A DDoS attack defense method based on identification model

Abstract

The present invention relates to the field of digital information transmission technology, and in particular to a DDoS attack defense method based on an identification model, wherein the method comprises: obtaining training data from a target data source, and performing model training to obtain an initial attack identification model; using a server to debug the initial attack identification model to obtain a debugging result; within a preset time, judging whether the debugging result meets a preset normal alarm condition, if the debugging result meets the preset normal alarm condition, the initial attack identification model is used as an actual attack identification model, otherwise, the initial attack identification model is retrained based on the debugging result until a preset iteration stop condition is met, and an actual attack identification model is obtained, so as to use the actual attack identification model to perform DDoS attack identification. Thus, the technical problems in the related technology, such as high construction cost, inability to effectively relieve server pressure, high implementation difficulty, and inconvenience for promotion and application, are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a DDoS attack defense method based on a recognition model. Background Art

[0002] Distributed Denial of Service (DDoS) is a group behavior that uses hundreds or even thousands of hosts that have been hacked and installed with attack processes to launch attacks simultaneously. It exploits some defects in network protocols and operating systems, and uses deception and camouflage strategies to carry out network attacks. Hundreds or thousands of attack proxy hosts send a large number of disguised service request packets whose sources cannot be identified to the target host. The services requested by these packets often consume a large amount of system resources or network bandwidth, causing the system or network to be overloaded and paralyzed and stop providing normal network services. The direct manifestations of DDoS attacks include network congestion, system downtime, slow response, etc., which cannot process normal requests, affect normal user access, cause economic losses, and may even be hacked and steal data during the attack, endangering information security.

[0003] At present, distributed denial of service attack DDoS is an attack that is easy to launch and causes great harm. It occupies server resources through a large number of invalid accesses, causing the server to crash and be unable to process normal requests, thus affecting normal user access. It is difficult to achieve perfect defense.

[0004] In the related technologies, many defense methods have been developed for different attack characteristics of DDoS. The boundary filtering method focuses on removing forged messages, but it requires global deployment of message source address checking function, which is difficult to implement. The rate limiting method performs data merging restrictions on the rate problem itself, but calculating the traffic bandwidth that needs to be limited will occupy too many server resources, resulting in low resource utilization. The attack source tracing method can solve the problem from the root of the attack, but the labor cost is too high and it will cause network congestion. The sampling method has low coverage in the entire network and is inefficient. The dynamic security association method is combined with the attack source tracing method, with multiple node personnel working simultaneously, which is efficient, but establishing security associations and information authentication will have a greater impact on routers and requires administrators to cooperate with each other, which is difficult to implement.

[0005] To sum up, in the related technologies, the construction cost is high, it cannot effectively alleviate the server pressure, and it is difficult to implement, which is not conducive to promotion and application, and needs to be improved. Summary of the invention

[0006] The present invention provides a DDoS attack defense method based on an identification model to solve technical problems in related technologies, such as high construction cost, inability to effectively alleviate server pressure, great implementation difficulty, and being unfavorable for promotion and application.

[0007] The first aspect of the present invention provides a DDoS attack defense method based on an identification model, comprising the following steps: obtaining training data from a target data source; using the training data to perform model training to obtain an initial attack identification model; connecting the initial attack identification model to a corresponding server to use the server to debug the initial attack identification model to obtain a debugging result; within a preset time period, judging whether the debugging result meets a preset normal alarm condition, wherein if the debugging result meets the preset normal alarm condition, the initial attack identification model is used as an actual attack identification model to use the actual attack identification model to perform DDoS attack identification, otherwise, retraining the initial attack identification model based on the debugging result until a preset iteration stop condition is met to obtain the actual attack identification model to use the actual attack identification model to perform DDoS attack identification.

[0008] Optionally, in one embodiment of the present invention, the obtaining of training data from the target data source includes: intercepting actual data that meets preset data conditions from the target server as the training data; and / or launching multiple simulated DDoS attacks on the target server, and intercepting simulated data that meets the preset data conditions from the target server as the training data.

[0009] Optionally, in one embodiment of the present invention, before using the training data for model training, it also includes: cutting the training data into multiple time slices of preset lengths, and cleaning the time slices to obtain cleaned valid time slices; labeling each of the valid time slices based on the data in the valid time slices to obtain valid time slices that are being subjected to DDoS attack labels and valid time slices that are not being subjected to DDoS attacks; grouping the valid time slices to obtain a first group of data that meets the preset DDoS attack feature significance condition and a second group of data that does not meet the preset DDoS attack feature significance condition; shuffling all the valid time slices in the first group of data and the second group of data, randomly combining the valid time slices in the first group of data to obtain multiple first random time slice pairs, and randomly combining the valid time slices in the second group of data to obtain multiple second random time slice pairs.

