QUIC network abnormal behavior identification method, system and equipment

Abstract

The invention discloses a QUIC network abnormal behavior identification method and system and a storage medium. The method comprises the following steps: firstly, acquiring multiple segments of network traffic signals based on a sliding window principle; secondly, decomposing and reconstructing the multiple segments of network traffic signals by adopting a wavelet transform method to obtain network traffic reconstruction signals; when the Hurst index is smaller than a first abnormal threshold value, predicting and estimating the network traffic reconstruction signal based on Kalman filtering to obtain a prior prediction value and a posterior optimal estimation value corresponding to each segment of network traffic signal; finally, judging whether the error between the priori predicted value and the posterior optimal estimated value is greater than or equal to a second abnormal threshold value or not; and if the first abnormal threshold value is greater than or equal to the second abnormal threshold value, indicating that the data jitter abnormal behavior exists in each section of network flow signal, and giving an alarm or visually displaying. According to the method, the wavelet algorithm is combined with the Kalman filtering, so that the accuracy, universality and efficiency of network abnormal behavior recognition are improved, and a better denoising effect is achieved.

Description

Technical Field

[0001] The present invention relates to the field of abnormal behavior detection technology, and in particular to a method, system and device for identifying abnormal behavior in a QUIC network. Background Art

[0002] HTTP / 3.0 is a new generation of HTTP protocol based on the QUIC protocol, with lower latency, better congestion control mechanism and better security. The combination of HTTP / 3.0 and QUIC points the way for the development of the next generation of Internet transmission protocols. The development of HTTP / 3.0 solves some performance problems of HTTP / 2.0 under high latency and high packet loss rate. As the underlying transmission protocol of HTTP / 3.0, QUIC has new features such as fast connection establishment, multiplexing and fast retransmission. In order to quickly establish a connection and reduce the low latency of the connection, QUIC sends data directly when establishing a connection. This is a 0-RTT method, which improves the connection speed compared to the network delay of the TCP three-way handshake. In addition, QUIC uses the Connection ID as a unique identifier, so when the network link status changes, no additional handshake reconnection time is added. The QUIC protocol also supports multiplexing technology, that is, multiple data streams can be transmitted simultaneously in one connection without waiting for the previous data stream to complete. This can improve the load capacity of the connection while ensuring network transmission efficiency and speed. In order to quickly retransmit data packets and reduce transmission delays caused by network packet loss, QUIC has established a fast retransmission mechanism. If a data packet with a smaller sequence number than the expected one is received, QUIC can determine whether the data packet has timed out through the timestamp, and quickly decide whether to retransmit it.

[0003] Therefore, the QUIC protocol with multiplexing characteristics and multipath QUIC (MPQUIC) based on QUIC extension and supporting parallel transmission have gradually become new hot spots. The combination of QUIC protocol and multipath technology is considered to be the development direction of multipath transmission technology in the future.

[0004] However, compared with the traditional TCP-based transmission method, QUIC does have some differences. The fast connection establishment, multiplexing and fast retransmission features of the QUIC protocol are also easily exploited by some malicious attackers to launch network attacks such as DoS, DDoS and LDDoS (Low and Slow Distributed Denial of Service), which are mainly manifested in the following aspects:

[0005] 1. The fast connection mechanism of the QUIC protocol allows attackers to establish a large number of connection requests in a short period of time, occupying server resources and causing a denial of service attack (DoS).

[0006] 2. QUIC protocol multiplexing technology transmits multiple application streams in parallel on the same QUIC connection, allowing attackers to launch LDDoS attacks on one connection without being accurately detected and filtered.

[0007] 3. The fast retransmission mechanism of the QUIC protocol allows attackers to occupy network bandwidth through fast retransmission in the case of network congestion, causing a denial of service attack (DoS).

[0008] 4. The timestamp mechanism of the QUIC protocol allows attackers to forge source IP addresses and send a large number of low-rate and long-duration LDDoS attacks to avoid being detected by some security devices.

[0009] 5. QUIC is based on the UDP protocol instead of TCP. UDP itself is more vulnerable to attacks such as DDoS (distributed denial of service) than TCP because it does not have TCP's connection state tracking and flow control mechanism.

[0010] Therefore, in response to the above security risks, it is urgent to study solutions to improve the defense capabilities and robustness of the QUIC network.

[0011] In addition, traditional abnormal traffic detection methods based on data labels are usually based on supervised learning. On the one hand, they rely on databases with known labels and are only sensitive to known types of network attacks. In practical applications, it is also difficult to collect enough labeled data. On the other hand, they require a large amount of labeled data for training, which requires high computing power and consumes a lot of energy. In summary, traditional network abnormal traffic detection only targets known types of network attacks, and has the disadvantages of harsh detection conditions, poor versatility, low sensitivity, a small range of detectable types, low efficiency, high computing power requirements, and high energy consumption. Summary of the invention

[0012] The purpose of the present invention is to provide a method, system and device for identifying abnormal behavior in a QUIC network to improve detection speed and sensitivity.

[0013] To achieve the above object, the present invention provides a method for identifying abnormal behavior in a QUIC network, the method comprising:

[0014] Based on the principle of sliding window, multiple segments of network traffic signals are obtained;

[0015] Decomposing and reconstructing the plurality of network traffic signals by wavelet transform method, and obtaining network traffic reconstruction signals corresponding to each network traffic signal;

[0016] The Hurst index is calculated based on the wavelet coefficient to determine whether the Hurst index is greater than or equal to the first abnormal threshold; if it is greater than or equal to the first abnormal threshold, an alarm is issued; if it is less than the first abnormal threshold, the network traffic reconstruction signal corresponding to each segment of the network traffic signal is predicted and estimated based on the Kalman filter to obtain the prior prediction value and the a posteriori optimal estimation value corresponding to each segment of the network traffic signal;

[0017] Determine whether the error between the prior prediction value and the posterior optimal estimate value corresponding to the network traffic signal of each segment is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that the network traffic signal of each segment has abnormal data jitter behavior, and an alarm or visual display is performed.

