A method and apparatus for identifying decoy hosts under link flooding attacks

Abstract

The present invention discloses a method and device for identifying a decoy host under a link flooding attack, the method comprising: after obtaining global routing information in an SDN controller, selecting key switches and dividing the network into multiple monitoring areas according to their distribution; offline training an improved RF model for traffic classification in each monitoring area, then converting all trained RF models into forwarding rules that comply with P4 switch specifications in the SDN controller, and installing them on key switches; running forwarding rules in the switch to classify traffic at line speed, and reporting the classification results to the SDN controller; identifying the address of the decoy host according to the classification results. The present invention significantly reduces the communication overhead between the controller and the data plane and within the data plane, improves the recognition accuracy and time efficiency of the decoy host under LFA, provides an efficient and resource-saving solution for the security defense of LFA, and improves the efficiency of SDN in dealing with LFA.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for identifying a bait host under a link flooding attack. Background Art

[0002] Link Flooding Attack (LFA) is a new type of distributed denial-of-service (DDoS) attack. It can launch attacks on multiple hidden and specific target decoy hosts (decoys) by controlling multiple zombie hosts (bots), flooding the intermediate decoy host (Persisitent Route, PR) to a congested state, and destroying the end-to-end service connection between the host and the target. Among them, the source host that initiates the flooding traffic is called the zombie host bots, the target host that receives this traffic is called the target decoy host decoys, and the link with high link density and is particularly vulnerable to zombie attacks is called the intermediate decoy host PRs. The attacker will properly control the flooding rate in advance to ensure that the target link bandwidth is exhausted during the attack, causing PR congestion. PR congestion will increase the packet loss rate of legitimate traffic, thereby preventing benign hosts from accessing the target server. This invisible flood attack traffic is characterized by continuity, legitimacy, and low rate. Examples of LFA include Crossfire attack and Coremelt attack. LFA consumes link bandwidth, which is different from other fraudulent DDoS attacks such as virtual local area network (VLAN) hopping, address resolution protocol (ARP) spoofing, and IP address spoofing. This hidden relationship between bots and decoys poses a significant challenge to the currently adopted intrusion detection systems (IDS), which are designed to monitor network traffic to detect suspicious activities and potential threats. There are two main factors that contribute to these challenges: First, IDSs are usually deployed near host gateways, which limits their monitoring coverage because flooding traffic from LFA may occur throughout the network. Second, IDSs usually rely on detecting patterns of abnormal behavior or large-volume attacks, but the characteristics of LFA usually involve many low-speed flooding flows that are directed to decoys and may resemble normal traffic in some PRs, making detection more complicated. These factors make existing IDSs ineffective in detecting decoys under LFA, highlighting the urgent need for innovative network solutions to effectively and accurately distinguish attack traffic from normal traffic. Improving classification accuracy is crucial to improving the efficiency and accuracy of decoy identification under LFA, thus driving the development of effective solutions.

[0003] Efficient identification of these decoys remains a major challenge for many existing LFA defense solutions. Efficiency here refers to minimizing the overall decoy detection time while maintaining sufficient detection accuracy. There are two key drivers for this challenge: First, the defense's reliance on decoys. Most existing defense mechanisms rely on accurately identifying the location of decoys. For example, the Moving Target Defense (MTD) method dynamically adjusts routing policies or network configurations based on the precise decoy locations to improve defense effectiveness. Without a comprehensive understanding of the decoy addresses, the effectiveness of these adjustments will be greatly reduced. In addition, the identified decoys are critical for configuring firewalls and can be used to selectively block malicious traffic targeting decoys. Second, resource-efficient decoy detection. Unlike traditional methods of detecting bots, identifying decoys provides a potentially lightweight and more resource-efficient way to enhance network security. Since decoys represent a smaller subset of targets than zombie nodes, identifying decoys can reduce network resource consumption without sacrificing detection effectiveness. These challenges highlight the critical need for efficient decoys identification to enhance the ability of Software-Defined Networking (SDN) to resist LFA. Strong identification capabilities can improve the network's resilience against attacks, enabling it to respond to LFA more quickly and accurately.

[0004] To achieve efficient decoys identification, a promising approach is to leverage the centralized routing capabilities of the SDN controller to generate specific forwarding rules for selected P4-enabled switches. These switches, configured with customized rules, monitor the active data forwarding paths of each host in the network. By following these rules, each switch is able to efficiently classify traffic and identify the IP addresses of decoys targeted by LFA attacks. Once decoys are identified, the switches feed these addresses back to the controller, enabling defenders to take effective actions with timely and accurate decoy information. However, realizing this concept—efficiently identifying decoys under LFA attacks with minimal communication overhead—faces two major challenges. The first challenge is to reduce communication overhead. A key challenge is to minimize the communication overhead of data flow status reporting between the SDN controller and the switches, which can be time-consuming and resource-intensive. In large networks, this overhead can cause the controller to become a bottleneck. Addressing this challenge requires hierarchical management or other strategies that can reduce communication overhead while still achieving effective decoys identification. The second challenge is to balance the accuracy and efficiency of traffic classification. Another challenge is how to achieve efficient traffic classification without compromising accuracy. The Random Forest (RF) model is well suited for this task because it can be implemented as a forwarding rule in the switch, enabling efficient, low-memory traffic classification. RF-based rules enable the switch to classify traffic at line speed, allowing for fine-grained control of traffic tasks. Innovations in RF-based forwarding rule generation can further improve the accuracy and efficiency of decoy detection under LFA attacks.

