Synchronous adaptive link flooding attack defense method for multi-dimensional identification heterogeneous network

Abstract

The invention discloses a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network, which comprises the following steps of: S1, sampling a packet loss rate and a link utilization rate of a network topology link to obtain a current state of the link; s2, key flow characteristics of the current state are extracted through a badger optimization algorithm; s3, inputting the key traffic characteristics of the current state into a prediction model based on a space-time diagram convolutional neural network to obtain a DDoS attack traffic prediction value; s4, identifying an attack action of the DDoS attack traffic predicted value, and selecting an optimal defense action through a partially observable Markov decision process model and a reward mechanism; and S5, adjusting the defense strategy according to the optimal defense action selected in the current state. According to the method, the attack behavior can be accurately predicted, and the optimal mitigation strategy in a novel multi-dimensional identification fusion network scene is dynamically learned, so that normal traffic transmission is maximized, and the influence of attack traffic on a bottleneck link is reduced to the minimum.

Description

Technical Field

[0001] The present invention belongs to the field of novel multi-dimensional identification fusion network security, and in particular relates to a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network. Background Art

[0002] In order to meet the urgent needs of diversified emerging services for the future Internet in terms of high security, light weight, intelligence, efficiency, mobility, etc., a new multi-dimensional identification fusion network is proposed based on an in-depth study of the existing network identification system and its derivative technologies. The new multi-dimensional identification fusion network uses a multi-dimensional unified identification UID (Unified Identifiers) as the unique identification of the subject identity information in the network. The multi-dimensional unified identification has multi-dimensional attributes such as identity, location, time, and physics, and is used to describe various types of network entities such as terminals, interfaces, services, content, and specific groups in the network. The new multi-dimensional identification fusion network adopts the idea of ​​separating identity and location, separates the IP space into a multi-dimensional unified identification UID and a network connection identification NID (Network Interconnection Identifiers), and uses UID to mark the unique identity of the object and NID to mark the location of the object in the network. Multi-dimensional identification network objects are divided into two categories: device objects and service objects, which contain different multi-dimensional attributes MAD (Multidimensional Attribute Description).

[0003] By analyzing the prediction methods of DDoS attacks in existing technical solutions, although the software-defined network defense solutions in the existing technology have made significant progress in DDoS attack prediction and defense, there is still a centralized architecture of the control plane that may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitations in the case of high-traffic DDoS attacks. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the synchronous adaptive link flooding attack defense method for multi-dimensionally identified heterogeneous networks provided by the present invention solves the problem that the centralized architecture of the control plane in the software-defined network defense solution in the prior art in terms of DDoS attack prediction and defense may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitation in the case of high-traffic DDoS attacks.

[0005] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a synchronous adaptive link flood attack defense method for a multi-dimensionally identified heterogeneous network, comprising the following steps:

[0006] S1, sampling the packet loss rate and link utilization of the network topology link of the multi-dimensionally identified heterogeneous network to obtain the current state of the link;

[0007] S2, extract the key traffic features of the current state through the honey badger optimization algorithm;

[0008] S3, input the key traffic features of the current state into the prediction model based on the spatiotemporal graph convolutional neural network to obtain the DDoS attack traffic prediction value;

[0009] S4, identify the attack actions of the DDoS attack traffic prediction value, and select the best defense action through the partially observable Markov decision process model and reward mechanism;

[0010] S5. Adjust the defense strategy based on the best defense action selected in the current state.

[0011] Further: In S1, the possibility b of the current state s of the link t The specific expression of (s) is:

[0012]

[0013] In the formula, p(o|b t ,a def ) is the normalization constant, b t is the confidence level, a def is the best possible defensive action in the current state, a att is the possible attack action in the current state, V att For all attack actions, p t-1 (s|s″,a def ,a att ) is the probability of state transition from state s″ to the current state s when the last attack event and defense event interact, S nhf For all states, q(a att ) is the probability of the last attack action occurring, b t-1 (s″) is the possibility of state s″.

[0014] Further: In S2, the method of extracting the key traffic features of the current state by the honey badger optimization algorithm includes the following steps:

[0015] S21, setting the position of the honey badger within the search space by the following formula;

[0016] hb i =lb i +r1×(ub i -lb i )

[0017] In the formula, hb i for i th Honey badger location, lbi andub i are the lower and upper limits of the search domain, r1 is the first random number;

[0018] S22. Calculate the intensity of the influence on the motion dynamics based on the distance between the honey badger and the prey. i ;

[0019]

[0020] In the formula, r2 is the second random number, α is the density coefficient, and its specific expression is:

[0021]

[0022] In the formula, Iteration max is the maximum number of iterations, and Iteration is the current number of iterations;

[0023] S23, update the honey badger according to the strength, and the position of the honey badger after the update hb new ;

[0024] hb new =hb prey +Flag×θ×I i ×hb prey +Flag

[0025] ×r3×α×(hb prey -hb i )×|cos(2πr4)×[1-cos(2πr5)]|

[0026] In the formula, hb prey is the position of the honey badger before the update, θ is a random factor, and θ≥1, r3 is the third random number, r4 is the fourth random number, r5 is the fifth random number, and r3,r4,r5∈[0,1], Flag is the flag of the search direction, and its specific expression is:

[0027]

[0028] Wherein, r6 is the sixth random number;

[0029] S24, the honey badger tracks the bees to guide the bird to the beehive through the updated honey badger, and the honey badger position is updated to obtain the final honey badger position, wherein the honey badger tracks the bees to guide the bird to the beehive is simulated by the following formula;

[0030] hb new =hb prey +F×r7×α×(hb prey -hb i )

[0031] In the formula, r7 is the seventh random number, and F is a tensor containing the feature dimensions of all nodes;

[0032] S25. Determine the key traffic characteristics of the current state according to the final honey badger position output.

