An attack detection method, apparatus and electronic device

Abstract

The application discloses an attack detection method and device and electronic equipment, the method comprises the following steps: based on the DDoS attack feature, the standard feature library is established; based on the standard feature library, in the training data of the space-ground integrated network, the outstanding feature in each record period is determined, and the outstanding feature is taken as the observation result in the corresponding record period; based on the training sequence generated by the multiple observation results, the initial HMM model is trained to obtain the target HMM model; the test sequence generated based on the to-be-detected data of the space-ground integrated network is processed through the target HMM model, the network state of the space-ground integrated network is obtained, and whether the space-ground integrated network is attacked is determined according to the network state. Through the technical scheme provided by the embodiment of the application, accurate, efficient and lightweight DDoS attack detection is realized in the space-ground integrated network environment.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an attack detection method, apparatus, and electronic device. Background Technology

[0002] Because space-based networks can effectively supplement the shortcomings of terrestrial internet, especially in remote areas where 3 billion people still lack access to broadband, space-based networks can enable them to access the internet. Therefore, the integration of space-based networks with terrestrial internet into a unified space-ground network is becoming a key development trend.

[0003] However, at the same time, the rapid advancement of network technology has gradually increased the threat of Distributed Denial of Service (DDoS) attacks. A DDoS attack refers to multiple attackers in different locations simultaneously launching attacks against one or more targets, or a single attacker controlling multiple machines in different locations and using these machines to simultaneously attack a target.

[0004] Given that accurate, efficient, and lightweight detection methods are the foundation of all defenses, current DDoS attack defense measures mainly focus on DDoS attack detection.

[0005] However, current mainstream artificial intelligence (AI) technologies require significant resources for pre-training, sample collection, and other preparatory work. Since space-based network hardware operates in a vacuum environment, it often requires higher radiation resistance. Its chip processing power and corresponding resources are often far lower than those of current terrestrial hardware, making it difficult to effectively deploy AI technology across the entire space network. This hinders accurate, efficient, and lightweight DDoS attack detection in an integrated space-ground network environment. Summary of the Invention

[0006] This application provides an attack detection method, apparatus, and electronic device to address the difficulty of achieving accurate, efficient, and lightweight DDoS attack detection in an integrated terrestrial-space network environment. The specific implementation scheme is as follows:

[0007] Firstly, this application provides an attack detection method, the method comprising:

[0008] A standard signature library was built based on the characteristics of Distributed Denial-of-Service (DDoS) attacks.

[0009] Based on the standard feature library, in the training data of the space-ground integrated network, prominent features in each recording period are determined, and the prominent features are used as the observation results in the corresponding recording period.

[0010] Based on the training sequence generated from the multiple observation results, the initial Hidden Markov Model (HMM) is trained to obtain the target HMM model.

[0011] The target HMM model processes the test sequence generated from the data to be detected in the integrated space-ground network to obtain the network state of the integrated space-ground network, and determines whether the integrated space-ground network is under attack based on the network state.

[0012] Through the above-described embodiments, a standard feature library based on DDoS attack characteristics can identify prominent features in each recording period of the integrated space-ground network. These prominent features are then used as observations for the corresponding recording periods, ensuring that the training sequences obtained from multiple observations contain the most prominent features of the DDoS attack characteristics. This allows for targeted extraction of DDoS attack feature information, facilitating better training of the initial Hidden Markov Model (HMM). The resulting target HMM model becomes the optimal model, thereby improving the accuracy of test sequences generated from the data to be detected in the integrated space-ground network. This enhances the accuracy of attack detection. Furthermore, since the HMM model requires only a small amount of data to achieve excellent training results, it reduces the consumption of computational resources and storage space. Therefore, by using the HMM model for attack detection, the space-based network in the integrated space-ground network can achieve attack detection without requiring a large amount of resources, enabling accurate, efficient, and lightweight DDoS attack detection within the integrated space-ground network environment.

[0013] In one possible implementation, the step of determining prominent features in each recording period based on the standard feature library and in the training data of the integrated space-ground network, and using the prominent features as the observation results in the corresponding recording period, includes:

[0014] In the training data of the integrated space-ground network, the feature value corresponding to each DDoS attack feature in each recording period is determined;

[0015] For each of the recorded periods, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated.

[0016] Determine the maximum deviation in each of the recorded periods;

[0017] The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

[0018] Through the above application embodiments, based on the deviation between the feature value corresponding to each DDoS attack feature in each recording period and the corresponding standard feature value in the standard feature library, the most prominent deviation feature (i.e., prominent feature) in each recording period is determined. Then, the prominent feature is used as the observation result in the corresponding recording period, so that the observation result is the feature with the largest deviation from the standard feature value in the corresponding recording period, thereby providing data for generating training sequences for training models.

[0019] In one possible implementation, before training the initial Hidden Markov Model (HMM) based on the training sequence generated from the multiple observations to obtain the target HMM model, the following steps are further included:

[0020] Based on the training data of the integrated space-ground network, an initial state transition probability matrix A, an initial observation probability matrix B, and an initial probability matrix π are generated.

[0021] The initial HMM model is generated based on the initial A matrix, the initial B matrix, and the initial π matrix.

[0022] Through the above-described embodiments, an initial HMM model was generated based on the initial A matrix, initial B matrix, and initial π matrix generated from historical data of the integrated space-ground network. Thus, by utilizing the historical data of the integrated space-ground network, the parameters (i.e., the initial A matrix, initial B matrix, and initial π matrix) in the initial HMM model were initialized, thereby achieving accurate model startup and laying the foundation for obtaining the optimal HMM model.

[0023] In one possible implementation, generating an initial probability π matrix based on the training data from the integrated space-ground network includes:

[0024] In the training data of the integrated space-ground network, the normal duration of the integrated space-ground network when it is running normally in each recording period is statistically analyzed, as well as the attack duration corresponding to each of the N types of attacks that occur in each recording period; where N is a positive integer.

[0025] For each recording period, calculate the total duration between the normal duration and N attack durations, and calculate the ratio of the normal duration to each attack duration in the total duration.

[0026] Based on each ratio, the initial π matrix is ​​determined for each of the recording periods.

[0027] Through the above application embodiments, the initial π matrix is ​​quickly determined based on the normal duration and attack duration in historical data, providing more realistic initial parameters for the initialization of HMM generation, so as to accurately start HMM training.