[0005] To address the first challenge, two features of the SDN architecture were exploited: centralized routing control and fine-grained data plane programming using P4. (i) Centralized routing control: SDN manages routing and traffic for the entire network through a centralized controller. The controller collects comprehensive network status information and calculates the optimal global routes based on predetermined policies and dynamic network conditions, and then distributes these routes to the managed switches. These switches communicate and interact through the shortest data paths, which may vary in hop count and latency. This centralized approach simplifies network management by allowing operators to quickly adjust traffic flows and leverage a unified view of data plane status. Typically, this control relies on an out-of-band management channel for interaction between the controller and each switch. The connection between the switch and the controller through an independent management network is called an out-of-band path, while the connection between switches belongs to the data path. This approach improves response efficiency and strengthens the security and reliability of the network, and is therefore widely adopted. For example, Google has established an independent management network for SDN control. Ultimately, the use of out-of-band control not only improves the overall performance of the network, but also provides a critical security layer by isolating management traffic from data traffic, reducing the risk of interference from malicious activities. (ii) Fine-grained data plane programming using P4: P4 is an open source programming language designed to be protocol-independent, effectively abstracting the differences in switch hardware between different equipment vendors. It enables operators to create complex forwarding rules, including customized matching conditions and actions. With P4, the controller can dynamically define and update forwarding rules in the data plane, achieving fine-grained programmability. This flexibility allows forwarding behavior to be customized according to various network needs, including detecting traffic anomalies, thereby enhancing network security measures.

[0006] For the second challenge, a traffic classification model is needed that can be centrally controlled by SDN and can be quickly deployed on P4 switches. The model must ensure accuracy while being responsive enough to reduce overall management costs and time. Identifying decoys under LFA is critical to maintaining network integrity. Three traffic classification models are available: the RF model can be represented by forwarding rules; the Convolutional Neural Network (CNN) uses the spatial locality of features for fast classification; and the Long-Short-Term Memory (LSTM) network is efficient in processing time series features.

[0007] Existing RF algorithms have been widely used in networks due to their lightweight, high accuracy, stability, and scalability. RF models excel in processing large amounts of data and optimizing the classification training and prediction process through effective matching algorithms. This capability makes up for the limitations of previous machine learning models, which are often complex and time-consuming. The characteristics of RF models include fast classification speed, efficient operation on large feature sets, resistance to overfitting, and the ability to detect network variables. As the number of decision trees increases, the variance of the model decreases while the bias remains unchanged. However, RF models also have some disadvantages, including reliance on random generation, poor interpretability, and possible performance degradation due to correlation between variables. It is worth noting that existing research shows that RF algorithms can be efficiently embedded in P4 switches for traffic classification, which makes RF algorithms particularly suitable for operation in SDN data planes.

[0008] LFA traffic features have spatial continuity, which makes CNNs particularly suitable for classification. CNNs are feed-forward neural networks that use convolution operations with translation invariance. They extract local features through convolution kernels and preserve planar structural information. CNNs are able to extract static local features from network traffic, similar to how they process images. They are able to quickly learn and classify local features in traffic, especially when dealing with large-scale, high-dimensional data. CNNs excel in spatial feature extraction, can effectively capture local details, and reduce model parameters and computational costs through parameter sharing and sparse connections. However, CNNs generally perform poorly when processing time series data. Although one-dimensional convolution can capture local patterns in time series, it is less effective than LSTM in capturing long-range dependencies such as those in data traffic.

[0009] LSTM improves the Recurrent Neural Network (RNN) by solving the gradient vanishing and exploding problems, and effectively manages long-term dependencies. Due to its memory-functional design, LSTM performs well in processing time series data, accurately captures long-term dependencies, and predicts traffic behavior when there are obvious temporal features. This makes LSTM valuable in classifying time-continuous LFA traffic and very suitable for processing time series features in traffic, such as continuous packet sequences and time-dependent attack patterns. Although machine learning models such as LSTM and CNN have certain advantages, they usually require long training times and are very sensitive to training conditions. Embedding these complex models into the data plane consumes a lot of memory and computing resources, which affects switch performance and increases packet processing latency, which in turn affects overall network performance. In contrast, the RF model is a promising alternative. It is lightweight, has low computational overhead, and is able to perform classification tasks at line rate in the switch, achieving efficient traffic classification without significantly increasing resource consumption.

[0010] Compared with CNN and LSTM, RF is more suitable for traffic classification in the SDN data plane. However, it remains a challenge to efficiently utilize RF to identify decoys in LFA while maintaining accuracy. This requires innovative solutions, such as hybrid models that combine RF with other technologies to enable SDN controllers to effectively identify decoys using RF-based traffic classification. However, how to efficiently generate RF-based forwarding rules and embed them into switches remains an open problem for effective decoy identification under LFA. Generating effective RF-based forwarding rules requires careful consideration of multiple factors, including traffic characteristics, network topology, and efficiency requirements. This process requires the development of innovative algorithms to ensure that the generated rules minimize memory usage and latency while maintaining high classification accuracy. In summary, while the RF model provides a promising approach for decoy identification in SDN, it is critical to effectively address the issues of communication overhead and maintaining classification accuracy. By exploring hierarchical management strategies and innovative algorithmic solutions, the ability to efficiently and accurately identify decoys in the face of LFA can be significantly improved. Summary of the invention

[0011] The purpose of the present invention is to provide a method and device for identifying a decoy host under a link flooding attack in view of the deficiencies of the prior art. The present invention can accurately identify a decoy host under a link flooding attack.

[0012] The objective of the present invention is achieved through the following technical solutions: A first aspect of an embodiment of the present invention provides a method for identifying a decoy host under a link flooding attack, comprising the following steps:

[0013] (1) Obtain global routing information in the software-defined network controller, select switches based on the global routing information to obtain key switches representing the region, and divide the network into multiple monitoring areas according to the distribution of key switches;

[0014] (2) Train an improved random forest model for traffic classification offline for each monitoring area to achieve the highest accuracy. Then, in the software-defined network controller, convert all trained random forest models into forwarding rules that comply with the P4 switch specifications and install them on key switches.

[0015] (3) The forwarding rules installed on the key switches in each monitoring area are independently run to perform online traffic classification at line speed to obtain traffic classification results;

[0016] (4) The key switch reports the traffic classification results to the software-defined network controller, tracks and locates the address of the decoy host based on the traffic classification results and the classified data packets and traffic information, and reports it to the software-defined network controller.

