Distributed anti-DDoS detection system and method, electronic equipment and storage medium
By deploying distributed DDoS detection subsystems on the user side, access side and core network side of the 5G network, working together and dynamically adjusting detection parameters, the problem that the existing technology cannot effectively detect DDoS attacks in 5G network is solved, and efficient and accurate attack detection is achieved.
Patent Information
- Application Number
- CN202411761876.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-03
- Publication Date
- 2025-03-04
AI Technical Summary
The existing DDoS detection methods cannot meet various attack detection problems in complex 5G network environments, especially in terms of data protection, security protection, operation and deployment.
Adopting a distributed detection architecture, independent but collaborative subsystems are deployed on the user side, access side and core network side respectively. Data synchronization and detection parameters are adjusted through security monitoring and early warning subsystems to achieve efficient and accurate DDoS attack detection.
Effectively detect and respond to DDoS attacks in 5G networks, improve detection rate and accuracy, and solve the problem that existing methods cannot meet the attack detection problem in complex 5G network environments.
Smart Images
Figure CN119562262A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information security technology, and in particular to a distributed anti-DDoS detection system, method, electronic device and storage medium. Background Art
[0002] With the rapid development of 5G technology, it has brought unprecedented advantages such as high bandwidth, low latency and greater connection density to the field of mobile communications. However, these new technologies are also accompanied by a series of new security threats and risks, especially in terms of data protection, security protection and operational deployment.
[0003] For example, since network slicing technology allows operators to create multiple virtualized network instances based on different service requirements, attackers can launch DDoS attacks against a slice with weaker protection, causing wider service disruptions. In addition, the ubiquitous Internet of Things, edge computing, network function virtualization, and network capability openness of 5G networks also increase the risk of DDoS attacks. Existing DDoS detection methods cannot meet the various attack detection issues in the complex 5G network environment. Summary of the invention
[0004] The purpose of the embodiments of the present application is to provide a distributed anti-DDoS detection system, method, electronic device and storage medium, which adopts a distributed detection architecture and deploys independent but collaborative subsystems on the user side, access side and core network side, respectively, to effectively detect DDoS attacks against 5G networks, solving the problem that existing methods cannot meet the various attack detection problems in complex 5G network environments.
[0005] The present application provides a distributed anti-DDoS detection system, which includes:
[0006] User-side attack detection subsystem, used to monitor traffic between user terminals, base stations, access and mobility management function network elements;
[0007] Access-side attack detection subsystem, used to monitor traffic from base stations to access and mobility management function network elements and between base stations and adjacent devices;
[0008] The core network attack detection subsystem is used to monitor the traffic between the access and mobility management function network elements in the core network and the adjacent network elements;
[0009] The security monitoring and early warning subsystem is used to establish connections with the user-side attack detection subsystem, the access-side attack detection subsystem and the core network attack detection subsystem, receive the detection results of any subsystem, and notify each subsystem to synchronize data and dynamically adjust detection parameters based on the detection results.
[0010] In the above implementation process, the DDoS detection function is decomposed into multiple independent but collaborative subsystems such as the user side, access side, and core network side. Each subsystem focuses on the security issues of a specific network area. When a subsystem detects an attack threat, it can notify other subsystems to dynamically adjust the detection parameters to achieve efficient and accurate DDoS attack detection for 5G networks, solving various attack detection problems in complex 5G network environments that existing methods cannot meet.
[0011] Furthermore, the user-side attack detection subsystem includes:
[0012] The first data collection module is used to collect messages between the user terminal and the base station and the access and mobility management function network element;
[0013] A first data processing module, used for parsing the message and converting the data format;
[0014] A first model training module, used to perform machine learning model training based on the detection results, and send the trained model to the system management module after completing the periodic training;
[0015] The first attack detection module is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information;
[0016] The first system management module is used to send the detection result to the security monitoring and early warning subsystem, and determine whether to send the detection result to the first model training module for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem.
[0017] In the above implementation process, the user-side attack detection subsystem is used to monitor the traffic from the user terminal device to the base station and to the access and mobility management function network element, focusing on the security monitoring between the terminal user device and its neighboring devices.
[0018] Furthermore, the first model training module is also used to extract characteristic values of DDOS attack traffic from the first data processing module, and perform model training using the characteristic values and attack data in the detection results.
[0019] In the above implementation process, historical data is used to train the model in order to effectively identify future DDOS attacks.
