A data security protection system against DDoS attacks for big data platforms

Abstract

The present invention discloses an anti-DDoS attack data security protection system for a big data platform, which belongs to the field of data security technology. By using a DDoS attack detection model constructed by a deep learning algorithm to learn historical network traffic characteristics, a rule for identifying DDoS attacks can be constructed, thereby preliminarily realizing DDoS attack detection. At the same time, an improved intelligent optimization algorithm is used to train the DDoS attack detection model, which can achieve better parameter optimization effect and ultimately improve the accuracy of DDoS attack detection. Finally, according to the DDoS attack detection result, a DDoS attack mitigation operation is performed, which can effectively improve the data security of the big data platform.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and in particular relates to an anti-DDoS attack data security protection system for a big data platform. Background Art

[0002] With the widespread popularity of the Internet and the rapid development of computer technology, people's daily lives have been greatly facilitated. However, the close connection between a large number of applications and cyberspace has also led to the frequent occurrence of network attacks. As one of the common network attack methods, DDoS (Distributed Denial of Service) attacks use a large number of controlled systems to send a large number of requests to the target at the same time to exhaust the target resources, causing normal users to be unable to access the target service or resources. This attack method is diverse, harmful, wide-ranging, and highly concealed, making it one of the most widespread and common attack methods, seriously threatening the security of the Internet.

[0003] In the prior art, detection and classification techniques based on statistical analysis are often used to detect DDoS attacks. For example, three features, namely, the entropy of the source IP (Internet Protocol), the rate of change of the source IP, and the packet speed, are first extracted from the network traffic. Then, the feature score of the attack traffic sample is calculated and compared with the prototype average score of the pre-calculated normal traffic sample. When the result value exceeds the threshold, an attack alarm is issued to achieve DDoS attack traffic detection. Although this method can detect DDoS attacks, the detection accuracy is not high, and it is easy to have false detection and missed detection, which reduces data security. Summary of the invention

[0004] The present invention provides an anti-DDoS attack data security protection system for a big data platform, which is used to solve the problem that the detection accuracy of the prior art is low, false detection and missed detection are prone to occur, thereby reducing data security.

[0005] A data security protection system against DDoS attacks for a big data platform, characterized by comprising: a historical data collection module, a model training module, a DDoS attack detection module, and a DDoS attack mitigation module;

[0006] The historical data collection module is used to collect historical network traffic features related to DDoS attacks, and use a manual labeling method to label each historical network traffic feature with a DDoS attack label;

[0007] The model training module is used to build a DDoS attack detection model using a deep learning algorithm, and use historical network traffic characteristics and DDoS attack labels as supporting data to train the DDoS attack detection model using an improved intelligent optimization algorithm to obtain a trained DDoS attack detection model;

[0008] The DDoS attack detection module is used to collect real-time network traffic features on the big data platform, and schedule the trained DDoS attack detection model to identify the real-time network traffic features to determine the DDoS attack detection results;

[0009] The DDoS attack mitigation module is used to perform DDoS attack mitigation operations based on the DDoS attack detection results to achieve data security protection against DDoS attacks.

[0010] Furthermore, a deep learning algorithm is used to build a DDoS attack detection model, including: using a CNN-LSTM algorithm to build a DDoS attack detection model.

[0011] Furthermore, with historical network traffic characteristics and DDoS attack labels as supporting data, an improved intelligent optimization algorithm is used to train the DDoS attack detection model to obtain the trained DDoS attack detection model, including:

[0012] A spatial adaptive distribution strategy is adopted to generate model parameters of the DDoS attack detection model, obtain parameter individuals, and obtain multiple different parameter individuals;

[0013] Using historical network traffic features as input and DDoS attack labels as expected output, we obtain the loss function value corresponding to each parameter individual.

