DDoS attack detection method and device based on self-supervised learning

Abstract

The invention discloses a DDoS attack detection method and device based on self-supervised learning. The method comprises the following steps: acquiring flow characteristic data and preprocessing the flow characteristic data; wherein the traffic characteristic data comprises full traffic characteristic data and abnormal characteristic data; training a preset self-supervision detection model according to the preprocessed traffic characteristic data; and identifying the to-be-detected traffic through the trained self-supervised detection model, and determining the attribute of the to-be-detected traffic. According to the invention, the detection efficiency of the DDoS attack can be improved.

Description

Technical Field

[0001] The present invention relates to a field, and in particular to a DDoS attack detection method and device based on self-supervised learning. Background Art

[0002] With the rapid development of the Internet and network technology, the threat of network attacks is also increasing. Distributed Denial of Service (DDoS) attacks have become one of the most common network attacks. DDoS attacks initiate a large number of requests to the target server, network or service through a large number of controlled computers in a distributed network, thereby exhausting the target's network resources or computing resources and making it unable to provide services normally. At present, most mainstream DDoS attack detection methods rely on network traffic feature analysis, pattern matching, rule filtering and other technologies. However, these methods often show obvious shortcomings when facing complex and dynamically changing network traffic. For example, it is very difficult to obtain a large amount of accurately labeled attack and normal traffic data, especially when new attacks continue to emerge, the cost of labeling is higher. Relying on manually designed traffic features, feature selection and engineering also require professional knowledge.

[0003] Traditional rule-based detection methods rely on fixed traffic features or behavior patterns, such as source IP, port number, protocol type, etc. However, DDoS attacks are becoming more and more diverse, and attackers are constantly updating their attack methods. Especially when facing new types of attacks that have never appeared before, these attack traffic cannot be marked as abnormal traffic in a timely manner, resulting in the inability to effectively detect new attacks.

[0004] Since network traffic patterns vary greatly over time, fixed detection models are difficult to cope with the ever-changing attack methods. At the same time, it is impossible to learn attack detection when the existing artificial intelligence model cannot access labels. Therefore, how to invent a DDoS attack detection method in an SDN environment based on self-supervised learning is an urgent problem to be solved in this technical field.

[0005] In recent years, solutions for applying artificial intelligence to DDoS have been proposed one after another. Zhang proposed a distributed denial of service attack (DDoS) detection method based on deep learning, DeepDefense, which effectively identifies attack traffic by using a recurrent neural network (RNN) model to learn patterns in network traffic sequences. However, since these network architectures are usually distributed, network devices independently manage traffic in their respective areas and there is no unified global view. Attackers can bypass some monitoring nodes through distributed hidden traffic. Marcos et al. proposed a GRU deep learning system for software-defined network attacks. DDoS and intrusion attacks are detected by analyzing a single IP flow record, thereby achieving rapid mitigation response. However, this deep learning system for software-defined network attacks GRU has a strong dependence on data quality and quantity. At the same time, in the face of new or variant attacks, the cost of manual annotation of new attacks is high, and the model's lack of adaptability will also affect the detection effect. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, the present invention provides a DDoS attack detection method and device based on self-supervised learning, which can improve the detection efficiency of DDoS attacks.

[0007] An embodiment of the present invention provides a DDoS attack detection method based on self-supervised learning, comprising the following steps:

[0008] Acquire flow characteristic data and pre-process the flow characteristic data; wherein the flow characteristic data includes normal characteristic data and abnormal characteristic data;

[0009] The preset self-supervised detection model is trained according to the preprocessed traffic feature data;

[0010] The trained self-supervised detection model is used to identify the traffic to be detected and determine the attributes of the traffic to be detected.