[0028] In one possible implementation, generating the initial state transition probability matrix A based on the training data from the integrated space-ground network includes:

[0029] In the training data of the integrated space-ground network, determine the probability of each state of the integrated space-ground network being the next recording period of each state.

[0030] The initial A matrix is ​​determined for each of the recording periods based on multiple probabilities.

[0031] Through the above application embodiments, the initial A matrix was quickly determined, providing initial parameters that are more in line with the real situation for the initialization of HMM, so as to accurately start the training of HMM.

[0032] In one possible implementation, generating the initial observation probability matrix B based on the training data from the integrated space-ground network includes:

[0033] In each recording period of the training data of the integrated space-ground network, the duration corresponding to each state of the integrated space-ground network is divided into multiple moments, and the prominent features of the integrated space-ground network in each moment of each state are determined.

[0034] Determine the probability of each observation being the salient feature in each state of the integrated space-ground network;

[0035] The initial B matrix for each recording period is generated based on multiple probabilities.

[0036] Through the above application embodiments, the initial B matrix was quickly determined, providing initial parameters that are more in line with the real situation for the initialization of HMM, so as to accurately start the training of HMM.

[0037] In one possible implementation, training an initial Hidden Markov Model (HMM) based on training sequences generated from multiple observations to obtain a target HMM model includes:

[0038] Based on the multiple observation results, a training sequence including the multiple observation results is generated;

[0039] The training sequence, initial A matrix, initial B matrix, and initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and dynamic learning rate to obtain the target HMM model.

[0040] Through the above-described embodiments, an initial HMM model is trained based on the Baum-Welch algorithm, regularization term, and dynamic learning rate to obtain a target HMM model. This can reduce the training time of the HMM model while avoiding overfitting, thereby improving the training speed of the HMM model. This ensures that the obtained target HMM model is the optimal model, which helps to improve the accuracy of attack detection.

[0041] In one possible implementation, determining whether the integrated space-ground network is under attack based on the network status includes:

[0042] If the network status is determined to be normal, then the integrated space-ground network is determined not to be under attack.

[0043] If the network status is determined to be abnormal, then the integrated space-ground network is determined to be under attack.

[0044] Through the above application embodiments, based on the determination of whether the network status is normal or abnormal, it is possible to efficiently and accurately determine whether the integrated space-ground network is under attack.

[0045] Secondly, this application also provides an attack detection device, the device comprising:

[0046] The module is used to build a standard signature library based on the characteristics of Distributed Denial-of-Service (DDoS) attacks.

[0047] The determination module is used to determine the prominent features in each recording period based on the standard feature library in the training data of the space-ground integrated network, and to use the prominent features as the observation results in the corresponding recording period.

[0048] The training module is used to train the initial Hidden Markov Model (HMM) based on the training sequence generated from multiple observations, and to obtain the target HMM model.

[0049] The processing module is used to process the test sequence generated from the data to be detected based on the integrated space-ground network through the target HMM model, obtain the network state of the integrated space-ground network, and determine whether the integrated space-ground network is under attack based on the network state.

[0050] In one possible implementation, the determining module is specifically used to determine the feature value corresponding to each DDoS attack feature in each recording period from the training data of the integrated space-ground network.

[0051] For each of the recorded periods, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated.

[0052] Determine the maximum deviation in each of the recorded periods;

[0053] The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

[0054] In one possible implementation, the device further includes an initialization module, which is used to generate an initial state transition probability matrix A, an initial observation probability matrix B, and an initial probability π matrix based on the training data of the space-ground integrated network before training an initial hidden Markov HMM model based on the training sequence generated from the multiple observation results to obtain a target HMM model.

[0055] The initial HMM model is generated based on the initial A matrix, the initial B matrix, and the initial π matrix.

[0056] In one possible implementation, the initialization module is specifically used to, in the training data of the integrated space-ground network, count the normal duration of the integrated space-ground network when it is running normally in each recording period, and the attack duration corresponding to each of the N types of attacks that occur in each recording period; where N is a positive integer;

[0057] For each recording period, calculate the total duration between the normal duration and N attack durations, and calculate the ratio of the normal duration to each attack duration in the total duration.

[0058] Based on each ratio, the initial π matrix is ​​determined for each of the recording periods.

[0059] In one possible implementation, the initialization module is specifically used to determine, from the training data of the integrated space-ground network, the probability that the next recording period of each state of the integrated space-ground network is each state.

[0060] The initial A matrix is ​​determined for each of the recording periods based on multiple probabilities.

[0061] In one possible implementation, the initialization module is specifically used to divide the duration corresponding to each state of the integrated space-ground network into multiple moments in each recording period of the training data of the integrated space-ground network, and to determine the prominent features of the integrated space-ground network in each moment of each state.

[0062] Determine the probability of each observation being the salient feature in each state of the integrated space-ground network;

[0063] The initial B matrix for each recording period is generated based on multiple probabilities.

[0064] In one possible implementation, the training module is specifically configured to generate a training sequence comprising the multiple observations based on the multiple observations.

[0065] The training sequence, initial A matrix, initial B matrix, and initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and dynamic learning rate to obtain the target HMM model.

[0066] In one possible implementation, the processing module is specifically configured to determine that the integrated space-ground network has not been attacked if the network status is determined to be normal.

[0067] If the network status is determined to be abnormal, then the integrated space-ground network is determined to be under attack.

[0068] Thirdly, this application provides an electronic device, comprising:

[0069] Memory, used to store computer programs;

[0070] When the processor executes the computer program stored in the memory, it implements the steps of the attack detection method described above.

[0071] Fourthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the attack detection method described above.

[0072] For the various aspects of the second to fourth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, which will not be repeated here. Attached Figure Description

[0073] Figure 1 This is a schematic diagram of an attack scenario provided in an embodiment of this application;

[0074] Figure 2 A flowchart illustrating an attack detection method provided in an embodiment of this application;

[0075] Figure 3 A schematic diagram of state transition probabilities provided for embodiments of this application;

[0076] Figure 4 A schematic diagram illustrating the processing steps of the attack detection method provided in this application embodiment;

[0077] Figure 5 A schematic diagram of an attack detection device provided in an embodiment of this application;

[0078] Figure 6 A schematic diagram of an electronic device provided in this application. Detailed Implementation

[0079] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operational methods in the method embodiments can also be applied to the device embodiments or system embodiments. It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A connected to B can represent: A and B directly connected, and A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for distinguishing the purpose of description and should not be construed as indicating or implying relative importance or order.

