Multi-dimensional identification fusion network-oriented dual-scale pulse wave DDos capturing method

Abstract

The invention discloses a dual-scale pulse wave DDoS capturing method for a multi-dimensional identification fusion network. The method comprises the following steps: S1, deploying a BNN inference model in multi-dimensional routing switching equipment accessed by the multi-dimensional identification fusion network; s2, converting decimal stream level features input by the multi-dimensional routing switching device into binary forms, inputting the binary forms into a BNN inference model, and performing layer-by-layer inference to obtain a coarse-grained malicious traffic detection result; s3, in a controller of the multi-dimensional identification fusion network, performing Gram matrix-based transformation on a malicious traffic detection result, constructing a Gram-like matrix, and extracting statistical characteristics of aggregation flow time sequence data according to the Gram-like matrix; and S4, using a CNN network model and a BiLSTM model to perform spatial-temporal feature extraction on the statistical features, and capturing DDoS attack traffic.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a dual-scale abnormal traffic DDos capture and prediction method for a multi-dimensional identification fusion network. Background Art

[0002] With the rapid development of the Internet and the Internet of Things, the network environment has become increasingly complex and diverse. The traditional single identification system (such as IP address) has been unable to meet the needs of modern networks, especially when faced with the requirements of high security, lightweight, intelligent, efficient and transferable. To solve these problems, multi-dimensional identification fusion networks and systems have emerged, aiming to provide more flexible, efficient and secure network identification solutions. Multi-dimensional identification fusion technology more comprehensively describes various entities and behaviors in the network. Its core idea is to separate identity identification from location identification, so that the identity of network entities and their locations can be managed independently. This approach not only improves the flexibility and manageability of the network, but also enhances security and reliability.

[0003] With the rapid development of multi-dimensional identification fusion networks and systems, distributed denial of service (DDoS) attacks have become one of the major threats in the field of network security. Pulse wave DDoS attacks send a large amount of false traffic to the target server in the network system, making it unable to provide services normally, which seriously affects the stability and security of the network. Traditional DDoS detection methods mainly rely on a single traffic feature, which often seems to be inadequate in the face of complex and changing network environments. At the same time, since the multi-dimensional identification fusion network and system is essentially a heterogeneous network, that is, a complex network environment composed of network devices of different types, different protocols and different topologies, the difficulty of DDoS attack detection is increased. In this case, relying only on a single scale of traffic features for detection is likely to lead to high false alarm rates and missed alarm rates. For the new type of pulse wave volume attacks characterized by short, high-rate traffic pulses and fast switching modes, traditional detection mechanisms are difficult to balance the accuracy and efficiency of the model, and require seconds to minutes to complete data mirroring, transmission and identification within the topology.

[0004] The existing related DDoS defense methods and their limitations are as follows:

[0005] (1) SDN-based DDoS defense method

[0006] SDN is a paradigm shift from traditional IP networks to centralized software-based network control, aiming to decouple the control plane from the data plane. Traditional control plane-based defense schemes use the computational scalability of the controller to extract key features of network traffic encapsulated in relevant packet headers from packets in messages. Existing schemes use spatiotemporal graph convolutional neural network models to classify switches containing attack traffic and propose DDoS attack mitigation schemes based on unsupervised learning models to defend against DDoS attacks in software-defined CPS. With the rapid development of programmable data planes, scholars have used programmability to deploy detection algorithms or mitigation strategies to defend against DDoS attacks directly on P4 switches. Through ML models deployed on programmable switches, traffic is accurately classified at line speed and discard, inspection or throttling strategies are executed to prevent attack traffic from interfering with the victim's operations.

[0007] In this method, in the SDN architecture, the network control plane centrally handles all control tasks in the network. When a large-scale DDoS attack occurs, the control plane may be overloaded due to the need to handle a large amount of abnormal traffic, resulting in network performance degradation or even control plane crash.

[0008] During the DDoS attack detection and response process, the data plane needs to communicate frequently with the control plane. This communication will increase latency, especially in large network environments, which may affect the effectiveness of real-time detection and response. SDN-based DDoS detection methods rely on traffic characteristics and behavior patterns. Due to the complexity and diversity of network traffic, there may be a high false alarm rate and missed alarm rate, which affects the accuracy and effectiveness of defense strategies.