[0018] Optionally, the obtaining of multiple network traffic signals based on the principle of a sliding window specifically includes:

[0019] Get the original signal of network traffic;

[0020] The original network traffic signal is subjected to sliding window segmentation processing to obtain multiple segments of network traffic signals.

[0021] Optionally, the method of using wavelet transform to decompose and reconstruct the multiple segments of the network traffic signal to obtain the network traffic reconstruction signal corresponding to each segment of the network traffic signal specifically includes:

[0022] Select Haar wavelet as the wavelet function;

[0023] Performing Haar wavelet three-layer decomposition on the original network traffic signal of each segment, decomposing the signal into different frequency components, and obtaining the approximate coefficients and wavelet coefficients of each layer corresponding to the network traffic data of each segment;

[0024] Performing fixed threshold processing on the wavelet coefficients corresponding to the network traffic signals of each segment to obtain the signals to be reconstructed corresponding to the network traffic signals of each segment;

[0025] The signals to be reconstructed and the approximate coefficients corresponding to the network traffic signals of each segment are reconstructed layer by layer along the direction of inverse decomposition to obtain network traffic reconstructed signals corresponding to the network traffic signals of each segment.

[0026] Optionally, predicting and estimating the network traffic reconstruction signal corresponding to each segment of the network traffic signal based on Kalman filtering to obtain a priori prediction values ​​and a posteriori optimal estimation values ​​corresponding to each segment of the network traffic signal specifically includes:

[0027] Use Kalman filter to predict the state and obtain the prior state prediction value of the state variable at the kth moment;

[0028] A posteriori optimal estimation is performed based on the prior state prediction value of the state variable at the kth moment and the network traffic reconstruction signal corresponding to the state variable at the kth moment to obtain the posteriori optimal estimation value of the state variable at the kth moment.

[0029] Optionally, the method further comprises:

[0030] If the Hurst exponent warning fails to detect abnormal jitter of network traffic, but the errors of the priori and a posteriori estimates of the Kalman filter detect abnormal jitter of network traffic, the threshold of the Hurst exponent alarm is corrected.

[0031] The present invention also provides a QUIC network abnormal behavior identification system, the system comprising:

[0032] A network traffic signal acquisition module is used to acquire multiple segments of network traffic signals based on the principle of a sliding window;

[0033] A decomposition and reconstruction module, used to decompose and reconstruct the multiple segments of the network traffic signal by using a wavelet transform method, and obtain a network traffic reconstruction signal corresponding to each segment of the network traffic signal;

[0034] The first judgment module is used to calculate the Hurst index based on the wavelet coefficients and judge whether the Hurst index is greater than or equal to the first abnormal threshold; if it is greater than or equal to the first abnormal threshold, an alarm is issued; if it is less than the first abnormal threshold, a "prediction estimation module" is executed;

[0035] A prediction and estimation module, used to predict and estimate the network traffic reconstruction signal corresponding to each segment of the network traffic signal based on Kalman filtering, and obtain a priori prediction values ​​and a posteriori optimal estimation values ​​corresponding to each segment of the network traffic signal;

[0036] The second judgment module is used to determine whether the error between the prior prediction value and the posteriori optimal estimate value corresponding to the network traffic signal of each segment is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that the network traffic signal of each segment has abnormal data jitter behavior, and an alarm or visual display is performed.

[0037] Optionally, the network traffic signal acquisition module specifically includes:

[0038] An acquisition unit, used for acquiring original signals of network traffic;

[0039] The sliding window segmentation processing unit is used to perform sliding window segmentation processing on the original network traffic signal to obtain multiple segments of network traffic signals.

[0040] Optionally, the decomposition and reconstruction module specifically includes:

[0041] A selection unit is used to select Haar wavelet as a wavelet function;

[0042] The decomposition unit is used to perform Haar wavelet three-layer decomposition on the original signal of each segment of network traffic, decompose the signal into different frequency components, and obtain the approximate coefficients and wavelet coefficients of each layer corresponding to each segment of network traffic data.

[0043] The comparison unit is used to perform fixed threshold processing on the wavelet coefficients corresponding to each segment of the network traffic signal to obtain the to-be-reconstructed signal corresponding to each segment of the network traffic signal.

[0044] The reconstruction unit is used to reconstruct the signals to be reconstructed and the approximate coefficients corresponding to each segment of the network traffic signal layer by layer along the direction of inverse decomposition to obtain the network traffic reconstructed signals corresponding to each segment of the network traffic signal.

[0045] Optionally, the system further comprises:

[0046] The correction unit is used to record and analyze network log files when there is abnormal data jitter in the network traffic signal of each segment, and to correct the error threshold value.

[0047] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the QUIC network abnormal behavior identification method as described above.

