DDoS attack detection method, device and system

Abstract

The invention provides a DDoS (Distributed Denial of Service) attack detection method, device and system, and the method comprises the steps: capturing network card flow data through Skay, the network card flow data being flow which is obtained from a switch through a port mirror image technology and is sent to a target drone; based on a pre-trained classifier, according to the network card flow data, determining whether DDoS attacks will occur, if yes, based on a statistical method of a CRH algorithm, according to the network card flow data, determining a malicious MAC address, and according to the malicious MAC address, controlling a switch to execute a filtering operation on the flow sent to a target drone. The method is not only high in processing efficiency, but also capable of accurately distinguishing malicious traffic in the mixed traffic and correctly detecting the MAC address of the host initiating the DDoS attack, and has relatively high detection precision.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a DDoS attack detection method, device and system. Background Art

[0002] A distributed denial of service (DDoS) attack is a type of network attack in which the attacker manipulates a "botnet" network to send malicious traffic to the target server, making it unable to respond to legitimate users' service requests in a timely manner. The target of a DDoS attack is usually the network bandwidth or computing resources of the target server. If the network bandwidth is penetrated by malicious traffic, legitimate users' requests cannot be sent to the target server, thus achieving a denial of service (DoS) effect; if computing resources are exhausted by malicious traffic, the target server cannot respond to legitimate users' requests, also achieving a denial of service effect.

[0003] The result of a successful DDoS attack is that the target server cannot work properly, and eventually the service is suspended, causing huge economic losses and reputation damage to the service provider. And because DDoS attacks are usually launched from different hosts in the "zombie" network, it is difficult for existing detection solutions to trace the correct attack source. Attackers can flexibly adjust the traffic carrier and packet frequency used by the "zombie" network to bypass defense, thus posing a huge threat to network security.

[0004] Traditional DDoS attack detection methods mainly monitor network traffic and analyze traffic patterns to detect DDoS attacks. Abnormal traffic patterns (such as a sudden increase in traffic or a specific type of traffic) may indicate that the target server is under DDoS attack. Therefore, statistical methods will set thresholds to monitor specific parameters of network traffic (such as bandwidth utilization, number of packets, or other statistical characteristics). When these parameters exceed the preset thresholds, an alarm is issued, indicating that a DDoS attack has been detected. Statistical methods are generally easy to implement and deploy, but due to the continuous changes in the network environment, fixed threshold settings cannot adapt to dynamic DDoS attacks.

[0005] In order to solve the problems of statistical methods, a method combining reinforcement learning and statistics has emerged. HBOS-RL is a common DDoS attack detection method based on reinforcement learning. It uses the Histogram-based outlier score (HBOS) algorithm to detect DDoS attacks, and uses the Soft Actor-Critic (SAC) algorithm to build a reinforcement learning model to control the four parameters (Nbin, α, β, θ) in the HBOS algorithm to adapt to dynamic DDoS attacks.

[0006] However, HBOS-RL has problems such as difficulty in processing high-dimensional data, which leads to high algorithm complexity and computational overhead, ignoring the correlation between features, which leads to reduced algorithm accuracy, and poor algorithm stability. Summary of the invention

[0007] In order to solve the above problems existing in the prior art, the present invention provides a DDoS attack detection method, device and system, which specifically include:

[0008] In a first aspect, the present invention provides a DDoS attack detection method, comprising:

[0009] Capture network card traffic data through Scapy. The network card traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology.

[0010] Based on the pre-trained classifier, according to the network card traffic data, it is determined whether the target machine will be attacked by DDoS. If so, based on the statistical method of the CRH algorithm, according to the network card traffic data, the malicious MAC address is determined, and according to the malicious MAC address, the switch is controlled to perform filtering operations on the traffic sent to the target machine.

[0011] In a second aspect, the present invention further provides a DDoS attack detection device, comprising:

[0012] Traffic monitoring component, used to capture network card traffic data through Scapy. The network card traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology;

[0013] The traffic filtering component is used to determine whether the target machine will be attacked by DDoS based on the pre-trained classifier and the network card traffic data. If so, the malicious MAC address is determined based on the network card traffic data based on the statistical method of the CRH algorithm, and the switch is controlled to perform filtering operations on the traffic sent to the target machine based on the malicious MAC address.

