Defense method and device for distributed denial of service attack and electronic equipment

Abstract

The invention discloses a distributed denial of service attack defense method and device and electronic equipment, and relates to the technical field of network security. The method comprises the following steps: based on a connection relationship between nodes in a current network topology structure, obtaining a flow characteristic parameter of each link in the network topology structure in a current detection period; according to the traffic characteristic parameters, respectively obtaining a traffic dynamic weight of each link in the network topology structure; respectively obtaining a dynamic ranking value of each node in the network topology structure according to the flow dynamic weight; according to the dynamic ranking values, respectively obtaining node feature parameters of each node in the network topology structure; and judging whether the node characteristic parameter of each node exceeds a node characteristic parameter threshold value corresponding to the node, and when the node characteristic parameter of any node exceeds the node characteristic parameter threshold value corresponding to the node, starting a defense strategy for the node. The timeliness and accuracy of distributed denial of service attack defense are improved, and the network security is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a defense method, device and electronic device for distributed denial of service attacks. Background Art

[0002] A Distributed Denial of Service (DDoS) attack occurs when multiple attackers in different locations simultaneously attack one or more targets, or when an attacker controls multiple machines in different locations and uses them to attack victims simultaneously.

[0003] Compared with traditional flooding DDoS attacks, new pulse DDoS attacks are launched in an intermittent manner. The attacker will launch a wave of strong DDoS attacks in a short period of time, then suddenly stop, and then launch again. Because the attack traffic quickly reaches its peak, traditional detection methods may not be able to respond in time, and during the rest period, the traffic may return to normal levels, making it difficult for the defense system to accurately identify the attack. In view of this, it is urgent to develop a timely and accurate defense method to deal with the threat of pulse DDoS attacks to network security. Summary of the invention

[0004] The present application provides a distributed denial of service attack defense method, device and electronic device to improve the timeliness and accuracy of distributed denial of service attack defense.

[0005] In a first aspect, a method for defending against a distributed denial of service (DDoS) attack is provided, comprising:

[0006] Based on the connection relationship between nodes in the current network topology, the traffic characteristic parameters of each link in the network topology within the current detection period are obtained;

[0007] According to the traffic characteristic parameters, the dynamic traffic weight of each link in the network topology is obtained respectively;

[0008] According to the dynamic weight of traffic, the dynamic ranking value of each node in the network topology is obtained respectively;

[0009] According to the dynamic ranking value, the node characteristic parameters of each node in the network topology structure are obtained respectively;

[0010] It is determined whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node. When the node characteristic parameter of any node exceeds the node characteristic parameter threshold corresponding to the node, a defense strategy for the node is initiated.

[0011] In the present application, the traffic characteristic parameters of each link in the network topology are periodically obtained to improve the accuracy and real-time performance of subsequent distributed denial of service attack detection. The dynamic traffic weight of each link is calculated through the traffic characteristic parameters, so that it can accurately reflect the fluctuation of traffic in the network, and provide data support for identifying potential distributed denial of service attacks. Then, based on the dynamic traffic weight of each link, the dynamic ranking value of each node in the network topology is calculated, and the node characteristic parameters of each node are further calculated according to the dynamic ranking value of each node, which are used to determine whether each node in the network topology is subjected to a distributed denial of service attack, so as to initiate the corresponding defense strategy, thereby improving the timeliness and accuracy of distributed denial of service attack defense, especially pulse DDoS attack defense, which is conducive to reducing the threat of distributed denial of service attacks to network security and ensuring network security.

[0012] In some embodiments, the traffic characteristic parameters of each link include: traffic volume value, communication frequency, and proportion of various protocol data in the data packet;

[0013] According to the traffic characteristic parameters, the dynamic traffic weight of each link in the network topology is obtained, including:

[0014] The dynamic weight of the traffic of each link is calculated according to the traffic volume value, communication frequency and proportion of various protocol data in the data packet of each link in the network topology structure in the current detection period.