[0017] Furthermore, the step (1) includes the following sub-steps:

[0018] (1.1) Based on the centralized routing control function of the software-defined network controller, obtaining global routing information; wherein the global routing information includes hosts, switches, and forwarding paths;

[0019] (1.2) Based on the global routing information, a key switch selection algorithm is used to simultaneously maximize node coverage, balance the node density of key switches, and minimize the total cost of data paths and out-of-band paths. The switches in the global route are selected to obtain the key switches representing the region, and monitoring areas are formed according to the distribution of key switches and their associated load connections to divide the network containing the global routing information into multiple monitoring areas.

[0020] Furthermore, the objective of the key switch selection algorithm is converted into an optimization problem, and the corresponding formula is:

[0021]

[0022] in, represents the objective of the key switch selection algorithm; represents the i-th switch in the switch set S, represents the jth switch in the switch set S; represents the out-of-band path cost of the j-th switch, calculated as the number of hops in the out-of-band path from the j-th switch to the software-defined network controller; represents the data path cost between the i-th switch and the j-th switch, which is determined by measuring the number of hops in the data path between the i-th switch and the j-th switch; represents the node coverage of the jth switch, which is calculated as the number of other nodes monitored by the jth switch; It represents the forwarding coverage of the network, which is obtained by calculating the sum of the node coverage of all switches.

[0023] Further, the key switch selection algorithm is used to identify a group of switches as key switches, and divide the global routing of the network into different monitoring areas according to the distribution of the key switches and their associated load connections; the key switches are specifically switches that can maximize the coverage of the data path while minimizing the overhead cost of the report message between the software-defined network controller and the data plane;

[0024] The key switch selection algorithm specifically includes the following process:

[0025] (1.2.1) Initialize the key switch selection algorithm: Determine the variables and data structures required for the key switches and initialize them, including: Creating a maximum heap H to store each switch The node density The negative value is filled into the heap H for initialization; the key switch set , the total path cost set W, the monitoring area set A, the neighbor switch set M and the covered node set B are initialized to empty; the index i of the key switch is initialized to 0;

[0026] (1.2.2) Select key switches and update monitoring areas: Extract node density from heap H The largest switch , determine the switch Is it in the key switch set? If the switch In key switch assembly , return to the current step (1.2.2) and execute the next iteration; otherwise, the selected switch Added as a critical switch to the critical switch collection In the example, the monitoring area is updated according to its neighbor switches, specifically including: first, the neighbor switch set M is updated to include reachable, uncovered switches, and the neighbor switches in the neighbor switch set M are added to the covered node set B to update the covered node set B, and then the key switch is calculated. The cost And add it to the total path cost set W. Secondly, identify the key switches to be included in the monitoring area and the load nodes to be monitored by taking the node density threshold and The minimum value between and rounded down to obtain the load balancing number, and the key switch is selected from the updated neighbor switch set M according to the load balancing number. Monitor the load nodes and switch the critical The load nodes to be monitored are added to the i-th monitoring area, completing the update of the monitoring area set A;

[0027] (1.2.3) Update the node density and heap H of the remaining switches: by traversing the switches that are not in the covered node set B The neighbor switches are iteratively updated. For each neighbor switch , its node density Decrease by 1, and add the updated node density value back to the heap H, and remove the key switch selected in step (1.2.2) and its connected load nodes from the heap H;

[0028] (1.2.4) Repeat steps (1.2.2) to (1.2.3) until all nodes are covered or the heap H is empty;

[0029] (1.2.5) After the loop process is completed, the selected key switch set is obtained , the total path cost set W and the monitoring area set , thus completing the selection process of key switches, where represents the jth key switch, the key switch set There are m key switches in the CCP. represents the jth monitoring area, and there are m monitoring areas in the monitoring area set A.

[0030] Furthermore, the step (2) includes the following sub-steps:

[0031] (2.1) Offline training of an improved random forest model in each monitoring area, where the improved random forest model is obtained by adding importance parameters of time series features to the basic random forest model; and systematically testing various parameter combinations to achieve the highest accuracy, to obtain the most accurate trained random forest model;

[0032] (2.2) In the software-defined network controller, all trained random forest models are converted into forwarding rules that meet the P4 switch specifications using a random forest-based forwarding rule generation algorithm;

[0033] (2.3) The software-defined network controller embeds the final forwarding rules into the flow table of the designated key switch through the P4 driver to be installed in the key switch.

[0034] Furthermore, the step (2.1) includes the following sub-steps:

[0035] (2.1.1) Using the input monitoring area set , the number of decision trees d in the improved random forest model and the ratio f of the current training set to the total training set have an impact on the random forest model set And the final forwarding rule set Initialize;

[0036] (2.1.2) During the offline training phase, for each monitoring area , first use the monitoring area The training set D of the decision tree q estimates the importance of each feature ; The importance of these features is then normalized to produce a probability distribution ; Feature selection and decision tree training are then performed for a total of d iterations; in each iteration, a new training data set is generated by randomly sampling from the training set D , and based on the probability distribution Selecting a subset of features , and then use the new training data set and feature subsets Train the decision tree q to obtain the monitoring area The qth trained decision tree Finally, the d trained decision trees are aggregated and the random forest model is optimized by testing the parameter combination that produces the highest accuracy within the predefined range to obtain the monitoring area The corresponding trained random forest model .

