A DDos attack identification method based on machine learning

Abstract

The invention discloses a DDos attack identification method based on machine learning, which belongs to the technical field of DDos attack identification. By adopting a machine learning model to build an attack detection model, DDos attack identification is preliminarily realized. The attack detection model is trained by adopting a multi-level search algorithm to obtain the trained attack detection model. The method focuses on parameter optimization of the machine learning model to improve the recognition accuracy of the attack detection model, and finally improves the DDos attack recognition rate, reduces the false alarm rate, and greatly improves the security protection performance.

Description

Technical Field

[0001] The invention belongs to the technical field of DDos attack identification, and in particular relates to a DDos attack identification method based on machine learning. Background Art

[0002] With the popularization of the Internet, network security issues are becoming increasingly serious. Distributed denial of service attacks (DDoS) are a common means of network attacks, which have caused huge losses to network service providers and users. Existing DDoS attack identification methods often use machine learning models for identification. The existing technology generally considers improving the structure of the machine learning model to improve the recognition accuracy of DDos attacks, but does not consider the parameter optimization of the machine learning model. Therefore, the existing DDoS attack identification methods have problems such as low recognition rate, high false alarm rate, and poor real-time performance. An efficient and accurate identification method is urgently needed. Summary of the invention

[0003] The present invention provides a DDos attack identification method based on machine learning, which is used to solve the problem that the prior art does not consider the parameter optimization of the machine learning model, resulting in low recognition rate and high false alarm rate.

[0004] A DDos attack identification method based on machine learning, comprising:

[0005] Obtain network traffic characteristics and network traffic characteristic labels related to DDos attacks that are pre-stored or input through human-computer interaction;

[0006] The attack detection model is constructed by using a machine learning model. According to the network traffic characteristics and network traffic feature labels, the attack detection model is trained by using a multi-level search algorithm to obtain the trained attack detection model.

[0007] The trained attack detection model is deployed in the system to be detected, and the real-time network traffic characteristics corresponding to the system to be detected are obtained in real time. The trained attack detection model is scheduled to identify the real-time network traffic characteristics to obtain the DDos attack identification result.

[0008] Furthermore, it also includes:

[0009] When the system to be detected detects new attack features, an incremental learning algorithm or a transfer learning algorithm is used to update the attack detection model, and the updated attack detection model is used to identify the DDos attack.

[0010] Furthermore, a machine learning model is used to build an attack detection model, including: using a CNN-LSTM model to build an attack detection model.

[0011] Furthermore, according to the network traffic characteristics and network traffic characteristic labels, a multi-level search algorithm is used to train the attack detection model to obtain the trained attack detection model, including:

[0012] For the hyperparameters of the attack detection model, a random initialization method is used to initialize the hyperparameter population to obtain a population for training; wherein the population includes a plurality of individuals, each of which includes the hyperparameters to be trained of the attack detection model;

[0013] For any individual, apply the hyperparameters contained in the individual to the attack detection model, use the network traffic features as the input of the attack detection model, and use the network traffic feature labels as the expected output of the attack detection model to obtain the loss function value corresponding to each individual;

[0014] According to the loss function value corresponding to each individual, the fitness corresponding to each individual is obtained, and the optimal individual is obtained according to the fitness corresponding to each individual;

[0015] In the multi-neighborhood information exploration method, neighborhood exploration is performed on each individual in the population to obtain the individual after neighborhood exploration;

[0016] For the individuals after neighborhood exploration, the population information interaction method is used to perform an extended search on each individual in the population to obtain the individuals after the extended search;

[0017] For the individuals after the expanded search, the optimal area surrounding search method is used to conduct a surrounding search on each individual in the population to obtain the individuals after the surrounding search;

[0018] For the individuals after the search, an adaptive mutation search method is used to perform mutation search on each individual in the population to obtain the individuals after the mutation search;

[0019] Neighborhood exploration, expansion search, surrounding search, and mutation search are repeatedly performed until the training end conditions are met, the optimal individual is determined in the population, and the optimal individual is used as the final hyperparameter of the attack detection model to obtain the trained attack detection model.

[0020] Furthermore, according to the loss function value corresponding to each individual, the fitness corresponding to each individual is obtained, and according to the fitness corresponding to each individual, the optimal individual is obtained, including:

[0021] Add the loss function value corresponding to each individual to the preset constant term and take the inverse to obtain the fitness corresponding to each individual; where the preset constant term is less than 0.0001;

[0022] According to the fitness of each individual, the individual with the largest fitness is determined as the optimal individual.