[0015] By obtaining the traffic volume value, communication frequency and the proportion of various protocol data in the data packet of each link as the traffic characteristic parameters, it is helpful to accurately and comprehensively reflect the traffic characteristics of each link and improve the accuracy of the traffic dynamic weight calculation results.

[0016] In some embodiments, the dynamic weight of traffic for each link is obtained by the following formula:

[0017] w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ;

[0018] Among them, w ij Represents the dynamic weight of the traffic on the link between node i and node j in the network topology;

[0019] flow ijrepresents the flow value of the link transmission between node i and node j, min(flow) represents the minimum flow value of all links in the network topology, and max(flow) represents the maximum flow value of all links in the network topology;

[0020] freq ij represents the communication frequency of the link between node i and node j, min(freq) represents the minimum value of the communication frequency among all links in the network topology, and max(freq) represents the maximum value of the communication frequency among all links in the network topology;

[0021] Protocols represents a collection of all types of protocols contained in a data packet. represents the traffic volume transmitted by protocol p on the link between node i and node j, W P is the proportion of protocol p in the data packet;

[0022] α, β, and γ are set coefficients.

[0023] The above calculation process comprehensively considers the impact of traffic volume, communication frequency and the proportion of each protocol data in the data packet on the dynamic traffic weight of each link, so as to improve the accuracy of the calculation result of the dynamic traffic weight.

[0024] In some embodiments, according to the dynamic weight of the traffic, the dynamic ranking value of each node in the network topology structure is obtained respectively, specifically including:

[0025] Substitute the dynamic weight of traffic into the improved PageRank calculation formula to calculate the dynamic ranking value of each node in the network topology structure.

[0026] In some embodiments, the improved PageRank calculation formula is:

[0027]

[0028] Among them, PR(i,t) represents the dynamic ranking value of node i in the current detection cycle;

[0029] PR(i,t-1) represents the dynamic ranking value of node i in the previous detection cycle;

[0030] w ij Represents the dynamic weight of the traffic on the link between node i and node j in the network topology;

[0031] M(i) represents the set of all nodes pointing to node i;

[0032] L(j) represents the number of all links starting from node j;

[0033] d represents the damping factor.

[0034] The above calculation process uses an improved PageRank algorithm to calculate the dynamic ranking value of each node, which is conducive to detecting the real-time changes of the dynamic ranking value of each node and realizing real-time and accurate detection of pulse DDoS attacks.

[0035] In some embodiments, node characteristic parameters of each node in the network topology are obtained according to the dynamic ranking value, specifically including:

[0036] The dynamic ranking value of each node is substituted into the node characteristic parameter calculation formula to calculate the node characteristic parameters of each node in the network topology structure.

[0037] In some embodiments, the node characteristic parameter calculation formula is:

[0038]

[0039] Among them, Z (i) Represents the node characteristic parameters of node i;

[0040] PR(i,t) represents the dynamic ranking value of node i in the current detection cycle;

[0041] μ PR Represents the average of the dynamic ranking values ​​of all nodes in the network topology in the current detection cycle;

[0042] σ PR Represents the standard deviation of the dynamic ranking values ​​of all nodes in the network topology within the current detection cycle.

[0043] The above calculation process can eliminate the influence of accidental changes in the traffic of a single or a few nodes on the calculation results by introducing the mean and standard deviation of the dynamic ranking values ​​of all nodes in the network topology structure in the current detection cycle, and improve the accuracy of the calculation results of the node characteristic parameters of each node through overall judgment.

[0044] In some embodiments, initiating a defense strategy for an attacked point includes:

[0045] Start the backup nodes of the attacked nodes to form a new network topology;

[0046] The method also includes:

[0047] Get the connection relationship between each node in the new network topology.

[0048] Through the above method, the network topology structure can be updated in real time to ensure that the traffic characteristic parameters of each link can be accurately obtained in the subsequent detection cycle.