[0010] Optionally, in one embodiment of the present invention, the use of the training data to perform model training to obtain an initial attack identification model includes: constructing a preliminary model, and using the preliminary model to identify the status codes of the first random time slice pairs in the first group of data one by one, to obtain a preliminary identification model, wherein the status code is obtained by the label corresponding to each valid time slice in the first random time slice pair; inputting the second group of data into the preliminary identification model, calculating the accuracy of the preliminary identification model, and determining whether the accuracy is greater than or equal to a preset threshold; if the accuracy is greater than or equal to the preset threshold, using the preliminary identification model as the initial attack identification model; if the accuracy is less than the preset threshold, repeating the identification process of the first group of data using the second group of data until the accuracy is greater than or equal to the preset threshold, to obtain the initial attack identification model.

[0011] Optionally, in one embodiment of the present invention, the retraining of the initial attack identification model based on the debugging result until a preset iteration stop condition is met to obtain the actual attack identification model, so as to use the actual attack identification model to perform the DDoS attack identification, includes: when the debugging result is that the system is subjected to an unidentified DDoS attack, obtaining new training data, and using the new training data to perform model training to obtain a new initial attack identification model; when the debugging result is that the system is not subjected to the unidentified DDoS attack, judging whether the identified DDoS attack is correct; if the DDoS attack identification is correct, debugging the initial attack identification model multiple times within the preset time length until each debugging result is that the system is not subjected to the unidentified DDoS attack, and obtaining the actual attack identification model; otherwise, adjusting the parameters of the preliminary identification model, and retraining the preliminary identification model using a time slice that meets the preset similarity condition until the initial attack identification model is obtained, and re-debugging the initial attack identification model.

[0012] The second aspect of the present invention provides a DDoS attack defense device based on an identification model, including: an acquisition module, used to acquire training data from a target data source; a training module, used to use the training data to perform model training to obtain an initial attack identification model; a debugging module, used to connect the initial attack identification model to a corresponding server, so as to use the server to debug the initial attack identification model and obtain a debugging result; an identification module, used to determine whether the debugging result meets a preset normal alarm condition within a preset time period, wherein if the debugging result meets the preset normal alarm condition, the initial attack identification model is used as an actual attack identification model to use the actual attack identification model to perform DDoS attack identification, otherwise, the initial attack identification model is retrained based on the debugging result until a preset iteration stop condition is met to obtain the actual attack identification model, so as to use the actual attack identification model to perform DDoS attack identification.

[0013] Optionally, in one embodiment of the present invention, the acquisition module includes: a first interception unit, used to intercept actual data that meets preset data conditions from the target server as the training data; and / or, a second interception unit, used to launch multiple simulated DDoS attacks on the target server, and intercept simulated data that meets the preset data conditions from the target server as the training data.

[0014] Optionally, in one embodiment of the present invention, it also includes: a processing module, which is used to cut the training data into multiple time slices of preset lengths, and clean the time slices to obtain cleaned valid time slices; a labeling module, which is used to label each of the valid time slices based on the data in the valid time slices, and obtain valid time slices that are suffering from DDoS attack labels and valid time slices that are not suffering from DDoS attacks; a grouping module, which is used to group the valid time slices to obtain a first group of data that meets the preset DDoS attack feature significance condition and a second group of data that does not meet the preset DDoS attack feature significance condition; a combining module, which is used to disrupt all valid time slices in the first group of data and the second group of data, randomly combine the valid time slices in the first group of data to obtain multiple first random time slice pairs, and randomly combine the valid time slices in the second group of data to obtain multiple second random time slice pairs.

[0015] Optionally, in one embodiment of the present invention, the training module includes: a construction unit, used to construct a preliminary model, and use the preliminary model to identify the status code of the first random time slice pair in the first group of data one by one, to obtain a preliminary recognition model, wherein the status code is obtained by the label corresponding to each valid time slice in the first random time slice pair; a calculation unit, used to input the second group of data into the preliminary recognition model, calculate the accuracy of the preliminary recognition model, and determine whether the accuracy is greater than or equal to a preset threshold; a first determination unit, used to use the preliminary recognition model as the initial attack recognition model when the accuracy is greater than or equal to the preset threshold; a second determination unit, used to use the second group of data to repeat the recognition process of the first group of data when the accuracy is less than the preset threshold, until the accuracy is greater than or equal to the preset threshold, to obtain the initial attack recognition model.

[0016] Optionally, in one embodiment of the present invention, the identification module includes: a first training unit, used to obtain new training data when the debugging result is that the system is subjected to an unidentified DDoS attack, and use the new training data to perform model training to obtain a new initial attack identification model; a second training unit, used to determine whether the identified DDoS attack is correct when the debugging result is that the system is not subjected to the unidentified DDoS attack; if the DDoS attack is identified correctly, the initial attack identification model is debugged multiple times within the preset time length until each debugging result is that the system is not subjected to the unidentified DDoS attack, and the actual attack identification model is obtained; otherwise, the parameters of the preliminary identification model are adjusted, and the preliminary identification model is retrained using a time slice that meets the preset similarity conditions until the initial attack identification model is obtained, and the initial attack identification model is re-debugged.

[0017] A third aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a DDoS attack defense method based on an identification model as described in the above embodiment.