[0080] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0081] A typical DDoS attack scenario is as follows: Figure 1 As shown, when potential DDoS attack traffic enters the space-ground integrated network from the terrestrial internet, the DDoS attack traffic will be transmitted to the satellite along with normal service traffic, and further spread through the space-based network, thus causing the target to be attacked.

[0082] To address these issues, existing technologies primarily rely on AI to detect DDoS attacks and then implement defenses based on the detection results.

[0083] However, AI technology requires a lot of resources for pre-training, sample collection, and other tasks. The resources of space-based network hardware are far less than those of ground-based hardware, making it difficult to effectively deploy AI technology in space-based networks. As a result, it is difficult to achieve accurate, efficient, and lightweight DDoS attack detection in an integrated space-ground network environment.

[0084] Because Hidden Markov Models (HMMs) can be trained with minimal data, achieving excellent results, they reduce the resource consumption of hardware devices. Therefore, in this embodiment, attack detection can be implemented using HMMs to minimize hardware resource consumption and enable effective deployment in space-based networks.

[0085] Therefore, this application proposes an attack detection method. First, based on a standard feature library constructed from DDoS attack characteristics, prominent features are identified in each recording period of the training data of the integrated space-ground network, and these prominent features are used as the observation results for the corresponding recording period. Then, an initial Hidden Markov Model (HMM) is trained using training sequences generated from multiple observation results to obtain a target HMM model. Finally, the target HMM model is used to process test sequences generated from the data to be detected in the integrated space-ground network to obtain the network state of the integrated space-ground network. Based on this network state, it can be determined whether the integrated space-ground network is under attack. This method eliminates the need for large amounts of data for model training, reducing resource consumption and enabling accurate, efficient, and lightweight DDoS attack detection in the integrated space-ground network environment.

[0086] Reference Figure 2 The diagram shown is a flowchart of an attack detection method provided in an embodiment of this application. The method includes:

[0087] S201, based on DDoS attack characteristics, establishes a standard signature library.

[0088] In this application embodiment, the DDoS attack characteristics can be characteristics unique to the space-ground integrated network in the DDoS field, including "total network traffic", "User Datagram Protocol (UDP) ratio", "Synchronize Sequence Numbers (SYN) flag ratio", "connection establishment frequency", "source address entropy", "Space Communication Protocol Specification (SCPS) retransmission flag ratio in the space-based network", and "CCSDS File Delivery Protocol (CFDP) transmission error rate in the space-based network", but not limited to these, and can also include characteristics from the traditional DDoS field.

[0089] The UDP protocol ratio is the ratio of the number of UDP packets to the total number of packets. The SYN flag ratio is the ratio of the number of SYN flags to the total number of flags in the Transmission Control Protocol (TCP).

[0090] Optionally, the standard signature library generated above based on DDoS attack characteristics can be generated in the following way:

[0091] After the integrated space-ground network has been operating normally for a period of time, the feature value corresponding to each DDoS attack feature during that period is obtained; and this feature value is used as the standard feature value; then, based on each DDoS attack feature and its corresponding standard feature value, a standard feature library is generated, so that the standard feature values ​​in the standard feature library are all feature values ​​when the integrated space-ground network is operating normally, providing a benchmark for subsequently determining the most prominent features that deviate from normal operation (i.e., prominent features).

[0092] For example, the standard feature library is shown in Table 1 below:

[0093] DDoS attack characteristics Standard eigenvalues Total network traffic a UDP protocol ratio b SYN flag ratio c Connection establishment frequency d Entropy of source address e SCPS retransmission flag ratio in space-based networks f CFDP transmission error rate in space-based networks g

[0094] Table 1

[0095] In Table 1, each DDoS attack feature corresponds to a standard feature value.

[0096] Optionally, feature indexes (such as sequence numbers like 1, 2, 3, etc.) can be established in the standard feature library, so that the corresponding DDoS attack features and their corresponding standard feature values ​​can be determined more quickly based on the feature indexes.

[0097] S202, based on a standard feature library, identifies prominent features in each recording period from the training data of the space-ground integrated network, and uses these prominent features as the observation results for the corresponding recording period.

[0098] After establishing a standard feature library based on DDoS attack characteristics in step S201, the feature values ​​corresponding to each DDoS attack in each recording period are recorded for the training data of the integrated space-ground network. This recording period can be flexibly adjusted according to specific application scenarios.

[0099] In this embodiment of the application, the training data of the space-ground integrated network may include the feature values ​​corresponding to each of the DDoS attack features such as "total traffic in the network", "UDP ratio", "SYN flag ratio", "connection establishment frequency", "source address entropy", "space-based network SCPS retransmission flag ratio", and "space-based network CFDP transmission error rate".

[0100] Then, for each recording period, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated. This deviation represents the degree of deviation between the feature value corresponding to the DDoS attack feature and the standard feature value. Based on the deviation, the most prominent attack feature can be selected and used as the prominent feature to generate the observation results.

[0101] In this embodiment, the aforementioned deviation can be determined by calculating the difference between the feature value and the standard feature value, then calculating the ratio of the difference to the standard feature value, and finally calculating the absolute value of the ratio. Specifically, as shown in the following formula:

[0102]

[0103] Among them, D w This represents the deviation of the w-th DDoS attack feature within a given recording period; x w This represents the feature value corresponding to the w-th DDoS attack feature within the corresponding recording period; s w This represents the standard feature value corresponding to the w-th DDoS attack feature in the standard feature library.

[0104] After calculating the corresponding deviation for each DDoS attack feature within the same recording period, the maximum deviation within the same recording period is determined. The DDoS attack feature corresponding to this maximum deviation is then used as the prominent feature for that recording period. This method allows us to determine the maximum deviation and the prominent features for each recording period.

[0105] Optionally, the above-mentioned use of the DDoS attack characteristics corresponding to the maximum deviation as prominent features in this recording period can be achieved by first determining the feature index of the maximum deviation (e.g., D...). w (w in the text), and then based on the feature index (such as D) w The w) in the model is used to identify the corresponding DDoS attack characteristics, and then the DDoS attack characteristics are used as prominent features.

[0106] Then, the prominent features are used as the observation results in the corresponding recording period, so that a training sequence including multiple observation results can be generated based on the observation results in each recording period in the training data of the space-ground integrated network.