[0011] Furthermore, the obtaining of traffic characteristic data specifically includes:

[0012] The traffic characteristic data is collected from a preset network device, and the traffic characteristic data that meets the preset abnormal conditions is determined as the abnormal characteristic data, and other data except the abnormal characteristic data is determined as normal characteristic data; wherein, the traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal conditions include: bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage increase of the SDN controller or switch is greater than a preset increase threshold, and the link requests pouring into the SDN environment are greater than a preset request threshold.

[0013] Furthermore, the preprocessing of the flow characteristic data specifically includes:

[0014] Deduplication is performed on completely identical data packets in the traffic characteristic data, and noise reduction is performed on the deduplication traffic characteristic data based on time series;

[0015] The normal feature data after denoising is determined as a positive sample, and the abnormal feature data after denoising is determined as a negative sample.

[0016] Furthermore, the training of the preset self-supervised detection model according to the preprocessed traffic feature data specifically includes:

[0017] Obtaining a training sample from the positive sample by window sampling, obtaining a foreign sample from the negative sample by window sampling, and marking the training sample and the foreign sample as being dissimilar;

[0018] Performing data enhancement on the training sample to obtain an enhanced sample, and marking the enhanced sample and the training sample as similar;

[0019] The preset self-supervised detection model is trained according to the training samples and the labeled outlier samples and the enhanced samples to obtain the trained self-supervised detection model.

[0020] Preferably, the loss function of the preset self-supervised detection model is specifically:

[0021]

[0022] Among them, L i is the loss function value, N is the number of samples, z i is the low-dimensional embedding representation of the training sample, z i ′ Compared to z i The enhanced sample low-dimensional embedding representation corresponding to the training sample, z j Compared to z i The low-dimensional embedding representation of the heterogeneous samples corresponding to the training samples, sim() represents the cosine similarity calculation, and τ is the preset hyperparameter.

[0023] Preferably, before obtaining the trained self-supervised detection model, the method further includes:

[0024] Selecting a number of samples from the positive samples and the negative samples as fine-tuning samples, and labeling the fine-tuning samples;

[0025] According to the annotated fine-tuning sample, the preset self-supervised detection model is fine-tuned by a preset cross entropy loss function; wherein the preset cross entropy loss function is specifically:

[0026]

[0027] Where M is the number of fine-tuning samples, y i is the true label of the fine-tuning sample, p i The probability that the model predicts that the traffic is abnormal.

[0028] Furthermore, the self-supervised detection model completed through training identifies the traffic to be detected and determines the attributes of the traffic to be detected, specifically including:

[0029] Inputting the flow to be detected into the trained self-supervised detection model so that the model calculates the cosine similarity between the flow to be detected and the positive sample;

[0030] When the cosine similarity is greater than a preset similarity threshold, the flow to be detected is determined to be normal flow, and when the cosine similarity is less than the preset similarity threshold, the flow to be detected is determined to be abnormal flow.

[0031] Preferably, after determining the attribute of the traffic to be detected, the method further includes:

[0032] When it is detected that there is a continuous time flow in the flow to be detected whose duration exceeds a preset duration threshold and the cosine similarity between the continuous time flow and the positive sample is less than the preset similarity threshold, the flow to be detected is determined to be potential abnormal flow, and the potential abnormal flow is used as a negative sample to update the self-supervised detection model.

[0033] Another embodiment of the present invention provides a DDoS attack detection device based on self-supervised learning, comprising: a data acquisition module, a model training module and a traffic identification module;

[0034] The data acquisition module is used to acquire flow characteristic data and pre-process the flow characteristic data; wherein the flow characteristic data includes normal characteristic data and abnormal characteristic data;

[0035] The model training module is used to train the preset self-supervised detection model according to the preprocessed traffic characteristic data;

[0036] The traffic identification module is used to identify the traffic to be detected through a trained self-supervised detection model and determine the attributes of the traffic to be detected.

