Link flooding attack cross-layer cooperative defense method and system based on weighted ensemble learning

Abstract

The invention provides a link flooding attack cross-layer cooperative defense method and system based on weighted ensemble learning, and belongs to the technical field of link flooding attack (LFA) defens.Metadata obtained through dynamic sampling telemetering is converted into a three-dimensional tensor to serve as input of an LFA prediction model based on weighted ensemble learning, and the LFA prediction model is subjected to LFA prediction; the attack intention is perceived and the attack node is positioned by fusing the multi-view feature learning ability of the diversified base model; according to an LFA prediction result, an LFA attack detection mechanism based on online clustering reasoning is activated in advance, nominal and ordinal number features are extracted, similar data packets are aggregated into a traffic cluster by adopting a Manhattan distance, and an adaptive LFA mitigation strategy is generated by analyzing the aggregation degree of the traffic cluster and evaluating the attack traffic cluster. According to the method, the attack intention can be dynamically perceived and accurately predicted, the contradiction between the limited data plane resource overhead and the attack response timeliness is balanced, the linear speed detection of the attack traffic is realized, and the adaptive defense strategy for different attack modes is generated.

Description

Technical Field

[0001] The present invention relates to the technical field of link flooding attack defense, and in particular to a cross-layer collaborative defense method and system for link flooding attack based on weighted ensemble learning. Background Art

[0002] As artificial intelligence (AI) and the Internet of Things (IoT) technologies are booming, the Artificial Intelligence Internet of Things (AIoT) has been widely used in the fields of medical care, office, transportation, entertainment, etc. due to its intelligence (smart decision-making) and scalability (massive access). However, the growing cloud data center business and the limited security computing capabilities of IoT terminal devices have increased the security risk of link flooding attacks (LFA). LFA is a special type of DDoS attack, such as Figure 1 As shown in the figure, LFA indirectly disrupts the services of critical infrastructure by flooding the bottleneck links of the target area with legitimate traffic or low-rate traffic. LFA has three main characteristics: 1) Undetectability. The target of the attack is not the victim itself, but the key connectivity nodes of the Internet service provider. Attack detection measures deployed at the victim's destination cannot effectively respond to LFA. 2) Indistinguishability. The attacker manipulates the botnet to generate large-scale low-rate traffic with non-spoofed addresses. Traditional DDoS defense systems cannot effectively distinguish between attack traffic and normal traffic. 3) Flexibility. The attacker alternately floods the optimal and disjoint suboptimal link sets in a short period of time. Traditional defenses that rely on offline middleware can be easily bypassed, and even cause hazards such as routing oscillation.

[0003] The existing LFA defense work is mainly completed under the software-defined network architecture. The decoupling of the control and data planes improves the openness and controllability of network management. Traditional defense algorithms include statistical analysis, machine learning, deep learning, etc., which usually run on a centralized control plane. They exchange traffic statistics with switches at runtime to obtain a global view and generate new defense decisions, which are then filled into the switch to defend against LFA. However, the lengthy process from sampling and detection on the control plane to the deployment of defense decisions on the data plane makes the response to LFA significantly delayed. If the adversary changes its attack vector quickly, the defense may fall into a loop of repeated installation without effective mitigation, or even suboptimal defense actions against outdated attack information may cause unnecessary damage. Therefore, it is difficult for existing technologies to meet the real-time requirements of LFA defense.

[0004] An emerging network paradigm, programmable data plane, provides a promising solution to defend against LFA directly on the switch. The introduction of the P4 programming language enables high-level configurable packet processing functions to be offloaded to forwarding devices. Recent research has used data plane programmability to collect and analyze network traffic statistics to detect and mitigate attacks (malicious traffic) in a timely manner. However, data plane resources are extremely limited and cannot meet the needs of fine-grained and complex analysis of all traffic statistics. In addition, running defense mechanisms all the time consumes unnecessary computing and storage resources, which has a negative impact on the forwarding performance of normal traffic. Traditional threshold-based defense activation methods either increase reaction latency and fail to defend against flexible LFA, or increase the probability of false positives at the expense of normal traffic. Therefore, it is difficult for existing technologies to achieve effective LFA defense under the constraints of limited resources. Summary of the invention

[0005] The purpose of the present invention is to provide a cross-layer collaborative defense method and system for link flooding attacks based on weighted ensemble learning to solve at least one technical problem existing in the above-mentioned background technology.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning, comprising:

[0008] The metadata of each switch is collected at dynamic intervals, and the in-band telemetry frequency is dynamically adjusted according to the changes in the network traffic size. The fine-grained real-time network status is obtained in large traffic scenarios, and the network status is modeled as a spatiotemporal graph to capture the changes in the network status. The collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of the network status and the traffic change rate.

[0009] After obtaining the three-dimensional tensor, it and the adjacency matrix of the space-time graph are used as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switch through which the attack flow passes. Among them, the LFA prediction model adopts a weighted ensemble learning method, combining the diversified advantages of base models including decision tree (DT), support vector machine (SVM), temporal convolutional network (TCN), graph convolutional neural network (GCN), etc. (for example, TCN convolves the three-dimensional tensor from the perspective of time to extract the temporal features of the data; GCN convolves the three-dimensional tensor with the adjacency matrix to extract the spatial features of the data). Through the dynamic weighted voting mechanism, the independent prediction opinions of the base models are effectively integrated to generate more reliable attack prediction results.

[0010] According to the prediction results of the LFA prediction model, the nominal and ordinal features are extracted from the packet header, and similar packets are aggregated into a traffic cluster based on the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and a link flood attack mitigation strategy is generated to mitigate link flood attacks.

[0011] Furthermore, the metadata of each switch is dynamically sampled to obtain a fine-grained real-time network status, including: first, according to the traffic size, the dynamic sampling interval is calculated, and the INT header containing the telemetry instruction is inserted after the header of the specified user data packet; then, according to different telemetry instructions, the real-time fine-grained metadata information is inserted into the data packet in sequence to realize the collection of diversified network status information; finally, after the data packet reaches the aggregation node switch, the INT report containing the measurement metadata information is sent to the network telemetry server of the control plane, and the user payload is forwarded to the destination; wherein, when the sampling is performed, the source node inserts the INT instruction in the header of the telemetry data packet; if the data packet contains the INT instruction, all the specified INT metadata of each switch it passes through will be written into it; otherwise, no metadata is written.