[0049] In a second aspect, a DDoS attack defense device is provided, comprising:

[0050] An acquisition module, used to acquire the flow characteristic parameters of each link in the network topology structure within the current detection period based on the connection relationship between the nodes in the current network topology structure;

[0051] The traffic dynamic weight calculation module is used to obtain the traffic dynamic weight of each link in the network topology structure according to the traffic characteristic parameters;

[0052] The dynamic ranking value calculation module is used to obtain the dynamic ranking value of each node in the network topology structure according to the dynamic weight of the traffic;

[0053] The response module is used to determine whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node. When the node characteristic parameter of any node exceeds the node characteristic parameter threshold corresponding to the node, the defense strategy for the node is initiated.

[0054] In some embodiments, the response module is specifically used to start a backup node of the attacked node to form a new network topology;

[0055] The acquisition module is also used to acquire the connection relationship between each node in the new network topology.

[0056] According to a third aspect, an electronic device is provided, including:

[0057] A memory is used to store a computer program; a processor is used to implement any one of the methods in the first aspect when executing the computer program stored in the memory.

[0058] According to a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of the first aspects is implemented.

[0059] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic diagram of a method for defending against a distributed denial of service attack provided in an embodiment of the present application;

[0061] Figure 2A schematic diagram of a network topology structure provided in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of another network topology structure provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of the structure of a distributed denial of service attack defense device provided in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0066] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0067] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0068] A Distributed Denial of Service (DDoS) attack occurs when multiple attackers in different locations simultaneously attack one or more targets, or when an attacker controls multiple machines in different locations and uses them to attack victims simultaneously.

[0069] Compared with traditional flooding DDoS attacks, new pulse DDoS attacks are launched intermittently. The attacker launches a strong wave of DDoS attacks in a short period of time, then suddenly stops, and then launches again. Because the attack traffic quickly reaches its peak, traditional detection methods may not be able to respond in time, and during the rest period, the traffic may return to normal levels, making it difficult for defense systems to accurately identify attacks.

[0070] In view of this, the present application provides a method, device, electronic device and storage medium for defending against distributed denial of service attacks, so as to overcome the above problems.

[0071] An embodiment of the present application provides a method for defending against distributed denial of service attacks. Figure 1 A schematic diagram of a distributed denial of service attack defense method provided in an embodiment of the present application, see Figure 1 The distributed denial of service attack defense method provided in the embodiment of the present application includes the following steps:

[0072] S110: Based on the connection relationship between each node in the current network topology structure, the flow characteristic parameters of each link in the network topology structure in the current detection period are obtained.

[0073] In the embodiment of the present application, the distributed denial of service attack can be detected in real time according to the set period T. Generally, the shorter the time length of the set period T is, the more accurate the detection result is. In specific implementation, the time length of the set period T can be set to a fixed value according to actual conditions, or the time length of the set period T can be automatically adjusted according to actual traffic conditions, for example, when abnormal traffic is detected, the detection frequency is increased to further improve the detection accuracy, which is not limited here.

[0074] Figure 2 A schematic diagram of a network topology structure provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the network topology includes multiple nodes (such as Figure 2 Routes 1 to 8, etc.) and links used to connect nodes (such as Figure 2 Link 1 to Link 9, etc.) It should be noted that Figure 2 The network topology shown is only used for illustration. When it is implemented, the network topology can also be other structures, which are not limited here. In general, a firewall or the like can also be set at the boundary of the network for security protection. In the defense method for distributed denial of service attacks provided in the embodiment of the present application, within the set detection period T, the flow characteristic parameters of each link in the network topology structure within the current detection period can be obtained according to the connection relationship between the nodes in the current network topology structure, wherein the flow characteristic parameters are used to characterize the flow characteristics of each link in the current detection period, and based on the flow characteristics of each link, it is conducive to the subsequent accurate judgment of whether there are abnormal nodes in the network topology structure.

[0075] S120: According to the traffic characteristic parameters, a traffic dynamic weight of each link in the network topology is obtained respectively.

[0076] In this step, the dynamic traffic weight of each link can be calculated according to the traffic characteristic parameters, and the dynamic traffic weight is used to subsequently calculate the dynamic ranking value of each node in the network topology.