[0033] Further: In S3, the prediction model based on the spatiotemporal graph convolutional neural network includes an adaptive hybrid spatiotemporal learning layer, an input layer and an output layer connected in sequence, the adaptive hybrid spatiotemporal learning layer includes a plurality of adaptive hybrid spatiotemporal learning components with jump connections, each adaptive hybrid spatiotemporal learning component includes a temporal convolution module, an adaptive hybrid graph learning module and a spatiotemporal adaptation module, wherein the adaptive hybrid graph learning module includes a static adaptive graph learning submodule, a dynamic graph learning submodule based on a graph attention mechanism and a spatial gate fusion mechanism submodule;

[0034] The S3 comprises the following sub-steps:

[0035] S31, model the key traffic characteristics of the current state at the millisecond, second and minute levels;

[0036] S32, inputting the modeling result into the time convolution module to obtain the final output of the time convolution module;

[0037] S33, inputting the modeling result into the adaptive hybrid graph learning module to obtain the output of the adaptive hybrid graph learning module;

[0038] S34, inputting the output of the multi-layer temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module, obtaining the output of the spatiotemporal adaptation module, and using it as the output of the adaptive hybrid spatiotemporal learning component;

[0039] S35, obtaining the output of the adaptive hybrid spatiotemporal learning layer according to the outputs of all adaptive hybrid spatiotemporal learning components;

[0040] S36, inputting the output of the adaptive hybrid spatiotemporal learning layer into the input layer, and outputting the DDoS attack traffic prediction value through the output layer.

[0041] Further: in said S31, the flow characteristic G of the current state is represented by graph data as G=(V, E, A, X);

[0042] Where V is the set of switches whose traffic characteristics change over time, and |V|=N, N is the number of identity switches, E is the set of links between switches, A is the adjacency matrix of the graph, X is the graph signal matrix for a given historical time step τ, and X=(X t-τ+1 ,…,X t-1 ,X t ), submatrix To identify the observation value at the i-th switch at time slice t, R is a matrix and F is a tensor containing the feature dimensions of all nodes.

[0043] Further: S32 includes the following sub-steps:

[0044] S321, inputting the modeling results into a plurality of time convolution modules with skip connections in sequence to obtain the first to third time feature elements finally calculated;

[0045] The expressions of the first to third time characteristic elements finally calculated are specifically:

[0046]

[0047] In the formula, is the first time characteristic element finally calculated, is the first time characteristic element calculated for the l-1th time, is the second time characteristic element finally calculated, is the second time characteristic element calculated for the l-1th time, is the third time characteristic element finally calculated, is the third time feature element calculated for the l-1th time, * is the convolution operator, □ is the element product, W t1 ,W t2 ,b t1 and b t2 is the learning parameter, tanh is the hyperbolic tangent activation function, σ is the sigmoid activation function, and the first to third time feature elements calculated for the lth time are calculated and generated based on the key traffic features of the current state at the millisecond, second, and minute levels;

[0048] S322, connecting the first to third time feature elements finally calculated into a vector to obtain the final output of the time convolution module;

[0049] Among them, the output of the temporal convolution module The specific expression is:

[0050]

[0051] Where MLP(·||·||·) is a multi-layer perceptron.

[0052] Further: S33 includes the following sub-steps:

[0053] S331: Input the modeling result into the static adaptive graph learning submodule for graph convolution operation to obtain the output of adaptive graph learning.

[0054]

[0055] In the formula, I N is a self-connected unitary matrix, A aam is the adaptive adjacency matrix, Θ is the graph convolution kernel, is the output of the dimensional graph convolutional neural network, and its specific expression is:

[0056]

[0057] In the formula, is the augmented adjacency matrix, X is the feature matrix of the modeling result;

[0058] S332, inputting the modeling result into the dynamic graph learning submodule based on the graph attention mechanism to obtain the dynamic graph learning result;

[0059] S333, input the output of adaptive graph learning and the result of dynamic graph learning into the spatial gate fusion mechanism submodule to obtain the output of the adaptive hybrid graph learning module

[0060]

[0061] In the formula, is the result of dynamic graph learning, W Gate , biasvector are all learnable parameters.