[0014] According to the loss function value corresponding to each parameter individual, the parameter individual with the smallest loss function value is determined as the optimal individual and the parameter individual with the largest loss function value is determined as the worst individual;

[0015] According to the best individual and the worst individual, a mutually exclusive attraction strategy is used to perform a position reference search on the parameter individual to obtain the parameter individual after the position reference search;

[0016] An information fusion strategy is used to perform local fusion search on the parameter individuals after the position reference search to obtain the parameter individuals after the local fusion search;

[0017] Adopting information learning strategy to conduct local information learning search on parameter individuals after local fusion search, and obtaining parameter individuals after local information learning search;

[0018] A global search strategy is used to perform a global variation search on the parameter individuals after the local information learning search, and the parameter individuals after the global variation search are obtained;

[0019] Determine whether the current number of training times is greater than or equal to the maximum number of training times. If so, re-obtain the optimal individual based on the parameter individual after the global mutation search, and use the model parameters in the optimal individual as the final parameters of the DDoS attack detection model to obtain the trained DDoS attack detection model. Otherwise, return to the step of obtaining the loss function value.

[0020] Furthermore, a spatial adaptive distribution strategy is adopted to generate model parameters of the DDoS attack detection model, obtain parameter individuals, and obtain multiple different parameter individuals, including:

[0021] Determine the total number M of parameter individuals to be generated, and use M as the maximum serial number, and assign different serial numbers to the parameter individuals to be generated starting from 1;

[0022] Based on the serial number corresponding to the parameter individual to be generated and the dimension of the parameter to be generated, the parameter value corresponding to each dimension of the parameter individual is initialized using the cosine function;

[0023] Based on the parameter value corresponding to each dimension of the parameter individual, a dual-space position optimization method is used to determine the first space optimized individual and the second space optimized individual corresponding to the parameter individual;

[0024] The parameter individual is initialized according to the first space optimization individual and the second space optimization individual corresponding to the parameter individual, and a plurality of different parameter individuals are repeatedly obtained.

[0025] Furthermore, taking the historical network traffic features as input and the DDoS attack label as the expected output, the loss function value corresponding to each parameter individual is obtained, including:

[0026] For any parameter individual, after applying the model parameters in the parameter individual to the DDoS attack detection model, the actual output of the DDoS attack detection model is obtained by taking the historical network traffic characteristics as input;

[0027] Taking the DDoS attack label as the expected output, and based on the actual output and expected output of the DDoS attack detection model, the cross entropy loss function is used to obtain the loss function value corresponding to the parameter individual.

[0028] Further, according to the best individual and the worst individual, a mutually exclusive attraction strategy is adopted to perform a position reference search on the parameter individual to obtain the parameter individual after the position reference search, including:

[0029] Get the average position corresponding to all parameter individuals and obtain the center individual of the population;

[0030] The worst position mutual exclusion information is obtained by subtracting the worst individual from the population center individual; the best position attraction information is obtained by subtracting the population center individual from the best individual;

[0031] An information adjustment factor is randomly generated between (0, 1), and the information adjustment factor is used to adjust the sum of the worst position mutually exclusive information and the best position attractive information to obtain mutually exclusive attractive information;

[0032] A position reference search is performed on the parameter individual according to the mutually exclusive attraction information to obtain the parameter individual after the position reference search.

[0033] Furthermore, an information fusion strategy is used to perform a local fusion search on the parameter individuals after the position reference search, and the parameter individuals after the local fusion search are obtained, including:

[0034] For any parameter individual after the position reference search, randomly match another parameter individual for the parameter individual to obtain the information fusion individual corresponding to the parameter individual;

[0035] The information fusion individual corresponding to the parameter individual is used to perform information fusion with the parameter individual to obtain the information fusion individual;

[0036] Based on the current number of training times, an adaptive inertia weight is obtained, and the adaptive inertia weight is used to weight the information fusion individual to obtain the weighted information fusion individual;

[0037] The weighted information sum individual is used to perform a local fusion search on the parameter individual after the position reference search to obtain the parameter individual after the local fusion search.

[0038] Furthermore, an information learning strategy is used to perform local information learning search on the parameter individuals after the local fusion search, and the parameter individuals after the local information learning search are obtained, including:

[0039] For any parameter individual after local fusion search, randomly match another parameter individual for the parameter individual to obtain the information learning individual corresponding to the parameter individual;

[0040] According to the information learning individual corresponding to the parameter individual, the adaptive cosine function is used to obtain the information learning individual corresponding to the parameter individual;

[0041] According to the information learning individuals corresponding to the parameter individuals, local information learning search is performed on the parameter individuals after the local fusion search to obtain the parameter individuals after the local information learning search.

