Whole-network target-free intelligent traffic classification DDOS monitoring method and device

Abstract

The invention discloses a whole-network target-free intelligent traffic classification DDOS monitoring method and device, and the method comprises the steps: collecting Netflow traffic transmitted by routing equipment in a whole network in real time; the method comprises the following steps of: cleaning and normalizing acquired Netflow, extracting feature information of the Netflow, calculating statistics of the features, and constructing a baseline model by using an adaptive learning technology according to historical data and a flow mode; carrying out preliminary classification on Netflow traffic by using a K-means clustering algorithm, and identifying normal traffic and potential abnormal traffic; a random forest classifier is used to carry out further detailed classification on the preliminary classification result, and the DDoS attack in the abnormal traffic is accurately identified; combining the classification result with a baseline model, identifying DDoS attack traffic, triggering an alarm, and executing defense measures at the same time; and performing feedback updating on the baseline model after alarm processing. According to the method and the device, the abnormal traffic can be timely found and responded, and the accuracy and the effectiveness of DDoS attack detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of DDoS attack detection, in particular to a method and a device for whole-network non-target intelligent traffic classification DDOS monitoring. Background Art

[0002] With the rapid development of the Internet, DDoS attack methods have become increasingly complex and diverse. Traditional DDoS detection methods usually rely on predefined rules and feature matching to generate alarms, but these alarms may contain a large number of false positives or false negatives, which can easily lead to a large number of false positives and false negatives, resulting in waste of defense resources and misoperation. Therefore, a monitoring method and device that can intelligently identify and classify traffic is needed to cope with the ever-changing attack patterns. Traditional DDoS detection methods mainly rely on static rules and feature matching, which cannot be updated and adapted to new attack methods in a timely manner, which will lead to reduced detection accuracy and slower response speed. Non-target DDoS attacks on the entire network (such as UDP flood attacks, ICMP flood attacks, etc.) are often random and decentralized, and are difficult to be effectively monitored by traditional DDoS detection methods. Summary of the invention

[0003] In view of the above situation, the present invention provides a method and device for the whole network non-target intelligent traffic classification DDOS monitoring, which uses machine learning and big data analysis technology to achieve real-time monitoring and dynamic adjustment, improve detection accuracy and response speed; comprehensively monitor the whole network traffic, identify potential non-target DDoS attacks, and improve the security protection capability of the whole network; through deep learning and analysis of traffic characteristics, accurately identify abnormal traffic, reduce false alarms and missed alarms, improve defense efficiency, and improve the management and operation efficiency of the whole network; improve the management and operation efficiency of the whole network, reduce operation and maintenance costs, and ensure the stability and reliability of the whole network service.

[0004] To achieve the above purpose, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a method for non-target intelligent traffic classification DDOS monitoring in the entire network is proposed, and the method includes:

[0006] Collect Netflow traffic sent by routing devices in the entire network in real time;

[0007] After cleaning and normalizing the collected Netflow traffic, extract its feature information and calculate the statistics of these features. Then, based on historical data and traffic patterns, use adaptive learning technology to build a baseline model.

[0008] Use K-means clustering algorithm to preliminarily classify Netflow traffic and identify normal traffic and potential abnormal traffic;

[0009] Use the random forest classifier to further classify the preliminary classification results and accurately identify DDoS attacks in abnormal traffic;

[0010] The above classification results are combined with the baseline model to identify DDoS attack traffic, trigger an alarm, and execute defense measures; after the alarm is handled, the baseline model is fed back and updated.

[0011] Furthermore, the K-means clustering algorithm is used to preliminarily classify Netflow traffic and identify normal traffic and potential abnormal traffic, including:

[0012] By plotting the sum of squared errors under different K values, find the data point where the sum of squared errors decreases and the amplitude decreases significantly as the K value;

[0013] Evaluate whether the choice of K value is reasonable. The silhouette coefficient value is between -1 and 1. The higher the value, the more reasonable the cluster division.

[0014] Calculate the distance from each data point to the K cluster centers, assign the data point to the cluster center with the closest distance, calculate the centroid of each cluster, and use the centroid as the new cluster center, repeat the assignment and update steps until the position of the cluster center no longer changes significantly;

[0015] Based on the iteratively calculated cluster centers and cluster assignments, similar data points are grouped together to identify normal traffic and potential abnormal traffic.