[0012] Furthermore, by converting the metadata, a three-dimensional tensor containing the feature vectors of all nodes at different times is obtained. Where f is the number of features of each node, |V| is the number of nodes, and m is the number of time slices; is the graph signal of the t-th time interval, corresponding to the traffic characteristics of each node in the time series graph G at time t; the metadata is classified according to the switch ID; the size of the time slice τ is set, the mean of all states collected in each time slice and the traffic change rate are calculated, and the feature vectors of all switches in a time slice are obtained; finally, a three-dimensional feature tensor X is obtained, which contains the feature vectors of all switches in multiple time slices, and the feature vectors are composed of multiple state information.

[0013] Furthermore, the LFA prediction model dynamically allocates voting weights according to the training performance of the base model. In order to make the weight allocation smoother, the Softmax function is used to normalize the weights. Then the base model predicts the attack intention of the current test sample (for example, TCN uses an extended causal convolution module to model the time dependency of the traffic of each node in the time series graph, and predicts based on the learned time dependency, and GCN uses a graph convolution module and a 1×1 convolution module to model the traffic correlation between nodes, and predicts based on the learned traffic correlation). Soft voting is used to output the modified attack intention prediction result in combination with factors such as the voting weight coefficient and the confidence adjustment coefficient.

[0014] Furthermore, first, |C| random data packets are used to initialize clustering; then, for each newly arrived data packet, each feature distance of all clusters is calculated to calculate its distance to each cluster, and they are aggregated into the nearest cluster; the closer the distance between the data packet and the cluster, the more relevant it is to the behavioral intention of the data packets in the cluster; finally, the cluster aggregation rate is used to evaluate the possibility that each cluster contains attack traffic, so as to detect malicious attack data packets.

[0015] Furthermore, by periodically polling the evaluation results of the cluster aggregation rate of the detection component, the rate limit strategy for the aggregated traffic corresponding to each cluster is derived; the transmission data packets subsequently mapped to the malicious attack cluster will be restricted to be sent to discard the excess traffic, thereby alleviating the link flooding attack; where the rate limit window is calculated as: W TL =μ-γ×α×R arr ; where μ is the average of all cluster arrival rates and α is a constant set by the administrator to determine the aggressiveness of the penalty; if α is equal to 0, no penalty is applied and badly behaved flows receive a fair share of the bandwidth; if α is equal to 1, a maximum exponential penalty is applied proportionally to badly behaved flows.

[0016] In a second aspect, the present invention provides a cross-layer collaborative defense system for link flooding attacks based on weighted ensemble learning, comprising:

[0017] The acquisition module is used to dynamically sample the metadata of each switch to obtain fine-grained real-time network status and model the network status as a spatiotemporal graph to capture changes in the network status. The collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of network status and traffic change rate.

[0018] The prediction module is used to obtain the three-dimensional tensor and use it and the adjacency matrix of the space-time graph as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switch through which the attack flow passes. The LFA prediction model integrates the independent prediction results of the diversified models through the weighted ensemble learning method, combines the time learning and space learning characteristics of different base models, and outputs the modified attack intent prediction results in the form of dynamic weighted voting;

[0019] The strategy generation module is used to extract nominal and ordinal features from the packet header according to the prediction results of the LFA prediction model, and aggregate similar packets into a traffic cluster according to the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and the link flood attack mitigation strategy is generated to mitigate the link flood attack.

[0020] In a third aspect, the present invention provides a non-transitory computer-readable storage medium, which is used to store computer instructions. When the computer instructions are executed by a processor, the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described in the first aspect is implemented.

[0021] In a fourth aspect, the present invention provides a computer device comprising a memory and a processor, wherein the processor and the memory communicate with each other, the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described in the first aspect.

[0022] In a fifth aspect, the present invention provides an electronic device, comprising: a processor, a memory, and a computer program; wherein the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes instructions for implementing the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described in the first aspect.

[0023] The beneficial effects of the present invention are as follows: by deploying the LFA prediction model based on weighted ensemble learning on the control plane and integrating the multi-view feature learning capabilities of the diversified base model, the attack intention is captured, the location where the attack may occur is located, and the high-throughput and low-latency defense mechanism of the programmable data plane is activated in advance. Thus, cross-layer collaboration can effectively balance the contradiction between the limited resource overhead of the data plane and the timeliness of the response to the attack.

[0024] The LFA defense algorithm for the programmable data plane runs completely on the data plane and does not rely on the global perspective and pre-trained machine learning model of the control plane. It can achieve line-speed detection of abnormal traffic and generate real-time defense strategies that adapt to different attack modes.

[0025] Additional advantages of the present invention will be more clearly given in the following description or learned through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0027] Figure 1 The present invention is a flowchart of a cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning according to an embodiment of the present invention.

[0028] Figure 2 The figure is a schematic diagram of a network telemetry process based on adaptive sampling according to an embodiment of the present invention.

[0029] Figure 3 This is a functional block diagram of the LFA attack prediction model based on weighted ensemble learning described in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The embodiments described below by the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

[0031] It should be understood by those skilled in the art that unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this invention belongs.

[0032] It should also be understood that terms, such as those defined in commonly used dictionaries, should be understood to have a meaning consistent with that in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless as defined herein.

[0033] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements and / or groups thereof.

[0034] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. Different embodiments or examples described in this specification and features of different embodiments or examples may be combined and combined by those skilled in the art without contradiction.

[0035] To facilitate understanding of the present invention, the present invention is further explained below with reference to specific embodiments in conjunction with the accompanying drawings, and the specific embodiments do not constitute a limitation on the embodiments of the present invention.

[0036] Those skilled in the art should understand that the drawings are merely schematic diagrams of embodiments, and the components in the drawings are not necessarily necessary for implementing the present invention.

[0037] Example 1

[0038] In this embodiment 1, a cross-layer collaborative defense system for link flooding attacks based on weighted ensemble learning is first provided, including: an acquisition module, which is used to dynamically sample the metadata of each switch to obtain a fine-grained real-time network state, and model the network state as a spatiotemporal graph to capture changes in the network state; wherein the collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times, and the spatiotemporal feature vectors are composed of network states and flow change rates; a prediction module, which is used to, after obtaining the three-dimensional tensor, use it and the adjacency matrix as inputs of the LFA prediction model to perceive the attack intent of the flow and locate the switch through which the attack flow passes; wherein the LFA prediction model adopts a weighted ensemble learning method, combines the different advantages of the diversified base models, and effectively integrates their independent prediction opinions through a dynamic weighted voting mechanism to generate more reliable attack prediction results; a strategy generation module, which is used to extract nominal and ordinal features from the data packet header according to the prediction results of the LFA prediction model, and aggregate similar data packets into a traffic cluster according to the Manhattan distance, and by analyzing the aggregation degree of the traffic cluster, evaluate the possibility of it containing attack traffic, generate a link flooding attack mitigation strategy, and mitigate the link flooding attack.

