CNN-BiGRU-based DDOS attack detection method and system

Abstract

The invention discloses a CNN-BiGRU-based DDOS attack detection method and system, and the method comprises the steps: determining features which are significant in correlation with DDOS attack according to the absolute value of a Spearman rank correlation coefficient, converting the time sequence features into 2D texture images based on a Grubm angle difference field, inputting the two-dimensional images after the time sequence conversion of each single variable into a CNN-BiGRU network model, and carrying out the recognition of the CNN-BiGRU network model. And training the model until convergence, inputting a sample into the trained GAF-CNN-BiGRU network model, carrying out average probability fusion on probability distribution output by the model, and then obtaining a result with the highest prediction probability from fused output and outputting the result. According to the method, more complex attack features are recognized, the expression ability of data is enriched, meanwhile, fusion can help the model to understand and analyze data more comprehensively and deeply, and the detection accuracy and generalization ability are improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet security, and in particular to a CNN-BiGRU-based DDOS attack detection method and system. Background Art

[0002] With the rapid development and popularization of the Internet, network security issues are becoming increasingly serious. In particular, distributed denial of service (DDoS) attacks, as a common network security threat, pose a serious threat to network infrastructure and service availability. Traditional DDoS detection methods often rely on a single data source or a specific model, and cannot effectively respond to the attackers' increasingly changing and complex attack methods.

[0003] Most current solutions are based on feature extraction and analysis of a single data source, lacking the comprehensive use of multimodal data, such as time series data, image data, etc. Therefore, an efficient method that can integrate features of multiple data modalities is needed to improve the adaptability and detection accuracy of the DDoS attack detection system to various attack forms. Summary of the invention

[0004] 1. Technical issues to be solved

[0005] In order to solve the above technical problems, the present invention provides a DDOS attack detection method and system based on CNN-BiGRU. The method is a feature fusion method based on Gramian Angular Field (GAF) conversion, and combines a hybrid model (GAF-CNN-BiGRU) of convolutional neural network (CNN) and bidirectional gated recurrent unit (BiGRU) for DDoS attack detection. The method converts time series data into a two-dimensional texture image, uses CNN to effectively capture spatial information, and then combines time series features through a BiGRU model, thereby comprehensively utilizing multimodal data to improve the detection accuracy and generalization ability of DDoS attacks.

[0006] (II) Technical solution

[0007] In order to solve the above-mentioned technical problems and achieve the purpose of the invention, the present invention is implemented by the following technical solutions:

[0008] A DDOS attack detection method based on CNN-BiGRU, characterized by comprising the following steps:

[0009] S1: Calculate the Spearman rank correlation coefficient between each feature in the CIC 2019 D(D)oS dataset and the DDOS attack label feature, and determine the features that are significantly correlated with DDOS attacks based on the absolute value of the Spearman rank correlation coefficient;

[0010] S2: Convert time series features into 2D texture images based on Gram angle difference field;

[0011] S3: Input the two-dimensional image converted from each univariate time series into the CNN-BiGRU network model, and train the model until convergence;

[0012] S4: Input the sample into the trained GAF-CNN-BiGRU network model, perform average probability fusion on the probability distribution output by the model, and then obtain the result with the highest prediction probability from the fused output and output it.

[0013] Furthermore, the step S1 further includes:

[0014] S11: Calculate the Spearman rank correlation coefficient between each feature and the DDOS attack label feature. Specifically, sort the two feature data separately and assign a rank to each data point. If there are the same values, assign their average rank, calculate the rank difference, the sum of squares of the rank difference, and the Spearman rank correlation coefficient.

[0015] Furthermore, the

[0016] The rank difference is calculated by the following formula:

[0017] d i =R(x i )-R(y i )

[0018] The sum of squares of rank differences is calculated by the following formula:

[0019]

[0020] The Spearman rank correlation coefficient is calculated by the following formula:

[0021]

[0022] Where n is the number of data pairs.