[0107] By using the above method, based on the deviation between the feature value corresponding to each DDoS attack feature in each recording period and the corresponding standard feature value in the standard feature library, the prominent feature in each recording period is determined. Then, the prominent feature is used as the observation result in the corresponding recording period, so that the obtained observation result is the most prominent attack feature in the corresponding recording period, thereby providing data for generating training sequences for training models.

[0108] S203, based on training sequences generated from multiple observations, trains the initial HMM model to obtain the target HMM model.

[0109] After obtaining the observation results in each recording period of the training data of the space-ground integrated network in step S203, a training sequence including multiple observation results (i.e., prominent features) is generated based on the observation results.

[0110] For example, training sequence O train As shown below:

[0111] O train = ("Total network traffic", "Connection establishment frequency", ..., "SYN flag ratio")

[0112] The above training sequence O train The "total network traffic" and "connection establishment frequency" are all observation results (i.e., prominent features) within a recording period.

[0113] After generating a training sequence based on multiple observations, the initial HMM model is trained based on the training sequence to obtain the target HMM model.

[0114] In this embodiment of the application, before training the initial HMM model based on the training sequence, the initial HMM is generated using the training data of the space-ground integrated network.

[0115] According to the definition of Hidden Markov Models (HMMs), λ = (A, B, π). Here, A is the state transition probability matrix, B is the observation probability matrix, and π is the initial probability matrix. Therefore, an HMM includes at least matrices A, B, and π.

[0116] Then, it is necessary to first use the training data of the space-ground integrated network to generate the initial A matrix, the initial B matrix, and the initial π matrix, thereby realizing the initialization of the HMM and obtaining the initial HMM.

[0117] Before initializing the HMM, it is necessary to determine the state set Q and observation set V of the integrated space-ground network. This observation set V can include all possible observations, such as "total network traffic," "UDP ratio," "SYN flag ratio," "connection establishment frequency," "source address entropy," "space-based network SCPS retransmission flag ratio," and "space-based network CFDP transmission error rate," but it is not limited to these; for example, it can also include characteristics from the traditional DDoS domain. Therefore, the observation set V can be as follows:

[0118] V = {"Total network traffic", "UDP percentage", "SYN flag percentage", "Connection establishment frequency", "Source address entropy", "Space-based network SCPS retransmission flag percentage", "Space-based network CFDP transmission error rate", ...}

[0119] The aforementioned state set Q can include all states of the integrated space-ground network, such as "normal operation," "resource exhaustion attack," "bandwidth exhaustion attack," and "hybrid attack," but it is not limited to these and can be adjusted according to specific application scenarios. "Normal operation" represents the traffic forwarding state of the integrated space-ground network in the absence of DDoS attacks; "resource exhaustion attack," "bandwidth exhaustion attack," and "hybrid attack" represent the states of the integrated space-ground network under three types of DDoS attacks. Therefore, the state set Q of the HMM model can be as follows:

[0120] Q = {"Normal Operation", "Resource Exhaustion Attack", "Bandwidth Exhaustion Attack", "Hybrid Attack", ...}

[0121] Since the purpose of this application is to detect whether the network is normal or under attack, i.e. to detect the state of the network, the state is unobservable for defense. Therefore, solving for the state is the ultimate goal of this scheme, which satisfies the hidden state space in the HMM model.

[0122] Furthermore, based on the training data of the space-ground integrated network, an initial A matrix, an initial B matrix, and an initial π matrix are generated; then, based on the initial A matrix, the initial B matrix, and the initial π matrix, an initial HMM is generated.

[0123] Optionally, the specific steps for generating the initial π matrix based on the training data of the space-ground integrated network can be as follows:

[0124] The π matrix represents the probability of the network being in normal operation and under different types of attacks at the initial moment. Based on this, the ratio of the overall normal operation time of the integrated space-ground network to the duration of different attacks can be obtained according to the training data and the recording period, thus yielding the initial probability.

[0125] Specifically, firstly, in the training data of the integrated space-ground network, according to the recording period, the normal operating time of the integrated space-ground network when it is running normally in each recording period, and the attack time corresponding to each of the N types of attacks that occur in each recording period, are statistically analyzed. Here, N is a positive integer. Furthermore, N is the number of state types in the state set Q minus 1.

[0126] The training data mentioned above may also include the normal operating time of the integrated space-ground network and the attack duration corresponding to each of the N types of attacks that occur on the integrated space-ground network. The N types of attacks may include resource exhaustion attacks, bandwidth exhaustion attacks, and hybrid attacks, but are not limited to these.

[0127] Then, for each recording period, calculate the total duration between the normal duration and the N attack durations. Next, calculate the ratio of the normal duration to the total duration for each attack duration. Finally, based on these ratios, determine the initial π matrix for each recording period.

[0128] For example, the state set Q includes four states: "normal operation," "resource exhaustion attack," "bandwidth exhaustion attack," and "hybrid attack." Then, the N types of attacks include "resource exhaustion attack," "bandwidth exhaustion attack," and "hybrid attack." Within a recording period, the normal operation duration is q1, the resource exhaustion attack duration is q2, the bandwidth exhaustion attack duration is q3, and the hybrid attack duration is q4. The initial π matrix for the corresponding recording period can then be obtained as follows:

[0129]

[0130] q = q1 + q2 + q3 + q4

[0131] Where q is the total duration between the normal duration and the duration of N attacks.

[0132] Using the above method, the initial π matrix was quickly determined based on the normal duration and attack duration in the training data of the integrated space-ground network. This provided more realistic initial parameters for generating the HMM, thus facilitating the precise initiation of HMM training.

[0133] Optionally, the specific steps for generating the initial A matrix based on the training data of the space-ground integrated network can be as follows:

[0134] In the training data of the space-ground integrated network, the probability of each state of the network being in the next recording period is determined. This probability is called the occurrence probability, which represents the probability that the space-ground integrated network is in the i-th state in the m-th recording period and in the j-th state in the (m+1)-th recording period. Here, m, i, and j are all positive integers.

[0135] Based on the determined probabilities, an initial A matrix is ​​then determined. This initial A matrix includes each probability of occurrence.

[0136] For example, the state transition probability of an integrated space-ground network in a recording period is as follows: Figure 3 As shown, the first state is "normal operation", the second state is "resource exhaustion attack", the third state is "bandwidth exhaustion attack", and the fourth state is "hybrid attack"; a ij Let $\mathbf{i}$ represent the probability that the next recording period of the integrated space-ground network in state $i$ will be state $j$, where $i$ and $j$ are both positive integers less than 5. The initial A matrix for the corresponding recording period can be obtained as follows:

[0137]

[0138] The first row or column represents the first state, the second row or column represents the second state, the third row or column represents the third state, and the fourth row or column represents the fourth state.

