DDoS attack detection method, apparatus, and system

Abstract

The application provides a DDoS attack detection method, device and system, the method comprising: capturing network card traffic data through Scapy, the network card traffic data being traffic sent to a target machine obtained from a switch through port mirroring technology; based on a pre-trained classifier, determining whether a DDoS attack will occur according to the network card traffic data, if yes, determining a malicious MAC address according to the network card traffic data based on a statistical method of a CRH algorithm, and controlling the switch to perform a filtering operation on the traffic sent to the target machine according to the malicious MAC address. The method not only has high processing efficiency, but also can accurately distinguish malicious traffic in mixed traffic, correctly detect the MAC address of a host initiating a DDoS attack, and has high detection precision.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a DDoS attack detection method, apparatus, and system. Background Technology

[0002] A Distributed Denial of Service (DDoS) attack is a type of cyberattack where attackers manipulate a botnet to send malicious traffic to a target server, preventing it from responding to legitimate users' service requests in a timely manner. DDoS attacks typically target the target server's network bandwidth or computing resources. If network bandwidth is overwhelmed by malicious traffic, legitimate users' requests cannot be sent to the target server, thus achieving a denial-of-service (DoS) effect; similarly, if computing resources are exhausted by malicious traffic, the target server cannot respond to legitimate users' requests, also achieving a denial-of-service effect.

[0003] A successful DDoS attack renders the target server inoperable, causing service disruptions and resulting in significant financial losses and reputational damage to the service provider. Furthermore, because DDoS attacks typically originate from different hosts within a botnet, existing detection methods struggle to trace the exact source of the attack. Attackers can flexibly adjust the traffic carriers and packet frequencies used by the botnet to circumvent defenses, posing a substantial threat to network security.

[0004] Traditional DDoS attack detection methods primarily rely on monitoring network traffic and analyzing traffic patterns. Abnormal traffic patterns (such as a sudden increase in traffic or specific types of traffic) may indicate that the target server is under a DDoS attack. Therefore, statistical methods typically set thresholds to monitor specific parameters of network traffic (such as bandwidth utilization, packet count, or other statistical characteristics). When these parameters exceed preset thresholds, an alert is issued, indicating a detected DDoS attack. Statistical methods are generally easy to implement and deploy, but due to the constantly changing network environment, fixed threshold settings cannot adapt to dynamic DDoS attacks.

[0005] To address the limitations of statistical methods, a combination of reinforcement learning and statistics has emerged. HBOS-RL is a common reinforcement learning-based method for detecting DDoS attacks. It uses a histogram-based outlier score (HBOS) algorithm to detect DDoS attacks and employs the Soft Actor-Critic (SAC) algorithm to construct a reinforcement learning model that controls the four parameters in the HBOS algorithm. , , , To adapt to dynamic DDoS attacks.

[0006] However, HBOS-RL suffers from several problems, including difficulties in processing high-dimensional data leading to high algorithm complexity and computational overhead, neglecting the correlation between features resulting in reduced algorithm accuracy, and poor algorithm stability. Summary of the Invention

[0007] To address the aforementioned problems in the prior art, the present invention provides a DDoS attack detection method, apparatus, and system, specifically comprising:

[0008] In a first aspect, the present invention provides a DDoS attack detection method, comprising:

[0009] The network interface card (NIC) traffic data is captured using Scapy. This NIC traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology.

[0010] Based on a pre-trained classifier, the system determines whether the target machine is subject to a DDoS attack based on network interface card (NIC) traffic data. If so, it uses the CRH algorithm to determine the malicious MAC address based on the NIC traffic data and controls the switch to perform filtering operations on the traffic destined for the target machine based on the malicious MAC address.

[0011] Secondly, the present invention also provides a DDoS attack detection device, comprising:

[0012] The traffic monitoring component is used to capture network interface card (NIC) traffic data via Scapy. The NIC traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology.

[0013] The traffic filtering component is used to determine whether the target machine is subject to a DDoS attack based on a pre-trained classifier and network interface card (NIC) traffic data. If so, it uses the CRH algorithm statistical method to determine the malicious MAC address based on the NIC traffic data and controls the switch to perform filtering operations on the traffic sent to the target machine based on the malicious MAC address.

[0014] Thirdly, the present invention also provides a DDoS attack detection system, comprising:

[0015] Target machines, switches, observation hosts, legitimate user equipment, and dummy networks;

[0016] The observation host is used to capture network interface card (NIC) traffic data via Scapy. Based on a pre-trained classifier, it determines whether the target machine is subject to a DDoS attack based on the NIC traffic data. If so, it uses the CRH algorithm statistical method to determine the malicious MAC address based on the NIC traffic data. Based on the malicious MAC address, it controls the switch to perform filtering operations on the traffic sent to the target machine. The NIC traffic data is the traffic sent to the target machine from legitimate user devices and dummy networks obtained from the switch through port mirroring technology.