[0023] Furthermore, the multi-neighborhood information exploration method performs neighborhood exploration on each individual in the population, and obtains individuals after neighborhood exploration, including:

[0024] Based on the current number of training times, the amount of neighborhood exploration is determined as:

[0025]

[0026] in, Indicates the t-1th training process. i Individuals, i =1,2,…,K, K represents the total number of individuals in the population, represents the optimal individual, e represents the natural constant, represents a random number between (0,1), R represents the control factor, represents the update amount during the t-1th training process, Represents the update amount during the tth training process;

[0027] According to the neighborhood exploration amount, a preliminary neighborhood exploration is performed on each individual in the population, and the neighborhood exploration position is obtained as follows:

[0028]

[0029]

[0030] in, represents the first neighbor exploration position, represents the second neighbor exploration position, represents the neighborhood exploration range factor;

[0031] Explore locations based on the first neighborhood and the second neighbor exploration location , determine the final neighborhood exploration amount as:

[0032]

[0033] in, Indicates the t-1th training process. i The final neighborhood exploration amount corresponding to each individual is represents the neighborhood exploration step length, and =c· , c represents the step size attenuation factor, and c is set to a constant term between (0.2, 0.4), represents the symbolic function, represents the fitness corresponding to the first neighborhood exploration position, Indicates the fitness corresponding to the second neighborhood exploration position;

[0034] According to the final neighborhood exploration amount, a neighborhood exploration is performed on each individual in the population, and the individuals after the neighborhood exploration are obtained as follows:

[0035]

[0036] in, represents the weight parameter between (0,1), Represents the individual after neighborhood exploration .

[0037] Furthermore, for the individuals after the neighborhood exploration, the population information interaction method is used to perform an extended search on each individual in the population to obtain the individuals after the extended search, including:

[0038] For individuals after neighborhood exploration, the individuals interacting with population information are determined as follows:

[0039]

[0040] in, represents the population information interaction individuals in the t-th training process, Indicates t -1 training session j Individuals, Represents an individual The corresponding fitness, represents the total number of individuals in the population;

[0041] According to the population information interaction individuals, an extended search is performed on each individual in the population, and the individuals after the extended search are obtained as follows:

[0042]

[0043] in, Represents a random number between (0,1), Represents the individual after the expanded search .

[0044] Furthermore, for the individuals after the expanded search, the optimal area surrounding search method is used to perform surrounding search on each individual in the population, and the individuals after the surrounding search are obtained, including:

[0045] For individuals after the expanded search, the generated surrounding search control factor is:

[0046]

[0047]

[0048]

[0049] in, represents the first surrounding search control factor, represents the second surrounding search control factor, represents the adaptive attenuation factor in the t-th training process, Represents a random number between (0,1), represents the preset constant factor, represents the maximum value of the adaptive attenuation factor, represents the minimum value of the adaptive attenuation factor, e represents a natural constant, and T represents the preset maximum number of training times;

[0050] According to the first surrounding search control factor and the second surrounding search control factor, a surrounding search is performed on each individual in the population, and the individual after the surrounding search is obtained as follows:

[0051]

[0052] in, represents the best individual in the t-1th training process, Indicates the t-1th training process. m individuals after the extended search, Represents the individual after the search , Indicates except A random individual other than , e represents a natural constant.

[0053] Furthermore, for the individuals after the search, an adaptive mutation search method is used to perform mutation search on each individual in the population to obtain individuals after the mutation search, including:

[0054] Based on the current number of training times, the adaptive mutation search coefficient is generated as:

[0055]

[0056]

[0057] in, represents the adaptive mutation search coefficient, represents the scaling factor, represents a natural constant, means [-2.5 , 2.5 ], Indicates the upper limit of the scaling factor, represents the adjustment parameter of the scaling factor, and T represents the maximum number of training times;

[0058] According to the adaptive mutation search coefficient, a mutation search is performed on each individual in the population, and the individual after the mutation search is obtained as:

[0059]

[0060] in, represents the kth individual in the t-1th training process, Represents the individual after mutation search , Indicates except Other random individuals.

[0061] Furthermore, the training end condition includes: when the current training times is greater than or equal to the maximum training times, the training end condition is met.