[0037] Furthermore, the random forest-based forwarding rule generation algorithm is used to generate, for each monitoring area, a forwarding rule that complies with the P4 switch specification and directly filters the decoy host at the switch level based on the trained random forest model corresponding to the monitoring area, specifically including the following process:

[0038] (2.2.1) The overall objective function of the random forest-based forwarding rule generation algorithm is determined as ,in, Indicates the overall traffic classification accuracy of the current monitoring area, which is determined by the minimum traffic classification accuracy of all switches in the current monitoring area; Represents the weight factor used to balance classification time and classification accuracy; Indicates the overall classification time of the current monitoring area, which is determined by the maximum classification time of all switches in the current monitoring area;

[0039] (2.2.2) The overall objective function determined in step (2.2.1) is To optimize the target, each monitoring area The corresponding trained random forest model Convert to a set of forwarding rules This conversion ensures that the converted forwarding rules are suitable for traffic level classification and prediction and fully comply with the P4 switch specification; finally, the forwarding rules corresponding to all random forest models are aggregated into the final forwarding rule set middle.

[0040] Furthermore, in the step (3), when performing online traffic classification, each key switch classifies the abnormal traffic directed to the bait host at line speed according to the link flooding attack, runs the forwarding rules that apply the classification principle of the random forest model, so as to convert the custom features of the incoming abnormal traffic and normal traffic into corresponding binary string representations, and then compares the traffic to be predicted with the example binary string representation to determine the type of the traffic to be predicted, and detects the abnormal traffic targeting the bait host at line speed.

[0041] A second aspect of an embodiment of the present invention provides a device for identifying a decoy host under a link flooding attack, comprising one or more processors and a memory, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-mentioned method for identifying a decoy host under a link flooding attack.

[0042] A third aspect of an embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, it is used to implement the above-mentioned method for identifying a bait host under a link flooding attack.

[0043] The beneficial effect of the present invention is that the present invention first divides the network into smaller monitoring areas by selecting key switches, significantly reducing the interaction between the controller and the data plane, and effectively reducing the communication overhead; then, the RF-based forwarding rules are used in the switch to efficiently classify the traffic with time series characteristics, and then the address of the bait host under LFA is located, thereby maximizing the accuracy and time efficiency of the identification of the bait host under LFA; the present invention can also accurately identify the bait host under LFA under a mixed traffic including LFA attack traffic and benign traffic constructed according to the CAIDA traffic trajectory of the real Internet data set. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1It is a schematic diagram of the process of LFA attack of the present invention;

[0045] Figure 2 It is a structural block diagram of a process of using RF to identify decoys under LFA in SDN of the present invention;

[0046] Figure 3 It is a structural block diagram of a mechanism for identifying decoys under LFA by using RF in SDN of the present invention;

[0047] Figure 4 is a schematic diagram of the operation of the key switch selection algorithm of the present invention;

[0048] Figure 5 It is a schematic diagram of the operation of the RF-based forwarding rule generation algorithm of the present invention;

[0049] Figure 6 It is a structural schematic diagram of the device for identifying a bait host under a link flooding attack of the present invention. DETAILED DESCRIPTION

[0050] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0051] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0052] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0053] The present invention is described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the features of the following embodiments and implementations can be combined with each other.

[0054] In the Internet, for invisible link flooding attacks, defenders need to accurately identify victim decoy hosts outside the link, namely, target decoy hosts (decoys). Therefore, the identification method of decoy hosts under link flooding attacks (Link Flooding Attack, LFA) in software-defined networks (Software-Defined Networking, SDN) of the present invention can accurately distinguish flood traffic characteristics and benign characteristics in time series. The identification method uses a random forest (Random Forest, RF) model to effectively identify decoy hosts under invisible link flooding attacks, reduces the communication overhead between the SDN controller and the data plane and within the data plane, and maximizes the accuracy and time efficiency of identifying decoy hosts under LFA.

[0055] See also Figure 2 The identification process of the bait host under the link flooding attack shown in Figure 2 and Figure 3 The identification mechanism and principle shown in the figure describe in detail the method for identifying a decoy host under a link flooding attack of the present invention, which specifically includes the following steps:

[0056] (1) Obtain global routing information in the SDN controller, select switches based on the global routing information to obtain key switches representing the region, and divide the network into multiple monitoring areas according to the distribution of key switches.

[0057] (1.1) Based on the centralized routing control function of the SDN controller, obtain global routing information, which includes hosts, switches, and forwarding paths.

[0058] It should be understood that the centralized routing control function of the SDN controller is mainly to use the centralized routing function to obtain global routing information in the network, and the switches in the subsequent operation process upload reporting information to the controller.

[0059] In this embodiment, since the identification of the decoy host needs to be performed after mastering the global routing information in the network under the link flooding attack environment, the link flooding attack is first simulated based on the open data set CAIDA, and then the real attack environment is simulated to obtain the global routing information, where the global routing information includes routing information such as the host, switch, and forwarding path. Specifically, first, the corresponding nodes and links of the host and switch are generated based on the open data set CAIDA to form a network topology for simulation to simulate the link flooding attack. The process is as follows: Figure 1As shown, the leaf nodes represent hosts and the non-leaf nodes represent switches. Then, the global route is pre-built using the Dijkstra algorithm to determine the shortest data path between communication pairs, covering the out-of-band management network and the service network, where the communication is established through the gRPC protocol to facilitate lightweight and efficient exchanges between the SDN controller and the switch, so that reports from key switches can be received in a timely manner with minimal delay. Finally, based on the constructed global route, the global routing information can be collected through communication during the simulation process. Assume that P is the set of all nodes (i.e., switch nodes) in the global route, that is ,in represents the i-th node in the global routing, Indicates that there are a total of nodes; R is the set of all forwarding paths in the global routing, that is, ,in Represents a slave node The forwarding path that starts Indicates that there are a total of forwarding path.

[0060] It should be understood that the Dijkstra algorithm is a typical single-source shortest path algorithm, which is used to calculate the shortest path from one node to all other nodes. Therefore, the Dijkstra algorithm is used to construct a global route, in which the shortest data path is between each communication pair.

[0061] (1.2) Based on the global routing information, a key switch selection algorithm is used to simultaneously maximize node coverage, balance the node density of key switches, and minimize the total cost of data paths and out-of-band paths. The switches in the global route are selected to obtain the key switches representing the region, and monitoring areas are formed according to the distribution of key switches and their associated load connections to divide the network containing the global routing information into multiple monitoring areas.

