DDoS attack detection method and device based on multi-source data fusion

Abstract

The invention discloses a DDoS attack detection method and device based on multi-source data fusion, and the method comprises the steps: collecting a plurality of data sources generated in a DDoS attack, including Netflow network flow data, system log data and external threat intelligence data; preprocessing the collected multiple data sources, and extracting key features; splicing the features of the multiple data sources according to a time sequence to form a multi-dimensional feature vector; constructing and training an LSTM (Long Short Term Memory) model by using the time sequence data after the feature fusion; and receiving and processing various data sources in real time, predicting whether DDoS attacks exist in a current network environment by using the trained LSTM model, and triggering an alarm. According to the method and the device, the detection accuracy, the response speed and the comprehensiveness are remarkably improved, and a more comprehensive view angle can be provided to identify the DDoS attack, so that the detection precision is improved and false alarms are reduced.

Description

Technical Field

[0001] The present invention relates to the field of DDoS attack detection, and in particular to a DDoS attack detection method and device based on multi-source data fusion. Background Art

[0002] As attack methods become increasingly complex, traditional detection methods based on a single data source have become difficult to effectively respond to. Traditional detection methods usually rely on the analysis of network traffic or a single log, which is prone to false positives and false negatives, and is difficult to deal with complex attacks from multiple dimensions and sources. Existing technologies lack the means to comprehensively utilize multi-source data to enhance the comprehensiveness and accuracy of detection. Multi-source data fusion integrates different types of data and assists machine learning algorithms to achieve efficient and accurate detection of DDoS attacks.

[0003] Distributed Denial of Service (DDoS) attacks are a type of attack that uses a large number of legitimate distributed requests to exhaust the resources of a target system. With the rapid development of the Internet, DDoS attack methods have become increasingly complex and diverse, causing great harm and often leading to service paralysis. Existing DDoS detection methods usually rely on a single data source, such as network traffic data, system logs, or user behavior data. However, these detection methods based on a single data source have the following problems:

[0004] (1) Low detection accuracy: A single data source often cannot fully reflect the attack behavior in the network, resulting in high false positive and false negative rates.

[0005] (2) Slow response speed: Existing methods have limited efficiency in data processing and analysis and cannot respond to attacks in a timely manner.

[0006] (3) Lack of comprehensiveness: A single data source can only provide a partial perspective and cannot fully capture the multi-dimensional characteristics of DDoS attacks. Summary of the invention

[0007] In order to solve the above problems existing in the prior art, the present invention provides a DDoS attack detection method and device based on multi-source data fusion, which utilizes multi-source data to enhance the comprehensiveness and accuracy of detection. Multi-source data fusion integrates different types of data and assists machine learning algorithms to achieve efficient and accurate detection of DDoS attacks. At the same time, it can provide a more comprehensive perspective to identify DDoS attacks, thereby improving detection accuracy and reducing false alarms.

[0008] To achieve the above purpose, the present invention adopts the following technical solutions:

[0009] In one embodiment of the present invention, a DDoS attack detection method based on multi-source data fusion is proposed, and the method includes:

[0010] Collect various data sources generated by DDOS attacks, including Netflow network traffic data, system log data, and external threat intelligence data;

[0011] Preprocess the collected data sources and extract key features;

[0012] The features of various data sources are spliced ​​in time series to form a multi-dimensional feature vector;

[0013] Use the time series data after feature fusion to build and train the LSTM model;

[0014] Receive and process multiple data sources in real time, use the trained LSTM model to predict whether there is a DDoS attack in the current network environment, and trigger an alarm.

[0015] Furthermore, a weighted fusion algorithm is used to achieve feature fusion, and a feature selection algorithm is used to further optimize the feature set.

[0016] Furthermore, the LSTM model includes:

[0017] Input layer: receives time series data after feature fusion. The format of input data is (samples, time_steps, features), where samples is the number of time windows, time_steps is the time step of each time window, and features is the number of features corresponding to each time window.