[0062] The present invention provides a DDos attack recognition method based on machine learning. By adopting a machine learning model to build an attack detection model, the DDos attack recognition is preliminarily realized. The attack detection model is trained by adopting a multi-level search algorithm to obtain the trained attack detection model. The parameter optimization of the machine learning model is focused on to improve the recognition accuracy of the attack detection model, and finally the DDos attack recognition rate is improved, the false alarm rate is reduced, and the security protection performance is greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0064] Figure 1 A flowchart of a DDos attack identification method based on machine learning is provided in an embodiment of the present invention.

[0065] Figure 2 A flowchart of using a multi-level search algorithm to train an attack detection model is provided in an embodiment of the present invention.

[0066] The above drawings have shown clear embodiments of the present invention, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present invention in any way, but to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0067] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0068] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0069] like Figure 1 As shown, the embodiment of the present invention provides a DDos attack identification method based on machine learning, including:

[0070] S11, obtaining network traffic characteristics and network traffic characteristic labels related to DDos attacks that are pre-stored or input through human-computer interaction;

[0071] For example, network traffic characteristics can be:

[0072] 1. Basic traffic characteristics;

[0073] Traffic size: The total size of packets or the amount of traffic per unit time. Packet rate: The number of packets sent or received per unit time. Packet size distribution: The statistical distribution of packet sizes. Traffic rate: The rate at which bytes are transmitted per unit time.

[0074] 2. Protocol characteristics;

[0075] Protocol type: such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), etc. Protocol field statistics: such as the usage frequency of TCP flags (SYN, ACK, FIN, RST, etc.).

[0076] 3. Source and target characteristics;

[0077] Source IP address number: The number of different source IP addresses (Internet Protocol Address) that initiated the traffic. Target IP address: The target IP address that was attacked. Source and destination ports: The distribution of the source and destination ports of the data packets.

[0078] 4. Connection characteristics;

[0079] Connection establishment rate: the speed at which new connections are established. Connection status: the number of half-open connections in a SYN flood attack. Connection duration: the difference in duration between a normal connection and an abnormal connection.

[0080] 5. Traffic pattern characteristics;

[0081] Traffic burstiness: The burstiness and fluctuation of traffic. Traffic synchronization: Whether the traffic from multiple sources is synchronized. Traffic duration: The difference between the duration of attack traffic and normal traffic.

[0082] 6. Statistical characteristics;

[0083] Packet arrival time interval: the interval between consecutive packet arrival times. Packet length standard deviation: the standard deviation of packet length, used to detect abnormal changes in packet size. Traffic entropy: the entropy value of network traffic, used to measure the randomness of traffic.

[0084] 7. Anomaly detection features;

[0085] Abnormal communication patterns: abnormal traffic patterns compared to normal communication patterns. Abnormal traffic: abnormal traffic compared to historical traffic baselines.

[0086] 8. Other features;

[0087] IP geographic information: geographical location information of the source IP address. Network layer characteristics: such as the TTL (time to live) value of the IP header. Application layer characteristics: if the attack involves a specific application layer protocol, it may include HTTP (HyperText TransferProtocol) request method, URI (Uniform Resource Identifier), etc.

[0088] It is worth noting that the above features are merely examples of the embodiments of the present invention, and some of the features may be used, or other features may be used to identify DDos attacks.

[0089] S12. Use a machine learning model to build an attack detection model, and train the attack detection model according to network traffic characteristics and network traffic feature labels using a multi-level search algorithm to obtain a trained attack detection model;

[0090] The machine learning model can be set to a CNN model (Convolutional Neural Network), a BP (Back Propagation) neural network model, an LSTM (Long Short-Term Memory) neural network model, or other machine learning models that can classify data.

[0091] In the prior art, people often only focus on the structural improvement of the machine learning model, but not on parameter optimization, which results in poor recognition effect of the attack detection model even if the network structure is improved. Therefore, an embodiment of the present invention provides a multi-level search algorithm to solve the problems in the prior art and improve the recognition accuracy of DDos attacks.

[0092] S13, deploying the trained attack detection model in the system to be detected, and obtaining the real-time network traffic characteristics corresponding to the system to be detected in real time, scheduling the trained attack detection model to identify the real-time network traffic characteristics, and obtaining the DDos attack identification result.