[0042] Furthermore, it is characterized in that a global search strategy is used to perform a global variation search on the parameter individuals after the local information learning search, and the parameter individuals after the global variation search are obtained, including:

[0043] For the parameter individuals after local information learning search, the population center individuals are re-determined, and the global variation range control factor is obtained with the re-determined population center individuals;

[0044] According to the optimal parameter individual, the population center individual and the global variation range control factor, and combined with Gaussian distribution, a global variation search is performed on the parameter individual after the local information learning search to obtain the parameter individual after the global variation search.

[0045] Furthermore, based on the DDoS attack detection result, DDoS attack mitigation operations are performed, including: when the DDoS attack detection result is an abnormal category, blocking ports, blocking IP addresses or limiting speed operations are performed according to preset DDoS attack mitigation rules.

[0046] The present invention provides an anti-DDoS attack data security protection system for a big data platform. The system learns historical network traffic characteristics by using a DDoS attack detection model constructed by a deep learning algorithm, thereby constructing rules for identifying DDoS attacks, thereby preliminarily realizing DDoS attack detection. At the same time, an improved intelligent optimization algorithm is used to train the DDoS attack detection model, which can achieve better parameter optimization effects and ultimately improve the accuracy of DDoS attack detection. Finally, according to the DDoS attack detection results, a DDoS attack mitigation operation is performed, which can effectively improve the data security of the big data platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0048] Figure 1 A structural diagram of a data security protection system against DDoS attacks for a big data platform provided in an embodiment of the present invention.

[0049] Figure 2 A flowchart of using an improved intelligent optimization algorithm to train a DDoS attack detection model is provided in an embodiment of the present invention.

[0050] Among them, 11-historical data collection module, 12-model training module, 13-DDoS attack detection module, and 14-DDoS attack mitigation module.

[0051] The above drawings have shown clear embodiments of the present invention, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present invention in any way, but to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0052] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0053] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0054] like Figure 1 As shown, the embodiment of the present invention provides an anti-DDoS attack data security protection system for a big data platform, characterized in that it includes: a historical data collection module 11, a model training module 12, a DDoS attack detection module 13 and a DDoS attack mitigation module 14;

[0055] The historical data collection module 11 is used to collect historical network traffic features related to DDoS attacks, and use a manual labeling method to label each historical network traffic feature with a DDoS attack label;

[0056] Since there are few historical network traffic features about DDoS attacks on a single big data platform, historical network traffic features from other data sets or other big data platforms can also be collected. The historical network traffic features about DDoS attacks need to include historical network traffic features under normal circumstances and historical network traffic features when suffering from DDoS attacks. Therefore, the DDoS attack label can include a normal category and at least one abnormal category. When there is only one abnormal category, the abnormal category indicates that it is suffering from a DDoS attack; when there are multiple abnormal categories (generally set to the number of DDoS attack types), each abnormal category represents a DDoS attack type, thereby achieving more detailed classification.

[0057] The model training module 12 is used to build a DDoS attack detection model using a deep learning algorithm, and use historical network traffic characteristics and DDoS attack labels as supporting data to train the DDoS attack detection model using an improved intelligent optimization algorithm to obtain a trained DDoS attack detection model;

[0058] Since network traffic characteristics contain multiple data, and in order to improve data recognition accuracy, historical network traffic characteristics at multiple consecutive time points can also be collected for training according to a preset data sampling frequency. However, it is worth noting that historical network traffic characteristics at a certain time point or historical network traffic characteristics within a certain time period can also be used for training.

[0059] Therefore, the embodiment of the present invention can use the CNN (Convolutional Neural Network) algorithm to build a DDoS attack detection model. In the prior art, after the DDoS attack detection model is built, the gradient descent algorithm is generally used to train the DDoS attack detection model, but the gradient descent algorithm often falls into the local optimum, resulting in poor data learning effect, and ultimately resulting in poor DDoS attack detection effect. The embodiment of the present invention provides an improved intelligent optimization algorithm, and the intelligent optimization algorithm is used to train the DDoS attack detection model, thereby solving the problem that the prior art is prone to fall into the local optimum, and ultimately improving the accuracy of DDoS attack detection.