[0018] LSTM layer: one or more LSTM layers to capture temporal dependencies in time series;

[0019] Fully connected layer: Connect the output of the LSTM layer to one or more fully connected layers to map the time series features to attack or non-attack labels;

[0020] Output layer: Use the Sigmoid activation function to output binary classification results, including DDoS attack alarms or normal traffic.

[0021] In one embodiment of the present invention, a DDoS attack detection device based on multi-source data fusion is also proposed, and the device includes:

[0022] Data collection module, used to collect various data sources generated in DDOS attacks, including Netflow network traffic data, system log data, and external threat intelligence data;

[0023] Data preprocessing module, used to preprocess the collected data sources and extract key features;

[0024] The data fusion module is used to combine the features of multiple data sources in time series to form a multi-dimensional feature vector;

[0025] LSTM model module, used to build and train LSTM model using time series data after feature fusion;

[0026] The attack detection module is used to receive and process multiple data sources in real time, use the trained LSTM model to predict whether there is a DDoS attack in the current network environment, and trigger an alarm.

[0027] Furthermore, a weighted fusion algorithm is used to achieve feature fusion, and a feature selection algorithm is used to further optimize the feature set.

[0028] Furthermore, the LSTM model includes:

[0029] Input layer: receives time series data after feature fusion. The format of input data is (samples, time_steps, features), where samples is the number of time windows, time_steps is the time step of each time window, and features is the number of features corresponding to each time window.

[0030] LSTM layer: one or more LSTM layers to capture temporal dependencies in time series;

[0031] Fully connected layer: Connect the output of the LSTM layer to one or more fully connected layers to map the time series features to attack or non-attack labels;

[0032] Output layer: Use the Sigmoid activation function to output binary classification results, including DDoS attack alarms or normal traffic.

[0033] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned DDoS attack detection method based on multi-source data fusion is designed.

[0034] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing a DDoS attack detection method based on multi-source data fusion.

[0035] Beneficial effects:

[0036] 1. By integrating multi-source data, the present invention can more accurately analyze the network status and reduce false alarms caused by the limitations of a single data source. After feature-level fusion and algorithm optimization, it can maintain high sensitivity while reducing the false alarm rate, ensuring minimal interference with normal business.

[0037] 2. The present invention extracts relevant features from different data sources and automatically selects the most representative features for analysis through an algorithm, thereby reducing data redundancy and improving analysis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of a DDoS attack detection method based on multi-source data fusion of the present invention;

[0039] Figure 2 It is a structural schematic diagram of a DDoS attack detection device based on multi-source data fusion of the present invention;

[0040] Figure 3 It is a schematic diagram of the computer device structure of the present invention. DETAILED DESCRIPTION

[0041] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and design the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0042] Those skilled in the art will appreciate that the embodiments of the present invention may be designed as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be specifically designed in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0043] According to an implementation manner of the present invention, a DDoS attack detection method based on multi-source data fusion is proposed, which collects various data sources generated in DDOS attacks, including Netflow network traffic data, system log data, and external threat intelligence data; pre-processes the collected various data sources and extracts key features; splices the features of various data sources according to time series to form a multi-dimensional feature vector; uses the time series data after feature fusion to build and train an LSTM model; receives and processes various data sources in real time, uses the trained LSTM model to predict whether there is a DDoS attack in the current network environment, and triggers an alarm.

[0044] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0045] Figure 1 FIG. 1 is a flow chart of a DDoS attack detection method based on multi-source data fusion according to the present invention. Figure 1 As shown, the method includes:

[0046] 1. Define and construct a data collection module to collect various data sources generated by DDOS attacks.