[0009] Implementing an SDN-based DDoS defense solution requires complex configuration and management, including network topology, policy configuration, traffic monitoring, and anomaly detection, which increases the complexity and difficulty of network management. Although SDN provides flexible network management, it requires additional computing and storage resources to handle traffic monitoring and anomaly detection. This additional performance overhead may affect the overall efficiency of the network.

[0010] (2) DDoS defense methods based on characteristics and behaviors

[0011] Abnormal behavior is identified by analyzing the statistical characteristics of network traffic (such as packet size, transmission rate, traffic peak, etc.). At the same time, the nodes and traffic relationships in the network are represented as graph structures, and abnormal behavior is detected through graph analysis techniques (such as convolutional networks, random walks, etc.). Deep neural networks (such as convolutional neural networks, recursive neural networks, etc.) are used to conduct in-depth analysis of traffic data, and time series analysis techniques (such as autoregressive models, long short-term memory networks, etc.) are used to model the time series of traffic to identify abnormal changes. The network is comprehensively analyzed from different perspectives (such as traffic characteristics perspective, protocol type perspective, topology perspective, etc.) to enhance the comprehensiveness and robustness of detection. However, these technologies are difficult to capture and mine the potential internal correlation of DDoS attacks, and cannot capture attack traffic in real time, which increases communication overhead and causes network bottlenecks.

[0012] In this method, it is necessary to accurately select and extract traffic features (such as packet size, transmission rate, protocol type, etc.). Improper feature selection may lead to reduced detection accuracy. Attackers can evade detection by changing the characteristics of attack traffic. For example, by changing the packet size, transmission rate, etc., the attack traffic is no different from normal traffic. When faced with diverse and complex network traffic, it is easy to misjudge legitimate traffic as attack traffic, resulting in a high false alarm rate.

[0013] Behavior-based DDoS defense methods require real-time monitoring and analysis of the behavior patterns of each node in the network, which has high computational and storage overhead, especially in large-scale networks. It requires a long observation period to establish behavior patterns, and the response time is slow, which may not be able to respond to rapidly erupting DDoS attacks in a timely manner. It usually involves complex algorithms and models (such as graph analysis, timing analysis, etc.), which are difficult to implement and maintain.

[0014] When using feature-based and behavior-based methods together, it is necessary to coordinate the detection results of the two, which makes integration difficult. Both feature detection and behavior detection face real-time issues. In high-traffic, high-rate attack scenarios, the effect of real-time detection and response may not be ideal. When facing a dynamically changing network environment, the adaptability is poor, and the detection strategy needs to be constantly adjusted and optimized. Summary of the invention

[0015] In view of the above-mentioned deficiencies in the prior art, the dual-scale pulse wave DDos capture method for a multi-dimensional identification fusion network provided by the present invention solves the problem that the existing related methods are difficult to accurately capture the temporal and spatial characteristics of business data, thereby affecting the response attack rate.

[0016] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a dual-scale pulse wave DDoS capture method for a multi-dimensional identification fusion network, comprising the following steps:

[0017] S1. Deploy the BNN inference model in the multi-dimensional routing switching device accessed by the multi-dimensional identity fusion network;

[0018] S2, converting the decimal flow-level features input by the multi-dimensional routing switching device into binary form and inputting them into the BNN inference model for layer-by-layer inference to obtain coarse-grained malicious traffic detection results;

[0019] S3. In the controller of the multi-dimensional identification fusion network, the malicious traffic detection results are transformed based on the Gram matrix, a Gram-like matrix is ​​constructed, and statistical features of the aggregated flow time series data are extracted based on the Gram matrix;

[0020] S4. Use the CNN network model and BiLSTM model to extract spatiotemporal features of statistical features and capture DDoS attack traffic.