[0060] The DDoS attack detection module 13 is used to collect real-time network traffic features on the big data platform, and schedule the trained DDoS attack detection model to identify the real-time network traffic features to determine the DDoS attack detection results;

[0061] The data type and structure of the collected real-time network traffic features are the same as those of the historical network traffic features, which ensures that the trained DDoS attack detection model can effectively identify the real-time network traffic features.

[0062] The DDoS attack mitigation module 14 is used to perform DDoS attack mitigation operations based on the DDoS attack detection results to achieve data security protection against DDoS attacks.

[0063] DDoS attack mitigation operations can include: blocking ports, blocking IP addresses, or limiting speed operations, which can effectively prevent DDoS attacks from threatening the data on the big data platform.

[0064] The present invention provides an anti-DDoS attack data security protection system for a big data platform. The system learns historical network traffic characteristics by using a DDoS attack detection model constructed by a deep learning algorithm, thereby constructing rules for identifying DDoS attacks, thereby preliminarily realizing DDoS attack detection. At the same time, an improved intelligent optimization algorithm is used to train the DDoS attack detection model, which can achieve better parameter optimization effects and ultimately improve the accuracy of DDoS attack detection. Finally, according to the DDoS attack detection results, a DDoS attack mitigation operation is performed, which can effectively improve the data security of the big data platform.

[0065] In an embodiment of the present invention, a deep learning algorithm is used to build a DDoS attack detection model, including: using a CNN (Convolutional Neural Network)-LSTM (Long Short-Term Memory) algorithm to build a DDoS attack detection model.

[0066] It is worth noting that the above CNN-LSTM algorithm is only a preferred method of the embodiment of the present invention, and other algorithms can also be used to build a DDoS attack detection model.

[0067] like Figure 2 As shown in the figure, the DDoS attack detection model is trained using the improved intelligent optimization algorithm with historical network traffic characteristics and DDoS attack labels as supporting data, and the trained DDoS attack detection model is obtained, including:

[0068] S21. Generate model parameters of the DDoS attack detection model using a spatial adaptive distribution strategy, obtain parameter individuals, and obtain multiple different parameter individuals; wherein each parameter individual is equivalent to a vector, and each dimensional parameter in the vector represents a hyperparameter of the DDoS attack detection model.

[0069] S22, taking the historical network traffic characteristics as input and the DDoS attack label as the expected output, obtaining the loss function value corresponding to each parameter individual;

[0070] S23, according to the loss function value corresponding to each parameter individual, determine the parameter individual with the smallest loss function value as the best individual and the parameter individual with the largest loss function value as the worst individual;

[0071] S24, performing a position reference search on the parameter individuals using a mutually exclusive attraction strategy according to the best individual and the worst individual, to obtain the parameter individuals after the position reference search;

[0072] S25, using an information fusion strategy to perform a local fusion search on the parameter individuals after the position reference search, to obtain the parameter individuals after the local fusion search;

[0073] S26, using an information learning strategy to perform local information learning search on the parameter individuals after the local fusion search, to obtain the parameter individuals after the local information learning search;

[0074] S27, using a global search strategy to perform a global variation search on the parameter individuals after the local information learning search, to obtain the parameter individuals after the global variation search;

[0075] S28. Determine whether the current number of training times is greater than or equal to the maximum number of training times. If so, re-obtain the optimal individual based on the parameter individual after the global variation search, and use the model parameters in the optimal individual as the final parameters of the DDoS attack detection model to obtain the trained DDoS attack detection model. Otherwise, return to the step of obtaining the loss function value.