[0047] 1.1. Collect Netflow network traffic data: construct and initialize the Netflow data receiver, initialize network port 9999 to receive Netflow binary stream, and extract key features in network traffic, such as data packet size, transport protocol type, source IP address, destination IP address and packet time interval data;

[0048] 1.2. Further, collect system log data and extract features from operating system logs, application logs, and security device logs, such as the number of login failures, error rates, resource usage, and time intervals between log entries;

[0049] 1.3. Further, collect external threat intelligence data and use threat intelligence data provided by third parties, such as known malicious IPs, domain names, and attack signature libraries, as supplementary information in the detection process.

[0050] 2. Clean, standardize, normalize and time synchronize multiple data sources.

[0051] 2.1. Further, clean the collected data sources, remove invalid or duplicate data, normalize the data, handle outliers and missing values, and ensure the accuracy and consistency of the data;

[0052] 2.2. Furthermore, the timestamps of various data sources are synchronized to ensure the accuracy of the fusion time series;

[0053] 2.3. Furthermore, different data sources are standardized to ensure that their numerical ranges are consistent to facilitate fusion and subsequent analysis.

[0054] 3. Perform feature extraction on multiple data sources. For each data source, feature extraction is to convert the raw data into features that can be used for analysis. Features can be simple statistics or more complex patterns or signals.

[0055] 3.1. Further, the flow rate feature extraction, the feature extraction of Netflow network flow data, includes:

[0056] Traffic statistics within a time window: the number of packets, bytes, traffic peak, and traffic coefficient of variation within a certain time period;

[0057] Connection characteristics: such as the number of connections per IP address, connection frequency, and the proportion of failed connections;

[0058] Protocol characteristics: Analyze the proportion and changes of traffic of different protocols (such as TCP, UDP, ICMP, etc.);

[0059] 3.2. Further, service response time feature extraction, feature extraction of system log data includes:

[0060] Event frequency: Statistics of specific log events within a certain time window, such as login failures and abnormal access frequencies;

[0061] Correlate events: Extract patterns of multiple related events, such as activity of the same IP on multiple systems;

[0062] Abnormal pattern recognition: Identify log patterns that should not appear under normal circumstances;

[0063] 3.3. Further, feature extraction of alarm quantity and feature extraction of external threat intelligence.

[0064] Threat matching: Determine whether the IP and domain names in network traffic or logs appear in known blacklists;

[0065] Threat Score: Each match is assigned a threat score based on the credibility and temporal relevance of the intelligence source.

[0066] 4. Perform feature-level fusion on multiple data sources. These features can be spliced ​​together in chronological order to form a comprehensive feature vector containing multiple information.

[0067] 4.1. Before fusion, the extracted features need to be preprocessed to ensure the consistency and applicability between the features;

[0068] Normalization: Features from different data sources may have different magnitudes, and standard normalization is used to adjust the features to a uniform range;

[0069] Missing value processing: Since different data sources may have incomplete data, missing values ​​need to be processed. Common methods include filling missing values ​​(using mean, median, etc.) or ignoring missing features;

[0070] Dimensionality reduction: When the number of features is too large, the principal component analysis (PCA) method can be used for dimensionality reduction to reduce the feature dimension and reduce the complexity of the model.

[0071] 4.2. Further, once the features are extracted and preprocessed, feature-level fusion can be performed;

[0072] 4.3. Further, a weighted fusion algorithm is selected to achieve fusion;

[0073] Assign different weights to the features of different data sources and then merge them. The weights can be set based on experience or through data analysis (such as information gain, mutual information, etc.);

[0074] If a data source has performed well in past tests, it can be given a higher weight;

[0075] The weighted fusion formula can be expressed as: fusion feature = w1*feature 1+w2*feature 2+...+wn*feature n, where wi is the weight of the feature;

[0076] 4.4. Furthermore, the feature set extracted in step 3 is further optimized by feature selection algorithm to remove redundant or irrelevant features.

[0077] 5. After feature fusion is completed, the features need to be trained on the model. The feature vector (time series data) after feature fusion in step 4 is trained using the long short-term memory network (LSTM). LSTM is a neural network specifically used to process time series data. For traffic features or time series data in DDoS detection, LSTM can capture the dependencies in time series and detect gradually accumulated attack behaviors.