[0021] Furthermore, the step S2 is specifically as follows:

[0022] S21, using a matrix equivalent substitution method, converting the decimal flow-level features input by the multi-dimensional routing switching device into binary;

[0023] S22. In the BNN inference model, the binary weight of the kth neuron in the current layer and the binary input a of the current layer k Perform bitwise XOR operation between them to obtain the similarity measure between the weight and the input Among them, ⊙ represents the bitwise XOR operation, and PopCount represents the number of 1s in the bit string of the statistical calculation result;

[0024] S23, normalizing the similarity measure c to obtain a corresponding normalized value d;

[0025] S24. Use the SIGN function to process the normalized value d to obtain the binary output of the corresponding neuron

[0026]

[0027] S25, combine the binary outputs of multiple neurons to form the next layer input a k+1 =(a k+1 《1)+SIGN(d), repeat steps S22 to S24, and reason layer by layer to output coarse-grained malicious traffic detection results; wherein << represents a left shift operation.

[0028] Further, in step S23, the normalized value d is expressed as:

[0029]

[0030] Where, t krepresents the predefined threshold, r k1 Represents the mini-batch mean adjusted for normalization based on batch statistics.

[0031] Furthermore, in the BNN inference model, all 1-bit weights of the neurons are connected into decimal values ​​and stored in registers of the multidimensional routing switch device.

[0032] Furthermore, in step S3, the method for constructing a Gram-like matrix is ​​specifically as follows:

[0033] S31, the malicious traffic detection result is represented as a current flow sequence X containing n data = x1, x2, ..., x n , and scale it to the range of [-1, 1] to obtain the corresponding current flow sequence

[0034] S32, using the bijective transformation of the Arccos function, the current flow sequence Each univariate flow in is mapped from Cartesian coordinates to polar coordinates;

[0035] S33. According to the polar coordinates of each univariate flow, a Gramian angular field transformation is performed to construct a Gram-like matrix.

[0036] Furthermore, in step S32, the expression for mapping the univariate flow from Cartesian coordinates to polar coordinates is:

[0037]

[0038] In step S33, the expression for performing Gramian angular field conversion is:

[0039]

[0040] In the formula, φ i Indicated by The inverse cosine function is used to calculate the angle, φ j Indicates that The inverse cosine function is used to calculate the angle, and I represents the angle with Identity matrices of the same size;

[0041] The constructed Gram-like matrix G is expressed as:

[0042]

[0043] Furthermore, in step S3, the extracted statistical features include the first-order moment μ and the second-order moment σ of the Gram matrix 2 And the third-order moment γ, its expression is:

[0044]

[0045] Where N is the total number of polar coordinates, Q i,j Represents each element in the Gram-like matrix.

[0046] Furthermore, the step S4 is specifically as follows:

[0047] S41. In the CNN network model, the statistical features are adaptively calibrated by multi-head squeezing operations to generate global statistical information z with global average pooling. c ;

[0048] S42, global statistical information z c Perform an excitation operation to adaptively learn the weight coefficient s of the global statistics through two fully connected layers and activation functions;

[0049] S43, in the CNN network model, for each SE block, the corresponding learning flow feature X is obtained by multiplying the generated weighted coefficient with the corresponding original input feature FT After fitting the learning flow features of all SE blocks in parallel, the fusion feature X′ is obtained FT , as the spatial characteristics of DDoS;

[0050] S44. Use the BiLSTM model to capture the dependency relationship and global data relationship of statistical features in the time dimension to obtain the time characteristics of DDoS traffic;

[0051] S45. Complete the capture of DDoS attack traffic based on the spatial characteristics and spatial features of the DDoS traffic.

[0052] Furthermore, in step S41, the global statistical information z c It is expressed as:

[0053]

[0054] In the formula, x FTc represents the c input features of size H in the CNN model, x FT =[x FT1 , x FT2 ,···,x FTc ],F sq (·) represents the global average pooling function;

[0055] In step S42, the weighting coefficient s is expressed as:

[0056] s=F ex (F sq (x FTc),W)=Sigmoid(g(z,W))=Sigmoid(W2GeLu(W1))

[0057] In the formula, F ex (·) represents the feature extraction function, W represents the weight parameter of the model, g(·) represents a combination function, Sigmoid(·) represents the Sigmoid activation function, and z represents the sq (x FTc ), GeLu(·) represents the GeLu activation function, and W1 and W2 represent the weights of the two fully connected layers;

[0058] In step S43, the fusion feature X′ FT It is expressed as:

[0059] X′ FT =s 1 X FT +s 2 X FT +s 3 X FT .

