A method for detecting LDoS attack based on MF-LSTM in SDN environment

Abstract

The application discloses an MF-LSTM-based LDoS attack detection method in an SDN environment, belongs to the field of network security, and generates normal and LDoS attack flow data in the SDN environment through a D-ITG network flow generator and a Python script, utilizes a Ryu controller to perform real-time sampling, forms training and test data sets, cuts original flow data into multiple time segments, further subdivides each segment into data pieces for feature calculation, extracts 11 key features to construct a feature matrix for describing network states, trains an LSTM model using the feature matrix, adopts ReLU as an activation function, cross entropy as a loss function, and optimizes model performance, deploys the trained model in the Ryu controller, monitors network flow in real time, and performs LDoS attack detection. The application fully utilizes the centralized control advantage of the SDN and the ability of the LSTM network to process time sequence data, comprehensively analyzes multidimensional features of network flow, and realizes efficient and accurate detection of LDoS attacks.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to an LDoS attack detection method based on MF-LSTM in an SDN environment. Background Technology

[0002] Our society is currently in an era of rapid digital development, with continuous advancements in network technology and the increasing prevalence of network applications, bringing immense convenience to people's lives. At the same time, due to the inherent openness, complexity, and vulnerability of the network, it is highly susceptible to attacks. As the forms and methods of cyberattacks become increasingly diverse and complex, cybersecurity has become a focal point of social concern. Cyberattacks not only negatively impact users' daily lives but also cause significant economic losses to society.

[0003] The tight coupling between the control plane and data plane in traditional networks, embedding them within the same network device, results in a highly complex architecture that struggles to cope with dynamic changes. Software-defined networking (SDN) is a landmark technology that fundamentally revolutionizes the traditional vertical integration model. It isolates the control and data of network devices, transforming complex functions into program interfaces that can be invoked by the application layer. This significantly enhances network flexibility, creating a completely open and programmable network environment that allows users to access and manage it more easily. By virtualizing the underlying network resources, network resources can be logically integrated, enabling unified centralized management and control. SDN technology effectively improves the control efficiency of network devices, transferring control from traditional embedded control systems to a central control node. Furthermore, it leverages software-driven technologies to achieve more flexible and automated network management and service configuration.

[0004] Low-rate denial-of-service (LDoS) attacks, a new variant of DoS attacks, do not require a high-rate attack flow compared to traditional DoS attacks. The attacking end remains silent for most of the time, resulting in very low average traffic, almost indistinguishable from that of legitimate users. LDoS attacks are characterized by their strong stealth, allowing victim hosts to suffer attacks for extended periods without being detected. Their destructive power can even surpass that of flood DDoS attacks. LDoS attacks primarily target vulnerabilities in various adaptive mechanisms within the network, causing the network to constantly shift between stable and unstable states, severely degrading network performance. Therefore, they are more efficient and destructive.

[0005] Traditional LDoS attack detection technologies face several challenges, including cumbersome feature extraction processes, high computational costs, and limitations in experimental environments. These limitations restrict their effectiveness in handling the complex and ever-changing situations in today's network environments. Traditional network monitoring systems often lack real-time capabilities, failing to detect and respond to new attacks promptly, leading to frequent security incidents. Low-rate denial-of-service (LDoS) attacks, due to their high degree of stealth and difficulty in distinguishing from legitimate traffic, make it difficult for traditional network security measures to detect and respond to them in a timely manner. Existing technologies struggle to accurately represent network state, which is crucial for network security. However, current technologies fail to fully capture subtle changes in network traffic during feature extraction, resulting in a insufficient understanding of network state. This necessitates the adoption of new technologies to improve the accuracy of LDoS attack identification, simplify operational processes, and reduce training and deployment costs. Summary of the Invention

[0006] To address the aforementioned shortcomings in the existing technology, this invention provides an LDoS attack detection method based on MF-LSTM in an SDN environment.