[0048] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0049] The present invention discloses a QUIC network abnormal behavior identification method, system and storage medium. First, based on the principle of sliding window, multiple network traffic signals are obtained; secondly, the wavelet transform method is used to decompose and reconstruct the multiple network traffic signals to obtain the network traffic reconstruction signals corresponding to each segment of the network traffic signal; then when the Hurst index is less than the first abnormal threshold, the network traffic reconstruction signals corresponding to each segment of the network traffic signal are predicted and estimated based on the Kalman filter to obtain the prior prediction value and the a posteriori optimal estimation value corresponding to each segment of the network traffic signal; finally, it is determined whether the prior prediction value and the a posteriori optimal estimation value corresponding to each segment of the network traffic signal are greater than or equal to the second abnormal threshold; if greater than or equal to the second abnormal threshold, it means that there is data jitter abnormal behavior in each segment of the network traffic signal, and an alarm or visual display is performed. The present invention combines the wavelet algorithm with the Kalman filter, which not only improves the accuracy, versatility and efficiency of network abnormal behavior identification, but also has a better denoising effect and higher robustness, and can effectively detect network attacks such as DoS, DDoS and LDDoS. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0051] Figure 1 This is a flow chart of a method for identifying abnormal behavior in a QUIC network according to an embodiment of the present invention;

[0052] Figure 2 This is a schematic diagram of the sliding window principle of an embodiment of the present invention;

[0053] Figure 3 The process of three-layer wavelet decomposition and reconstruction in the embodiment of the present invention;

[0054] Figure 4 A schematic diagram of the jitter amplitude after and after the LDDoS attack according to an embodiment of the present invention;

[0055] Figure 5 This is a diagram showing the effect of Haar wavelet smoothing and denoising according to an embodiment of the present invention;

[0056] Figure 6 This is a diagram showing the effect of wavelet transform and Kalman filtering processing in an embodiment of the present invention;

[0057] Figure 7 The conventional single Kalman filter processing result of the embodiment of the present invention;

[0058] Figure 8 This is a graph showing the prior and a posteriori errors of a single Kalman filter according to an embodiment of the present invention;

[0059] Fig. 9 The wavelet transform of the embodiment of the present invention is combined with the Kalman filter prior and a posteriori errors;

[0060] Fig.10 is the time series error of the embodiment of the present invention;

[0061] Fig.11 A schematic diagram of a Kalman filter optimal estimation algorithm according to an embodiment of the present invention;

[0062] Fig.12 The network topology designed for the experiment of the embodiment of the present invention is a schematic diagram of the QUIC single-path topology. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] The purpose of the present invention is to provide a method, system and device for identifying abnormal behavior in a QUIC network to improve detection speed and sensitivity.

[0065] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0066] Example 1

[0067] like Figure 1 As shown, the present invention discloses a method for identifying abnormal behavior of a QUIC network, the method comprising:

[0068] Step S1: Based on the principle of sliding window, multiple network traffic signals are obtained.

[0069] Step S2: Decompose and reconstruct multiple segments of network traffic signals using a wavelet transform method to obtain a network traffic reconstruction signal corresponding to each segment of the network traffic signal.

[0070] Step S3: Calculate the Hurst index based on the wavelet coefficients to determine whether the Hurst index is greater than or equal to the first abnormal threshold; if it is greater than or equal to the first abnormal threshold, an alarm is issued; if it is less than the first abnormal threshold, execute "Step S4";

[0071] Step S4: Based on Kalman filtering, the network traffic reconstruction signal corresponding to each segment of the network traffic signal is predicted and estimated to obtain a priori prediction values ​​and a posteriori optimal estimation values ​​corresponding to each segment of the network traffic signal.

[0072] Step S5: Determine whether the error between the prior prediction value and the a posteriori optimal estimate value corresponding to each segment of the network traffic signal is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that there is abnormal data jitter behavior in each segment of the network traffic signal, and an alarm or visual display is performed.

[0073] The following is a detailed discussion of each step:

[0074] Step S1: Based on the principle of sliding window, multiple segments of network traffic signals are obtained, specifically including:

[0075] Step S11: Obtaining the original signal of network traffic; specifically, the present invention deploys edge terminal nodes on network nodes (such as routers), and is responsible for receiving the original data of network traffic with specific characteristics, also known as the original signal of network traffic, through various active detection components.

[0076] Step S12: Perform sliding window segmentation processing on the original network traffic signal to obtain multiple segments of network traffic signals. Figure 2 As shown, based on the prior data knowledge and the principle of sliding window, the present invention divides the received original network traffic signal into multiple flow segments with 40 seconds as a window, that is, 40 seconds is used as a detection window for detection, and detection is performed every 40 seconds. The next 40 seconds should include the last 5 seconds of the signal of the previous window. The advantage of this is that it not only reduces the single calculation amount, but also ensures that all network traffic signals are detected without being missed.

[0077] Step S2: Decomposing and reconstructing multiple segments of network traffic signals by wavelet transform method to obtain network traffic reconstruction signals corresponding to each segment of network traffic data, specifically including:

[0078] Step S21: Select Haar wavelet as the wavelet function.

[0079] The selection of wavelet basis, i.e. wavelet function, is an important step in determining the effect of wavelet denoising. Based on compact support, orthogonality, symmetry and similarity, this method selects Haar wavelet as wavelet function to decompose the original data. The decomposition of network signals usually adopts multi-level decomposition. Generally speaking, 2 to 5 levels of decomposition or even more levels of decomposition can be adopted. The specific selection should be determined according to the actual situation and needs. Multi-level decomposition can help remove noise and interference in network signals. By thresholding the high-frequency wavelet coefficients or using wavelet packet analysis and other technologies, effective signal denoising can be achieved to improve the quality and reliability of the signal. The present invention adopts 3-level decomposition to decompose and reconstruct the original data. Specifically, Figure 3 shown.