[0060] The beneficial effects of the present invention are:

[0061] 1. Improve the accuracy of malicious traffic detection: By deploying a binary neural network (BNN) inference model in the multi-dimensional routing and switching equipment of the multi-dimensional identification fusion network access, it can effectively capture and respond to dynamic changes in the network, and infer layer by layer to obtain coarse-grained malicious traffic detection results, which greatly improves the accuracy of detection.

[0062] 2. Efficiently extract spatiotemporal features of traffic: By using Gram matrix transformation and combining CNN and BiLSTM models, spatiotemporal features of traffic statistics can be extracted to more accurately capture DDoS attack traffic. This dual-scale analysis method not only improves the comprehensiveness of detection, but also enhances the robustness of the model in complex network environments.

[0063] 3. Reduce the system's computing and storage overhead: The BNN inference model is used to perform binary operations during stream-level feature processing, which reduces memory usage and the number of register read and write operations. This not only improves the system's processing speed, but also reduces computing and storage overhead, allowing the system to run efficiently under high load.

[0064] 4. Improve the real-time performance of detection and response: By deploying the detection algorithm directly on the programmable switch, the system can efficiently collaborate between the data plane and the control plane in the network, reducing communication delays and thus improving the real-time performance of DDoS attack detection and response. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 The invention provides a dual-scale pulse wave DDos capture method for a multi-dimensional identification fusion network. DETAILED DESCRIPTION

[0066] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0067] The embodiment of the present invention provides a dual-scale pulse wave DDoS capture method for a multi-dimensional identification fusion network, such as Figure 1 As shown, the following steps are included:

[0068] S1. Deploy the BNN inference model in the multi-dimensional routing switching device accessed by the multi-dimensional identity fusion network;

[0069] S2, converting the decimal flow-level features input by the multi-dimensional routing switching device into binary form and inputting them into the BNN inference model for layer-by-layer inference to obtain coarse-grained malicious traffic detection results;

[0070] S3. In the controller of the multi-dimensional identification fusion network, the malicious traffic detection results are transformed based on the Gram matrix, a Gram-like matrix is ​​constructed, and statistical features of the aggregated flow time series data are extracted based on the Gram matrix;

[0071] S4. Use the CNN network model and BiLSTM model to extract spatiotemporal features of statistical features and capture DDoS attack traffic.

[0072] In step S1 of the embodiment of the present invention, considering the limitations of the P4 language, a binary neural network, i.e., a BNN inference model, is adopted and deployed on a multi-dimensional routing switching device, so that it can effectively capture and respond to continuous network dynamic changes to accurately classify abnormal traffic.

[0073] Step S2 of the embodiment of the present invention is specifically as follows:

[0074] S21, using a matrix equivalent substitution method, converting the decimal flow-level features input by the multi-dimensional routing switching device into binary;

[0075] Exemplarily, in this embodiment, by converting the decimal stream-level features into binary form input, it is ensured that the input layer of the BNN reasoning model can operate with effective bit size;

[0076] S22. In the BNN inference model, the binary weight of the kth neuron in the current layer and the binary input a of the current layer k Perform bitwise XOR operation between them to obtain the similarity measure between the weight and the input Among them, ⊙ represents the bitwise XOR operation, and PopCount represents the number of 1s in the bit string of the statistical calculation result;

[0077] S23, normalizing the similarity measure c to obtain a corresponding normalized value d;

[0078] S24. Use the SIGN function to process the normalized value d to obtain the binary output of the corresponding neuron

[0079] S25, combine the binary outputs of multiple neurons to form the next layer input a k+1 =(a k+1 <<1)+SIGN(d), repeat steps S22 to S24, and reason layer by layer to output coarse-grained malicious traffic detection results; wherein << represents a left shift operation.