[0037] Furthermore, the data acquisition module is used to acquire traffic characteristic data, specifically including:

[0038] The traffic characteristic data is collected from a preset network device, and the traffic characteristic data that meets the preset abnormal conditions is determined as the abnormal characteristic data, and other data except the abnormal characteristic data is determined as normal characteristic data; wherein, the traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal conditions include: bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage increase of the SDN controller or switch is greater than a preset increase threshold, and the link requests pouring into the SDN environment are greater than a preset request threshold.

[0039] Compared with the prior art, the beneficial effects of the present invention are:

[0040] It can efficiently extract traffic features under self-supervision conditions and complete the training of the self-supervision detection model without relying on a large amount of labeled data. The trained self-supervision detection model has the ability to detect in real time, which improves the detection efficiency of DDOS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of a DDoS attack detection process based on self-supervised learning according to a method provided in one embodiment of the present invention.

[0042] Figure 2 A schematic diagram of the structure of a DDoS attack detection device based on self-supervised learning provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0043] The drawings are for illustrative purposes only and should not be construed as limiting the present patent;

[0044] It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0045] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0046] Reference Figure 1 , is a schematic diagram of a DDoS attack detection process based on self-supervised learning according to an embodiment of the present invention, comprising the following steps:

[0047] S1: Acquire flow characteristic data and preprocess the flow characteristic data; wherein the flow characteristic data includes normal characteristic data and abnormal characteristic data;

[0048] S2: training the preset self-supervised detection model based on the preprocessed traffic feature data;

[0049] S3: Identify the traffic to be detected through the trained self-supervised detection model, and determine the attributes of the traffic to be detected.

[0050] For step S1, specifically, obtaining flow characteristic data specifically includes:

[0051] The traffic characteristic data is collected from a preset network device, and the traffic characteristic data that meets the preset abnormal conditions is determined as the abnormal characteristic data, and other data except the abnormal characteristic data is determined as normal characteristic data; wherein, the traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal conditions include: bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage increase of the SDN controller or switch is greater than a preset increase threshold, and the link requests pouring into the SDN environment are greater than a preset request threshold.

[0052] In a preferred embodiment, after the flow characteristic data is collected from the preset network devices such as OpenFlow switches, in order to make the difference between positive and negative samples more significant, the flow in the normal period is used as the normal characteristic data, and the flow in the abnormal resource occupancy period is collected as the abnormal characteristic data. The flow characteristic data collected from SDN mainly includes: flow data, such as the packet rate, byte rate, and packet size of the flow; session information data, such as source IP, destination IP, destination port, and protocol type; time characteristics, such as the duration and interval time of the flow.

[0053] Data on periods of abnormal network device load, that is, traffic data during abnormal periods, including: traffic data when bandwidth usage is abnormally high, traffic data when the CPU usage of the SDN controller or switch increases significantly, and traffic data when a large number of link requests flow into the SDN environment.

[0054] For step S1, further, the preprocessing of the flow characteristic data specifically includes:

[0055] Deduplication is performed on completely identical data packets in the traffic characteristic data, and noise reduction is performed on the deduplication traffic characteristic data based on time series;

[0056] The normal feature data after denoising is determined as a positive sample, and the abnormal feature data after denoising is determined as a negative sample.

[0057] For step S2, specifically, the training of the preset self-supervised detection model according to the preprocessed traffic feature data specifically includes:

[0058] Obtaining a training sample from the positive sample by window sampling, obtaining a foreign sample from the negative sample by window sampling, and marking the training sample and the foreign sample as being dissimilar;

[0059] Performing data enhancement on the training sample to obtain an enhanced sample, and marking the enhanced sample and the training sample as similar;

[0060] The preset self-supervised detection model is trained according to the training samples and the labeled outlier samples and the enhanced samples to obtain the trained self-supervised detection model.

[0061] Preferably, the loss function of the preset self-supervised detection model is specifically:

[0062]

[0063] Among them, L i is the loss function value, N is the number of samples, z i is the low-dimensional embedding representation of the training sample, z i ε Compared to z i The enhanced sample low-dimensional embedding representation corresponding to the training sample, z j Compared to z i The low-dimensional embedding representation of the heterogeneous samples corresponding to the training samples, sim() represents the cosine similarity calculation, and τ is the preset hyperparameter.