[0080] Step S22: Perform Haar wavelet three-layer decomposition on the original signal of each segment of network traffic, decompose the signal into different frequency components, and obtain the approximate coefficient (low-frequency part) and wavelet coefficient (high-frequency part) of each layer corresponding to each segment of network traffic data. In this embodiment, the approximate coefficient is also called the scale function, and the detail coefficient is also called the wavelet function.

[0081] The scaling function φ(x) and the wavelet function ψ(x) can generate a series of functions to decompose or reconstruct the target signal. Therefore, φ(x) is called the "father wavelet" and ψ(x) is called the "mother wavelet".

[0082] The Haar wavelet is the simplest one in the Daubechies wavelet family and is also known as the Daubechies wavelet of order 1. The Haar wavelet is an orthogonal wavelet basis and has the characteristics of both symmetry and antisymmetry. The general form of the Haar mother wavelet with scale λ and interval t - λ < u ≤ t + λ is:

[0083]

[0084] The general form of the Haar father wavelet with scale j and interval k - j < u ≤ k + j is:

[0085]

[0086] The Haar mother wavelet function can be represented by the father wavelet, that is

[0087] ψ(t) = φ(2t) - φ(2t - 1)

[0088] Regarding the determination of the decomposition level, theoretically, it can be decomposed continuously, but generally, it is necessary to determine the appropriate decomposition level according to the characteristics of the signal and the needs of the user. Generally speaking, during the signal analysis process, the signal is roughly decomposed into 3 - 4 layers. Therefore, the decomposition level of the discrete wavelet transform in the present invention is determined to be 3 layers.

[0089] For the above-mentioned three-scale wavelet decomposition of the network traffic signal, based on the upper-level approximate component signal, the next-level approximate component signal and detail component signal are obtained. Finally, the finally obtained approximate component signal is compared horizontally with the original signal, and the frequency domain analysis method is used to extract the signal information in different frequency intervals.

[0090] The calculation process of wavelet denoising is as follows. First, the original signal f(t) is subjected to wavelet transform using the Haar mother wavelet, and the signal is decomposed into wavelet coefficients of multiple layers. Then, these wavelet coefficients are processed with a fixed threshold, the coefficients smaller than the threshold are set to zero, and the coefficients larger than the threshold are retained. Finally, the wavelet inverse transform is performed using the processed wavelet coefficients to reconstruct the denoised signal. The following are the detailed calculation steps of this process:

[0091] 1. Discretization. The continuous network traffic signal f(t) is discretized into x(t).

[0092] Assume that the time series {x t : t ∈ Z} is the sampling of the finite energy signal x(·), that is, x t = x(t). Each element v 0,k of each initial scale sequence is the inner product of x(·) and φ 0,k (·). If the understanding of x(·) is limited to the values on Z, that is, {x t}, then strictly speaking, we cannot obtain a multiresolution analysis of x(·). This is because there is not enough data to construct v 0，k However, we can get an approximate v based on the Riemann principle and sampling principle. 0，k .v 0，k It is called the scale factor with a scale of 1.

[0093]

[0094] In this case, the total length of the network signal time series data is 40 seconds, and the sampling interval is 1.5 ms. After each level of decomposition, the sampling interval is doubled and the sampling points are halved. Assuming the number of data is N, for scale 2 j-1 , there are N / 2j wavelet coefficients in total.

[0095] 2. Wavelet decomposition. The decomposition process follows the pyramidal decomposition of wavelet transform.

[0096]

[0097] Among them, j0∈Z, if Then for any j>j0, the signal The components of V1 and W1 can be decomposed into:

[0098] x(t)=s1(t)+d1(t),

[0099] Where x(t) is the original signal, s1(t) is the approximation component in the scale space V1, and d1(t) is the detail component in the detail space W1. Yes V j In V j-1 in the orthogonal complement, which is considered to be relative to the scale τ j =2 j-1 In the next level of decomposition, x(·) is considered as V1 and the decomposition is continued.

[0100] The network traffic signal x(t) is decomposed into three levels using Haar wavelet, and each layer is obtained at scale λ i =2 j The approximate component s of x(t) j (t) and detail component d j (t), where j represents the number of layers.

[0101]

[0102] w j,k = j-1 (·),ψ j，k (·)>

[0103] ​Among them, v j，k Represented at scale λ j =2 j The scale factor under , k represents the time series number. j，k Represented at scale λ j =2 j The wavelet coefficients under , k represents the time series number.

[0104] Step S23: Perform fixed threshold processing on the wavelet coefficients corresponding to each segment of the network traffic signal to obtain the to-be-reconstructed signal corresponding to each segment of the network traffic signal. Perform fixed threshold denoising, the specific steps are as follows:

[0105] For each layer of wavelet coefficients, denoising is performed according to a preset fixed threshold θ. j，k If the value is less than the threshold value θ, the coefficient is set to zero; otherwise, the coefficient is retained. The calculation formula is as follows:

[0106]

[0107] The key to Haar wavelet denoising is to perform threshold processing on detail coefficients. Since noise usually appears as high-frequency components in the signal, and the important information of the signal itself is mainly contained in the low-frequency components, the noise components in the wavelet coefficients can be removed by threshold processing while retaining the main information of the signal. If the noise level is high, a larger threshold may be required to effectively remove the noise; for signals with low noise levels, a smaller threshold can be selected.

[0108] Step S24: reconstruct the signals to be reconstructed and the approximate coefficients corresponding to each segment of the network traffic signal layer by layer along the direction of the inverse decomposition to obtain the network traffic reconstructed signals corresponding to each segment of the network traffic signal. In this embodiment, the reconstruction process includes upsampling and deconvolution operations to obtain the network traffic reconstructed signals after noise reduction.

