Attack detection method and device and electronic equipment

Abstract

The invention discloses an attack detection method and device and electronic equipment, and the method comprises the steps: building a standard feature library based on DDoS attack features; based on the standard feature library, determining prominent features in each recording period in the training data of the space-ground integrated network, and taking the prominent features as observation results in the corresponding recording periods; training the initial HMM model based on a training sequence generated by the plurality of observation results to obtain a target HMM model; and processing a test sequence generated based on the to-be-detected data of the air-ground integrated network through the target HMM model to obtain a network state of the air-ground integrated network, and determining whether the air-ground integrated network is attacked according to the network state. Through the technical scheme provided by the embodiment of the invention, accurate, efficient and lightweight DDoS attack detection is realized in a space-ground integrated network environment.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack detection method, device and electronic device. Background Art

[0002] Since space-based networks can effectively supplement the deficiencies of terrestrial Internet, especially in remote areas where 3 billion people still cannot access broadband networks, they can access the Internet through space-based networks. Therefore, the space-ground integrated network that integrates space-based networks with terrestrial Internet is becoming a key development trend.

[0003] But at the same time, the rapid progress of network technology has gradually increased the threat of distributed denial of service (DDoS) attacks. DDoS attacks refer to multiple attackers in different locations launching attacks on one or more targets at the same time, or an attacker controlling multiple machines in different locations and using these machines to attack targets at the same time.

[0004] Given that accurate, efficient, and lightweight detection methods are the basis of all defense, current defense measures against DDoS attacks mainly focus on the detection of DDoS attacks.

[0005] However, the current mainstream artificial intelligence (AI) technology requires a lot of resources for pre-training, sample collection and other preparatory work. The hardware equipment in the space-based network often requires higher radiation resistance due to the vacuum environment. Its chip processing capacity and corresponding resources are often far lower than those of the current ground hardware equipment. As a result, it is difficult to effectively deploy AI technology in the space-based network, making it difficult to achieve accurate, efficient and lightweight DDoS attack detection in the space-ground integrated network environment. Summary of the invention

[0006] This application provides an attack detection method, device and electronic device to solve the problem that it is difficult to achieve accurate, efficient and lightweight DDoS attack detection in a ground-ground integrated network environment. The specific implementation scheme is as follows:

[0007] In a first aspect, the present application provides an attack detection method, the method comprising:

[0008] Based on the characteristics of distributed denial of service DDoS attacks, a standard feature library is established;

[0009] Based on the standard feature library, in the training data of the space-ground integrated network, a prominent feature in each recording period is determined, and the prominent feature is used as the observation result in the corresponding recording period;

[0010] Based on the training sequences generated by the plurality of observation results, an initial Hidden Markov Model (HMM) is trained to obtain a target HMM model;

[0011] The target HMM model is used to process a test sequence generated based on the data to be detected of the integrated space-ground network to obtain a network status of the integrated space-ground network, and based on the network status, it is determined whether the integrated space-ground network is under attack.

[0012] Through the above-mentioned application embodiment, the standard feature library formed based on the DDoS attack feature can determine the prominent features in each recording cycle of the integrated space-ground network, so that the prominent features are used as the observation results in the corresponding recording cycle, so that the training sequence obtained based on multiple observation results contains the most prominent features of the DDoS attack features, so that the information of the DDoS attack features can be extracted in a targeted manner, so as to better train the initial HMM model, so that the obtained target HMM model can become the optimal model, and then the accuracy of the test sequence generated by the data to be detected based on the integrated space-ground network is improved according to the target HMM model, which is conducive to improving the accuracy of attack detection. In addition, since the HMM model can obtain excellent training effects with only a small amount of data, the consumption of computing resources and storage space can be reduced. Therefore, by using the HMM model to perform attack detection, the space-based network in the integrated space-ground network does not need a large amount of resources to realize attack detection, so that accurate, efficient and lightweight DDoS attack detection can be realized in the integrated space-ground network environment.

[0013] In a possible implementation, determining, based on the standard feature library, in the training data of the space-ground integrated network, the prominent features in each recording period, and using the prominent features as the observation results in the corresponding recording period, includes:

[0014] In the training data of the integrated space-ground network, determining a feature value corresponding to each of the DDoS attack features in each of the recording periods;

[0015] For each of the recording periods, the deviation between the feature value corresponding to each of the DDoS attack features and the corresponding standard feature value in the standard feature library is calculated;

[0016] determining a maximum deviation in each of said recording periods;

[0017] The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

[0018] Through the above-mentioned application embodiment, based on the deviation between the feature value corresponding to each DDoS attack feature in each recording period and the corresponding standard feature value in the standard feature library, the most prominent deviation feature (i.e., prominent feature) in each recording period is determined, and then the prominent feature is used as the observation result in the corresponding recording period, so that the observation result is the feature with the largest deviation from the standard feature value in the corresponding recording period, thereby providing data for generating a training sequence for training the model.

[0019] In a possible implementation, before training the initial Hidden Markov Model based on the training sequence generated by the plurality of observation results to obtain the target HMM model, the method further includes:

[0020] Based on the training data of the space-ground integrated network, generate an initial state transition probability A matrix, an initial observation probability B matrix, and an initial probability π matrix;

[0021] The initial HMM model is generated according to the initial A matrix, the initial B matrix, and the initial π matrix.

[0022] Through the above-mentioned application embodiment, an initial HMM model is generated based on the initial A matrix, initial B matrix, and initial π matrix generated based on the historical data of the integrated space-ground network. Thus, the historical data of the integrated space-ground network is utilized to initialize the parameters in the initial HMM model (i.e., the initial A matrix, the initial B matrix, and the initial π matrix), thereby achieving accurate startup of the model, laying the foundation for obtaining the optimal HMM model.

[0023] In a possible implementation, the generating an initial probability π matrix based on the training data of the space-ground integrated network includes:

[0024] In the training data of the integrated space-ground network, the normal duration of the integrated space-ground network when it operates normally in each recording period and the attack duration corresponding to each of N types of attacks occurring in the integrated space-ground network in each recording period are counted; wherein N is a positive integer;

[0025] For each of the recording periods, the total duration between the normal duration and the N attack durations is calculated, and the ratio of the normal duration to each of the attack durations to the total duration is calculated respectively;

[0026] Based on the respective ratios, the initial π matrix in each of the recording cycles is determined.

