Methods, devices, and electronic equipment for defending against distributed denial-of-service attacks

Abstract

This application discloses a method, apparatus, and electronic device for defending against distributed denial-of-service (DDoS) attacks, relating to the field of network security technology. The method includes: obtaining traffic characteristic parameters of each link in the current network topology within the current detection period based on the connection relationships between nodes in the current network topology; obtaining dynamic traffic weights for each link in the network topology based on the traffic characteristic parameters; obtaining dynamic ranking values ​​for each node in the network topology based on the dynamic traffic weights; obtaining node characteristic parameters for each node in the network topology based on the dynamic ranking values; determining whether the node characteristic parameters of each node exceed the corresponding node characteristic parameter threshold; and activating a defense strategy for that node when the node characteristic parameters of any node exceed the corresponding node characteristic parameter threshold. This improves the timeliness and accuracy of DDoS attack defense and ensures network security.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to methods, apparatus and electronic devices for defending against distributed denial-of-service attacks. Background Technology

[0002] A Distributed Denial of Service (DDoS) attack refers to an attack launched simultaneously by multiple attackers in different locations against one or more targets, or an attacker controlling multiple machines in different locations and using these machines to launch attacks against the victim simultaneously.

[0003] Compared to traditional flood-style DDoS attacks, the new pulse-style DDoS attacks are launched intermittently. Attackers launch a strong wave of DDoS attacks in a short period of time, then suddenly stop, and then launch again. Because the attack traffic reaches its peak rapidly, traditional detection methods may not be able to respond in time, and during the rest period, the traffic may return to normal levels, making it difficult for defense systems to accurately identify the attack. Therefore, there is an urgent need to develop a timely and accurate defense method to address the threat posed to network security by pulse-style DDoS attacks. Summary of the Invention

[0004] This application provides a method, apparatus, and electronic device for defending against distributed denial-of-service attacks, in order to improve the timeliness and accuracy of distributed denial-of-service attack defense.

[0005] Firstly, a method for defending against distributed denial-of-service (DDoS) attacks is provided, including:

[0006] Based on the connection relationships between nodes in the current network topology, obtain the traffic characteristic parameters of each link in the network topology within the current detection period;

[0007] Based on the traffic characteristic parameters, the dynamic traffic weight of each link in the network topology is obtained.

[0008] Based on the dynamic weight of traffic, the dynamic ranking value of each node in the network topology is obtained;

[0009] Based on the dynamic ranking value, the node characteristic parameters of each node in the network topology are obtained respectively;

[0010] Determine whether the node feature parameters of each node exceed the corresponding node feature parameter threshold. When the node feature parameters of any node exceed the corresponding node feature parameter threshold, activate the defense strategy for that node.

[0011] This application improves the accuracy and real-time performance of subsequent distributed denial-of-service (DDoS) attack detection by periodically acquiring traffic characteristic parameters of each link in the network topology. The traffic characteristic parameters are used to calculate the dynamic weight of each link's traffic, accurately reflecting network traffic fluctuations and providing data support for identifying potential DDoS attacks. Then, based on the dynamic weight of each link's traffic, the dynamic ranking value of each node in the network topology is calculated. Furthermore, based on each node's dynamic ranking value, node characteristic parameters are calculated to determine whether any node in the network topology is under DDoS attack, enabling the activation of corresponding defense strategies. This improves the timeliness and accuracy of DDoS attack defense, especially pulsed DDoS attack defense, helping to reduce the threat of DDoS attacks to network security and ensuring network security.

[0012] In some embodiments, the traffic characteristic parameters of each link include: traffic volume value, communication frequency, and the proportion of various protocol data in the data packet;

[0013] Based on the traffic characteristic parameters, the dynamic traffic weights of each link in the network topology are obtained, specifically including:

[0014] Based on the traffic volume, communication frequency, and proportion of various protocol data in the data packets of each link in the network topology during the current detection period, the dynamic traffic weight of each link is calculated.

[0015] By obtaining the traffic volume, communication frequency, and proportion of various protocol data in the data packets of each link as traffic characteristic parameters, it is beneficial to accurately and comprehensively reflect the traffic characteristics of each link and improve the accuracy of the dynamic weight calculation results of traffic.