[0109] Haar wavelet reconstruction is the inverse operation of decomposition, using the denoised wavelet coefficients To reconstruct the signal. The calculation formula of inverse wavelet transform (IDWT) is:

[0110]

[0111] The scale coefficients of the j-1 layer can be reconstructed by the scale coefficients and wavelet coefficients of the jth layer using the following formula:

[0112] Wavelet Filter Zero outside -(L-1)≤l≤0. Scaling filter It is also zero outside -(L-1)≤l≤0.

[0113]

[0114] After this process, the wavelet coefficients of the original signal after wavelet fixed threshold denoising are used to reconstruct the denoised signal x'(t).

[0115] Step S25: After wavelet reconstruction, adding the detection and judgment of the threshold of the Hurst exponent can effectively reduce the missed detection rate.

[0116] Step S3: predicting and estimating the network traffic reconstruction signal corresponding to each segment of the network traffic signal based on Kalman filtering, and obtaining the priori prediction value and the a posteriori optimal estimation value corresponding to each segment of the network traffic signal. The specific steps include:

[0117] Step S31: Use the Kalman filter to perform state prediction to obtain the prior state prediction value of the state variable at the kth moment. The specific calculation formula is:

[0118]

[0119] in, is the prior prediction value of the state variable at the kth moment, F k is the state transfer matrix, is the posterior optimal estimate of the state variable at the k-1th moment, B k is the input control matrix, u k is the control quantity of the current state.

[0120] Step S32: Perform a posteriori optimal estimation based on the prior state prediction value of the state variable at the kth moment and the network traffic reconstruction signal corresponding to the state variable at the kth moment to obtain the posteriori optimal estimation value of the state variable at the kth moment. The specific calculation formula is:

[0121]

[0122] in is the posterior optimal estimate of the state variable at the kth moment, K k is the Kalman gain, is the posterior optimal estimate of the state variable at the k-1th moment, is the prior prediction value of the state variable at the kth moment, H k is the observation matrix, and Z(k) is the network traffic reconstruction signal corresponding to the state variable at the kth moment.

[0123] In this embodiment, in the Kalman filter, the Kalman gain K kIt is used to perform weighted fusion of the system's predicted values ​​and actual observed values ​​to obtain the optimal state estimation.

[0124] The Kalman gain is calculated based on the prior prediction value of the state variable covariance at the kth moment. The specific calculation formula is:

[0125]

[0126] Among them, K k is the Kalman gain, R k is the measurement noise covariance, is the prior prediction value of the state variable covariance at the kth moment, H k is the observation matrix.

[0127] Subsequently, in order for the Kalman filter to continue to complete the prediction step for the next state, the posterior estimate of the state covariance at the kth moment is updated. The specific steps are as follows:

[0128] The posterior estimate of the state covariance at the kth moment is calculated based on the prior prediction value of the state variable covariance at the kth moment and the Kalman gain. The specific calculation formula is:

[0129]

[0130] Among them, H k is the observation matrix, K k is the Kalman gain, is the posterior estimate of the state covariance at the kth moment, is the prior prediction value of the state variable covariance at the kth moment. In addition, P k is the measured value at time k.

[0131] The update step of the Mann filter algorithm gives a series of measurement update equations, which realize the correction function of the predicted value of the state variable at the current moment.

[0132] Step S4: Determine whether the error between the prior prediction value and the a posteriori optimal estimate value corresponding to each segment of the network traffic signal is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that each segment of the network traffic signal has abnormal data jitter behavior, and an alarm or visual display is performed; if it is less than the second abnormal threshold, it means that each segment of the network traffic signal does not have abnormal data jitter behavior.

[0133] The present application also includes: if the Hurst exponent warning fails to detect abnormal jitter of network traffic, but the a priori and a posteriori estimates of the Kalman filter detect abnormal jitter of network traffic, then the threshold of the Hurst exponent alarm is corrected.

[0134] The present invention It is only derived from the information of the kth state, and The calculation also uses the observation value at the kth moment. When jitter occurs, the network traffic becomes abnormal and the optimal estimate will have a large error. Therefore, the network traffic signal corresponding to each window is monitored in real time, and the posterior optimal estimate corresponding to the network traffic signal is compared with the threshold, thereby realizing QUIC network traffic anomaly detection.

[0135] Example 2

[0136] The present invention also discloses a QUIC network abnormal behavior identification system, the system comprising:

[0137] The network traffic signal acquisition module is used to acquire multiple segments of network traffic signals based on the principle of sliding windows.

[0138] The decomposition and reconstruction module is used to decompose and reconstruct multiple segments of the network traffic signal by using a wavelet transform method to obtain a network traffic reconstruction signal corresponding to each segment of the network traffic signal.

[0139] The first judgment module is used to calculate the Hurst index based on the wavelet coefficients and judge whether the Hurst index is greater than or equal to the first abnormal threshold; if it is greater than or equal to the first abnormal threshold, an alarm is issued; if it is less than the first abnormal threshold, the "prediction and estimation module" is executed.

[0140] The prediction and estimation module is used to predict and estimate the network traffic reconstruction signal corresponding to each segment of the network traffic signal based on Kalman filtering, and obtain the prior prediction value and the posteriori optimal estimation value corresponding to each segment of the network traffic signal.

[0141] The second judgment module is used to determine whether the error between the prior prediction value and the posteriori optimal estimate value corresponding to the network traffic signal of each segment is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that the network traffic signal of each segment has abnormal data jitter behavior, and an alarm or visual display is performed.