[0014] In a third aspect, the present invention further provides a DDoS attack detection system, comprising:

[0015] Target machines, switches, observation hosts, legitimate user devices, and puppet networks;

[0016] The observation host is used to capture the network card traffic data through Scapy. Based on the pre-trained classifier, it determines whether the target machine will be attacked by DDoS according to the network card traffic data. If so, the malicious MAC address is determined based on the statistical method of the CRH algorithm according to the network card traffic data, and the switch is controlled to perform filtering operations on the traffic sent to the target machine according to the malicious MAC address. The network card traffic data is the traffic sent to the target machine by legitimate user devices and puppet networks obtained from the switch through port mirroring technology.

[0017] In a fourth aspect, the present invention further provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0018] Memory, used to store computer programs;

[0019] The processor is used to implement any method provided in the first aspect when executing a program stored in the memory.

[0020] Beneficial effects of the present invention:

[0021] The DDoS attack detection method, device and system provided by the present invention capture network card traffic data through Scapy, where the network card traffic data is traffic sent to a target machine obtained from a switch through a port mirroring technology; based on a pre-trained classifier, it is determined whether a DDoS attack will occur according to the network card traffic data; if so, a malicious MAC address is determined according to the network card traffic data based on a statistical method of a CRH algorithm, and the switch is controlled to perform a filtering operation on the traffic sent to the target machine according to the malicious MAC address, which not only has high processing efficiency, but also can accurately distinguish malicious traffic in mixed traffic, correctly detect the MAC address of the host that initiates the DDoS attack, and has high detection accuracy.

[0022] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of the architecture of a DDoS attack detection system provided by the present invention;

[0024] Figure 2 A schematic diagram of a DDoS attack detection method provided by the present invention;

[0025] Figure 3 A schematic diagram of a set of experimental data provided by the present invention;

[0026] Figure 4A structural diagram of a DDoS attack detection device provided by the present invention;

[0027] Figure 5 Another set of experimental data schematic diagram provided by the present invention. DETAILED DESCRIPTION

[0028] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0029] In order to solve the problems existing in the prior art, the present invention provides a DDoS attack detection system, such as Figure 1 As shown, the DDoS attack detection system includes:

[0030] Target machine 11, switch 12, observation host 13, legitimate user equipment 14 and puppet network 15.

[0031] The observation host 13 is used to capture the network card traffic data through Scapy; based on the pre-trained classifier, according to the network card traffic data, it is determined whether the target machine 11 will be attacked by DDoS. If so, based on the statistical method of the CRH algorithm, the malicious MAC address is determined according to the network card traffic data, and according to the malicious MAC address, the switch 12 is controlled to perform filtering operations on the traffic sent to the target machine 11. The network card traffic data is the traffic sent to the target machine 11 by the legitimate user device 14 and the puppet network 15 obtained from the switch 12 through the port mirroring technology.

[0032] Specifically, Figure 1 As shown, the switch 12 may include a layer 2 switch 122 and a layer 3 switch 121 .

[0033] Among them, port mirroring and ACL rule deployment are set on the three-layer switch 121, and the three-layer switch 121 connects the observation host 13, the target machine 11, and monitors the traffic entrance for receiving external traffic. For example, the three-layer switch connects the target machine, the observation host and the two-layer switch. Each interface on the three-layer switch is numbered, and the port number of the observation host is G0 / 0 / 1, the two-layer switch is G0 / 0 / 2, and the target machine is G0 / 0 / 3.

[0034] The layer 2 switch 122 connects the legitimate user device 14 and the puppet network 15 on the attacker side, and is used to forward the traffic of the legitimate user device 14 and the puppet network 15 to the layer 3 switch 121. The target machine 11 is the object to be attacked, and an exemplary one may be a honeypot system host, on which the Saining honeypot system is installed. The legitimate user device 14 corresponds to the network usage behavior of a normal user. The puppet network 15 on the attacker side can implement dynamic DDoS attacks, and an exemplary one may specifically include multiple hosts.

[0035] The DDoS attack detection system provided by the present invention has the advantages of high detection accuracy, low time consumption, low resource consumption rate and strong stability for dynamic DDoS attacks. It can respond quickly and take defensive measures after detecting a DDoS attack without affecting the user experience of legitimate users.

[0036] Furthermore, the present invention also provides a DDoS attack detection method, which is applied to Figure 1 The observation host in the DDoS attack detection system is as follows: Figure 2 As shown, the method includes:

[0037] S201. Capture network card traffic data through Scapy.

[0038] Among them, the network card traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology.

[0039] Port mirroring monitors the network by forwarding the data traffic of one or more source ports to a designated port on the switch. The designated port is called the "mirror port" or "destination port". The network traffic can be monitored and analyzed through the mirror port without seriously affecting the normal throughput of the source port.