[0093] The system to be detected can be some software system or a system combining software and hardware. The trained attack detection model is deployed on the system to be detected, and real-time network traffic characteristics are collected, so that DDos attack identification can be realized.

[0094] The present invention provides a DDos attack recognition method based on machine learning. By adopting a machine learning model to build an attack detection model, the DDos attack recognition is preliminarily realized. The attack detection model is trained by adopting a multi-level search algorithm to obtain the trained attack detection model. The parameter optimization of the machine learning model is focused on to improve the recognition accuracy of the attack detection model, and finally the DDos attack recognition rate is improved, the false alarm rate is reduced, and the security protection performance is greatly improved.

[0095] In an embodiment of the present invention, it also includes:

[0096] When the system to be detected detects new attack features, an incremental learning algorithm or a transfer learning algorithm is used to update the attack detection model, and the updated attack detection model is used to identify the DDos attack.

[0097] In an embodiment of the present invention, a machine learning model is used to build an attack detection model, including: using a CNN-LSTM model to build an attack detection model.

[0098] CNN (Convolutional Neural Network) and LSTM (Long Short-Term Memory Network) are two very popular network structures in deep learning, which are usually used to process different types of data. The CNN model is better at processing spatial features, while the LSTM model is better at processing temporal features. Therefore, the embodiment of the present invention uses the CNN-LSTM model to construct an attack detection model to ensure the recognition accuracy of the attack detection model. For example, the output layer of the CNN model can be removed and connected to the LSTM model to realize the recognition of spatial features and temporal features, and finally improve the recognition accuracy.

[0099] like Figure 2 As shown, according to the network traffic characteristics and network traffic feature labels, the attack detection model is trained using a multi-level search algorithm to obtain the trained attack detection model, including:

[0100] S21. For the hyperparameters of the attack detection model, a hyperparameter population is initialized by a random initialization method to obtain a population for training; wherein the population includes a plurality of individuals, and each individual includes the hyperparameters to be trained of the attack detection model;

[0101] The hyperparameters to be trained of the attack detection model may be all of its parameters to be optimized or part of its parameters to be optimized; for example, the hyperparameters to be trained may be weight parameters of the attack detection model. These weight parameters usually have a valid range and can be randomly initialized within a limited range of the weight parameters, thereby achieving population initialization.

[0102] Optionally, a chaotic mapping strategy can be used to initialize the parameters of the attack detection model so that the initial solution is more evenly distributed in the solution space, thereby improving the convergence speed of the algorithm.

[0103] S22. For any individual, apply the hyperparameters contained in the individual to the attack detection model, use the network traffic features as the input of the attack detection model, use the network traffic feature labels as the expected output of the attack detection model, and obtain the loss function value corresponding to each individual;

[0104] Optionally, the loss function value may be obtained through a cross entropy loss function or a root mean square loss function, and the network traffic feature labels may include normal categories and abnormal categories, thereby achieving attack detection.

[0105] S23, according to the loss function value corresponding to each individual, obtain the fitness corresponding to each individual, and obtain the optimal individual according to the fitness corresponding to each individual;

[0106] S24, performing neighborhood exploration on each individual in the population using a multi-neighborhood information exploration method to obtain an individual after the neighborhood exploration;

[0107] S25, for the individuals after the neighborhood exploration, using the population information interaction method to perform an extended search on each individual in the population to obtain the individuals after the extended search;

[0108] S26, for the individuals after the expanded search, use the optimal area surrounding search method to perform surrounding search on each individual in the population to obtain the individuals after the surrounding search;

[0109] S27, for the individuals after the search, using an adaptive mutation search method to perform mutation search on each individual in the population to obtain the individuals after the mutation search;

[0110] S28. Repeat the neighborhood exploration, expansion search, surrounding search, and mutation search until the training end condition is met, determine the optimal individual in the population, and use the optimal individual as the final hyperparameter of the attack detection model to obtain the trained attack detection model.

[0111] In the prior art, the hyperparameters of the machine learning model are usually optimized by using the gradient descent and back propagation methods, which may easily fall into the local optimum and have poor convergence accuracy, resulting in a high misrecognition rate even if the structure of the machine learning model is improved. Therefore, the embodiment of the present invention provides a multi-level search algorithm to solve the technical problems of the prior art and ultimately improve the detection accuracy of DDos attacks.