[0027] Through the above application embodiment, based on the normal duration and attack duration in the historical data, the initial π matrix is ​​quickly determined, providing initial parameters that are more in line with the actual situation for generating the HMM initialization, so as to accurately start the HMM training.

[0028] In a possible implementation, generating an initial state transition probability A matrix based on the training data of the space-ground integrated network includes:

[0029] In the training data of the integrated space-ground network, determining the probability that the next recording period of each state of the integrated space-ground network is various states;

[0030] Based on multiple probabilities, the initial A matrix in each of the recording periods is determined.

[0031] Through the above application embodiment, the initial A matrix is ​​quickly determined, providing initial parameters that are more in line with the actual situation for the initialization of the HMM, so as to accurately start the training of the HMM.

[0032] In a possible implementation, generating an initial observation probability B matrix based on the training data of the space-ground integrated network includes:

[0033] In each of the recording cycles of the training data of the integrated space-ground network, the duration corresponding to each state of the integrated space-ground network is divided into a plurality of moments, and the prominent features of the integrated space-ground network in each moment under each state are determined;

[0034] Determining the probability of each observation result being the salient feature in each state of the space-ground integrated network;

[0035] The initial B matrix in each of the recording periods is generated according to a plurality of probabilities.

[0036] Through the above application embodiment, the initial B matrix is ​​quickly determined, providing initial parameters that are more in line with the actual situation for the initialization of the HMM, so as to accurately start the training of the HMM.

[0037] In a possible implementation, the training sequence generated based on the plurality of observation results, training the initial Hidden Markov Model (HMM) to obtain the target HMM model, includes:

[0038] Based on the plurality of observation results, generating the training sequence including the plurality of observation results;

[0039] The training sequence, the initial A matrix, the initial B matrix and the initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and the dynamic learning rate to obtain the target HMM model.

[0040] Through the above-mentioned application embodiment, the initial HMM model is trained based on the Baum-Welch algorithm, the regularization term and the dynamic learning rate to obtain the target HMM model. This can avoid overfitting of the HMM model while reducing the training time of the HMM model, thereby improving the training speed of the HMM model, so that the obtained target HMM model is the optimal model, which helps to improve the accuracy of attack detection.

[0041] In a possible implementation manner, determining whether the integrated space-ground network is under attack according to the network status includes:

[0042] If it is determined that the network status is normal, it is determined that the space-ground integrated network has not been attacked;

[0043] If it is determined that the network status is abnormal, it is determined that the space-ground integrated network is under attack.

[0044] Through the above application embodiments, whether the space-ground integrated network is under attack is determined efficiently and accurately based on whether the network status is normal or abnormal.

[0045] In a second aspect, the present application further provides an attack detection device, the device comprising:

[0046] A building module is used to build a standard feature library based on distributed denial of service DDoS attack features;

[0047] A determination module, configured to determine, based on the standard feature library, in the training data of the space-ground integrated network, the prominent features in each recording period, and use the prominent features as the observation results in the corresponding recording period;

[0048] A training module, used for training an initial Hidden Markov Model (HMM) based on a training sequence generated by a plurality of observation results to obtain a target HMM model;

[0049] A processing module is used to process a test sequence generated based on the data to be detected of the integrated space-ground network through the target HMM model to obtain the network status of the integrated space-ground network, and determine whether the integrated space-ground network is under attack based on the network status.

[0050] In a possible implementation, the determination module is specifically used to determine, in the training data of the integrated space-ground network, a feature value corresponding to each of the DDoS attack features in each of the recording periods;

[0051] For each of the recording periods, the deviation between the feature value corresponding to each of the DDoS attack features and the corresponding standard feature value in the standard feature library is calculated;

[0052] determining a maximum deviation in each of said recording periods;

[0053] The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

[0054] In a possible implementation, the device further includes an initialization module, the initialization module being used to generate an initial state transition probability A matrix, an initial observation probability B matrix, and an initial probability π matrix based on the training data of the space-ground integrated network before training the initial hidden Markov HMM model based on the training sequence generated based on the plurality of observation results to obtain the target HMM model;

[0055] The initial HMM model is generated according to the initial A matrix, the initial B matrix, and the initial π matrix.

[0056] In a possible implementation, the initialization module is specifically used to count the normal duration of the integrated space-ground network when it operates normally in each of the recording cycles, and the attack durations corresponding to each of N types of attacks occurring in the integrated space-ground network in each of the recording cycles, in the training data of the integrated space-ground network; wherein N is a positive integer;

[0057] For each of the recording periods, the total duration between the normal duration and the N attack durations is calculated, and the ratio of the normal duration to each of the attack durations to the total duration is calculated respectively;

[0058] Based on the respective ratios, the initial π matrix in each of the recording cycles is determined.

[0059] In a possible implementation manner, the initialization module is specifically used to determine, in the training data of the integrated space-ground network, the probability that the next recording period of each state of the integrated space-ground network is various states;

[0060] Based on multiple probabilities, the initial A matrix in each of the recording periods is determined.

[0061] In a possible implementation, the initialization module is specifically used to divide the duration corresponding to each state of the integrated space-ground network into a plurality of moments in each recording period of the training data of the integrated space-ground network, and determine the prominent features of the integrated space-ground network at each moment in each state;

[0062] Determining the probability of each observation result being the salient feature in each state of the space-ground integrated network;

[0063] The initial B matrix in each of the recording periods is generated according to a plurality of probabilities.

[0064] In a possible implementation manner, the training module is specifically configured to generate the training sequence including the plurality of observation results based on the plurality of observation results;

[0065] The training sequence, the initial A matrix, the initial B matrix and the initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and the dynamic learning rate to obtain the target HMM model.

[0066] In a possible implementation manner, the processing module is specifically configured to determine that the integrated space-ground network is not attacked if it is determined that the network status is normal;

[0067] If it is determined that the network status is abnormal, it is determined that the space-ground integrated network is under attack.

[0068] In a third aspect, the present application provides an electronic device, including:

[0069] Memory, used to store computer programs;

[0070] The processor is used to implement the above-mentioned attack detection method steps when executing the computer program stored in the memory.

[0071] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned attack detection method steps are implemented.