[0039] In this embodiment, the above-mentioned system is used to implement a cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning, including: dynamically sampling the metadata of each switch to obtain a fine-grained real-time network state, and modeling the network state as a spatiotemporal graph to capture changes in the network state; wherein the collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times, and the spatiotemporal feature vectors are composed of network states and flow change rates; after obtaining the three-dimensional tensor, it and the adjacency matrix are used as inputs of the LFA prediction model to perceive the attack intent of the flow and locate the switch through which the attack flow passes; wherein the LFA prediction model adopts a weighted ensemble learning method, combines the different advantages of the diversified base models, and effectively integrates their independent prediction opinions through a dynamic weighted voting mechanism to generate more reliable attack prediction results; according to the prediction results of the LFA prediction model, the nominal and ordinal features are extracted from the data packet header, and similar data packets are aggregated into a traffic cluster according to the Manhattan distance, and by analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and a link flooding attack mitigation strategy is generated to mitigate link flooding attacks.

[0040] The metadata of each switch is dynamically sampled to obtain a fine-grained real-time network status, including: first, according to the traffic size, the dynamic sampling interval is calculated, and the INT header containing the telemetry instruction is inserted after the user data packet header; then, according to different telemetry instructions, the real-time fine-grained metadata information is inserted into the data packet in sequence to realize the collection of diversified network status information; finally, after the data packet reaches the aggregation node switch, the INT report containing the measurement metadata information is sent to the network telemetry server of the control plane, and the user payload is forwarded to the destination; wherein, when the sampling is performed, the source node inserts the INT instruction in the telemetry data packet header; if the data packet contains the INT instruction, all the specified INT metadata of each switch it passes through will be written into it; otherwise, no metadata is written.

[0041] By converting the metadata, we get a three-dimensional tensor containing the feature vectors of all nodes at different times. Where f is the number of features of each node, |V| is the number of nodes, and m is the number of time slices; is the graph signal of the t-th time interval, corresponding to the traffic characteristics of each node in the time series graph G at time t; the metadata is classified according to the switch ID; the size of the time slice τ is set, the mean of all states collected in each time slice and the traffic change rate are calculated, and the feature vectors of all switches in a time slice are obtained; finally, a three-dimensional feature tensor X is obtained, which contains the feature vectors of all switches in multiple time slices, and the feature vectors are composed of multiple state information.

[0042] The LFA prediction model dynamically allocates voting weights according to the training performance of the base model. In order to make the weight allocation smoother, the Softmax function is used to normalize the weights. Then the base model predicts the attack intention of the current test sample (for example, TCN uses an extended causal convolution module to model the time dependency of the traffic of each node in the time series graph and makes predictions based on the learned time dependency. GCN uses a graph convolution module and a 1×1 convolution module to model the traffic correlation between nodes and makes predictions based on the learned traffic correlation). Soft voting is used to output the modified attack intention prediction results in combination with factors such as the voting weight coefficient and the confidence adjustment coefficient.

[0043] First, |C| random data packets are used to initialize clustering; then, for each newly arrived data packet, each feature distance of all clusters is calculated to calculate its distance to each cluster, and they are aggregated into the nearest cluster; the closer the distance between the data packet and the cluster, the more relevant it is to the behavioral intention of the data packets in the cluster; finally, the cluster aggregation rate is used to evaluate the possibility that each cluster contains attack traffic, so as to detect malicious attack data packets.

[0044] By periodically polling the evaluation results of the cluster aggregation rate of the detection component, the rate limit strategy for the aggregated traffic corresponding to each cluster is derived; the transmission data packets mapped to the malicious attack cluster will be restricted to be sent in order to discard the excess traffic, so as to alleviate the link flooding attack; the rate limit window is calculated as: W TL =μ-γ×α×R arr ; where μ is the average of all cluster arrival rates and α is a constant set by the administrator to determine the aggressiveness of the penalty; if α is equal to 0, no penalty is applied and badly behaved flows receive a fair share of the bandwidth; if α is equal to 1, a maximum exponential penalty is applied proportionally to badly behaved flows.

[0045] Example 2

[0046] like Figure 1 As shown, in this embodiment, a cross-layer collaborative programmable LFA defense method is proposed, which specifically includes two parts: an LFA prediction module based on weighted ensemble learning and an LFA defense module based on a programmable data plane. First, the LFA prediction module based on weighted ensemble learning is used to perceive the attack intention in a timely and accurate manner, and activate subsequent defense measures before the attack arrives, so as to save unnecessary resource waste in idle time. Compared with traditional queuing theory models and discrete event simulation schemes, the weighted ensemble learning model can integrate diversified machine learning models, and capture the changes in the global network state tensor from multiple angles such as time series and space under the constraints of limited computing cost and execution time, and more realistically restore the attack traffic behavior intention. Then, the LFA defense module based on the programmable data plane can detect and mitigate LFA at line speed without relying on the global perspective. By analyzing the ordinal and nominal features of the data packet, the Manhattan distance between it and each cluster is calculated to aggregate the malicious traffic on the abnormal switch. The detection algorithm identifies the attack traffic locally at line speed, does not rely on the global view of the controller, and can improve the efficiency of attack detection. By generating and deploying corresponding punitive traffic rate limit strategies based on the bandwidth encroachment behavior of each aggregated traffic cluster, dynamic adaptive defense against LFA can be achieved.

[0047] For LFA defense, the goal in this embodiment is to predict the attack intent of the traffic, locate the location of the attack flow, then pre-activate the attack detection mechanism, and execute an adaptive attack mitigation strategy. In this embodiment, the in-band network telemetry (INT) technology is used to dynamically sample the fine-grained real-time network status on the programmable switch, map the network status into a three-dimensional tensor, and establish an LFA prediction model based on weighted ensemble learning on the control plane. Then, based on the predicted network anomaly location, the LFA detection algorithm based on clustering reasoning is started locally on the switch to identify malicious traffic and generate an adaptive mitigation strategy for aggregated attack traffic clusters.

[0048] (1) LFA prediction based on weighted ensemble learning. First, the metadata of each switch is dynamically collected using INT technology. In order to reduce the additional consumption of CPU computing resources and bandwidth, an adaptive interval sampling method is used when executing INT. The INT report is parsed on the controller to obtain fine-grained network status. Then, the network is modeled as a spatiotemporal graph on the controller to capture changes in network status. Specifically, the collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The feature vector consists of the network status and traffic change rate collected by INT. After obtaining the three-dimensional tensor, it is used as the input of the LFA prediction model with the adjacency matrix of the graph. The prediction model adopts a weighted ensemble learning method, combining the different advantages of diversified base models (time series, topology feature learning, etc.), and effectively integrates their independent prediction opinions through a dynamic weighted voting mechanism, so as to more accurately perceive the attack intention of the traffic and locate the switches through which the attack flow passes.