[0016] In some embodiments, the dynamic traffic weight for each link is obtained using the following formula:

[0017] w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ;

[0018] Among them, w ij This represents the dynamic weight of traffic on the link between node i and node j in the network topology.

[0019] flow ijThis represents the flow rate of the link between node i and node j. min(flow) represents the minimum flow rate of all links in the network topology, and max(flow) represents the maximum flow rate of all links in the network topology.

[0020] freq ij Let represent the communication frequency of the link between node i and node j, min(freq) represents the minimum communication frequency among all links in the network topology, and max(freq) represents the maximum communication frequency among all links in the network topology.

[0021] Protocols represents the collection of all types of protocols contained in the data packet. W represents the amount of traffic transmitted by protocol p on the link between node i and node j. P It represents the proportion of protocol p in the data packet;

[0022] α, β, and γ are set coefficients.

[0023] The above calculation process takes into account the impact of traffic volume, communication frequency, and the proportion of each protocol data in the data packet on the dynamic weight of traffic for each link, so as to improve the accuracy of the dynamic weight calculation results.

[0024] In some embodiments, the dynamic ranking value of each node in the network topology is obtained according to the dynamic weight of traffic, specifically including:

[0025] By substituting the dynamic weight of traffic into the improved PageRank calculation formula, the dynamic ranking value of each node in the network topology is calculated.

[0026] In some embodiments, the improved PageRank calculation formula is as follows:

[0027]

[0028] Where PR(i,t) represents the dynamic ranking value of node i in the current detection period;

[0029] PR(i,t-1) represents the dynamic ranking value of node i in the previous detection period;

[0030] w ij This represents the dynamic weight of traffic on the link between node i and node j in the network topology.

[0031] M(i) represents the set of all nodes pointing to node i;

[0032] L(j) represents the number of all links originating from node j;

[0033] d represents the damping factor.

[0034] The above calculation process uses an improved PageRank algorithm to calculate the dynamic ranking value of each node, which is beneficial for detecting the real-time changes in the dynamic ranking value of each node and realizing real-time and accurate detection of pulse DDoS attacks.

[0035] In some embodiments, node characteristic parameters of each node in the network topology are obtained based on the dynamic ranking value, specifically including:

[0036] Substitute the dynamic ranking value of each node into the node feature parameter calculation formula to calculate the node feature parameters of each node in the network topology.

[0037] In some embodiments, the formula for calculating node feature parameters is as follows:

[0038]

[0039] Among them, Z (i) Represents the node characteristic parameters of node i;

[0040] PR(i,t) represents the dynamic ranking value of node i in the current detection period;

[0041] μ PR This represents the average dynamic ranking value of all nodes in the network topology during the current detection period.

[0042] σ PR It represents the standard deviation of the dynamic ranking values ​​of all nodes in the network topology during the current detection period.

[0043] The above calculation process introduces the mean and standard deviation of the dynamic ranking values ​​of all nodes in the network topology within the current detection period. This can eliminate the influence of random changes in the traffic of a single or a few nodes on the calculation results, and improve the accuracy of the node characteristic parameter calculation results for each node through overall judgment.

[0044] In some embodiments, activating a defense strategy targeting the attacked point includes:

[0045] Start the backup node of the attacked node to form a new network topology;

[0046] The method also includes:

[0047] Obtain the connection relationships between each node in the new network topology.

[0048] The above method allows for real-time updates to the network topology, ensuring accurate acquisition of traffic characteristic parameters for each link during subsequent detection cycles.

[0049] Secondly, a DDoS attack defense device is provided, comprising:

[0050] The acquisition module is used to acquire the traffic characteristic parameters of each link in the network topology within the current detection period based on the connection relationship between nodes in the current network topology.

[0051] The traffic dynamic weight calculation module is used to obtain the traffic dynamic weight of each link in the network topology based on traffic characteristic parameters.

[0052] The dynamic ranking value calculation module is used to obtain the dynamic ranking value of each node in the network topology based on the dynamic weight of traffic.

[0053] The response module is used to determine whether the node characteristic parameters of each node exceed the threshold of the corresponding node characteristic parameters. When the node characteristic parameters of any node exceed the threshold of the corresponding node characteristic parameters, the defense strategy for that node is activated.

[0054] In some embodiments, the response module is specifically used to activate a backup node of the attacked node to form a new network topology.