[0062] Further: S34 includes the following sub-steps:

[0063] S341, inputting the output of the time convolution module and the output of the adaptive hybrid graph learning module into the time-space adaptation module to obtain the key vectors of the nodes in the time and space dimensions;

[0064]

[0065] Where W Ks ,W Kt are all learnable transformation matrices, is the key vector of the node in the time dimension, is the key vector of the node in the spatial dimension;

[0066] S342, calculating the time and space dimension attention of the graph node through the key vector of the node in the time and space dimensions;

[0067]

[0068] In the formula, is the time dimension attention, is the spatial dimension attention, D is the degree normalization matrix, Q is the query vector, and Q = EWQ , W Q is a learnable transformation matrix;

[0069] S343, calculating the attention score of the node in the time and space dimensions according to the time and space dimension attention of the graph node;

[0070]

[0071] In the formula, is the attention score in the time dimension, is the attention score in the spatial dimension, Score for overall attention;

[0072] S344, calculate the output H of the spatiotemporal adaptation module according to the attention score of the node in the time and space dimensions l ;

[0073]

[0074] Further: In S35, the output H of the adaptive hybrid spatiotemporal learning component is obtained finally_out The specific expression is:

[0075]

[0076] Where L is the total number of adaptive hybrid spatiotemporal learning components;

[0077] In S36, the DDoS attack traffic prediction value is calculated. The specific expression is:

[0078]

[0079] Where W f1 , W f2 , W f3 are weight matrices, b f1 、b f2 、b f3 are bias vectors, and GeLU(·) is a fully connected layer operation.

[0080] Further: In S4, the reward mechanism R(s′,s,a def ,a att ) is expressed as:

[0081] R(s′,s,a def ,a att )=(Ψ s -Ψ s′ )+ò def

[0082] In the formula, Ψs is the average benign flow drop in state s determined based on historical data, Ψ s′ is the average benign flow drop in the next state s′ determined based on historical data, def A term that provides additional incentives for less explored defensive actions.

[0083] The beneficial effects of the present invention are:

[0084] (1) The present invention provides a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network. Aiming at the communication counterparts' requirements for high security, high mobility, and intelligent communication in a heterogeneous network communication environment, a new active LFA defense framework is designed based on a new multi-dimensional identification heterogeneous network architecture. The framework can accurately predict attack behaviors and dynamically learn the best mitigation strategy in the new multi-dimensional identification fusion network scenario to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links. In this way, the safe operation of the new multi-dimensional identification fusion network and system is ensured, which helps to achieve an efficient, secure, and intelligent network environment. It solves the problem that the centralized architecture of the control plane in the software-defined network defense solution in the prior art may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitation in the case of high-traffic DDoS attacks.

[0085] (2) The present invention designs a hybrid spatiotemporal graph convolutional neural network based on the honey badger optimization algorithm to construct a prediction model that can capture the composite spatial dependency and nonlinear temporal dependency of periodic data input, thereby greatly improving the prediction performance.

[0086] (3) The present invention designs a reinforcement learning optimization mitigation strategy based on partially observable Markov decision process modeling, which utilizes prediction results and distributed sampling information to continuously evolve and adapt to changes in attack strategies and environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 The present invention provides a flow chart of a synchronous adaptive link flood attack defense method for a multi-dimensionally identified heterogeneous network. DETAILED DESCRIPTION

[0088] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0089] like Figure 1As shown, in one embodiment of the present invention, a synchronous adaptive link flood attack defense method for multi-dimensionally identifying heterogeneous networks includes the following steps:

[0090] S1, sampling the packet loss rate and link utilization of the network topology link of the multi-dimensionally identified heterogeneous network to obtain the current state of the link;

[0091] S2, extract the key traffic features of the current state through the honey badger optimization algorithm;

[0092] S3, input the key traffic features of the current state into the prediction model based on the spatiotemporal graph convolutional neural network to obtain the DDoS attack traffic prediction value;

[0093] S4, identify the attack actions of the DDoS attack traffic prediction value, and select the best defense action through the partially observable Markov decision process model and reward mechanism;

[0094] S5. Adjust the defense strategy based on the best defense action selected in the current state.

[0095] This patent aims at the problems and shortcomings in the existing technology and proposes an active collaborative DDoS defense framework based on the existing research results. The framework makes full use of INT distributed sampling, spatiotemporal graph convolutional neural network model and self-learning driven mitigation strategy to improve fine-grained prediction accuracy and reduce false positive rate. It aims to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links. It has important research value and application prospects.

[0096] In S1, the probability b of the current state s of the link t The specific expression of (s) is:

[0097]

[0098] In the formula, p(o|b t ,a def ) is the normalization constant, b t is the confidence level, a def is the best possible defensive action in the current state, a att is the possible attack action in the current state, V att For all attack actions, p t-1 (s|s″,a def ,a att ) is the probability of state transition from state s″ to the current state s when the last attack event and defense event interact, S nhf For all states, q(a att ) is the probability of the last attack action occurring, b t-1 (s″) is the possibility of state s″.

[0099] In this embodiment, the process of selecting relevant features for the adaptive active defense framework includes eliminating the most redundant and unnecessary features, and adopting the honey badger optimization algorithm to overcome the main problems of long calculation time and local optimal superposition of previous algorithms.