[0017] Fourthly, the present invention also provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0018] Memory, used to store computer programs;

[0019] The processor, when executing a program stored in memory, implements any of the methods provided in the first aspect.

[0020] The beneficial effects of this invention are:

[0021] The DDoS attack detection method, apparatus, and system provided by this invention capture network interface card (NIC) traffic data using Scapy. This NIC traffic data consists of traffic destined for the target machine obtained from the switch via port mirroring technology. Based on a pre-trained classifier, the system determines whether the NIC is under a DDoS attack based on the NIC traffic data. If so, it uses a statistical method based on the CRH algorithm to determine the malicious MAC address based on the NIC traffic data. Then, based on the malicious MAC address, it controls the switch to perform filtering operations on the traffic destined for the target machine. This method not only has high processing efficiency but also accurately distinguishes malicious traffic in mixed traffic and correctly detects the MAC address of the host initiating the DDoS attack, exhibiting high detection accuracy.

[0022] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the architecture of a DDoS attack detection system provided by the present invention;

[0024] Figure 2 A flowchart illustrating a DDoS attack detection method provided by the present invention;

[0025] Figure 3 A schematic diagram of a set of experimental data provided by the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of a DDoS attack detection device provided by the present invention;

[0027] Figure 5 This is a schematic diagram of another set of experimental data provided by the present invention. Detailed Implementation

[0028] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0029] To address the problems existing in the prior art, this invention provides a DDoS attack detection system, such as... Figure 1 As shown, the DDoS attack detection system includes:

[0030] Target machine 11, switch 12, observation host 13, legitimate user equipment 14, and puppet network 15.

[0031] The observation host 13 is used to capture network interface card (NIC) traffic data via Scapy. Based on a pre-trained classifier, it determines whether the target machine 11 will be subject to a DDoS attack based on the NIC traffic data. If so, it determines the malicious MAC address based on the statistical method of the CRH algorithm and the NIC traffic data. Based on the malicious MAC address, it controls the switch 12 to perform filtering operations on the traffic sent to the target machine 11. The NIC traffic data is the traffic sent to the target machine 11 by the legitimate user device 14 and the dummy network 15, which is obtained from the switch 12 through port mirroring technology.

[0032] Specifically, such as Figure 1 As shown, switch 12 may include a Layer 2 switch 122 and a Layer 3 switch 121.

[0033] The Layer 3 switch 121 is equipped with port mirroring and ACL rule deployment. Layer 3 switch 121 connects to the observation host 13, the target machine 11, and the traffic ingress used by the monitoring system to receive external traffic. For example, the Layer 3 switch connects the target machine, the observation host, and the Layer 2 switch. Each interface on the Layer 3 switch is numbered; the port connected to the observation host is numbered G0 / 0 / 1, the port connected to the Layer 2 switch is numbered G0 / 0 / 2, and the port connected to the target machine is numbered G0 / 0 / 3.

[0034] Layer 2 switch 122 connects legitimate user equipment 14 and the attacker's dummy network 15, and forwards traffic from legitimate user equipment 14 and dummy network 15 to Layer 3 switch 121. Target machine 11 is the object of attack; exemplarily, it can be a honeypot system host running the Cyndi honeypot system. Legitimate user equipment 14 corresponds to the network usage behavior of normal users. The attacker's dummy network 15 can carry out dynamic DDoS attacks; exemplarily, it can include multiple hosts.

[0035] The DDoS attack detection system provided by this invention has the advantages of high detection accuracy, low time consumption, low resource consumption and strong stability against dynamic DDoS attacks. It can react quickly and take defense after detecting a DDoS attack without affecting the user experience of legitimate users.

[0036] Furthermore, the present invention also provides a DDoS attack detection method, which is applied to, for example... Figure 1 The monitoring host in the DDoS attack detection system, such as Figure 2 As shown, the method includes:

[0037] S201. Capture network card traffic data using Scapy.

[0038] Among them, the network interface card traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology.

[0039] Port mirroring enables network monitoring by forwarding data traffic from one or more source ports to a designated port on a switch. The designated port is called the "mirror port" or "destination port". Without significantly affecting the normal throughput of the source ports, network traffic can be monitored and analyzed through the mirror port.