[0076] In the embodiment of the present invention, a spatial adaptive distribution strategy is adopted to generate model parameters of a DDoS attack detection model, obtain parameter individuals, and obtain multiple different parameter individuals, including:

[0077] Determine the total number M of parameter individuals to be generated, and use M as the maximum serial number, and assign different serial numbers to the parameter individuals to be generated starting from 1;

[0078] Based on the serial number corresponding to the parameter individual to be generated and the dimension of the parameter to be generated, the parameter value corresponding to each dimension of the parameter individual is initialized using the cosine function: ;in, Indicates i The parameter individual d The parameter value corresponding to the dimension, i =1,2,…,M, M represents the total number of parameter individuals; d =1,2,…,D, where D represents the total number of parameter dimensions of the parameter individual. The model parameters contained in the parameter individual can be the weights of the DDoS attack detection model or other hyperparameters to be trained. cos represents the cosine function. represents pi, Express satisfaction The smallest prime number of ;

[0079] Based on the parameter value corresponding to each dimension of the parameter individual, the dual-space position optimization method is used to determine the first space optimization individual and the second space optimization individual corresponding to the parameter individual as follows:

[0080]

[0081]

[0082] in, represents the d-th dimension parameter of the first space optimization individual, represents the d-th dimension parameter of the second space optimization individual, Indicates d The upper limit of the dimension parameter, Indicates d The lower limit of the dimension parameter, mod represents the remainder function, Represents the first random number between (0,1).

[0083] Initialize the parameter individual according to the first space optimization individual and the second space optimization individual corresponding to the parameter individual, and repeatedly obtain multiple different parameter individuals. That is, when the error function value of the first space optimization individual is less than that of the second space optimization individual, the first space optimization individual is used to initialize the parameter individual, otherwise the second space optimization individual is used to initialize the parameter individual.

[0084] In the prior art, a random initialization method is often used to generate parameter individuals, which results in a slow convergence speed due to a poor initial position. The spatial adaptive distribution strategy of the embodiment of the present invention can not only make the initial solution distribution more uniform, but also improve the position quality of each parameter individual at the initial moment, which can effectively improve the training speed of the algorithm.

[0085] In the embodiment of the present invention, the historical network traffic characteristics are used as input, the DDoS attack label is used as the expected output, and the loss function value corresponding to each parameter individual is obtained, including:

[0086] For any parameter individual, after applying the model parameters in the parameter individual to the DDoS attack detection model, the actual output of the DDoS attack detection model is obtained by taking the historical network traffic characteristics as input;

[0087] Taking the DDoS attack label as the expected output, and based on the actual output and expected output of the DDoS attack detection model, the cross entropy loss function is used to obtain the loss function value corresponding to the parameter individual.

[0088] In the embodiment of the present invention, according to the best individual and the worst individual, a mutually exclusive attraction strategy is adopted to perform a position reference search on the parameter individual to obtain the parameter individual after the position reference search, including:

[0089] Get the average position corresponding to all parameter individuals, and get the population center individual as: ;in, Indicates t During the training m The parameter individual d Dimension parameters, m =1,2,…,M, represents the center individual of the population d Dimension parameters;

[0090] The worst position mutually exclusive information is obtained by subtracting the worst individual from the population center individual: ;in, represents the mutually exclusive information learning rate, and is a random number uniformly distributed between [0,1]. The worst individual d Dimension parameters;

[0091] The optimal position attraction information is obtained by subtracting the individual at the center of the population from the optimal individual: ;in, represents the learning rate of attracting information, and is a random number uniformly distributed between [0,1]. The optimal individual d Dimension parameters;

[0092] The information adjustment factor is randomly generated between (0, 1), and the information adjustment factor is used to adjust the sum of the worst position mutual exclusion information and the best position attraction information, and the mutual exclusion attraction information is obtained as follows: ;in, represents the information adjustment factor;

[0093] According to the mutually exclusive attraction information, a position reference search is performed on the parameter individual, and the parameter individual after the position reference search is obtained as follows: ;in, Indicates m The first position of the reference search after the parameter individual d Dimension parameters.

[0094] The embodiment of the present invention adopts a mutually exclusive attraction strategy to perform position reference search on parameter individuals, which can effectively move away from poor positions and approach better positions, while searching more unknown areas, and can improve the ability of the algorithm to escape from the local optimal solution to a certain extent.