[0080] In step S23 of this embodiment, the normalized value d is expressed as:

[0081]

[0082] Where, t k represents the predefined threshold, r k1 Represents the mini-batch mean adjusted for normalization based on batch statistics.

[0083] Optionally, the threshold t k Set to half the length of the bit string.

[0084] In this embodiment, in the BNN inference model, all 1-bit weights of the neurons are connected into decimal values ​​and stored in registers of the multidimensional routing switching device; this setting minimizes the number of register read / write operations and memory usage, which is critical to maintaining the high processing speed of the multidimensional identification routing switching device.

[0085] In step S3 of the embodiment of the present invention, the control plane in the novel multi-dimensional identification fusion network and system receives the alarm message sent after the data plane detection is triggered, and performs granular intent detection on suspicious traffic in the topology. By performing a Gram matrix-based transformation on the time series data, data for the next step of processing is generated, wherein the Gramian angular field is a one-dimensional time series processing method based on the Gram matrix idea, which has the advantage of being able to measure the properties of the elements of the sequence itself and the relationship between the elements in the sequence.

[0086] Specifically, in step S3 of this embodiment, the method for constructing a Gram-like matrix is ​​as follows:

[0087] S31, the malicious traffic detection result is represented as a current flow sequence X containing n data = x1, x2, ..., x n , and scale it to the range of [-1, 1] to obtain the corresponding current flow sequence

[0088] Exemplarily, the normalization formula shown by the MinMaxScaler of the Scikitlearn library is used to scale the stream sequence to the range [-1, 1], and the specific formula is:

[0089]

[0090] In the formula, and is the minimum and maximum value of X, max and min are the default values;

[0091] S32, using the bijective transformation of the Arccos function, the current flow sequence Each univariate flow in is mapped from Cartesian coordinates to polar coordinates;

[0092] S33. According to the polar coordinates of each univariate flow, a Gramian angular field transformation is performed to construct a Gram-like matrix.

[0093] In step S32 of this embodiment, the expression for mapping the univariate flow from Cartesian coordinates to polar coordinates is:

[0094]

[0095] In step S33 of this embodiment, the expression for performing Gramian angular field conversion is:

[0096]

[0097] In the formula, φ i Indicated by The inverse cosine function is used to calculate the angle, φ j Indicates that The inverse cosine function is used to calculate the angle, and I represents the angle with The identity matrix has the same size, and the diagonal elements in the identity matrix are 1, and the rest of the elements are 0;

[0098] The constructed Gram-like matrix G is expressed as:

[0099]

[0100] In step S3 of the embodiment of the present invention, the constructed Gram-like matrix G can be regarded as a two-dimensional image matrix. By calculating the order moment, the statistical features of the aggregated flow time series data can be extracted. These features can reflect the distribution and change of the data. In this embodiment, the extracted statistical features include the first-order moment μ and the second-order moment σ of the Gram-like matrix. 2 And the third-order moment γ, its expression is:

[0101]

[0102] Where N is the total number of polar coordinates, Q i,j Represents each element in the Gram-like matrix.

[0103] In step S4 of the embodiment of the present invention, the accuracy of attack detection is improved by jointly analyzing the above multiple features. Step S4 of this embodiment is specifically as follows:

[0104] S41. In the CNN network model, the statistical features are adaptively calibrated by multi-head squeezing operations to generate global statistical information z with global average pooling. c ;

[0105] S42, global statistical information z c Perform an excitation operation to adaptively learn the weight coefficient s of the global statistics through two fully connected layers and activation functions;

[0106] S43, in the CNN network model, for each SE block, the corresponding learning flow feature X is obtained by multiplying the generated weighted coefficient with the corresponding original input feature FT After fitting the learning flow features of all SE blocks in parallel, the fusion feature X′ is obtained FT , as the spatial characteristics of DDoS;

[0107] S44. Use the BiLSTM model to capture the dependency relationship and global data relationship of statistical features in the time dimension to obtain the time characteristics of DDoS traffic;

[0108] S45. Complete the capture of DDoS attack traffic based on the spatial characteristics and spatial features of the DDoS traffic.