[0077] In some embodiments, the traffic characteristic parameters of each link include the traffic value flowing through the link, the communication frequency of the link, and the proportion of each protocol data in the data packet during the current detection cycle. Since the difference between abnormal traffic and normal traffic during a distributed denial of service attack mainly lies in the change in the size of the traffic, the communication frequency, and the proportion of each protocol data in the data packet, for example, when a node is attacked by a pulsed DDoS, the traffic value transmitted by the corresponding link during the attack may increase significantly, and the communication frequency increases significantly. The attack traffic often uses TCP (Transmission Control Protocol, referred to as TCP) and UDP (User Datagram Protocol, referred to as UDP) protocols at the same time, resulting in changes in the proportion of different protocol data. Therefore, the traffic value flowing through the link, the communication frequency of the link, and the proportion of each protocol data in the data packet can be used as the traffic characteristic parameters of each link. Therefore, the traffic dynamic weight of each link can be calculated based on the traffic value, communication frequency, and the proportion of various protocol data in the data packet of each link in the network topology structure during the current detection cycle.

[0078] In specific implementation, the dynamic traffic weight of each link can be obtained by the following formula:

[0079] w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ;

[0080] Among them, w ij Represents the dynamic weight of the traffic on the link between node i and node j in the network topology;

[0081] flow ij represents the flow value of the link transmission between node i and node j, min(flow) represents the minimum flow value of all links in the network topology, and max(flow) represents the maximum flow value of all links in the network topology;

[0082] freq ij represents the communication frequency of the link between node i and node j, min(freq) represents the minimum value of the communication frequency among all links in the network topology, and max(freq) represents the maximum value of the communication frequency among all links in the network topology;

[0083] Protocols represents a collection of all types of protocols contained in a data packet. represents the traffic volume transmitted by protocol p on the link between node i and node j, W P is the proportion of protocol p in the data packet; Indicates that for all protocols in the data packet, For example, if the data packet includes multiple protocols P1, P2 and P3, that is, Protocols = {P1, P2, P3}, then

[0084] α, β and γ are set coefficients; the specific values ​​of α, β and γ can be adjusted according to network characteristics. For example, the values ​​of α, β and γ can be adjusted through multiple tests to improve the accuracy of pulse DDoS attack detection.

[0085] The above calculation process comprehensively considers the impact of traffic volume, communication frequency and the proportion of each protocol data in the data packet on the dynamic traffic weight of each link, so as to improve the accuracy of the calculation result of the dynamic traffic weight.

[0086] S130: According to the dynamic weight of the traffic, a dynamic ranking value of each node in the network topology structure is obtained respectively.

[0087] In this step, the dynamic ranking value of each node in the network topology structure can be calculated according to the dynamic weight of the traffic.

[0088] In some embodiments, the algorithm for calculating the dynamic ranking value of a node can adopt an improved PageRank algorithm. The core idea of ​​the PageRank algorithm is to evaluate the importance of a web page based on the link relationship between web pages. In the traditional PageRank algorithm, the PageRank value of a web page is mainly determined by the number and quality of connections pointing to the page, that is, the web page ranking value mainly depends on the network topology. Once the network topology is determined, the web page ranking value will no longer change. In an embodiment of the present invention, the PageRank algorithm is improved by introducing the dynamic weight of traffic flow to calculate the dynamic ranking value of each node in the network topology. Since the traffic characteristic parameters of each link change in real time during the pulse DDoS attack, which in turn causes the dynamic weight of the traffic of each link to change, the dynamic ranking value of each node in the current detection cycle can be calculated based on the improved PageRank algorithm, so that the dynamic ranking value of each node in the network topology is no longer dependent on the network topology, but can be changed in real time according to the change of network traffic. Based on the dynamic ranking value of the node, it is further judged whether the node is abnormal, which is conducive to the real-time and accurate detection of the pulse DDoS attack.