[0055] The acquisition module is also used to acquire the connection relationships between each node in the new network topology.

[0056] Thirdly, an electronic device is provided, comprising:

[0057] A memory for storing computer programs; a processor for executing the computer programs stored in the memory, implementing any of the methods in the first aspect.

[0058] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the method of any one of the first aspects.

[0059] For the various aspects of the second to fourth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect or the various possible solutions in the first aspect, which will not be repeated here. Attached Figure Description

[0060] Figure 1 A schematic diagram of the defense method against distributed denial-of-service attacks provided in this application embodiment;

[0061] Figure 2A schematic diagram of a network topology provided in an embodiment of this application;

[0062] Figure 3 This is a schematic diagram of another network topology provided in an embodiment of this application;

[0063] Figure 4 A schematic diagram of a defense device against distributed denial-of-service attacks provided in an embodiment of this application;

[0064] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0066] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0067] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0068] A Distributed Denial of Service (DDoS) attack refers to an attack launched simultaneously by multiple attackers in different locations against one or more targets, or an attacker controlling multiple machines in different locations and using these machines to launch attacks against the victim simultaneously.

[0069] Compared to traditional flood-style DDoS attacks, the new pulse-style DDoS attacks are launched intermittently. Attackers launch a strong DDoS attack in a short period of time, then suddenly stop, and then launch it again. Because the attack traffic reaches its peak rapidly, traditional detection methods may not be able to respond in time, and during the rest period, the traffic may return to normal levels, making it difficult for defense systems to accurately identify the attack.

[0070] In view of this, this application provides a method, apparatus, electronic device, and storage medium for defending against distributed denial-of-service attacks, in order to overcome the above-mentioned problems.

[0071] This application provides a method for defending against distributed denial-of-service attacks. Figure 1 This is a schematic flowchart of a method for defending against distributed denial-of-service attacks provided in an embodiment of this application. (Refer to...) Figure 1 The method for defending against distributed denial-of-service attacks provided in this application includes the following steps:

[0072] S110: Based on the connection relationship between each node in the current network topology, obtain the traffic characteristic parameters of each link in the network topology within the current detection period.

[0073] In this embodiment, distributed denial-of-service attacks can be detected in real time according to a set period T. Generally, the shorter the set period T, the more accurate the detection results. In specific implementations, the set period T can be set to a fixed value according to the actual situation, or the set period T can be automatically adjusted according to the actual traffic conditions. For example, the detection frequency can be increased when abnormal traffic is detected to further improve the detection accuracy. This is not limited here.

[0074] Figure 2 A network topology diagram provided for an embodiment of this application, such as... Figure 2 As shown, the network topology includes multiple nodes (such as...) Figure 2 Routes 1 through 8 (e.g., middle routes) and links used for connections between nodes (e.g., middle routes 1 through 8) Figure 2 (Links 1 through 9, etc.). It should be noted that... Figure 2 The network topology shown is for illustrative purposes only. In actual implementation, the network topology can be other structures, which are not limited here. Generally, firewalls or other security measures can be set up at the network boundary for protection. In the distributed denial-of-service attack defense method provided in this application embodiment, within a set detection period T, the traffic characteristic parameters of each link in the network topology can be obtained based on the connection relationships between nodes in the current detection period. The traffic characteristic parameters are used to characterize the traffic characteristics of each link in the current detection period. Based on the traffic characteristics of each link, it is beneficial to accurately determine whether there are any abnormal nodes in the network topology.

[0075] S120: Based on the traffic characteristic parameters, obtain the dynamic traffic weight of each link in the network topology.

[0076] In this step, the dynamic weight of traffic for each link can be calculated based on traffic characteristic parameters. The dynamic weight of traffic is used to calculate the dynamic ranking value of each node in the network topology.

