A DDoS attack identification method and system based on multimodal fusion analysis

Abstract

The present invention belongs to the technical field of network security, and discloses a DDoS attack identification method and system based on multimodal fusion analysis. The method comprises the following steps: based on a cloud data center, constructing an Hfish honeypot chain network, a multimodal fusion model, a DDoS attack identification model, and a defense strategy generation model; based on the Hfish honeypot chain network, collecting real-time multimodal data, and using a multimodal fusion model, performing multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features; using a DDoS attack identification model, performing DDoS attack identification on the real-time multimodal fusion features to obtain real-time identification results; using a defense strategy generation model, performing defense strategy generation on the real-time identification results to obtain a real-time DDoS attack defense strategy. The present invention solves the problems of insufficient identification accuracy and insufficient real-time performance of defense strategies in the prior art.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a DDoS attack identification method and system based on multimodal fusion analysis. Background Art

[0002] With the increasing popularity of the internet, more and more individuals and businesses rely on network services, creating a wide range of targets for distributed denial of service (DDoS) attacks. A DDoS attack is a network attack tactic designed to overload a targeted server or network resource, rendering it unable to provide services to legitimate users. Attackers infect large numbers of computers, creating botnets, and then leverage these compromised computers to launch large-scale, coordinated attacks. As DDoS attack techniques evolve, their sophistication grows, and the frequency and scale of attacks continue to increase. Therefore, identifying and defending against DDoS attacks has become a crucial issue in network security.

[0003] Existing DDoS attack identification technologies have the following flaws:

[0004] 1) Insufficient identification accuracy: Existing technologies often rely on a single data source or feature to identify DDoS attacks, which can lead to high false positive and false negative rates and may not effectively distinguish between normal and malicious traffic, especially when faced with complex and changing attack methods.

[0005] 2) Insufficient real-time performance of defense strategies: Existing defense systems take a long time to respond after detecting an attack and are unable to block the attack in a timely manner, resulting in impaired service availability. Furthermore, updating defense strategies often relies on manual intervention and lacks automated real-time adjustment capabilities. Summary of the Invention

[0006] In order to solve the problems of insufficient recognition accuracy and insufficient real-time performance of defense strategies in the existing technology, the present invention aims to provide a DDoS attack identification method and system based on multimodal fusion analysis.

[0007] The technical solution adopted in the present invention is:

[0008] A DDoS attack identification method based on multimodal fusion analysis includes the following steps:

[0009] Based on the cloud data center, we built the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model, and defense strategy generation model;

[0010] Based on the Hfish honeypot chain network, real-time multimodal data is collected and multimodal fusion models are used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features;

[0011] Use the DDoS attack recognition model to identify DDoS attacks using real-time multimodal fusion features and obtain real-time recognition results;

[0012] The defense strategy generation model is used to generate defense strategies for real-time identification results to obtain real-time DDoS attack defense strategies.

[0013] Furthermore, based on the cloud data center, we build the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model, and defense strategy generation model, including the following steps:

[0014] Based on the cloud data center, build several Hfish honeypots, set up the Hfish management module, and build the Hfish honeypot chain network based on the Hfish management module and several Hfish honeypots;

[0015] Collect a number of historical multimodal data, and use a feature fusion algorithm based on the historical multimodal data to build a multimodal fusion model and generate a number of historical multimodal fusion features;

[0016] Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results.

[0017] Collect historical DDoS defense information and historical DDoS defense decisions of the cloud data center based on different historical identification results;

[0018] Based on some historical DDoS defense information and some historical DDoS defense decisions, a reinforcement learning algorithm is used to build a defense strategy generation model and generate some historical defense strategy generation experience.

[0019] Furthermore, based on the cloud data center, several Hfish honeypots are constructed, an Hfish management module is set up, and an Hfish honeypot chain network is constructed based on the Hfish management module and the several Hfish honeypots, including the following steps:

[0020] Based on the cloud data center, basic information of several applications is collected and corresponding Hfish honeypot elements are generated based on the basic information;

[0021] According to the Hfish honeypot elements, build the corresponding Hfish honeypot at the application and set the traffic probe in the Hfish honeypot;

[0022] Set up the Hfish management module and connect all Hfish honeypots to the Hfish management module to obtain the Hfish honeypot chain network.