[0007] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:

[0008] A method for detecting LDoS attacks based on MF-LSTM in an SDN environment includes the following steps:

[0009] S1. Simulate normal network traffic and LDoS attack traffic in the SDN environment, collect raw network traffic data in the SDN environment and label it to form training dataset and test dataset;

[0010] S2. Cut the original network traffic into data segments, calculate the feature matrix using the cut data segments, and use the calculated feature matrix to distinguish between normal traffic and attack traffic;

[0011] S3. Train the LSTM model using the feature matrix of the training dataset, using the feature matrix as input and the corresponding labels as the model's classification result.

[0012] S4. Verify the model's performance using the test dataset, and deploy the MF-LSTM model in the SDN controller to collect network traffic data in real time for classification and detection.

[0013] Furthermore, in S1, a D-ITG network traffic generator and a Python script are used to generate normal network traffic and LDoS attack traffic in the SDN environment, respectively. The Ryu controller samples the network traffic data in real time at equal time intervals to form training datasets and test datasets.

[0014] Furthermore, step S2 specifically includes the following steps:

[0015] S21. Divide the raw network traffic data into multiple time segments according to the set time interval;

[0016] S22. Calculate the feature matrix of the training dataset per unit time using each time segment as a detection window;

[0017] S23. Extract multiple raw network traffic data features based on the feature matrix of the training dataset to distinguish between attack traffic and normal traffic.

[0018] Furthermore, the original network traffic data features in S23 include TCP traffic, UDP traffic, TCP information entropy, and UDP information entropy, where TCP information entropy represents TCP traffic within a detection window, and UDP information entropy represents UDP traffic within a detection window.

[0019] Furthermore, the calculation method for TCP information entropy and UDP information entropy in S23 is as follows:

[0020]

[0021] In the formula, For TCP information entropy or UDP information entropy, When the extracted i-th raw network traffic data value is The probability of that time. This represents the total number of original network traffic data.

[0022] Furthermore, the specific method for distinguishing between attack traffic and normal traffic in S23 is as follows:

[0023] When an LDoS attack occurs, the covariance between TCP and UDP traffic increases;

[0024] When an LDoS attack occurs, the correlation coefficient between TCP traffic and UDP traffic decreases.

[0025] Furthermore, the covariance between the TCP traffic and UDP traffic is calculated as follows:

[0026]

[0027] In the formula, They are each other's i-th TCP or UDP traffic. , This represents the average of the corresponding TCP or UDP traffic. Data length.

[0028] Furthermore, the correlation coefficient between the TCP traffic and UDP traffic is calculated as follows:

[0029] In the formula, They are either TCP traffic or UDP traffic. This represents the average of the corresponding TCP or UDP traffic. for Standard deviation

[0030] Furthermore, in S3, when training the LSTM model using the feature matrix of the training dataset, ReLU is used instead of the traditional tanh function in the input gate and candidate memory cells of the LSTM, expressed as:

[0031]

[0032] In the formula, This is the value input to the ReLU activation function.

[0033] The present invention has the following beneficial effects:

[0034] In a Software-Defined Networking (SDN) environment, a slow denial-of-service (LDoS) attack detection method based on Multi-Feature Long Short-Term Memory (MF-LSTM) networks is implemented. By comprehensively analyzing multiple characteristics of network traffic and leveraging the deep learning capabilities of LSTM networks on time-series data, LDoS attack behaviors hidden within normal traffic can be accurately identified. This method enables real-time monitoring and rapid response to network behavior while maintaining high-precision detection performance and reducing the possibility of false positives and false negatives. Furthermore, by utilizing the centralized control advantages of SDN, this method can be flexibly deployed and updated to adapt to constantly changing network environments and attack methods. Therefore, this detection method is universally applicable for accurately detecting LDoS attacks. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the LDoS attack detection method based on MF-LSTM in an SDN environment according to the present invention.

[0036] Figure 2 This is a schematic diagram of the LDoS attack model according to an embodiment of the present invention.

[0037] Figure 3 This is a schematic diagram of the chain structure of the LSTM algorithm in an embodiment of the present invention.

[0038] Figure 4 This is the overall framework of the LDoS attack detection scheme based on MF-LSTM in the SDN environment of this invention. Detailed Implementation

[0039] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0040] A method for detecting LDoS attacks based on MF-LSTM in an SDN environment, such as Figure 1 As shown, it includes the following steps:

[0041] S1. Simulate normal network traffic and LDoS attack traffic in an SDN environment, collect raw network traffic data, and label it to form training and test datasets.