[0077] In some embodiments, the traffic characteristic parameters of each link include the traffic volume flowing through the link, the communication frequency of the link, and the proportion of each protocol data in the data packets during the current detection period. Since the difference between abnormal and normal traffic during a distributed denial-of-service attack lies mainly in the changes in traffic volume, communication frequency, and the proportion of each protocol data in the data packets, for example, when a node is subjected to a pulsed DDoS attack, the traffic volume transmitted on the corresponding link during the attack may increase significantly, and the communication frequency may increase significantly. Attack traffic often uses both TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) protocols simultaneously, leading to changes in the proportion of different protocol data. Therefore, the traffic volume flowing through the link, the communication frequency of the link, and the proportion of each protocol data in the data packets can be used as the traffic characteristic parameters of each link. Thus, the dynamic traffic weight of each link can be calculated based on the traffic volume, communication frequency, and proportion of various protocol data in the data packets of each link in the network topology during the current detection period.

[0078] In practice, the dynamic traffic weight for each link can be obtained using the following formula:

[0079] w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ;

[0080] Among them, w ij This represents the dynamic weight of traffic on the link between node i and node j in the network topology.

[0081] flow ij This represents the flow rate of the link between node i and node j. min(flow) represents the minimum flow rate of all links in the network topology, and max(flow) represents the maximum flow rate of all links in the network topology.

[0082] freq ij Let represent the communication frequency of the link between node i and node j, min(freq) represents the minimum communication frequency among all links in the network topology, and max(freq) represents the maximum communication frequency among all links in the network topology.

[0083] Protocols represents the collection of all types of protocols contained in the data packet. W represents the amount of traffic transmitted by protocol p on the link between node i and node j. P It represents the proportion of protocol p in the data packet; This indicates that for all protocols in the data packet, ... To perform summation, for example, if a data packet contains multiple protocols P1, P2, and P3, i.e., Protocols = {P1, P2, P3}, then...

[0084] α, β, and γ are set coefficients; the specific values ​​of α, β, and γ can be adjusted according to network characteristics. For example, the values ​​of α, β, and γ can be adjusted through multiple tests to improve the accuracy of pulse DDoS attack detection.

[0085] The above calculation process takes into account the impact of traffic volume, communication frequency, and the proportion of each protocol data in the data packet on the dynamic weight of traffic for each link, so as to improve the accuracy of the dynamic weight calculation results.

[0086] S130: Based on the dynamic weight of traffic, obtain the dynamic ranking value of each node in the network topology.

[0087] In this step, the dynamic ranking value of each node in the network topology can be calculated based on the dynamic weight of traffic.

[0088] In some embodiments, the algorithm for calculating the dynamic ranking value of a node can employ an improved PageRank algorithm. The core idea of ​​the PageRank algorithm is to evaluate the importance of a webpage based on the link relationships between webpages. In the traditional PageRank algorithm, a webpage's PageRank value is mainly determined by the number and quality of links pointing to that page; that is, the webpage ranking value primarily depends on the network topology. Once the network topology is determined, the webpage ranking value will no longer change. In this embodiment of the invention, a dynamic traffic weight is introduced to improve the PageRank algorithm, used to calculate the dynamic ranking value of each node in the network topology. Since the traffic characteristic parameters of each link change in real time during a pulse DDoS attack, leading to changes in the dynamic traffic weight of each link, the improved PageRank algorithm can be used to calculate the dynamic ranking value of each node in the current detection period. This allows the dynamic ranking value of each node in the network topology to no longer depend solely on the network topology, but to change in real time according to changes in network traffic. Based on the node's dynamic ranking value, it is further possible to determine whether the node has experienced an anomaly, thereby facilitating real-time and accurate detection of pulse DDoS attacks.

[0089] In practice, the dynamic ranking value of each node can be obtained using the following formula (i.e., the improved PageRank calculation formula):

[0090]

[0091] Where PR(i,t) represents the dynamic ranking value of node i in the current detection period;

[0092] PR(j,t-1) represents the dynamic ranking value of node j in the previous detection period;

[0093] w ij This represents the dynamic weight of traffic on the link between node i and node j in the network topology.

[0094] M(i) represents the set of all nodes pointing to node i;

[0095] L(j) represents the number of all links originating from node j;

[0096] d represents the damping factor;

[0097] This means that for all nodes in set M(i) that point to node i, ... To perform summation, for example, if in the network topology all nodes pointing to node i include j1, j2, and j3, i.e., M(i) = {j1, j2, j3}, then...

[0098] S140: Based on the dynamic ranking value, obtain the node characteristic parameters of each node in the network topology.