[0040] To obtain traffic destined for the target machine from the switch using port mirroring technology, you first need to configure the switch ports according to the port information of the host being observed and the port information of the target machine to be monitored. After configuration, the traffic on the switch can be copied to the host being observed through the configured ports.

[0041] It should be noted that, in order to achieve the above functions, the selected switch should support port mirroring.

[0042] For example, assuming the observation host is located on port G0 / 0 / 1, and the target machine to be monitored is on the outgoing port of G0 / 0 / 3, the following command can be used to configure the port of the switch host:

[0043] # Configure G0 / 0 / 1 as a watch port

[0044] observe-port 1 interface gigabitethernet 0 / 0 / 1

[0045] # Enter port G0 / 0 / 3

[0046] interface gigabitethernet 0 / 0 / 3

[0047] # Configure outbound traffic from port G0 / 0 / 3 to G0 / 0 / 1

[0048] port-mirroring to observe-port 1 outbound.

[0049] Scapy is a Python library for creating, sending, capturing, and analyzing network packets. Specifically, Scapy allows you to write custom network tools, including those for capturing and analyzing network traffic.

[0050] In one possible implementation, network interface card (NIC) traffic data is captured using Scapy, including: using the sniff() function in Scapy to capture NIC traffic data on the host being observed within a preset fixed time window, and generating a .pcappcap file based on the captured data.

[0051] For example, Scapy's sniff() function can be used to capture network interface card (NIC) traffic data on the observed host within a fixed time window, such as 5 seconds, and package it into a .pcappcap file. Specifically, all traffic captured within a time window will be packaged into a single .pcappcap file, which will contain multiple packets.

[0052] S202. Based on the pre-trained classifier, determine whether the target machine will be subject to DDoS attack according to the network card traffic data. If so, determine the malicious MAC address based on the statistical method of CRH algorithm according to the network card traffic data, and control the switch to perform filtering operation on the traffic sent to the target machine according to the malicious MAC address.

[0053] Optionally, the classifier can be a simple classifier, such as a decision tree or random forest.

[0054] Specifically, by using a simple classifier, the system determines whether the target machine is susceptible to a DDoS attack based on the acquired traffic data. If a DDoS attack is suspected, a statistical method based on the CRH algorithm is used to analyze the malicious MAC address. Finally, a defense command is generated based on the analysis results to filter the traffic.

[0055] In one possible implementation, based on a pre-trained classifier and network interface card (NIC) traffic data, it is determined whether the target machine is subject to a DDoS attack, including the following steps A1 and A2:

[0056] A1. Use the rdpcap() function in Scapy to analyze the .pcappcap file corresponding to the network card traffic data to obtain the status data queue of the .pcappcap file.

[0057] The status data queue includes the following data characteristics: number of data packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval, maximum packet interval, and average packet interval.

[0058] A2. Based on a pre-trained classifier, determine whether the target machine will be subject to a DDoS attack according to the state data queue.

[0059] Optionally, training the classifier includes: collecting network data under various dynamic DDoS attacks for a preset duration, such as 5 seconds, and labeling the network data according to whether a DDoS attack exists in each time window, thereby constructing a training dataset; and then training the classifier using the constructed training dataset.

[0060] Specifically, network interface card (NIC) traffic data is collected within a preset time window, resulting in several .pcappcap files. Some of these files contain DDoS attack traffic, which can then be labeled and used as the training dataset. The process for collecting the training dataset is as follows: several .pcappcap files are collected within a fixed time window. Each .pcappcap file is then processed into a state data queue, forming the data portion of the training samples. Finally, the .pcappcap files are labeled based on whether they contain malicious traffic, forming the label portion of the training samples.

[0061] The training method provided by this invention not only has a simple and efficient way of obtaining training samples, but also has the advantages of high training efficiency and low training complexity in its model training process.

[0062] In one possible implementation, a statistical method based on the CRH algorithm determines the malicious MAC address based on network interface card traffic data, including the following steps B1-B2:

[0063] B1. Using the rdpcap() function in Scapy, the data queue corresponding to each data packet in the .pcappcap file is determined based on the method of padding missing values ​​with zeros.

[0064] The data queue includes Media Access Control (MAC) source address, Internet Protocol (IP) source address, IP destination address, IP packet length, maximum IP router hop count, IP header length, Transmission Control Protocol (TCP) destination port, TCP data offset length, TCP reserved fields, TCP window size, User Datagram Protocol (UDP) destination port, and UDP packet length.