[0100] In S2, the method of extracting the key traffic features of the current state by using the honey badger optimization algorithm includes the following steps:

[0101] S21, setting the position of the honey badger within the search space by the following formula;

[0102] hb i =lb i +r1×(ub i -lb i )

[0103] In the formula, hb i for i th Honey badger location, lb i andub i are the lower and upper limits of the search domain, r1 is the first random number, and its numerical strength is calculated based on the distance between the honey badger and the prey;

[0104] S22. Calculate the intensity of the influence on the motion dynamics based on the distance between the honey badger and the prey. i ;

[0105]

[0106] In the formula, r2 is the second random number, and α is the density coefficient, which is used to promote a smooth transition from exploration to mining. The specific expression is:

[0107]

[0108] In the formula, Iteration max is the maximum number of iterations, and Iteration is the current number of iterations;

[0109] S23, update the honey badger according to the strength, and the position of the honey badger after the update hb new ;

[0110] hb new =hb prey +Flag×θ×I i ×hb prey +Flag

[0111] ×r3×α×(hb prey -hb i )×|cos(2πr4)×[1-cos(2πr5)]|

[0112] In the formula, hb prey is the position of the honey badger before the update, θ is a random factor, and θ≥1, r3 is the third random number, r4 is the fourth random number, r5 is the fifth random number, and r3,r4,r5∈[0,1], Flag is the flag of the search direction, and its specific expression is:

[0113]

[0114] Wherein, r6 is the sixth random number;

[0115] S24, the honey badger tracks the bees to guide the bird to the beehive through the updated honey badger, and the honey badger position is updated to obtain the final honey badger position, wherein the honey badger tracks the bees to guide the bird to the beehive is simulated by the following formula;

[0116] hb new =hb prey +F×r7×α×(hb prey -hb i )

[0117] In the formula, r7 is the seventh random number, and F is a tensor containing the feature dimensions of all nodes;

[0118] S25. Determine the key traffic characteristics of the current state according to the final honey badger position output.

[0119] In this embodiment, the Honey Badger Optimization Algorithm uses the root mean square error (RMSE) as the fitness function of the spatiotemporal graph convolutional neural network model to evaluate feature quality, minimizing the RMSE to select the best features. This approach allows the Honey Badger Optimization Algorithm to effectively select features to improve the accuracy and performance of the prediction model. The update function RMSE value is associated with the update in each iteration to locate the best features.

[0120] The multi-periodic temporal dependence between the input data in the prediction model is captured with three periodic inputs of milliseconds T ms , seconds T s , min T min ,The present invention selects the best feature by introducing the honey badger optimization algorithm and ,uses it as the key traffic feature of the current state. ,The feature is fed into the prediction model to calculate the DDoS attack traffic ,prediction of link flooding DDoS attacks.

[0121] In S3, the prediction model based on the spatiotemporal graph convolutional neural network includes an adaptive hybrid spatiotemporal learning layer, an input layer, and an output layer connected in sequence, the adaptive hybrid spatiotemporal learning layer includes a plurality of adaptive hybrid spatiotemporal learning components with jump connections, each adaptive hybrid spatiotemporal learning component includes a temporal convolution module, an adaptive hybrid graph learning module, and a spatiotemporal adaptation module, wherein the adaptive hybrid graph learning module includes a static adaptive graph learning submodule, a dynamic graph learning submodule based on a graph attention mechanism, and a spatial gate fusion mechanism submodule;

[0122] In this embodiment, the root mean square error (RMSE) between the predicted value and the true value of the prediction model based on the spatiotemporal graph convolutional neural network is used as the loss function and minimized by back propagation. The MAE function is chosen because it provides an intuitive way to measure the average size of the prediction error applied to the regression problem.

[0123]

[0124] In the formula, is the prediction model’s prediction of all switch forwarding traffic at time step i, Y i It is the actual traffic forwarded by the switch.

[0125] The S3 comprises the following sub-steps:

[0126] S31, model the key traffic characteristics of the current state at the millisecond, second and minute levels;

[0127] S32, inputting the modeling result into the time convolution module to obtain the final output of the time convolution module;

[0128] S33, inputting the modeling result into the adaptive hybrid graph learning module to obtain the output of the adaptive hybrid graph learning module;

[0129] S34, inputting the output of the multi-layer temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module, obtaining the output of the spatiotemporal adaptation module, and using it as the output of the adaptive hybrid spatiotemporal learning component;

[0130] S35, obtaining the output of the adaptive hybrid spatiotemporal learning layer according to the outputs of all adaptive hybrid spatiotemporal learning components;

[0131] S36, inputting the output of the adaptive hybrid spatiotemporal learning layer into the input layer, and outputting the DDoS attack traffic prediction value through the output layer.

[0132] In S31, the flow characteristic G of the current state is represented by graph data as G=(V, E, A, X);

[0133] Where V is the set of switches whose traffic characteristics change over time, and |V|=N, N is the number of identity switches, E is the set of links between switches, A is the adjacency matrix of the graph, X is the graph signal matrix for a given historical time step τ, and X=(X t-τ+1 ,…,X t-1 ,X t ), submatrix To identify the observation value at the i-th switch at time slice t, R is a matrix and F is a tensor containing the feature dimensions of all nodes.