[0112] In the embodiment of the present invention, according to the loss function value corresponding to each individual, the fitness corresponding to each individual is obtained, and according to the fitness corresponding to each individual, the optimal individual is obtained, including:

[0113] Add the loss function value corresponding to each individual to the preset constant term and take the inverse to obtain the fitness corresponding to each individual; where the preset constant term is less than 0.0001;

[0114] According to the fitness of each individual, the individual with the largest fitness is determined as the optimal individual.

[0115] In an embodiment of the present invention, the multi-neighborhood information exploration method performs neighborhood exploration on each individual in the population to obtain the individual after the neighborhood exploration, including:

[0116] Based on the current number of training times, the amount of neighborhood exploration is determined as:

[0117]

[0118] in, Indicates the t-1th training process. i Individuals, i=1,2,…,K, K represents the total number of individuals in the population, represents the optimal individual, e represents the natural constant, represents a random number between (0,1), R represents the control factor, represents the update amount during the t-1th training process, Represents the update amount during the tth training process;

[0119] According to the neighborhood exploration amount, a preliminary neighborhood exploration is performed on each individual in the population, and the neighborhood exploration position is obtained as follows:

[0120]

[0121]

[0122] in, represents the first neighbor exploration position, represents the second neighbor exploration position, represents the neighborhood exploration range factor;

[0123] Explore locations based on the first neighborhood and the second neighbor exploration location , determine the final neighborhood exploration amount as:

[0124]

[0125] in, Indicates the t-1th training process. i The final neighborhood exploration amount corresponding to each individual is represents the neighborhood exploration step length, and =c· , c represents the step size attenuation factor, and c is set to a constant term between (0.2, 0.4), represents the symbolic function, represents the fitness corresponding to the first neighborhood exploration position, Indicates the fitness corresponding to the second neighborhood exploration position;

[0126] According to the final neighborhood exploration amount, a neighborhood exploration is performed on each individual in the population, and the individuals after the neighborhood exploration are obtained as follows:

[0127]

[0128] in, represents the weight parameter between (0,1), Represents the individual after neighborhood exploration .

[0129] The multi-neighborhood information exploration method provided by the embodiment of the present invention can effectively integrate the information within the neighborhood and obtain the optimal solution through gradual approximation, thereby achieving efficient optimization and reducing the amount of calculation, greatly improving the training efficiency and training accuracy of the algorithm.

[0130] In the embodiment of the present invention, for the individuals after the neighborhood exploration, a population information interaction method is used to perform an extended search on each individual in the population to obtain the individuals after the extended search, including:

[0131] For individuals after neighborhood exploration, the individuals interacting with population information are determined as follows:

[0132]

[0133] in, represents the population information interaction individuals in the t-th training process, Indicates t -1 training session j Individuals, Represents an individual The corresponding fitness, represents the total number of individuals in the population;

[0134] According to the population information interaction individuals, an extended search is performed on each individual in the population, and the individuals after the extended search are obtained as follows:

[0135]

[0136] in, Represents a random number between (0,1), Represents the individual after the expanded search .

[0137] The population information interaction method provided in the embodiment of the present invention can not only effectively utilize population information to achieve better optimization effect, but also maintain the diversity of the population in the early stage of the algorithm and ensure the convergence accuracy of the algorithm in the later stage of the algorithm, thereby effectively improving the training effect.

[0138] In the embodiment of the present invention, for the individuals after the extended search, an optimal area surrounding search method is used to perform a surrounding search on each individual in the population to obtain the individuals after the surrounding search, including:

[0139] For individuals after the expanded search, the generated surrounding search control factor is:

[0140]

[0141]

[0142]

[0143] in, represents the first surrounding search control factor, represents the second surrounding search control factor, represents the adaptive attenuation factor in the t-th training process, Represents a random number between (0,1), represents the preset constant factor, represents the maximum value of the adaptive attenuation factor, represents the minimum value of the adaptive attenuation factor, e represents a natural constant, and T represents the preset maximum number of training times;

[0144] According to the first surrounding search control factor and the second surrounding search control factor, a surrounding search is performed on each individual in the population, and the individual after the surrounding search is obtained as follows:

[0145]

[0146] in, represents the best individual in the t-1th training process, Indicates the t-1th training process. m individuals after the extended search, Represents the individual after the search , Indicates except A random individual other than , e represents a natural constant.