[0049] (2) LFA defense based on programmable data plane. According to the LFA prediction results of the control plane, the defense mechanism of the switch on the attack path is activated. The defense mechanism consists of an attack detection module based on online clustering reasoning that runs entirely on the data plane and an adaptive attack mitigation module for aggregated traffic. The attack detection module based on online clustering reasoning extracts nominal and ordinal features from the headers of the arriving data packets and aggregates similar data packets into a traffic cluster based on the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic can be evaluated to generate the corresponding adaptive mitigation strategy. The adaptive attack mitigation module for aggregated traffic periodically polls the aggregation degree information of the traffic cluster and generates the speed limit window setting for the malicious traffic cluster. According to the adaptive penalty factor, the stronger the bandwidth occupation tendency, the greater the traffic speed limit. The attack defense mechanism processes all data packets at line rate on the data plane, can quickly respond to attack changes, adaptively adjust the mitigation strategy, and effectively reduce the interactive communication and flow table storage overhead.

[0050] LFA prediction based on weighted ensemble learning

[0051] In order for the LFA prediction model to consider both the network topology and the node timing characteristics when predicting attacks, this embodiment uses INT to dynamically sample the fine-grained real-time network status of the switch as the node feature, and then organizes the metadata obtained by INT into a three-dimensional state tensor as the input of the prediction model. Finally, based on the weighted ensemble learning model, the different learning characteristics of the diversified machine learning models are integrated to analyze the switch status when LFA occurs and identify the switches affected by the attack. This process can be divided into three parts: network status perception, three-dimensional tensor mapping, and prediction model establishment.

[0052] (1) Implementing network status awareness

[0053] Traditional network measurement technology is not only inefficient, but also has limited collection granularity. INT enables user data packets to directly carry network status information, providing a new way to measure networks. In this embodiment, an INT-based network status perception solution is adopted to collect network status information from the data plane forwarding device, ensuring the accuracy of telemetry information and the granularity of packet-level collection. In addition, according to the size of network traffic, the INT sampling interval is dynamically adjusted, and the collected network information is directly inserted into the user data packet, which can complete network status perception at the lowest cost under the premise of high statistical accuracy and save link bandwidth resources.

[0054] First, the INT header (INTHeader) containing telemetry instructions is inserted after the user data packet header (Packet Header). Then, according to different telemetry instructions (such as queue depth, link utilization, latency, port transmission rate and other metadata in the forwarding device), the real-time fine-grained metadata (Metadata) information is inserted into the data packet in sequence to achieve flexible collection of diversified network status information. Finally, after the data packet reaches the aggregation node switch, the INT report containing the measurement metadata information is sent to the network telemetry server of the control plane, and the user payload (Payload) is forwarded to the destination.

[0055] In actual scenarios, network traffic is huge. In order to reduce the computing and memory costs of the controller and the additional bandwidth costs required to transmit INT data in large-scale networks. In this embodiment, a sampling strategy is adopted when executing INT. If each data packet writes metadata according to the INT instruction in the packet header during forwarding. Since the state of the switch is obtained through data packets, the time interval between adjacent data packets passing through the same switch is very small, so the states of the same switch obtained by adjacent data packets are very similar, which means that part of the acquired data is redundant, which will cause unnecessary consumption of network bandwidth and computing resources. In order to avoid the redundancy problem, a trade-off is made between state granularity and bandwidth consumption in this embodiment, and an adaptive sampling method is adopted.

[0056] When performing sampling, the source node inserts the INT instruction in the telemetry packet header. If the packet contains the INT instruction, all the specified INT metadata for each switch it passes through will be written to it. Otherwise, no metadata is written, such as Figure 2 As shown. INT is the sampling interval, that is, the number of unsampled packets between two samples, and the calculation result is as follows:

[0057]

[0058] Where τ is the unit time interval, pktnum is the number of packets passing through the switch within the unit time interval τ, and η is the sampling constant. INT The sampling interval R varies according to the size of the network traffic. When the number of packets passing through the programmable switch per unit time increases, the sampling interval R INT The INT sampling does not require additional probe packets and does not affect the forwarding of normal packets. Compared with out-of-band telemetry methods, INT has extremely low measurement latency. Due to the adaptive sampling frequency, a more fine-grained network status perception is guaranteed.

[0059] (2) Three-dimensional feature tensor mapping

[0060] A network topology can be represented as a graph G = (V, E, A), where V is a set of programmable switch nodes whose characteristics change over time, and E is a set of edges, i.e., links between switches. is the weighted adjacency matrix of graph G. The connection weights a between adjacent nodes ij It is measured by the absolute value of the Pearson correlation coefficient ρ of the traffic time series. If two nodes are not adjacent, the weight is 0. Connection weight a ij and the correlation coefficient ρ ij The calculation formula can be expressed as:

[0061]

[0062] in, and is the traffic time series of nodes i and j, cov(·) is the covariance operator, σ i , σ j Represents the flow sequence The larger the absolute value of the correlation coefficient, the stronger the correlation between node traffic. When predicting the traffic of the target switch, the traffic data of adjacent nodes with higher connection weights in G (i.e., other nodes with strong correlation) can be used to assist in the prediction.

[0063] Based on the graph structure traffic data, in this embodiment, by converting the metadata, a three-dimensional tensor containing the feature vectors of all nodes at different times can be obtained. Where f is the number of features of each node, |V| is the number of nodes, and m is the number of time slices. It can be regarded as the graph signal of the t-th time interval, corresponding to the traffic characteristics of each node in G at time t. The prediction model learns the law of LFA affecting the network state from the perspectives of time and space based on X. In order to convert the metadata into a three-dimensional feature tensor X, the metadata is first classified according to the switch ID. Then, the size of the time slice τ is set, and the mean of all states collected in each time slice and the traffic change rate are calculated to obtain the feature vectors of all switches in a time slice. Finally, a three-dimensional feature tensor X is obtained, which contains the feature vectors of all switches in multiple time slices, and the feature vectors are composed of multiple state information.