[0018] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute a DDoS attack defense method based on an identification model as described in the above embodiment.

[0019] A fifth aspect of the present invention provides a computer program product, including a computer program, which, when executed, is used to implement the above-mentioned DDoS attack defense method based on the identification model.

[0020] The embodiment of the present invention can use the training data from the target data source to train the model, obtain the initial attack identification model, and use the server to debug the initial attack identification model to obtain the debugging result, so as to judge whether the debugging result meets the preset normal alarm condition within the preset time length. If the debugging result meets the preset normal alarm condition, the initial attack identification model is used as the actual attack identification model. Otherwise, the initial attack identification model is retrained based on the debugging result until the preset iteration stop condition is met to obtain the actual attack identification model, so as to use the actual attack identification model to identify DDoS attacks, combine machine learning with DDoS defense, and in the defense process, use the characteristics of the model that are sensitive to data changes, analyze the request initiation interval, time change trend, spatial distribution law, request package characteristics and other changes in a short period of time, identify DDoS attacks, so as to identify data before entering the server, intercept suspicious requests, and continuously learn and correct in real time after being put into use, so as to reduce economic and labor costs and facilitate promotion and application. Thus, the technical problems such as high construction cost, inability to effectively relieve server pressure, high implementation difficulty and unfavorable promotion and application in the related technology are solved.

[0021] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0023] Figure 1 A flowchart of a DDoS attack defense method based on an identification model provided according to an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a time slice pair generation principle according to an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of a model training principle according to an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of a debugging principle according to an embodiment of the present invention;

[0027] Figure 5 A flowchart of a DDoS attack defense method based on an identification model according to an embodiment of the present invention;

[0028] Figure 6A structural diagram of a DDoS attack defense device based on an identification model provided according to an embodiment of the present invention;

[0029] Figure 7 It is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0031] The following describes a DDoS attack defense method based on an identification model according to an embodiment of the present invention with reference to the accompanying drawings. In view of the technical problems that the related technologies mentioned in the above background technology have high construction costs, cannot effectively alleviate server pressure, are difficult to implement, and are not conducive to popularization and application, the present invention provides a DDoS attack defense method based on an identification model. In this method, the training data from the target data source can be used to train the model to obtain an initial attack identification model, and the initial attack identification model can be debugged using the server to obtain a debugging result, so as to judge whether the debugging result meets the preset normal alarm condition within a preset time. If the debugging result meets the preset normal alarm condition, the initial attack identification model is used as the actual attack identification model, otherwise , retrain the initial attack identification model based on the debugging results until the preset iteration stop condition is met, and obtain the actual attack identification model, so as to use the actual attack identification model to identify DDoS attacks, combine machine learning with DDoS defense, and in the defense process, use the characteristics of the model that are sensitive to data changes, and analyze the changes in the request initiation interval, time change trend, spatial distribution law, request package characteristics and other short-term changes to identify DDoS attacks, so as to identify data before entering the server and intercept suspicious requests. At the same time, after being put into use, continuous learning and real-time correction can be carried out, thereby reducing economic and labor costs and facilitating promotion and application. In this way, the technical problems of high construction cost, inability to effectively relieve server pressure, difficulty in implementation, and unfavorable promotion and application in related technologies are solved.

[0032] Specifically, Figure 1 A flowchart of a DDoS attack defense method based on an identification model provided in an embodiment of the present invention.

[0033] like Figure 1 As shown, the DDoS attack defense method based on the identification model includes the following steps:

[0034] In step S101, training data is obtained from a target data source.

[0035] It is understandable that the establishment of a preliminary model requires data with obvious features. The actual data contains multiple influencing factors, so the data does not have obvious features. Therefore, the embodiment of the present invention can use a combination of manual generation and actual data to train the model.

[0036] The data types may include the change trend of the total number of requests, the frequency of request initiation, the spatial distribution, and the characteristics of the request package. The spatial distribution can be quantified by the IP address and the geographic longitude and latitude.

[0037] Optionally, in one embodiment of the present invention, obtaining training data from a target data source includes: intercepting actual data that meets preset data conditions from a target server as training data; and / or launching multiple simulated DDoS attacks on the target server, and intercepting simulated data that meets preset data conditions from the target server as training data.

[0038] In the actual implementation process, Figure 2 As shown, the actual data satisfying the preset data conditions, that is, the training data, in the embodiment of the present invention can come from actual data and manually generated data.

[0039] The actual data can be intercepted from the actual server available data; the manually generated data can be launched by relevant technicians through different ports to simulate multiple real DDoS attacks, and the corresponding data can be intercepted from the server side as training data. The preset data conditions can be set by technicians in this field according to the actual situation, and no specific restrictions are made here.

[0040] In step S102, model training is performed using the training data to obtain an initial attack recognition model.

[0041] Furthermore, the embodiment of the present invention can use training data to train an initial attack recognition model.