[0065] Using the `rdpcap()` function in Scapy, and employing zero-padding for missing values, the data queue corresponding to each packet in the `.pcappcap` file is determined. Specifically, each packet in the `.pcappcap` file is described as a fixed-length data queue, and each data queue includes 12 attributes: MAC source address, IP source address, IP destination address, IP packet length, maximum IP hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved fields, TCP window size, UDP destination port, and UDP packet length. For any packet, if a certain attribute is missing, the corresponding attribute value is set to 0 in its generated data queue. This yields the dataset. The dataset contains several packets, each packet represented by a data queue with 12 attribute values. The input to the CRH algorithm is this dataset. .

[0066] B2. Determine the parameter queue based on the state data queue and the pre-trained agent.

[0067] In one possible implementation, the agent is trained by steps (a) and (b) as follows:

[0068] (a) Obtain multiple dynamic DDoS attack traffic data.

[0069] Dynamic DDoS attacks can be any form of attack, such as attacks from common DDoS attack tools like Hping3, LOIC, and Slowloris.

[0070] (b) Based on the policy gradient algorithm, the initial agent is trained according to dynamic DDoS attack traffic data to obtain reinforcement learning components.

[0071] The agent consists of three fully connected layers, each followed by a ReLU activation function to introduce a non-linear decision network.

[0072] The reward function of the agent is expressed as:

[0073] ,

[0074] in, Represents the reward function, These are hyperparameters used to control the proportion of legitimate traffic throughput and malicious traffic rejection rate prioritized by the agent. This represents the true negative rate, which is the accuracy rate at which legitimate traffic is identified. This represents the true positive rate, which is the accuracy rate at which malicious traffic is identified.

[0075] The calculation formula is expressed as:

[0076] ,

[0077] The calculation formula is expressed as:

[0078] ,

[0079] in, , , , These represent the true negative, true positive, false negative, and false positive values ​​in the confusion matrix, respectively.

[0080] Figure 3 This shows the changes in loss and reward of the policy network during the training process of the agent. Figure 3 As can be seen, the agent can be trained within 100 cycles, and the model converges quickly and has high training efficiency.

[0081] The training method provided by this invention not only has a simple and efficient way of obtaining training samples, but also has the advantages of high training efficiency and low training complexity in its model training process.

[0082] This invention uses a policy gradient algorithm to train a policy-based agent, which has high training efficiency. Furthermore, the key parameters in the CRH algorithm are determined based on the trained agent, making the key parameters in the CRH algorithm more adaptable and practical for dynamic DDoS attacks. Whether it is a capacity attack or a slow attack, the occurrence of DDoS attacks and the corresponding malicious MAC addresses can be accurately detected.

[0083] Furthermore, the agent's state space is obtained by analyzing the .pcappcap file using the rdpcap() function in Scapy to acquire target data, and a state data queue is generated based on the target data; the action space is a parameter queue used to determine the malicious MAC address.

[0084] B3. A statistical method based on the CRH algorithm is used to determine the malicious MAC address based on the data queue and parameter queue corresponding to each data packet in the .pcappcap file.

[0085] In one possible implementation, the parameter queue is represented as:

[0086] ,

[0087] in, Represents a parameter queue. Indicates the iteration round number. This represents the weight threshold parameter. This indicates a parameter for determining malice.

[0088] Correspondingly, the statistical method based on the CRH algorithm determines the malicious MAC address according to the data queue and parameter queue corresponding to each packet in the .pcappcap file, including the following steps C1-C5:

[0089] C1. Based on the number of packets in the .pcappcap file, assign weights to the packets in the .pcappcap file. Initialize to ,in, This indicates the number of packets in the .pcappcap file.

[0090] Specifically, each item in the weight queue corresponds to the weight of a data packet.

[0091] C2. Iteratively execute the weight update operation until the number of iterations in the parameter queue is reached, and obtain the target weight queue.

[0092] In other words, the data in the weight queue is modified through multiple rounds of iterative processing.

[0093] For example, if the number of packets in the .pcappcap file is 10, the initialized weight queue is... After multiple iterations, it was modified to... This is just an example and does not impose any specific limitations.

[0094] Specifically, in the i-th iteration, the weight update operation includes the following steps (1)-(4):

[0095] (1) Based on the initial weight queue of the data packets, determine the sum of the weights, expressed as:

[0096] ,

[0097] in, This represents the sum of the weights. This represents the sum of all elements in the weighted queue.

[0098] (2) Based on the sum of the data queues and weights corresponding to each data packet in the .pcappcap file, and the initial weight queues of the data packets, determine the weighted average vector, expressed as:

[0099] ,

[0100] in, This represents the weighted average vector. Represents a data queue. This indicates that the elements of the weight queue are multiplied by the elements of the data queue.