[0109] In this embodiment, by introducing a multi-head squeezing incentive mechanism, the flow feature weights are adaptively calibrated from various angles. Based on this, in step S41 of this embodiment, the global statistical information z c It is expressed as:

[0110]

[0111] In the formula, x FTcrepresents the c input features of size H in the CNN model, x FT =[x FT1 , x FT2 ,···,x FTc ],F sq (·) represents the global average pooling function;

[0112] In step S42 of this embodiment, the weighting coefficient s is expressed as:

[0113] s=F ex (F sq (x FTc ),W)=Sigmoid(g(z,W))=Sigmoid(W2GeLu(W1))

[0114] In the formula, F ex (·) represents the feature extraction function, W represents the weight parameter of the model, g(·) represents a combination function, which calculates the input z and the weight W and finally generates the output s, Sigmoid(·) represents the Sigmoid activation function, and z represents the sq (x FTc ) is the intermediate feature vector generated by global statistical pooling (average pooling) of the input features. It is usually a scalar or vector. GeLu(·) represents the GeLu activation function, and W1 and W2 represent the weights of the two fully connected layers.

[0115] In step S43 of this embodiment, the fusion feature X′ FT It is expressed as:

[0116] X′ FT =s 1 X FT +s 2 X FT +s 3 X FT .

[0117] In step S44 of this embodiment, the BiLSTM model is used to more comprehensively capture the dependencies and global data relationships of the data in the time dimension in view of the characteristics of the network traffic data itself; the weights and biases of the input, forgetting and output gates of the bidirectional LSTM in the BiLSTM model are set to control the selective retention and transmission of information, and the implementation process formula is:

[0118] i t =Sigmoid(W i ·[h t-1 ,x t ]+b i )

[0119] f t=Sigmoid(W f ·[g t-1 ,x t ]+b f )

[0120]

[0121]

[0122] o t =Sigmoid(W o ·[h t-1 ,x t ]+b o )

[0123] h t =o t tanh(C t )

[0124] In the formula, i t represents the input gate, f t represents the forget gate, f t represents the output gate, and C t Respectively represent the temporary unit state and the current unit state, h t and h t-1 denote the instantaneous and instantaneous hidden layer states respectively, x t Represents the input sequence at time t.

[0125] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0126] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A dual-scale pulse wave DDoS capture method for multi-dimensional identification fusion network, characterized in that: The following steps are involved: S1. Deploy the BNN inference model in the multi-dimensional routing switching device accessed by the multi-dimensional identity fusion network; S2, converting the decimal flow-level features input by the multi-dimensional routing switching device into binary form and inputting them into the BNN inference model for layer-by-layer inference to obtain coarse-grained malicious traffic detection results; S3, in the controller of the multi-dimensional identification fusion network, performing Gram matrix-based transformation on the malicious traffic detection results, constructing a Gram-like matrix, and extracting statistical features of the aggregated flow time series data based on the Gram matrix; S4. Use the CNN network model and BiLSTM model to extract spatiotemporal features of statistical features and capture DDoS attack traffic.

2. The dual-scale pulse wave DDos capture method for a multi-dimensional identification fusion network according to claim 1 is characterized in that: The step S2 is specifically as follows: S21, using a matrix equivalent substitution method, converting the decimal flow-level features input by the multi-dimensional routing switching device into binary; S22. In the BNN inference model, the binary weight of the kth neuron in the current layer and the binary input a of the current layer k Perform bitwise XOR operation between them to obtain the similarity measure between the weight and the input Among them, ⊙ represents the bitwise XOR operation, and PopCount represents the number of 1s in the bit string of the statistical calculation result; S23, normalizing the similarity measure c to obtain a corresponding normalized value d; S24. Use the SIGN function to process the normalized value d to obtain the binary output of the corresponding neuron S25, combine the binary outputs of multiple neurons to form the next layer input a k+1 =(a k+1 <<1)+SIGN(d), repeat steps S22 to S24, and reason layer by layer to output coarse-grained malicious traffic detection results; wherein << represents a left shift operation.