[0072] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 A schematic diagram of an attack scenario provided in an embodiment of the present application;

[0074] Figure 2 A flowchart of an attack detection method provided in an embodiment of the present application;

[0075] Figure 3 A schematic diagram of state transition probability provided for an embodiment of the present application;

[0076] Figure 4 A schematic diagram of the processing process of the attack detection method provided in the embodiment of the present application;

[0077] Figure 5 A schematic diagram of an attack detection device provided in an embodiment of the present application;

[0078] Figure 6 A schematic diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0079] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0080] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0081] A DDoS attack scenario is as follows: Figure 1 When potential DDoS attack traffic enters the space-ground integrated network from the ground Internet, the DDoS attack traffic will be transmitted to the satellite together with normal business traffic and further spread through the space-based network, causing the target to be attacked.

[0082] To solve the above problems, existing technologies mainly use AI technology to detect DDoS attacks and then defend against them based on the detection results.

[0083] However, AI technology requires a lot of resources for pre-training, sample collection, and other tasks, while the resources of space-based network hardware equipment are far lower than those of ground-based hardware equipment, which makes it difficult to effectively deploy AI technology in space-based networks. As a result, it is difficult to achieve accurate, efficient, and lightweight DDoS attack detection in a space-ground integrated network environment.

[0084] Since the Hidden Markov Model (HMM) model does not require a large amount of data for training, only a small amount of data is needed to achieve excellent training, thereby reducing the consumption of corresponding resources of hardware devices. Therefore, in the embodiment of the present application, attack detection can be implemented through the HMM model to reduce the resource consumption of hardware devices, so that it can be effectively deployed in the space-based network.

[0085] Therefore, the present application proposes an attack detection method. First, based on a standard feature library formed by DDoS attack features, the prominent features in each recording cycle are determined in the training data of the integrated space-ground network, and the prominent features are used as the observation results in the corresponding recording cycle; then, the initial HMM model is trained according to the training sequence generated by multiple observation results to obtain the target HMM model; then, the test sequence generated based on the data to be detected of the integrated space-ground network is processed by the target HMM model to obtain the network status of the integrated space-ground network, so that according to the network status, it can be determined whether the integrated space-ground network is under attack. In this way, a large amount of data is not required for model training, which reduces resource consumption, so that accurate, efficient and lightweight DDoS attack detection can be achieved in the integrated space-ground network environment.

[0086] Reference Figure 2 The figure is a flow chart of an attack detection method provided by an embodiment of the present application, the method comprising:

[0087] S201, based on DDoS attack features, build a standard feature library.

[0088] In an embodiment of the present application, the DDoS attack characteristics may be relevant characteristics specific to the space-ground integrated network in the DDoS field, and may include "total traffic in the network", "User Datagram Protocol (UDP) ratio", "Synchronize Sequence Numbers (SYN) flag ratio", "Connection establishment frequency", "Source address entropy", "Space Communication Protocol Specification (SCPS) retransmission flag ratio in space-based network", "Consultative Committee for Space Data Systems (CCSDS) File Delivery Protocol (CFDP) in space-based network" and "Sending error rate in the file transfer protocol (CFDP) of the Consultative Committee for Space Data Systems (CCSDS) in space-based network", but are not limited to these, and may also include characteristics in the traditional DDoS field.

[0089] The UDP protocol ratio is the ratio of the number of UDP data packets to the total number of data packets. The SYN flag bit ratio is the ratio of the number of SYN flag bits to the total number of flag bits in the Transmission Control Protocol (English: Transmission Control Protocol, abbreviated as TCP) protocol.

[0090] Optionally, the above-mentioned generation of a standard feature library based on DDoS attack features may be performed in the following manner:

[0091] After the space-ground integrated network has been operating normally for a period of time, the characteristic value corresponding to each DDoS attack feature during this period is obtained; and the characteristic value is used as the standard characteristic value; then, based on each DDoS attack feature and its corresponding standard characteristic value, a standard characteristic library is generated, so that the standard characteristic values ​​in the standard characteristic library are all characteristic values ​​when the space-ground integrated network is operating normally, which provides a benchmark for the subsequent determination of the most prominent features (i.e., prominent features) that deviate from normal operation.

[0092] Exemplarily, the standard feature library is shown in Table 1 below:

[0093] DDoS attack characteristics Standard eigenvalues Total traffic in the network a UDP protocol ratio b SYN flag ratio c Connection frequency d Entropy of source address e Proportion of SCPS retransmission flag bits in space-based networks f The error rate of CFDP transmission in space-based networks g

[0094] Table 1

[0095] In Table 1, each DDoS attack feature corresponds to a standard feature value.

[0096] Optionally, in the standard feature library, a feature index (such as a sequence number of 1, 2, 3, etc.) may be established, so that the corresponding DDoS attack feature and its corresponding standard feature value may be determined more quickly based on the feature index.

[0097] S202, based on the standard feature library, in the training data of the space-ground integrated network, determine the prominent features in each recording period, and use the prominent features as the observation results in the corresponding recording period.

[0098] After a standard feature library is built based on the DDoS attack features in step S201, the feature values ​​corresponding to each DDoS attack of the integrated space-ground network in each recording period are recorded for the training data of the integrated space-ground network. The recording period can be flexibly adjusted according to the specific application scenario.

[0099] In an embodiment of the present application, the training data of the integrated space-ground network may include characteristic values ​​corresponding to DDoS attack characteristics such as "total traffic in the network", "UDP ratio", "SYN flag ratio", "connection establishment frequency", "source address entropy", "space-based network SCPS retransmission flag ratio", and "space-based network CFDP sending error rate".

[0100] Then, for each recording period, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated. The deviation indicates the degree of deviation between the feature value corresponding to the DDoS attack feature and the standard feature value, so that the most prominent attack feature can be selected based on the deviation and used as a prominent feature to generate observation results.

[0101] In the embodiment of the present application, the above deviation can be determined by calculating the difference between the characteristic value and the standard characteristic value, then calculating the ratio of the difference to the standard characteristic value, and then calculating the absolute value of the ratio. Specifically, as shown in the following formula:

[0102]

[0103] Among them, D w Indicates the deviation corresponding to the wth DDoS attack feature in a certain recording period; x w Indicates the feature value corresponding to the wth DDoS attack feature in the corresponding recording period; s w Indicates the standard feature value corresponding to the w-th DDoS attack feature in the standard feature library.

[0104] After calculating the corresponding deviation for each DDoS attack feature in the same recording period, the maximum deviation in the same recording period is determined. The DDoS attack feature corresponding to the maximum deviation is then used as the prominent feature in the recording period, so that the maximum deviation in each recording period and the prominent feature in each recording period can be determined in this way.