[0016] Furthermore, the random forest classifier is used to further classify the preliminary classification results in detail to accurately identify DDoS attacks in abnormal traffic, including:

[0017] Construct a decision tree. For each decision tree, use the bootstrap sampling method to randomly extract samples from the training set. In the splitting process of each node, randomly select a feature subset to split the decision tree. Recursively split the sample until the predetermined tree depth is reached or the node purity reaches a certain standard.

[0018] The new Netflow traffic data is input into the trained random forest classifier for prediction. Each decision tree classifies the data point, and the final result is determined by the voting results of all decision trees.

[0019] For potential abnormal traffic, further identify the specific DDoS attack type and label it.

[0020] In one embodiment of the present invention, a device for non-target intelligent traffic classification DDOS monitoring in the entire network is also proposed, and the device includes:

[0021] Data collection module, used to collect Netflow traffic sent by routing devices in the entire network in real time;

[0022] The data preprocessing module is used to clean and normalize the collected Netflow traffic, extract its feature information, calculate the statistics of these features, and then use adaptive learning technology to build a baseline model based on historical data and traffic patterns;

[0023] The preliminary classification module is used to perform preliminary classification of Netflow traffic using the K-means clustering algorithm to identify normal traffic and potential abnormal traffic;

[0024] The detailed classification module is used to further classify the preliminary classification results using the random forest classifier to accurately identify DDoS attacks in abnormal traffic;

[0025] The intelligent analysis and threat assessment module is used to combine the above classification results with the baseline model, identify DDoS attack traffic, trigger alarms, and execute defense measures at the same time; after the alarm is handled, the baseline model is fed back and updated.

[0026] Furthermore, the preliminary classification module is specifically used to:

[0027] By plotting the sum of squared errors under different K values, find the data point where the sum of squared errors decreases and the amplitude decreases significantly as the K value;

[0028] Evaluate whether the choice of K value is reasonable. The silhouette coefficient value is between -1 and 1. The higher the value, the more reasonable the cluster division.

[0029] Calculate the distance from each data point to the K cluster centers, assign the data point to the cluster center with the closest distance, calculate the centroid of each cluster, and use the centroid as the new cluster center, repeat the assignment and update steps until the position of the cluster center no longer changes significantly;

[0030] Based on the iteratively calculated cluster centers and cluster assignments, similar data points are grouped together to identify normal traffic and potential abnormal traffic.

[0031] Furthermore, the detailed classification module is specifically used for:

[0032] Construct a decision tree. For each decision tree, use the bootstrap sampling method to randomly extract samples from the training set. In the splitting process of each node, randomly select a feature subset to split the decision tree. Recursively split the sample until the predetermined tree depth is reached or the node purity reaches a certain standard.

[0033] The new Netflow traffic data is input into the trained random forest classifier for prediction. Each decision tree classifies the data point, and the final result is determined by the voting results of all decision trees.

[0034] For potential abnormal traffic, further identify the specific DDoS attack type and label it.

[0035] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned method of network-wide non-targeted intelligent traffic classification DDOS monitoring is designed.

[0036] In one embodiment of the present invention, a computer-readable storage medium is also proposed, which stores a computer program for executing a method for network-wide non-target intelligent traffic classification DDOS monitoring.

[0037] Beneficial effects:

[0038] 1. The present invention uses advanced machine learning and big data analysis technologies to intelligently classify the traffic of the entire network. Intelligent traffic classification can effectively distinguish normal traffic from abnormal traffic, improve detection accuracy, reduce false alarms and missed alarms, and ensure the accuracy and reliability of the system.

[0039] 2. The present invention adopts multi-level analysis technology, including rule matching and machine learning, to perform multi-level and multi-dimensional analysis of traffic. The multi-level analysis technology can deeply explore traffic characteristics, identify complex attack behaviors, and provide more accurate and comprehensive attack detection.

[0040] 3. The present invention can monitor the entire network instead of targeting specific targets. This can capture abnormal traffic in the entire network more comprehensively without the need to pre-configure specific targets or rules, thus reducing the complexity of manual configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flow chart of the method for network-wide non-target intelligent traffic classification DDOS monitoring of the present invention;

[0042] Figure 2 It is a schematic diagram of the structure of the device for the whole network non-target intelligent traffic classification DDOS monitoring of the present invention;

[0043] Figure 3 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0044] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and design the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0045] Those skilled in the art will appreciate that the embodiments of the present invention may be designed as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be specifically designed in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0046] According to the implementation of the present invention, a method for DDOS monitoring of the whole network without target intelligent traffic classification is proposed. In the face of increasingly complex DDoS attacks, abnormal traffic can be discovered and responded to in a timely manner, the detection accuracy and response speed can be improved, false positives and false negatives can be reduced, network management and operation efficiency can be improved, and a comprehensive defense strategy can be provided. By adopting advanced machine learning and big data analysis technologies, intelligent and dynamic traffic monitoring and defense can be achieved, providing more effective protection for network security.