[0064] Traffic characteristics include switch status collected through telemetry, namely, real-time fine-grained metadata such as queue depth, link utilization, latency, port transmission rate, etc. In addition, other indicators are also considered in this embodiment. For link flooding attacks, the behavior of a single flow often cannot reflect the malicious intentions of the attacker. Therefore, the traffic between adjacent switches is integrated into a traffic matrix (TM) to represent the traffic change trend and change amplitude of the link. If the two switches are not adjacent, the corresponding element of the traffic matrix TM(i,j) = 0. The rate of change of the traffic matrix The calculation is as follows:

[0065]

[0066] The numerator is the absolute sum of the differences between the elements of the two matrices in adjacent time intervals, and the denominator is TM t The absolute sum of the elements in (equal to the aggregate flow T t ), τ represents the unit time interval.

[0067] Furthermore, in this embodiment, the change rate of the aggregate flow is calculated To examine the macro dynamics of traffic within a network area, the calculation is as follows:

[0068]

[0069] Among them, T t represents the aggregate traffic rate. It is worth noting that in most cases, link traffic is more dynamic than total traffic. In other words, the traffic matrix is ​​more sensitive to changes in network status than the aggregate traffic rate. Even if the aggregate traffic remains unchanged (i.e. ), the traffic pattern exchanged between switches (in measurement) may still vary significantly. It is difficult to distinguish burst traffic from attack traffic. Therefore, in this embodiment, the aggregated traffic change rate is combined Determine whether LFA actually occurs. When the observation threshold is exceeded, it means that the traffic pattern in the area has undergone a fundamental change due to human factors. Locate the attacked switch.

[0070] (3) Weighted Ensemble Learning Prediction Model

[0071] LFA is continuous in time and has certain characteristics in time. In addition, when LFA flows enter the network and are forwarded between switches, the impact on the states of different switches must be different, and the differences in switch states must follow certain rules in space. Taking these factors into consideration, this embodiment constructs an LFA prediction model based on weighted ensemble learning. By integrating the different learning characteristics of diversified machine learning models, it attempts to simultaneously model and analyze the switch state when LFA occurs from multiple perspectives such as time and space, and identify the switches affected by the attack.

[0072] Figure 3 The overall process of building an LFA prediction model based on weighted ensemble learning is given, including three parts: base model training and evaluation, dynamic weight allocation, and weighted soft voting prediction. The weighted soft voting mechanism is the core part of its weighted ensemble learning model. By dynamically adjusting the weights of the base model, it can effectively integrate the advantages of diversified machine learning models, thereby improving the overall accuracy and robustness of the prediction of complex dynamic LFA attack patterns.

[0073] In the base model training and evaluation phase, the multi-view features in the data are captured by training on the same data set. Each base model is trained independently and outputs attack intent prediction results respectively. This ensures that in various data scenarios, at least one model can effectively predict attack intent. The training process can be expressed as

[0074] M i =T train (D train ,model)

[0075] Among them, T train (·) is the training process, D train is the training set, model is the base model type, M i is the base model obtained after training. Then, the performance of each base model is evaluated on the validation set, and the accuracy and other indicators are used as the basis for weight allocation. The evaluation formula of the base model performance can be expressed as

[0076] P i =T test (D test ,M i )

[0077] Among them, T test(·) is the test evaluation process, D test is the training set, M i is the base model to be evaluated, P i It is the accuracy of the base model. By evaluating the prediction performance of each model, it provides a basis for subsequent dynamic weight allocation and weighted soft voting. The better the model, the greater the weight.

[0078] In this embodiment, two representative base models, TCN and GCN, are used as examples to introduce the training and evaluation process of the base models. TCN uses an extended causal convolution module to model the temporal dependency of traffic at each node in G and predict attack intent, while GCN uses a graph convolution module and a 1×1 convolution module to model the traffic correlation between nodes and predict attack intent.

[0079] In this embodiment, a TCN-based model with faster training speed, simpler structure, and less reliance on previous time steps is used to extract the temporal features of the data. A two-layer stacked extended causal convolution structure is used to capture the temporal dependency (temporal dynamic pattern) of switch traffic. Figure 3 As shown, the expanded causal convolution operation slides over the input data X in a stride skipping value manner and applies a standard one-dimensional causal convolution to the selected value. By stacking the expanded causal convolution layers in increasing order, the receptive field of the convolution can be made to grow exponentially. The receptive field size of a layer of causal convolution is (K-1)d, so increasing the convolution kernel size K or the dilation factor d can increase the receptive field. Usually, as the number of network layers increases, the dilation factor d increases exponentially by 2. Therefore, the expanded causal convolution network is able to capture long-range sequences in a non-recursive manner with fewer layers, which can be parallelized during training to save computing resources.

[0080] The input of each node in G is a two-dimensional flow sequence of length m. It contains n feature channels. Then, the two-dimensional traffic time series of each node is convolved twice using temporal convolution to learn the temporal characteristics of the traffic. In order to generalize the extended causal convolution to the input traffic data of all switches (i.e., all nodes in G), The convolution kernel is used equally for each node in G to capture their dynamic time characteristics, and the output is N Γ is the size of the output feature channel, which is determined by the number of output filters in the extended causal convolution. It should be pointed out that in order to extract features at different time scales and make the results more stable, the kernel sizes of different convolutional layers are different. The temporal convolution Γ can be formalized as

[0081]

[0082] in is the convolution kernel parameter, * T Represents the operation of temporal convolution, and ReLU is the activation function. In order to improve the stability of the model, the design adopts residual connection and uses ReLU as the nonlinear activation function.

[0083] The prediction results are output using a 1-D causal convolution module followed by a fully connected (FC) layer to integrate features and generate attack intent predictions. First, a one-dimensional convolution Γ with a kernel size of m is used. O The output X of the temporal convolution Γ Mapping to a single-step prediction X ΓO . Sigmoid is used as the activation function in the output layer. Then, the FC layer maps it from multi-channel to single channel, and ΓO Applying linear transformation to Where W FC is the weight vector, b FC is the bias. Finally, the prediction model outputs the possibility of an attack on the switch node in the t+1 time interval, and uses the prediction error to update the model parameters during the model training process.