[0099] In this step, node characteristic parameters for each node in the network topology can be calculated based on the dynamic ranking value of each node. These node characteristic parameters are then compared with the corresponding node characteristic parameter thresholds to accurately determine whether the node is under a pulse DDoS attack.

[0100] In practice, the dynamic ranking value of each node can be substituted into the node characteristic parameter calculation formula to calculate the node characteristic parameters of each node in the network topology.

[0101] The formula for calculating node feature parameters can be:

[0102]

[0103] Among them, Z (i) Represents the node characteristic parameters of node i;

[0104] PR(i,t) represents the dynamic ranking value of node i in the current detection period;

[0105] μ PR This represents the average dynamic ranking value of all nodes in the network topology during the current detection period.

[0106] σ PR It represents the standard deviation of the dynamic ranking values ​​of all nodes in the network topology during the current detection period.

[0107] The above calculation process introduces the mean and standard deviation of the dynamic ranking values ​​of all nodes in the network topology within the current detection period. This can eliminate the influence of random changes in the traffic of a single or a few nodes on the calculation results, and improve the accuracy of the node characteristic parameter calculation results for each node through overall judgment.

[0108] S150: Determine whether the node feature parameters of each node exceed the threshold of the corresponding node feature parameters. When the node feature parameters of any node exceed the threshold of the corresponding node feature parameters, activate the defense strategy for that node.

[0109] In this step, the node feature parameters of each node are compared with the corresponding node feature parameter threshold to determine whether each node's node feature parameters exceed the threshold. Specifically, under normal operating conditions, the node feature parameter Z of each node can be calculated. (i) The maximum and / or minimum values ​​are set as the threshold values ​​for the corresponding node's characteristic parameters. When any node's characteristic parameters exceed the threshold value within the current detection period, it is considered that the node may be under a pulse DDoS attack, allowing for the rapid activation of defense strategies against such nodes. These defense strategies include switching the node under attack to a backup node to alleviate traffic pressure, and implementing firewall blocking policies to filter attack traffic in the network. Specific implementation strategies can be tailored to the actual situation and are not limited here.

[0110] In practice, when multiple nodes in the network topology are simultaneously subjected to a pulsed DDoS attack, defense strategies can be activated for each node affected by the pulsed DDoS attack, and then the next detection cycle can continue. When it is detected that none of the nodes in the network topology have been attacked, the next detection cycle can continue.

[0111] The pulse DDoS attack defense method provided in this application periodically acquires traffic characteristic parameters of each link in the network topology to improve the accuracy and real-time performance of the subsequently improved PageRank algorithm. The traffic characteristic parameters are used to calculate the dynamic traffic weight of each link, enabling it to accurately reflect network traffic fluctuations and providing data support for identifying potential pulse DDoS attacks. Then, based on the dynamic traffic weight of each link, the improved PageRank algorithm is used to calculate the dynamic ranking value of each node in the network topology. Based on the dynamic ranking value of each node, node characteristic parameters are further calculated to determine whether each node in the network topology has been subjected to a pulse DDoS attack, thus initiating corresponding defense strategies. This improves the timeliness and accuracy of pulse DDoS attack defense, helps reduce the threat of pulse DDoS attacks to network security, and ensures network security.

[0112] In some embodiments, initiating a defense strategy targeting the attacked point may specifically include: activating a backup node of the attacked node to form a new network topology. Figure 3 This is a schematic diagram of another network topology provided in an embodiment of this application. For example, as shown below... Figure 3 As shown, when a pulsed DDoS attack is detected on route 6, a backup node, route 6', can be activated to alleviate traffic pressure. Routes 4 and 6' can be connected via a new link 2'. The distributed denial-of-service attack defense method provided in this application also includes obtaining the connection relationships between each node in the new network topology, thereby updating the network topology in real time to ensure accurate acquisition of traffic characteristic parameters for each link in subsequent detection cycles.

[0113] To make the defense method against distributed denial-of-service attacks provided in the embodiments of this application clearer, the following is combined with... Figure 2 and Figure 3 This application provides an example of a method for defending against distributed denial-of-service attacks. In one possible embodiment, the method for defending against distributed denial-of-service attacks specifically includes the following steps:

[0114] Step 1:

[0115] Obtain the connection relationships between nodes in the current network topology. Based on the connection relationships between nodes in the network topology during the current detection period, obtain the traffic characteristic parameters of each link in the network topology, such as the amount of traffic transmitted by each link during the current detection period, the communication frequency, and the proportion of various protocol data in the data packets.