[0078] 5.1. Standardize / normalize time series data: Standardize or normalize time series data to a certain range [0,1] to speed up training and prevent gradient explosion caused by excessive values;

[0079] 5.2. Further, time windowing: the fused time series data is cut into multiple small time windows (sliding windows).

[0080] Fixed time window: Split the fused time series data into time windows of fixed length. For example, 5 seconds, 10 seconds or 1 minute is a time step, and the data in each time step is taken as an input sequence;

[0081] Sliding window: Use overlapping time windows to obtain more time series samples. For example, assuming the window size is 60 seconds, a new window is generated every 30 seconds, which can enhance the learning ability of the model;

[0082] 5.3. Time series construction, converting the processed data into the three-dimensional input format (samples, time_steps, features) required by LSTM: samples: the number of samples, that is, the number of time windows. time_steps: the time step in each sample, indicating the time points contained in each window in the time series. features: the number of features corresponding to each time point;

[0083] 5.4. LSTM model construction. During the training process of the model, the fused feature vectors are input into the model in batches, and multiple rounds of iterative training are performed. During this process, the validation set can be used to monitor the performance of the model to prevent overfitting; validation set: the original data set is divided into a certain ratio. Usually the data set is divided into a training set, a validation set, and a test set. The common division ratio is 60% for training, 20% for validation, and 20% for testing. The role of the validation set is to adjust the hyperparameters of the model to avoid overfitting.

[0084] Input layer: receives time series data, the input format is (samples, time_steps, features): samples: the number of samples, that is, the number of time windows. time_steps: the time step in each sample, indicating the time points contained in each window in the time series. features: the number of features corresponding to each time point;

[0085] LSTM layer: One or more LSTM layers are used to capture temporal dependencies in time series. Multiple layers of LSTM can be stacked to enhance the learning ability of the model;

[0086] Dense Layer: Connect the LSTM output to one or more fully connected layers to map the time series features to attack or non-attack labels;

[0087] Output layer: Use activation function to output binary classification results: DDoS attack alarm or normal traffic.

[0088] 6. Online detection and deployment. In actual applications, the model can be deployed in the network monitoring system to analyze and detect network traffic in real time. The trained LSTM model can be deployed in the network environment to process and analyze network traffic in real time. The following steps can be used:

[0089] Stream data processing: preprocessing and feature extraction of real-time multi-source data;

[0090] Time window generation: Split the stream data into certain time intervals to generate input sequences;

[0091] LSTM model prediction: Input the time series into the LSTM model to obtain the prediction results.

[0092] 7. Since the pattern of DDoS attacks may change over time, it is necessary to continuously collect new NetFlow traffic data + log data + threat intelligence data, and fine-tune and retrain the LSTM model. Ensure that the model can cope with new attack strategies through online learning or regular updates.

[0093] 8. By integrating information from multiple data sources, a more comprehensive view of the network status can be obtained, improving detection accuracy. After integration, the LSTM model is good at capturing time dependencies and can effectively identify persistent and progressive DDoS attacks.

[0094] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0095] In order to explain the above-mentioned DDoS attack detection method based on multi-source data fusion more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0096] Example:

[0097] The DDoS attack detection method of this embodiment is implemented based on multi-source data fusion and long short-term memory network (LSTM) algorithm. The specific implementation steps are as follows:

[0098] Step 1: Define a data collection module. In this embodiment, the data collection module obtains data from the following multiple data sources.

[0099] Netflow network traffic data: Obtain indicators such as the number of packets per second, traffic size per minute, number of connections, etc. through the traffic monitoring system.

[0100] System log data: Extract information such as request time, response time, request type, client IP address, etc. from the logs of web servers and application servers.