[0064] In a preferred embodiment, after obtaining the positive sample and the negative sample, the training sample x is obtained from the positive sample by sampling in the time window. i , and then according to the training sample x i The enhanced sample x is obtained by data enhancement method i ε , and mark x i and x i ′ To be similar.

[0065] In this preferred embodiment, data enhancement refers to making subtle changes to the traffic features themselves, such as perturbing the number of packets per second and packet size of the traffic. Through these operations, different variants of positive samples can be generated to simulate the variability of network traffic in the actual environment. At the same time, random masking is performed to randomly discard certain feature values ​​in the sample to simulate traffic packet loss or incomplete transmission.

[0066] Then, the outlier sample x is obtained from the negative sample by sampling again in the time window j , and mark x i and x j To be dissimilar.

[0067] Finally, using x i 、x i ε and x j , train the preset self-supervised detection model. Before training, it is also necessary to i Perform preprocessing. The preprocessing process specifically includes:

[0068] Use the long short-term memory network LSTM as the encoder model, taking sample x i For example, assuming that a window time length is T, then each flow sample x i It can be represented as a feature sequence:

[0069]

[0070] in, Represents the feature vector at the t-th time step.

[0071] Normalize the feature sequence in each time step so that all feature values ​​are in the same numerical range to avoid the influence of feature scale differences on model training. The normalized feature vector is:

[0072]

[0073] Input the feature vector of each time step t into the LSTM and update the hidden state:

[0074]

[0075] in, It is the hidden state of the current time step t, which contains the characteristic information of the traffic sequence up to time step t.

[0076] The high-dimensional hidden state h i Projecting to a low-dimensional embedding space, a simple fully connected layer is introduced as a projection head to map the high-dimensional hidden state generated by LSTM to the low-dimensional representation z required for contrastive learning. i , which is convenient for similarity calculation.

[0077] The hidden state h is mapped to a low-dimensional embedding space through a projection head:

[0078] z i =g(h i )=W h h i +b h

[0079] Among them, W h is the weight matrix of the fully connected layer, b h is the bias term. iis the final generated low-dimensional embedding representation.

[0080] After the preprocessing is completed, the preset self-supervised detection model is trained using the loss function:

[0081]

[0082] Where N is the number of samples, z i is the low-dimensional embedding representation of the training sample, z i ′ Compared to z i The enhanced sample, z j Compared to z i , sim() represents the cosine similarity calculation, and τ is the preset hyperparameter.

[0083] The specific formula for calculating cosine similarity is:

[0084]

[0085] Among them, ||z i || represents vector z i The Euclidean norm of .

[0086] Preferably, before obtaining the trained self-supervised detection model, the method further includes:

[0087] Selecting a number of samples from the positive samples and the negative samples as fine-tuning samples, and labeling the fine-tuning samples;

[0088] According to the annotated fine-tuning sample, the preset self-supervised detection model is fine-tuned by a preset cross entropy loss function; wherein the preset cross entropy loss function is specifically:

[0089]

[0090] Where M is the number of fine-tuning samples, y i is the true label of the fine-tuning sample, p i The probability that the model predicts that the traffic is abnormal.

[0091] In a preferred embodiment, in order to improve the detection accuracy of the model, after training with the loss function of the self-supervised detection model, it is also necessary to extract the traffic feature vector for further classification to perform final fine-tuning on the model.

[0092] For step S3, specifically, the self-supervised detection model completed through training identifies the traffic to be detected and determines the attributes of the traffic to be detected, specifically including:

[0093] Inputting the flow to be detected into the trained self-supervised detection model so that the model calculates the cosine similarity between the flow to be detected and the positive sample;

[0094] When the cosine similarity is greater than a preset similarity threshold, the flow to be detected is determined to be normal flow, and when the cosine similarity is less than the preset similarity threshold, the flow to be detected is determined to be abnormal flow.