[0023] Furthermore, the multimodal fusion model is constructed based on the CNN-LSTM-MLP algorithm;

[0024] The DDoS attack identification model is built based on the RF algorithm;

[0025] The defense strategy generation model is built based on the DQN algorithm.

[0026] Furthermore, based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results, including the following steps:

[0027] Construct the second input layer and the second output layer according to the data structure of historical multimodal fusion features and historical recognition results;

[0028] Use the RF algorithm to build an attack identification module, and combine the second input layer and the second output layer to build the initial DDoS attack identification model;

[0029] Using the initial DDoS attack recognition model, several feature key scores of historical multimodal fusion features are generated, and based on these feature key scores, several corresponding historical key features are extracted.

[0030] Based on several historical key features and using several historical multimodal fusion features, the initial DDoS attack recognition model is optimized and trained to obtain the final DDoS attack recognition model and generate several historical recognition results.

[0031] Furthermore, based on some historical DDoS defense information and some historical DDoS defense decisions, a reinforcement learning algorithm is used to construct a defense strategy generation model and generate some historical defense strategy generation experiences, including the following steps:

[0032] The defense strategy generation problem is used as a simulation environment for the DQN algorithm, and the intelligent agent and experience replay pool of the defense strategy generation model are set up;

[0033] Based on several historical DDoS defense information of the same historical recognition result, the state space of the DQN algorithm is defined, and based on several corresponding historical DDoS defense decisions, the action space of the DQN algorithm is defined;

[0034] Based on the state space and action space, a deep Q-network is constructed to generate a defense strategy model. Furthermore, a reward function is constructed based on the impact of historical DDoS defense decisions on historical DDoS defense information.

[0035] An initial defense strategy generation model is constructed based on the reward function, intelligent agent, deep Q network, and experience replay pool;

[0036] Traverse all historical DDoS defense information and historical DDoS defense decisions of all historical identification results, perform optimization training, and obtain the final defense strategy generation model;

[0037] Several historical defense strategy generation experiences generated by each optimization training are stored in the experience replay pool of the final defense strategy generation model.

[0038] Furthermore, based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features, including the following steps:

[0039] Use the Hfish honeypot in the Hfish honeypot chain network to collect real-time multimodal data and send it to the Hfish management module;

[0040] Use the Hfish management module in the Hfish honeypot chain network to send real-time multimodal data to the multimodal fusion model;

[0041] Use multimodal fusion models to extract real-time unstructured features and real-time structured features of real-time multimodal data;

[0042] The real-time unstructured features and real-time structured features are multimodally fused to obtain real-time multimodal fusion features.

[0043] Furthermore, the DDoS attack identification model is used to identify DDoS attacks using the real-time multimodal fusion features to obtain real-time identification results, including the following steps:

[0044] Input real-time multimodal fusion features into the DDoS attack identification model;

[0045] According to the key scores of several features of the DDoS attack identification model, several real-time key features of the real-time multimodal fusion feature are extracted;

[0046] Based on several real-time key features, DDoS attacks are identified and real-time identification results are obtained.

[0047] Furthermore, a defense strategy generation model is used to generate a defense strategy based on the real-time identification results to obtain a real-time DDoS attack defense strategy, which includes the following steps:

[0048] If the real-time identification result indicates a DDoS attack, the system extracts several matching historical defense strategies from the experience replay pool to generate experience based on the real-time identification result. Otherwise, the DDoS attack identification ends.