[0105] Optionally, the DDoS attack feature corresponding to the maximum deviation is used as the prominent feature in the recording period. The feature index of the maximum deviation can be determined first (such as D w w in, and then according to the feature index (such as D w w) in the figure determines the corresponding DDoS attack feature, thereby taking the DDoS attack feature as a prominent feature.

[0106] Then, the prominent features are used as the observation results in the corresponding recording period, so that a training sequence including multiple observation results can be generated according to the observation results in each recording period in the training data of the space-ground integrated network.

[0107] Through the above method, based on the deviation between the feature value corresponding to each DDoS attack feature in each recording period and the corresponding standard feature value in the standard feature library, the prominent features in each recording period are determined, and then the prominent features are used as the observation results in the corresponding recording period, so that the obtained observation results are the most prominent attack features in the corresponding recording period, thereby providing data for generating training sequences for training models.

[0108] S203, training an initial HMM model based on a training sequence generated by a plurality of observation results to obtain a target HMM model.

[0109] After obtaining the observation results in each recording period in the training data of the space-ground integrated network in step S203, a training sequence including a plurality of observation results (ie, salient features) is generated based on the observation results.

[0110] For example, the training sequence O train As shown below:

[0111] O train =("Total traffic in the network", "Frequency of establishing connections", ..., "SYN flag ratio")

[0112] The above training sequence O train The “total traffic in the network”, “frequency of establishing connections”, etc. are all observation results (i.e., prominent features) in a recording period.

[0113] After generating a training sequence based on multiple observation results, an initial HMM model is trained based on the training sequence to obtain a target HMM model.

[0114] In an embodiment of the present application, before training the initial HMM model based on the training sequence, the initial HMM is first generated using the training data of the space-ground integrated network.

[0115] According to the definition of HMM, λ in HMM = (A, B, π). Among them, A is the state transition probability matrix, B is the observation probability matrix, and π is the initial probability matrix. Therefore, HMM at least includes A matrix, B matrix, and π matrix.

[0116] Then, it is necessary to use the training data of the integrated space-ground network to generate the initial A matrix, the initial B matrix, and the initial π matrix, so as to initialize the HMM and obtain the initial HMM.

[0117] Before initializing the HMM, it is also necessary to determine the state set Q and observation set V of the space-ground integrated network. The observation set V can include all possible observation results, such as "total traffic in the network", "UDP ratio", "SYN flag ratio", "connection establishment frequency", "source address entropy", "space-based network SCPS retransmission flag ratio", "space-based network CFDP transmission error rate", etc., but it is not limited to this, for example, it can also include features in the traditional DDoS field. Therefore, the observation set V can be as follows:

[0118] V = {"total network traffic", "UDP ratio", "SYN flag ratio", "connection establishment frequency", "source address entropy", "space-based network SCPS retransmission flag ratio", "space-based network CFDP transmission error rate", ...}

[0119] The above state set Q can include all states of the integrated space-ground network, such as "normal operation", "resource exhaustion attack", "bandwidth exhaustion attack", "hybrid attack", etc., but is not limited to this, and the state can be adjusted according to the specific application scenario. Among them, "normal operation" means the traffic forwarding state of the integrated space-ground network without DDoS attack; "resource exhaustion attack", "bandwidth exhaustion attack" and "hybrid attack" represent the states of three types of DDoS attacks on the integrated space-ground network. Therefore, the state set Q of the HMM model can be as follows:

[0120] Q = {"Normal operation", "Resource exhaustion attack", "Bandwidth exhaustion attack", "Hybrid attack", ...}

[0121] Since the purpose of this application is to detect whether the network is normal or under some attack, that is, to detect the state of the network, this state is unobservable for defense. Therefore, solving the state is the ultimate goal of this solution, which satisfies the hidden state space in the HMM model.

[0122] Furthermore, based on the training data of the integrated space-ground network, an initial A matrix, an initial B matrix, and an initial π matrix are generated; and then an initial HMM is generated based on the initial A matrix, the initial B matrix, and the initial π matrix.

[0123] Optionally, based on the training data of the space-ground integrated network, the specific steps of generating the initial π matrix can be as follows:

[0124] The π matrix represents the probability of the network being in normal operation and different types of attack states at the initial moment. Based on this, we can obtain the ratio of the overall normal operation time of the space-ground integrated network and the duration of different attacks according to the training data and the recording period, and then obtain the initial probability.

[0125] Specifically, first, in the training data of the space-ground integrated network, according to the recording period, the normal duration of the space-ground integrated network when it operates normally in each recording period, and the attack duration corresponding to each of N types of attacks in the space-ground integrated network in each recording period are counted. Where N is a positive integer. And N is the value after subtracting 1 from the number of state types in the state set Q.

[0126] The training data may also include the normal duration of normal operation of the space-ground integrated network and the corresponding attack durations when N types of attacks occur on the space-ground integrated network. The N types of attacks may include resource exhaustion attacks, bandwidth exhaustion attacks, and mixed attacks, but are not limited thereto.

[0127] Then, for each recording period, the total duration between the normal duration and the N attack durations is calculated. Then, the ratio of the normal duration to each attack duration to the total duration is calculated respectively. Then, based on the ratios, the initial π matrix in each recording period is determined.

[0128] For example, the state set Q includes four states, namely "normal operation", "resource exhaustion attack", "bandwidth exhaustion attack", and "mixed attack", and the N attacks include "resource exhaustion attack", "bandwidth exhaustion attack", and "mixed attack". In one recording cycle, the normal duration is q 1 , the attack duration of resource exhaustion attack is q 2 , the attack duration of bandwidth exhaustion attack is q 3 , the attack duration of the mixed attack is q 4 . Then the initial π matrix in the corresponding recording period can be obtained as follows:

[0129]

[0130] q=q 1 +q 2 +q 3 +q 4

[0131] Among them, q is the total duration between the normal duration and the N attack durations.

[0132] Through the above method, based on the normal duration and attack duration in the training data of the integrated space-ground network, the initial π matrix was quickly determined, providing more actual initial parameters for generating HMM initialization, so as to accurately start the HMM training.

[0133] Optionally, based on the training data of the space-ground integrated network, the specific steps of generating the initial A matrix can be as follows:

[0134] In the training data of the space-ground integrated network, the probability of the next recording cycle of each state of the space-ground integrated network being various states is determined. This probability is the occurrence probability, which means the probability that the space-ground integrated network is in the i-th state in the m-th recording cycle and in the j-th state in the m+1 recording cycle. Among them, m, i, and j are all positive integers.