[0040] To obtain the traffic sent to the target machine from the switch through port mirroring technology, you first need to configure the switch port according to the port information of the observation host and the port information of the target machine to be monitored. After configuration, you can copy the traffic on the switch to the observation host through the configured port.

[0041] It should be noted that to achieve the above functions, the selected switch should support the port mirroring function.

[0042] For example, assuming that the port of the observed host is G0 / 0 / 1 and the port of the target machine to be monitored is G0 / 0 / 3 in the outbound direction, you can configure the port of the switch host using the following command:

[0043] #Configure G0 / 0 / 1 as an observing port

[0044] observe-port 1 interface gigabitethernet 0 / 0 / 1

[0045] #Enter port G0 / 0 / 3

[0046] interface gigabitethernet 0 / 0 / 3

[0047] #Configure the outbound traffic of port G0 / 0 / 3 to G0 / 0 / 1

[0048] port-mirroring to observe-port 1outbound.

[0049] Scapy is a Python library for creating, sending, capturing, and analyzing network packets. Specifically, with Scapy, you can write custom network tools, including capturing and analyzing network traffic.

[0050] In a possible implementation, capturing network card traffic data through Scapy includes: using the sniff() function in Scapy to capture the network card traffic data on the observation host in a preset fixed time window, and generating a .pcap file based on the captured data.

[0051] Exemplarily, the sniff() function of Scapy is used to capture the network card traffic data on the host with a fixed time window, such as 5 seconds, and package it into a .pcap file. Specifically, all traffic captured in a time window will be packaged into a .pcap file, and a .pcap file will contain multiple data packets.

[0052] S202. Based on the pre-trained classifier, determine whether the target machine will be attacked by DDoS according to the network card traffic data. If so, determine the malicious MAC address based on the statistical method of the CRH algorithm according to the network card traffic data, and control the switch to perform filtering operations on the traffic sent to the target machine according to the malicious MAC address.

[0053] Optionally, the classifier is a simple classifier, such as a decision tree, a random forest, etc.

[0054] Specifically, by using a simple classifier, it is determined whether the target machine will be attacked by DDoS based on the acquired traffic data. If it is determined to be attacked by DDoS, a statistical method based on the CRH algorithm is used to analyze the malicious MAC address, and finally a defense command is generated according to the analysis results to perform traffic filtering.

[0055] In a possible implementation, based on a pre-trained classifier and according to network card traffic data, determining whether a target machine is subject to a DDoS attack includes the following steps A1 and A2:

[0056] A1. Analyze the .pcap file corresponding to the network card traffic data through the rdpcap() function in Scapy to obtain the status data queue of the .pcap file.

[0057] The status data queue includes the following data features: number of data packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval time, maximum packet interval time, and average packet interval time.

[0058] A2. Based on the pre-trained classifier, determine whether the target machine will be attacked by DDoS according to the state data queue.

[0059] Optionally, training the classifier includes: collecting network data under various dynamic DDoS attacks in a time window with a preset time length, such as 5 seconds, and marking the network data according to whether a DDoS attack exists in each time window, thereby constructing a training data set; and then training the classifier with the constructed training data set.

[0060] Specifically, network card traffic data is collected based on a preset time window size to obtain several .pcap files, some of which contain DDoS attack traffic, so they can be marked as training data sets. The specific process of collecting training data sets is: collect several .pcap files according to a fixed time window size, and then each .pcap file will be processed into a state data queue to form the data part of the training sample. Then, the .pcap file is marked according to whether it contains malicious traffic to form the label part of the training sample.

[0061] The training method provided by the present invention not only has a simple training sample acquisition method and high acquisition efficiency, but also its model training process has the advantages of high training efficiency and low training complexity.

[0062] In a possible implementation, a statistical method based on the CRH algorithm is used to determine a malicious MAC address according to network card traffic data, including the following steps B1-B2:

[0063] B1. Use the rdpcap() function in Scapy to determine the data queue corresponding to each data packet in the .pcap file based on the method of filling missing values ​​with zeros.

[0064] Among them, the data queue includes Media Access Control (MAC) source address, Internet Protocol (IP) source address, IP destination address, IP packet length, IP maximum router hop count, IP header length, Transmission Control Protocol (TCP) destination port, TCP data offset length, TCP reserved field, TCP window size, User Datagram Protocol (UDP) destination port, and UDP packet length.