[0095] In the embodiment of the present invention, an information fusion strategy is used to perform a local fusion search on the parameter individuals after the position reference search to obtain the parameter individuals after the local fusion search, including:

[0096] For any parameter individual after the position reference search, randomly match another parameter individual for the parameter individual to obtain the information fusion individual corresponding to the parameter individual;

[0097] The information fusion individual corresponding to the parameter individual is used to fuse information with the parameter individual, and the information fusion individual is obtained as follows: ;in, Indicates t During the training n The first position of the reference search after the parameter individual d Dimension parameters, Indicates n The first position of the information fusion individual corresponding to the parameter individual after the reference search d Dimension parameters;

[0098] Based on the current number of training times, the adaptive inertia weight is obtained, and the adaptive inertia weight is used to weight the information fusion individual. The weighted information fusion individual is obtained as follows: ;in, represents the weighted information fusion individual d Dimension parameters, represents the adaptive inertia weight during the t-th training process, and , represents the second random number between (0,1), represents the maximum value of the adaptive inertia weight, represents the minimum value of the adaptive inertia weight, Indicates the maximum number of training times;

[0099] The weighted information and individuals are used to perform local fusion search on the parameter individuals after the position reference search, and the parameter individuals after the local fusion search are obtained as follows: ;in, Indicates n The first parameter individual after the local fusion search d Dimension parameters, represents the third random number between (0,1), represents the information fusion control factor, and , Represents the search step size, and exp represents the exponential function with the natural constant e as the base.

[0100] The embodiment of the present invention adopts an information fusion strategy to perform local fusion search on the parameter individuals after the position reference search, which can effectively fuse the information of two parameter individuals, not only improving the local search ability of the algorithm, but also improving the local exploration rate. At the same time, an adaptive inertia weight is set, which can effectively prevent the algorithm from falling into the local optimum in the middle of the algorithm.

[0101] In the embodiment of the present invention, an information learning strategy is used to perform local information learning search on the parameter individuals after the local fusion search to obtain the parameter individuals after the local information learning search, including:

[0102] For any parameter individual after local fusion search, randomly match another parameter individual for the parameter individual to obtain the information learning individual corresponding to the parameter individual;

[0103] According to the information learning individual corresponding to the parameter individual, the adaptive cosine function is used to obtain the information learning individual corresponding to the parameter individual: ;in, Indicates the tth training process k The first parameter individual after the local fusion searchd Dimension parameters, k =1,2,…,M, Indicates k The information learning individual corresponding to the parameter individual after the local fusion search d Dimension parameters, represents pi, represents the fourth random number between (0,1), Indicates k The first d Dimension parameters;

[0104] According to the information learning individuals corresponding to the parameter individuals, local information learning search is performed on the parameter individuals after the local fusion search, and the parameter individuals after the local information learning search are obtained as follows: ;in, Indicates k The first parameter of the individual after the local information learning search d Dimension parameters.

[0105] The embodiment of the present invention adopts an information learning strategy to perform local information learning search on parameter individuals after local fusion search, and can search to other positions in the form of a fluctuation curve, so as to explore different areas more extensively and balance the local and global development capabilities of the algorithm.

[0106] In the embodiment of the present invention, it is characterized in that a global search strategy is used to perform a global variation search on the parameter individuals after the local information learning search, and the parameter individuals after the global variation search are obtained, including:

[0107] For the parameter individuals after local information learning search, the population center individuals are re-determined, and the global variation range control factor is obtained with the re-determined population center individuals:

[0108]

[0109] Where T represents transpose, Indicates g The parameter individuals after local information learning search, Indicates g The global variation range control factor corresponding to the parameter individual after the local information learning search, represents the central individual of the population, g =1,2,…,M;

[0110] According to the optimal parameter individual, the population center individual and the global variation range control factor, combined with Gaussian distribution, a global variation search is performed on the parameter individual after the local information learning search, and the parameter individual after the global variation search is obtained as follows: ;in, Indicates t During the training g The first parameter of the individual after the local information learning search d Dimension parameters, represents the center individual of the population d Dimension parameters, represents the optimal parameter individual d Dimension parameters; It means that the mean is 0 and the variance is Gaussian distributed random numbers; represents the parameter individual after the g-th global mutation search. d Dimension parameters.

[0111] The embodiment of the present invention adopts a global search strategy to perform global variation search on parameter individuals after local information learning search, which can effectively realize variation search. As the algorithm proceeds, the variation range gradually narrows, and the global search is converted into a local search, which can effectively ensure the global search capability of the algorithm and the final search accuracy.

[0112] Optionally, out-of-bounds processing can be performed on parameter individuals after each search to ensure the effectiveness of the algorithm.