[0049] Analyze the experience of generating several matching historical defense strategies to obtain several real-time DDoS defense decisions and extract real-time DDoS defense information;

[0050] Based on the real-time DDoS defense information, the state space of the defense strategy generation model is updated to obtain an updated state space;

[0051] Based on several real-time DDoS defense decisions, the action space of the defense strategy generation model is updated to obtain an updated action space;

[0052] Based on the updated state space, use the reward function to obtain the real-time reward value of possible actions in the updated action space;

[0053] Based on the real-time reward value, use the agent to update the Q value of all possible actions in the updated action space of the deep Q network to obtain the updated Q value of the possible action;

[0054] Repeat the above Q-value update steps until the number of iterations reaches the iteration threshold, and use the greedy strategy to take the possible action with the highest updated Q-value as the execution action;

[0055] According to the execution action, a real-time DDoS attack defense strategy is obtained, and the generated real-time defense strategy generation experience is stored in the experience replay pool of the defense strategy generation model.

[0056] A DDoS attack identification system based on multimodal fusion analysis is used to implement a DDoS attack identification method. The system is deployed in a cloud data center and includes a model building unit, a multimodal fusion unit, a DDoS attack identification unit, and a DDoS attack defense unit connected in sequence.

[0057] The beneficial effects of the present invention are:

[0058] The present invention discloses a DDoS attack identification method and system based on multimodal fusion analysis. The method performs feature fusion on multimodal data through a multimodal fusion model, and uses the DDoS attack identification model to perform automated, intelligent, and efficient DDoS attack identification. The method improves the accuracy and robustness of DDoS attack identification, reduces the false alarm rate and the missed alarm rate, and can accurately distinguish normal traffic from malicious traffic when facing complex and changeable attack methods, thereby improving the reliability of DDoS attack identification. The method also constructs an attack trapping Hfish honeypot network and uses active defense technology to actively expose some vulnerabilities and set some bait to lure attackers to attack, so that the attack behavior can be captured and analyzed, thereby improving the effectiveness of security defense measures and improving the security protection level and security. The method also generates and adjusts the DDoS defense strategy in real time through a defense strategy generation model, significantly improving the real-time performance, response speed, and adaptability of the defense system, enabling timely blocking of attacks and avoiding damage to service availability. The defense strategy generation model can automatically adjust according to changes in the network environment and attack mode, thereby improving the flexibility and effectiveness of the defense strategy and realizing real-time adjustment and updating of the defense strategy.

[0059] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a flowchart of the DDoS attack identification method based on multimodal fusion analysis in the present invention.

[0061] Figure 2 This is a structural block diagram of the DDoS attack identification system based on multimodal fusion analysis in the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0063] Example 1:

[0064] like Figure 1 As shown, this embodiment provides a DDoS attack identification method based on multimodal fusion analysis, including the following steps:

[0065] S1: Based on the cloud data center, build the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model, and defense strategy generation model, including the following steps:

[0066] S1-1: Based on the cloud data center, build several Hfish honeypots, set up the Hfish management module, and build an Hfish honeypot chain network based on the Hfish management module and several Hfish honeypots. The steps include:

[0067] S1-1-1: Based on the cloud data center, collect basic information of several applications and generate corresponding Hfish honeypot elements based on the basic information;

[0068] S1-1-2: Based on the Hfish honeypot elements, build the corresponding Hfish honeypot at the application and set up a traffic probe in the Hfish honeypot;

[0069] S1-1-3: Set up the Hfish management module and connect all Hfish honeypots to the Hfish management module to obtain the Hfish honeypot chain network;

[0070] S1-2: Collect some historical multimodal data, and use the feature fusion algorithm based on the historical multimodal data to build a multimodal fusion model and generate some historical multimodal fusion features, including the following steps:

[0071] S1-2-1: Collect a number of historical multimodal data, and preprocess and label the historical multimodal data to obtain a number of preprocessed historical multimodal data with real labels;

[0072] Historical multimodal data includes historical access traffic data, historical access behavior data, and multimodal historical transmission data;

[0073] Access traffic data typically includes statistical information such as the source IP address of the request, the number of requests, the size of the data packet, the frequency of access, and the duration of access. Access behavior data typically includes user behavior data (such as clicks, browsing, and searches, as well as timestamps associated with these behaviors), page content (text or images), or other user interaction data. Transmission data refers to the data content actually transmitted on the network, typically including text, images, video, audio, and other data. The above multimodal data can be divided into structured data and unstructured data.