[0020] Furthermore, the first system management module is also used to synchronize the abnormal source and attack source information to the security monitoring and early warning subsystem, and adjust the sampling ratio and attack threshold based on the current attack level or when an attack occurs in other subsystems.
[0021] In the above implementation process, the data of each subsystem can be integrated and the detection parameters can be dynamically adjusted to improve the detection efficiency.
[0022] Furthermore, the access side attack detection subsystem includes:
[0023] The second data collection module is used to collect Xn interface messages, NG interface messages, N2 and N3 interface messages;
[0024] A second data processing module, used for parsing and converting the data format of the interface message;
[0025] The second model training module is used to train the machine learning model based on the detection results, and send the trained model to the system management module after completing the periodic training;
[0026] The second attack detection module is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information;
[0027] The second system management module is used to send the detection result to the security monitoring and early warning subsystem, and determine whether to send the detection result to the second model training module for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem.
[0028] In the above implementation process, the traffic from the base station to the access and mobility management function (AMF) network element and its neighbors is monitored to avoid service interruption.
[0029] Furthermore, the core network attack detection subsystem includes:
[0030] The third data collection module is used to collect N4, N7, N8, and N11 messages;
[0031] A third data processing module, used for parsing the message and converting the data format;
[0032] The third model training module is used to train the machine learning model based on the detection results, and send the trained model to the system management module after completing the periodic training;
[0033] The third attack detection module is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information;
[0034] The third system management module is used to send the detection result to the security monitoring and early warning subsystem, and determine whether to send the detection result to the third model training module for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem.
[0035] In the above implementation process, the traffic between the AFM network element and other network element devices in the core network is monitored. The core network is one of the key components in the 5G architecture. Ensuring the security of this part of the network is crucial to maintaining the stability and reliability of the entire system.
[0036] The embodiment of the present application also provides a distributed anti-DDoS detection method, which is applied to the above-mentioned distributed anti-DDoS detection system, and the method includes:
[0037] The user-side attack detection subsystem, access-side attack detection subsystem and core network attack detection subsystem are used to monitor the traffic on the user side, access side and core network side respectively;
[0038] If a subsystem on either side detects an attack threat, the detection result is sent to the security monitoring and early warning subsystem, and the security monitoring and early warning subsystem notifies other subsystems to synchronize data and dynamically adjust detection parameters based on the detection result.
[0039] In the above implementation process, the DDoS detection function is decomposed into multiple independent but collaborative subsystems such as the user side, access side, and core network side. Each subsystem focuses on the security issues of a specific network area. When a subsystem detects an attack threat, it can notify other subsystems to dynamically adjust the detection parameters to achieve efficient and accurate DDoS attack detection for 5G networks, solving various attack detection problems in complex 5G network environments that existing methods cannot meet.
[0040] The method further comprises:
[0041] Load the protection object model and attack detection model issued by the security monitoring and early warning subsystem through the first system management module, and establish a heartbeat with the security monitoring and early warning subsystem;
[0042] Collecting messages between the user terminal and the base station and the access and mobility management function network element through the first data collection module;
[0043] Parsing and converting the data format of the message by a first data processing module;
[0044] Using the first attack detection module to detect the processed data, obtain a detection result, and send the detection result to the security monitoring and early warning subsystem through the first system management module;
[0045] The first model training module is used to perform model training, and the trained model is sent to the safety monitoring and early warning subsystem.
[0046] In the above implementation process, data from different systems are integrated to form a comprehensive security view with situational awareness capabilities.
[0047] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the above-mentioned distributed anti-DDoS detection method.
[0048] The embodiment of the present application further provides a readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the above-mentioned distributed anti-DDoS detection method is executed. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0050] Figure 1 A structural block diagram of a distributed anti-DDoS detection system provided in an embodiment of the present application;
[0051] Figure 2 A flowchart of a distributed anti-DDoS detection method provided in an embodiment of the present application;
[0052] Figure 3 A specific implementation flow chart of the distributed anti-DDoS detection method provided in the embodiment of the present application;
[0053] Figure 4 A specific workflow diagram of the user-side attack detection subsystem provided in an embodiment of the present application.
[0054] icon:
[0055] 100-user-side attack detection subsystem; 101-first data acquisition module; 102-first data processing module; 103-first model training module; 104-first attack detection module; 105-first system management module; 200-access-side attack detection subsystem; 201-second data acquisition module; 202-second data processing module; 203-second model training module; 204-second attack detection module; 205-second system management module; 300-core network attack detection subsystem; 301-third data acquisition module; 302-third data processing module; 303-third model training module; 304-third attack detection module; 305-third system management module; 400-security monitoring and early warning subsystem. DETAILED DESCRIPTION
[0056] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.