3. The dual-scale pulse wave DDos capture method for a multi-dimensional identification fusion network according to claim 2 is characterized in that: In step S23, the normalized value d is expressed as: Where, t k represents the predefined threshold, r k1 Represents the mini-batch mean adjusted for normalization based on batch statistics.

4. The dual-scale pulse wave DDoS capture method for multi-dimensional identification fusion network according to claim 2 is characterized in that: In the BNN inference model, all 1-bit weights of the neurons are concatenated into decimal values ​​and stored in registers of the multi-dimensional routing switch device.

5. The dual-scale pulse wave DDos capture method for multi-dimensional identification fusion network according to claim 1 is characterized in that: In step S3, the method for constructing a Gram-like matrix is ​​specifically as follows: S31, the malicious traffic detection result is represented as a current flow sequence X containing n data = x1, x2, ..., x n , and scale it to the range of [-1, 1] to obtain the corresponding current flow sequence S32, using the bijective transformation of the Arccos function, the current flow sequence Each univariate flow in is mapped from Cartesian coordinates to polar coordinates; S33. According to the polar coordinates of each univariate flow, a Gramian angular field transformation is performed to construct a Gram-like matrix.

6. The dual-scale pulse wave DDos capture method for a multi-dimensional identification fusion network according to claim 5 is characterized in that: In step S32, the expression for mapping the univariate flow from Cartesian coordinates to polar coordinates is: In step S33, the expression for performing Gramian angular field conversion is: In the formula, φ i Indicated by The inverse cosine function is used to calculate the angle, φ j Indicates that The inverse cosine function is used to calculate the angle, and I represents the angle with Identity matrices of the same size; The constructed Gram-like matrix G is expressed as:

7. The dual-scale pulse wave DDos capture method for a multi-dimensional identification fusion network according to claim 5, characterized in that: In step S3, the extracted statistical features include the first-order moment μ and the second-order moment σ of the Gram matrix. 2 And the third-order moment γ, its expression is: Where N is the total number of polar coordinates, Q i,j Represents each element in the Gram-like matrix.

8. The dual-scale pulse wave DDoS capture method for multi-dimensional identification fusion network according to claim 5 is characterized in that: The step S4 is specifically as follows: S41. In the CNN network model, the statistical features are adaptively calibrated by multi-head squeezing operations to generate global statistical information z with global average pooling. c ; S42, global statistical information z c Perform an excitation operation to adaptively learn the weight coefficient s of the global statistics through two fully connected layers and activation functions; S43, in the CNN network model, for each SE block, the corresponding learning flow feature X is obtained by multiplying the generated weighted coefficient with the corresponding original input feature FT After fitting the learning flow features of all SE blocks in parallel, the fusion feature X is obtained ′ Ft , as the spatial characteristics of DDoS; S44. Use the BiLSTM model to capture the dependency relationship and global data relationship of statistical features in the time dimension to obtain the time characteristics of DDoS traffic; S45. Complete the capture of DDoS attack traffic based on the spatial characteristics and spatial features of the DDoS traffic.

9. The dual-scale pulse wave DDoS capture method for multi-dimensional identification fusion network according to claim 8 is characterized in that: In step S41, the global statistical information z c It is expressed as: In the formula, x FTc represents the c input features of size H in the CNN model, x Ft =[x FT1 , x FT2 ,···,x FTc ], F sq (·) represents the global average pooling function; In step S42, the weighting coefficient s is expressed as: s=F ex (F sq (x FTc ),W)=Sigmoid(g(z,W))=Sigmoid(W2GeLu(W1)) In the formula, F ex (·) represents the feature extraction function, W represents the weight parameter of the model, g(·) represents a combination function, Sigmoid(·) represents the Sigmoid activation function, and z represents the sq (x FTc ), GeLu(·) represents the GeLu activation function, and W1 and W2 represent the weights of the two fully connected layers; In step S43, the fusion feature X′ FT It is expressed as: X′ FT =s 1 X FT +s 2 X FT +s 3 X FT 。

Images