[0084] The GCN base model uses spectrum-based graph convolution to learn traffic correlation patterns between switch nodes. Graph convolution can be used for graph structured data to extract traffic interdependencies by aggregating and transforming adjacent information of switch nodes. Specifically, at time interval t, the input of the graph convolution layer is recorded as The process of filtering graph signals using convolution kernels can be regarded as a function mapping of the normalized Laplace matrix L, which is usually implemented through its eigenvalue decomposition. In order to reduce the number of parameters and reduce the computational complexity, the truncated Chebyshev expansion polynomial is used to limit the size of the convolution kernel, that is, the graph convolution is approximated by polynomials, recursively calculating K from each node in G. Θ Local graph convolution within the radius. Therefore, the graph convolution Θ can be defined as follows:

[0085]

[0086] in, is the graph convolution output, N Θ is the size of the output channels, which is determined by the number of output filters in the graph convolution. represents the Chebyshev expansion polynomial of the scaled Laplace matrix, θ z represents the Chebyshev polynomial coefficients, To scale the Laplacian matrix, we scale it to ensure that the eigenvalues ​​are between [-1, 1], L = ID -1 / 2 AD -1 / 2is the normalized Laplace matrix, A is the weighted adjacency matrix of graph G, D is the diagonal degree matrix, D ii =∑ j A ij ,λ max is the largest eigenvalue of the normalized Laplace matrix, and I is the identity matrix. The Chebyshev expansion polynomial is recursively defined as H z (x) = 2xH z-1 (x)-H z-2 (x), where H0(x) = 1 and H1(x) = x. Through the definition of Chebyshev polynomials, the approximate derivation of the graph convolution kernel allows effective convolution operations on the graph structure, expanding the receptive field while reducing the computational complexity.

[0087] To generalize the above graph convolution to X, at each time interval, the same kernel Θ is used to apply graph convolution operations to all switch nodes in the graph G to capture their topological related features, and the output is In this embodiment, the convolution results of high-order adjacent nodes are obtained by superimposing multiple first-order graph convolution layers. In the model proposed in this embodiment, the spatial convolution module consists of two first-order graph convolution layers, that is, the proposed model will convolve the second-order adjacent nodes of each node in the graph. This process can be formalized as:

[0088]

[0089] in,* G represents the graph convolution operation, and are the parameters of the graph convolution kernel, and ReLU is the activation function used. Residual connections are also applied in the graph convolution layer to maintain gradient validity and avoid model degradation. After the graph convolution, a 1×1 convolution defined by the convolution kernel Γs is used to add nonlinearity, and the output is Similar to the output prediction results of the TCN-based model, a 1-D causal convolution module followed by a fully connected (FC) layer is used to integrate features and generate attack intent predictions. By accurately modeling the network state and traffic behavior, the predicted attack intent at the next moment can be obtained and the location of the attack can be located.

[0090] In the dynamic weight allocation stage, the weights are dynamically adjusted based on the accuracy of the base model. The weight allocation of weighted voting is calculated based on the prediction accuracy of each base model. The base model with better prediction performance will have a greater weight in the vote. The weight calculation formula is as follows

[0091]

[0092] Among them, W i is the weight assigned to the ith base model, Pi is the prediction accuracy of the ith base model, and min(P) is the minimum prediction accuracy among all base models. In order to reduce the variance of weight estimation, the α-power of the weight is used as the basis for subsequent weighted voting, and the weights of different base models are normalized by the Softmax function to make the weight distribution smoother, thereby avoiding voting errors caused by power multiplication when the predicted probabilities differ greatly, or the problem of excessive dominance of a base model over the results.

[0093] In the weighted soft voting prediction stage, it is not just a simple weighted accumulation, but also uses the accuracy and confidence of the base model as weighting factors. The accuracy of each base model on the test sample is combined, and the prediction result is corrected by the confidence. This dynamic weighting method can give a greater weight when the model prediction confidence is higher, ensuring that the final prediction result is more reliable. The weighted voting result is calculated as follows

[0094]

[0095] in, is the weighted voting coefficient of the base model, P i (x i ) is the base model in sample x i The prediction results on the above, C(·) is the set confidence interval, and partial judgment is directly made according to the prediction results of the base model to reduce unnecessary calculation overhead such as dynamic weight allocation. The calculation formula is as follows

[0096]

[0097] If the base model predicts the probability P i (x i ) is less than 0.2, then we can judge it as normal. i (x i ) is greater than 0.8, it is directly judged to be under attack. In the interval [0.2, 0.8], weighted soft voting is performed to obtain the prediction result. Therefore, through the weighted soft voting prediction mechanism, when multiple base models disagree, the judgments made by each model from different perspectives such as timing and topology can be effectively integrated to output reliable attack intention predictions.

[0098] In specific applications, attack defense based on programmable data plane includes the following steps:

[0099] (1) Attack Detection Based on Online Clustering Inference

[0100] After the attack prediction component predicts that the switch node may be attacked, an adaptive attack detection component called clustering reasoning is launched to identify malicious traffic. The attack detection component does not require a pre-trained classification model and does not rely on the global view of the controller, thus further reducing the computation and communication costs. In this section, we first formally describe the target task problem of the attack detection component and define it as an aggregate reasoning problem. Then we introduce the design details of implementing the clustering reasoning algorithm in the programmable data plane.

[0101] Since the switch processes and forwards traffic packet by packet, each received data packet needs to be processed and forwarded in a timely manner, otherwise it will be cached, resulting in storage overhead and latency costs. In addition, a data packet can only be processed and forwarded once, and this operation cannot be undone or modified. In order to adapt to the processing characteristics of packet-by-packet forwarding of the programmable data plane, the data packet features are defined in this embodiment and attack detection is performed on them. By clustering similar data packets and analyzing the aggregation degree of the clusters, malicious attack aggregated traffic that occupies bandwidth resources is separated.

[0102] Corresponding to the header fields of each data packet, two types of features are defined: ordinal features and nominal features. The closer the values ​​of ordinal features are, the stronger the similarity is (for example, source address, destination address, packet length, TTL), while the similar values ​​of nominal features do not necessarily mean similarity (for example, source port, destination port, protocol). For a set of similar data packets P, the range of the ordered feature values ​​can be expressed as F(P) = [min F (P),max F (P)], the nominal feature can be expressed as a discrete value set F(P) = {min F (P),...,max F (P)}.

[0103] Given a set of packets incoming to an abnormal switch node, the goal in this embodiment is to infer |C| clusters, where each incoming packet can find the most similar cluster and join it. Then, based on the throughput and cluster size, a high-bandwidth malicious packet cluster is identified. The number of clusters |C| is usually not too large to minimize the complexity and overhead of subsequent attack defense, and to avoid perfect classification accuracy due to too few packet samples in the cluster.

[0104] Therefore, the attack detection goal is transformed into a clustering reasoning problem, which is defined as follows: For a given set of data packets P, find a set of clusters C = {c1, c2, ..., c i}(2≤i≤|C|), so that the sum of all clustering costs δ(C)=∑ ci∈C δ(ci ) is the smallest. Among them, δ(c i )=Π f∈F δ f (c i ) is the cluster c i The cost of δ measures the similarity of packets within a cluster. For ordinal features f, δ f (c i )=max f (c i )-min f (c i ). For nominal characteristics, δ f (c i )=|f(c i )|(ie, the number of values ​​in the set). Since this problem is an NPhard problem, this embodiment further proposes a heuristic online clustering algorithm, as shown in Algorithm 1, which aims to achieve an approximation to the optimal clustering result in the process of packet-by-packet forwarding.