[0142] As an optional implementation manner, the network traffic signal acquisition module of the present invention specifically includes:

[0143] The acquisition unit is used to acquire the original signal of network traffic.

[0144] The sliding window segmentation processing unit is used to perform sliding window segmentation processing on the original network traffic signal to obtain multiple segments of network traffic signals.

[0145] As an optional implementation mode, the decomposition and reconstruction module of the present invention specifically includes:

[0146] The selection unit is used to select Haar wavelet as the wavelet function.

[0147] The decomposition unit is used to perform Haar wavelet three-layer decomposition on the original signal of each segment of network traffic, decompose the signal into different frequency components, and obtain the approximate coefficients and wavelet coefficients of each layer corresponding to each segment of network traffic data.

[0148] The comparison unit is used to perform fixed threshold processing on the wavelet coefficients corresponding to each segment of the network traffic signal to obtain the to-be-reconstructed signal corresponding to each segment of the network traffic signal.

[0149] The reconstruction unit is used to reconstruct the signals to be reconstructed and the approximate coefficients corresponding to each segment of the network traffic signal layer by layer along the direction of inverse decomposition to obtain the network traffic reconstructed signals corresponding to each segment of the network traffic signal.

[0150] As an optional implementation manner, the system of the present invention further includes:

[0151] The correction unit is used to record and analyze network log files when there is abnormal data jitter in the network traffic signal of each segment, and to correct the error threshold value.

[0152] The same parts as those in Example 1 will not be discussed again here, and please refer to Example 1 for details.

[0153] Example 3

[0154] The present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the QUIC network abnormal behavior identification method as described in Example 1.

[0155] Specific examples:

[0156] The network topology designed for the experiment is a QUIC single-path topology. Fig.12 As shown. There are two terminal nodes: QUIC sender and QUIC receiver. Two router nodes R1 and R2 are set on this path, and the CBR traffic generator can be used to simulate attack traffic. According to the characteristics of slow attack rate, large number of attack sources and distribution of LDDoS network, 5000 CBR generator nodes (Attack node) and 5 CBR receiver nodes (Attacknode) are set. The sampling interval is 10ms. Since the experiment uses a batch sending application to send data packets and the number of data packets sent is large, a bottleneck link (bandwidth 10Mb, delay 5ms) is set on the main path, and a link (bandwidth 12Mb, delay 0.1ms) is set on the access path. We set the packet loss rate on all links to 0.01. See Table 1 for detailed parameter settings.

[0157] Table 1

[0158]

[0159]

[0160] When attack traffic is added to the QUIC network, the attack time is set to 20s, ranging from 9s to 29s, with 2s as an attack cycle. Here, the amplitude ratio coefficient of adding white noise is preset to 0.2, and the overall average is 100.

[0161] In the QUIC network, once it is attacked by LDDoS, the transmission of data packets will experience large fluctuations due to the increase in delay jitter. Based on this fact, the present invention proposes a QUIC network anomaly detection method based on wavelet transform and Kalman filtering.

[0162] To detect LDDoS attacks, we must first study the characteristics of network traffic when the attack occurs. This method uses the NS-3 network simulation simulator to simulate the QUIC network transmission signal, and combines the DCE (Direct Code Execution) plug-in to simulate the LDDoS attack in NS3. The normal network traffic before the network attack is set to 5Mb bandwidth and 25ms delay. First, collect the original data of network traffic jitter before and after the LDDoS attack, and then extract the original signal as the observation value of the Kalman filter combination model based on wavelet analysis. The QUIC signal jitter data with a duration of 40s and an attack time of 20s is extracted as a data acquisition indicator set for comparison and analysis of the algorithm proposed in the present invention. The time series line graph drawn by MATLAB software is shown in the figure. Figure 4 As shown, (a) shows the normal network traffic without network attack, and (b) shows the jitter amplitude after LDDoS attack.

[0163] Depend on Figure 4 It can be seen that the time delay of the victim traffic fluctuated significantly during the attack period (10s-30s). In order to provide smoother detection data for the subsequent Kalman filter, it is necessary to perform wavelet transform on the sampled signal to extract the changing trend of the waveform. At the same time, the amount of data to be processed is also reduced. This is because wavelet transform is a scale-based analysis method. It uses wavelet functions at different scales to decompose the signal, and wavelet functions usually have the characteristics of locality and sparsity, that is, at a certain scale, the non-zero part of the wavelet function only occupies a small part of the entire signal. Therefore, the frequency components at each scale obtained by wavelet transform are usually sparse and only contain part of the signal information, thereby reducing the amount of data to be processed.

[0164] For the collected traffic data, the process of using Haar wavelet to perform discrete wavelet transform includes two steps: decomposition and reconstruction. The specific steps refer to the decomposition and reconstruction steps in Example 1.

[0165] This method uses Haar wavelet function and adopts three-level decomposition to perform the first stage of smoothing and denoising on the original sampled data. Haar wavelet is the simplest orthogonal wavelet function. The comparison between the original signal and the denoised signal after Haar wavelet processing is as follows: Figure 5 As shown in the figure. After this transformation, the original waveform becomes relatively smooth, and there is no short-term mutation only before and after the attack. At the same time, the amount of data to be processed is also reduced, which is more conducive to the denoising effect of the Kalman filter in the next stage.

[0166] Kalman filter algorithm: Based on the above wavelet analysis, the Kalman filter algorithm is used to further predict and estimate the data after wavelet transformation. The covariance Q of the process noise is set to 0.1, and the covariance R of the observation noise is set to 0.5. The Kalman filter optimal estimation algorithm is as follows Fig.11 shown.