[0139] The above method quickly determines the initial A matrix, providing more realistic initial parameters for HMM initialization, thus facilitating accurate initiation of HMM training.

[0140] In this embodiment of the application, the probability of determining the next recording period of each state of the integrated space-ground network as various states can be determined by the number of state types and the duration of the current state, so that the obtained probability is more in line with the real situation. This is beneficial to make the initialization of the HMM model more in line with the real situation, thereby helping to improve the accuracy of the HMM model in attack detection.

[0141] Specifically, for each state of the integrated space-ground network, the following operations are performed:

[0142] First, determine the duration of the current state of the integrated space-ground network, and determine the total number of states of the integrated space-ground network as P (P is a positive integer). Calculate the difference between the duration of the current state and P, and use the ratio of this difference to the duration of the current state as the probability that the next recording period of the integrated space-ground network will still be the current state; use the ratio of this difference to the duration of the current state as the probability that the next recording period of the integrated space-ground network will be a state other than the current state.

[0143] For example, the duration of the "normal operation" state of the integrated space-ground network is 60 minutes. The integrated space-ground network has four states: "normal operation," "resource exhaustion attack," "bandwidth exhaustion attack," and "hybrid attack." Therefore, the probability that the next recording period of the integrated space-ground network will be "normal operation" is 57 / 60, the probability of the next recording period being "resource exhaustion attack" is 1 / 60, the probability of the next recording period being "bandwidth exhaustion attack" is 1 / 60, and the probability of the next recording period being "hybrid attack" is 1 / 60.

[0144] Optionally, the specific steps for generating the initial B matrix based on the training data of the space-ground integrated network can be as follows:

[0145] First, within each recording period of the training data for the integrated space-ground network, the duration corresponding to each state of the network is divided into multiple time points, and the salient features of the network at each time point in each state are determined. Then, the probability of each observation being a salient feature in each state is determined. This probability is the generation probability, representing the probability of generating the k-th salient feature in the i-th state at time t. Finally, based on these probabilities, an initial B-matrix is ​​determined for the corresponding recording period. This initial B-matrix includes each generation probability.

[0146] For example, the first state is "normal operation", the second state is "resource exhaustion attack", the third state is "bandwidth exhaustion attack", and the fourth state is "hybrid attack"; the first observation is "total traffic in the network", the second observation is "UDP protocol ratio", the third observation is "SYN flag ratio", the fourth observation is "connection establishment frequency", the fifth observation is "source address entropy", the sixth observation is "SCPS retransmission flag ratio in space-based network", and the seventh observation is "CFDP transmission error rate in space-based network"; b j (k) represents the probability that the observation result is the k-th observation result in the j-th state, where k is a positive integer less than 8. The initial B matrix for a recording period can be obtained as follows:

[0147]

[0148] In this table, the first row represents the first state, the second row represents the second state, the third row represents the third state, the fourth row represents the fourth state, the first column represents the first observation result, the second column represents the second observation result, the third column represents the third observation result, the fourth column represents the fourth observation result, the fifth column represents the fifth observation result, the sixth column represents the sixth observation result, and the seventh column represents the seventh observation result.

[0149] The above method quickly determines the initial B matrix, providing more realistic initial parameters for HMM initialization, thus facilitating accurate initiation of HMM training.

[0150] In this embodiment of the application, the probability of each observation as a prominent feature in each state can be determined by the frequency of the observation as a prominent feature, as shown below:

[0151] In each state, determine the number of times each observation is identified as a prominent feature. Then, use the ratio of this number to the total number of time points as the probability that the corresponding observation is identified as a prominent feature.

[0152] For example, in a recording period, under normal operating conditions of the space-ground integrated network, there are 60 time points. In 30 of these time points, the "proportion of SCPS retransmission flag bits in the space-based network" is a prominent feature. Therefore, under normal operating conditions of the space-ground integrated network, the probability of the "proportion of SCPS retransmission flag bits in the space-based network" being a prominent feature is 30 / 60, or 50%.

[0153] By using the above method, the probability of each observation being a prominent feature under each state is quickly and accurately determined by the frequency of the observation results as prominent features, thus providing data for determining the initial B matrix.

[0154] Furthermore, after generating the initial A matrix, initial B matrix, and initial π matrix, the initial HMM model is obtained based on these initial A matrix, initial B matrix, and initial π matrix.

[0155] After obtaining the initial HMM model, the target HMM model can be obtained by training the initial HMM model based on the training sequence.

[0156] Training methods for Hidden Markov Models (HMMs) can include the Baum-Welch algorithm. The Baum-Welch algorithm is an expectation-maximization algorithm that estimates the parameters of the HMM (such as the A matrix and B matrix) by iteratively calculating the expected values ​​of the latent variables and maximizing the likelihood function, thereby training the HMM model.

[0157] However, to avoid overfitting of the HMM model and to improve the training speed of the HMM model, a regularization term and a dynamic learning rate can be introduced while training the HMM model using the Baum-Welch algorithm.

[0158] Specifically, the training sequence, initial A matrix, initial B matrix, and initial π matrix are input into the Baum-Welch algorithm. At the same time, a regularization term and dynamic learning rate are introduced on the basis of the Baum-Welch algorithm, and the initial HMM model is iteratively trained to obtain the target HMM model. This avoids overfitting of the model and significantly improves the training speed of the model, making the target HMM model the optimal model, which helps to improve the accuracy of attack detection.

[0159] In this embodiment, the regularization term can be introduced by adding regularization terms to the initial A matrix and the initial B matrix, as shown in the following formula:

[0160]

[0161] Where n represents the number of iterations; ξ represents the probability that the next recording period of the integrated space-ground network in state i will be state j in the (n+1)th iteration; t (i,j) represents the probability that the integrated space-ground network is in state i at time t and in state j at time t+1; γ t (i) represents the probability that the integrated space-ground network is in the i-th state at time t; λ A With λ B Let A and B represent the regularization parameters of matrix A and matrix B, respectively. Based on these regularization parameters, overfitting of the model can be avoided while ensuring that the model's complexity remains within a reasonable range. j (k)(n+1) This represents the probability that, in the (n+1)th iteration, the observed result of the integrated space-ground network in the j-th state is the k-th observed result; v k This represents the k-th observation in the observation set V; o t Indicates the prominent feature at time t; o t =v k Let v represent the observation at time t. k This also makes v the prominent feature at time t. k ; α represents the initial probability that the integrated space-ground network is in the i-th state at the (n+1)-th iteration; t (i) represents the coefficients of the integrated space-ground network in state i at time t; b j (o t+1 ) represents the probability that the observation result of the integrated space-ground network in the j-th state is the salient feature at time t+1; β t+1 (j) represents the coefficient when the integrated space-ground network is in the j-th state at time t+1.