[0074] S1-2-2: Divide the pre-processed historical multimodal data into a model training set and a model test set, and use the feature fusion algorithm to build an initial multimodal fusion model;

[0075] The multimodal fusion model is constructed based on the CNN-LSTM-MLP algorithm and includes a first input layer, an unstructured feature extraction module constructed based on the Convolutional Neural Networks (CNN) algorithm, a structured feature extraction module constructed based on the Long Short-Term Memory (LSTM) algorithm, a feature fusion module constructed based on the Multilayer Perceptron (MLP) algorithm, and a first output layer. The first input layer is connected to the unstructured feature extraction module and the structured feature extraction module, respectively. The unstructured feature extraction module and the structured feature extraction module are both connected to the feature fusion module, and the feature fusion module is connected to the first output layer.

[0076] CNN networks excel in processing unstructured data such as images, videos, audio, and text. For image data, they can capture spatial hierarchical structures such as edges, textures, and shapes. For text data, one-dimensional CNNs or text convolutional neural networks can be used to extract local features. LSTM networks are suitable for processing and predicting temporal dependencies in sequence data, and can extract features related to structured data time series through deep features. This meets the requirements of traffic data (such as network traffic and traffic flow), which usually changes over time and has obvious time series characteristics. MLP networks are used to fuse structured and unstructured features and output multimodal fusion features. By integrating information from different modalities, the model's understanding ability, accuracy, and robustness are improved.

[0077] S1-2-3: Input the model training set into the initial multimodal fusion model for optimization training to obtain an optimized multimodal fusion model;

[0078] S1-2-4: Input the model test set into the optimized multimodal fusion model to perform model testing and obtain the model accuracy;

[0079] S1-2-5: If the model accuracy is greater than the preset accuracy threshold, the final multimodal fusion model is output and several historical multimodal fusion features are generated. Otherwise, optimization training continues;

[0080] S1-3: Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results. This includes the following steps:

[0081] S1-3-1: Construct the second input layer and the second output layer based on the data structure of historical multimodal fusion features and historical recognition results;

[0082] S1-3-2: Use the RF algorithm to build an attack identification module, and combine the second input layer and the second output layer to build the initial DDoS attack identification model;

[0083] The DDoS attack identification model is built based on the Random Forest (RF) algorithm and includes a second input layer, an attack identification module, and a second output layer connected in sequence.

[0084] Multimodal fusion features are high-dimensional features. The RF structure provides a feature importance score, which can help screen out the most important features for the prediction task, reducing model complexity and the risk of overfitting.

[0085] S1-3-3: Use the initial DDoS attack recognition model to generate several feature key scores of historical multimodal fusion features, and extract several corresponding historical key features based on the several feature key scores, including the following steps:

[0086] S1-3-3-1: Use the RF structure of the initial DDoS attack recognition model to extract the feature contribution of M candidate features of the historical multimodal fusion feature;

[0087] The formula is:

[0088]

[0089] Where, For the Feature contribution of candidate features; For the The candidate features are in the random forest The feature contribution of each tree; is the CART tree indicator; is an alternative characteristic indicator; is the total number of CARTs;

[0090]

[0091] Where, CART tree node of random forest m ,node and nodes The Gini index; CART tree node m Medium category the proportion; is the total number of categories; m 、 、 is the node indicator; is the category indicator;

[0092] S1-3-3-2: Normalize the feature contributions of the M candidate features to obtain corresponding normalized feature contributions;

[0093] The formula is:

[0094]

[0095] Where, is the contribution of the feature after normalization; J is the total number of candidate features;

[0096] S1-3-3-3: Generate feature selection standard values ​​for several candidate features based on the normalized feature contribution;

[0097] The formula is:

[0098]

[0099] Where, For the Feature selection criterion values ​​for candidate features; For the The contribution of the candidate features after normalization; is an alternative characteristic indicator;