[0062] In this embodiment, the key switch selection algorithm aims to reduce the communication overhead by minimizing the message volume and delay of report transmission between the switch and the SDN controller, where the communication overhead includes the cost caused by the number of messages exchanged and their associated time delay. The operation process of the key switch selection algorithm is as follows: Figure 4As shown in the figure, in SDN, communication overhead is affected by the frequency of message exchange. By managing the static total path cost, the frequency of message exchange can be reduced, thereby reducing the impact of the message exchange frequency and reducing the communication overhead. The static total path cost is quantified by the number of hops. The static total path cost includes the data path cost and the out-of-band path cost. The data path cost reflects the number of hops between switches, and the out-of-band path cost reflects the number of hops from the switch to the SDN controller. Optimizing communication overhead requires balancing coverage and node density between key switches, because effective coverage ensures that all network nodes are monitored, while balanced node density avoids the problem of excessive traffic on any single switch, which may increase overhead.

[0063] Furthermore, the goal of the key switch selection algorithm is to maximize node coverage, balance the node density of key switches, and minimize the total cost of data paths and out-of-band paths at the same time; among them, balancing the node density of key switches can achieve the balance of network monitoring by presetting a node density threshold. The goal of the key switch selection algorithm is converted into an optimization problem, which is expressed as:

[0064]

[0065] in, represents the objective of the key switch selection algorithm; represents the i-th switch in the switch set S, represents the jth switch in the switch set S; represents the out-of-band path cost of the j-th switch, calculated as the number of hops in the out-of-band path from the j-th switch to the SDN controller; represents the data path cost between the i-th switch and the j-th switch, which is determined by measuring the number of hops in the data path between the i-th switch and the j-th switch; represents the node coverage of the jth switch, which is calculated as the number of other nodes monitored by the jth switch; It represents the forwarding coverage of the network, which is obtained by calculating the sum of the node coverage of all switches. By maximizing it, as many nodes as possible can be monitored.

[0066] Furthermore, the key switch selection algorithm is used to identify a group of switches with high node density as key switches, and divide the global routing of the network into different monitoring areas according to the distribution of key switches and their associated load connections. The key switches are specifically switches that can maximize the coverage of the data path while minimizing the report message overhead cost between the SDN controller and the data plane. The key switch selection algorithm achieves balanced and efficient network monitoring. The key switch selection algorithm specifically includes the following processes:

[0067] (1.2.1) Initialize the key switch selection algorithm: Determine the variables and data structures required for the key switches and initialize them, including: Creating a maximum heap H to store each switch The node density The negative value of is filled into the heap H for initialization, which can effectively avoid using 0 as its initial value; the key switch set , the total path cost set W, the monitoring area set A, the neighbor switch set M and the covered node set B are initialized to empty; the index i of the key switch is initialized to 0. The above preparations provide the necessary states for recording switch selection.

[0068] It should be understood that in the key switch selection algorithm, a maximum heap H is used so that the switch with the largest node density can be popped out each time. The node density is a related function of the node coverage. The switch node with the largest node density value is selected and popped out. After being initialized to a negative value, each switch node is first assigned the number of load nodes connected to it, and then the comprehensive balance degree is converted into the node density function value according to the operation of the key switch selection algorithm.

[0069] It should be noted that since one monitoring area corresponds to one key switch, i in the key switch selection algorithm represents the index of each selected key switch, that is, the index of the divided monitoring area. Therefore, in the early stage, when traversing and calculating all candidate switches, j is used as the index of the switch, and i is used as the index of the key switch, which also represents the index of the monitoring area.

[0070] (1.2.2) Select key switches and update monitoring areas: Extract node density from heap H The largest switch , determine the switch Is it in the key switch set? If the switch In key switch assembly , return to the current step (1.2.2) and execute the next iteration, so that only the unselected switches are evaluated; otherwise, the selected switches Added as a critical switch to the critical switch collection In the example, the monitoring area is updated according to its neighbor switches, specifically including: first, the neighbor switch set M is updated to include reachable, uncovered switches, and the neighbor switches in the neighbor switch set M are added to the covered node set B to update the covered node set B, and then the key switch is calculated. The cost And add it to the total path cost set W. Secondly, identify the key switches to be included in the monitoring area and the load nodes to be monitored by taking the node density threshold and The minimum value between and rounded down to obtain the load balancing number, and the key switch is selected from the updated neighbor switch set M according to the load balancing number. Monitor the load nodes and switch the critical The load nodes to be monitored are added to the i-th monitoring area, completing the update of the monitoring area set A.

[0071] It should be understood that by the node density threshold The node density of key switches can be balanced to achieve a balanced network monitoring, which can minimize the total path cost while ensuring sufficient node coverage and node density balance. The number of other nodes connected to it, so according to the load balancing number, the key switch can be selected from the updated neighbor switch set M The number of monitored load nodes is the load balancing number.

[0072] (1.2.3) Update the node density and heap H of the remaining switches: by traversing the switches that are not in the covered node set B The neighbor switches are iteratively updated. For each neighbor switch , its node density Decrease by 1 and add the updated node density value back to the heap H, and remove the key switch selected in step (1.2.2) and its connected load nodes from the heap H.

[0073] (1.2.4) Repeat steps (1.2.2)-(1.2.3) until all nodes are covered or the heap H is empty. In this loop, the check condition of the key switch selection algorithm is and .

[0074] (1.2.5) After the above cycle is completed, the selected key switch set is obtained , the total path cost set W and the monitoring area set , thus completing the selection process of key switches, where represents the jth key switch, the key switch set There are m key switches in the CCP. represents the jth monitoring area, there are m monitoring areas in the monitoring area set A, and the key switches correspond to the monitoring areas one by one. The last step ensures that there is no overlap between areas, thereby improving the overall efficiency.