[0047] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0048] Figure 1 This is a flow chart of the method for network-wide non-target intelligent traffic classification DDOS monitoring of the present invention. Figure 1 As shown, the method includes:

[0049] 1. Define and build a data collection module to collect the Netflow traffic of router devices in the entire network.

[0050] 1.1. Construct and initialize the Netflow receiver, and initialize the network port 9999 to receive the Netflow binary stream;

[0051] 1.2. Furthermore, Netflow receivers are deployed as traffic monitoring devices at the network boundary and inside to collect Netflow traffic data sent by router devices in real time. Netflow traffic data includes packet header information, traffic size, transmission time, source and destination addresses, etc.

[0052] 2. Define the data preprocessing module.

[0053] 2.1. Further, the collected Netflow traffic data is cleaned, invalid data is filtered, and the Netflow traffic data is normalized to handle abnormal values ​​and missing values;

[0054] 2.2. Further, the Netflow traffic data is normalized to convert data with different characteristics into the same dimension range for subsequent analysis and processing;

[0055] 2.3. Further, feature extraction is performed on the Netflow traffic data: important features are extracted from the Netflow traffic data, such as source IP, destination IP, traffic size, packet rate, protocol type, time interval, etc.

[0056] 3. Build a traffic baseline model and calculate baseline statistics to help subsequent models more clearly identify abnormal traffic.

[0057] 3.1. Further, calculate the statistics of traffic characteristics, including mean, standard deviation, maximum value, minimum value, calculate the traffic size, the average size and standard deviation of normal traffic, calculate the packet rate, including the mean and standard deviation of the packet rate of normal traffic;

[0058] 3.2. Further, according to the statistical results of normal traffic in historical data, a normal traffic pattern is established;

[0059] 3.3. Further, the adaptive learning baseline capability, the baseline can be dynamically adjusted over time and as traffic patterns change. This adaptive learning technology enables the baseline model to adapt to changes in traffic patterns, thereby improving the accuracy of the detection device; the baseline model is a simple or basic model used as a reference in machine learning or data analysis, which learns and accumulates Netflow traffic data for a long time to form a baseline value, providing a baseline value for subsequent data models;

[0060] 3.4. Further, the baseline model is updated in real time according to the new historical data and traffic patterns, so that it always reflects the current normal traffic pattern;

[0061] 3.5. Furthermore, the traffic that exceeds the baseline model is marked as abnormal traffic and will enter the next step of model matching, which provides additional reference for the preliminary classification K-means clustering algorithm and the secondary classification random forest algorithm, enabling these algorithms to identify abnormal traffic more accurately.

[0062] 4. Build a preliminary classification module and use the K-means clustering algorithm to preliminarily classify the traffic and identify normal traffic and potential abnormal traffic.

[0063] 4.1. Apply the K-means clustering algorithm to divide the traffic data into several clusters. The K-means clustering algorithm classifies similar traffic data points into one category by iteratively calculating cluster centers and cluster assignments;

[0064] 4.2. Further, select the K value, and determine the K value: divide the data into how many clusters according to the determined K value. The elbow rule can be used, that is, plot the sum of squared errors (SSE) under different K values, and find the data points where the SSE decreases and the amplitude decreases significantly as the K value; SSE reflects the sum of squared distances between the data point in the clustering result and the centroid of the cluster to which it belongs, and is used to evaluate the compactness of the clustering.

[0065] 4.3. Further, silhouette coefficient: evaluates whether the selection of K value is reasonable. The silhouette coefficient value is between -1 and 1. The higher the value, the more reasonable the cluster division.

[0066] 4.4. Further, calculate the distance from each data point to the K cluster centers, assign the data point to the cluster center with the closest distance, calculate the centroid of each cluster (the mean of the data points in the cluster), and use the centroid as the new cluster center. Repeat the assignment and update steps until the position of the cluster center no longer changes significantly.

[0067] 4.5. Further, the K-means clustering algorithm divides the Netflow traffic data into different clusters to help identify normal traffic and potential abnormal traffic. Abnormal traffic usually forms independent clusters, which are quite different from normal traffic clusters.

[0068] 5. Detailed classification module, uses random forest classifier to further classify the preliminary classification results in detail, and accurately identify DDoS attacks in abnormal traffic.