[0116] Step 2:

[0117] Calculate the dynamic traffic weight w for each link based on its traffic characteristic parameters in the network topology. ij For example, according to Figure 2 The network topology shown assumes that, within the current detection period, the dynamic weight w of the traffic on link 1 between route 1 and route 4 is calculated based on the traffic characteristic parameters of each link. 14 =0.8, the dynamic weight w of traffic on link 2 between route 4 and route 6. 46 =0.9, the dynamic weight w of traffic on link 3 between route 2 and route 4. 24 =0.5, the dynamic weight w of traffic on link 4 between route 4 and route 7. 47 =0.6, the dynamic weight w of traffic on link 5 between route 2 and route 5. 25 =0.2, the dynamic weight w of traffic on link 6 between route 5 and route 7. 57 =0.3, the dynamic weight w of traffic on link 7 between route 3 and route 5. 35 =0.1, the dynamic weight w of traffic on link 8 between route 5 and route 8. 58 =0.2.

[0118] Step 3:

[0119] Dynamically weight the traffic of each link w ij Substitute the improved PageRank calculation formula. Taking route 6 as an example, the node pointing to route 6 is route 4, w 46 =0.9, the number of all links originating from route 4 is L(4)=2, assuming the damping factor d is 0.85, and assuming the dynamic ranking value of route 4 in the previous detection period is PR(i,t-1)=0.2, substitute into In the current detection period, the dynamic ranking value of route 6, PR(6,t), is obtained as 0.34125.

[0120] Step 4:

[0121] Based on the dynamic ranking values ​​of each node, the node characteristic parameters of each node in the network topology are calculated. Taking route 6 as an example, let's assume the mean μ of the dynamic ranking values ​​of all nodes in the network topology during the current detection period. PR The variance σ is 0.3. PR It is 0.05, substituting... From this, we can obtain Z. (6) =0.825.

[0122] Step 5:

[0123] The system determines whether the node characteristic parameters of each node in the network topology exceed the threshold value for that node. If they do not exceed the threshold, the detection continues to the next cycle. If one or more nodes exceed the corresponding threshold, the corresponding defense strategy is activated. Taking route 6 as an example, assuming that the maximum value of the node characteristic parameter for route 6 under normal circumstances is 2, and since the node characteristic parameter Z of route 6 in the current detection cycle... (6) The value is 0.825, therefore the node characteristic parameter Z of route 6 within the current detection period can be determined. (6) If the threshold is not exceeded, no defense strategy for route 6 needs to be activated. When the node characteristic parameter Z of route 6 exceeds the threshold within a certain detection period... (6) When the actual value exceeds the threshold of 2, for example, the node characteristic parameter Z of route 6. (6) When the actual value is 5, the node characteristic parameter Z of route 6 in the current detection period can be determined. (6) If the threshold is exceeded, Router 6 may be under a pulse DDoS attack, thus triggering defense strategies against Router 6, such as... Figure 3 As shown, route 6 can be switched to the backup route 6', and a firewall can be used to implement blocking policies, filter attack traffic in the network, and issue alerts to notify maintenance personnel to conduct further confirmation and handling in a timely manner.

[0124] Based on the same technical concept, this application also provides a defense device against distributed denial-of-service attacks. Figure 4 This is a schematic diagram of a defense device against distributed denial-of-service attacks provided in an embodiment of this application. Figure 4 As shown, the device includes an acquisition module 401, a traffic dynamic weight calculation module 402, a dynamic ranking value calculation module 403, and a response module 404.

[0125] The acquisition module 401 is used to acquire the traffic characteristic parameters of each link in the network topology within the current detection period based on the connection relationship between nodes in the current network topology.

[0126] The traffic dynamic weight calculation module 402 is used to obtain the traffic dynamic weight of each link in the network topology based on traffic characteristic parameters.

[0127] The dynamic ranking value calculation module 403 is used to obtain the dynamic ranking value of each node in the network topology based on the dynamic weight of traffic.