[0134] The S32 comprises the following sub-steps:

[0135] S321, inputting the modeling results into a plurality of time convolution modules with skip connections in sequence to obtain the first to third time feature elements finally calculated;

[0136] The expressions of the first to third time characteristic elements finally calculated are specifically:

[0137]

[0138] In the formula, is the first time characteristic element finally calculated, is the first time characteristic element calculated for the l-1th time, is the second time characteristic element finally calculated, is the second time characteristic element calculated for the l-1th time, is the third time characteristic element finally calculated, is the third time feature element calculated for the l-1th time, * is the convolution operator, □ is the element product, W t1 ,W t2 ,b t1 and b t2 is the learning parameter, tanh is the hyperbolic tangent activation function, σ is the sigmoid activation function, and the first to third time feature elements calculated for the lth time are calculated and generated based on the key traffic features of the current state at the millisecond, second, and minute levels;

[0139] In this implementation, the temporal convolution module of the adaptive hybrid spatiotemporal learning component consists of three gated temporal convolutional networks, Temporal Conv-milliseconds, Temporal Conv-second, and Temporal Conv-minute, to capture the complex temporal correlation and periodicity of traffic. The temporal convolution module is highly parallelized and easy to maintain high computational efficiency. By stacking multiple layers to build a temporal convolutional network, the temporal convolutional network allows an exponential sensing field with extended causal convolution. The gating mechanism has the ability to process continuous data, avoids the gradient vanishing / exploding problem, and enhances the modeling capability of temporal convolution, providing efficient model training and inference.

[0140] S322, connecting the first to third time feature elements finally calculated into a vector to obtain the final output of the time convolution module;

[0141] Among them, the output of the temporal convolution module The specific expression is:

[0142]

[0143] Where MLP(·||·||·) is a multi-layer perceptron.

[0144] In this embodiment, the first to third time feature elements are input into a multilayer perceptron to obtain the final output of the time convolution module.

[0145] The S33 comprises the following sub-steps:

[0146] S331: Input the modeling result into the static adaptive graph learning submodule for graph convolution operation to obtain the output of adaptive graph learning.

[0147]

[0148] In the formula, I N is a self-connected unitary matrix, A aam is the adaptive adjacency matrix, Θ is the graph convolution kernel, is the output of the dimensional graph convolutional neural network, and its specific expression is:

[0149]

[0150] In the formula, is the augmented adjacency matrix, X is the feature matrix of the modeling result;

[0151] In this embodiment, the augmented adjacency matrix is ​​composed of a self-connected unitary matrix I N , obtained based on the degree normalized matrix D and the adjacency matrix A.

[0152] S332, inputting the modeling result into the dynamic graph learning submodule based on the graph attention mechanism to obtain the dynamic graph learning result;

[0153] In this embodiment, a dynamic graph learning submodule (GAT) based on a graph attention mechanism is used to empower dynamic graph learning to achieve dynamic spatial feature aggregation, because GAT is known to capture the dynamic influence between adjacent nodes. Considering that the short-term dynamic effects of traffic trend changes mainly occur between adjacent 1-hop switches, an exponential distance decay matrix called the distance adjacency matrix is ​​designed as the prior graph structure of GAT. GAT achieves weighted feature aggregation by calculating the attention scores of the central node and the adjacent nodes. Multi-head attention is also suitable for capturing the semantics of the relationship between nodes in different learning subspaces. In addition, multi-head attention can be calculated in parallel to reduce the time complexity:

[0154]

[0155] After the above changes in the formula, the graph attention mechanism formula for dynamic Graph learning can be modeled as follows:

[0156]

[0157] where a ij Indicates that the switch i and j The attention score calculated between i ,N i Represents the neighboring nodes of a node in the topology i The collection of is a learnable parameter vector, and is the weight matrix of the shared linear transformation. For each head, and W head are all represented as linear transformation matrices used to generate the corresponding heads, and Head is represented as the number of heads. The final output of dynamic graph learning is defined as

[0158] S333, input the output of adaptive graph learning and the result of dynamic graph learning into the spatial gate fusion mechanism submodule to obtain the output of the adaptive hybrid graph learning module

[0159]

[0160] In the formula, is the result of dynamic graph learning, W Gate ,W gate1 ,W gate2, biasvector are all learnable parameters.

[0161] The S34 comprises the following sub-steps:

[0162] S341, inputting the output of the time convolution module and the output of the adaptive hybrid graph learning module into the time-space adaptation module to obtain the key vectors of the nodes in the time and space dimensions;

[0163]

[0164] Where W Ks ,W Kt are all learnable transformation matrices, is the key vector of the node in the time dimension, is the key vector of the node in the spatial dimension;

[0165] S342, calculating the time and space dimension attention of the graph node through the key vector of the node in the time and space dimensions;

[0166]

[0167] In the formula, is the time dimension attention, is the spatial dimension attention, D is the degree normalization matrix, Q is the query vector, and Q = EW Q , W Q is a learnable transformation matrix;

[0168] S343, calculating the attention score of the node in the time and space dimensions according to the time and space dimension attention of the graph node;

[0169]

[0170] In the formula, is the attention score in the time dimension, is the attention score in the spatial dimension, Score for overall attention;

[0171] S344, calculate the output H of the spatiotemporal adaptation module according to the attention score of the node in the time and space dimensions l ;

[0172]