[0069] 5.1. Label the data and prepare labeled data containing normal traffic and various DDoS attack types. The data should include traffic characteristics and known labels (labels formed by K-means clustering), and be labeled with attack type or normal traffic labels;

[0070] 5.2. Further, a decision tree is constructed. For each decision tree, a bootstrap sampling method is used to randomly extract samples from the training set (Netflow traffic data collected over a long period of time). In the splitting process of each node, a feature subset is randomly selected to split the decision tree. The samples are split recursively until the predetermined tree depth is reached or the node purity reaches a certain standard.

[0071] 5.3. Further, the new Netflow traffic data is input into the trained random forest classifier for prediction. Each decision tree classifies the data point, and the final result is determined by the voting results of all decision trees. For abnormal traffic, the random forest classifier can further identify the specific DDoS attack type;

[0072] 5.4. Further, detailed classification of abnormal traffic, including the type of DDoS attack (such as SYN Flood, UDP Flood, etc.).

[0073] 6. The intelligent analysis and threat assessment module combines the baseline model and model detection data (data formed by K-means clustering algorithm and random forest classifier analysis) to identify abnormal traffic, confirm the alarm attack event, and set up an alarm mechanism. When an attack is detected, it automatically executes defense measures such as traffic filtering and IP blocking to reduce the impact of potential attacks. After the alarm is handled, the baseline model needs to be fed back and updated.

[0074] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0075] In order to explain the above-mentioned method of network-wide non-target intelligent traffic classification DDOS monitoring more clearly, a specific embodiment is used for illustration below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0076] Example:

[0077] The implementation process of the whole network non-target intelligent traffic classification DDOS monitoring is as follows:

[0078] Step 1: Deploy data collection equipment at the network inlet and outlet to collect Netflow traffic data generated by network equipment routers and switches.

[0079] Step 2: Netflow traffic analysis and storage: Perform preliminary analysis on the received Netflow traffic data, extract basic information, such as source IP address, destination IP address, port number, protocol type, data packet size, etc., and store the analyzed basic information in a high-performance database for subsequent processing and analysis. Use distributed storage technology to improve data access speed and reliability;

[0080] Example data format:

[0081]

[0082] Step 3: Network feature extraction and feature construction: Aggregate the captured raw data packets according to fixed time windows (such as 1 second, 5 seconds, etc.) to generate traffic records. Each traffic record contains the comprehensive features of all data packets in the time window. Generate feature vector data based on the generated feature data, including the number of packets, number of bytes, average packet size, packet rate, average packet interval time, and protocol distribution;

[0083] Extract features from Netflow traffic data to form a feature matrix. For example:

[0084]

[0085] Step 4: Traffic classification: Use clustering algorithms (such as K-means) to preliminarily classify traffic and identify normal traffic and potential abnormal traffic;

[0086] Furthermore, K cluster centers are randomly initialized;

[0087] Furthermore, the distance from each data point to the cluster center is calculated, and the data point is assigned to the nearest cluster center;

[0088] Furthermore, the cluster center is recalculated as the average value of all data points in the current cluster;

[0089] Further, the above steps are repeated until the cluster center no longer changes or the preset number of iterations is reached;

[0090] Furthermore, the clustering results are analyzed to identify abnormal traffic, and the traffic is divided into three categories (normal traffic, abnormal traffic, and suspicious traffic). Common abnormal traffic characteristics are: abnormally high number of traffic bytes and packets, short duration, and abnormally high source IP or destination IP request frequency.

[0091] Step 5: Use the random forest classifier to further classify the preliminary classification results;

[0092] Furthermore, the clustering results of K-means were used as labels to construct a training set for the random forest classifier;

[0093] Furthermore, based on the preliminary classification results, the data is annotated in a more detailed manner. For example, data that is initially classified as abnormal traffic is further classified as potential DDOS attacks, malicious scanning, and other similar attack behaviors;

[0094] Furthermore, a decision tree is constructed. For each decision tree, samples are randomly selected from the training set using the bootstrap sampling method. During the splitting process of each node, a feature subset is randomly selected to split the decision tree. The samples are split recursively until the predetermined tree depth is reached or the node purity reaches a certain standard. The classification results of each tree are voted, and the classification result with the most votes is finally selected as the final prediction.