[0057] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.
[0058] Example 1
[0059] Please see Figure 1 , Figure 1 A block diagram of a distributed anti-DDoS detection system provided for an embodiment of the present application. Given that the current traditional DDoS detection system cannot meet various attack detection problems in a complex 5G network environment, such as air interface DDoS and signaling storm attack detection, and cannot be applied to high-traffic and high-concurrency scenarios in a 5G network environment, the distributed anti-DDoS detection system described in this application can be used to solve the above problems.
[0060] This application deploys independent but collaborative subsystems on the user side, access side, and core network side, and each subsystem focuses on security issues in a specific network area. When any subsystem detects an attack threat, the security monitoring and early warning subsystem 400 can notify other subsystems to dynamically adjust detection parameters, such as increasing the statistical sampling ratio, adjusting the Flood attack detection threshold, synchronizing abnormal source node information, server node information, attack traffic feature model, user portrait information, etc., to improve the detection rate of the system.
[0061] The system includes:
[0062] The user-side attack detection subsystem 100 is used to monitor the traffic between the user terminal and the base station and the access and mobility management function network element (Access and Mobility Management Services, AMF, access and mobility management function network element);
[0063] The user-side attack detection subsystem 100 (UD-ADS) is used for security monitoring between end-user devices and their adjacent devices. Different end-users use different monitoring strategies to support identification of different end devices such as mobile phones, smart cars, and IoT devices. Different devices have different characteristics, so using a specific model can improve the attack detection rate.
[0064] The access side attack detection subsystem 200 is used to monitor the traffic from the base station to the access and mobility management function network element and between the base station and the adjacent equipment;
[0065] The main goal of the access-side attack detection subsystem 200 (AD-ADS) is to protect the radio access network (RAN) and edge computing platform from various DDOS security threats. Since base stations communicate directly with user devices and are key entry points in the network, they are particularly vulnerable to DDoS attacks. Usually attackers generate a large amount of useless network traffic to consume the bandwidth and processing power of the base station, resulting in service interruption.
[0066] The core network attack detection subsystem 300 is used to monitor the traffic between the access and mobility management function network elements in the core network and the adjacent network elements;
[0067] For the core network attack detection subsystem 300 (CN-ADS), the core network mainly uses signaling messages between network elements, and this subsystem can effectively detect signaling storm attacks. The core network is one of the key components in the 5G architecture, and ensuring the security of this part of the network is crucial to maintaining the stability and reliability of the entire system.
[0068] The security monitoring and early warning subsystem 400 is used to establish a connection with the user-side attack detection subsystem 100, the access-side attack detection subsystem 200 and the core network attack detection subsystem 300, receive the detection results of any subsystem, and notify each subsystem to synchronize data and dynamically adjust detection parameters based on the detection results.
[0069] Security Monitoring and Early Warning Subsystem 400 (SM-ADS), a centralized management platform, completes policy formulation and distribution tasks, and uniformly configures parameters of each subsystem, such as threshold settings, alarm levels, etc. Defines standardized API interfaces to ensure data consistency and interoperability between subsystems and with SM-ADS. Fusion of data from different subsystems to form a comprehensive security view can better identify complex attack patterns, coordinate the operation of the above systems, and provide overall situational awareness capabilities.
[0070] Each subsystem includes a data acquisition module, a data processing module, a model training module, an attack detection module and a system management module (the first data acquisition module and the second data acquisition module mentioned below are only used to distinguish the various subsystems). Among them, the data acquisition module is the front end of the DDOS detection system, responsible for capturing traffic data from various network nodes (such as user terminals, base stations, AMFs, core network elements, etc.) in real time. These data are the basis for subsequent analysis, processing and detection. This module needs to be able to collect data efficiently while ensuring the integrity and accuracy of the data. At the same time, the sampling ratio is adjustable, and it is adjusted according to the attack level in the current subsystem, or when an attack occurs in any subsystem, it will notify other subsystems to adjust the sampling ratio.
[0071] The data processing module is responsible for protocol identification, protocol parsing, format conversion and normalization of the collected raw data, and supports the processing of various protocols in the 5G mobile network. It is also used to dynamically establish flow tables, obtain information such as attack traffic characteristics, and improve the effectiveness and accuracy of subsequent analysis.