[0113] In an embodiment of the present invention, based on the DDoS attack detection result, a DDoS attack mitigation operation is performed, including: when the DDoS attack detection result is an abnormal category, blocking ports, blocking IP addresses or limiting speed operations are performed according to preset DDoS attack mitigation rules.

[0114] For example, the preset DDoS attack mitigation rules can be: set a DDoS attack mitigation operation for each DDoS attack, such as, when a DDoS attack is discovered, the speed can be limited to 25%, and the processing speed of the data packets from the attacker is reduced by 25% compared with the current speed; when the attack occurs again, the speed can be limited to 50%, and the processing speed of the data packets from the attacker is reduced by 50% compared with the current speed; if the attack occurs again, the attacker's IP can be blocked for a certain period of time; when the attack continues to intensify, the port of the big data platform can be blocked for a certain period of time, thereby ensuring the data security of the big data platform.

[0115] A different DDoS attack mitigation operation may be set for each DDoS attack, or the same DDoS attack mitigation operation may be set for all DDoS attacks. Those skilled in the art may select a DDoS attack mitigation operation according to actual needs.

[0116] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data security protection system against DDoS attacks for big data platforms, characterized in that: include: Historical data collection module, model training module, DDoS attack detection module, and DDoS attack mitigation module; The historical data collection module is used to collect historical network traffic features related to DDoS attacks, and use a manual labeling method to label each historical network traffic feature with a DDoS attack label; The model training module is used to build a DDoS attack detection model using a deep learning algorithm, and use historical network traffic characteristics and DDoS attack labels as supporting data to train the DDoS attack detection model using an improved intelligent optimization algorithm to obtain a trained DDoS attack detection model; The DDoS attack detection module is used to collect real-time network traffic features on the big data platform, and schedule the trained DDoS attack detection model to identify the real-time network traffic features to determine the DDoS attack detection results; The DDoS attack mitigation module is used to perform DDoS attack mitigation operations based on the DDoS attack detection results to achieve data security protection against DDoS attacks; Using historical network traffic characteristics and DDoS attack labels as supporting data, the DDoS attack detection model is trained using an improved intelligent optimization algorithm to obtain the trained DDoS attack detection model, including: A spatial adaptive distribution strategy is used to generate model parameters of a DDoS attack detection model, obtain parameter individuals, and obtain multiple different parameter individuals; Using historical network traffic features as input and DDoS attack labels as expected output, we obtain the loss function value corresponding to each parameter individual. According to the loss function value corresponding to each parameter individual, the parameter individual with the smallest loss function value is determined as the optimal individual and the parameter individual with the largest loss function value is determined as the worst individual; According to the best individual and the worst individual, a mutually exclusive attraction strategy is used to perform a position reference search on the parameter individual to obtain the parameter individual after the position reference search; An information fusion strategy is used to perform local fusion search on the parameter individuals after the position reference search to obtain the parameter individuals after the local fusion search; Adopting information learning strategy to conduct local information learning search on parameter individuals after local fusion search, and obtaining parameter individuals after local information learning search; A global search strategy is used to perform a global variation search on the parameter individuals after the local information learning search, and the parameter individuals after the global variation search are obtained; Determine whether the current number of training times is greater than or equal to the maximum number of training times. If so, re-obtain the optimal individual based on the parameter individual after the global mutation search, and use the model parameters in the optimal individual as the final parameters of the DDoS attack detection model to obtain the trained DDoS attack detection model. Otherwise, return to the step of obtaining the loss function value.

2. According to claim 1, the anti-DDoS attack data security protection system for big data platform is characterized in that: A deep learning algorithm is used to build a DDoS attack detection model, including: using a CNN-LSTM algorithm to build a DDoS attack detection model.