[0095] The following is an example of K-means training data:

[0096]

[0097] Step 6: Further, by combining the baseline model and model detection data, when the IP exceeds a certain range of the baseline model set, and the model data of the IP is also determined to be malicious DDOS attack traffic, the Netflow traffic belonging to the IP is determined to be DDOS attack traffic, and a certain characteristic attack is automatically classified according to the protocol type in the traffic.

[0098] Step 7: Further, after confirming that the attack is complete, adjust and optimize the baseline model based on the feedback information, reduce the false alarm rate, continue to collect new Netflow traffic data, continuously improve and update the detection algorithm, and maintain the accuracy and effectiveness of the baseline model.

[0099] Based on the same inventive concept, the present invention also proposes a device for DDOS monitoring of the whole network without target intelligent traffic classification. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware designed for a predetermined function. Although the device described in the following embodiments is preferably designed with software, the design of hardware, or a combination of software and hardware is also possible and conceived.

[0100] Figure 2 This is a schematic diagram of the structure of the device for the whole network non-target intelligent traffic classification DDOS monitoring of the present invention. Figure 2 As shown, the device comprises:

[0101] The data collection module 101 is used to collect Netflow traffic sent by routing devices in the entire network in real time.

[0102] The data preprocessing module 102 is used to clean and normalize the collected Netflow traffic, extract its feature information, calculate the statistics of these features, and then use adaptive learning technology to build a baseline model based on historical data and traffic patterns.

[0103] The preliminary classification module 103 is used to perform preliminary classification on Netflow traffic using the K-means clustering algorithm to identify normal traffic and potential abnormal traffic; the details are as follows:

[0104] By plotting the sum of squared errors under different K values, find the data point where the sum of squared errors decreases and the amplitude decreases significantly as the K value;

[0105] Evaluate whether the choice of K value is reasonable. The silhouette coefficient value is between -1 and 1. The higher the value, the more reasonable the cluster division.

[0106] Calculate the distance from each data point to the K cluster centers, assign the data point to the cluster center with the closest distance, calculate the centroid of each cluster, and use the centroid as the new cluster center, repeat the assignment and update steps until the position of the cluster center no longer changes significantly;

[0107] Based on the iteratively calculated cluster centers and cluster assignments, similar data points are grouped together to identify normal traffic and potential abnormal traffic.

[0108] The detailed classification module 104 is used to use a random forest classifier to further classify the preliminary classification results in detail, and accurately identify DDoS attacks in abnormal traffic; the details are as follows:

[0109] Construct a decision tree. For each decision tree, use the bootstrap sampling method to randomly extract samples from the training set. In the splitting process of each node, randomly select a feature subset to split the decision tree. Recursively split the sample until the predetermined tree depth is reached or the node purity reaches a certain standard.

[0110] The new Netflow traffic data is input into the trained random forest classifier for prediction. Each decision tree classifies the data point, and the final result is determined by the voting results of all decision trees.

[0111] For potential abnormal traffic, further identify the specific DDoS attack type and label it.

[0112] The intelligent analysis and threat assessment module 105 is used to combine the above classification results with the baseline model, identify DDoS attack traffic, trigger an alarm, and execute defense measures at the same time; after the alarm is handled, the baseline model is fed back and updated.

[0113] It should be noted that although several modules of the device for monitoring DDOS without target intelligent traffic classification in the whole network are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0114] Based on the above invention concept, Figure 3 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned method for whole-network non-target intelligent traffic classification DDOS monitoring is designed.

[0115] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned method for network-wide non-targeted intelligent traffic classification DDOS monitoring.

[0116] The method and device for the whole network non-target intelligent traffic classification DDOS monitoring proposed by the present invention have the following highlights:

[0117] 1. Intelligent traffic classification: Using advanced machine learning and big data analysis technologies to intelligently classify network traffic, intelligent traffic classification can effectively distinguish normal traffic from abnormal traffic, improve detection accuracy, reduce false positives and false negatives, and ensure the accuracy and reliability of the system.

[0118] 2. Multi-level analysis technology: Multi-level analysis technology, including rule matching and machine learning, is used to conduct multi-level and multi-dimensional analysis of traffic. The multi-level analysis method can deeply explore traffic characteristics, identify complex attack behaviors, and provide more accurate and comprehensive attack detection.

[0119] 3. Targetless monitoring: Monitoring is performed across the entire network, rather than targeting specific targets. This allows for more comprehensive capture of abnormal traffic in the network without the need to pre-configure specific targets or rules, reducing the complexity of manual configuration.