[0072] The model training module is used to train the machine learning model using historical data so that it can identify future DDOS attacks. First, it is necessary to extract the characteristic values of DDOS attack traffic from the data processing module, such as traffic pattern, packet size distribution, protocol distribution, etc., and use the extracted features and known attack data to train the model so that it can accurately identify DDOS attacks. Finally, the performance of the model is evaluated through cross-validation, confidence rate, recall rate and other indicators to ensure the effectiveness of the model.
[0073] The attack detection module is the final execution part of the DDOS detection system. It preprocesses and extracts features from the real-time collected traffic data, and then inputs it into the trained model for analysis. It determines whether a DDOS attack exists based on the output of the model, determines the type and level of the attack, and issues an alarm.
[0074] The system management module is used to handle the heartbeat between subsystems, model download and upload, detection task scheduling, and synchronous reporting of attack result information.
[0075] Specifically, the user-side attack detection subsystem 100 includes:
[0076] The first data collection module 101 is used to collect messages between the user terminal and the base station and the access and mobility management function network element;
[0077] A first data processing module 102, used for parsing the message and converting the data format;
[0078] A first model training module 103, used to perform machine learning model training based on the detection results, and send the trained model to the system management module after completing the periodic training;
[0079] The first attack detection module 104 is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information;
[0080] The first system management module 105 is used to send the detection result to the security monitoring and early warning subsystem 400, and determine whether to send the detection result to the first model training module 103 for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem 400.
[0081] The first model training module 103 is further used to extract the characteristic value of the DDOS attack traffic from the first data processing module 102, and perform model training using the characteristic value and the attack data in the detection result.
[0082] The first system management module 105 is also used to synchronize the abnormal source and attack source information to the security monitoring and early warning subsystem 400, and adjust the sampling ratio and attack threshold based on the current attack level or when an attack occurs in other subsystems.
[0083] The access side attack detection subsystem 200 includes:
[0084] The second data collection module 201 is used to collect Xn interface messages, NG interface messages, N2 and N3 interface messages;
[0085] The second data processing module 202 is used to parse and convert the data format of the interface message;
[0086] The second model training module 203 is used to perform machine learning model training based on the detection results, and send the trained model to the system management module after completing the periodic training;
[0087] The second attack detection module 204 is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information;
[0088] The second system management module 205 is used to send the detection result to the security monitoring and early warning subsystem 400, and determine whether to send the detection result to the second model training module 203 for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem 400.
[0089] The core network attack detection subsystem 300 includes:
[0090] The third data collection module 301 is used to collect N4, N7, N8, and N11 messages;
[0091] The third data processing module 302 is used to parse the message and convert the data format;
[0092] The third model training module 303 is used to perform machine learning model training based on the detection results, and send the trained model to the system management module after completing the periodic training;
[0093] The third attack detection module 304 is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information;
[0094] The third system management module 305 is used to send the detection result to the security monitoring and early warning subsystem 400, and determine whether to send the detection result to the third model training module 303 for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem 400.
[0095] This application adopts a distributed architecture that can integrate data from various subsystems to form a comprehensive security view and have the ability of situational awareness.
[0096] The detection system is optimized according to the characteristics of 5G networks, effectively detecting DDoS attacks against 5G networks, and improving the detection rate of 5G network attacks compared to traditional methods. It also supports different device types and application scenarios, and is easy to expand to adapt to new technologies and new threats that may appear in the future.
[0097] The system adopts a distributed detection architecture, deploying independent but collaborative subsystems on the user side, access side, and core network side, effectively detecting DDoS attacks against 5G networks, and solving various attack detection problems in complex 5G network environments that existing methods cannot meet.
[0098] Example 2
[0099] The embodiment of the present application provides a distributed anti-DDoS detection method, which is applied to the distributed anti-DDoS detection system described in Example 1. The system can adapt to the complexity and dynamics of the 5G network environment and realize efficient and accurate DDoS attack detection. It solves the problem of delayed DDoS attack detection in 5G networks, ensures that new attack modes can be discovered and responded to in a timely manner, and can also adapt to the unique environment and technical characteristics of 5G networks, such as network slicing, ubiquitous Internet of Things, edge computing, etc.
[0100] like Figure 2 FIG. 1 is a flow chart of a distributed anti-DDoS detection method, wherein the method comprises the following steps:
[0101] Step S100: using the user-side attack detection subsystem 100, the access-side attack detection subsystem 200 and the core network attack detection subsystem 300 to monitor the traffic on the user side, the access side and the core network side respectively;
[0102] Step S200: If a subsystem on either side detects an attack threat, the detection result is sent to the security monitoring and early warning subsystem 400. The security monitoring and early warning subsystem 400 notifies other subsystems to synchronize data and dynamically adjust detection parameters based on the detection result.