[0042] Optionally, in one embodiment of the present invention, before using the training data for model training, it also includes: cutting the training data into multiple time slices of preset lengths, and cleaning the time slices to obtain cleaned valid time slices; labeling each valid time slice based on the data in the valid time slices to obtain valid time slices that are being subjected to DDoS attack labels and valid time slices that are not being subjected to DDoS attacks; grouping the valid time slices to obtain a first group of data that meets the preset DDoS attack feature significance condition and a second group of data that does not meet the preset DDoS attack feature significance condition; shuffling all valid time slices in the first group of data and the second group of data, randomly combining the valid time slices in the first group of data to obtain multiple first random time slice pairs, and randomly combining the valid time slices in the second group of data to obtain multiple second random time slice pairs.

[0043] Before model training, Figure 2 As shown, the embodiment of the present invention can pre-process the training data.

[0044] The embodiment of the present invention can match the training data by time, ensure that the four data of the change trend of the total number of requests, the request initiation frequency, the spatial distribution and the request package characteristics occur simultaneously, and cut the obtained data into time slices of appropriate length for screening.

[0045] The training data is cleaned, abnormal time slices are deleted, and each time slice is labeled as being under DDoS attack (yes) or not under DDoS attack (no).

[0046] The training data is divided into two groups: the first group of data has obvious DDoS attack characteristics, and the second group of data does not have obvious DDoS attack characteristics.

[0047] The two sets of data are randomly shuffled for multiple times and then combined in pairs, so as to obtain a number of time slice pairs combined in pairs, namely, a first random time slice pair and a second random time slice pair.

[0048] Optionally, in one embodiment of the present invention, model training is performed using training data to obtain an initial attack identification model, including: constructing a preliminary model, and using the preliminary model to identify the status codes of the first random time slice pairs in the first group of data one by one, to obtain a preliminary identification model, wherein the status code is obtained by the label corresponding to each valid time slice in the first random time slice pair; inputting the second group of data into the preliminary identification model, calculating the accuracy of the preliminary identification model, and determining whether the accuracy is greater than or equal to a preset threshold; if the accuracy is greater than or equal to the preset threshold, using the preliminary identification model as the initial attack identification model; if the accuracy is less than the preset threshold, repeating the identification process of the first group of data using the second group of data until the accuracy is greater than or equal to the preset threshold, to obtain an initial attack identification model.

[0049] In the actual implementation process, Figure 3 As shown, the embodiment of the present invention can first use the first random time slice pair in the first group of data (obvious group) for training, wherein the following four status codes can be set according to the labels corresponding to the two time slices contained in a single time slice pair:

[0050] (1) None - None is set to 0

[0051] (2) Yes or No: set to -1

[0052] (3) None - Set to 1 if yes

[0053] (4) Yes - set to 1

[0054] Through multiple rounds of learning on the recognition of the above four status codes, the preliminary model is trained to have basic DDoS attack recognition function and obtain the preliminary recognition model.

[0055] Use the second set of data to test and optimize the preliminary recognition model. Use the recognition accuracy rate as the standard to measure the recognition effect of the preliminary recognition model. If the result is lower than γ If the recognition rate is higher than 90%, the training process of the first set of data is repeated with the second set of data to optimize the model so that it can achieve a higher recognition rate. After achieving a higher recognition rate, the preliminary recognition model is used as the initial attack recognition model.

[0056] In step S103, the initial attack identification model is connected to the corresponding server, so as to use the server to debug the initial attack identification model and obtain a debugging result.

[0057] In some embodiments, the initial attack identification model may be connected to a corresponding server for debugging, and corresponding debugging results may be obtained.

[0058] In step S104, within a preset time period, it is determined whether the debugging result meets the preset normal alarm condition. If the debugging result meets the preset normal alarm condition, the initial attack identification model is used as the actual attack identification model to perform DDoS attack identification using the actual attack identification model. Otherwise, the initial attack identification model is retrained based on the debugging result until the preset iteration stop condition is met to obtain the actual attack identification model to perform DDoS attack identification using the actual attack identification model.

[0059] Furthermore, when debugging the embodiment of the present invention, various situations may be encountered, such as missed alarms, false alarms, and no false alarms.

[0060] like Figure 4 As shown, the embodiment of the present invention can determine whether the debugging result meets the preset normal alarm condition, that is, on the premise that there is no unidentified DDoS attack and the identified DDoS attack is correct, after multiple debugging and repeated observation for a period of time, it is determined that the debugging results meet the above premise, and it is determined that the debugging result meets the preset normal alarm condition, indicating that there is no false alarm at present, then the initial attack recognition model can be put into use as the actual attack recognition model.

[0061] On the contrary, if the debugging result does not meet the preset normal alarm conditions, it means that it may be in a false alarm state. At this time, the embodiment of the present invention can re-train the model according to the debugging results until the preset iteration stop conditions are met to obtain the actual attack identification model, wherein the false alarm state may include a missed alarm state or a false alarm state.

[0062] The preset duration may be set by technicians in this field according to actual conditions and is not specifically limited here.