[0135] Based on the determined multiple probabilities, an initial A matrix is ​​determined, which includes each occurrence probability.

[0136] For example, the state transition probability of the space-ground integrated network in a recording cycle is as follows: Figure 3 As shown in the figure, the first state is "normal operation", the second state is "resource exhaustion attack", the third state is "bandwidth exhaustion attack", and the fourth state is "mixed attack"; a ij It represents the probability that the next recording cycle of the space-ground integrated network in the i-th state is the j-th state, and both i and j are positive integers less than 5. The initial A matrix in the corresponding recording cycle can be obtained as follows:

[0137]

[0138] Among them, the first row or the first column represents the first state, the second row or the second column represents the second state, the third row or the third column represents the third state, and the fourth row or the fourth column represents the fourth state.

[0139] Through the above method, the initial A matrix is ​​quickly determined, providing initial parameters that are more in line with the actual situation for the initialization of the HMM, so as to accurately start the training of the HMM.

[0140] In an embodiment of the present application, the probability of the next recording period of each state of the integrated space-ground network being various states can be determined by the number of state types and the duration of the current state, so that the obtained probability is more in line with the actual situation, which is conducive to making the initialization of the HMM model more in line with the actual situation, thereby helping to improve the accuracy of the HMM model in attack detection.

[0141] Specifically, for each state of the space-ground integrated network, the following operations are performed:

[0142] First, determine the duration of the current state of the integrated space-ground network, and determine the total number of states of the integrated space-ground network as P (P is a positive integer). Calculate the difference between the duration of the current state and P, and use the ratio of the difference to the duration of the current state as the probability that the next recording cycle of the current state of the integrated space-ground network is still the current state; use the ratio of - to the duration of the current state as the probability that the next recording cycle of the current state of the integrated space-ground network is a state other than the current state.

[0143] For example, the duration of the "normal operation" state of the space-ground integrated network is 60 minutes, and the space-ground integrated network states include four types, namely "normal operation", "resource exhaustion attack", "bandwidth exhaustion attack", and "mixed attack". Then the probability of the next recording cycle of the "normal operation" state of the space-ground integrated network being "normal operation" is 57 / 60, the probability of the next recording cycle being "resource exhaustion attack" is 1 / 60, the probability of the next recording cycle being "bandwidth exhaustion attack" is 1 / 60, and the probability of the next recording cycle being "mixed attack" is 1 / 60.

[0144] Optionally, based on the training data of the space-ground integrated network, the specific steps of generating the initial B matrix can be as follows:

[0145] First, in each recording cycle of the training data of the integrated space-ground network, the duration corresponding to each state of the integrated space-ground network is divided into multiple moments, and the prominent features of the integrated space-ground network at each moment in each state are determined. Then, the probability of each observation result being a prominent feature in each state is determined. This probability is the generation probability, which represents the probability of generating the kth prominent feature in the i-th state at time t. Then, based on multiple probabilities, the initial B matrix in the corresponding recording cycle is determined. The initial B matrix includes each generation probability.

[0146] For example, the first state is "normal operation", the second state is "resource exhaustion attack", the third state is "bandwidth exhaustion attack", and the fourth state is "mixed attack"; the first observation result is "total traffic in the network", the second observation result is "UDP protocol ratio", the third observation result is "SYN flag ratio", the fourth observation result is "connection establishment frequency", the fifth observation result is "source address entropy", the sixth observation result is "SCPS retransmission flag ratio in space-based network", and the seventh observation result is "CFDP transmission error rate in space-based network"; b j (k) represents the probability that the observation result is the kth observation result in the jth state, and k is a positive integer less than 8. The initial B matrix in a recording cycle can be obtained as follows:

[0147]

[0148] Among them, the first row represents the first state, the second row represents the second state, the third row represents the third state, the fourth row represents the fourth state, the first column represents the first observation result, the second column represents the second observation result, the third column represents the third observation result, the fourth column represents the fourth observation result, the fifth column represents the fifth observation result, the sixth column represents the sixth observation result, and the seventh column represents the seventh observation result.

[0149] Through the above method, the initial B matrix is ​​quickly determined, providing initial parameters that are more in line with the actual situation for the initialization of the HMM, so as to accurately start the training of the HMM.

[0150] In the embodiment of the present application, the above determination of the probability of each observation result being a prominent feature in each state can be determined by the frequency of the observation result being a prominent feature, as shown below:

[0151] In each state, determine the number of times each observation result is used as a prominent feature, and then use the ratio of this number to the total number of moments as the probability that the corresponding observation result is a prominent feature.

[0152] For example, in a recording cycle, when the space-ground integrated network is operating normally, it is divided into 60 moments. Among them, in 30 moments, the "proportion of SCPS retransmission flag bits in the space-based network" is a prominent feature. Then, when the space-ground integrated network is operating normally, the probability that the "proportion of SCPS retransmission flag bits in the space-based network" is a prominent feature is 30 / 60, that is, 50%.

[0153] In the above manner, the probability of each observation result being a prominent feature in each state is quickly and accurately determined by taking the observation result as the frequency of the prominent feature, thereby providing data for determining the initial B matrix.

[0154] Furthermore, after the initial A matrix, the initial B matrix and the initial π matrix are generated, an initial HMM model is obtained according to the initial A matrix, the initial B matrix and the initial π matrix.

[0155] After the initial HMM model is obtained, the initial HMM model can be trained based on the training sequence to obtain the target HMM model.

[0156] The training method of the HMM model may include the Baum-Welch algorithm. The Baum-Welch algorithm is an expectation maximization algorithm that estimates the parameters of the HMM (such as the A matrix and the B matrix) by iteratively calculating the expected value of the latent variable and maximizing the likelihood function, thereby realizing the training of the HMM model.

[0157] However, in order to avoid overfitting of the HMM model and to improve the training speed of the HMM model, regularization terms and dynamic learning rates can be introduced while training the HMM model through the Baum-Welch algorithm.

[0158] Specifically, the training sequence, initial A matrix, initial B matrix and initial π matrix are input into the Baum-Welch algorithm. At the same time, regularization terms and dynamic learning rates are introduced on the basis of the Baum-Welch algorithm. The initial HMM model is iteratively trained to obtain the target HMM model, thereby avoiding overfitting of the model and significantly improving the training speed of the model, making the target HMM model the optimal model, which helps to improve the accuracy of attack detection.