[0065] Through the rdpcap() function in Scapy, based on the method of filling missing values ​​with zeros, the data queue corresponding to each data packet in the .pcap file is determined. Specifically, each data packet in the .pcap file is described as a data queue of fixed length. Each data queue includes 12 attributes, namely MAC source address, IP source address, IP destination address, IP packet length, IP maximum router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved field, TCP window size, UDP destination port, and UDP packet length. For any data packet, if an attribute does not exist in the data packet, the value of the corresponding attribute is set to 0 in the data queue generated by it. Thus, a data set X is obtained, which contains several packets, and each data packet is represented by a data queue including 12 attribute values. The input of the CRH algorithm is data set X.

[0066] B2. Determine the parameter queue based on the state data queue and the pre-trained agent.

[0067] In a possible implementation, training an intelligent agent includes the following steps (a) and (b):

[0068] (a) Obtain multiple dynamic DDoS attack traffic data.

[0069] Dynamic DDoS attacks can be any form of attack, such as attacks from common DDoS attack tools such as Hping3, LOIC, and Slowloris.

[0070] (b) Based on the policy gradient algorithm, the initial agent is trained according to the dynamic DDoS attack traffic data to obtain the reinforcement learning component.

[0071] The agent is a decision network that includes three fully connected layers and uses the ReLU activation function after each fully connected layer to introduce nonlinearity.

[0072] The agent’s reward function is expressed as:

[0073] reward=ε·TNR+(1-ε)·TPR,

[0074] Among them, reward represents the reward function, ε is a hyperparameter used to control the ratio of the agent's emphasis on the legitimate traffic pass rate and the malicious traffic discard rate, TNR represents the true negative rate, that is, the accuracy of judging legitimate traffic, and TPR represents the true positive rate, that is, the accuracy of judging malicious traffic.

[0075] The calculation formula of TNR is expressed as:

[0076]

[0077] The calculation formula of TPR is expressed as:

[0078]

[0079] Among them, TN, TP, FN, and FP represent the corresponding true negative, true positive, false negative, and false positive in the confusion matrix, respectively.

[0080] Figure 3 The loss and reward changes of the policy network during the training process of the agent are shown. Figure 3 It can be seen that the agent can be trained within 100 cycles, and the model converges quickly and has high training efficiency.

[0081] The training method provided by the present invention not only has a simple training sample acquisition method and high acquisition efficiency, but also its model training process has the advantages of high training efficiency and low training complexity.

[0082] The method of obtaining an intelligent agent based on a policy network through training based on a policy gradient algorithm has high training efficiency. Furthermore, the key parameters in the CRH algorithm are determined based on the intelligent agent obtained through training, so that the key parameters in the CRH algorithm have stronger adaptability and practicality for dynamic DDoS attacks. Whether it is a volumetric attack or a slow attack, the occurrence of a DDoS attack and the corresponding malicious MAC address can be accurately detected.

[0083] Furthermore, the state space of the agent is to analyze the .pcap file through the rdpcap() function in Scapy to obtain the target data and generate a state data queue based on the target data; the action space is a parameter queue used to determine the malicious MAC address.

[0084] B3. A statistical method based on the CRH algorithm determines the malicious MAC address according to the data queue and parameter queue corresponding to each data packet in the .pcap file.

[0085] In one possible implementation, the parameter queue is represented as:

[0086] p={iteration_count,α,β},

[0087] Among them, p represents the parameter queue, iteration_count represents the number of iterations, α represents the weight threshold parameter, and β represents the malicious judgment parameter.

[0088] Accordingly, the statistical method based on the CRH algorithm determines the malicious MAC address according to the data queue and parameter queue corresponding to each data packet in the .pcap file, including the following steps C1-C5:

[0089] C1. According to the number of data packets in the .pcap file, initialize the weight queue weight_list of the data packets in the .pcap file to [1 / x, 1 / x, ..., 1 / x], where x represents the number of data packets in the .pcap file.

[0090] Specifically, each item in the weight queue corresponds to the weight of a data packet.

[0091] C2. Iterate the weight update operation until the number of iterations in the parameter queue is reached and the target weight queue is obtained.

[0092] In other words, the data in the weight queue is modified through multiple rounds of iterative processing.

[0093] For example, if the number of packets in the .pcap file is 10, the weighted queue is initialized as After multiple rounds of iterations, it was modified to This is just an example and is not a limitation.

[0094] Specifically, in the i-th iteration, the weight update operation includes the following steps (1)-(4):

[0095] (1) According to the weight queue of the initial data packet, the sum of the weights is determined, which is expressed as:

[0096] s = np.sum(weight_list),

[0097] Among them, s represents the sum of weights, and np.sum(weight_list) represents the sum of all elements in the weight list.