[0063] Optionally, in one embodiment of the present invention, the initial attack identification model is retrained based on the debugging result until a preset iteration stop condition is met to obtain an actual attack identification model, so as to use the actual attack identification model to identify DDoS attacks, including: when the debugging result is that the system is subjected to an unidentified DDoS attack, new training data is obtained, and the model is trained using the new training data to obtain a new initial attack identification model; when the debugging result is that the system is not subjected to an unidentified DDoS attack, it is determined whether the identified DDoS attack is correct; if the DDoS attack is correctly identified, the initial attack identification model is debugged multiple times within a preset time length until each debugging result is that the system is not subjected to an unidentified DDoS attack, and the actual attack identification model is obtained; otherwise, the parameters of the preliminary identification model are adjusted, and the preliminary identification model is retrained using a time slice that meets the preset similarity condition until the initial attack identification model is obtained, and the initial attack identification model is re-debugged.

[0064] Specifically, Figure 4 As shown, the embodiment of the present invention can determine that it is currently in a missed alarm state when the debugging result is an unrecognized DDoS attack. At this time, the relevant technical personnel can manually supplement the model, obtain new attack data, repeat the first set of data training process, and optimize the model. Among them, the model parameters that can be adjusted include two parts, the proportion of different features in the round and the number of iterations. Among them, the different features in the round can include four parts: the change trend of the total number of requests, the frequency of request initiation, the spatial distribution, and the request package characteristics. Adjustment can be made according to the data type at the false alarm. If it is determined that a certain part accounts for too high a proportion, resulting in a model recognition error, a balance value can be found through multiple rounds of adjustment, thereby achieving adjustment of the parameters.

[0065] When the debugging result shows that the system has not been attacked by an unidentified DDoS attack and the DDoS attack has been misidentified, it is determined that the system is currently in a false alarm state. At this time, the model parameters can be adjusted to find similar time slice pairs in the database, modify their labels and status codes, and retrain. Among them, the preset database is a database that stores the first set of data and the second set of data, and after being put into use, the preset database can also be used to update and maintain new data sets. Similar time slice pair judgments can be obtained based on four values: the trend of changes in the total number of requests, the frequency of request initiation, the spatial distribution, and the characteristics of the request package. For example, if the four data of a training time slice pair are all close to the false alarm time slice pair, and the difference is about 5% (which can be appropriately expanded), the similar time slice pair corresponding to the time slice pair currently used for debugging the model can be obtained.

[0066] When the debugging result is that there is no unidentified DDoS attack and the DDoS attack is correctly identified, after multiple debuggings and repeated observations for a period of time, it is determined that the debugging results are all that there is no unidentified DDoS attack, which means that there is no false alarm at present, and the initial attack identification model can be put into use as the actual attack identification model.

[0067] Combination Figures 2 to 5 As shown, the working principle of a DDoS attack defense method based on an identification model in an embodiment of the present invention is described in detail with an embodiment.

[0068] like Figure 5 As shown, the embodiment of the present invention may include the following steps:

[0069] Step S501: Acquisition and processing of data required for training the model. The establishment of the preliminary model requires data with obvious features. The training data contains a variety of influencing factors, so that the data does not have obvious features. Therefore, the embodiment of the present invention can use a combination of manual generation and actual data to train the model. The training data can be intercepted from the actual server available data; the manually generated data can be launched by relevant technicians through different ports to simulate multiple real-life DDoS attacks, and the corresponding data can be intercepted from the server as a data source.

[0070] like Figure 2 As shown, the training data types include the change trend of the total number of requests, the frequency of request initiation, the spatial distribution, and the characteristics of the request package. The spatial distribution can be quantified by the IP address and the geographic longitude and latitude. The embodiment of the present invention can correspond the training data to time to ensure that the four types of data occur at the same time. The embodiment of the present invention can also cut the training data into time slices of moderate length for screening.

[0071] After obtaining the training data, the training data is cleaned, the abnormal time slices are deleted, and each time slice is labeled as being under DDoS attack (yes) or not under DDoS attack (no).

[0072] The data is divided into two groups: the first group is data with obvious DDoS attack characteristics, and the second group is data without obvious DDoS attack characteristics. The two groups of data are randomly shuffled multiple times and then combined in pairs to obtain several time slice pairs of two-by-two combinations.

[0073] Step S502: training the model. Figure 3 As shown, the embodiment of the present invention can first use the first random time slice pair in the first group of data (obvious group) for training, wherein the following four status codes can be set according to the labels corresponding to the two time slices contained in a single time slice pair:

[0074] (1) None - None is set to 0

[0075] (2) Yes or No: set to -1

[0076] (3) None - Set to 1 if yes

[0077] (4) Yes - set to 1

[0078] Through multiple rounds of learning on the recognition of the above four status codes, the preliminary model is trained to have basic DDoS attack recognition function and obtain the preliminary recognition model.

[0079] Use the second set of data to test and optimize the preliminary recognition model. Use the recognition accuracy rate as the standard to measure the recognition effect of the preliminary recognition model. If the result is lower than γIf the recognition rate is higher than 90%, the training process of the first set of data is repeated with the second set of data to optimize the model so that it can achieve a higher recognition rate. After achieving a higher recognition rate, the preliminary recognition model is used as the initial attack recognition model.