[0023] Furthermore, the step S1 further includes:

[0024] S12: Select features that are significantly correlated with DDOS attacks;

[0025] S13: Calculate the Spearman rank correlation coefficient between the features that are significantly correlated with DDOS attacks, filter out some features whose correlation is greater than a threshold, and retain multiple representative features.

[0026] Furthermore, features with a Spearman rank correlation coefficient greater than 0.8 are selected as features with significant correlation with DDOS attacks.

[0027] Furthermore, the step S2 further includes:

[0028] S21: Normalize the univariate time series of feature data selected from the CIC 2019 D(D)oS dataset;

[0029] S22: Convert each univariate time series from Cartesian coordinates to polar coordinates;

[0030] The normalized data is encoded according to the following formula and mapped to the polar coordinate system:

[0031]

[0032] In the formula represents the normalized feature data, φ i is the angle of the corresponding data point in polar coordinates, N is the length of the time series data, is the normalized time series dataset, r i is the radius of the ith data point, t i For x i The corresponding timestamps are normalized to the range [0,1] according to the index of the data point. Represents a timestamp collection;

[0033] S23: Using the Gram angle difference field to obtain a two-dimensional image from the data mapped to the polar coordinate system; the specific calculation method is as follows:

[0034]

[0035] GADF=cos(φ i -φ j )

[0036]

[0037] Where GADF is a two-dimensional image matrix, I is a unit row vector [1,1,1,...,1], express The transpose of express The transpose of .

[0038] Furthermore, the CNN-BiGRU network model in step S3 includes one or more convolutional layers and pooling layers, a bidirectional gate control unit, a fully connected layer and an output layer arranged in sequence.

[0039] Furthermore, the specific implementation method of averaging the probability distribution of the model output in step S4 is as follows: for each sample to be predicted, use the GAF-CNN-BiGRU model to predict and obtain the prediction probability of each model for each category; for each category, average the prediction probabilities of each model to obtain an average probability value; select the category with the largest average probability value as the final prediction result.

[0040] The present invention also provides a DDOS attack detection system based on CNN-BiGRU, which includes:

[0041] The attack-related feature acquisition module is used to calculate the Spearman rank correlation coefficient between each feature in the CIC 2019 D(D)oS dataset and the DDOS attack label feature, and determine the features that are significantly correlated with the DDOS attack based on the absolute value of the Spearman rank correlation coefficient;

[0042] A texture image generation module, which is used to convert time series features into 2D texture images based on the Gram angle difference field;

[0043] The network model building and training module is used to input the two-dimensional image converted from each univariate time series into the CNN-BiGRU network model and train the model until convergence;

[0044] The prediction result calculation module is used to input the sample into the trained GAF-CNN-BiGRU network model, perform average probability fusion on the probability distribution output by the model, and then obtain the result with the highest prediction probability from the fused output and output it.

[0045] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which program instructions of a DDOS attack detection method based on CNN-BiGRU are stored, and the program instructions of the DDOS attack detection method based on CNN-BiGRU can be executed by one or more processors to implement the steps of the DDOS attack detection method based on CNN-BiGRU as described above.

[0046] (III) Beneficial effects

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] By converting time series data into two-dimensional texture images, using CNN to effectively capture spatial information, and then combining time series features through the BiGRU model, multimodal data is comprehensively utilized to improve the detection accuracy and generalization ability of DDoS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0050] Figure 1 It is a flow chart of a DDOS attack detection method based on CNN-BiGRU according to an embodiment of the present application;

[0051] Figure 2 is a flowchart of training a CNN-BiGRU model according to an embodiment of the present application;

[0052] Figure 3 It is a schematic diagram of the CNN-BiGRU model structure according to an embodiment of the present application. DETAILED DESCRIPTION

[0053] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0054] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0055] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0056] See also Figure 1 ,A DDOS attack detection method based on CNN-BiGRU includes the following steps:

[0057] S1: Calculate the Spearman rank correlation coefficient between each feature in the CIC 2019 D(D)oS dataset and the DDOS attack label feature, and determine the features that are significantly correlated with DDOS attacks based on the absolute value of the Spearman rank correlation coefficient.