[0042] In this embodiment, as Figure 2 As shown, the LDoS attack model consists of three parameters: attack period T, attack burst length t, and attack rate R. Each attack period contains only one attack pulse, remaining silent for the rest of the time. The short duration of the LDoS attack pulse results in a very low average rate and excellent stealth. In this embodiment, a D-ITG network traffic generator and a Python script are used to generate normal network traffic and LDoS attack traffic in an SDN environment. The Ryu controller samples the network traffic data in real time at equal time intervals, and the sampled network traffic over a period of time is recorded to obtain the original traffic dataset, which serves as both the training and test datasets.

[0043] S2. Divide the raw network traffic data into multiple time segments according to the set time interval. Each time segment becomes a detection window. Use the detection window as the basic unit to form the feature matrix of the training dataset for feature calculation.

[0044] In this embodiment, the raw network traffic data of the dataset is divided into multiple time segments according to a set time interval, and each time segment becomes a detection window. Therefore, the network traffic is divided into multiple detection windows (DW), and each detection window can be further divided into several data slices (DS).

[0045] Feature calculations are performed on training and test samples. Specifically, a unit of time can be divided into several segments of appropriate length, each segment being called a data slice. Within that unit of time, the feature matrix of the network data is obtained by using the data slices as the unit of feature calculation. Based on the analysis of network traffic, multiple network traffic features are extracted to distinguish between attack traffic and normal traffic. These features include average transfer speed, coefficient of variation, average packet length, total TCP packets, total UDP packets, TCP information entropy, UDP information entropy, TCP variance, UDP variance, covariance, and correlation coefficient. Here, TCP represents TCP traffic within a detection window, and UDP represents UDP traffic within a detection window.

[0046] The above features are organized into a matrix according to time segments, with each time segment's features forming a row of the matrix, thus forming a multi-dimensional feature matrix. The detection window is set to 10 seconds, and the data slice is set to 1 second, meaning each detection window contains 10 consecutive data slices. The feature matrix will have a dimension of 10 rows and 11 columns. The feature matrix will look like this:

[0047]

[0048] Where, x i,j This represents the value of the j-th feature in the i-th data slice.

[0049] In information theory, the amount of information generated by each terminal is random. Therefore, its uncertainty can be measured using a probability distribution. Here, x i It is the extracted information sequence, P(x) i (i = 1, 2, ..., m) represents the value of the source x. i The probability of this happening. Then the formula for calculating information entropy can be expressed as:

[0050]

[0051] In statistics, covariance measures how much each dimension deviates from its mean. When an LDoS attack occurs, the covariance between TCP and UDP traffic increases, as calculated by the following formula:

[0052]

[0053] The correlation coefficient is used to study the correlation between variables. When an LDoS attack occurs, the correlation coefficient between TCP traffic and UDP traffic decreases, as shown in the formula:

[0054]

[0055] S3. Train the LSTM model using the feature matrix of the training dataset, using the feature matrix as input and the corresponding labels as the model's classification result.

[0056] For example, training using the feature matrix of the training samples... Figure 3 The LSTM model shown is input to a feature matrix, indicating whether an LDoS attack occurred (0 for normal traffic, 1 for an attack). ReLU is used instead of the traditional tanh function in the LSTM input gate and candidate memory cells, improving computational efficiency and providing better model expressiveness and generalization ability.

[0057]

[0058] In the formula, This is the value input to the ReLU activation function.

[0059] For binary classification problems, cross-entropy is used as the loss function to update the model, and the formula is expressed as follows: It represents the probability predicted by the model, typically given by the Sigmoid function of the LSTM output layer.

[0060]

[0061] S4. Verify the model's performance using the test dataset, and deploy the MF-LSTM model in the SDN controller to collect network traffic data in real time for classification and detection.

[0062] The trained LSTM model was used to validate the feature matrix of the test dataset. The detection model was then deployed in the Ryu controller. Normal traffic data and LDoS attack detection data were simulated in the SDN environment. The network traffic data was acquired in real time by the controller for classification.