[0095] In a preferred embodiment, when a new traffic sample (ie, the traffic to be detected) enters, the similarity value between the sample and the normal traffic characteristics is calculated, and the cosine similarity and a pre-set threshold θ are used to determine whether the traffic is normal or abnormal.

[0096] When the similarity between the new traffic sample and the normal traffic feature is greater than or equal to the threshold θ, it is considered normal traffic and no special processing is performed; otherwise, the traffic is considered abnormal traffic. The specific judgment formula is:

[0097]

[0098] Preferably, after determining the attribute of the traffic to be detected, the method further includes:

[0099] When it is detected that there is a continuous time flow in the flow to be detected whose duration exceeds a preset duration threshold and the cosine similarity between the continuous time flow and the positive sample is less than the preset similarity threshold, the flow to be detected is determined to be potential abnormal flow, and the potential abnormal flow is used as a negative sample to update the self-supervised detection model.

[0100] In a preferred embodiment, network traffic characteristics may change over time, so the detection model needs to be updated regularly. The self-supervised learning model is continuously trained using new network traffic data to ensure that the model can adapt to the changing traffic patterns.

[0101] Therefore, when it is detected that there is a continuous time flow in the traffic to be detected whose duration exceeds the preset duration threshold and the cosine similarity between the continuous time flow and the positive sample is less than the preset similarity threshold, the traffic to be detected is determined to be potential abnormal traffic, and the potential abnormal traffic is used as a negative sample to update the self-supervised detection model.

[0102] Reference Figure 2 , is a schematic diagram of a DDoS attack detection structure based on self-supervised learning provided by another embodiment of the present invention, comprising: a data acquisition module 101, a model training module 102 and a traffic identification module 103;

[0103] The data acquisition module 101 is used to acquire flow characteristic data and pre-process the flow characteristic data; wherein the flow characteristic data includes normal characteristic data and abnormal characteristic data;

[0104] The model training module 102 is used to train the preset self-supervised detection model according to the preprocessed traffic characteristic data;

[0105] The traffic identification module 103 is used to identify the traffic to be detected by using a trained self-supervised detection model, and determine the attributes of the traffic to be detected.

[0106] Furthermore, the data acquisition module 101 is used to acquire traffic characteristic data, specifically including:

[0107] The traffic characteristic data is collected from a preset network device, and the traffic characteristic data that meets the preset abnormal conditions is determined as the abnormal characteristic data, and other data except the abnormal characteristic data is determined as normal characteristic data; wherein, the traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal conditions include: bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage increase of the SDN controller or switch is greater than a preset increase threshold, and the link requests pouring into the SDN environment are greater than a preset request threshold.

[0108] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A DDoS attack detection method based on self-supervised learning, characterized in that: The steps include: Acquire flow characteristic data and pre-process the flow characteristic data; wherein the flow characteristic data includes normal characteristic data and abnormal characteristic data; The preset self-supervised detection model is trained according to the preprocessed traffic feature data; The trained self-supervised detection model is used to identify the traffic to be detected and determine the attributes of the traffic to be detected.

2. The DDoS attack detection method based on self-supervised learning as claimed in claim 1, characterized in that: The obtaining of traffic characteristic data specifically includes: The traffic characteristic data is collected from a preset network device, and the traffic characteristic data that meets the preset abnormal conditions is determined as the abnormal characteristic data, and other data except the abnormal characteristic data is determined as normal characteristic data; wherein, the traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal conditions include: bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage increase of the SDN controller or switch is greater than a preset increase threshold, and the link requests pouring into the SDN environment are greater than a preset request threshold.

3. The DDoS attack detection method based on self-supervised learning as claimed in claim 1, characterized in that: The preprocessing of the flow characteristic data specifically includes: Deduplication is performed on completely identical data packets in the traffic characteristic data, and noise reduction is performed on the deduplication traffic characteristic data based on time series; The normal feature data after denoising is determined as a positive sample, and the abnormal feature data after denoising is determined as a negative sample.