[0058] Generally speaking, a correlation coefficient with a larger absolute value indicates a stronger correlation between features. According to the set threshold, select features that are significantly correlated with whether the data sample belongs to a DDoS attack, filter out some features with a correlation greater than the threshold, and retain some of them; this step includes the following sub-steps:

[0059] S11: Calculate the Spearman rank correlation coefficient between each feature and the DDOS attack label feature. Specifically, sort the two feature data respectively and assign a rank to each data point. If they have the same value, assign their average rank, calculate the rank difference, the sum of squares of the rank difference, and the Spearman rank correlation coefficient.

[0060] The rank difference is calculated by the following formula:

[0061] d i =R(x i )-R(y i )

[0062] The sum of squares of rank differences is calculated by the following formula:

[0063]

[0064] The Spearman rank correlation coefficient is calculated by the following formula:

[0065]

[0066] Where n is the number of data pairs;

[0067] S12: Select features that are significantly correlated with DDOS attacks;

[0068] Optionally, features with a Spearman rank correlation coefficient greater than 0.8 are selected as features that are significantly correlated with DDOS attacks.

[0069] S13: Calculate the Spearman rank correlation coefficient between the features that are significantly correlated with DDOS attacks, filter out some features with correlations greater than a threshold, and retain multiple representative features;

[0070] S2: Convert the time series features into a 2D texture image; this step includes the following sub-steps:

[0071] S21: Normalize the univariate time series of feature data selected from the CIC 2019 D(D)oS dataset;

[0072] The normalization process includes:

[0073] Normalize the received data to [-1, 1] according to formula (1), or normalize it to [0, 1] according to formula (2):

[0074]

[0075] Where, time series X = {x1, x2, x3, …, x i}, represents a data sequence of a feature selected from the CIC 2019 D(D)oS dataset, x i represents the i-th feature data in the sample, n represents the number of feature data, max(X) represents the maximum value in the feature data, and min(X) represents the minimum value in the feature data.

[0076] S22: Convert each univariate time series from Cartesian coordinates to polar coordinates;

[0077] The normalized data is encoded according to the following formula and mapped to the polar coordinate system:

[0078]

[0079] In the formula represents the normalized feature data, φ i is the angle of the corresponding data point in polar coordinates, N is the length of the time series data, is the normalized time series dataset, r i is the radius of the ith data point, t i For x i The corresponding timestamps are normalized to the range [0,1] according to the index of the data point. Represents a timestamp collection.

[0080] S23: Using the Gram angle difference field to obtain a two-dimensional image from the data mapped to the polar coordinate system; the specific calculation method is as follows:

[0081]

[0082] GADF=cos(φ i -φ j )

[0083]

[0084] Where GADF is a two-dimensional image matrix, I is a unit row vector [1,1,1,...,1], express The transpose of express The transpose of .

[0085] S3: Input the two-dimensional image after each univariate time series conversion into the CNN-BiGRU network model and train the model until convergence; the process is as follows Figure 2 shown.

[0086] Optional, such as Figure 3 As shown, the CNN-BiGRU network model includes one or more convolutional layers and pooling layers, a bidirectional gate control unit, a fully connected layer and an output layer arranged in sequence.

[0087] The bidirectional gate control unit simultaneously trains two separate RNNs in one network layer, one for processing sequence data from front to back and the other for processing data from back to front, and then merges the outputs of the two RNNs to form the final output.

[0088] The fully connected layer of the CNN-BiGRU network model uses the Relu activation function and maps the features to the final output category by introducing a nonlinear activation function.

[0089] The output layer of the CNN-BiGRU network model uses a softmax function to complete the binary classification of whether it is a DDOS attack;

[0090] The CNN-BiGRU network model uses a binary cross-entropy loss function (Binary Cross-EntropyLoss) as a loss function.

[0091] The validation set is further used to evaluate the model performance, and the model hyperparameters are adjusted to improve the performance. The model structure or hyperparameters are adjusted according to the evaluation results to improve the model performance.