[0105]

[0106] First, |C| random packets are used to initialize the clustering. In this embodiment, a range-based representation method is used to represent the clustering. On the one hand, the range-based clustering representation is easy to calculate and update, which is conducive to implementation on the programmable data plane. On the other hand, this representation method can retain information about the cluster size and does not need to maintain the mapping relationship between each packet and the cluster, which is scalable. For example, for an ordered feature f, a newly arrived packet p is aggregated to an existing cluster c. i The range of the new cluster is: [min(min f (c i ),min f (p)),max(max f (c i ),max(p))]. Nominal feature clustering can be implemented using Bloom filters.

[0107] Then, for each newly arrived packet, CalcDist(p,c i ) calculates the distance of each feature of each cluster to calculate its distance to each cluster, and passes UpdtClst(p,c slct) aggregates them into the nearest cluster. The closer the distance between a packet and a cluster is, the more relevant it is to the behavioral intention of the packets in the cluster. By combining clustering indicators such as throughput and cluster size, high-bandwidth malicious packet clusters can be identified. In this paper, the Manhattan distance function is selected to calculate the correlation instead of the commonly used Euclidean distance. Since it is deployed in a programmable data plane, the computational cost for evaluating clustering decisions is required to be as low as possible. On the programmable data plane, the square root operation involved in the Euclidean distance is not easily supported, while in the Manhattan distance, the complex square root operation and the product operation of a single feature distance are replaced by a sum operation. After such simplification, the clustering cost function can be written as:

[0108]

[0109] New packet p to cluster c i The Manhattan distance function of

[0110]

[0111] in,

[0112]

[0113] Finally, the cluster aggregation rate is used to evaluate the possibility that each cluster contains attack traffic, thereby realizing the detection of malicious attack packets. The cluster aggregation rate is defined as the ratio of the arrival rate and the cluster size, which can characterize the packet similarity and high-bandwidth behavior characteristics of the cluster. It is formulated as follows:

[0114]

[0115] Among them, the arrival rate R arr (c i )=pktnum(c i ) / τ is the number of data packets arriving per unit time, which can be obtained from the packet counter. Cluster size size(c i ) is the size of the source address set, which is equivalent to the clustering cost of the source address feature, and can extract the packet similarity within the cluster. After aggregating the packets sent by LFA through clustering reasoning, the cluster containing the attack usually has higher packet similarity and high bandwidth occupation tendency. If the data packet belongs to a cluster with high aggregation degree (i.e., exceeding the average aggregation degree), it is identified as a malicious attack data packet and the mitigation component is further activated.

[0116] (2) Attack Mitigation Based on Adaptive Penalty Factor

[0117] The attack mitigation component periodically polls the detection component's evaluation results of the cluster aggregation rate to derive the rate limit policy for each cluster corresponding to the aggregated traffic. Subsequent transmission packets mapped to the malicious attack cluster will be restricted to discard excess traffic to achieve the purpose of mitigating LFA. The rate limit window is calculated as follows:

[0118] W TL =μ-γ×α×R arr

[0119] Where μ is the average of all cluster arrival rates and α is a constant set by the administrator to determine the penalty aggressiveness. If α is equal to 0, no penalty is applied and badly behaved flows get their fair share of bandwidth. If α is equal to 1, a maximum exponential penalty is applied proportionally to badly behaved flows. Adaptive penalty factor γ = 1-e (Rarr-μ) The purpose is to apply a more stringent rate limit strategy to attack flows that use much more bandwidth than their fair share, ensuring that ① the more aggressive the attacker's behavior, the less bandwidth they get; and ② regardless of the attacker's strategy, each legitimate client is guaranteed to receive bandwidth that is no less than the fair share of each sender. Under this flexible rate limit strategy, this embodiment can quickly adapt to traffic changes caused by attacks. In addition, while effectively discarding attack traffic, the adaptive rate limit strategy can also reduce the negative impact of false positives in attack detection on legitimate traffic.

[0120] In summary, this embodiment proposes an LFA prediction model based on weighted ensemble learning, which captures the attack intention, locates the location where the attack may occur, and pre-activates the subsequent defense mechanism. This balances the contradiction between the limited data plane resource overhead and the timeliness of the attack response. An LFA defense algorithm based on a programmable data plane is implemented. The algorithm runs completely on the data plane and does not rely on the global perspective of the control plane and the pre-trained machine learning model. Therefore, it can achieve line speed detection of abnormal traffic and generate real-time defense strategies that adapt to different attack modes.

[0121] Example 3

[0122] This embodiment 3 provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described above is implemented. The method includes:

[0123] Dynamically sample the metadata of each switch to obtain fine-grained real-time network status, and model the network status as a spatiotemporal graph to capture changes in the network status. The collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of network status and traffic change rate.

[0124] After obtaining the three-dimensional tensor, it and the adjacency matrix of the space-time graph are used as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switches through which the attack flow passes. Among them, the LFA prediction model can integrate diverse machine learning models to capture the changes in the global network state tensor from multiple angles such as time series and space, and more realistically restore the behavior intent of the attack traffic.

[0125] According to the prediction results of the LFA prediction model, the nominal and ordinal features are extracted from the packet header, and similar packets are aggregated into a traffic cluster based on the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and a link flood attack mitigation strategy is generated to mitigate link flood attacks.

[0126] Example 4

[0127] This embodiment 4 provides a computer device, including a memory and a processor, the processor and the memory communicate with each other, the memory stores program instructions executable by the processor, the processor calls the program instructions to execute the above-mentioned cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning, the method comprising:

[0128] Dynamically sample the metadata of each switch to obtain fine-grained real-time network status, and model the network status as a spatiotemporal graph to capture changes in the network status. The collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of network status and traffic change rate.

[0129] After obtaining the three-dimensional tensor, it and the adjacency matrix of the space-time graph are used as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switches through which the attack flow passes. Among them, the LFA prediction model can integrate diverse machine learning models to capture the changes in the global network state tensor from multiple angles such as time series and space, and more realistically restore the behavior intent of the attack traffic.

[0130] According to the prediction results of the LFA prediction model, the nominal and ordinal features are extracted from the packet header, and similar packets are aggregated into a traffic cluster based on the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and a link flood attack mitigation strategy is generated to mitigate link flood attacks.