[0100] S1-3-3-4: Based on the feature selection standard value as the feature key score, the candidate features are sorted in descending order, and the top M candidate features are selected as historical key features to obtain M historical key features;

[0101] S1-3-4: Based on several historical key features, several historical multimodal fusion features are used to optimize and train the initial DDoS attack recognition model to obtain the final DDoS attack recognition model and generate several historical recognition results. This includes the following steps:

[0102] S1-3-4-1: Based on several historical key features, reduce the dimension of each historical multimodal fusion feature to obtain the historical key feature sequence of each historical multimodal fusion feature;

[0103] S1-3-4-2: Based on the historical key feature sequence, the attack identification module of the initial DDoS attack identification model is optimized and trained to obtain an optimized attack identification module;

[0104] S1-3-4-3: Based on the optimized attack identification module, attack identification is performed according to the historical key feature sequence, and the corresponding historical identification results are generated;

[0105] Identification results include whether a DDoS attack exists and the type of DDoS attack (including volumetric attacks, protocol attacks, and application layer attacks).

[0106] S1-3-4-4: Traverse all historical multimodal fusion features and obtain the final DDoS attack recognition model based on the trained attack recognition module;

[0107] S1-4: Collect historical DDoS defense information and historical DDoS defense decisions of the cloud data center based on different historical identification results.

[0108] DDoS defense information includes network traffic statistics (such as traffic volume, traffic patterns, and abnormal traffic detection), server or network device load, known attack types and attack characteristics, the status of currently activated defense measures (such as traffic scrubbing rules and IP block lists), and network service availability and performance indicators.

[0109] DDoS defense decisions include enabling or adjusting traffic scrubbing rules, blocking or unblocking specific IP addresses or address ranges, adjusting network routing policies to mitigate the impact of attacks, increasing server resources to cope with traffic spikes, and starting or stopping specific defense scripts or programs.

[0110] S1-5: Based on historical DDoS defense information and historical DDoS defense decisions, a reinforcement learning algorithm is used to build a defense strategy generation model and generate historical defense strategy generation experience. This includes the following steps:

[0111] S1-5-1: Use the defense strategy generation problem as a simulation environment for the Deep Q Network (DQN) algorithm, setting up the intelligent agent and experience replay pool of the defense strategy generation model;

[0112] The defense strategy generation model is built based on the DQN algorithm, and the defense strategy generation model is equipped with an intelligent agent, a deep Q network, and an experience replay pool;

[0113] The agent is the entity that interacts with the model and the environment. It is used to select actions based on the current state and observe the state and reward after the action. The agent's strategy is determined by learning the Q function. The deep Q network is used to approximate the Q function. The Q function is used to calculate the expected return of taking a specific action in a given state. The experience replay pool is used to store historical experience of the interaction between the model and the environment.

[0114] S1-5-2: Define the state space of the DQN algorithm based on several historical DDoS defense information of the same historical recognition result, and define the action space of the DQN algorithm based on several corresponding historical DDoS defense decisions;

[0115] S1-5-3: Based on the state space and action space, a deep Q-network is constructed to generate a defense strategy model. Furthermore, a reward function is constructed based on the impact of historical DDoS defense decisions on historical DDoS defense information.

[0116] S1-5-4: The initial defense strategy generation model is constructed based on the reward function, intelligent agent, deep Q network, and experience replay pool;

[0117] S1-5-5: Traverse all historical DDoS defense information and historical DDoS defense decisions of all historical identification results, perform optimization training, and obtain the final defense strategy generation model;

[0118] S1-5-6: Store the historical defense strategy generation experiences generated by each optimization training into the experience replay pool of the final defense strategy generation model;

[0119] S2: Based on the Hfish honeypot chain network, real-time multimodal data is collected and multimodal fusion is performed on the real-time multimodal data using a multimodal fusion model to obtain real-time multimodal fusion features. The steps include:

[0120] S2-1: Use the Hfish honeypot in the Hfish honeypot chain network to collect real-time access traffic data and real-time access behavior data, combine it with multi-modal real-time transmission data, obtain real-time multi-modal data, and send it to the Hfish management module;

[0121] S2-2: Use the Hfish management module in the Hfish honeypot chain network to send real-time multimodal data to the first input layer of the multimodal fusion model;

[0122] S2-3: Use the unstructured feature extraction module of the multimodal fusion model to extract real-time unstructured features of real-time multimodal data, and use the structured feature extraction module of the multimodal fusion model to extract real-time structured features of real-time multimodal data;

[0123] S2-5: Use the feature fusion module to perform multimodal fusion on the real-time unstructured features and real-time structured features, and use the first output layer to output the corresponding real-time multimodal fusion features;

[0124] S3: Use the DDoS attack recognition model to identify DDoS attacks based on real-time multimodal fusion features and obtain real-time recognition results. This includes the following steps:

[0125] S3-1: Input the real-time multimodal fusion features into the second input layer of the DDoS attack identification model;

[0126] S3-2: Extract several real-time key features of the real-time multimodal fusion feature according to the key feature scores of the DDoS attack identification model;

[0127] S3-3: Based on several real-time key features, the attack identification module is used to identify DDoS attacks and obtain real-time identification results.

[0128] S4: Use the defense strategy generation model to generate a defense strategy based on the real-time identification results to obtain a real-time DDoS attack defense strategy, including the following steps:

[0129] S4-1: If the real-time identification result indicates a DDoS attack, the attack source tracing module of the firewall device is called. Based on the source IP in the real-time access traffic data, the transmission path and jump nodes of the attack traffic are analyzed. The corresponding attack source is added to the blacklist, prohibiting the next access. Based on the real-time identification result, several matching historical defense strategies are extracted from the experience replay pool to generate experience. Otherwise, the DDoS attack identification ends.

[0130] S4-2: Analyze the experience generated by several matching historical defense strategies to obtain several real-time DDoS defense decisions and extract real-time DDoS defense information;

[0131] S4-3: Update the state space of the defense strategy generation model based on real-time DDoS defense information to obtain an updated state space ,in, For the updated Status value, is the status indicator, is the total number of state space dimensions;

[0132] S4-4: Update the action space of the defense strategy generation model based on several real-time DDoS defense decisions to obtain an updated action space ,in, For the updated Action value, is the action indicator, is the total number of action space dimensions;

[0133] S4-5: Based on the updated state space, use the reward function to obtain the real-time reward value of the possible actions in the updated action space;

[0134] S4-6: Based on the real-time reward value, use the agent to update the Q value of all possible actions in the updated action space of the deep Q network to obtain the updated Q value of the possible action;

[0135] The formula is:

[0136]

[0137] Where, In the updated state Next update action The corresponding updated Q value; In state Next action The corresponding Q value of the possible action; is the learning rate; is the Q value of the highest possible action; To update the parameters; To use the updated action Will state Adjust to the updated status Real-time reward value;

[0138] S4-7: Repeat the above Q-value update steps until the number of iterations reaches the iteration threshold, and use the greedy strategy to take the possible action with the highest updated Q-value as the execution action;

[0139] S4-8: According to the execution action, a real-time DDoS attack defense strategy is obtained, and the generated real-time defense strategy generation experience is stored in the experience replay pool of the defense strategy generation model.

[0140] Example 2:

[0141] like Figure 2 As shown, this embodiment provides a DDoS attack identification system based on multimodal fusion analysis, which is used to implement a DDoS attack identification method. The system is deployed in a cloud data center, and the system includes a model building unit, a multimodal fusion unit, a DDoS attack identification unit, and a DDoS attack defense unit connected in sequence.

[0142] Model building unit, used to build Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model and defense strategy generation model based on cloud data center;

[0143] The multimodal fusion unit is used to collect real-time multimodal data based on the Hfish honeypot chain network, and use the multimodal fusion model to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features;

[0144] A DDoS attack identification unit is used to use a DDoS attack identification model to perform DDoS attack identification on real-time multimodal fusion features to obtain real-time identification results;

[0145] The DDoS attack defense unit is used to generate a defense strategy based on the real-time identification results using a defense strategy generation model to obtain a real-time DDoS attack defense strategy.