[0101] (3) Based on the data queue and weighted average vector corresponding to each data packet in the .pcappcap file, determine the sum of squared distances from each data queue to the weighted average vector, expressed as:

[0102] ,

[0103] in, This represents the sum of squared distances from the data queue to the weighted average vector. This indicates summation along the row direction.

[0104] (4) Update the weight queue of the data packet based on the sum of squared distances from each data queue to the weighted average vector, as follows:

[0105] ,

[0106] in, Expressing the request The logarithm of .

[0107] For example If it is 2, then .

[0108] Based on this method, after multiple rounds of iterative updates, malicious traffic data packets will be given higher weights, thus enabling accurate detection of malicious traffic.

[0109] C3. Based on the parameters in the target weight queue and parameter queue The weight threshold is determined as follows:

[0110] ,

[0111] in, Indicates the weight threshold. Indicates taking The minimum value in, Pick The maximum value in.

[0112] C4. Determine the result queue based on the target weight queue and the weight threshold.

[0113] Specifically, data packets with a weight greater than the weight threshold in the target weight queue are identified as malicious traffic data packets, while data packets with a weight less than or equal to the weight threshold are identified as legitimate traffic data packets.

[0114] Optionally, elements in the target weight queue with values ​​greater than the weight threshold are set to 1, and elements with values ​​less than or equal to the weight threshold are set to 0, resulting in a result queue containing only elements of the two classes: 1 and 0. For example, [1,0,0,0,1,...,1,1,1,0,0], where 1 represents malicious and 0 represents legitimate.

[0115] C5. Based on the data queue, result queue, and parameters in the parameter queue. The malicious MAC address was identified.

[0116] Specifically, based on the data queue and the result queue, the proportion of malicious traffic packets corresponding to each MAC address in its corresponding total traffic packets is determined, and the proportion is set to be greater than the parameters in the parameter queue. The MAC address is identified as a malicious MAC address. For example, MAC address elements are extracted from the data queue and analyzed in combination with the result queue. Each MAC address in the data queue corresponds to several packets, and each packet is judged as either malicious or legitimate. When the proportion of packets judged as malicious from a MAC address exceeds a certain parameter... At that time, the MAC address was identified as a malicious MAC address.

[0117] Furthermore, based on the malicious MAC address, the switch is controlled to perform filtering operations on the traffic destined for the target machine, including: constructing ACL rules based on the malicious MAC address; and sending the ACL rules to the switch through the netmiko module so that the switch executes the ACL rules to filter out the traffic data corresponding to the malicious MAC address from the traffic destined for the target machine.

[0118] The netmiko module is a Python library for simplifying the automation and management of network devices, enabling remote connection to switches.

[0119] For example, assuming the MAC address to be blocked is 0123-4567-8910 and the traffic ingress is G0 / 0 / 2, the port ACL rule can be built using the following command:

[0120] # Create ACL rules

[0121] ACL name deny-mac 4000

[0122] # Configure MAC blocking

[0123] rule 1 deny source-mac 0123-4567-8910 ffff-ffff-ffff

[0124] # Enter port G0 / 0 / 2

[0125] interface gigabitethernet 0 / 0 / 2

[0126] # Configure traffic filtering

[0127] traffic-filter inbound acl name deny-mac.

[0128] The DDoS attack detection method provided by this invention captures network interface card (NIC) traffic data using Scapy. This NIC traffic data is traffic sent to the target machine from the switch obtained through port mirroring technology. Based on a pre-trained classifier, the method determines whether the NIC is under DDoS attack based on the NIC traffic data. If so, it uses a statistical method based on the CRH algorithm to determine the malicious MAC address based on the NIC traffic data. Then, based on the malicious MAC address, it controls the switch to perform filtering operations on the traffic sent to the target machine. This method can distinguish malicious traffic in mixed traffic and correctly detect the MAC address of the host initiating the DDoS attack.

[0129] This invention also provides a DDoS attack detection device, such as... Figure 4 As shown, the device includes:

[0130] Traffic monitoring component 41 is used to capture network interface card (NIC) traffic data via Scapy. The NIC traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology.

[0131] Traffic filtering component 42 is used to determine whether a DDoS attack is likely based on a pre-trained classifier and network interface card (NIC) traffic data. If so, it uses the CRH algorithm statistical method to determine the malicious MAC address based on the NIC traffic data and controls the switch to perform filtering operations on the traffic destined for the target machine based on the malicious MAC address.

[0132] Optionally, the traffic monitoring component 41 is specifically used to capture network card traffic data on the host through the sniff() function in Scapy at a preset fixed time window, and generate a .pcappcap file based on the captured data.