[0162] Therefore, the above formula can be used to regularize the initial A matrix and the initial B matrix in order to minimize the sum of squares of the parameters, thereby suppressing excessively large parameter values ​​and enhancing the generalization ability of the model.

[0163] In this embodiment of the application, the dynamic learning rate can be as follows:

[0164]

[0165] Where α represents the decay rate, n represents the number of iterations, and η (0) η represents the initial learning rate. (n) This represents the learning rate at the nth iteration. Thus, by using a dynamic learning rate, the model can quickly approach the state where training is complete.

[0166] Therefore, after introducing the regularization term and dynamic learning rate, the complete iterative formula is as follows:

[0167]

[0168] Therefore, through the complete iterative formula described above, the HMM model can be iteratively optimized to obtain the optimal target HMM model.

[0169] In the embodiments of this application, the termination condition for iterative training of the HMM model can be that the number of iterations is greater than or equal to the iteration termination threshold, or that the parameter change between two iterations is less than the change threshold, but it is not limited to these and can be adjusted according to the specific application scenario.

[0170] Furthermore, it should be noted that in the embodiments of this application, both the target HMM model and the initial HMM model satisfy the two basic assumptions of HMM: the homogeneous Markov assumption and the observation independence assumption. The homogeneous Markov assumption states that at any given time (e.g., any recording period), the state of the network depends only on the state at the previous time (e.g., the recording period), and is independent of states further back in time. The observation independence assumption states that the observation result (e.g., salient features) at any given time depends only on the state at the current time, and is independent of other observation results and states at other times.

[0171] S204. The test sequence generated by processing the data to be detected based on the integrated space-ground network is obtained by processing the target HMM model to obtain the network state of the integrated space-ground network, and the network state is used to determine whether the integrated space-ground network is under attack.

[0172] After obtaining the target HMM model in step S203, Viterbi decoding is used to complete the attack detection for the data to be detected in the integrated space-ground network.

[0173] Specifically, firstly, in the data to be detected in the integrated space-ground network, based on a standard feature library, prominent features are identified in each recording period, and these prominent features are used as the observation results for the corresponding recording period. Based on the observation results of each recording period, a test sequence of multiple observation results is generated. This test sequence O... Test It can be as follows:

[0174] O Test = (O1, O2, ..., O T )

[0175] Among them, O T This represents the observation results for the current period. In other words, the test sequence must include the observation results for the current period as well as multiple observation results from previous periods.

[0176] It should be noted that the specific steps for determining the prominent features in each recording period based on the standard feature library in the data to be detected in the integrated space-ground network are the same as the specific steps for determining the prominent features in each recording period based on the standard feature library in the training data of the integrated space-ground network in step S202, and will not be repeated here.

[0177] In this embodiment of the application, the recording period in the data to be detected in the integrated space-ground network may or may not be the same as the recording period in the training data of the integrated space-ground network.

[0178] Furthermore, after obtaining the test sequence, the test sequence is input into the target HMM model. The target HMM model processes the test sequence to obtain the network state of the space-ground integrated network (i.e., the hidden state of the HMM model), so as to realize the detection of the network state of the space-ground integrated network.

[0179] In this embodiment, the obtained network state is the network state of the integrated space-ground network in the current period. This network state can be either an abnormal state or a normal state, thereby determining whether the integrated space-ground network is under attack based on this network state.

[0180] Specifically, if the network status is determined to be normal, then the integrated space-ground network is determined not to have been attacked.

[0181] If the network status is determined to be abnormal, it is determined that the integrated space-ground network is under attack, thus achieving attack detection for the integrated space-ground network. This attack could be a DDoS attack.

[0182] By using the above methods, based on whether the network status is normal or abnormal, it is possible to efficiently and accurately determine whether the integrated space-ground network is under attack.

[0183] Optionally, after determining that the integrated space-ground network has been attacked, an alarm can be triggered, and corresponding interception and mitigation strategies can be executed based on the observation sequence to defend against DDoS attacks and prevent the target from being attacked.

[0184] Furthermore, the attack detection method provided in this application embodiment can be deployed on network devices such as gateways and satellite communication base stations to detect and defend against DDoS attacks from the terrestrial Internet.

[0185] The attack detection method provided in this application embodiment can also be applied to space-based networks in integrated space-ground networks, and can also be deployed on satellites. It can use inter-satellite links and satellite-to-ground links to transmit and summarize the required traffic characteristic information and train models to achieve attack detection.

[0186] Compared to existing technologies that deploy AI solutions on the ground for training, then perform optical splitting and detection of space-based network traffic, and continuously interact between the space-based network and the terrestrial internet, the attack detection method provided in this application operates independently between the space-based network and the terrestrial internet, with only a small amount of interaction. For example, after determining that the integrated space-ground network is under attack, it executes corresponding interception and mitigation strategies based on the observation sequence to defend against the attack. This avoids the problems of existing technologies being limited by the long-distance, high-error-rate transmission conditions between the space-based network and the terrestrial internet, making it difficult to synchronously extract traffic features and monitor and analyze them, resulting in significant delays.

[0187] In summary, the attack detection method proposed in this application, based on the objective conditions of space-based networks, uses probabilistic models (i.e., HMM models) and statistical calculation methods to design detection schemes, ensuring detection accuracy while being applicable to resource-constrained and bandwidth-constrained space-based networks.

[0188] By utilizing the training data of the space-ground integrated network, parameters (such as the initial A matrix, initial B matrix, and initial π matrix) in the initial HMM model are generated. In other words, an HMM model is established specifically for the characteristics of the space-based network, achieving precise startup and improving the practical value of the HMM model.

[0189] Then, a standard feature library was built by combining DDoS attack characteristics, and the most prominent features that deviated from the characteristics were obtained as observation results. In this way, prominent features related to DDoS attacks were extracted in a targeted manner, laying the foundation for subsequent accurate detection.

