit assumption of the above attack detection model: that the users assigned to each proxy server are basically consistent. In practice, especially when the controller server attempts to find malicious users through shuffling, it is easy for the number of users assigned to one proxy server to far exceed that of other proxy servers.
[0039] Therefore, in this embodiment of the invention, considering the number of users, the load factor of the target proxy server within the target time period is determined based on the characteristic indicators and the number of users, and a load factor calculation method independent of the number of users is proposed.
[0040] Step 103: Compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain the spatial comparison result.
[0041] Step 104: Compare the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain the time comparison result.
[0042] refer to Figure 2 , Figure 2 This is a schematic diagram illustrating the working principle of the proxy server detection model for detecting distributed denial-of-service attacks in the mobile target attack defense system provided by the present invention. It includes a proxy server cluster, a control server, a number of users, feature vectors, load factors (including SYN packets, data volume per flow, average data volume, TCP flow, and number of packets per flow), and a load factor calculation framework (including comparisons in the spatial direction and the temporal direction).
[0043] In this embodiment of the invention, various characteristic indicators collected from the proxy server under a time window approach are used to calculate the current load factor by using these characteristics and the number of users assigned to the corresponding proxy server. The model determines which proxy server is currently under attack by comparing the load factors of different proxies under a temporal and spatial approach. The spatial comparison refers to comparing the load factors of different proxy servers at the same point in time, while the temporal comparison compares the load factors of the same proxy in different time windows.
[0044] Step 105: Based on the time comparison results and the space comparison results, determine the proxy server that has been subjected to a distributed denial-of-service attack.
[0045] In this embodiment of the invention, since many parameters can affect the load factor, the measured load factor can be considered to be normally distributed. This characteristic can quickly filter out load factors with large deviations when comparing them, and the proxy server corresponding to the load factor with large deviation is regarded as the proxy server suffering from distributed denial attack.
[0046] Through the steps described in this embodiment of the invention, the characteristic indicators of the target proxy server in the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server are obtained; based on the characteristic indicators and the number of users, the load factor of the target proxy server within the target time period is determined; the load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a time comparison result; the load factor of the target proxy server is compared with the load factors of the target proxy server in other time periods to obtain a spatial comparison result; based on the time comparison result and the spatial comparison result, the proxy server suffering from a distributed denial-of-service attack is determined. Thus, the problem of detecting a server currently under attack is transformed into an outlier filtering problem in a data sequence, thereby solving the technical problem of low accuracy in related technologies for detecting distributed denial-of-service attacks based on mobile target defense systems.
[0047] According to the present invention, a distributed denial-of-service attack detection method based on a mobile target defense system obtains characteristic indicators of the target proxy server of the mobile target defense system within a target time period, including:
[0048] The system obtains the number of synchronization packets, the amount of data transmitted per connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol (TCP) connections, and the number of packets transmitted per connection for the target proxy server of the mobile target defense system within the target time period.
[0049] The number of synchronization packets, the amount of data transmitted in a single connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol (TCP) connections, and the number of packets transmitted in a single connection are used as characteristic indicators of the target proxy server of the mobile target defense system within the target time period.
[0050] To design suitable attack detection algorithms, it is necessary to select feature metrics that better reflect whether the current proxy server is under a distributed denial-of-service (DDoS) attack. In related technologies, researchers used the BOUN DDoS attack dataset to calculate the information gain of different features. The information gain of a feature indicates the quality of information about whether a connection is a DDoS connection; therefore, information gain measures how much information a feature can provide about classification.
[0051] Considering that all users who obtain the proxy server address have already been authenticated, the unique source feature is not very meaningful in the mobile target defense model scenario. Therefore, this embodiment of the invention selects the following five feature values to form the feature vector (feature index) F, namely SYN packets (number of synchronization packets), data volume per flow (data volume transmitted in a single connection), average data volume (average data volume transmitted between connections), TCP flow (number of established Transmission Control Protocol connections), and number of packets per flow (number of packets transmitted in a single connection). These feature values are all generated in the form of time windows, where the data volume of each flow and the number of packets per flow are the maximum values within the current time window. For details, please refer to the following formula (1):
[0052] (1)
[0053] in, Represents the eigenvector. Indicates the number of synchronization data packets. Indicates the amount of data in each stream. This indicates the average amount of data transferred between connections. This indicates the number of established Transmission Control Protocol (TCP) connections. This indicates the number of packets transmitted in a single connection.
[0054] It should be noted that three of the five selected parameters are not related to the number of users, but it is clear that the number of SYN packets, the number of new TCP connections per second, and the number of TCP streams are related to the number of users allocated on the current proxy node.