[0147] The optimal area surrounding search method provided by the embodiment of the present invention can enable all individuals to conduct a joint search around the optimal position to form a mesh search path, which can not only effectively improve the search efficiency, but also improve the algorithm's global search capability, thereby effectively avoiding falling into the local optimum, and can effectively search the range in the later stage of the algorithm, greatly improving the algorithm's search accuracy.

[0148] In the embodiment of the present invention, for the individuals after the search, an adaptive mutation search method is used to perform mutation search on each individual in the population to obtain the individuals after the mutation search, including:

[0149] Based on the current number of training times, the adaptive mutation search coefficient is generated as:

[0150]

[0151]

[0152] in, represents the adaptive mutation search coefficient, represents the scaling factor, represents a natural constant, means [-2.5 , 2.5 ], Indicates the upper limit of the scaling factor, represents the adjustment parameter of the scaling factor, and T represents the maximum number of training times;

[0153] According to the adaptive mutation search coefficient, a mutation search is performed on each individual in the population, and the individual after the mutation search is obtained as:

[0154]

[0155] in, represents the kth individual in the t-1th training process, Represents the individual after mutation search , Indicates except Other random individuals.

[0156] The adaptive mutation search method provided by the embodiment of the present invention can provide a larger mutation probability in the early stage of the algorithm, thereby improving the possibility of the algorithm searching for the global optimal position. The algorithm also has a certain probability of mutation in the later stage, thereby always maintaining the ability to jump out of the local optimum.

[0157] In the embodiment of the present invention, the training end condition includes: when the current training times is greater than or equal to the maximum training times, the training end condition is satisfied.

[0158] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A DDos attack identification method based on machine learning, characterized in that: include: Obtain network traffic characteristics and network traffic characteristic labels related to DDos attacks that are pre-stored or input through human-computer interaction; The attack detection model is constructed by using a machine learning model. According to the network traffic characteristics and network traffic feature labels, the attack detection model is trained by using a multi-level search algorithm to obtain the trained attack detection model. Deploy the trained attack detection model in the system to be detected, obtain the real-time network traffic characteristics of the system to be detected in real time, schedule the trained attack detection model to identify the real-time network traffic characteristics, and obtain the DDos attack identification result; According to the network traffic characteristics and network traffic feature labels, the attack detection model is trained using a multi-level search algorithm to obtain the trained attack detection model, including: For the hyperparameters of the attack detection model, a random initialization method is used to initialize the hyperparameter population to obtain a population for training; wherein the population includes a plurality of individuals, each of which includes the hyperparameters to be trained of the attack detection model; For any individual, apply the hyperparameters contained in the individual to the attack detection model, use the network traffic features as the input of the attack detection model, and use the network traffic feature labels as the expected output of the attack detection model to obtain the loss function value corresponding to each individual; According to the loss function value corresponding to each individual, the fitness corresponding to each individual is obtained, and the optimal individual is obtained according to the fitness corresponding to each individual; In the multi-neighborhood information exploration method, neighborhood exploration is performed on each individual in the population to obtain the individual after neighborhood exploration; For the individuals after neighborhood exploration, the population information interaction method is used to perform an extended search on each individual in the population to obtain the individuals after the extended search; For the individuals after the expanded search, the optimal area surrounding search method is used to conduct a surrounding search on each individual in the population to obtain the individuals after the surrounding search; For the individuals after the search, an adaptive mutation search method is used to perform mutation search on each individual in the population to obtain the individuals after the mutation search; Neighborhood exploration, expansion search, surrounding search, and mutation search are repeatedly performed until the training end conditions are met, the optimal individual is determined in the population, and the optimal individual is used as the final hyperparameter of the attack detection model to obtain the trained attack detection model.

2. The DDos attack identification method based on machine learning according to claim 1 is characterized in that: Also includes: When the system to be detected detects new attack features, an incremental learning algorithm or a transfer learning algorithm is used to update the attack detection model, and the DDos attack is identified with the updated attack detection model.

3. The DDos attack identification method based on machine learning according to claim 1 is characterized in that: The attack detection model is constructed by using a machine learning model, including: the attack detection model is constructed by using a CNN-LSTM model.