[0075] (2) Offline training of an improved RF model for traffic classification in each monitoring area to achieve the highest accuracy. All trained RF models are then converted into forwarding rules that comply with P4 switch specifications in the SDN controller and installed on key switches.

[0076] It should be understood that each monitoring area corresponds to an improved RF model. For all monitoring areas, the improved RF model of each monitoring area is trained and saved offline at the same time to obtain the trained RF models corresponding to all monitoring areas, where the parameters of each trained RF model may be different.

[0077] (2.1) Offline training of an improved RF model in each monitoring area, where the improved RF model is obtained by adding importance parameters of time series features to the basic RF model; and systematically testing various parameter combinations to achieve the highest accuracy, thereby obtaining a trained RF model with the highest accuracy.

[0078] It should be noted that the RF model is a classification model based on the concept of ensemble learning. It builds and combines multiple decision trees to make predictions and obtain classification results. By adding the importance parameters of time series features (such as time, traffic rate, and throughput fluctuations) to the RF model, an improved RF model can be obtained, which helps to improve classification efficiency.

[0079] (2.1.1) Using the input monitoring area set , the number of decision trees d in the improved RF model and the ratio f of the current training set to the total training set have an impact on the RF model set And the final forwarding rule set Initialization is performed, laying the foundation for the subsequent RF model training and forwarding rule generation.

[0080] (2.1.2) During the offline training phase, for each monitoring area , first use the monitoring area The training set D of the decision tree q estimates the importance of each feature ; The importance of these features is then normalized to produce a probability distribution ; Since the improved RF model increases the importance of time series features such as time, traffic rate, and throughput fluctuation patterns, which are crucial for effective anomaly detection during the training process, feature selection and decision tree training are subsequently performed for a total of d iterations; in each iteration, a new training dataset is generated by randomly sampling from the training set D , and based on the probability distribution Selecting a subset of features , and then use the new training data set and feature subsets Train the decision tree q to obtain the monitoring area The qth trained decision tree Finally, the d trained decision trees are aggregated to optimize the generalization ability of the RF model by testing the parameter combination that produces the highest accuracy within the predefined range to obtain the monitoring area The corresponding trained RF model , trained RF model The accuracy is the highest. In summary, in the above offline training stage, the importance of each feature in the training set of each monitoring area is estimated and standardized, and the accuracy of the RF model is ensured through multiple decision tree training iterations. Finally, the offline training process is ended, providing a highly accurate RF model for the subsequent forwarding rule generation.

[0081] It should be noted that the training set contains information reported by the SDN controller from each monitoring area, including traffic characteristics, time series characteristics, and information about the monitoring area. Traffic characteristics include source IP, destination IP, protocol, and packet size; time series characteristics include time, traffic rate, and throughput fluctuations; and information about the monitoring area includes key switch numbers and monitoring relationships. The features of each sample in the training set above come from the information reported by each monitoring area, and do not require real-time collection. Through P4, the SDN controller can dynamically define and update forwarding rules in the data plane to achieve refined programmability. This flexibility allows forwarding behaviors to be customized according to various network requirements, including detecting traffic anomalies, thereby enhancing network security measures. The input of the decision tree is the feature data in the training set, and the output is the traffic category. It relies on the idea of ​​ensemble learning, which reduces variance and improves prediction accuracy by averaging or voting multiple decision trees.

[0082] (2.2) In the SDN controller, the RF-based forwarding rule generation algorithm is used to transform all trained RF models into forwarding rules that comply with the P4 switch specifications.

[0083] In this embodiment, the RF-based forwarding rule generation algorithm is designed to create forwarding rules for key switches, thereby promoting efficient traffic classification, screening out decoy addresses, and achieving accurate and efficient traffic classification, which is essential for effective decoy host identification and timely detection of potential attack behaviors. The operation of the RF-based forwarding rule generation algorithm is shown in the figure below: Figure 5As shown in the figure, the RF-based forwarding rule generation algorithm can convert the RF model into forwarding rules, and then embed these forwarding rules into the switch. The switch can run these forwarding rules to further classify and help filter the IP addresses of the decoy hosts. After classification, the target address of the attack traffic is the address of the attacked decoy host.

[0084] Furthermore, the RF-based forwarding rule generation algorithm is used to generate forwarding rules that comply with the P4 switch specification for directly filtering decoy hosts at the switch level based on the trained RF model corresponding to each monitoring area, which is beneficial to improving classification accuracy and reducing processing time. The RF-based forwarding rule generation algorithm includes the following processes:

[0085] (2.2.1) The overall objective function of the RF-based forwarding rule generation algorithm is determined as ,in Indicates the overall traffic classification accuracy of the current monitoring area. It represents the weight factor used to balance the classification time and classification accuracy, which is a positive value. Indicates the overall classification time of the current monitoring area.

[0086] Specifically, the set of critical switches is modeled as The goal of the RF-based forwarding rule generation algorithm is to balance the overall classification accuracy and overall classification time efficiency by maximizing the classification accuracy while minimizing the classification time and deployment cost. The standard definition of this optimization is as follows: ① Overall traffic classification accuracy: determined by the minimum traffic classification accuracy of all switches in the current monitoring area. The overall traffic classification accuracy of the current monitoring area is improved by maximizing the minimum traffic classification accuracy in the current monitoring area, that is, if each switch Traffic classification accuracy satisfy , then the overall traffic classification accuracy Defined as ,in Indicates the minimum acceptable traffic classification accuracy between switches. A higher value indicates higher network accuracy and better traffic classification performance. ② Overall classification time: Each switch performs traffic classification tasks independently. The classification time is recorded as ,The overall classification time of the current monitoring area is defined as the maximum classification time of all switches in the current monitoring area, i.e. Taking all the above factors into consideration, the overall objective function of the RF-based forwarding rule generation algorithm can be determined as ,in is a positive weight factor used to balance classification time and classification accuracy, providing a key consideration for operators to ensure optimal decoy identification performance. This RF-based forwarding rule generation algorithm is critical to optimizing the overall traffic classification efficiency and accuracy, and directly affects the effectiveness of decoy identification under LFA.