[0098] (2) According to the sum of the data queue and weight corresponding to each data packet in the .pcap file and the weight queue of the initial data packet, the weighted average vector is determined, which is expressed as:

[0099] v_hat=np.dot(weight_list,X) / s,

[0100] Among them, v_hat represents the weighted average vector, X represents the data queue, and np.dot(weight_list,X) represents the matrix multiplication of the elements of the weight queue and the elements in the data queue.

[0101] (3) According to the data queue and weighted average vector corresponding to each data packet in the .pcap file, the sum of the squares of the distances from each data queue to the weighted average vector is determined, which is expressed as:

[0102] d = np.sum((X-v_hat) 2 ,axis=1),

[0103] Where d represents the sum of the squares of the distances from the data queue to the weighted average vector, and axis=1 represents the summation along the row direction.

[0104] (4) Update the weight queue of the data packet according to the sum of the squares of the distances from each data queue to the weighted average vector, expressed as:

[0105] weight_list=-np.log(d / np.sum(d)),

[0106] Among them, np.log(d / np.sum(d)) means to find the logarithm of (d / np.sum(d)).

[0107] For example, if (d / np.sum(d)) is 2, then np.log(d / np.sum(d))=ln2.

[0108] Based on this method, after multiple rounds of iterative updates, malicious traffic data packets will be given higher weights, so that malicious traffic can be accurately detected.

[0109] C3. Determine the weight threshold according to the target weight queue and the parameter α in the parameter queue, expressed as:

[0110] weight_divide=(1-α)·min(weight_list)+α·max(weight_list),

[0111] Among them, weight_divide represents the weight threshold, min(weight_list) means taking the minimum value in weight_list, and max(weight_list) means taking the maximum value in weight_list.

[0112] C4. Determine the result queue according to the target weight queue and the weight threshold.

[0113] Specifically, data packets with weights greater than a weight threshold in the target weight queue are determined as malicious traffic data packets, and data packets with weights less than or equal to the weight threshold are determined as legitimate traffic data packets.

[0114] Optionally, the elements in the target weight queue whose values ​​are greater than the weight threshold are set to 1, and the elements whose values ​​are less than or equal to the weight threshold are set to 0, to obtain a result queue, which contains only two types of elements: 1 and 0. For example, [1,0,0,0,1,...,1,1,1,0,0], where 1 is malicious and 0 is legitimate.

[0115] C5. Determine the malicious MAC address based on the data queue, the result queue, and the parameter β in the parameter queue.

[0116] Specifically, according to the data queue and the result queue, the proportion of malicious traffic packets corresponding to each MAC address in the corresponding total traffic data packets is determined, and the MAC address whose proportion is greater than the parameter β in the parameter queue is determined as a malicious MAC address. Exemplarily, the MAC address element in the data queue is extracted and combined with the result queue for analysis. In the data queue, each MAC address will correspond to several packets, and each packet will be judged to be malicious or legal. When the proportion of packets judged to be malicious in a MAC address is higher than the parameter β, the MAC address is judged to be a malicious MAC address.

[0117] Furthermore, based on the malicious MAC address, the switch is controlled to perform filtering operations on the traffic sent to the target machine, including: constructing ACL rules based on the malicious MAC address; sending the ACL rules to the switch through the netmiko module, so that the switch executes the ACL rules to filter out the traffic data corresponding to the malicious MAC address from the traffic sent to the target machine.

[0118] The netmiko module is a Python library for simplifying the automation and management of network devices, capable of remotely connecting to switches.

[0119] For example, assuming that the MAC address to be blocked is 0123-4567-8910 and the traffic inlet is G0 / 0 / 2, the port ACL rule can be constructed using the following command:

[0120] #Create ACL rules

[0121] acl name deny-mac 4000

[0122] #Configure MAC blocking

[0123] rule 1deny source-mac 0123-4567-8910ffff-ffff-ffff

[0124] #Enter port G0 / 0 / 2

[0125] interface gigabitethernet 0 / 0 / 2

[0126] #Configure traffic filtering

[0127] traffic-filter inbound acl name deny-mac.

[0128] The DDoS attack detection method provided by the present invention captures network card traffic data through Scapy, where the network card traffic data is traffic sent to a target machine obtained from a switch through a port mirroring technology; based on a pre-trained classifier, it is determined whether a DDoS attack will occur according to the network card traffic data; if so, a malicious MAC address is determined according to the network card traffic data based on a statistical method of a CRH algorithm, and according to the malicious MAC address, the switch is controlled to perform a filtering operation on the traffic sent to the target machine, so that malicious traffic in mixed traffic can be distinguished, and the MAC address of the host that initiates the DDoS attack can be correctly detected.