[0133] Optionally, the traffic filtering component 42 is specifically used to analyze the .pcappcap file using the rdpcap() function in Scapy to obtain the status data queue of the .pcappcap file. The status data queue includes the following data characteristics: number of packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval, maximum packet interval, and average packet interval. Based on a pre-trained classifier, the status data queue is used to determine whether the file is subject to a DDoS attack.

[0134] Optional, such as Figure 4 As shown, it also includes reinforcement learning component 43.

[0135] The traffic filtering component 42, specifically using the rdpcap() function in Scapy, determines the data queue corresponding to each packet in the .pcappcap file based on zero-padding for missing values. The data queue includes MAC source address, IP source address, IP destination address, IP packet length, maximum IP router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved fields, TCP window size, UDP destination port, and UDP packet length; and sends the state data queue to the reinforcement learning component.

[0136] The reinforcement learning component 43 is used to determine the parameter queue based on the state data queue and the pre-trained agent; and send the parameter queue to the traffic filtering component 42.

[0137] Traffic filtering component 42 is specifically used for statistical methods based on the CRH algorithm to determine malicious MAC addresses according to the data queue and parameter queue corresponding to each data packet in the .pcappcap file.

[0138] Optionally, the parameter queue is represented as:

[0139] ,

[0140] in, Represents a parameter queue. Indicates the iteration round number. This represents the weight threshold parameter. This indicates a parameter for determining malice.

[0141] Correspondingly, the traffic filtering component 42 is specifically used to weight the data packets in the .pcappcap file according to the number of data packets in the .pcappcap file. Initialize to ,in, This indicates the number of packets in the .pcappcap file;

[0142] The weight update operation is performed iteratively until the number of iterations in the parameter queue is reached, and the target weight is obtained.

[0143] Based on the parameters in the target weight queue and parameter queue The weight threshold is determined as follows:

[0144] ,

[0145] in, Indicates the weight threshold. Indicates taking The minimum value in, Pick The maximum value in;

[0146] The result queue is determined based on the initial data packet weight queue weight threshold;

[0147] Based on the parameters in the result queue and parameter queue The malicious MAC address was identified.

[0148] In the i-th iteration, the weight update operation includes:

[0149] Based on the initial weighted queue of data packets, the sum of weights is determined, expressed as:

[0150] ,

[0151] in, This represents the sum of the weights. This represents the sum of all elements in the weighted queue.

[0152] Based on the sum of the data queues and weights corresponding to each data packet in the .pcappcap file, and the initial weight queues of the data packets, the weighted average vector is determined, expressed as:

[0153] ,

[0154] in, This represents the weighted average vector. Represents a data queue. This indicates that a matrix multiplication is performed between elements in the weight queue and elements in the data queue.

[0155] Based on the data queue and weighted average vector corresponding to each data packet in the .pcappcap file, determine the sum of squared distances from each data queue to the weighted average vector, expressed as:

[0156] ,

[0157] in, This indicates summation along the row direction.

[0158] The weighted queues of data packets are updated based on the sum of squared distances from each data queue to the weighted average vector, as follows:

[0159] ,

[0160] in, Expressing the request The logarithm of .

[0161] Optionally, reinforcement learning component 43 is also used to acquire multiple dynamic DDoS attack traffic data; the dynamic DDoS attack traffic data is used to train the initial agent to obtain a trained agent. The agent consists of three fully connected layers, each followed by a ReLU activation function to introduce a non-linear decision network. The reward function of the agent is expressed as:

[0162] ,

[0163] in, These are hyperparameters used to control the proportion of legitimate traffic throughput and malicious traffic rejection rate prioritized by the agent. This represents the true negative rate, which is the accuracy rate at which legitimate traffic is identified. This represents the true positive rate, which is the accuracy rate in identifying malicious traffic.

[0164] in, The calculation formula is expressed as:

[0165] ,

[0166] The calculation formula is expressed as:

[0167] ,

[0168] in, , , , These represent the true negative, true positive, false negative, and false positive values ​​in the confusion matrix, respectively.

[0169] Optionally, the traffic filtering component 42 is specifically used to construct ACL rules based on malicious MAC addresses; and send the ACL rules to the switch through the netmiko module so that the switch can execute the ACL rules to filter out traffic data corresponding to malicious MAC addresses from the traffic sent to the target machine.

[0170] To further demonstrate the beneficial effects of this invention, a set of experimental data is also provided, showing the specific target machine flow rate status as follows: Figure 5 As shown, from Figure 5 It is easy to see that there is a period of time when the traffic increases, and the traffic drops back to normal after the defense takes effect. This shows that the present invention can quickly lock down the malicious MAC address and filter the traffic when facing dynamic DDoS attacks.