[0167] Continue to use the Kalman filter optimal estimation algorithm to further predict and estimate the data after wavelet transformation. The results are as follows Figure 6 shown.

[0168] like Figure 6 As shown in the figure, the effect of further processing the wavelet transformed data using Kalman filtering shows that the wavelet transform can provide good noise resistance in the signal decomposition process, but there may still be some residual noise. Using Kalman filtering can further reduce the impact of noise and improve signal quality. Wavelet transform usually decomposes the signal into approximate coefficients and detail coefficients, where the detail coefficients contain the high-frequency components of the signal. Processing the detail coefficients through Kalman filtering can smooth the signal and reduce sharp transitions.

[0169] Wavelet transform has the characteristics of time-frequency localization, which can provide local information of signals at different times and frequencies. Combining the state update and prediction steps of Kalman filtering to filter network traffic data can better track the dynamic abnormal changes of network traffic, reduce the noise level, and improve the accuracy of signal analysis and processing.

[0170] Experimental comparison with a single Kalman filter algorithm

[0171] The NS3 network emulator is used to simulate the QUIC network transmission signal, and the DCE (Direct Code Execution) plug-in is used to simulate the LDDoS attack in NS3. Figure 4The results of directly processing the original data of LDDoS jitter amplitude obtained by NS3 simulation using Kalman filtering are as follows: Figure 6 shown.

[0172] Will Figure 6 and Figure 7 By comparison, it is not difficult to find that the processing method using wavelet transform combined with Kalman filtering has the advantages of better noise removal, feature separation, adaptation to nonlinear signals, time-frequency localization, and data compression compared to the single Kalman filtering method. This joint method combines the advantages of wavelet transform and Kalman filtering, and has higher effect and accuracy for signal processing and analysis tasks.

[0173] In order to quantify the advantages and disadvantages of the two detection methods, the mean error ε of the prior and the posterior is introduced as a criterion. The calculation formula is:

[0174]

[0175] In the filtering process, the prior represents the predicted state based on the system model, and the posterior represents the estimated state after correction based on the observed data. Calculating the mean error of the prior and posterior can be used to evaluate the noise suppression effect of the filter. If the mean error of the prior and posterior decreases, it means that the filter has successfully reduced the impact of noise on the signal and improved the accuracy of the signal. A smaller mean error indicates that the filter has a better noise suppression effect. The effect diagram of the mean error ε of the prior and posterior in the two detection methods is shown in the figure below. Figure 8 and Fig. 9 The calculation results are shown in Table 2.

[0176] Table 2

[0177] Wavelet transform combined with Kalman filtering method Single Kalman filter method ε 0.000081 0.000417

[0178] The results show that the wavelet transform combined with Kalman filtering method has a smaller mean error ε of the prior and the posterior and a more accurate prediction than the single Kalman filtering method.

[0179] Attack Test

[0180] In order to perform real-time detection, according to the sliding window principle, each detection cycle is set to 40 seconds, and each window contains the last 5 seconds of the previous window for detection. The advantage of this is that it can avoid missing network traffic data. Subsequently, the errors of Kalman prior and posterior estimates are calculated. Using the prior prediction value and the optimal posterior estimate value for detection can give full play to the greatest advantage of Kalman filtering, that is, due to the prior prediction value It is obtained based on the state at time k and previous information, and the optimal estimate The observed value at the kth moment is also used, so when an abnormality suddenly occurs, there will be a large error between the estimated value and the predicted value. If it exceeds a certain threshold, it can be judged that an attack has occurred.

[0181] The expression for error calculation is:

[0182]

[0183] The time series error after further processing the wavelet transformed data using Kalman filtering is Fig.10 shown.

[0184] Depend on Fig.10 It can also be seen that the errors at the beginning and end of the attack are large, because the recovery of normal traffic from the attacked state also undergoes a mutation. In order to only alarm for mutations when an attack occurs, a hypothesis test method is used to determine the beginning and end of the attack, using the t-test method, which can reduce false alarms. Once ε is detected, k When the value exceeds the threshold, the next time point's raw data will be tested. A detection cycle is divided into n equal time intervals, and the t-test method is used to determine whether the attack has started or ended. Need to test:

[0185] H0:μ≥μ0=M k / n

[0186] H1:μ <M k / n

[0187] Among them, M k is the mathematical expectation of a jitter amplitude obtained through learning under normal circumstances. The rejection region is:

[0188]

[0189] In the formula, F avg is the average value of the jitter amplitude during this period. If H1 is acceptable, it is considered that the attack has just begun; if H1 is rejected, it is considered that the attack has ended. In this way, only one mutation point is considered to be an attack, and the other mutation point will not be alarmed.

[0190] The experiment of the present invention uses jitter data as the raw data for analysis. Jitter is usually measured in milliseconds (ms) and represents the fluctuation range of the time interval between the arrival of data packets. Large jitter means that the arrival time of the data packet is unstable, which will lead to the degradation of real-time application performance.