[0146] The present invention discloses a DDoS attack identification method and system based on multimodal fusion analysis. The method performs feature fusion on multimodal data through a multimodal fusion model, and uses the DDoS attack identification model to perform automated, intelligent, and efficient DDoS attack identification. The method improves the accuracy and robustness of DDoS attack identification, reduces the false alarm rate and the missed alarm rate, and can accurately distinguish normal traffic from malicious traffic when facing complex and changeable attack methods, thereby improving the reliability of DDoS attack identification. The method also constructs an attack trapping Hfish honeypot network and uses active defense technology to actively expose some vulnerabilities and set some bait to lure attackers to attack, so that the attack behavior can be captured and analyzed, thereby improving the effectiveness of security defense measures and improving the security protection level and security. The method also generates and adjusts the DDoS defense strategy in real time through a defense strategy generation model, significantly improving the real-time performance, response speed, and adaptability of the defense system, enabling timely blocking of attacks and avoiding damage to service availability. The defense strategy generation model can automatically adjust according to changes in the network environment and attack mode, thereby improving the flexibility and effectiveness of the defense strategy and realizing real-time adjustment and updating of the defense strategy.

[0147] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A DDoS attack identification method based on multimodal fusion analysis, characterized by: The steps include: Based on the cloud data center, the Hfish honeypot chain network, multimodal fusion model, DDoS attack identification model and defense strategy generation model are constructed, including the following steps: Based on the cloud data center, build several Hfish honeypots, set up the Hfish management module, and build the Hfish honeypot chain network based on the Hfish management module and several Hfish honeypots; Collect some historical multimodal data, and use feature fusion algorithm to build a multimodal fusion model based on some historical multimodal data, and generate some historical multimodal fusion features; Based on several historical multimodal fusion features, a deep learning algorithm is used to build a DDoS attack recognition model and generate several historical recognition results, including the following steps: According to the data structure of historical multimodal fusion features and historical recognition results, a second input layer and a second output layer are constructed; Use the RF algorithm to build an attack identification module, and combine the second input layer and the second output layer to build an initial DDoS attack identification model; Using the initial DDoS attack identification model, several feature key scores of the historical multimodal fusion features are generated, and according to the several feature key scores, several corresponding historical key features are extracted; Based on several historical key features, several historical multimodal fusion features are used to optimize and train the initial DDoS attack recognition model, obtain the final DDoS attack recognition model, and generate several historical recognition results; Collecting some historical DDoS defense information and some historical DDoS defense decisions of the cloud data center under different historical identification results; Based on some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated; Based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features; Use the DDoS attack recognition model to identify DDoS attacks using real-time multimodal fusion features and obtain real-time recognition results; The defense strategy generation model is used to generate defense strategies for real-time identification results to obtain real-time DDoS attack defense strategies.

2. The DDoS attack identification method based on multimodal fusion analysis according to claim 1 is characterized by: Based on the cloud data center, several Hfish honeypots are constructed, the Hfish management module is set up, and the Hfish honeypot chain network is constructed according to the Hfish management module and several Hfish honeypots, including the following steps: Based on the cloud data center, basic information of several applications is collected, and corresponding Hfish honeypot elements are generated according to the basic information; According to the Hfish honeypot elements, build the corresponding Hfish honeypot at the application, and set the flow probe in the Hfish honeypot; Set up the Hfish management module and connect all Hfish honeypots to the Hfish management module to obtain the Hfish honeypot chain network.

3. The DDoS attack identification method based on multimodal fusion analysis according to claim 2 is characterized by: The multimodal fusion model is constructed based on the CNN-LSTM-MLP algorithm; The DDoS attack identification model is constructed based on the RF algorithm; The defense strategy generation model is constructed based on the DQN algorithm.