[0173] In S35, the output H of the adaptive hybrid spatiotemporal learning component is obtained. finally_out The specific expression is:

[0174]

[0175] Where L is the total number of adaptive hybrid spatiotemporal learning components;

[0176] In this embodiment, each output of the adaptive hybrid spatiotemporal learning component is fed forward via a skip connection directly to the output layer. This hierarchical arrangement allows the neural network to expand its time range, effectively capturing short-term millisecond-level and long-term minute-level relationships in the data. The low-level components of the model are fine-tuned to emphasize the characteristics of short time steps, while the high-level components are designed to integrate information over longer time spans. Skip connections help the model handle spatial correlations at different time scales. After integrating information through skip connections, accumulation operations such as the following equation combine the contributions of all adaptive hybrid spatiotemporal learning components to ultimately form a composite feature representation.

[0177] In S36, the DDoS attack traffic prediction value is calculated. The specific expression is:

[0178]

[0179] Where W f1 , W f2 , W f3 are weight matrices, b f1 、b f2 、b f3 are bias vectors, and GeLU(·) is a fully connected layer operation.

[0180] In this embodiment, the output layer uses a 3-layer fully connected layer to convert the combined features of the flow into a final comprehensive and accurate DDoS attack traffic prediction value.

[0181] In S4, by constructing a partially observable Markov decision process model, actively learning the required parameters, and constantly updating the model, more accurate defense strategies are formulated with the help of observation information such as network traffic characteristics and attack behaviors to enhance the defense effect. A partially observable Markov decision process is a tuple (S nhf ,A def ,T trs ,Ω OS ,R rwd ,κ Fat ). Among them S nhf Defined as the state space, A def Defined as the defensive space, Ω OS represents the observation space, T trs represents the state transfer matrix, M O represents the observation matrix, R rwd is a reward function that quantifies the possible defense benefit, κ Fat It is a discount factor that measures the impact of current behavior on the future.

[0182] Reinforcement learning based on partially observable Markov decision processes dynamically formulates sequential decision problems, making the DDoS defense agent more context-aware. The prediction model based on spatiotemporal graph convolutional neural networks automatically identifies DDoS attack preparation signals and triggers responses to assist in the reasoning planning of attack strategies, which can not only minimize the negative impact of the agent's blind exploration, but also help the agent converge to the optimal defense strategy faster.

[0183] Considering the active deployment of the best defense action, the agent is incentivized to att |s,a def ) accurately determine all possible attack actions a in state s att ∈V att and the best defensive action a def ∈A def .

[0184] It defines the probability terms of the next attack action based on the link conditions and the recent attack trends of the links which are integrated into the state transition matrix.

[0185]

[0186] When the environment is (s, s″, a def ,a′ def ,a′ att ), p t (a att |s,s″,a def ,a′ def ,a′ att ) is specified as executing a att The probability that q(a' att )=p t (a' att |*,*,*) is taken as the behavior of the last attack.

[0187] In S4, the reward mechanism R(s′,s,a def ,a att ) is expressed as:

[0188] R(s′,s,a def ,a att )=(Ψ s -Ψ s′ )+ò def

[0189] In the formula, Ψ s is the average benign flow drop in state s determined based on historical data, Ψ s′ is the average benign flow drop in the next state s′ determined based on historical data,def A term that provides additional incentives for less explored defensive actions.

[0190] In this embodiment, the principle of the designed reward mechanism is specifically as follows:

[0191] In order to select the best defense action through the partially observable Markov decision process model and reward mechanism, the possible attack actions a in the current state are att The probability is designated as the probability p t′ (a att ∣s initial ,s previous ,a def ,a′ def ,a′ att ) in the past time environment (s initial ,s previous ,a def ,a′ def ,a′ att )middle.

[0192] Each time, the agent sends new attack observations to retrain the prediction model, where this online learning method enables learning new attack strategies and their adaptability instead of relying on a static attack model. For all possible current states s∈S nhf , the next state s'∈S nhf and action a def ∈A def , the state transfer matrix T trs By p t (s'|s,a def )composition.

[0193]

[0194] where p t (s′|s,a def ,a att ) represents a dynamically changing system, p t (a att ∣s,a def ) is in state s from attacking a att To Defense def possibility.

[0195] p t (s′|s,a def ,a att )=(1-ε)p t-1 (s′|s,a def ,a att )+εb t (s′)b t-1 (s)q(aatt )

[0196] The agent computes the expected reward, composes a new POMDP model, and solves it in real time using the Heuristic Search Value Iteration (HSVI) algorithm to compute the best mitigation strategy recommendation. For all possible current states s∈S nhf , the next state s'∈S nhf , attack action a att ∈V att , defensive action a def ∈A def , the reward can be calculated by the following equation:

[0197] R(s′,s,a def ,a att )=(Ψ s -Ψ s′ )+ò def

[0198] For less explored defensive behaviors, def The maximum value of the defense strategy is higher to incentivize the execution of the behavior, thus solving the exploration-exploitation dilemma of reinforcement learning with logarithmic regret. This exploration method has better sample efficiency because the reward of irrelevant actions is always low despite the higher search efficiency.