[0092] The training method of the CNN-BiGRU network model comprises the following steps:

[0093] a. Input the training 2D image of each feature into the CNN-BiGRU network model;

[0094] b. Determine whether each CNN-BiGRU network model converges. If the model converges, the training of the CNN-BiGRU network model is completed; if the model does not converge, proceed to step c;

[0095] c. Use the Adam adaptive optimization algorithm to optimize the model parameters with a learning rate of 0.001, and then return to step b.

[0096] S4: Input the sample into the trained GAF-CNN-BiGRU network model, perform average probability fusion on the probability distribution output by the model, and then obtain the result with the highest prediction probability from the fused output and output it.

[0097] The specific implementation method of averaging the probability output by the model is as follows: for each sample to be predicted, the GAF-CNN-BiGRU model is used to predict and obtain the prediction probability of each model for each category. For each category, the prediction probabilities of each model are averaged to obtain an average probability value. The category with the largest average probability value is selected as the final prediction result.

[0098] In this embodiment, by using the spearman coefficient to screen the features in the CIC 2019 D(D)oS dataset, the spearman coefficient of each pair of features in the CIC 2019 D(D)oS dataset is calculated to filter the features that are highly correlated with the existing features in the dataset or highly unrelated to the output, thereby reducing the feature dimension and speeding up the training. The Gram angular field converts the time series into a two-dimensional image, so that the complex patterns and dependencies hidden in the original data can be presented in a more intuitive and structured way, which can reveal the global and local patterns in the time series data and help identify more complex attack features. CNN-BiGRU combines the advantages of convolutional neural networks (CNN) and bidirectional gated recurrent units (BiGRU). The former is suitable for processing the spatial information of image data, and the latter is a deep learning model that combines the characteristics of bidirectional (Bidirectional) and gated recurrent units (GRU), which can process the forward and reverse information of the sequence at the same time. This enables the model to capture more contextual information, especially in sequence data, where understanding the context is crucial for accurately predicting and understanding data. Multiple features related to detecting DDOS attacks are fused with average probability. Different features provide different types of information. Through fusion, the model can make comprehensive use of multiple information sources and enrich the data's expressive ability. At the same time, fusion can help the model understand and analyze data more comprehensively and deeply, and improve detection accuracy and generalization ability.

[0099] The embodiment of the present invention further proposes a DDOS attack detection system based on CNN-BiGRU, comprising:

[0100] The attack-related feature acquisition module is used to calculate the Spearman rank correlation coefficient between each feature in the CIC 2019 D(D)oS dataset and the DDOS attack label feature, and determine the features that are significantly correlated with the DDOS attack based on the absolute value of the Spearman rank correlation coefficient;

[0101] A texture image generation module, which is used to convert time series features into 2D texture images based on the Gram angle difference field;

[0102] The network model building and training module is used to input the two-dimensional image converted from each univariate time series into the CNN-BiGRU network model and train the model until convergence;

[0103] The prediction result calculation module is used to input the sample into the trained GAF-CNN-BiGRU network model, perform average probability fusion on the probability distribution output by the model, and then obtain the result with the highest prediction probability from the fused output and output it.

[0104] In addition, an embodiment of the present invention further proposes a computer-readable storage medium, on which program instructions of a DDOS attack detection method based on CNN-BiGRU are stored, and the DDOS attack detection program instructions based on CNN-BiGRU can be executed by one or more processors to implement the steps of the DDOS attack detection method based on CNN-BiGRU as described above.

[0105] The embodiments described above are only descriptions of the preferred implementation modes of the present invention, and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A DDOS attack detection method based on CNN-BiGRU, characterized in that: The steps include: S1: Calculate the Spearman rank correlation coefficient between each feature in the CIC 2019D(D)oS dataset and the DDOS attack label feature, and determine the features that are significantly correlated with DDOS attacks based on the absolute value of the Spearman rank correlation coefficient; S2: Convert time series features into 2D texture images based on Gram angle difference field; S3: Input the two-dimensional image converted from each univariate time series into the CNN-BiGRU network model, and train the model until convergence; S4: Input the sample into the trained GAF-CNN-BiGRU network model, perform average probability fusion on the probability distribution output by the model, and then obtain the result with the highest prediction probability from the fused output and output it.