[0103] like Figure 3 As shown in FIG. 1 , it is a specific implementation flow chart of the distributed anti-DDoS detection method. During operation, the security monitoring and early warning subsystem 400 (SM-ADS) is first started, and then the system starts the (UD-ADS), (AD-ADS), and (CN-ADS) subsystems in sequence, and sends protection object model information, attack feature model, attack detection model, and network topology information model to other subsystems through the system management module. A heartbeat is established with each subsystem, and finally the security monitoring state is entered to receive the alarm information transmitted by each subsystem and respond.
[0104] like Figure 4 As shown, it is a specific working flow diagram of the user-side attack detection subsystem 100, and the method further includes:
[0105] Step S301: Load the protection object model and attack detection model issued by the security monitoring and early warning subsystem 400 through the first system management module, and establish a heartbeat with the security monitoring and early warning subsystem 400;
[0106] Step S302: Collect messages between the user terminal and the base station and the access and mobility management function network element through the first data collection module;
[0107] Step S303: parsing and converting the data format of the message by the first data processing module;
[0108] Step S304: using the first attack detection module to detect the processed data, obtaining a detection result, and sending the detection result to the security monitoring and early warning subsystem 400 through the first system management module;
[0109] Step S305: Use the first model training module to perform model training, and send the trained model to the safety monitoring and early warning subsystem 400.
[0110] After being activated, the user-side attack detection subsystem 100 (UD-ADS) will initialize local resources and create a terminal HASH table to store information such as the IMEI (International Mobile Equipment Identity) and SUPI (Subscription Permanent Identifier) of the user terminal. Start the first system management module to load the protection object model and attack detection model issued by the (SM-ADS) subsystem, and establish a heartbeat with the (SM-ADS) subsystem to indicate that the subsystem has been started normally.
[0111] Then it enters the task processing state, and executes the first data collection module to collect NAS and N1 messages between the user terminal (UE) and the base station (gNB) and AMF (network element), including registration request, service request, connection establishment and other information. The collected message data is parsed and converted into data format by the first data processing module, and the processed data is first sent to the first attack detection module for detection. The first attack detection module will output the current threat level, attack status, attack start, attack ongoing, attack end, abnormal source, attack source information, and the attack source information. The attack source information is calculated based on the source and destination IP addresses in the message, the information of the protection object, the terminal HASH table, the user portrait in the model and other information.
[0112] Finally, the detection results are sent to (SM-ADS), and the attack type and confidence rate in the detection results are used to determine whether the data needs to be sent to the first model training module for model training. After the first model training module runs a cycle, the trained detection model will be updated to the detection system and sent to (SM-ADS) through the first system management module. It is also necessary to synchronize the abnormal source and attack source information so that other subsystems can detect attacks more promptly based on this information.
[0113] After being activated, the access side attack detection subsystem 200 (AD-ADS) will initialize local resources, create a base station HASH table, start the second system management module to load the protection object model and attack detection model issued by the (SM-ADS) subsystem, and establish a heartbeat with the (SM-ADS) subsystem to indicate that the subsystem has started normally. Finally, it enters the task processing state and executes the second data collection module to collect Xn interface messages, NG interface messages, N2, N3 interface messages, including base station ID, cell ID, UE identification, traffic statistics and other information, and performs subsequent attack detection and model training tasks similar to other subsystems (such as the above-mentioned user side attack detection subsystem 100), which will not be repeated here.
[0114] After being activated, the core network attack detection subsystem 300 (CN-ADS) will initialize local resources, create a network element HASH table, start the third system management module to load the protection object model and attack detection model issued by the (SM-ADS) subsystem, and establish a heartbeat with the (SM-ADS) subsystem to indicate that the subsystem has started normally. Finally, it enters the task processing state and executes the data collection module to collect N4, N7, N8, and N11 messages, including session identifiers, network slice identifiers, control plane signaling messages, and other information, and performs subsequent attack detection and model training tasks similar to other subsystems, which will not be repeated here.
[0115] The distributed 5G network DDOS attack detection system can not only accurately identify and block known threats, but also has a strong self-evolution capability. Each attack detection subsystem is based on a hierarchical reinforcement learning algorithm, in which the detection systems collaborate with each other to strengthen their learning. Not only can different detection subsystems within the same network collaborate, but threat intelligence can also be shared with other network operators or security agencies to form a more extensive defense system that can continuously improve its ability to fight against unknown attacks over time. This provides a solid foundation for building a more intelligent, flexible and secure 5G network environment.