[0190] By using the Baum-Welch algorithm, regularization term and dynamic learning rate, a detection model (i.e. the initial HMM model) that does not depend on ground station resources was trained. This saved training time as much as possible while avoiding overfitting, making the target HMM model the optimal model.

[0191] Finally, the Viterbi algorithm was used to complete the attack detection. Based on the test sequence generated from the data to be detected, combined with the target HMM model, the network state of the integrated space-ground network was obtained. Thus, whether the integrated space-ground network was under attack was determined according to whether the network state was abnormal or normal. Under the constraint of prioritizing processing resources, the attack detection was completed efficiently, accurately, and in a lightweight manner.

[0192] The technical solution of this application will be further explained below with reference to a specific application process.

[0193] like Figure 4 The diagram illustrates the processing steps of the attack detection method. First, in the feature acquisition module, a standard feature library is constructed based on DDoS attack features. Then, in the training data of the integrated space-ground network, for each recording period, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated. Next, the maximum deviation is determined from multiple deviations within the same recording period. The DDoS attack feature corresponding to this maximum deviation is then identified as the prominent feature in that recording period, and this prominent feature is used as the observation result for that recording period. Based on the observation results (i.e., prominent features) in each recording period, a training sequence including the observation results is constructed. This training sequence is then transmitted to the training module for model training.

[0194] In the parameter initialization module, based on historical data from the integrated space-ground network, the initial A matrix, initial π matrix, and initial B matrix are determined. Then, based on the initial A matrix, initial π matrix, and initial B matrix, an initial HMM model is generated. The initial HMM model and its initial parameters (such as the initial A matrix, initial B matrix, and initial π matrix) are then transmitted to the training module to facilitate training of the initial HMM model and obtain the target HMM model.

[0195] In the training module, after receiving the training sequence from the feature acquisition module and the initial A matrix, initial π matrix, and initial B matrix from the parameter initialization module, the training sequence, initial A matrix, initial π matrix, and initial B matrix are input into the Baum-Welch algorithm. Simultaneously, a regularization term and a dynamic learning rate are introduced to iteratively train the initial HMM model, obtaining the target HMM model. The target HMM model is then transmitted to the solution module to obtain the network state of the integrated space-ground network based on the HMM model.

[0196] In the solution module, detection is performed using Viterbi decoding. Specifically, in the data to be detected from the integrated space-ground network, the observation results (i.e., salient features) of the integrated space-ground network in each recording period are determined, and a test sequence is formed based on multiple observation results. The test sequence includes at least the observation results of the current period. Then, the test sequence is input into the target HMM model transmitted from the training module, and the network state of the integrated space-ground network in the current period is obtained through the output of the target HMM model. The network state is then transmitted to the attack detection module to determine whether the integrated space-ground network has been attacked.

[0197] The attack detection module receives the network status transmitted from the solution module. If the network status is determined to be normal, the integrated space-ground network is determined not to be under attack. If the network status is determined to be abnormal, the integrated space-ground network is determined to be under attack, and an alarm can be triggered, and corresponding interception and mitigation strategies can be executed based on the observation sequence.

[0198] By employing the above methods and integrating the feature acquisition module, parameter initialization module, training module, solution module, and attack judgment module, the detection accuracy of DDoS attacks is significantly improved, and lightweight DDoS attack detection is achieved, thus facilitating DDoS attack defense.

[0199] Based on the same inventive concept, this application also provides an attack detection device, such as... Figure 5 The diagram shown is a structural schematic of an attack detection device provided in this application. The device includes:

[0200] Module 501 is used to build a standard signature library based on the characteristics of Distributed Denial-of-Service (DDoS) attacks.

[0201] The determination module 502 is used to determine the prominent features in each recording period based on the standard feature library in the training data of the space-ground integrated network, and use the prominent features as the observation results in the corresponding recording period;

[0202] Training module 503 is used to train an initial Hidden Markov Model (HMM) based on training sequences generated from multiple observation results, and to obtain a target HMM model.

[0203] The processing module 504 is used to process the test sequence generated based on the data to be detected from the integrated space-ground network through the target HMM model, obtain the network state of the integrated space-ground network, and determine whether the integrated space-ground network is under attack based on the network state.

[0204] In one possible implementation, the determining module 502 is specifically used to determine the feature value corresponding to each DDoS attack feature in each recording period in the training data of the integrated space-ground network.

[0205] For each of the recorded periods, the deviation between the feature value corresponding to each DDoS attack feature and the corresponding standard feature value in the standard feature library is calculated.

[0206] Determine the maximum deviation in each of the recorded periods;

[0207] The DDoS attack feature corresponding to the maximum deviation is determined as the prominent feature in the corresponding recording period, and the prominent feature is used as the observation result in the corresponding recording period.

[0208] In one possible implementation, the device further includes an initialization module, which is used to generate an initial state transition probability matrix A, an initial observation probability matrix B, and an initial probability π matrix based on the training data of the space-ground integrated network before training an initial hidden Markov HMM model based on the training sequence generated from the multiple observation results to obtain a target HMM model.

[0209] The initial HMM model is generated based on the initial A matrix, the initial B matrix, and the initial π matrix.

[0210] In one possible implementation, the initialization module is specifically used to, in the training data of the integrated space-ground network, count the normal duration of the integrated space-ground network when it is running normally in each recording period, and the attack duration corresponding to each of the N types of attacks that occur in each recording period; where N is a positive integer;

[0211] For each recording period, calculate the total duration between the normal duration and N attack durations, and calculate the ratio of the normal duration to each attack duration in the total duration.

[0212] Based on each ratio, the initial π matrix is ​​determined for each of the recording periods.

[0213] In one possible implementation, the initialization module is specifically used to determine, from the training data of the integrated space-ground network, the probability that the next recording period of each state of the integrated space-ground network is each state.

[0214] The initial A matrix is ​​determined for each of the recording periods based on multiple probabilities.

[0215] In one possible implementation, the initialization module is specifically used to divide the duration corresponding to each state of the integrated space-ground network into multiple moments in each recording period of the training data of the integrated space-ground network, and to determine the prominent features of the integrated space-ground network in each moment of each state.

[0216] Determine the probability of each observation being the salient feature in each state of the integrated space-ground network;

[0217] The initial B matrix for each recording period is generated based on multiple probabilities.