[0089] In specific implementation, the dynamic ranking value of each node can be obtained by the following formula (i.e. the improved PageRank calculation formula):

[0090]

[0091] Among them, PR(i,t) represents the dynamic ranking value of node i in the current detection cycle;

[0092] PR(j,t-1) represents the dynamic ranking value of node j in the previous detection cycle;

[0093] w ij Represents the dynamic weight of the traffic on the link between node i and node j in the network topology;

[0094] M(i) represents the set of all nodes pointing to node i;

[0095] L(j) represents the number of all links starting from node j;

[0096] d represents the damping factor;

[0097] It means that for all nodes in the set M(i) pointing to node i, For example, all nodes pointing to node i in the network topology include j1, j2, and j3, that is, M(i) = {j1, j2, j3}, then

[0098] S140: Obtain node characteristic parameters of each node in the network topology structure according to the dynamic ranking value.

[0099] In this step, the node characteristic parameters of each node in the network topology can be calculated according to the dynamic ranking value of each node. The node characteristic parameters are used to compare with the node characteristic parameter threshold of the corresponding node, so as to accurately determine whether the node is under a pulse DDoS attack.

[0100] In specific implementation, the dynamic ranking value of each node can be substituted into the node characteristic parameter calculation formula respectively, so as to calculate the node characteristic parameters of each node in the network topology structure respectively.

[0101] The calculation formula of node characteristic parameters can be:

[0102]

[0103] Among them, Z (i) Represents the node characteristic parameters of node i;

[0104] PR(i,t) represents the dynamic ranking value of node i in the current detection cycle;

[0105] μ PR Represents the average of the dynamic ranking values ​​of all nodes in the network topology in the current detection cycle;

[0106] σ PR Represents the standard deviation of the dynamic ranking values ​​of all nodes in the network topology within the current detection cycle.

[0107] The above calculation process can eliminate the influence of accidental changes in the traffic of a single or a few nodes on the calculation results by introducing the mean and standard deviation of the dynamic ranking values ​​of all nodes in the network topology structure in the current detection cycle, and improve the accuracy of the calculation results of the node characteristic parameters of each node through overall judgment.

[0108] S150: Determine whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node. When the node characteristic parameter of any node exceeds the node characteristic parameter threshold corresponding to the node, initiate a defense strategy for the node.

[0109] In this step, the node characteristic parameter of each node is compared with the node characteristic parameter threshold corresponding to the node to determine whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node. In the normal operation, the node characteristic parameter Z of each node can be calculated. (i) The maximum and / or minimum value of the node characteristic parameter is determined and set as the node characteristic parameter threshold of the corresponding node. When it is detected that the node characteristic parameter of any node in the current detection cycle exceeds the node characteristic parameter threshold corresponding to the node, it is considered that the node may be under a pulse DDoS attack, so that a defense strategy can be quickly launched for the node under the pulse DDoS attack. The defense strategy includes switching the node under the pulse DDoS attack to the backup node to relieve the traffic pressure, and implementing the interception strategy through the firewall to filter the attack traffic in the network. The defense strategy can be set according to the actual situation during the specific implementation, and is not limited here.

[0110] In specific implementation, when it is detected that multiple nodes in the network topology are simultaneously attacked by pulse DDoS, defense strategies can be started for multiple nodes attacked by pulse DDoS respectively, and then the next cycle of detection can be continued. When it is detected that all nodes in the network topology are not attacked, the next cycle of detection can be continued.

[0111] In the method for defending against pulse DDoS attacks provided in the embodiment of the present application, the traffic characteristic parameters of each link in the network topology are periodically obtained to improve the accuracy and real-time performance of the subsequently improved PageRank algorithm. The dynamic traffic weight of each link is calculated by the traffic characteristic parameters so that it can accurately reflect the fluctuation of traffic in the network, providing data support for identifying potential pulse DDoS attacks. Then, based on the dynamic traffic weight of each link, the improved PageRank algorithm is used to calculate the dynamic ranking value of each node in the network topology, and the node characteristic parameters of each node are further calculated according to the dynamic ranking value of each node, which are used to determine whether each node in the network topology is subjected to a pulse DDoS attack, so as to initiate the corresponding defense strategy, thereby improving the timeliness and accuracy of the defense against pulse DDoS attacks, and helping to reduce the threat of pulse DDoS attacks to network security and ensure network security.