[0191] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0192] The present invention uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only used to help understand the method and core ideas of the present invention. At the same time, for those skilled in the art, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for identifying abnormal behavior in a QUIC network, characterized in that: The method comprises: Based on the principle of sliding window, multiple segments of network traffic signals are obtained; Decomposing and reconstructing the plurality of network traffic signals by wavelet transform method, and obtaining network traffic reconstruction signals corresponding to each network traffic signal; The Hurst index is calculated based on the wavelet coefficient to determine whether the Hurst index is greater than or equal to the first abnormal threshold; if it is greater than or equal to the first abnormal threshold, an alarm is issued; if it is less than the first abnormal threshold, the network traffic reconstruction signal corresponding to each segment of the network traffic signal is predicted and estimated based on the Kalman filter to obtain the prior prediction value and the a posteriori optimal estimation value corresponding to each segment of the network traffic signal; Determine whether the error between the prior prediction value and the posterior optimal estimate value corresponding to the network traffic signal of each segment is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that the network traffic signal of each segment has abnormal data jitter behavior, and an alarm or visual display is performed.

2. The QUIC network abnormal behavior identification method according to claim 1, characterized in that: The method of obtaining multiple network traffic signals based on the principle of sliding window specifically includes: Get the original signal of network traffic; The original network traffic signal is subjected to sliding window segmentation processing to obtain multiple segments of network traffic signals.

3. The QUIC network abnormal behavior identification method according to claim 1, characterized in that: The method of using wavelet transform to decompose and reconstruct the multiple segments of the network traffic signal to obtain the network traffic reconstruction signal corresponding to each segment of the network traffic signal specifically includes: Select Haar wavelet as the wavelet function; Performing Haar wavelet three-layer decomposition on the original network traffic signal of each segment, decomposing the signal into different frequency components, and obtaining the approximate coefficients and wavelet coefficients of each layer corresponding to the network traffic data of each segment; Performing fixed threshold processing on the wavelet coefficients corresponding to the network traffic signals of each segment to obtain the signals to be reconstructed corresponding to the network traffic signals of each segment; The signals to be reconstructed and the approximate coefficients corresponding to the network traffic signals of each segment are reconstructed layer by layer along the direction of inverse decomposition to obtain network traffic reconstructed signals corresponding to the network traffic signals of each segment.

4. The QUIC network abnormal behavior identification method according to claim 1, characterized in that: The method of predicting and estimating the network traffic reconstruction signal corresponding to each segment of the network traffic signal based on Kalman filtering to obtain the prior prediction value and the a posteriori optimal estimation value corresponding to each segment of the network traffic signal specifically includes: Use Kalman filter to predict the state and obtain the prior state prediction value of the state variable at the kth moment; A posteriori optimal estimation is performed based on the prior state prediction value of the state variable at the kth moment and the network traffic reconstruction signal corresponding to the state variable at the kth moment to obtain the posteriori optimal estimation value of the state variable at the kth moment.

5. The QUIC network abnormal behavior identification method according to claim 1, characterized in that: The method further comprises: If the Hurst exponent warning fails to detect abnormal jitter of network traffic, but the errors of the priori and a posteriori estimates of the Kalman filter detect abnormal jitter of network traffic, the threshold of the Hurst exponent alarm is corrected.

6. A QUIC network abnormal behavior identification system, characterized in that: The system comprises: A network traffic signal acquisition module is used to acquire multiple segments of network traffic signals based on the principle of a sliding window; A decomposition and reconstruction module, used to decompose and reconstruct the multiple segments of the network traffic signal by using a wavelet transform method, and obtain a network traffic reconstruction signal corresponding to each segment of the network traffic signal; The first judgment module is used to calculate the Hurst index based on the wavelet coefficients and judge whether the Hurst index is greater than or equal to the first abnormal threshold; if it is greater than or equal to the first abnormal threshold, an alarm is issued; if it is less than the first abnormal threshold, a "prediction estimation module" is executed; A prediction and estimation module, used to predict and estimate the network traffic reconstruction signal corresponding to each segment of the network traffic signal based on Kalman filtering, and obtain a priori prediction values ​​and a posteriori optimal estimation values ​​corresponding to each segment of the network traffic signal; The second judgment module is used to determine whether the error between the prior prediction value and the posteriori optimal estimate value corresponding to the network traffic signal of each segment is greater than or equal to the second abnormal threshold; if the error is greater than or equal to the second abnormal threshold, it means that the network traffic signal of each segment has abnormal data jitter behavior, and an alarm or visual display is performed.

7. The QUIC network abnormal behavior identification system according to claim 6, characterized in that: The network traffic signal acquisition module specifically includes: An acquisition unit, used for acquiring original signals of network traffic; The sliding window segmentation processing unit is used to perform sliding window segmentation processing on the original network traffic signal to obtain multiple segments of network traffic signals.

8. The QUIC network abnormal behavior identification system according to claim 6, characterized in that: The decomposition and reconstruction module specifically includes: A selection unit is used to select Haar wavelet as a wavelet function; The decomposition unit is used to perform Haar wavelet three-layer decomposition on the original signal of each segment of network traffic, decompose the signal into different frequency components, and obtain the approximate coefficients and wavelet coefficients of each layer corresponding to each segment of network traffic data. The comparison unit is used to perform fixed threshold processing on the wavelet coefficients corresponding to each segment of the network traffic signal to obtain the to-be-reconstructed signal corresponding to each segment of the network traffic signal. The reconstruction unit is used to reconstruct the signals to be reconstructed and the approximate coefficients corresponding to each segment of the network traffic signal layer by layer along the direction of inverse decomposition to obtain the network traffic reconstructed signals corresponding to each segment of the network traffic signal.

9. The QUIC network abnormal behavior identification system according to claim 6, characterized in that: The system further comprises: The correction unit is used to record and analyze network log files when there is abnormal data jitter in the network traffic signal of each segment, and to correct the error threshold value.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the QUIC network abnormal behavior identification method as described in any one of claims 1 to 5.

Images