[0218] In one possible implementation, the training module 503 is specifically configured to generate the training sequence including the multiple observations based on the multiple observations.

[0219] The training sequence, initial A matrix, initial B matrix, and initial π matrix are input into the Baum-Welch algorithm, and the initial HMM model is iteratively trained based on the regularization term and dynamic learning rate to obtain the target HMM model.

[0220] In one possible implementation, the processing module 504 is specifically configured to determine that the integrated space-ground network has not been attacked if the network status is determined to be normal.

[0221] If the network status is determined to be abnormal, then the integrated space-ground network is determined to be under attack.

[0222] Based on the same inventive concept, this application also provides an electronic device that can realize the function of the aforementioned attack detection device. (Refer to...) Figure 6 The aforementioned electronic devices include:

[0223] At least one processor 601 and a memory 602 connected to at least one processor 601. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 The example shown is the connection between processor 601 and memory 602 via bus 600. Bus 600 is... Figure 6 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 600 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 6 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller; there is no restriction on the name.

[0224] In this embodiment, memory 602 stores instructions executable by at least one processor 601. By executing the instructions stored in memory 602, at least one processor 601 can perform the attack detection method discussed above. Processor 601 can implement... Figure 5 The functions of each module in the device shown.

[0225] The processor 601 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 602 and calling data stored in memory 602, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0226] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0227] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the attack detection method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0228] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0229] By designing and programming the processor 601, the code corresponding to the attack detection method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during runtime. Figure 2 The steps of the attack detection method in the illustrated embodiment are as follows. How to design and program the processor 601 is a technique well-known to those skilled in the art and will not be described further here.

[0230] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the attack detection method described above.

[0231] In some possible implementations, various aspects of the attack detection method provided in this application may also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in the attack detection method according to the various exemplary embodiments of this application described above.

[0232] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0233] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0234] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0235] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0236] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An attack detection method characterized by, The method comprises the following steps: Assembling a standard feature library based on characteristics of a distributed denial of service (DDoS) attack; Determining a feature value corresponding to each DDoS attack characteristic in each record period in training data of a space-ground integrated network; For each record period, calculating a deviation between the feature value corresponding to each DDoS attack characteristic and a corresponding standard feature value in the standard feature library; Determining a maximum deviation in each record period; Determining a DDoS attack characteristic corresponding to the maximum deviation as a prominent feature in the corresponding record period, and taking the prominent feature as an observation result in the corresponding record period; Training an initial hidden Markov model (HMM) based on a training sequence generated based on multiple observation results to obtain a target HMM model; Processing a test sequence generated based on to-be-detected data of the space-ground integrated network through the target HMM model to obtain a network state of the space-ground integrated network, and determining whether the space-ground integrated network is attacked according to the network state.

2. The method of claim 1, wherein, Before the step of training an initial hidden Markov model (HMM) based on a training sequence generated based on multiple observation results to obtain a target HMM model, the method further comprises the following steps: Generating an initial state transition probability matrix, an initial observation probability matrix and an initial probability matrix based on the training data of the space-ground integrated network; Generating the initial HMM model according to the initial state transition probability matrix, the initial observation probability matrix and the initial probability matrix.

3. The method of claim 2, wherein, The step of generating an initial probability matrix based on the training data of the space-ground integrated network comprises the following steps: In the training data of the space-ground integrated network, counting a normal duration when the space-ground integrated network runs normally in each record period and attack durations corresponding to N types of attacks in each record period; wherein N is a positive integer; For each record period, calculating a total duration between the normal duration and N attack durations, and respectively calculating a ratio of the normal duration and each attack duration to the total duration; Based on the ratios, determining the initial probability matrix in each record period.

4. The method of claim 2, wherein, The step of generating an initial state transition probability matrix based on the training data of the space-ground integrated network comprises the following steps: In the training data of the space-ground integrated network, determining a probability that a next record period of each state of the space-ground integrated network is a state; Based on the probabilities, determining the initial state transition probability matrix in each record period.

5. The method of claim 2, wherein, The step of generating an initial observation probability matrix based on the training data of the space-ground integrated network comprises the following steps: In each record period in the training data of the space-ground integrated network, dividing a duration corresponding to each state of the space-ground integrated network into multiple time points, and determining a prominent feature in each time point in each state of the space-ground integrated network; determining a probability of each observation being the prominent feature in each state of the space-ground integrated network; generating the initial observation probability matrix in each record period according to the plurality of probabilities.

6. The method of claim 1, wherein, The training sequence generated based on the plurality of observations is used to train an initial hidden Markov model (HMM) to obtain a target HMM model, including: generating the training sequence including the plurality of observations based on the plurality of observations; inputting the training sequence, an initial state transition probability matrix, an initial observation probability matrix, and an initial probability matrix into a Baum-Welch algorithm, and iteratively training the initial HMM model based on a regularization term and a dynamic learning rate to obtain the target HMM model.

7. The method of claim 1, wherein, The determining whether the space-ground integrated network is under attack according to the network state includes: if it is determined that the network state is normal, it is determined that the space-ground integrated network is not under attack; if it is determined that the network state is abnormal, it is determined that the space-ground integrated network is under attack.

8. An attack detection apparatus characterized by comprising: including: The assembling module is configured to assemble a standard feature library based on a distributed denial of service (DDoS) attack feature. The determining module is configured to determine a feature value corresponding to each DDoS attack feature in each record period in training data of the space-ground integrated network. For each record period, a deviation degree between the feature value corresponding to each DDoS attack feature and a corresponding standard feature value in the standard feature library is calculated, and a maximum deviation degree in each record period is determined. The DDoS attack feature corresponding to the maximum deviation degree is determined as a prominent feature in the corresponding record period, and the prominent feature is taken as an observation result in the corresponding record period. The training module is configured to train an initial hidden Markov model (HMM) based on a training sequence generated based on the plurality of observations to obtain a target HMM model. The processing module is configured to process a test sequence generated based on to-be-detected data of the space-ground integrated network through the target HMM model to obtain a network state of the space-ground integrated network, and determine whether the space-ground integrated network is under attack according to the network state.

9. An electronic device, comprising: including: a memory for storing a computer program; a processor for executing the computer program stored in the memory to implement the method steps of any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer program stored in the computer-readable storage medium is executed by the processor to implement the method steps of any one of claims 1-7. The computer program stored in the computer-readable storage medium is executed by the processor to implement the method steps of any one of claims 1-7.

Images