[0112] In some embodiments, starting a defense strategy for an attacked point may specifically include: starting a backup node of the attacked node to form a new network topology. Figure 3 Another network topology diagram provided in the embodiment of the present application is as follows, for example: Figure 3 As shown, when it is detected that route 6 is under a pulse DDoS attack, the backup node route 6' of route 6 can be started to relieve the traffic pressure, wherein route 4 and route 6' can be connected through a new link 2'. The defense method for distributed denial of service attacks provided in the embodiment of the present application also includes obtaining the connection relationship between each node in the new network topology structure, thereby updating the network topology structure in real time to ensure that the traffic characteristic parameters of each link can be accurately obtained in the subsequent detection cycle.

[0113] In order to make the distributed denial of service attack defense method provided by the embodiment of the present application clearer, the following is combined with Figure 2 and Figure 3 , the defense method for distributed denial of service attacks provided in the embodiment of the present application is illustrated by way of example. In a possible embodiment, the defense method for distributed denial of service attacks provided in the embodiment of the present application specifically includes the following steps:

[0114] Step 1:

[0115] Obtain the connection relationship between nodes in the current network topology structure. Based on the connection relationship between nodes in the network topology structure in the current detection cycle, obtain the traffic characteristic parameters of each link in the network topology structure, such as the traffic value transmitted by each link in the current detection cycle, the communication frequency, and the proportion of various protocol data in the data packet.

[0116] Step 2:

[0117] Calculate the dynamic traffic weight w of each link according to the traffic characteristic parameters of each link in the network topology ij For example, according to Figure 2 The network topology shown in the figure assumes that in the current detection cycle, the dynamic weight w of the traffic to link 1 between route 1 and route 4 is calculated based on the traffic characteristic parameters of each link. 14 =0.8, the traffic dynamic weight w of link 2 between route 4 and route 6 46 =0.9, the dynamic weight w of the traffic on link 3 between route 2 and route 4 24 =0.5, the dynamic weight w of the traffic on link 4 between route 4 and route 7 47 =0.6, the dynamic weight w of the traffic on link 5 between route 2 and route 5 25 =0.2, the traffic dynamic weight w of link 6 between route 5 and route 7 57 =0.3, the traffic dynamic weight w of link 7 between route 3 and route 5 35 =0.1, the traffic dynamic weight w of link 8 between route 5 and route 8 58 =0.2.

[0118] Step 3:

[0119] The dynamic weight w of the traffic on each link ij Bring in the improved PageRank calculation formula. Taking route 6 as an example, the node pointing to route 6 is route 4, w 46 = 0.9, the number of all links from route 4 L(4) = 2, assuming the damping factor d is 0.85, and assuming that the dynamic ranking value of route 4 in the previous detection cycle PR(i,t-1) = 0.2, The dynamic ranking value PR(6,t) of route 6 in the current detection cycle is obtained as 0.34125.

[0120] Step 4:

[0121] According to the dynamic ranking value of each node, the node characteristic parameters of each node in the network topology are calculated. Taking route 6 as an example, assuming that the mean value of the dynamic ranking value of all nodes in the network topology in the current detection cycle is μ PR is 0.3, and the variance σ PR is 0.05, and In the above equation, we can get Z (6) =0.825.