4. The DDoS attack identification method based on multimodal fusion analysis according to claim 3 is characterized by: Based on some historical DDoS defense information and some historical DDoS defense decisions, a defense strategy generation model is constructed using a reinforcement learning algorithm, and some historical defense strategy generation experiences are generated, including the following steps: The defense strategy generation problem is used as the simulation environment of the DQN algorithm, and the intelligent agent and experience replay pool of the defense strategy generation model are set up; Based on several historical DDoS defense information of the same historical recognition result, the state space of the DQN algorithm is defined, and based on several corresponding historical DDoS defense decisions, the action space of the DQN algorithm is defined; Based on the state space and action space, a deep Q network of the defense strategy generation model is constructed, and a reward function is constructed based on the impact of historical DDoS defense decisions on historical DDoS defense information; The initial defense strategy generation model is constructed based on the reward function, intelligent agent, deep Q network and experience replay pool; Traverse all historical DDoS defense information and historical DDoS defense decisions of all historical recognition results, perform optimization training, and obtain the final defense strategy generation model; Several historical defense strategy generation experiences generated by each optimization training are stored in the experience replay pool of the final defense strategy generation model.

5. The DDoS attack identification method based on multimodal fusion analysis according to claim 3 is characterized by: Based on the Hfish honeypot chain network, real-time multimodal data is collected, and a multimodal fusion model is used to perform multimodal fusion on the real-time multimodal data to obtain real-time multimodal fusion features, including the following steps: Use the Hfish honeypot in the Hfish honeypot chain network to collect real-time multimodal data and send it to the Hfish management module; Use the Hfish management module in the Hfish honeypot chain network to send real-time multimodal data to the multimodal fusion model; Use multimodal fusion models to extract real-time unstructured features and real-time structured features of real-time multimodal data; The real-time unstructured features and the real-time structured features are multimodally fused to obtain real-time multimodal fusion features.

6. The DDoS attack identification method based on multimodal fusion analysis according to claim 3 is characterized by: Using the DDoS attack identification model, real-time multimodal fusion features are used to identify DDoS attacks and obtain real-time identification results, including the following steps: Input the real-time multimodal fusion features into the DDoS attack identification model; According to several key feature scores of the DDoS attack identification model, several real-time key features of the real-time multimodal fusion features are extracted; Based on several real-time key features, DDoS attack identification is performed to obtain real-time identification results.

7. The DDoS attack identification method based on multimodal fusion analysis according to claim 4 is characterized by: Using the defense strategy generation model, a defense strategy is generated for the real-time identification results to obtain a real-time DDoS attack defense strategy, including the following steps: If the real-time identification result is that there is a DDoS attack, then according to the real-time identification result, several matching historical defense strategies are extracted from the experience replay pool to generate experience. Otherwise, the DDoS attack identification is terminated. Analyze the experience of generating several matching historical defense strategies, obtain several real-time DDoS defense decisions, and extract real-time DDoS defense information; According to the real-time DDoS defense information, the state space of the defense strategy generation model is updated to obtain an updated state space; According to a number of real-time DDoS defense decisions, the action space of the defense strategy generation model is updated to obtain an updated action space; Based on the updated state space, use the reward function to obtain the real-time reward value of possible actions in the updated action space; According to the real-time reward value, use the agent to update the Q value of all possible actions of the deep Q network in the updated action space to obtain the updated Q value of the possible action; Repeat the above Q-value update steps until the number of iterations reaches the iteration threshold, and use the greedy strategy to take the possible action with the highest updated Q-value as the execution action; According to the execution action, a real-time DDoS attack defense strategy is obtained, and the generated real-time defense strategy generation experience is stored in the experience replay pool of the defense strategy generation model.

8. A DDoS attack identification system based on multimodal fusion analysis, used to implement the DDoS attack identification method according to any one of claims 1 to 7, characterized in that: The system is deployed in a cloud data center, and the system includes a model building unit, a multimodal fusion unit, a DDoS attack identification unit and a DDoS attack defense unit which are connected in sequence.

Images