4. The DDoS attack detection method based on self-supervised learning as claimed in claim 3, characterized in that: The training of the preset self-supervised detection model according to the pre-processed traffic feature data specifically includes: Obtaining a training sample from the positive sample by window sampling, obtaining a foreign sample from the negative sample by window sampling, and marking the training sample and the foreign sample as being dissimilar; Performing data enhancement on the training sample to obtain an enhanced sample, and marking the enhanced sample and the training sample as similar; The preset self-supervised detection model is trained according to the training samples and the labeled outlier samples and the enhanced samples to obtain the trained self-supervised detection model.

5. The DDoS attack detection method based on self-supervised learning as claimed in claim 4, characterized in that: The loss function of the preset self-supervised detection model is specifically: Among them, L i is the loss function value, N is the number of samples, z i is the low-dimensional embedding representation of the training sample, z i ′ Compared to z i The enhanced sample low-dimensional embedding representation corresponding to the training sample, z j Compared to z i The low-dimensional embedding representation of the heterogeneous samples corresponding to the training samples, sim() represents the cosine similarity calculation, and τ is the preset hyperparameter.

6. The DDoS attack detection method based on self-supervised learning as claimed in claim 4, characterized in that: Before obtaining the trained self-supervised detection model, the following steps are also included: Selecting a number of samples from the positive samples and the negative samples as fine-tuning samples, and labeling the fine-tuning samples; According to the annotated fine-tuning sample, the preset self-supervised detection model is fine-tuned by a preset cross entropy loss function; wherein the preset cross entropy loss function is specifically: Where M is the number of fine-tuning samples, y i is the true label of the fine-tuning sample, p i The probability that the model predicts that the traffic is abnormal.

7. The DDoS attack detection method based on self-supervised learning as claimed in claim 3, characterized in that: The self-supervised detection model completed through training identifies the traffic to be detected and determines the attributes of the traffic to be detected, specifically including: Inputting the flow to be detected into the trained self-supervised detection model so that the model calculates the cosine similarity between the flow to be detected and the positive sample; When the cosine similarity is greater than a preset similarity threshold, the flow to be detected is determined to be normal flow, and when the cosine similarity is less than the preset similarity threshold, the flow to be detected is determined to be abnormal flow.

8. The DDoS attack detection method based on self-supervised learning as claimed in claim 7, characterized in that: After determining the attribute of the traffic to be detected, the method further includes: When it is detected that there is a continuous time flow in the flow to be detected whose duration exceeds a preset duration threshold and the cosine similarity between the continuous time flow and the positive sample is less than the preset similarity threshold, the flow to be detected is determined to be potential abnormal flow, and the potential abnormal flow is used as a negative sample to update the self-supervised detection model.

9. A DDoS attack detection device based on self-supervised learning, characterized in that: include: Data acquisition module, model training module and traffic identification module; The data acquisition module is used to acquire flow characteristic data and pre-process the flow characteristic data; wherein the flow characteristic data includes normal characteristic data and abnormal characteristic data; The model training module is used to train the preset self-supervised detection model according to the preprocessed traffic characteristic data; The traffic identification module is used to identify the traffic to be detected through a trained self-supervised detection model and determine the attributes of the traffic to be detected.

10. The DDoS attack detection device based on self-supervised learning according to claim 8, characterized in that: The data acquisition module is used to acquire traffic characteristic data, specifically including: The traffic characteristic data is collected from a preset network device, and the traffic characteristic data that meets the preset abnormal conditions is determined as the abnormal characteristic data, and other data except the abnormal characteristic data is determined as normal characteristic data; wherein, the traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal conditions include: bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage increase of the SDN controller or switch is greater than a preset increase threshold, and the link requests pouring into the SDN environment are greater than a preset request threshold.

Images