[0159] In the embodiment of the present application, the above regularization term can be introduced by adding a regularization term to the initial A matrix and the initial B matrix, as shown in the following formula:

[0160]

[0161] Where n represents the number of iterations; represents the probability that the next recording cycle of the space-ground integrated network in the ith state is the jth state at the n+1th iteration; ξ t (i,j) represents the probability that the space-ground integrated network is in the i-th state at time t and in the j-th state at time t+1; γ t (i) represents the probability that the space-ground integrated network is in the i-th state at time t; λ A With λ B They represent the regularization parameters of the A matrix and the B matrix respectively, so that the overfitting of the model can be avoided based on the regularization parameters, while ensuring that the complexity of the model is within a reasonable range; b j (k)(n+1) represents the probability that the observation result of the space-ground integrated network is the kth observation result in the jth state at the n+1th iteration; v k represents the kth observation result in the observation set V; o t represents the prominent feature at time t; o t =v k Indicates that the observation result at time t is v k , which is also the prominent feature v at time t k ; represents the initial probability that the space-ground integrated network is in the i-th state at the n+1th iteration; α t (i) represents the coefficient when the space-ground integrated network is in the i-th state at time t; b j (o t+1 ) represents the probability that the observation result of the space-ground integrated network is the prominent feature at time t+1 in the jth state; β t+1 (j) represents the coefficient when the space-ground integrated network is in the jth state at the t+1th moment.

[0162] Therefore, the above formula can be used to regularize the initial A matrix and the initial B matrix to minimize the sum of squares of the parameters, thereby suppressing excessive parameter values ​​and enhancing the generalization ability of the model.

[0163] In the embodiment of the present application, the above dynamic learning rate can be as follows:

[0164]

[0165] Among them, α represents the decay rate, n represents the number of iterations, and η (0) represents the initial learning rate, η (n) Represents the learning rate at the nth iteration. Thus, the dynamic learning rate can quickly approach the state of model training completion.

[0166] Therefore, after the introduction of the above regularization term and dynamic learning rate, the complete iterative formula is as follows:

[0167]

[0168] Therefore, through the above complete iterative formula, iterative optimization of the HMM model can be achieved to obtain the optimal target HMM model.

[0169] In an embodiment of the present application, the termination condition for iterative training of the HMM model may be that the number of iterations is greater than or equal to an iteration termination threshold, or that the parameter change between two iterations is less than a change threshold, but is not limited thereto and may be adjusted according to specific application scenarios.

[0170] In addition, it should be noted that in the embodiment of the present application, the target HMM model and the initialization HMM model both satisfy the two basic assumptions of HMM, namely the homogeneous Markov assumption and the observation independence assumption. The homogeneous Markov assumption indicates that at any time (such as any recording period), the state of the network only depends on the state of the previous time (such as the recording period), and has nothing to do with the state of the previous time. The observation independence assumption indicates that the observation results (such as prominent features) at any time only depend on the state at the current time, and have nothing to do with other observation results and the state at other times.

[0171] S204, processing the test sequence generated based on the data to be detected of the space-ground integrated network through the target HMM model to obtain the network status of the space-ground integrated network, and determining whether the space-ground integrated network is under attack according to the network status.

[0172] After the target HMM model is obtained in step S203, Viterbi decoding is used to complete attack detection for the data to be detected in the space-ground integrated network.

[0173] Specifically, first, in the data to be detected in the integrated space-ground network, based on the standard feature library, the prominent features in each recording period are determined, and the prominent features are used as the observation results in the corresponding recording period, so as to generate a test sequence of multiple observation results based on the observation results of each recording period. Test It can be as follows:

[0174] O Test =(O 1 , O 2 , …, O T )

[0175] Among them, O T Represents the observation results of the current period. That is, the test sequence must include the observation results of the current period and multiple observation results before the current period.

[0176] It should be noted that the above-mentioned specific determination steps of determining the prominent features in each recording cycle in the data to be detected in the integrated space-ground network based on the standard feature library are consistent with the specific determination steps of determining the prominent features in each recording cycle in the training data of the integrated space-ground network based on the standard feature library in step S202, and will not be repeated here.

[0177] In the embodiment of the present application, the recording period in the data to be detected in the integrated space-ground network may be consistent with or inconsistent with the recording period in the training data in the integrated space-ground network.

[0178] Furthermore, after obtaining the test sequence, the test sequence is input into the target HMM model, and the test sequence is processed by the target HMM model to obtain the network state of the space-ground integrated network (i.e., the hidden state of the HMM model) to realize the detection of the network state of the space-ground integrated network.

[0179] In the embodiment of the present application, the network state obtained is the network state of the integrated space-ground network in the current cycle. The network state can be either abnormal or normal, so that it can be determined whether the integrated space-ground network is under attack based on the network state.

[0180] Specifically, if it is determined that the network status is normal, it is determined that the space-ground integrated network is not attacked.

[0181] If the network status is determined to be abnormal, it is determined that the space-ground integrated network is under attack, thereby realizing attack detection of the space-ground integrated network. The attack may be a DDoS attack.

[0182] Through the above method, whether the integrated space-ground network is under attack is determined efficiently and accurately based on whether the network status is normal or abnormal.

[0183] Optionally, after determining that the integrated space-ground network is under attack, an alarm can be sounded, and a corresponding interception and mitigation strategy can be executed according to the observation sequence to defend against DDoS attacks and avoid attacks on the target.

[0184] In addition, the attack detection method provided in the embodiment of the present application can be deployed on network devices such as gateways and satellite communication base stations to detect and defend against DDoS attacks from the terrestrial Internet.

[0185] The attack detection method provided in the embodiment of the present application can also be applied to the space-based network in the integrated space-ground network, and can also be deployed on a satellite, using inter-satellite links and satellite-to-ground links to transmit and summarize the required traffic feature information, and train the model to achieve attack detection.

[0186] Compared with the prior art that deploys AI solutions on the ground to complete training, then splits and detects the space-based network traffic, and continuously interacts between the space-based network and the ground Internet, the attack detection method provided in the embodiment of the present application operates independently on the space-based network and the ground Internet, and only performs a small amount of interaction. For example, after determining that the integrated space-ground network is under attack, the corresponding interception and mitigation strategy is executed according to the observation sequence to defend against the attack, thereby avoiding the problem that the prior art is limited by the long distance and high bit error rate transmission conditions between the space-based network and the ground Internet, making it difficult to synchronize the feature extraction and monitoring and analysis of the traffic, resulting in large delays and other problems.