[0171] The present invention also provides an electronic device structure, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus.

[0172] Memory, used to store computer programs;

[0173] When a processor executes a program stored in memory, it implements the steps provided in the above method embodiments.

[0174] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0175] The method provided in this invention can be applied to electronic devices. Specifically, the electronic device can be a desktop computer, a portable computer, a smart mobile terminal, a server, etc. No limitation is made herein; any electronic device that can implement this invention falls within the protection scope of this invention.

[0176] For the embodiments of the device / electronic device / system, since they are basically similar to the method embodiments, the description is relatively simple. For specific details and beneficial effects, please refer to the description of the method embodiments.

[0177] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0178] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A DDoS attack detection method, characterized in that, include: The sniff() function in Scapy is used to capture network card traffic data on the host under observation within a preset fixed time window, and a pcap file is generated based on the captured data. The network card traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology. The pcap file is analyzed using the rdpcap() function in Scapy to obtain the pcap file's state data queue. This state data queue includes the following data characteristics: number of packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval, maximum packet interval, and average packet interval. Based on a pre-trained classifier, the target machine is determined to be vulnerable to a DDoS attack based on the state data queue. If so, a malicious MAC address is determined based on the network interface card (NIC) traffic data using a CRH algorithm-based statistical method. Based on the malicious MAC address, the switch is then controlled to perform filtering operations on traffic destined for the target machine. The CRH algorithm-based statistical method, based on the network interface card (NIC) traffic data... Traffic data is used to determine malicious MAC addresses, including: using the rdpcap() function in Scapy, based on zero-padding for missing values, to determine the data queue corresponding to each packet in the pcap file. The data queue includes MAC source address, IP source address, IP destination address, IP packet length, maximum IP router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved fields, TCP window size, UDP destination port, and UDP packet length; determining the parameter queue based on the state data queue and a pre-trained agent; and determining the malicious MAC address based on a statistical method using the CRH algorithm, according to the data queue corresponding to each packet in the pcap file and the parameter queue. The statistical method based on the CRH algorithm determines the malicious MAC address according to the data queue and parameter queue corresponding to each data packet in the pcap file, including: Based on the number of packets in the pcap file, the packets in the pcap file are weighted and queued. Initialize to ,in, This indicates the number of packets in the pcap file; The weight update operation is performed iteratively until the number of iterations in the parameter queue is reached, thus obtaining the target weight queue. Based on the parameters in the target weight queue and the parameter queue The weight threshold is determined as follows: ， in, Indicates the weight threshold. Indicates taking The minimum value in, Pick The maximum value in; The result queue is determined based on the target weight queue and the weight threshold; Based on the data queue, the result queue, and the parameters in the parameter queue The malicious MAC address was identified.

2. The method according to claim 1, characterized in that, The parameter queue is represented as follows: ， in, Represents a parameter queue. Indicates the iteration round number. This represents the weight threshold parameter. Indicates parameters for malicious intent determination; In the i-th iteration, the weight update operation includes: Based on the initial weight queue of the data packets, the sum of weights is determined, expressed as: ， in, This represents the sum of the weights. This represents the sum of all elements in the weighted queue. Based on the sum of the data queues and weights corresponding to each data packet in the pcap file, and the initial weight queues of the data packets, a weighted average vector is determined, expressed as: ， in, This represents the weighted average vector. Represents a data queue. This indicates that the elements of the weight queue are multiplied by the elements of the data queue. Based on the data queue corresponding to each data packet in the pcap file and the weighted average vector, the sum of squared distances from each data queue to the weighted average vector is determined, expressed as: ， in, This represents the sum of squared distances from the data queue to the weighted average vector. This indicates summation along the row direction. The weight queue of the data packet is updated based on the sum of squared distances from each of the data queues to the weighted average vector, as shown below: ， in, Expressing the request The logarithm of .

3. The method according to claim 1 or 2, characterized in that, The trained agents include: Obtain multiple dynamic DDoS attack traffic data; Based on the dynamic DDoS attack traffic data, an initial agent is trained to obtain a trained agent. The agent consists of three fully connected layers, each followed by a ReLU activation function to introduce a non-linear decision network. The reward function of the agent is expressed as: ， in, Represents the reward function, These are hyperparameters used to control the proportion of legitimate traffic throughput and malicious traffic rejection rate prioritized by the agent. This represents the true negative rate, which is the accuracy rate at which legitimate traffic is identified. This represents the true positive rate, which is the accuracy rate in identifying malicious traffic. in, The calculation formula is expressed as: ， The calculation formula is expressed as: ， in, , , , These represent the true negative, true positive, false negative, and false positive values ​​in the confusion matrix, respectively.