[0199] The beneficial effects of the present invention are as follows: the present invention provides a synchronous adaptive link flooding attack defense method for a multi-dimensional identification heterogeneous network. Aiming at the communication counterpart's demand for high security, high mobility, and intelligent communication in a heterogeneous network communication environment, a new active LFA defense framework is designed based on a new multi-dimensional identification heterogeneous network architecture. The framework can accurately predict attack behaviors and dynamically learn the best mitigation strategy in the new multi-dimensional identification fusion network scenario to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links. In this way, the safe operation of the new multi-dimensional identification fusion network and system is ensured, which helps to achieve an efficient, secure, and intelligent network environment, and solves the problem that the centralized architecture of the control plane in the software-defined network defense solution in the prior art may cause the controller to become a bottleneck, affecting the overall network performance, especially the hardware performance limitations in the case of high-traffic DDoS attacks.

[0200] The present invention designs a hybrid spatiotemporal graph convolutional neural network based on the honey badger optimization algorithm to build a prediction model that can capture the composite spatial dependency and nonlinear temporal dependency of periodic data input, thereby greatly improving the prediction performance.

[0201] The present invention designs a reinforcement learning optimization mitigation strategy based on partially observable Markov decision process modeling, which utilizes prediction results and distributed sampling information to continuously evolve and adapt to changes in attack strategies and environment.

[0202] In the description of the present invention, it is necessary to understand that the orientation or positional relationship indicated by the terms "center", "thickness", "upper", "lower", "horizontal", "top", "bottom", "inner", "outer", "radial", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", and "third" are used only for descriptive purposes, and cannot be understood as indicating or implying the relative importance or the number of implicitly specified technical features. Therefore, the features defined by "first", "second", and "third" may explicitly or implicitly include one or more of the features.

Claims

1. A synchronous adaptive link flood attack defense method for multi-dimensional identification heterogeneous networks, characterized in that: The following steps are involved: S1, sampling the packet loss rate and link utilization of the network topology link of the multi-dimensionally identified heterogeneous network to obtain the current state of the link; S2, extract the key traffic features of the current state through the honey badger optimization algorithm; S3, input the key traffic features of the current state into the prediction model based on the spatiotemporal graph convolutional neural network to obtain the DDoS attack traffic prediction value; S4, identify the attack actions of the DDoS attack traffic prediction value, and select the best defense action through the partially observable Markov decision process model and reward mechanism; S5. Adjust the defense strategy based on the best defense action selected in the current state.

2. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 1 is characterized in that: In S1, the probability b of the current state s of the link t The specific expression of (s) is: In the formula, p(o|b t , a def ) is the normalization constant, b t is the confidence level, a def is the best possible defensive action in the current state, a att is the possible attack action in the current state, V att For all attack actions, p t-1 (s|s", a def , a att ) is the probability of state transition from state s" to the current state s when the last attack event and defense event interact, S nhf For all states, q(a att ) is the probability of the last attack action occurring, b t-1 (s") is the probability of state s".

3. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 2 is characterized in that: In S2, the method of extracting the key traffic features of the current state by using the honey badger optimization algorithm includes the following steps: S21, setting the position of the honey badger within the search space by the following formula; hb i =lb i +r1×(ub i -lb i ) In the formula, hb i for i th Honey badger location, lb i andub i are the lower and upper limits of the search domain, r1 is the first random number; S22. Calculate the intensity of the influence on the motion dynamics based on the distance between the honey badger and the prey. i ; In the formula, r2 is the second random number, α is the density coefficient, and its specific expression is: In the formula, Iteration max is the maximum number of iterations, and Iteration is the current number of iterations; S23, update the honey badger according to the strength, and the position of the honey badger after the update hb new ; hb new =hb prey +Flag×θ×I i ×hb prey +Flag ×r3×α×(hb prey -hb i )×|cos(2πr4)×[1-cos(2πr5)]| In the formula, hb prey is the position of the honey badger before the update, θ is a random factor, and θ≥1, r3 is the third random number, r4 is the fourth random number, r5 is the fifth random number, and r3,r4,r5∈[0,1], Flag is the flag of the search direction, and its specific expression is: Wherein, r6 is the sixth random number; S24, the honey badger tracks the bees to guide the bird to the beehive through the updated honey badger, and the honey badger position is updated to obtain the final honey badger position, wherein the honey badger tracks the bees to guide the bird to the beehive is simulated by the following formula; hb new =hb prey +F×r7×α×(hb prey -hb i ) In the formula, r7 is the seventh random number, and F is a tensor containing the feature dimensions of all nodes; S25. Determine the key traffic characteristics of the current state according to the final honey badger position output.

4. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 3 is characterized in that: In S3, the prediction model based on the spatiotemporal graph convolutional neural network includes an adaptive hybrid spatiotemporal learning layer, an input layer, and an output layer connected in sequence, the adaptive hybrid spatiotemporal learning layer includes a plurality of adaptive hybrid spatiotemporal learning components with jump connections, each adaptive hybrid spatiotemporal learning component includes a temporal convolution module, an adaptive hybrid graph learning module, and a spatiotemporal adaptation module, wherein the adaptive hybrid graph learning module includes a static adaptive graph learning submodule, a dynamic graph learning submodule based on a graph attention mechanism, and a spatial gate fusion mechanism submodule; The S3 comprises the following sub-steps: S31, model the key traffic characteristics of the current state at the millisecond, second and minute levels; S32, inputting the modeling result into the time convolution module to obtain the final output of the time convolution module; S33, inputting the modeling result into the adaptive hybrid graph learning module to obtain the output of the adaptive hybrid graph learning module; S34, inputting the output of the multi-layer temporal convolution module and the output of the adaptive hybrid graph learning module into the spatiotemporal adaptation module, obtaining the output of the spatiotemporal adaptation module, and using it as the output of the adaptive hybrid spatiotemporal learning component; S35, obtaining the output of the adaptive hybrid spatiotemporal learning layer according to the outputs of all adaptive hybrid spatiotemporal learning components; S36, inputting the output of the adaptive hybrid spatiotemporal learning layer into the input layer, and outputting the DDoS attack traffic prediction value through the output layer.

5. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 4 is characterized in that: In S31, the flow characteristic G of the current state is represented by graph data as G=(V, E, A, X); Where V is the set of switches whose traffic characteristics change over time, and |V|=N, N is the number of identity switches, E is the set of links between switches, A is the adjacency matrix of the graph, X is the graph signal matrix for a given historical time step τ, and X=(X t-τ+1 ,…,X t-1 ,X t ), submatrix To identify the observation value at the i-th switch at time slice t, R is a matrix and F is a tensor containing the feature dimensions of all nodes.

6. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 5 is characterized in that: The S32 comprises the following sub-steps: S321, inputting the modeling results into a plurality of time convolution modules with skip connections in sequence to obtain the first to third time feature elements finally calculated; The expressions of the first to third time characteristic elements finally calculated are specifically: In the formula, is the first time characteristic element finally calculated, is the first time characteristic element calculated for the l-1th time, is the second time characteristic element finally calculated, is the second time characteristic element calculated for the l-1th time, is the third time characteristic element finally calculated, is the third time feature element calculated for the l-1th time, * is the convolution operator, is the element-wise product, W t1 ,W t2 ,b t1 and b t2 is the learning parameter, tanh is the hyperbolic tangent activation function, σ is the sigmoid activation function, and the first to third time feature elements calculated for the lth time are calculated and generated based on the key traffic features of the current state at the millisecond, second, and minute levels; S322, connecting the first to third time feature elements finally calculated into a vector to obtain the final output of the time convolution module; Among them, the output of the temporal convolution module The specific expression is: Where MLP(·||·||·) is a multi-layer perceptron.

7. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 6 is characterized in that: The S33 comprises the following sub-steps: S331: Input the modeling result into the static adaptive graph learning submodule for graph convolution operation to obtain the output of adaptive graph learning. In the formula, I N is a self-connected unitary matrix, A aam is the adaptive adjacency matrix, Θ is the graph convolution kernel, is the output of the dimensional graph convolutional neural network, and its specific expression is: In the formula, is the augmented adjacency matrix, X is the feature matrix of the modeling result; S332, inputting the modeling result into the dynamic graph learning submodule based on the graph attention mechanism to obtain the dynamic graph learning result; S333, input the output of adaptive graph learning and the result of dynamic graph learning into the spatial gate fusion mechanism submodule to obtain the output of the adaptive hybrid graph learning module In the formula, is the result of dynamic graph learning, W Gate , biasvector are all learnable parameters.

8. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 7 is characterized in that: The S34 comprises the following sub-steps: S341, inputting the output of the time convolution module and the output of the adaptive hybrid graph learning module into the time-space adaptation module to obtain the key vectors of the nodes in the time and space dimensions; Where W Ks ,W Kt are all learnable transformation matrices, is the key vector of the node in the time dimension, is the key vector of the node in the spatial dimension; S342, calculating the time and space dimension attention of the graph node through the key vector of the node in the time and space dimensions; In the formula, is the time dimension attention, is the spatial dimension attention, D is the degree normalization matrix, Q is the query vector, and Q = EW Q , W Q is a learnable transformation matrix; S343, calculating the attention score of the node in the time and space dimensions according to the time and space dimension attention of the graph node; In the formula, is the attention score in the time dimension, is the attention score in the spatial dimension, Score for overall attention; S344, calculate the output H of the spatiotemporal adaptation module according to the attention score of the node in the time and space dimensions l ; 9. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 8 is characterized in that: In S35, the output H of the adaptive hybrid spatiotemporal learning component is obtained. finally_out The specific expression is: Where L is the total number of adaptive hybrid spatiotemporal learning components; In S36, the DDoS attack traffic prediction value is calculated. The specific expression is: Where W f1 , W f2 , W f3 are weight matrices, b f1 、b f2 、b f3 are bias vectors, and GeLU(·) is a fully connected layer operation.

10. The synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network according to claim 9, characterized in that: In S4, the reward mechanism R(s′,s,a def ,a att ) is expressed as: In the formula, Ψ s is the average benign flow drop in state s determined based on historical data, Ψ s′ is the average benign flow drop in the next state s′ determined based on historical data, A term that provides additional incentives for less explored defensive actions.

Images