[0129] The present invention also provides a DDoS attack detection device, such as Figure 4 As shown, the device comprises:

[0130] The traffic monitoring component 41 is used to capture network card traffic data through Scapy. The network card traffic data is the traffic sent to the target machine obtained from the switch through the port mirroring technology.

[0131] The traffic filtering component 42 is used to determine whether a DDoS attack will occur based on the network card traffic data based on a pre-trained classifier. If so, the malicious MAC address is determined based on the network card traffic data based on the statistical method of the CRH algorithm, and the switch is controlled to perform filtering operations on the traffic sent to the target machine based on the malicious MAC address.

[0132] Optionally, the traffic monitoring component 41 is specifically used to capture the network card traffic data on the observation host in a preset fixed time window through the sniff() function in Scapy, and generate a .pcap file based on the captured data.

[0133] Optionally, the traffic filtering component 42 is specifically used to analyze the .pcap file through the rdpcap() function in Scapy to obtain the status data queue of the .pcap file, the status data queue including the following data features: number of data packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval time, maximum packet interval time, average packet interval time; based on a pre-trained classifier, determine whether it will be attacked by DDoS according to the status data queue.

[0134] Optional, such as Figure 4 As shown, a reinforcement learning component 43 is also included.

[0135] The traffic filtering component 42, specifically through the rdpcap() function in Scapy, determines the data queue corresponding to each data packet in the .pcap file based on the method of filling missing values ​​with zeros, the data queue includes MAC source address, IP source address, IP destination address, IP packet length, IP maximum router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved field, TCP window size, UDP destination port, UDP packet length; sends the state data queue to the reinforcement learning component.

[0136] The reinforcement learning component 43 is used to determine the parameter queue according to the state data queue and the pre-trained intelligent agent; and send the parameter queue to the traffic filtering component 42.

[0137] The traffic filtering component 42 is specifically used to determine the malicious MAC address according to the data queue and parameter queue corresponding to each data packet in the .pcap file based on the statistical method of the CRH algorithm.

[0138] Optionally, the parameter queue is represented as:

[0139] p={iteration_count,α,β},

[0140] Among them, p represents the parameter queue, iteration_count represents the number of iterations, α represents the weight threshold parameter, and β represents the malicious judgment parameter.

[0141] Correspondingly, the traffic filtering component 42 is specifically used to initialize the weight queue weight_list of the data packets in the .pcap file to [1 / x, 1 / x, ..., 1 / x] according to the number of data packets in the .pcap file, where x represents the number of data packets in the .pcap file;

[0142] Iterate the weight update operation until the number of iterations in the parameter queue is reached and the target weight is obtained;

[0143] According to the parameter α in the target weight queue and the parameter queue, the weight threshold is determined, which is expressed as:

[0144] weight_divide=(1-α)·min(weight_list)+α·max(weight_list),

[0145] Among them, weight_divide represents the weight threshold, min(weight_list) represents the minimum value in weight_list, and max(weight_list) represents the maximum value in weight_list;

[0146] Determine the result queue according to the weight queue weight threshold of the initial data packet;

[0147] Determine the malicious MAC address based on the parameter β in the result queue and the parameter queue;

[0148] Among them, in the i-th iteration, the weight update operation includes:

[0149] According to the weight queue of the initial data packet, the sum of the weights is determined, which is expressed as:

[0150] s = np.sum(weight_list),

[0151] Among them, s represents the sum of weights, np.sum(weight_list) represents the sum of all elements in the weight list,

[0152] According to the sum of the data queue and weight corresponding to each data packet in the .pcap file and the weight queue of the initial data packet, the weighted average vector is determined, which is expressed as:

[0153] v_hat=np.dot(weight_list,X) / s,

[0154] Among them, v_hat represents the weighted average vector, X represents the data queue, and np.dot(weight_list,X) represents the matrix multiplication of the elements of the weight queue and the elements in the data queue.

[0155] According to the data queue and weighted average vector corresponding to each data packet in the .pcap file, the sum of the squares of the distances from each data queue to the weighted average vector is determined, expressed as:

[0156] d = np.sum((X-v_hat) 2 ,axis=1),

[0157] Wherein, axis=1 means summing along the row direction.

[0158] According to the sum of the squares of the distances from each data queue to the weighted average vector, the weight queue of the data packet is updated, which is expressed as:

[0159] weight_list=-np.log(d / np.sum(d)),

[0160] Among them, np.log(d / np.sum(d)) means to find the logarithm of (d / np.sum(d)).