[0087] (2.2.2) The overall objective function determined in step (2.2.1) is To optimize the target, each monitoring area The corresponding trained RF model Convert to a set of forwarding rules This conversion ensures that the converted forwarding rules are suitable for traffic level classification and prediction and fully comply with the P4 switch specification; finally, the forwarding rules corresponding to all RF models are aggregated into the final forwarding rule set middle.

[0088] It should be understood that, referring to the P4 switch specification, converting the code of the RF model into forwarding rules written in accordance with the P4 switch specification can ensure the compatibility of the P4 switch.

[0089] (2.3) The SDN controller will eventually forward the rule set By embedding the P4 driver into the flow table of the designated key switch and installing it in the key switch, it is convenient for the subsequent steps to realize the online traffic classification within the switch in the monitoring area.

[0090] (3) The forwarding rules installed on the key switches in each monitoring area are independently run to perform online traffic classification at line speed to obtain traffic classification results.

[0091] Furthermore, when performing online traffic classification, each key switch classifies the abnormal traffic directed to the bait host at line speed according to LFA. Since the forwarding rules encapsulated by the classification principle of the RF model can effectively convert the custom features of the incoming abnormal traffic and normal traffic into binary string representations, the forwarding rules using the classification principle of the RF model are run to convert the custom features of the incoming abnormal traffic and normal traffic into corresponding binary string representations, and then the traffic to be predicted is compared with the example binary string representation to determine the type of the traffic to be predicted, and the abnormal traffic targeting the bait host is detected quickly and efficiently at line speed.

[0092] It should be understood that in the online classification stage, the key switches in each monitoring area classify the traffic using the forwarding rules installed thereon, thereby identifying the address of the decoy host under LFA at the switch level and reporting the result to the SDN controller.

[0093] (4) The key switch reports the traffic classification results to the SDN controller, tracks and locates the address of the decoy host based on the traffic classification results and the classified data packets and traffic information, and reports it to the SDN controller.

[0094] Specifically, after obtaining the traffic classification result information, the address of the decoy host can be identified, because once the abnormal traffic is identified, the key switch will report the corresponding decoy host address to the SDN controller, that is, the destination address of the abnormal traffic. The classification process and the identification process are independently run simultaneously in the switch, which greatly shortens the time and can accurately track the address of the decoy host under LFA.

[0095] Corresponding to the above-mentioned embodiment of the method for identifying a decoy host under a link flooding attack, the present invention also provides an embodiment of a device for identifying a decoy host under a link flooding attack.

[0096] See also Figure 6 An embodiment of the present invention provides a device for identifying a decoy host under a link flooding attack, comprising one or more processors and a memory, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the method for identifying a decoy host under a link flooding attack in the above embodiment.

[0097] The embodiment of the device for identifying a decoy host under a link flooding attack of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory and running them. From the hardware level, if Figure 6 As shown, it is a hardware structure diagram of any device with data processing capability where the identification device of the bait host under the link flooding attack of the present invention is located, except Figure 6 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0098] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0099] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0100] An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the method for identifying a bait host under a link flooding attack in the above embodiment is implemented.

[0101] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capability and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0102] The above embodiments are only used to illustrate the design ideas and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design ideas disclosed by the present invention are within the protection scope of the present invention.

Claims

1. A method for identifying a decoy host under a link flooding attack, characterized in that: The following steps are involved: (1) obtaining global routing information in a software-defined network controller, selecting switches based on the global routing information to obtain key switches representing the regions, and dividing the network into multiple monitoring regions according to the distribution of the key switches; the key switches are specifically switches that can maximize the coverage of the data path while minimizing the overhead cost of the report message between the software-defined network controller and the data plane; (2) Offline training of an improved random forest model for traffic classification in each monitoring area to achieve the highest accuracy. All trained random forest models are then converted into forwarding rules that comply with P4 switch specifications in the software-defined network controller and installed on key switches. (3) The forwarding rules installed on the key switches in each monitoring area are independently run to perform online traffic classification at line speed to obtain traffic classification results; (4) The key switch reports the traffic classification results to the software-defined network controller, tracks and locates the address of the decoy host based on the traffic classification results and the classified data packets and traffic information, and reports it to the software-defined network controller.

2. The method for identifying a decoy host under a link flooding attack according to claim 1, characterized in that: The step (1) comprises the following sub-steps: (1.1) Based on the centralized routing control function of the software-defined network controller, obtain global routing information; wherein the global routing information includes hosts, switches, and forwarding paths; (1.2) Based on the global routing information, a key switch selection algorithm is used to simultaneously maximize node coverage, balance the node density of key switches, and minimize the total cost of data paths and out-of-band paths. The switches in the global routing are selected to obtain key switches representing the region, and monitoring areas are formed according to the distribution of key switches and their associated load connections to divide the network containing the global routing information into multiple monitoring areas.

3. The method for identifying a decoy host under a link flooding attack according to claim 2, characterized in that: The goal of the key switch selection algorithm is converted into an optimization problem, and the corresponding formula is: Where U represents the goal of the key switch selection algorithm; s i represents the i-th switch in the switch set S, s j represents the jth switch in the switch set S; L j represents the out-of-band path cost of the j-th switch, calculated as the number of hops in the out-of-band path from the j-th switch to the software-defined network controller; T(i,j) represents the data path cost between the i-th switch and the j-th switch, determined by measuring the number of hops in the data path between the i-th switch and the j-th switch; coverage(j) represents the node coverage of the j-th switch, calculated as the number of other nodes monitored by the j-th switch; It represents the forwarding coverage of the network, which is obtained by calculating the sum of the node coverage of all switches.