[0120] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0121] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for non-target intelligent traffic classification DDOS monitoring in the whole network, characterized in that: The method includes: Collect Netflow traffic sent by routing devices in the entire network in real time; After cleaning and normalizing the collected Netflow traffic, extract its feature information and calculate the statistics of these features. Then, based on historical data and traffic patterns, use adaptive learning technology to build a baseline model. Use K-means clustering algorithm to preliminarily classify Netflow traffic and identify normal traffic and potential abnormal traffic; Use the random forest classifier to further classify the preliminary classification results and accurately identify DDoS attacks in abnormal traffic; The above classification results are combined with the baseline model to identify DDoS attack traffic, trigger an alarm, and execute defense measures; after the alarm is handled, the baseline model is fed back and updated.

2. The method for network-wide non-target intelligent traffic classification DDOS monitoring according to claim 1 is characterized in that: Use the K-means clustering algorithm to preliminarily classify Netflow traffic and identify normal traffic and potential abnormal traffic, including: By plotting the sum of squared errors under different K values, find the data point where the sum of squared errors decreases and the amplitude decreases significantly as the K value; Evaluate whether the choice of K value is reasonable. The silhouette coefficient value is between -1 and 1. The higher the value, the more reasonable the cluster division. Calculate the distance from each data point to the K cluster centers, assign the data point to the cluster center with the closest distance, calculate the centroid of each cluster, and use the centroid as the new cluster center, repeat the assignment and update steps until the position of the cluster center no longer changes significantly; Based on the iteratively calculated cluster centers and cluster assignments, similar data points are grouped together to identify normal traffic and potential abnormal traffic.

3. The method for network-wide non-target intelligent traffic classification DDOS monitoring according to claim 1 is characterized in that: The random forest classifier is used to further classify the preliminary classification results in detail to accurately identify DDoS attacks in abnormal traffic, including: Construct a decision tree. For each decision tree, use the bootstrap sampling method to randomly extract samples from the training set. In the splitting process of each node, randomly select a feature subset to split the decision tree. Recursively split the sample until the predetermined tree depth is reached or the node purity reaches a certain standard. The new Netflow traffic data is input into the trained random forest classifier for prediction. Each decision tree classifies the data point, and the final result is determined by the voting results of all decision trees. For potential abnormal traffic, further identify the specific DDoS attack type and label it.

4. A device for non-target intelligent traffic classification DDOS monitoring in the whole network, characterized in that: The device includes: Data collection module, used to collect Netflow traffic sent by routing devices in the entire network in real time; The data preprocessing module is used to clean and normalize the collected Netflow traffic, extract its feature information, calculate the statistics of these features, and then use adaptive learning technology to build a baseline model based on historical data and traffic patterns; The preliminary classification module is used to perform preliminary classification of Netflow traffic using the K-means clustering algorithm to identify normal traffic and potential abnormal traffic; The detailed classification module is used to further classify the preliminary classification results using the random forest classifier to accurately identify DDoS attacks in abnormal traffic; The intelligent analysis and threat assessment module is used to combine the above classification results with the baseline model, identify DDoS attack traffic, trigger alarms, and execute defense measures at the same time; after the alarm is handled, the baseline model is fed back and updated.

5. The device for monitoring DDOS in a non-targeted intelligent traffic classification manner in the entire network according to claim 4 is characterized in that: The preliminary classification module is specifically used for: By plotting the sum of squared errors under different K values, find the data point where the sum of squared errors decreases and the amplitude decreases significantly as the K value; Evaluate whether the choice of K value is reasonable. The silhouette coefficient value is between -1 and 1. The higher the value, the more reasonable the cluster division. Calculate the distance from each data point to the K cluster centers, assign the data point to the cluster center with the closest distance, calculate the centroid of each cluster, and use the centroid as the new cluster center, repeat the assignment and update steps until the position of the cluster center no longer changes significantly; Based on the iteratively calculated cluster centers and cluster assignments, similar data points are grouped together to identify normal traffic and potential abnormal traffic.

6. The device for monitoring DDOS in a non-targeted intelligent traffic classification manner in the entire network according to claim 4 is characterized in that: The detailed classification module is specifically used for: Construct a decision tree. For each decision tree, use the bootstrap sampling method to randomly extract samples from the training set. In the splitting process of each node, randomly select a feature subset to split the decision tree. Recursively split the sample until the predetermined tree depth is reached or the node purity reaches a certain standard. The new Netflow traffic data is input into the trained random forest classifier for prediction. Each decision tree classifies the data point, and the final result is determined by the voting results of all decision trees. For potential abnormal traffic, further identify the specific DDoS attack type and label it.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 3.

Images