[0187] In summary, the attack detection method proposed in this application starts from the objective conditions of the space-based network and designs a detection scheme using a probability model (i.e., the HMM model) and statistical calculation methods. It is suitable for space-based networks with limited resources and bandwidth while ensuring detection accuracy.

[0188] The training data of the integrated space-ground network is used to generate the parameters in the initial HMM model (such as the initial A matrix, the initial B matrix, and the initial π matrix). That is, the HMM model is established according to the characteristics of the space-based network, which achieves precise startup and improves the actual value of the HMM model.

[0189] Then, a standard feature library was established in combination with the DDoS attack characteristics, and the most prominent features that deviated from the characteristics were obtained as observation results, thereby specifically extracting the prominent features related to DDoS attacks, laying the foundation for subsequent accurate detection.

[0190] Then, through the Baum-Welch algorithm, regularization terms and dynamic learning rate, the detection model (i.e., the initial HMM model) training that is independent of ground station resources is realized, and while avoiding overfitting, the model training time is saved as much as possible, so that the obtained target HMM model is the optimal model.

[0191] Finally, the Viterbi algorithm is used to complete the attack detection. That is, according to the test sequence generated by the data to be detected and combined with the target HMM model, the network status of the space-ground integrated network is obtained. Then, according to whether the network status is abnormal or normal, it is determined whether the space-ground integrated network is under attack. Then, under the constraint of processing resource priority, the attack detection is completed efficiently, accurately and lightweight.

[0192] The technical solution of this application is further explained below in conjunction with a specific application process.

[0193] like Figure 4 The figure shows a processing diagram of the attack detection method. First, in the feature acquisition module, a standard feature library is constructed based on the DDoS attack features. Then, in the training data of the integrated space-ground network, for each recording period, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated. Then, the maximum deviation is determined among multiple deviations in the same recording period. Then, the DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the recording period, and the prominent feature is used as the observation result in the recording period. Based on the observation results (i.e., prominent features) in each recording period, a training sequence including the observation results is composed. And the training sequence is transmitted to the training module so that the model can be trained based on the training sequence.

[0194] In the parameter initialization module, the initial A matrix, the initial π matrix, and the initial B matrix are determined based on the historical data of the space-ground integrated network. Then, the initial HMM model is generated according to the initial A matrix, the initial π matrix, and the initial B matrix. The initial HMM model and its initial parameters (such as the initial A matrix, the initial B matrix, and the initial π matrix) are transmitted to the training module to train the initial HMM model and obtain the target HMM model.

[0195] In the training module, after receiving the training sequence transmitted by the feature acquisition module, and the initial A matrix, initial π matrix, and initial B matrix transmitted by the parameter initialization module, the training sequence, initial A matrix, initial π matrix, and initial B matrix are input into the Baum-Welch algorithm, and the regularization term and dynamic learning rate are introduced at the same time, and the initial HMM model is iteratively trained to obtain the target HMM model. The target HMM model is then transmitted to the solution module so as to obtain the network status of the space-ground integrated network based on the HMM model.

[0196] In the solution module, detection is completed through Viterbi decoding. Specifically, in the data to be detected of the integrated space-ground network, the observation results (i.e., prominent features) of the integrated space-ground network in each recording cycle are determined, and a test sequence is composed based on multiple observation results. Among them, the test sequence includes at least the observation results of the current cycle. Then, the test sequence is input into the target HMM model transmitted from the training module, and the network status of the integrated space-ground network in the current cycle is obtained through the output of the target HMM model. And the network status is transmitted to the attack judgment module to determine whether the integrated space-ground network is attacked.

[0197] In the attack judgment module, the network status transmitted by the solution module is received. If the network status is determined to be normal, it is determined that the integrated space-ground network has not been attacked. If the network status is determined to be abnormal, it is determined that the integrated space-ground network has been attacked. At this time, an alarm can be issued and the corresponding interception and mitigation strategy can be executed according to the observation sequence.

[0198] Through the above method, based on the comprehensive use of feature collection module, parameter initialization module, training module, solution module and attack judgment module, the detection accuracy of DDoS attacks is significantly improved, and lightweight detection of DDoS attacks is achieved, so as to facilitate the defense against DDoS attacks.

[0199] Based on the same inventive concept, an attack detection device is also provided in the embodiment of the present application, such as Figure 5 FIG. 1 is a schematic diagram of the structure of an attack detection device provided by the present application, the device comprising:

[0200] A building module 501 is used to build a standard feature library based on distributed denial of service DDoS attack features;

[0201] A determination module 502 is used to determine, based on the standard feature library, in the training data of the space-ground integrated network, the prominent features in each recording period, and use the prominent features as the observation results in the corresponding recording period;

[0202] A training module 503 is used to train an initial Hidden Markov Model (HMM) based on a training sequence generated by a plurality of observation results to obtain a target HMM model;

[0203] The processing module 504 is used to process the test sequence generated based on the data to be detected of the integrated space-ground network through the target HMM model to obtain the network status of the integrated space-ground network, and determine whether the integrated space-ground network is under attack according to the network status.

[0204] In a possible implementation, the determination module 502 is specifically configured to determine, in the training data of the integrated space-ground network, a feature value corresponding to each of the DDoS attack features in each of the recording periods;

[0205] For each of the recording periods, the deviation between the feature value corresponding to each of the DDoS attack features and the corresponding standard feature value in the standard feature library is calculated;

[0206] determining a maximum deviation in each of said recording periods;

[0207] The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

[0208] In a possible implementation, the device further includes an initialization module, the initialization module being used to generate an initial state transition probability A matrix, an initial observation probability B matrix, and an initial probability π matrix based on the training data of the space-ground integrated network before training the initial hidden Markov HMM model based on the training sequence generated based on the plurality of observation results to obtain the target HMM model;

[0209] The initial HMM model is generated according to the initial A matrix, the initial B matrix, and the initial π matrix.

[0210] In a possible implementation, the initialization module is specifically used to count the normal duration of the integrated space-ground network when it operates normally in each of the recording cycles, and the attack durations corresponding to each of N types of attacks occurring in the integrated space-ground network in each of the recording cycles, in the training data of the integrated space-ground network; wherein N is a positive integer;

[0211] For each of the recording periods, the total duration between the normal duration and the N attack durations is calculated, and the ratio of the normal duration to each of the attack durations to the total duration is calculated respectively;

[0212] Based on the respective ratios, the initial π matrix in each of the recording cycles is determined.