4. The method for identifying a decoy host under a link flooding attack according to claim 2, characterized in that: The key switch selection algorithm is used to identify a group of switches as key switches and divide the global routing of the network into different monitoring areas according to the distribution of the key switches and their associated load connections; The key switch selection algorithm specifically includes the following process: (1.2.1) Initialize the key switch selection algorithm: Determine the variables and data structures required for the key switches and initialize them, including: creating a maximum heap H to store each switch s j The node density C j The negative value of is filled into the heap H for initialization; the key switch set S * , the total path cost set W, the monitoring area set A, the neighbor switch set M and the covered node set B are initialized to empty; the index i of the key switch is initialized to 0; (1.2.2) Select key switches and update the monitoring area: Extract node density C from the heap H j Largest switches j , determine the switch s j Is it in the key switch set S * If the switch s j In the key switch set S * , return to the current step (1.2.2) and execute the next iteration; otherwise, the selected switch s j Added as a key switch to the key switch set S * In the example, the monitoring area is updated according to its neighbor switches, specifically including: first, the neighbor switch set M is updated to include reachable, uncovered switches, and the neighbor switches in the neighbor switch set M are added to the covered node set B to update the covered node set B, and then the key switch s is calculated. j cost j And add it to the total path cost set W. Secondly, identify the key switches to be included in the monitoring area and the load nodes to be monitored. By taking the node density threshold α and C j The minimum value between and rounded down to obtain the load balancing number, and the key switch s is selected from the updated neighbor switch set M according to the load balancing number. j Monitor the load nodes and switch the critical j The load nodes to be monitored are added to the i-th monitoring area, completing the update of the monitoring area set A; (1.2.3) Update the node density and heap H of the remaining switches: By traversing the switches s that are not in the covered node set B j The neighbor switches are iteratively updated. For each neighbor switch s k , its node density C k Decrease by 1, and add the updated node density value back to the heap H, and remove the key switch selected in step (1.2.2) and its connected load nodes from the heap H; (1.2.4) Repeat steps (1.2.2) to (1.2.3) until all nodes are covered or the heap H is empty; (1.2.5) After the loop process is completed, the selected key switch set is obtained The total path cost set W and the monitoring area set A = {A1, A2, ..., A j ,…,A m }, thus completing the selection process of key switches, where represents the jth key switch, the key switch set S * There are m key switches in the CCP, A j represents the jth monitoring area, and there are m monitoring areas in the monitoring area set A.

5. The method for identifying a decoy host under a link flooding attack according to claim 1, characterized in that: The step (2) comprises the following sub-steps: (2.1) Offline training of an improved random forest model in each monitoring area, wherein the improved random forest model is obtained by adding the importance parameter of the time series features to the basic random forest model; and systematically testing various parameter combinations to achieve the highest accuracy, thereby obtaining a trained random forest model with the highest accuracy; (2.2) In the software-defined network controller, a random forest-based forwarding rule generation algorithm is used to transform all trained random forest models into forwarding rules that comply with the P4 switch specifications; (2.3) The software-defined network controller embeds the final forwarding rules into the flow table of the designated key switch through the P4 driver to be installed in the key switch.

6. The method for identifying a decoy host under a link flooding attack according to claim 5, characterized in that: The step (2.1) comprises the following sub-steps: (2.1.1) Using the input monitoring area set A = {A1, A2, …, A j ,…,A m }, the number of decision trees d in the improved random forest model and the ratio f of the current training set to the total training set for the random forest model set F M And the final forwarding rule set Initialize; (2.1.2) In the offline training stage, for each monitoring area A j , first use monitoring area A j The training set D of the decision tree q estimates the importance of each feature I j ; The importance of these features is then normalized to generate the probability distribution Q j ; Feature selection and decision tree training are then performed for a total of d iterations; In each iteration, a new training data set D(q,j) is randomly sampled from the training set D and based on the probability distribution Q j Select the feature subset F(q,j), and then use the new training data set D(q,j) and the feature subset F(q,j) to train the decision tree q to obtain the monitoring area A j Finally, the d trained decision trees are aggregated and the random forest model is optimized by testing the parameter combination that produces the highest accuracy within the predefined range to obtain the monitoring area A. j The corresponding trained random forest model 7. The method for identifying a decoy host under a link flooding attack according to claim 5, characterized in that: The random forest-based forwarding rule generation algorithm is used to generate, for each monitoring area, a forwarding rule that complies with the P4 switch specification and directly filters the bait host at the switch level based on the trained random forest model corresponding to the monitoring area, specifically including the following process: (2.2.1) The overall objective function of the random forest-based forwarding rule generation algorithm is determined as Among them, E e Indicates the overall traffic classification accuracy of the current monitoring area, which is determined by the minimum traffic classification accuracy of all switches in the current monitoring area; Represents the weight factor used to balance classification time and classification accuracy; V z Indicates the overall classification time of the current monitoring area, which is determined by the maximum classification time of all switches in the current monitoring area; (2.2.2) The overall objective function determined in step (2.2.1) is To optimize the target, each monitoring area A j The corresponding trained random forest model Convert to a set of forwarding rules This conversion ensures that the converted forwarding rules are suitable for traffic level classification and prediction and fully comply with the P4 switch specification. Finally, all the forwarding rules corresponding to the random forest model are aggregated into the final forwarding rule set. middle.

8. The method for identifying a decoy host under a link flooding attack according to claim 1, characterized in that: In the step (3), when performing online traffic classification, each key switch classifies the abnormal traffic directed to the bait host at line speed according to the link flooding attack, runs the forwarding rules that apply the classification principle of the random forest model, so as to convert the custom features of the incoming abnormal traffic and normal traffic into corresponding binary string representations, and then compares the traffic to be predicted with the example binary string representation to determine the type of the traffic to be predicted, and detects the abnormal traffic targeting the bait host at line speed.

9. A device for identifying a decoy host under a link flooding attack, comprising one or more processors and a memory, characterized in that: The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the method for identifying a bait host under a link flooding attack as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, it is used to implement the method for identifying a bait host under a link flooding attack as described in any one of claims 1-8.

Images