[0161] Optionally, the reinforcement learning component 43 is further used to obtain multiple dynamic DDoS attack traffic data; the dynamic DDoS attack traffic data is used to train the initial intelligent agent to obtain a trained intelligent agent, the intelligent agent is a decision network including 3 fully connected layers and each fully connected layer uses a ReLU activation function to introduce a nonlinearity, and the reward function of the intelligent agent is expressed as:

[0162] reward=ε·TNR+(1-ε)·TPR,

[0163] Among them, ε is a hyperparameter used to control the ratio of the agent's emphasis on the legitimate traffic passing rate and the malicious traffic discarding rate. TNR represents the true negative rate, that is, the accuracy of judging legitimate traffic. TPR represents the true positive rate, that is, the accuracy of judging malicious traffic.

[0164] Among them, the calculation formula of TNR is expressed as:

[0165]

[0166] The calculation formula of TPR is expressed as:

[0167]

[0168] Among them, TN, TP, FN, and FP represent the corresponding true negative, true positive, false negative, and false positive in the confusion matrix, respectively.

[0169] Optionally, the traffic filtering component 42 is specifically used to construct ACL rules according to malicious MAC addresses; send the ACL rules to the switch through the netmiko module, so that the switch executes the ACL rules to filter out traffic data corresponding to the malicious MAC addresses from the traffic sent to the target machine.

[0170] In order to further prove the beneficial effects of the present invention, the present invention also provides a set of experimental data, the specific state of the target machine traffic is as follows Figure 5 As shown, from Figure 5 It is not difficult to see that the traffic increases for a period of time, and then decreases to a normal level after the defense takes effect. This shows that the present invention can quickly lock malicious MAC addresses and perform traffic filtering when facing a dynamic DDoS attack.

[0171] The present invention also provides a structure of an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus.

[0172] Memory, used to store computer programs;

[0173] The processor is used to implement the steps provided in the above method embodiment when executing the program stored in the memory.

[0174] The communication interface is used for communication between the above electronic device and other devices.

[0175] The method provided in the embodiment of the present invention can be applied to electronic devices. Specifically, the electronic device can be: a desktop computer, a portable computer, an intelligent mobile terminal, a server, etc. This is not limited here, and any electronic device that can implement the present invention belongs to the protection scope of the present invention.

[0176] As for the device / electronic device / system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the specific contents and beneficial effects and other related matters can be referred to the partial description of the method embodiments.

[0177] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0178] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A DDoS attack detection method, characterized in that: include: Capture network card traffic data through Scapy, where the network card traffic data is traffic sent to the target machine obtained from the switch through port mirroring technology; Based on the pre-trained classifier, according to the network card traffic data, determine whether the target machine will be attacked by DDoS. If so, based on the statistical method of the CRH algorithm, determine the malicious MAC address according to the network card traffic data, and according to the malicious MAC address, control the switch to perform filtering operations on the traffic sent to the target machine.

2. The method according to claim 1, characterized in that The capture of network card traffic data through Scapy includes: The sniff() function in Scapy is used to capture the network card traffic data on the host in a preset fixed time window, and a .pcap file is generated based on the captured data.

3. The method according to claim 2, characterized in that The method of determining whether the target machine will be attacked by DDoS based on the pre-trained classifier and the network card traffic data includes: Analyze the .pcap file by the rdpcap() function in the Scapy to obtain a state data queue of the .pcap file, wherein the state data queue includes the following data features: number of data packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval time, maximum packet interval time, and average packet interval time; Based on the pre-trained classifier, it is determined whether the target machine will be attacked by DDoS according to the state data queue.

4. The method according to claim 3, characterized in that The statistical method based on the CRH algorithm determines the malicious MAC address according to the network card traffic data, including: Through the rdpcap() function in the Scapy, based on the missing value zero-filling method, the data queue corresponding to each data packet in the .pcap file is determined, and the data queue includes MAC source address, IP source address, IP destination address, IP packet length, IP maximum router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved field, TCP window size, UDP destination port, and UDP packet length; Determine a parameter queue according to the state data queue and the pre-trained agent; A statistical method based on the CRH algorithm is used to determine a malicious MAC address according to the data queue and the parameter queue corresponding to each data packet in the .pcap file.