[0055] According to the present invention, a distributed denial-of-service attack detection method based on a mobile target defense system determines the load factor of a target proxy server within a target time period based on characteristic indicators and the number of users, including:
[0056] The weight vector is determined based on the number of users and several preset parameters;
[0057] The product of the weight vector and the feature index is used to determine the load factor of the target proxy server within the target time period.
[0058] It should be noted that the units and magnitudes of the various parameters mentioned above differ significantly. For example, the total data volume and the data volume per stream are measured in bytes, with magnitudes ranging from approximately 10^3 to 10^7, while the number of packets per stream is typically not very large, around 10^1. The number of SYN packets and TCP streams varies with the number of users, generally being two to three times the number of users. Therefore, designing a weight vector to control the proportion of each characteristic parameter in the final load factor is necessary.
[0059] The weight vector is determined based on the number of users and several preset parameters. For details, please refer to the following formula (2):
[0060] (2)
[0061] in, Represents the weight vector. Indicates the number of users. These represent preset parameters (constants).
[0062] The weight vector K is designed according to Formula 2. In the formula, a, b, c, d, and e are parameters, of which only two weights include the number of users U assigned to the proxy server.
[0063] The product of the weight vector and the feature index is used to determine the load factor of the target proxy server in the target time period. The following formula (3) can be used as a reference:
[0064] (3)
[0065] in, Indicates the load factor. Represents the weight vector. Indicates characteristic indicators.
[0066] According to the distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, the load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a spatial comparison result, including:
[0067] Based on the load factor of the target proxy server and the load factors of other proxy servers within the target time period, a spatial load factor sequence is constructed.
[0068] Determine the normal distribution probability density function of the spatial load factor sequence;
[0069] Determine the anomaly spatial load factor in the normal probability density function that is less than a preset threshold;
[0070] The proxy server corresponding to the abnormal spatial load factor is designated as the abnormal proxy server. The preset threshold is negatively correlated with the number of spatial load factors in the spatial load factor sequence.
[0071] Refer to Algorithm 1 below, which is the load factor calculation method algorithm independent of the number of users provided by this invention.
[0072] Input: Feature vector ;
[0073] Number of users ;
[0074] Loading factor sequence ;
[0075] The size of the proxy service cluster ;
[0076] Output: The set of proxy servers that were attacked. ;
[0077] for do
[0078]
[0079] Will Add to load factor sequence
[0080] Will Add to load factor sequence
[0081] end for
[0082] For sequence For each value in the range, calculate the normal distribution probability density function.
[0083] for do
[0084] if then
[0085] Will Add to collection middle
[0086] end if
[0087] end for
[0088] for do
[0089] For the load factor sequence Calculate its mean. and variance
[0090] if then
[0091] Will Add to collection middle
[0092] end if
[0093] end for
[0094] The pseudocode of the load factor calculation method algorithm independent of the number of users provided in this embodiment of the invention is shown in Algorithm 1.
[0095] The first for loop uses the feature vector, the number of users assigned to the proxy server, and the weight vector to calculate the load factor for each proxy server.
[0096] The second for loop compares the spatial distribution, calculating the load factor for each proxy server in the normal probability density function. Subsequent loops use the Chauvenet criterion to filter out values with large errors; proxy servers with these values are marked as being under attack.
[0097] Since the number of proxy servers running in the cluster is always less than 10, the Chauvenet criterion is used here. The Chauvenet criterion is a statistical method for detecting and eliminating outliers. Its basic idea is to calculate the deviation of a data point from the mean and standardize it to the unit of standard deviation. Generally, if the deviation of a data point exceeds a certain threshold, it can be considered an outlier and excluded.
[0098] According to the distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, the load factor of the target proxy server is compared with the load factor of the target proxy server in other time periods to obtain a time comparison result, including:
[0099] Based on the load factor of the target proxy server and the load factors of the target proxy server in other time periods, a time load factor sequence is constructed.
[0100] Determine the mean and variance of the time loading factor series;
[0101] Determine the absolute value of the difference between each time load factor in the time load factor sequence and the mean.
[0102] Determine the abnormal time load factor whose absolute value is less than the product of variance and a preset constant;
[0103] The proxy server corresponding to the abnormal time load factor is designated as the abnormal proxy server.
[0104] Referring to Algorithm 1 above, the third for loop is used for time-based comparison. Since the time window is much smaller than the lifetime of the proxy server, the PauTa criterion is used here to detect outliers in the sequence.
[0105] Among them, the PauTa criterion is also known as the Raida criterion or the 3rd criterion. This criterion is primarily applied in data analysis and processing, especially when dealing with outliers or gross errors. The core idea of this criterion is based on the characteristics of the normal distribution. By calculating the standard deviation of the data, a reasonable error range is determined, and then outliers that exceed this range are identified and eliminated.