[0213] In a possible implementation manner, the initialization module is specifically used to determine, in the training data of the integrated space-ground network, the probability that the next recording period of each state of the integrated space-ground network is various states;

[0214] Based on multiple probabilities, the initial A matrix in each of the recording periods is determined.

[0215] In a possible implementation, the initialization module is specifically used to divide the duration corresponding to each state of the integrated space-ground network into a plurality of moments in each recording period of the training data of the integrated space-ground network, and determine the prominent features of the integrated space-ground network at each moment in each state;

[0216] Determining the probability of each observation result being the salient feature in each state of the space-ground integrated network;

[0217] The initial B matrix in each of the recording periods is generated according to a plurality of probabilities.

[0218] In a possible implementation manner, the training module 503 is specifically configured to generate the training sequence including the multiple observation results based on the multiple observation results;

[0219] The training sequence, the initial A matrix, the initial B matrix and the initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and the dynamic learning rate to obtain the target HMM model.

[0220] In a possible implementation, the processing module 504 is specifically configured to determine that the space-ground integrated network is not attacked if it is determined that the network status is normal;

[0221] If it is determined that the network status is abnormal, it is determined that the space-ground integrated network is under attack.

[0222] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the aforementioned attack detection device. Figure 6 , the electronic equipment includes:

[0223] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.

[0224] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the attack detection method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 5 The functions of each module in the device shown.

[0225] Among them, the processor 601 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 602 and calling the data stored in the memory 602, the various functions of the device and processing data, the device can be monitored as a whole.

[0226] In one possible design, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0227] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the attack detection method disclosed in the embodiments of the present application can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0228] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0229] By programming the processor 601, the code corresponding to the attack detection method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The steps of the attack detection method of the embodiment shown are as follows: How to design and program the processor 601 is a technique known to those skilled in the art and will not be described in detail here.

[0230] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the attack detection method discussed above.

[0231] In some possible implementations, various aspects of the attack detection method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a device, the program code is used to enable the control device to execute the steps of the attack detection method according to various exemplary implementations of the present application described above in this specification.

[0232] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0233] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0234] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0235] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0236] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection method, characterized in that: include: Based on the characteristics of distributed denial of service DDoS attacks, a standard feature library is established; Based on the standard feature library, in the training data of the space-ground integrated network, a prominent feature in each recording period is determined, and the prominent feature is used as the observation result in the corresponding recording period; Based on the training sequences generated by the plurality of observation results, an initial Hidden Markov Model (HMM) is trained to obtain a target HMM model; The target HMM model is used to process a test sequence generated based on the data to be detected of the integrated space-ground network to obtain a network status of the integrated space-ground network, and based on the network status, it is determined whether the integrated space-ground network is under attack.

2. The method according to claim 1, characterized in that The method of determining, based on the standard feature library, in the training data of the space-ground integrated network, the prominent features in each recording period, and using the prominent features as the observation results in the corresponding recording period, includes: In the training data of the integrated space-ground network, determining a feature value corresponding to each of the DDoS attack features in each of the recording periods; For each of the recording periods, the deviation between the feature value corresponding to each of the DDoS attack features and the corresponding standard feature value in the standard feature library is calculated; determining a maximum deviation in each of said recording periods; The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

3. The method according to claim 1, characterized in that Before training the initial Hidden Markov Model based on the training sequence generated by the plurality of observation results to obtain the target HMM model, the method further includes: Based on the training data of the space-ground integrated network, generate an initial state transition probability A matrix, an initial observation probability B matrix, and an initial probability π matrix; The initial HMM model is generated according to the initial A matrix, the initial B matrix, and the initial π matrix.

4. The method according to claim 3, characterized in that The generating of an initial probability π matrix based on the training data of the space-ground integrated network includes: In the training data of the integrated space-ground network, the normal duration of the integrated space-ground network when it operates normally in each recording period and the attack duration corresponding to each of N types of attacks occurring in the integrated space-ground network in each recording period are counted; wherein N is a positive integer; For each of the recording periods, the total duration between the normal duration and the N attack durations is calculated, and the ratio of the normal duration to each of the attack durations to the total duration is calculated respectively; Based on the respective ratios, the initial π matrix in each of the recording cycles is determined.

5. The method according to claim 3, characterized in that The generating of the initial state transition probability A matrix based on the training data of the space-ground integrated network includes: In the training data of the integrated space-ground network, determining the probability that the next recording period of each state of the integrated space-ground network is various states; Based on multiple probabilities, the initial A matrix in each of the recording periods is determined.

6. The method according to claim 3, characterized in that The generating of an initial observation probability B matrix based on the training data of the space-ground integrated network includes: In each of the recording cycles of the training data of the integrated space-ground network, the duration corresponding to each state of the integrated space-ground network is divided into a plurality of moments, and the prominent features of the integrated space-ground network in each moment under each state are determined; Determining the probability of each observation result being the salient feature in each state of the space-ground integrated network; The initial B matrix in each of the recording periods is generated according to a plurality of probabilities.

7. The method according to claim 1, characterized in that The training sequence generated based on the plurality of observation results, training the initial hidden Markov model to obtain the target HMM model, comprises: Based on the plurality of observation results, generating the training sequence including the plurality of observation results; The training sequence, the initial A matrix, the initial B matrix and the initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and the dynamic learning rate to obtain the target HMM model.

8. The method according to claim 1, characterized in that Determining whether the integrated space-ground network is under attack according to the network status includes: If it is determined that the network status is normal, it is determined that the space-ground integrated network has not been attacked; If it is determined that the network status is abnormal, it is determined that the space-ground integrated network is under attack.

9. An attack detection device, characterized in that: include: A building module is used to build a standard feature library based on distributed denial of service DDoS attack features; A determination module, configured to determine, based on the standard feature library, in the training data of the space-ground integrated network, the prominent features in each recording period, and use the prominent features as the observation results in the corresponding recording period; A training module, used for training an initial Hidden Markov Model (HMM) based on a training sequence generated by a plurality of observation results to obtain a target HMM model; A processing module is used to process a test sequence generated based on the data to be detected of the integrated space-ground network through the target HMM model to obtain the network status of the integrated space-ground network, and determine whether the integrated space-ground network is under attack based on the network status.

10. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 8 when executing a computer program stored in the memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 8 are implemented.

Images