5. The method according to claim 4, characterized in that The parameter queue is represented as: p={iteration_count,α,β}, Where p represents the parameter queue, iteration_count represents the number of iterations, α represents the weight threshold parameter, and β represents the malicious judgment parameter; The statistical method based on the CRH algorithm determines the malicious MAC address according to the data queue and the parameter queue corresponding to each data packet in the .pcap file, including: According to the number of data packets in the .pcap file, initialize the weight queue weight_list of the data packets in the .pcap file to [1 / x, 1 / x, ..., 1 / x], where x represents the number of data packets in the .pcap file; Iteratively perform the weight update operation until the number of iterations in the parameter queue is reached, and a target weight queue is obtained; According to the target weight queue and the parameter α in the parameter queue, a weight threshold is determined, which is expressed as: weight_divide=(1-α)·min(weight_list)+α·max(weight_list), Among them, weight_divide represents the weight threshold, min(weight_list) represents the minimum value in weight_list, and max(weight_list) represents the maximum value in weight_list; Determining a result queue according to the target weight queue and the weight threshold; Determine a malicious MAC address according to the data queue and the result queue, and the parameter β in the parameter queue; Among them, in the i-th round of iteration, the weight update operation includes: According to the weight queue of the initial data packet, the sum of the weights is determined, which is expressed as: s = np.sum(weight_list), Among them, s represents the sum of weights, np.sum(weight_list) represents the sum of all elements in the weight list, According to the data queue corresponding to each data packet in the .pcap file and the sum of the weights, and the weight queue of the initial data packet, a weighted average vector is determined, which is expressed as: v_hat=np.dot(weight_list,X) / s, Among them, v_hat represents the weighted average vector, X represents the data queue, and np.dot(weight_list,X) represents the matrix multiplication of the elements of the weight queue and the elements in the data queue. According to the data queue corresponding to each data packet in the .pcap file and the weighted average vector, the sum of the squares of the distances from each data queue to the weighted average vector is determined, which is expressed as: d=np.sum((X-v_hat) 2 ,axis=1), Where d represents the sum of the squares of the distances from the data queue to the weighted average vector, and axis=1 represents the sum along the row direction. According to the sum of the squares of the distances from each of the data queues to the weighted average vector, the weight queue of the data packet is updated, which is expressed as: weight_list=-np.log(d / np.sum(d)), Among them, np.log(d / np.sum(d)) means to find the logarithm of (d / np.sum(d)).

6. The method according to claim 4 or 5, characterized in that: The trained agent includes: Obtain multiple dynamic DDoS attack traffic data; According to the dynamic DDoS attack traffic data, the initial intelligent agent is trained to obtain a trained intelligent agent, wherein the intelligent agent includes three fully connected layers and each fully connected layer uses a ReLU activation function to introduce a nonlinear decision network. The reward function of the intelligent agent is expressed as: reward=ε·TNR+(1-ε)·TPR, Among them, reward represents the reward function, ε is a hyperparameter used to control the ratio of the agent's emphasis on the legitimate traffic passing rate and the malicious traffic discarding rate, TNR represents the true negative rate, that is, the accuracy of judging legitimate traffic, and TPR represents the true positive rate, that is, the accuracy of judging malicious traffic; Among them, the calculation formula of TNR is expressed as: The calculation formula of TPR is expressed as: Among them, TN, TP, FN, and FP represent the corresponding true negative, true positive, false negative, and false positive in the confusion matrix, respectively.

7. The method according to any one of claims 1 to 5, characterized in that: The step of controlling the switch to perform filtering operations on traffic sent to the target machine according to the malicious MAC address includes: Constructing an ACL rule according to the malicious MAC address; The ACL rule is sent to the switch through the netmiko module, so that the switch executes the ACL rule to filter out the traffic data corresponding to the malicious MAC address from the traffic sent to the target machine.

8. A DDoS attack detection device, characterized in that: include: A traffic monitoring component is used to capture network card traffic data through Scapy, where the network card traffic data is traffic sent to the target machine obtained from the switch through port mirroring technology; The traffic filtering component is used to determine whether the target machine will be attacked by DDoS based on the network card traffic data based on a pre-trained classifier. If so, the malicious MAC address is determined based on the network card traffic data based on the statistical method of the CRH algorithm, and the switch is controlled to perform filtering operations on the traffic sent to the target machine based on the malicious MAC address.

9. A DDoS attack detection system, characterized in that: include: Target machines, switches, observation hosts, legitimate user devices, and puppet networks; The observation host is used to capture network card traffic data through Scapy, and based on a pre-trained classifier, determine whether the target machine will be attacked by DDoS according to the network card traffic data. If so, determine the malicious MAC address based on the statistical method of the CRH algorithm according to the network card traffic data, and control the switch to perform filtering operations on the traffic sent to the target machine according to the malicious MAC address. The network card traffic data is the traffic sent to the target machine by the legitimate user device and the puppet network obtained from the switch through port mirroring technology.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-7 when executing a program stored in a memory.

Images