[0080] Step S503: corresponding website access debugging and application. Figure 4 As shown, in the embodiment of the present invention, the model can be connected to the corresponding server for debugging, and the following three situations may occur:

[0081] (1) Missed alarm: There is an unidentified DDoS attack.

[0082] Relevant technical personnel manually supplement the model, obtain new attack data, repeat the first set of data training process, and optimize the model.

[0083] (2) False alarm: The DDoS attack is identified incorrectly.

[0084] Adjust the model parameters, find similar time slice pairs in the database, modify their labels and status codes, and retrain.

[0085] (3) No false alarms: No recognition errors occur within a short period of time.

[0086] The system can be observed repeatedly for a period of time. If problems (1) and (2) do not occur, it can be put into use.

[0087] According to a DDoS attack defense method based on an identification model proposed in an embodiment of the present invention, the training data from the target data source can be used for model training to obtain an initial attack identification model, and the server can be used to debug the initial attack identification model to obtain a debugging result, so as to judge whether the debugging result meets the preset normal alarm condition within a preset time length. If the debugging result meets the preset normal alarm condition, the initial attack identification model is used as the actual attack identification model. Otherwise, the initial attack identification model is retrained based on the debugging result until the preset iteration stop condition is met to obtain the actual attack identification model, so as to use the actual attack identification model for DDoS attack identification, combine machine learning with DDoS defense, and in the defense process, use the characteristics of the model that are sensitive to data changes, analyze the request initiation interval, time change trend, spatial distribution law, request package characteristics and other short-term changes to identify DDoS attacks, so as to identify data before entering the server and intercept suspicious requests, and at the same time, after being put into use, continuous learning and real-time correction can be carried out, thereby reducing economic and labor costs and facilitating promotion and application. Therefore, the technical problems of high construction cost, inability to effectively relieve server pressure, high implementation difficulty and unfavorable promotion and application in the related technology are solved.

[0088] Next, a DDoS attack defense device based on an identification model proposed in an embodiment of the present invention is described with reference to the accompanying drawings.

[0089] Figure 6 It is a block diagram of a DDoS attack defense device based on an identification model according to an embodiment of the present invention.

[0090] like Figure 6 As shown, the DDoS attack defense device 10 based on the recognition model includes: an acquisition module 100, a training module 200, a debugging module 300 and an identification module 400.

[0091] Specifically, the acquisition module 100 is used to acquire training data from a target data source.

[0092] The training module 200 is used to perform model training using training data to obtain an initial attack recognition model.

[0093] The debugging module 300 is used to connect the initial attack identification model to the corresponding server, so as to use the server to debug the initial attack identification model and obtain the debugging result.

[0094] The identification module 400 is used to determine whether the debugging result meets the preset normal alarm condition within a preset time period. If the debugging result meets the preset normal alarm condition, the initial attack identification model is used as the actual attack identification model to use the actual attack identification model to perform DDoS attack identification. Otherwise, the initial attack identification model is retrained based on the debugging result until the preset iteration stop condition is met, and the actual attack identification model is obtained to use the actual attack identification model to perform DDoS attack identification.

[0095] Optionally, in one embodiment of the present invention, the acquisition module 100 includes: a first interception unit and / or a second interception unit.

[0096] The first interception unit is used to intercept actual data that meets preset data conditions from the target server as training data.

[0097] The second interception unit is used to launch multiple simulated DDoS attacks on the target server and intercept simulated data that meets preset data conditions from the target server as training data.

[0098] Optionally, in one embodiment of the present invention, a DDoS attack defense device 10 based on recognition model further includes: a processing module, a label module, a grouping module and a combining module.

[0099] The processing module is used to cut the training data into multiple time slices of preset lengths, and clean the time slices to obtain valid time slices after cleaning.

[0100] The label module is used to label each valid time slice based on the data in the valid time slice, and obtain the valid time slices that are suffering from DDoS attacks and the valid time slices that are not suffering from DDoS attacks.

[0101] The grouping module is used to group the valid time slices to obtain a first group of data that meets the preset DDoS attack feature significance condition and a second group of data that does not meet the preset DDoS attack feature significance condition.

[0102] The combination module is used to shuffle all valid time slices in the first group of data and the second group of data, randomly combine the valid time slices in the first group of data to obtain multiple first random time slice pairs, and randomly combine the valid time slices in the second group of data to obtain multiple second random time slice pairs.

[0103] Optionally, in one embodiment of the present invention, the training module 200 includes: a construction unit, a calculation unit, a first determination unit and a second determination unit.

[0104] Among them, the construction unit is used to construct a preliminary model, and use the preliminary model to identify the status code of the first random time slice pair in the first group of data one by one to obtain a preliminary recognition model, wherein the status code is obtained by the label corresponding to each valid time slice in the first random time slice pair.

[0105] The calculation unit is used to input the second set of data into the preliminary recognition model, calculate the accuracy of the preliminary recognition model, and determine whether the accuracy is greater than or equal to a preset threshold.