4. The method according to claim 1 or 2, characterized in that, The step of controlling the switch to perform filtering operations on traffic destined for the target machine based on the malicious MAC address includes: Based on the malicious MAC address, construct ACL rules; The ACL rules are sent to the switch via the netmiko module, so that the switch executes the ACL rules to filter out traffic data corresponding to the malicious MAC address from the traffic destined for the target machine.

5. A DDoS attack detection device, characterized in that, include: The traffic monitoring component is used to capture network card traffic data on the host through the sniff() function in Scapy at a preset fixed time window, and generate a pcap file based on the captured data. The network card traffic data is the traffic sent to the target machine obtained from the switch through port mirroring technology. A traffic filtering component is used to analyze the pcap file using the rdpcap() function in Scapy to obtain the pcap file's state data queue. The state data queue includes the following data characteristics: number of packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval, maximum packet interval, and average packet interval. Based on a pre-trained classifier, the component determines whether the target machine is subject to a DDoS attack based on the state data queue. If so, a malicious MAC address is determined based on the network interface card (NIC) traffic data using a statistical method based on the CRH algorithm. Based on the malicious MAC address, the component controls the switch to perform filtering operations on traffic destined for the target machine. The statistical method based on the CRH algorithm... Based on the network interface card (NIC) traffic data, the malicious MAC address is determined, including: using the rdpcap() function in Scapy, and padding missing values ​​with zeros, to determine the data queue corresponding to each packet in the pcap file. The data queue includes the MAC source address, IP source address, IP destination address, IP packet length, maximum IP router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved fields, TCP window size, UDP destination port, and UDP packet length; based on the state data queue and a pre-trained agent, a parameter queue is determined; and based on a statistical method using the CRH algorithm, the malicious MAC address is determined according to the data queue corresponding to each packet in the pcap file and the parameter queue. The statistical method based on the CRH algorithm determines the malicious MAC address according to the data queue and parameter queue corresponding to each data packet in the pcap file, including: Based on the number of packets in the pcap file, the packets in the pcap file are weighted and queued. Initialize to ,in, This indicates the number of packets in the pcap file; The weight update operation is performed iteratively until the number of iterations in the parameter queue is reached, thus obtaining the target weight queue. Based on the parameters in the target weight queue and the parameter queue The weight threshold is determined as follows: ， in, Indicates the weight threshold. Indicates taking The minimum value in, Pick The maximum value in; The result queue is determined based on the target weight queue and the weight threshold; Based on the data queue, the result queue, and the parameters in the parameter queue The malicious MAC address was identified.

6. A DDoS attack detection system, characterized in that, For implementing the DDoS attack detection method according to any one of claims 1-4, the DDoS attack detection system comprises: Target machines, switches, observation hosts, legitimate user equipment, and dummy networks; The observation host is used to capture network interface card (NIC) traffic data on the observation host using the sniff() function in Scapy within a preset fixed time window, and generate a pcap file based on the captured data. The pcap file is then analyzed using the rdpcap() function in Scapy to obtain the pcap file's state data queue. The state data queue includes the following data characteristics: number of packets, total number of bytes, maximum number of bytes, minimum number of bytes, average number of bytes, minimum packet interval, maximum packet interval, and average packet interval. Based on a pre-trained classifier and the state data queue, it is determined whether the target machine is subject to a DDoS attack. If so, a malicious MAC address is determined based on the CRH algorithm and the NIC traffic data. Based on the malicious MAC address, the switch is controlled to perform filtering operations on traffic destined for the target machine. The NIC traffic data is obtained through port mirroring technology. The method obtains traffic from the switch sent from the legitimate user equipment and the dummy network to the target machine; wherein, the statistical method based on the CRH algorithm determines the malicious MAC address based on the network card traffic data, including: using the rdpcap() function in Scapy, based on zero-padding for missing values, to determine the data queue corresponding to each packet in the pcap file, the data queue including MAC source address, IP source address, IP destination address, IP packet length, maximum IP router hop count, IP header length, TCP destination port, TCP data offset length, TCP reserved fields, TCP window size, UDP destination port, and UDP packet length; determining the parameter queue based on the state data queue and the pre-trained agent; the statistical method based on the CRH algorithm determines the malicious MAC address based on the data queue corresponding to each packet in the pcap file and the parameter queue.

7. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-4.

Images