[0063] Figure 4This invention presents the overall framework of an LDoS attack detection scheme based on MF-LSTM in an SDN environment, mainly comprising five steps: data collection, data fragmentation, data processing, model training, and attack detection. An SDN network centered on a Ryu controller is built in a Mininet network simulator to simulate LDoS attack traffic and normal traffic. After data collection, fragmentation, and processing, a predictive model is built using the LSTM algorithm, enabling real-time determination of whether new traffic is malicious. This invention uses a time-series approach to analyze network traffic changes. LSTM can process sequential data, learn long-term dependencies, and capture dynamic features in time series, making it suitable for network traffic analysis and helpful in identifying complex attack patterns. Furthermore, this method uses multiple features to describe the current network state, more accurately detecting LDoS attacks. This method can also be deployed in a Ryu controller to monitor network status in real time, identify hidden LDoS attacks in the network, and effectively improve network reliability.

[0064] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0065] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0066] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0067] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

[0068] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A method for detecting LDoS attacks based on MF-LSTM in an SDN environment, characterized in that, Includes the following steps: S1. Simulate normal network traffic and LDoS attack traffic in the SDN environment, collect raw network traffic data in the SDN environment and label it to form training dataset and test dataset; S2. Segment the original network traffic to obtain data fragments, calculate the feature matrix using the segmented data fragments, and use the calculated feature matrix to distinguish between normal traffic and attack traffic. This includes the following steps: S21. Divide the raw network traffic data into multiple time segments according to the set time interval; S22. Calculate the feature matrix of the training dataset per unit time using each time segment as a detection window; S23. Based on the feature matrix of the training dataset, extract multiple features from the raw network traffic data to distinguish between attack traffic and normal traffic. Specifically: The characteristics of raw network traffic data include average packet transmission speed, packet variation coefficient, average packet length, total number of TCP packets, total number of UDP packets, TCP entropy, UDP entropy, TCP variance, UDP variance, covariance, and correlation coefficient. Among them, TCP entropy represents TCP traffic within a detection window, and UDP entropy represents UDP traffic within a detection window. The calculation methods for TCP information entropy and UDP information entropy are as follows: In the formula, For TCP information entropy or UDP information entropy, When the extracted i-th raw network traffic data value is The probability of that time. This represents the total number of original network traffic data. The specific methods for distinguishing between attack traffic and normal traffic are as follows: When an LDoS attack occurs, the covariance between TCP and UDP traffic increases; When an LDoS attack occurs, the correlation coefficient between TCP traffic and UDP traffic decreases; S3. Train the LSTM model using the feature matrix of the training dataset, using the feature matrix as input and the corresponding labels as the model's classification result. S4. Verify the model's performance using the test dataset, and deploy the MF-LSTM model in the SDN controller to collect network traffic data in real time for classification and detection.

2. The LDoS attack detection method based on MF-LSTM in an SDN environment according to claim 1, characterized in that, In S1, a D-ITG network traffic generator and a Python script are used to generate normal network traffic and LDoS attack traffic in the SDN environment, respectively. The Ryu controller samples the network traffic data in real time at equal time intervals to form training datasets and test datasets.

3. The LDoS attack detection method based on MF-LSTM in an SDN environment according to claim 1, characterized in that, The covariance is calculated as follows: In the formula, They are each other's i-th TCP or UDP traffic. , This represents the average of the corresponding TCP or UDP traffic. Data length.

4. The LDoS attack detection method based on MF-LSTM in an SDN environment according to claim 1, characterized in that, The correlation coefficient between TCP traffic and UDP traffic is calculated as follows: In the formula, They are either TCP traffic or UDP traffic. This represents the average of the corresponding TCP or UDP traffic. for The standard deviation.

5. The LDoS attack detection method based on MF-LSTM in an SDN environment according to claim 1, characterized in that, When training the LSTM model using the feature matrix of the training dataset in S3, ReLU is used instead of the traditional tanh function in the input gate and candidate memory cells of the LSTM, as follows: In the formula, This is the value input to the ReLU activation function.

Images