2. The DDOS attack detection method based on CNN-BiGRU according to claim 1, characterized in that: The step S1 further comprises: S11: Calculate the Spearman rank correlation coefficient between each feature and the DDOS attack label feature. Specifically, sort the two feature data separately and assign a rank to each data point. If there are the same values, assign their average rank, calculate the rank difference, the sum of squares of the rank difference, and the Spearman rank correlation coefficient.

3. The DDOS attack detection method based on CNN-BiGRU according to claim 2 is characterized in that: Said The rank difference is calculated by the following formula: d i =R(x i )-R(y i ) The sum of squares of rank differences is calculated by the following formula: The Spearman rank correlation coefficient is calculated by the following formula: Where n is the number of data pairs.

4. The DDOS attack detection method based on CNN-BiGRU according to claim 1, characterized in that: The step S1 further comprises: S12: Select features that are significantly correlated with DDOS attacks; S13: Calculate the Spearman rank correlation coefficient between the features that are significantly correlated with DDOS attacks, filter out some features whose correlation is greater than a threshold, and retain multiple representative features.

5. The DDOS attack detection method based on CNN-BiGRU according to claim 4 is characterized in that: Features with a Spearman rank correlation coefficient greater than 0.8 were selected as features with significant correlation with DDOS attacks.

6. The DDOS attack detection method based on CNN-BiGRU according to claim 1, characterized in that: The step S2 further comprises: S21: Normalize the univariate time series of feature data selected from the CIC 2019D(D)oS dataset; S22: Convert each univariate time series from Cartesian coordinates to polar coordinates; The normalized data is encoded according to the following formula and mapped to the polar coordinate system: In the formula represents the normalized feature data, φ i is the angle of the corresponding data point in polar coordinates, N is the length of the time series data, is the normalized time series dataset, r i is the radius of the ith data point, t i For x i The corresponding timestamps are normalized to the range [0,1] according to the index of the data point. Represents a timestamp collection; S23: Using the Gram angle difference field to obtain a two-dimensional image from the data mapped to the polar coordinate system; the specific calculation method is as follows: GADF=cos(φ i -f j ) Where GADF is a two-dimensional image matrix, I is a unit row vector [1,1,1,...,1], express The transpose of express The transpose of .

7. The DDOS attack detection method based on CNN-BiGRU according to claim 1, characterized in that: The CNN-BiGRU network model in step S3 includes one or more convolutional layers and pooling layers, a bidirectional gate control unit, a fully connected layer and an output layer arranged in sequence.

8. The DDOS attack detection method based on CNN-BiGRU according to claim 1, characterized in that: The specific implementation method of averaging the probability distribution of the model output in step S4 is as follows: for each sample to be predicted, use the GAF-CNN-BiGRU model to predict and obtain the prediction probability of each model for each category; for each category, average the prediction probabilities of each model to obtain an average probability value; select the category with the largest average probability value as the final prediction result.

9. A system based on the CNN-BiGRU-based DDOS attack detection method as described in any of claims 1 to 8, comprising: The attack-related feature acquisition module is used to calculate the Spearman rank correlation coefficient between each feature in the CIC 2019D(D)oS dataset and the DDOS attack label feature, and determine the features that are significantly correlated with the DDOS attack based on the absolute value of the Spearman rank correlation coefficient; A texture image generation module, which is used to convert time series features into 2D texture images based on the Gram angle difference field; The network model building and training module is used to input the two-dimensional image converted from each univariate time series into the CNN-BiGRU network model and train the model until convergence; The prediction result calculation module is used to input the sample into the trained GAF-CNN-BiGRU network model, perform average probability fusion on the probability distribution output by the model, and then obtain the result with the highest prediction probability from the fused output and output it.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions of a DDOS attack detection method based on CNN-BiGRU, and the program instructions of the DDOS attack detection method based on CNN-BiGRU can be executed by one or more processors to implement the steps of the DDOS attack detection method based on CNN-BiGRU as described in any one of claims 1-8.

Images