[0106] According to the distributed denial-of-service attack detection method based on a mobile target defense system provided by the present invention, after determining the proxy server suffering from the distributed denial-of-service attack based on time comparison results and spatial comparison results, the method further includes:
[0107] The algorithm is based on a pre-defined shuffling method to destroy and recreate proxy servers that have been subjected to distributed denial-of-service attacks.
[0108] Users associated with the proxy server that suffered a distributed denial-of-service attack will be reassigned to the newly created proxy server.
[0109] In this embodiment of the invention, Algorithm 1 is invoked at the end of the time window, at which time the proxy servers upload their feature vectors from the previous time window. If the algorithm detects that some proxy servers are under a distributed denial-of-service attack, it immediately initiates a shuffling algorithm, as the attacked proxy servers are destroyed and users are reassigned to newly created proxy servers.
[0110] refer to Figure 3 , Figure 3 This is the overall structure diagram of the mobile target attack defense system based on the multi-proxy server switching strategy provided by the present invention, which includes a user group, a user group mixed with spies, a robot network, a control server, a proxy server cluster (including proxy server 1, proxy server 2, proxy server i and proxy server n) and an application server.
[0111] In practical applications, this invention proposes a detection model for identifying servers under distributed denial-of-service (DDoS) attacks in a system. This model identifies DDoS attacks based on the inherent architectural characteristics of mobile target defense systems using multi-agent strategies. It also includes a load factor calculation method independent of the number of users. In calculating the load factor, a weight vector incorporating a normalization method is designed. This is done to mitigate the impact of the number of users and different feature values on cross-server computation.
[0112] The detection model for servers under distributed denial-of-service (DDoS) attacks in the aforementioned identification system includes: a proxy server cluster, a control server, a feature factor collection and transmission framework, and a load factor calculation and filtering system. The collected feature factors include: the number of SYN packets, the amount of data transmitted per connection, the average amount of data transmitted between connections, the number of established TCP connections, and the number of packets transmitted per connection. These features are therefore collected using a sliding time window method. The number of users allocated to each proxy server is also considered.
[0113] The load factor calculation and filtering algorithm for the proxy server cluster includes a load factor calculation algorithm for the number of users allocated on unrelated proxy servers, and an outlier filtering algorithm optimized from the Chauvenet and PauTa criteria in the normal distribution.
[0114] The present invention has the following technical effects:
[0115] This invention proposes a distributed denial-of-service (DDoS) attack detection method with service independence protection, enabling rapid and accurate identification of servers under DDoS attacks within a mobile target defense system based on multi-proxy switching strategies. A detection model for identifying DDoS attack servers in the system is designed, transforming the problem of detecting currently attacked servers into an outlier filtering problem within a normally distributed data sequence. A load factor calculation method independent of the number of users is proposed, providing theoretical modeling and experimental verification. In the load factor calculation process, a weight vector incorporating a normalization method is designed. This is done to mitigate the impact of the number of users and different feature values on cross-server calculations. Finally, the load factor calculation algorithm and outlier filtering algorithm are carefully optimized. By adjusting the dimensions of feature vector types and fine-tuning the weight vector incorporating the normalization method, a balance between speed and accuracy is achieved in the attack detection algorithm. This method optimizes attack response speed and false positive and false negative rates compared to commonly used attack detection schemes in similar technologies.
[0116] The following describes the distributed denial-of-service attack detection device based on the mobile target defense system provided by the present invention. The distributed denial-of-service attack detection device based on the mobile target defense system described below can be referred to in correspondence with the distributed denial-of-service attack detection method based on the mobile target defense system described above.
[0117] refer to Figure 4 , Figure 4 The present invention provides a distributed denial-of-service attack detection device based on a mobile target defense system, which includes an acquisition module 401, a first determination module 402, a first comparison module 403, a second comparison module 404, and a second determination module 405.
[0118] The acquisition module 401 is used to acquire the characteristic indicators of the target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; the first determination module 402 is used to determine the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; the first comparison module 403 is used to compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result; the second comparison module 404 is used to compare the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a spatial comparison result; and the second determination module 405 is used to determine the proxy server suffering from a distributed denial-of-service attack based on the time comparison result and the spatial comparison result.
[0119] Specifically, the distributed denial-of-service attack detection device based on the mobile target defense system provided by the present invention can implement all the method steps implemented in the above-mentioned distributed denial-of-service attack detection method embodiment based on the mobile target defense system, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.
[0120] Figure 5 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as... Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a distributed denial-of-service attack detection method based on a mobile target defense system. This method includes: acquiring characteristic indicators of the target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a temporal comparison result; and determining the proxy server suffering from a distributed denial-of-service attack based on the temporal comparison result and the spatial comparison result.
[0121] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0122] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the distributed denial-of-service attack detection method based on the mobile target defense system provided by the above methods. The method includes: acquiring the characteristic indicators of the target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a temporal comparison result; and determining the proxy server suffering from a distributed denial-of-service attack based on the temporal comparison result and the spatial comparison result.