[0131] Example 5

[0132] This embodiment 5 provides an electronic device, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes instructions for implementing the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described above, the method including:

[0133] Dynamically sample the metadata of each switch to obtain fine-grained real-time network status, and model the network status as a spatiotemporal graph to capture changes in the network status. The collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of network status and traffic change rate.

[0134] After obtaining the three-dimensional tensor, it and the adjacency matrix of the space-time graph are used as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switches through which the attack flow passes. Among them, the LFA prediction model can integrate diverse machine learning models to capture the changes in the global network state tensor from multiple angles such as time series and space under the constraints of limited computing cost and execution time, and more realistically restore the behavior intention of the attack traffic.

[0135] According to the prediction results of the LFA prediction model, the nominal and ordinal features are extracted from the packet header, and similar packets are aggregated into a traffic cluster based on the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and a link flood attack mitigation strategy is generated to mitigate link flood attacks.

[0136] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0137] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0138] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0139] These computer program instructions can also be loaded onto a computer or other programmable data processing device, and a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0140] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative work on the basis of the technical solution disclosed in the present invention should be included in the scope of protection of the present invention.

Claims

1. A cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning, characterized in that: include: Dynamically sample the metadata of each switch, dynamically adjust the in-band telemetry frequency according to the changes in network traffic size, obtain fine-grained real-time network status in large traffic scenarios, and model the network status as a spatiotemporal graph to capture changes in network status; the collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of network status and traffic change rate; After obtaining the three-dimensional tensor, it and the adjacency matrix of the space-time graph are used as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switch through which the attack flow passes. The LFA prediction model integrates the different learning characteristics of diversified machine learning models to simultaneously model and analyze the switch status when LFA occurs from the perspective of time and space, and locate the switch affected by the attack. According to the prediction results of the LFA prediction model, the nominal and ordinal features are extracted from the packet header, and similar packets are aggregated into a traffic cluster based on the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and a link flood attack mitigation strategy is generated to mitigate link flood attacks.

2. According to claim 1, the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning is characterized in that: The metadata of each switch is dynamically sampled to obtain a fine-grained real-time network status, including: first, according to the traffic size, the dynamic sampling interval is calculated, and an INT header containing a telemetry instruction is inserted after the header of a specified user data packet; then, according to different telemetry instructions, the real-time fine-grained metadata information is sequentially inserted into the data packet to realize the collection of diversified network status information; finally, after the data packet reaches the aggregation node switch, the INT report containing the measurement metadata information is sent to the network telemetry server of the control plane, and the user payload is forwarded to the destination; wherein, when dynamic sampling is performed, the source node inserts the INT instruction into the header of the telemetry data packet according to the dynamically adjusted sampling interval; if the data packet contains the INT instruction, all the specified INT metadata of each switch it passes through will be written into it; otherwise, no metadata is written; thereby, fine-grained real-time network status perception in a large traffic scenario can be realized without introducing huge telemetry overhead and delay.

3. The cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning according to claim 1 is characterized in that: By converting the metadata, we get a three-dimensional tensor containing the feature vectors of all nodes at different times. Where f is the number of features of each node, |V| is the number of nodes, and m is the number of time slices; is the graph signal of the t-th time interval, corresponding to the traffic characteristics of each node in the time series graph G at time t; The metadata is classified according to the switch ID; the size of the time slice τ is set, the mean of all states collected in each time slice and the flow change rate are calculated, and the feature vectors of all switches in a time slice are obtained; finally, a three-dimensional feature tensor X is obtained, which contains the feature vectors of all switches in multiple time slices, and the feature vectors are composed of multiple state information.

4. The cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning according to claim 1 is characterized in that: The LFA prediction model dynamically allocates voting weights according to the training performance of the base model. In order to make the weight distribution smoother and not dominated by a single base model, the weights are normalized using the Softmax function. Then the base model predicts the attack intention of the current test sample and uses soft voting to output the modified attack intention prediction result in combination with factors such as the voting weight coefficient and the confidence adjustment coefficient.

5. The cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning according to claim 1 is characterized in that: First, |C| random data packets are used to initialize clustering; then, for each newly arrived data packet, each feature distance of all clusters is calculated to calculate its distance to each cluster, and they are aggregated into the nearest cluster; the closer the distance between the data packet and the cluster, the more relevant it is to the behavioral intention of the data packets in the cluster; finally, the cluster aggregation rate is used to evaluate the possibility that each cluster contains attack traffic, so as to detect malicious attack data packets.

6. The cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning according to claim 1 is characterized in that: By periodically polling the evaluation results of the cluster aggregation rate of the detection component, the rate limit strategy for the aggregated traffic corresponding to each cluster is derived; the transmission data packets mapped to the malicious attack cluster will be restricted to be sent in order to discard the excess traffic, so as to alleviate the link flooding attack; the rate limit window is calculated as: W TL =μ-γ×α×R arr ; where μ is the average of all cluster arrival rates and α is a constant set by the administrator to determine the aggressiveness of the penalty; if α is equal to 0, no penalty is applied and badly behaved flows receive a fair share of the bandwidth; if α is equal to 1, a maximum exponential penalty is applied proportionally to badly behaved flows.

7. A cross-layer collaborative defense system for link flooding attacks based on weighted ensemble learning, characterized in that: include: The acquisition module is used to dynamically sample the metadata of each switch to obtain fine-grained real-time network status and model the network status as a spatiotemporal graph to capture changes in the network status. The collected data is converted into a three-dimensional tensor, which contains the spatiotemporal feature vectors of each switch at different times. The spatiotemporal feature vectors are composed of network status and traffic change rate. The prediction module is used to obtain the three-dimensional tensor and use it and the adjacency matrix of the space-time graph as the input of the LFA prediction model to perceive the attack intent of the traffic and locate the switch through which the attack flow passes. The LFA prediction model integrates the independent prediction results of the diversified models through the weighted ensemble learning method, combines the time learning and space learning characteristics of different base models, and outputs the modified attack intent prediction results in the form of dynamic weighted voting; The strategy generation module is used to extract nominal and ordinal features from the packet header according to the prediction results of the LFA prediction model, and aggregate similar packets into a traffic cluster according to the Manhattan distance. By analyzing the aggregation degree of the traffic cluster, the possibility of it containing attack traffic is evaluated, and the link flood attack mitigation strategy is generated to mitigate the link flood attack.

8. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described in any one of claims 1-6 is implemented.

9. A computer device, characterized in that: It includes a memory and a processor, the processor and the memory communicate with each other, the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described in any one of claims 1-6.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes instructions for implementing the cross-layer collaborative defense method for link flooding attacks based on weighted ensemble learning as described in any one of claims 1-6.

Images