[0101] External threat intelligence data: Obtain known malicious IP addresses, domain names, and other information through third-party threat intelligence platforms.

[0102] Step 2: Data preprocessing, data preprocessing is performed on the collected multiple data sources.

[0103] Data cleaning: Remove outliers and noise data. For example, filter out invalid requests in system log data and remove packet loss information in network traffic data.

[0104] Time synchronization: Align the timestamps of different data sources so that all data are arranged in a unified time sequence.

[0105] Feature extraction: Extract features such as the number of packets and traffic size from Netflow network traffic data, extract features such as response time and request type from system log data, and extract features such as known malicious IP addresses and domain names from external threat intelligence data.

[0106] Standardization: Use Z-score standardization or minimum-maximum normalization method to scale all features to a uniform scale range to facilitate subsequent model training.

[0107] The third step: data fusion, integrating multiple data sources.

[0108] The data fusion module combines the features of each data source in time series to generate a multi-dimensional feature vector. The importance of each data source is weighted. Assuming that the weights of Netflow network traffic data, system log data, and external threat intelligence data are 0.5, 0.3, and 0.2 respectively, the fused feature vector (feature_1, feature_2,..., feature_n) is generated.

[0109] Step 4: LSTM model construction and training. The LSTM model module models the time series data after multi-source fusion.

[0110] Input layer: The format of input data is (samples, time_steps, features): samples: the number of samples, that is, the number of time windows. time_steps: the time step in each sample, indicating the time points contained in each window in the time series. features: the number of features corresponding to each time point;

[0111] LSTM layer: Two LSTM layers are used, the first layer contains 128 LSTM units and the second layer contains 64 LSTM units, which is designed to capture long-term dependencies in time series;

[0112] Fully connected layer: The output of the LSTM layer is connected to the fully connected layer to further extract features and perform classification.

[0113] Output layer: Use the Sigmoid activation function to output the binary classification results and predict whether there is a DDoS attack in the time window.

[0114] Model training: Use annotated datasets (many fields have annotated public datasets that can be downloaded and used directly, or you can download such annotated datasets from external websites) to train the LSTM model. The optimizer is Adam, and the loss function is binary cross entropy.

[0115] Step 5: Attack detection, perform attack detection on multi-source data.

[0116] In actual applications, the attack detection module receives and processes multi-source data in real time, inputs the processed time series data into the trained LSTM model, and predicts whether there is a DDoS attack in the current network environment. If the output value of the model is higher than the preset threshold, it is judged that there is an attack and an alarm is triggered.

[0117] Based on the same inventive concept, the present invention also proposes a DDoS attack detection device based on multi-source data fusion. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware designed for a predetermined function. Although the device described in the following embodiments is preferably designed with software, the design of hardware, or a combination of software and hardware is also possible and conceivable.

[0118] Figure 2 Schematic diagram of the structure of the DDoS attack detection device based on multi-source data fusion of the present invention. Figure 2 As shown, the device comprises:

[0119] The data collection module 101 is used to collect various data sources generated in DDOS attacks, including Netflow network traffic data, system log data, and external threat intelligence data.

[0120] The data preprocessing module 102 is used to preprocess the collected data sources and extract key features.

[0121] The data fusion module 103 is used to combine the features of various data sources in time series to form a multi-dimensional feature vector.

[0122] The weighted fusion algorithm is used to achieve feature fusion, and the feature set is further optimized through the feature selection algorithm.

[0123] The LSTM model module 104 is used to construct and train the LSTM model using the time series data after feature fusion;

[0124] The LSTM model consists of:

[0125] Input layer: receives time series data after feature fusion. The format of input data is (samples, time_steps, features), where samples is the number of time windows, time_steps is the time step of each time window, and features is the number of features corresponding to each time window.

[0126] LSTM layer: one or more LSTM layers to capture temporal dependencies in time series;

[0127] Fully connected layer: Connect the output of the LSTM layer to one or more fully connected layers to map the time series features to attack or non-attack labels;

[0128] Output layer: Use the Sigmoid activation function to output binary classification results, including DDoS attack alarms or normal traffic.