[0123] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program is implemented to perform the distributed denial-of-service attack detection method based on a mobile target defense system provided by the above methods. The method includes: acquiring characteristic indicators of a target proxy server of the mobile target defense system within a target time period and the number of users pre-assigned to the target proxy server; determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users; comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a temporal comparison result; and determining the proxy server suffering from a distributed denial-of-service attack based on the temporal comparison result and the spatial comparison result.
[0124] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0125] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A distributed denial-of-service attack detection method based on a moving target defense system, characterized in that, include: Acquire the characteristic indicators of the target proxy server of the mobile target defense system within the target time period, as well as the number of users pre-assigned to the target proxy server; Based on the aforementioned characteristic indicators and the number of users, the load factor of the target proxy server within the target time period is determined. The load factor of the target proxy server is compared with the load factors of other proxy servers within the target time period to obtain a spatial comparison result; The load factor of the target proxy server is compared with the load factor of the target proxy server in other time periods to obtain the time comparison result; Based on the time comparison results and the spatial comparison results, the proxy server that suffered a distributed denial-of-service attack is identified.
2. The distributed denial-of-service attack detection method based on a moving target defense system according to claim 1, characterized in that, The characteristic indicators of the target proxy server of the mobile target defense system within the target time period include: The system obtains the number of synchronization packets, the amount of data transmitted per connection, the average amount of data transmitted between connections, the number of established Transmission Control Protocol (TCP) connections, and the number of packets transmitted per connection for the target proxy server of the mobile target defense system within the target time period. The number of synchronization data packets, the amount of data transmitted in a single connection, the average amount of data transmitted between connections, the number of established transmission control protocol connections, and the number of packets transmitted in a single connection are used as characteristic indicators of the target proxy server of the mobile target defense system within the target time period.
3. The distributed denial-of-service attack detection method based on a moving target defense system according to claim 1, characterized in that, Determining the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users includes: A weight vector is determined based on the number of users and several preset parameters; The product of the weight vector and the feature index is determined as the load factor of the target proxy server within the target time period.
4. The distributed denial-of-service attack detection method based on a moving target defense system according to claim 1, characterized in that, The step of comparing the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a spatial comparison result includes: Based on the load factor of the target proxy server and the load factors of other proxy servers within the target time period, a spatial load factor sequence is constructed. Determine the normal distribution probability density function of the spatial load factor sequence; Determine the abnormal spatial load factors in the normal distribution probability density function that are less than a preset threshold; The proxy server corresponding to the abnormal spatial load factor is designated as the abnormal proxy server, wherein the preset threshold is negatively correlated with the number of spatial load factors in the spatial load factor sequence.
5. The distributed denial-of-service attack detection method based on a moving target defense system according to claim 1, characterized in that, The step of comparing the load factor of the target proxy server with the load factors of the target proxy server in other time periods to obtain a time comparison result includes: Based on the load factor of the target proxy server and the load factors of the target proxy server in other time periods, a time load factor sequence is constructed. Determine the mean and variance of the time load factor sequence; Determine the absolute value of the difference between each time load factor in the time load factor sequence and the mean; Determine the abnormal time load factor whose absolute value is less than the product of variance and a preset constant; The proxy server corresponding to the abnormal time load factor is designated as the abnormal proxy server.
6. The distributed denial-of-service attack detection method based on a moving target defense system according to claim 1, characterized in that, After determining the proxy server suffering from a distributed denial-of-service attack based on the time comparison result and the spatial comparison result, the method further includes: The proxy servers that have been subjected to distributed denial-of-service attacks are destroyed and rebuilt based on a preset shuffling algorithm. The users corresponding to the proxy servers that suffered the distributed denial-of-service attack will be reassigned to the newly created proxy servers.
7. A distributed denial-of-service attack detection device based on a moving target defense system, characterized in that, include: The acquisition module is used to acquire the characteristic indicators of the target proxy server of the mobile target defense system within the target time period and the number of users pre-assigned to the target proxy server; The first determining module is used to determine the load factor of the target proxy server within the target time period based on the characteristic indicators and the number of users. The first comparison module is used to compare the load factor of the target proxy server with the load factors of other proxy servers within the target time period to obtain a time comparison result. The second comparison module is used to compare the load factor of the target proxy server with the load factor of the target proxy server in other time periods to obtain a spatial comparison result. The second determining module is used to determine the proxy server that has been subjected to a distributed denial-of-service attack based on the time comparison result and the space comparison result.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the distributed denial-of-service attack detection method based on the mobile target defense system as described in any one of claims 1 to 6.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the distributed denial-of-service attack detection method based on the mobile target defense system as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the distributed denial-of-service attack detection method based on the mobile target defense system as described in any one of claims 1 to 6.