[0116] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.
[0117] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.
[0118] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0119] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.
[0120] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
[0121] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
Claims
1. A distributed anti-DDoS detection system, characterized in that: The system comprises: User-side attack detection subsystem, used to monitor traffic between user terminals, base stations, access and mobility management function network elements; Access-side attack detection subsystem, used to monitor traffic from base stations to access and mobility management function network elements and between base stations and adjacent devices; The core network attack detection subsystem is used to monitor the traffic between the access and mobility management function network elements in the core network and the adjacent network elements; The security monitoring and early warning subsystem is used to establish connections with the user-side attack detection subsystem, the access-side attack detection subsystem and the core network attack detection subsystem, receive the detection results of any subsystem, and notify each subsystem to synchronize data and dynamically adjust detection parameters based on the detection results.
2. The distributed anti-DDoS detection system according to claim 1, characterized in that: The user-side attack detection subsystem includes: The first data collection module is used to collect messages between the user terminal and the base station and the access and mobility management function network element; A first data processing module, used for parsing the message and converting the data format; A first model training module, used to perform machine learning model training based on the detection results, and send the trained model to the system management module after completing the periodic training; The first attack detection module is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information; The first system management module is used to send the detection result to the security monitoring and early warning subsystem, and determine whether to send the detection result to the first model training module for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem.
3. The distributed anti-DDoS detection system according to claim 2, characterized in that: The first model training module is also used to extract the characteristic value of the DDOS attack traffic from the first data processing module, and use the characteristic value and the attack data in the detection result to perform model training.
4. The distributed anti-DDoS detection system according to claim 2, characterized in that: The first system management module is also used to synchronize the abnormal source and attack source information to the security monitoring and early warning subsystem, and adjust the sampling ratio and attack threshold based on the current attack level or when an attack occurs in other subsystems.
5. The distributed anti-DDoS detection system according to claim 1, characterized in that: The access side attack detection subsystem includes: The second data collection module is used to collect Xn interface messages, NG interface messages, N2 and N3 interface messages; A second data processing module, used for parsing and converting the data format of the interface message; The second model training module is used to train the machine learning model based on the detection results, and send the trained model to the system management module after completing the periodic training; The second attack detection module is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information; The second system management module is used to send the detection result to the security monitoring and early warning subsystem, and determine whether to send the detection result to the second model training module for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem.
6. The distributed anti-DDoS detection system according to claim 1, characterized in that: The core network attack detection subsystem includes: The third data collection module is used to collect N4, N7, N8, and N11 messages; A third data processing module, used for parsing the message and converting the data format; The third model training module is used to train the machine learning model based on the detection results, and send the trained model to the system management module after completing the periodic training; The third attack detection module is used to input the processed message into the trained model for detection to obtain the detection result, which includes the threat level, attack status, attack start, attack ongoing, attack end, abnormal source, and attack source information; The third system management module is used to send the detection result to the security monitoring and early warning subsystem, and determine whether to send the detection result to the third model training module for model training based on the attack type and confidence rate in the detection result, and send the trained model to the security monitoring and early warning subsystem.
7. A distributed anti-DDoS detection method, applied to the distributed anti-DDoS detection system according to any one of claims 1 to 6, characterized in that: The method comprises: The user-side attack detection subsystem, access-side attack detection subsystem and core network attack detection subsystem are used to monitor the traffic on the user side, access side and core network side respectively; If a subsystem on either side detects an attack threat, the detection result is sent to the security monitoring and early warning subsystem, and the security monitoring and early warning subsystem notifies other subsystems to synchronize data and dynamically adjust detection parameters based on the detection result.
8. The distributed anti-DDoS detection method according to claim 7, characterized in that: The method further comprises: Load the protection object model and attack detection model issued by the security monitoring and early warning subsystem through the first system management module, and establish a heartbeat with the security monitoring and early warning subsystem; Collecting messages between the user terminal and the base station and the access and mobility management function network element through the first data collection module; Parsing and converting the data format of the message by a first data processing module; Using the first attack detection module to detect the processed data, obtain a detection result, and send the detection result to the security monitoring and early warning subsystem through the first system management module; The first model training module is used to perform model training, and the trained model is sent to the safety monitoring and early warning subsystem.
9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the distributed anti-DDoS detection method according to any one of claims 7 to 8.
10. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the distributed anti-DDoS detection method according to any one of claims 7 to 8 is executed.