[0129] The attack detection module 105 is used to receive and process multiple data sources in real time, use the trained LSTM model to predict whether there is a DDoS attack in the current network environment, and trigger an alarm.

[0130] It should be noted that although several modules of the DDoS attack detection device based on multi-source data fusion are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0131] Based on the above invention concept, Figure 3 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned DDoS attack detection method based on multi-source data fusion is designed.

[0132] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned DDoS attack detection method based on multi-source data fusion.

[0133] The DDoS attack detection method and device based on multi-source data fusion proposed in the present invention have the following highlights:

[0134] 1. By integrating multi-source data, it is possible to analyze network status more accurately and reduce false alarms caused by the limitations of a single data source. After feature-level fusion and algorithm optimization, it is possible to maintain high sensitivity while reducing false alarm rates, ensuring minimal interference with normal business.

[0135] 2. Extract relevant features from different data sources and automatically select the most representative features for analysis through algorithms to reduce data redundancy and improve analysis efficiency.

[0136] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0137] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A DDoS attack detection method based on multi-source data fusion, characterized in that: The method includes: Collect various data sources generated by DDOS attacks, including Netflow network traffic data, system log data, and external threat intelligence data; Preprocess the collected data sources and extract key features; The features of various data sources are spliced ​​in time series to form a multi-dimensional feature vector; Use the time series data after feature fusion to build and train the LSTM model; Receive and process multiple data sources in real time, use the trained LSTM model to predict whether there is a DDoS attack in the current network environment, and trigger an alarm.

2. The DDoS attack detection method based on multi-source data fusion according to claim 1 is characterized in that: The weighted fusion algorithm is used to achieve feature fusion, and the feature set is further optimized through the feature selection algorithm.

3. The DDoS attack detection method based on multi-source data fusion according to claim 1 is characterized in that: The LSTM model includes: Input layer: receives time series data after feature fusion. The format of input data is (samples, time_steps, features), where samples is the number of time windows, time_steps is the time step of each time window, and features is the number of features corresponding to each time window. LSTM layer: one or more LSTM layers to capture temporal dependencies in time series; Fully connected layer: Connect the output of the LSTM layer to one or more fully connected layers to map the time series features to attack or non-attack labels; Output layer: Use the Sigmoid activation function to output binary classification results, including DDoS attack alarms or normal traffic.

4. A DDoS attack detection device based on multi-source data fusion, characterized in that: The device includes: Data collection module, used to collect various data sources generated in DDOS attacks, including Netflow network traffic data, system log data, and external threat intelligence data; Data preprocessing module, used to preprocess the collected data sources and extract key features; The data fusion module is used to combine the features of multiple data sources in time series to form a multi-dimensional feature vector; LSTM model module, used to build and train LSTM model using time series data after feature fusion; The attack detection module is used to receive and process multiple data sources in real time, use the trained LSTM model to predict whether there is a DDoS attack in the current network environment, and trigger an alarm.

5. The DDoS attack detection device based on multi-source data fusion according to claim 4 is characterized in that: The weighted fusion algorithm is used to achieve feature fusion, and the feature set is further optimized through the feature selection algorithm.

6. The DDoS attack detection device based on multi-source data fusion according to claim 4 is characterized in that: The LSTM model includes: Input layer: receives time series data after feature fusion. The format of input data is (samples, time_steps, features), where samples is the number of time windows, time_steps is the time step of each time window, and features is the number of features corresponding to each time window. LSTM layer: one or more LSTM layers to capture temporal dependencies in time series; Fully connected layer: Connect the output of the LSTM layer to one or more fully connected layers to map the time series features to attack or non-attack labels; Output layer: Use the Sigmoid activation function to output binary classification results, including DDoS attack alarms or normal traffic.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 3.

Images