[0106] The first determining unit is used to use the preliminary recognition model as the initial attack recognition model when the accuracy rate is greater than or equal to a preset threshold.

[0107] The second determination unit is used to repeat the recognition process of the first set of data using the second set of data when the accuracy rate is less than the preset threshold, until the accuracy rate is greater than or equal to the preset threshold, so as to obtain an initial attack recognition model.

[0108] Optionally, in one embodiment of the present invention, the recognition module 400 includes: a first training unit and a second training unit.

[0109] Among them, the first training unit is used to obtain new training data when the debugging result is that the system is under an unrecognized DDoS attack, and use the new training data to perform model training to obtain a new initial attack recognition model.

[0110] The second training unit is used to determine whether the identified DDoS attack is correct when the debugging result is that the unidentified DDoS attack is not suffered. If the DDoS attack is identified correctly, the initial attack identification model is debugged multiple times within a preset time length until each debugging result is that the unidentified DDoS attack is not suffered, and the actual attack identification model is obtained. Otherwise, the parameters of the preliminary identification model are adjusted, and the preliminary identification model is retrained using a time slice that meets the preset similarity conditions until the initial attack identification model is obtained, and the initial attack identification model is re-debugged.

[0111] It should be noted that the above explanation of an embodiment of a DDoS attack defense method based on an identification model is also applicable to a DDoS attack defense device based on an identification model in this embodiment, which will not be repeated here.

[0112] According to a DDoS attack defense device based on an identification model proposed in an embodiment of the present invention, the training data from the target data source can be used for model training to obtain an initial attack identification model, and the server can be used to debug the initial attack identification model to obtain a debugging result, so as to judge whether the debugging result meets the preset normal alarm condition within a preset time length. If the debugging result meets the preset normal alarm condition, the initial attack identification model is used as the actual attack identification model. Otherwise, the initial attack identification model is retrained based on the debugging result until the preset iteration stop condition is met to obtain the actual attack identification model, so as to use the actual attack identification model to identify DDoS attacks, combine machine learning with DDoS defense, and in the defense process, use the characteristics of the model that are sensitive to data changes, analyze the request initiation interval, time change trend, spatial distribution law, request package characteristics and other short-term changes to identify DDoS attacks, so as to identify data before entering the server and intercept suspicious requests, and at the same time, after being put into use, continuous learning and real-time correction can be carried out, thereby reducing economic and labor costs and facilitating promotion and application. Therefore, the technical problems of high construction cost, inability to effectively relieve server pressure, high implementation difficulty and unfavorable promotion and application in the related technology are solved.

[0113] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device may include:

[0114] A memory 701 , a processor 702 , and a computer program stored in the memory 701 and executable on the processor 702 .

[0115] When the processor 702 executes the program, a DDoS attack defense method based on a recognition model provided in the above embodiment is implemented.

[0116] Furthermore, the electronic device further comprises:

[0117] The communication interface 703 is used for communication between the memory 701 and the processor 702 .

[0118] The memory 701 is used to store computer programs that can be executed on the processor 702 .

[0119] The memory 701 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0120] If the memory 701, the processor 702 and the communication interface 703 are implemented independently, the communication interface 703, the memory 701 and the processor 702 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0121] Optionally, in a specific implementation, if the memory 701, the processor 702 and the communication interface 703 are integrated on a chip, the memory 701, the processor 702 and the communication interface 703 can communicate with each other through an internal interface.

[0122] The processor 702 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0123] This embodiment also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned DDoS attack defense method based on the recognition model is implemented.

[0124] An embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed, it is used to implement a DDoS attack defense method based on an identification model provided in an embodiment of the present invention.

[0125] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0126] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "N" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0127] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present invention belong.

[0128] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways as necessary and then storing it in a computer memory.

[0129] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0130] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0131] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0132] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A DDoS attack defense method based on recognition model, characterized in that: The following steps are involved: Obtain training data from a target data source; Using the training data to perform model training to obtain an initial attack recognition model; Connecting the initial attack identification model to a corresponding server, so as to use the server to debug the initial attack identification model and obtain a debugging result; Within a preset time period, determining whether the debugging result satisfies a preset normal alarm condition, wherein if the debugging result satisfies the preset normal alarm condition, the initial attack recognition model is used as the actual attack recognition model, so as to use the actual attack recognition model to perform DDoS attack recognition; otherwise, the initial attack recognition model is retrained based on the debugging result until a preset iteration stop condition is met, so as to obtain the actual attack recognition model, so as to use the actual attack recognition model to perform DDoS attack recognition; Before using the training data for model training, the method further includes: cutting the training data into multiple time slices of preset lengths, and cleaning the time slices to obtain cleaned valid time slices; labeling each of the valid time slices based on the data in the valid time slices to obtain valid time slices that are being subjected to DDoS attack labels and valid time slices that are not being subjected to DDoS attacks; grouping the valid time slices to obtain a first group of data that meets the preset DDoS attack feature significance condition and a second group of data that does not meet the preset DDoS attack feature significance condition; disrupting all valid time slices in the first group of data and the second group of data, randomly combining the valid time slices in the first group of data to obtain multiple first random time slice pairs, and randomly combining the valid time slices in the second group of data to obtain multiple second random time slice pairs; Among them, the use of the training data to perform model training to obtain an initial attack recognition model includes: constructing a preliminary model, and using the preliminary model to identify the status codes of the first random time slice pairs in the first group of data one by one, to obtain a preliminary recognition model, wherein the status code is obtained by the label corresponding to each valid time slice in the first random time slice pair; inputting the second group of data into the preliminary recognition model, calculating the accuracy of the preliminary recognition model, and determining whether the accuracy is greater than or equal to a preset threshold; if the accuracy is greater than or equal to the preset threshold, using the preliminary recognition model as the initial attack recognition model; if the accuracy is less than the preset threshold, repeating the recognition process of the first group of data using the second group of data until the accuracy is greater than or equal to the preset threshold, to obtain the initial attack recognition model.