[0122] Step 5:

[0123] Determine whether the node characteristic parameter of each node in the network topology exceeds the node characteristic parameter threshold. If it does not exceed the threshold range, continue the detection of the next cycle. If one or more nodes exceed the corresponding threshold range, start the corresponding defense strategy. Taking route 6 as an example, assuming that the maximum value of the node characteristic parameter corresponding to route 6 under normal circumstances is 2, since the node characteristic parameter Z of route 6 in the current detection cycle is (6) is 0.825, so the node characteristic parameter Z of route 6 in the current detection cycle can be determined (6) The threshold is not exceeded, so there is no need to start the defense strategy for route 6. When the node characteristic parameter Z of route 6 is (6) When the actual value of exceeds threshold 2, for example, the node characteristic parameter Z of route 6 (6) When the actual value of is 5, the node characteristic parameter Z of route 6 in the current detection cycle can be determined (6) If the threshold is exceeded, router 6 may be under a pulse DDoS attack, so a defense strategy for router 6 can be initiated, such as Figure 3 As shown, route 6 can be switched to backup route 6', and an interception strategy can be implemented through a firewall to filter attack traffic in the network, and an alarm can be issued to notify maintenance personnel to conduct further confirmation and processing in a timely manner.

[0124] Based on the same technical concept, an embodiment of the present application also provides a defense device for distributed denial of service attacks. Figure 4 A schematic diagram of the structure of a distributed denial of service attack defense device provided in an embodiment of the present application. Figure 4 As shown, the device includes an acquisition module 401, a traffic dynamic weight calculation module 402, a dynamic ranking value calculation module 403 and a response module 404.

[0125] The acquisition module 401 is used to acquire the traffic characteristic parameters of each link in the network topology structure within the current detection period based on the connection relationship between the nodes in the current network topology structure.

[0126] The traffic dynamic weight calculation module 402 is used to obtain the traffic dynamic weight of each link in the network topology structure according to the traffic characteristic parameters.

[0127] The dynamic ranking value calculation module 403 is used to obtain the dynamic ranking value of each node in the network topology structure according to the dynamic weight of the traffic.

[0128] The response module 404 is used to determine whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node. When the node characteristic parameter of any node exceeds the node characteristic parameter threshold corresponding to the node, the defense strategy for the node is initiated.

[0129] In some embodiments, the response module 404 is specifically used to start a backup node of the attacked node to form a new network topology. The acquisition module 401 is also used to acquire the connection relationship between each node in the new network topology.

[0130] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0131] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the function of any of the aforementioned distributed denial of service attack defense devices.

[0132] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown, the electronic device provided in the embodiment of the present application includes at least one processor 501 and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0133] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute the distributed denial of service attack defense method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 4 The functions of each module in the device shown.

[0134] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0135] In the embodiment of the present application, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0136] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of a distributed denial of service attack defense method disclosed in the embodiments of the present application can be directly embodied as a hardware processor execution, or a combination of hardware and software modules in the processor.

[0137] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0138] By programming the processor 501, the code corresponding to the distributed denial of service attack defense method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1The defense method for distributed denial of service attack in the illustrated embodiment. How to design and program the processor 501 is a technique known to those skilled in the art and will not be described in detail here.

[0139] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0140] Based on the same technical concept, an embodiment of the present application provides a computer storage medium, which includes: a computer program code, which, when executed on a computer, enables the computer to execute any of the methods for defending against a distributed denial of service attack discussed above. Since the principle of solving the problem by the above-mentioned computer storage medium is similar to the method for defending against a distributed denial of service attack, the implementation of the above-mentioned computer storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0141] In the specific implementation process, the computer storage medium may include: Universal Serial Bus Flash Drive (USB), mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other storage media that can store program codes.

[0142] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any of the defense methods for distributed denial of service attacks discussed above. Since the principle of solving the problem by the above computer program product is similar to the defense method for distributed denial of service attacks, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0143] The computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0144] The method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0145] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the instructions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0149] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for defending against distributed denial of service (DDoS) attacks, characterized in that: include: Based on the connection relationship between nodes in the current network topology, the traffic characteristic parameters of each link in the network topology within the current detection period are obtained; According to the traffic characteristic parameters, respectively obtaining the traffic dynamic weight of each link in the network topology structure; According to the dynamic weight of the traffic, a dynamic ranking value of each node in the network topology structure is obtained respectively; According to the dynamic ranking value, node characteristic parameters of each node in the network topology structure are obtained respectively; Determine whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node; when the node characteristic parameter of any node exceeds the node characteristic parameter threshold corresponding to the node, initiate a defense strategy for the node.