[0128] The response module 404 is used to determine whether the node feature parameters of each node exceed the node feature parameter threshold corresponding to that node. When the node feature parameters of any node exceed the node feature parameter threshold corresponding to that node, the defense strategy for that node is activated.

[0129] In some embodiments, the response module 404 is specifically used to activate a backup node of the attacked node to form a new network topology. The acquisition module 401 is also used to acquire the connection relationships between each node in the new network topology.

[0130] It should be noted that the apparatus provided in this application embodiment can implement all the method steps in the above method embodiment and achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0131] Based on the same technical concept, this application also provides an electronic device that can perform the function of any of the aforementioned distributed denial-of-service attack defense devices.

[0132] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 5 As shown, the electronic device provided in this application embodiment includes at least one processor 501 and a memory 502 connected to at least one processor 501. This application embodiment does not limit the specific connection medium between the processor 501 and the memory 502. Figure 5 The example shown is the connection between processor 501 and memory 502 via bus 500. Bus 500 is... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 500 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 5 The term 501 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller; there is no restriction on the name.

[0133] In this embodiment, memory 502 stores instructions executable by at least one processor 501. By executing the instructions stored in memory 502, at least one processor 501 can execute the distributed denial-of-service attack defense method discussed above. Processor 501 can implement... Figure 4 The functions of each module in the device shown.

[0134] The processor 501 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 502 and calling data stored in memory 502, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0135] In this embodiment, processor 501 may include one or more processing units. Processor 501 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 501. In some embodiments, processor 501 and memory 502 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0136] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the distributed denial-of-service attack defense method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0137] Memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 502 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 502 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0138] By designing and programming the processor 501, the code corresponding to the distributed denial-of-service attack defense method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during runtime. Figure 1The illustrated embodiment provides a method for defending against distributed denial-of-service attacks. How to design and program the processor 501 is a technique well-known to those skilled in the art and will not be described further here.

[0139] It should be noted that the electronic device provided in this application embodiment can implement all the method steps implemented in the above method embodiment and can achieve the same technical effect. Here, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail.

[0140] Based on the same technical concept, embodiments of this application provide a computer storage medium, which includes computer program code. When the computer program code is executed on a computer, it causes the computer to execute any of the distributed denial-of-service attack defense methods discussed above. Since the principle by which the above-described computer storage medium solves the problem is similar to the distributed denial-of-service attack defense methods, the implementation of the above-described computer storage medium can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0141] In specific implementation, computer storage media can include: Universal Serial Bus Flash Drive (USB), portable hard drive, Read-Only Memory (ROM), Random Access Memory (RAM), magnetic disk or optical disk, and other storage media that can store program code.

[0142] Based on the same technical concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the distributed denial-of-service attack defense methods discussed above. Since the principle by which the above computer program product solves the problem is similar to that of the distributed denial-of-service attack defense methods, the implementation of the above computer program product can refer to the implementation of the method, and repeated details will not be repeated.

[0143] Computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0144] The methods in this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, they can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in this application are performed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, core network equipment, OAM, or other programmable devices.

[0145] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0146] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0147] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that specifies the functions in one or more boxes. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including the instruction device, which is implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0148] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0149] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

Claims

1. A method for defending against distributed denial-of-service (DDoS) attacks, characterized in that, include: Based on the connection relationships between nodes in the current network topology, obtain the traffic characteristic parameters of each link in the network topology within the current detection period; Based on the traffic characteristic parameters, the dynamic traffic weight of each link in the network topology is obtained respectively; Based on the dynamic weight of the traffic, the dynamic ranking value of each node in the network topology is obtained respectively; Based on the dynamic ranking value, the node characteristic parameters of each node in the network topology are obtained respectively; Determine whether the node feature parameters of each node exceed the node feature parameter threshold corresponding to that node. When the node feature parameters of any node exceed the node feature parameter threshold corresponding to that node, activate the defense strategy for that node. The dynamic traffic weight of each link is obtained using the following formula: w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ; Among them, w ij This represents the dynamic weight of the traffic on the link between node i and node j in the network topology. flow ij Let represent the traffic volume transmitted between node i and node j, min(flow) represents the minimum traffic volume among all links in the network topology, and max(flow) represents the maximum traffic volume among all links in the network topology. freq ij Let represent the communication frequency of the link between node i and node j, min(freq) represent the minimum communication frequency among all links in the network topology, and max(freq) represent the maximum communication frequency among all links in the network topology. Protocols represents the collection of all types of protocols contained in the data packet. W represents the amount of traffic transmitted by protocol p on the link between node i and node j. P It represents the proportion of protocol p in the data packet; α, β, and γ are set coefficients.