4. The DDos attack identification method based on machine learning according to claim 1 is characterized in that: According to the loss function value corresponding to each individual, the fitness corresponding to each individual is obtained, and the optimal individual is obtained according to the fitness corresponding to each individual, including: Add the loss function value corresponding to each individual to the preset constant term and take the inverse to obtain the fitness corresponding to each individual; where the preset constant term is less than 0.0001; According to the fitness of each individual, the individual with the largest fitness is determined as the optimal individual.

5. The DDos attack identification method based on machine learning according to claim 1 is characterized in that: In the multi-neighborhood information exploration method, neighborhood exploration is performed on each individual in the population to obtain individuals after neighborhood exploration, including: Based on the current number of training times, the amount of neighborhood exploration is determined as: in, Indicates the t-1th training process. i Individuals, i =1,2,…,K, K represents the total number of individuals in the population, represents the optimal individual, e represents the natural constant, represents a random number between (0,1), R represents the control factor, represents the update amount during the t-1th training process, Represents the update amount during the tth training process; According to the neighborhood exploration amount, a preliminary neighborhood exploration is performed on each individual in the population, and the neighborhood exploration position is obtained as follows: in, represents the first neighbor exploration position, represents the second neighbor exploration position, represents the neighborhood exploration range factor; Explore locations based on the first neighborhood and the second neighbor exploration location , determine the final neighborhood exploration amount as: in, represents the first time in the t-1th training process i The final neighborhood exploration amount corresponding to each individual is represents the neighborhood exploration step length, and =c· , c represents the step size attenuation factor, and c is set to a constant term between (0.2, 0.4), represents the symbolic function, represents the fitness corresponding to the first neighborhood exploration position, Indicates the fitness corresponding to the second neighborhood exploration position; According to the final neighborhood exploration amount, a neighborhood exploration is performed on each individual in the population, and the individuals after the neighborhood exploration are obtained as follows: in, represents the weight parameter between (0,1), Represents the individual after neighborhood exploration .

6. The DDos attack identification method based on machine learning according to claim 5 is characterized in that: For the individuals after neighborhood exploration, the population information interaction method is used to perform an extended search on each individual in the population to obtain the individuals after the extended search, including: For individuals after neighborhood exploration, the individuals interacting with population information are determined as follows: in, represents the population information interaction individuals in the t-th training process, Indicates t -1 training session j Individuals, Represents an individual The corresponding fitness, represents the total number of individuals in the population; According to the population information interaction individuals, an extended search is performed on each individual in the population, and the individuals after the extended search are obtained as follows: in, Represents a random number between (0,1), Represents the individual after the expanded search .

7. The DDos attack identification method based on machine learning according to claim 6 is characterized in that: For the individuals after the expanded search, the optimal area surrounding search method is used to conduct a surrounding search on each individual in the population, and the individuals after the surrounding search are obtained, including: For individuals after the expanded search, the generated surrounding search control factor is: in, represents the first surrounding search control factor, represents the second surrounding search control factor, represents the adaptive attenuation factor in the t-th training process, Represents a random number between (0,1), Represents a random number between (0,1), represents the preset constant factor, represents the maximum value of the adaptive attenuation factor, represents the minimum value of the adaptive attenuation factor, e represents a natural constant, and T represents the preset maximum number of training times; According to the first surrounding search control factor and the second surrounding search control factor, a surrounding search is performed on each individual in the population, and the individual after the surrounding search is obtained as follows: in, represents the best individual in the t-1th training process, Indicates the t-1th training process. m individuals after the extended search, Represents the individual after the search , Indicates except A random individual other than , e represents a natural constant.

8. The DDos attack identification method based on machine learning according to claim 7 is characterized in that: For the individuals after the search, an adaptive mutation search method is used to perform mutation search on each individual in the population to obtain the individuals after the mutation search, including: Based on the current number of training times, the adaptive mutation search coefficient is generated as: in, represents the adaptive mutation search coefficient, represents the scaling factor, represents a natural constant, means [-2.5 , 2.5 ], Indicates the upper limit of the scaling factor, represents the adjustment parameter of the scaling factor, and T represents the maximum number of training times; According to the adaptive mutation search coefficient, a mutation search is performed on each individual in the population, and the individual after the mutation search is obtained as: in, represents the kth individual in the t-1th training process, Represents the individual after mutation search , Indicates except Other random individuals.

9. The DDos attack identification method based on machine learning according to claim 7 is characterized in that: The training end condition includes: when the current training times is greater than or equal to the maximum training times, the training end condition is met.

Images