2. According to the DDoS attack defense method based on recognition model in claim 1, it is characterized in that: The acquiring of training data from the target data source includes: Intercepting actual data that meets preset data conditions from the target server as the training data; And / or, launching multiple simulated DDoS attacks on the target server, and intercepting simulated data that meets the preset data conditions from the target server as the training data.

3. The DDoS attack defense method based on recognition model according to claim 1, characterized in that: The retraining of the initial attack identification model based on the debugging result until a preset iteration stop condition is met to obtain the actual attack identification model, so as to use the actual attack identification model to perform the DDoS attack identification, includes: When the debugging result is that the device is subjected to an unidentified DDoS attack, new training data is obtained, and model training is performed using the new training data to obtain a new initial attack recognition model; In the case where the debugging result is that the network is not subjected to the unidentified DDoS attack, it is determined whether the identified DDoS attack is correct; if the DDoS attack is identified correctly, the initial attack identification model is debugged multiple times within the preset time period until each debugging result is that the network is not subjected to the unidentified DDoS attack, and the actual attack identification model is obtained; otherwise, the parameters of the preliminary identification model are adjusted, and the preliminary identification model is retrained using a time slice that meets the preset similarity condition until the initial attack identification model is obtained, and the initial attack identification model is re-debugged.

4. A DDoS attack defense device based on recognition model, characterized in that: include: An acquisition module, used for acquiring training data from a target data source; A training module, used to perform model training using the training data to obtain an initial attack recognition model; A debugging module, used to connect the initial attack identification model to a corresponding server, so as to use the server to debug the initial attack identification model and obtain a debugging result; an identification module, configured to determine whether the debugging result satisfies a preset normal alarm condition within a preset time period, wherein if the debugging result satisfies the preset normal alarm condition, the initial attack identification model is used as an actual attack identification model, so as to use the actual attack identification model to perform DDoS attack identification; otherwise, the initial attack identification model is retrained based on the debugging result until a preset iteration stop condition is met, so as to obtain the actual attack identification model, so as to use the actual attack identification model to perform DDoS attack identification; A processing module, used for cutting the training data into a plurality of time slices of preset lengths, and cleaning the time slices to obtain effective time slices after cleaning; A label module, used for labeling each of the valid time slices based on the data in the valid time slices, to obtain the valid time slices that are suffering from DDoS attack labels and the valid time slices that are not suffering from DDoS attack; A grouping module, used for grouping the valid time slices to obtain a first group of data that meets a preset DDoS attack feature significance condition and a second group of data that does not meet the preset DDoS attack feature significance condition; a combining module, configured to shuffle all valid time slices in the first group of data and the second group of data, randomly combine the valid time slices in the first group of data to obtain a plurality of first random time slice pairs, and randomly combine the valid time slices in the second group of data to obtain a plurality of second random time slice pairs; Among them, the training module includes: a construction unit, which is used to construct a preliminary model, and use the preliminary model to identify the status code of the first random time slice pair in the first group of data one by one, so as to obtain a preliminary recognition model, wherein the status code is obtained by the label corresponding to each valid time slice in the first random time slice pair; a calculation unit, which is used to input the second group of data into the preliminary recognition model, calculate the accuracy of the preliminary recognition model, and determine whether the accuracy is greater than or equal to a preset threshold; a first determination unit, which is used to use the preliminary recognition model as the initial attack recognition model when the accuracy is greater than or equal to the preset threshold; a second determination unit, which is used to use the second group of data to repeat the recognition process of the first group of data when the accuracy is less than the preset threshold, until the accuracy is greater than or equal to the preset threshold, so as to obtain the initial attack recognition model.

5. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a DDoS attack defense method based on an identification model as described in any one of claims 1 to 3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement a DDoS attack defense method based on an identification model as described in any one of claims 1 to 3.

7. A computer program product, characterized in that It includes a computer program, which, when executed, is used to implement a DDoS attack defense method based on an identification model as described in any one of claims 1 to 3.

Images