2. The method as described in claim 1, characterized in that, The traffic characteristic parameters of each link include: traffic volume, communication frequency, and the proportion of various protocol data in the data packet; The step of obtaining the dynamic traffic weight of each link in the network topology based on the traffic characteristic parameters specifically includes: Based on the traffic volume, communication frequency, and proportion of various protocol data in the data packets of each link in the network topology during the current detection period, the dynamic traffic weight of each link is calculated.

3. The method as described in claim 1, characterized in that, The step of obtaining the dynamic ranking value of each node in the network topology based on the dynamic traffic weight specifically includes: Substitute the dynamic traffic weights into the improved PageRank calculation formula to calculate the dynamic ranking value of each node in the network topology.

4. The method as described in claim 3, characterized in that, The improved PageRank calculation formula is as follows: Wherein, PR(i,t) represents the dynamic ranking value of node i within the current detection period; PR(i,t-1) represents the dynamic ranking value of node i in the previous detection period; w ij This represents the dynamic weight of the traffic on the link between node i and node j in the network topology. M(i) represents the set of all nodes pointing to node i; L(j) represents the number of all links originating from node j; d represents the damping factor.

5. The method as described in claim 1, characterized in that, The step of obtaining the node characteristic parameters of each node in the network topology based on the dynamic ranking value specifically includes: Substitute the dynamic ranking value of each node into the node feature parameter calculation formula to calculate the node feature parameters of each node in the network topology.

6. The method as described in claim 5, characterized in that, The formula for calculating the node feature parameters is as follows: Among them, Z (i) Represents the node characteristic parameters of node i; PR(i,t) represents the dynamic ranking value of node i in the current detection period; μ PR This represents the average dynamic ranking value of all nodes in the network topology during the current detection period. σ PR This represents the standard deviation of the dynamic ranking values ​​of all nodes in the network topology during the current detection period.

7. The method according to any one of claims 1 to 6, characterized in that, Activating defense strategies against attacked nodes includes: Start the backup node of the attacked node to form a new network topology; The method further includes: Obtain the connection relationships between each node in the new network topology.

8. A DDoS attack defense device, characterized in that, include: The acquisition module is used to acquire the traffic characteristic parameters of each link in the network topology within the current detection period based on the connection relationship between nodes in the current network topology. The traffic dynamic weight calculation module is used to obtain the traffic dynamic weight of each link in the network topology based on the traffic characteristic parameters. The dynamic ranking value calculation module is used to obtain the dynamic ranking value of each node in the network topology based on the dynamic weight of the traffic, and to obtain the node characteristic parameters of each node in the network topology based on the dynamic ranking value. The response module is used to determine whether the node feature parameters of each node exceed the node feature parameter threshold corresponding to that node. When the node feature parameters of any node exceed the node feature parameter threshold corresponding to that node, the defense strategy for that node is activated. The dynamic traffic weight of each link is obtained using the following formula: w ij =α·NormFlow ij +β·NormFreq ij +γ·ProtoWeight ij ; Among them, w ij This represents the dynamic weight of the traffic on the link between node i and node j in the network topology. flow ij Let represent the traffic volume transmitted between node i and node j, min(flow) represents the minimum traffic volume among all links in the network topology, and max(flow) represents the maximum traffic volume among all links in the network topology. freq ij Let represent the communication frequency of the link between node i and node j, min(freq) represent the minimum communication frequency among all links in the network topology, and max(freq) represent the maximum communication frequency among all links in the network topology. Protocols represents the collection of all types of protocols contained in the data packet. W represents the amount of traffic transmitted by protocol p on the link between node i and node j. P It represents the proportion of protocol p in the data packet; α, β, and γ are set coefficients.

9. The DDoS attack defense device as described in claim 8, characterized in that, The response module is specifically used to activate the backup node of the attacked node to form a new network topology. The acquisition module is also used to acquire the connection relationships between each node in the new network topology.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method of any one of claims 1-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-7.

Images