2. The method according to claim 1, characterized in that The flow characteristic parameters of each link include: flow value, communication frequency and the proportion of various protocol data in the data packet; The step of obtaining the dynamic traffic weight of each link in the network topology structure according to the traffic characteristic parameters specifically includes: The dynamic weight of the traffic of each link is calculated according to the traffic volume value, communication frequency and proportion of various protocol data in the data packet of each link in the network topology structure in the current detection period.

3. The method according to claim 2, characterized in that The dynamic traffic weight of each link is obtained by the following formula: w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ; Among them, w ij represents the dynamic weight of the traffic of the link between node i and node j in the network topology; flow ij represents the flow value of the link transmission between node i and node j, min(flow) represents the minimum flow value of all links in the network topology structure, and max(flow) represents the maximum flow value of all links in the network topology structure; freq ij represents the communication frequency of the link between node i and node j, min(freq) represents the minimum value of the communication frequency among all links in the network topology, and max(freq) represents the maximum value of the communication frequency among all links in the network topology; Protocols represents a collection of all types of protocols contained in a data packet. represents the traffic volume transmitted by protocol p on the link between node i and node j, W P is the proportion of protocol p in the data packet; α, β, and γ are set coefficients.

4. The method according to claim 1, characterized in that The step of obtaining the dynamic ranking value of each node in the network topology structure according to the dynamic traffic weight specifically includes: Substitute the traffic dynamic weight into the improved PageRank calculation formula to calculate the dynamic ranking value of each node in the network topology structure.

5. The method according to claim 4, characterized in that The improved PageRank calculation formula is: Wherein, PR(i,t) represents the dynamic ranking value of node i in the current detection cycle; PR(i,t-1) represents the dynamic ranking value of node i in the previous detection cycle; w ij represents the dynamic weight of the traffic of the link between node i and node j in the network topology; M(i) represents the set of all nodes pointing to node i; L(j) represents the number of all links starting from node j; d represents the damping factor.

6. The method according to claim 1, characterized in that The node characteristic parameters of each node in the network topology structure are obtained according to the dynamic ranking value, specifically including: The dynamic ranking value of each node is substituted into the node characteristic parameter calculation formula to calculate the node characteristic parameters of each node in the network topology structure.

7. The method according to claim 6, characterized in that The calculation formula of the node characteristic parameters is: Among them, Z (i) Represents the node characteristic parameters of node i; PR(i,t) represents the dynamic ranking value of node i in the current detection cycle; μ PR represents the average of the dynamic ranking values ​​of all nodes in the network topology in the current detection cycle; σ PR It represents the standard deviation of the dynamic ranking values ​​of all nodes in the network topology within the current detection cycle.

8. The method according to any one of claims 1 to 7, characterized in that: The defense strategy for launching the attacked point includes: Starting a backup node of the attacked node to form a new network topology; The method further comprises: The connection relationship between each node in the new network topology is obtained.

9. A DDoS attack defense device, characterized in that: include: An acquisition module, used to acquire the flow characteristic parameters of each link in the network topology structure within the current detection period based on the connection relationship between the nodes in the current network topology structure; A traffic dynamic weight calculation module, used to obtain the traffic dynamic weight of each link in the network topology structure according to the traffic characteristic parameters; A dynamic ranking value calculation module, used to obtain the dynamic ranking value of each node in the network topology structure according to the dynamic weight of the traffic; The response module is used to determine whether the node characteristic parameter of each node exceeds the node characteristic parameter threshold corresponding to the node. When the node characteristic parameter of any node exceeds the node characteristic parameter threshold corresponding to the node, the defense strategy for the node is initiated.

10. The DDoS attack defense device according to claim 9, characterized in that: The response module is specifically used to start the backup node of the attacked node to form a new network topology; The acquisition module is also used to acquire the connection relationship between each node in the new network topology.

11. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method according to any one of claims 1 to 8 when executing a computer program stored in the memory.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images