3. The anti-DDoS attack data security protection system for big data platform according to claim 1 is characterized in that: A spatial adaptive distribution strategy is used to generate model parameters of the DDoS attack detection model, obtain parameter individuals, and obtain multiple different parameter individuals, including: Determine the total number M of parameter individuals to be generated, and use M as the maximum serial number, and assign different serial numbers to the parameter individuals to be generated starting from 1; Based on the serial number corresponding to the parameter individual to be generated and the dimension of the parameter to be generated, the parameter value corresponding to each dimension of the parameter individual is initialized using the cosine function; Based on the parameter value corresponding to each dimension of the parameter individual, a dual-space position optimization method is used to determine the first space optimized individual and the second space optimized individual corresponding to the parameter individual; The parameter individual is initialized according to the first space optimization individual and the second space optimization individual corresponding to the parameter individual, and a plurality of different parameter individuals are repeatedly obtained.

4. The anti-DDoS attack data security protection system for big data platform according to claim 1 is characterized in that: Taking the historical network traffic features as input and the DDoS attack label as the expected output, we obtain the loss function value corresponding to each parameter individual, including: For any parameter individual, after applying the model parameters in the parameter individual to the DDoS attack detection model, the actual output of the DDoS attack detection model is obtained by taking the historical network traffic characteristics as input; Taking the DDoS attack label as the expected output, and based on the actual output and expected output of the DDoS attack detection model, the cross entropy loss function is used to obtain the loss function value corresponding to the parameter individual.

5. The anti-DDoS attack data security protection system for big data platform according to claim 1 is characterized in that: According to the best individual and the worst individual, a mutually exclusive attraction strategy is used to perform a position reference search on the parameter individual to obtain the parameter individual after the position reference search, including: Get the average position corresponding to all parameter individuals and obtain the center individual of the population; The worst position mutual exclusion information is obtained by subtracting the worst individual from the population center individual; the best position attraction information is obtained by subtracting the population center individual from the best individual; An information adjustment factor is randomly generated between (0, 1), and the information adjustment factor is used to adjust the sum of the worst position mutually exclusive information and the best position attractive information to obtain mutually exclusive attractive information; A position reference search is performed on the parameter individual according to the mutually exclusive attraction information to obtain the parameter individual after the position reference search.

6. The anti-DDoS attack data security protection system for big data platform according to claim 5 is characterized in that: The information fusion strategy is used to perform local fusion search on the parameter individuals after the position reference search, and the parameter individuals after the local fusion search are obtained, including: For any parameter individual after the position reference search, randomly match another parameter individual for the parameter individual to obtain the information fusion individual corresponding to the parameter individual; The information fusion individual corresponding to the parameter individual is used to perform information fusion with the parameter individual to obtain the information fusion individual; Based on the current number of training times, an adaptive inertia weight is obtained, and the adaptive inertia weight is used to weight the information fusion individual to obtain the weighted information fusion individual; The weighted information fusion individual is used to perform a local fusion search on the parameter individual after the position reference search to obtain the parameter individual after the local fusion search.

7. The anti-DDoS attack data security protection system for big data platform according to claim 6 is characterized in that: The information learning strategy is used to perform local information learning search on the parameter individuals after the local fusion search, and the parameter individuals after the local information learning search are obtained, including: For any parameter individual after local fusion search, randomly match another parameter individual for the parameter individual to obtain the information learning individual corresponding to the parameter individual; According to the information learning individual corresponding to the parameter individual, the adaptive cosine function is used to obtain the information learning individual corresponding to the parameter individual; According to the information learning individuals corresponding to the parameter individuals, local information learning search is performed on the parameter individuals after the local fusion search to obtain the parameter individuals after the local information learning search.

8. The anti-DDoS attack data security protection system for big data platform according to claim 7 is characterized in that: A global search strategy is used to perform a global mutation search on the parameter individuals after the local information learning search, and the parameter individuals after the global mutation search are obtained, including: For the parameter individuals after local information learning search, the population center individuals are re-determined, and the global variation range control factor is obtained with the re-determined population center individuals; According to the optimal parameter individual, the population center individual and the global variation range control factor, and combined with Gaussian distribution, a global variation search is performed on the parameter individual after the local information learning search to obtain the parameter individual after the global variation search.

9. The anti-DDoS attack data security protection system for big data platforms according to any one of claims 1 to 8, characterized in that: Based on the DDoS attack detection results, DDoS attack mitigation operations are performed, including: when the DDoS attack detection results are abnormal categories, blocking ports, blocking IP addresses or limiting speed operations are performed according to preset DDoS attack mitigation rules.

Images