DDoS attack detection method and device based on self-supervised learning

Abstract

The application discloses a DDoS attack detection method and device based on self-supervised learning, and the method comprises the following steps: acquiring traffic feature data and preprocessing the traffic feature data; wherein the traffic feature data comprises full traffic feature data and abnormal feature data; training a preset self-supervised detection model according to the preprocessed traffic feature data; identifying to-be-detected traffic through the trained self-supervised detection model to determine the attribute of the to-be-detected traffic. The application can improve the detection efficiency of DDoS attacks.

Description

TECHNICAL FIELD

[0001] The application relates to the field of DDoS attack detection, and particularly to a DDoS attack detection method and device based on self-supervised learning. BACKGROUND

[0002] With the rapid development of the Internet and network technology, the threat of network attacks is also increasing, and distributed denial of service (DDoS) attacks have become one of the most common network attacks. DDoS attacks launch a large number of requests to target servers, networks or services through a large number of controlled computers in a distributed network, thereby exhausting the target's network resources or computing resources, so that it cannot provide normal services. At present, the mainstream DDoS attack detection methods mostly rely on network traffic feature analysis, pattern matching, rule filtering and other technologies. However, these methods often show obvious shortcomings when facing complex and dynamically changing network traffic. For example, it is very difficult to obtain a large amount of accurately labeled attack and normal traffic data, especially when new attacks appear, the labeling cost is higher. Relying on manually designed traffic features, the selection and engineering of features also require professional knowledge in the field.

[0003] Traditional rule-based detection methods rely on fixed traffic features or behavior patterns, such as source IP, port number, protocol type, etc. However, DDoS attacks are becoming more and more diverse, and attackers' attack methods are constantly updating. Especially when facing new attacks that have never appeared before, these attack traffic cannot be labeled as abnormal traffic in time, resulting in that new attacks cannot be effectively detected.

[0004] Because the network traffic pattern changes greatly over time, it is difficult for fixed detection models to cope with constantly changing attack methods. At the same time, it is impossible to learn attack detection without access to labels in existing artificial intelligence models, so how to invent a DDoS attack detection method based on self-supervised learning in an SDN environment is a problem that needs to be solved in this technical field.

[0005] In recent years, solutions applying artificial intelligence in DDoS have been proposed one after another. Zhang proposed a distributed denial of service attack (DDoS) detection method DeepDefense based on deep learning, which effectively identifies attack traffic by using a recurrent neural network (RNN) model to learn patterns in network traffic sequences. But since these network architectures are usually distributed, network devices independently manage the traffic in their respective regions without a unified global view, and attackers can bypass some monitoring nodes by distributing hidden traffic. Marcos et al. proposed a GRU deep learning system for software-defined network attacks. By analyzing single IP flow records to detect DDoS and intrusion attacks, a rapid mitigation response is achieved. But this GRU deep learning system for software-defined network attacks is strongly dependent on data quality and quantity, and its adaptability is insufficient for new attacks, which also affects the detection effect. SUMMARY

[0006] The present application provides a DDoS attack detection method and device based on self-supervised learning, which can improve the detection efficiency of DDoS attacks.

[0007] An embodiment of the present application provides a DDoS attack detection method based on self-supervised learning, comprising the following steps:

[0008] Obtaining traffic feature data and preprocessing the traffic feature data; wherein the traffic feature data includes normal feature data and abnormal feature data;

[0009] Training a preset self-supervised detection model according to the preprocessed traffic feature data;

[0010] Identifying the to-be-detected traffic through the trained self-supervised detection model to determine the attribute of the to-be-detected traffic.

[0011] Further, the obtaining of the traffic feature data specifically comprises:

[0012] The traffic feature data is collected from a preset network device, and the traffic feature data meeting a preset abnormal condition is determined as the abnormal feature data, and other data except the abnormal feature data is determined as the normal feature data; wherein the traffic feature data includes packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; and the preset abnormal condition includes that the bandwidth occupancy is higher than a preset occupancy threshold, the CPU usage rate of the SDN controller or switch increases by more than a preset increase threshold, and the link request into the SDN environment is greater than a preset request threshold.

[0013] Furthermore, the preprocessing of the traffic characteristic data specifically includes:

[0014] The traffic feature data is deduplicated for identical data packets, and the deduplicated traffic feature data is then subjected to time-series-based noise reduction.

[0015] The normal feature data after noise reduction is identified as positive samples, and the abnormal feature data after noise reduction is identified as negative samples.

[0016] Furthermore, the step of training the preset self-supervised detection model based on the preprocessed traffic feature data specifically includes:

[0017] Training samples are obtained by window sampling from the positive samples, and heterogeneous samples are obtained by window sampling from the negative samples. The training samples and heterogeneous samples are then labeled as dissimilar.

[0018] The training samples are augmented to obtain augmented samples, and the augmented samples and the training samples are labeled as similar.

[0019] The pre-defined self-supervised detection model is trained based on the training samples, the labeled heterogeneous samples, and the augmented samples to obtain the trained self-supervised detection model.

[0020] Preferably, the loss function of the preset self-supervised detection model is as follows:

[0021]

[0022] Among them, L i Z represents the loss function value, N is the number of samples, and z is the value of the loss function. i z is the low-dimensional embedding representation of the training samples. i ′ Compared to z i The low-dimensional embedding representation of the augmented sample corresponding to the training sample, z j Compared to z i The corresponding training samples are heterogeneous low-dimensional embeddings, sim() represents the cosine similarity calculation, and τ is a preset hyperparameter.

[0023] Preferably, before obtaining the trained self-supervised detection model, the method further includes:

[0024] Several samples are selected from both the positive and negative samples as fine-tuning samples, and the fine-tuning samples are labeled.

[0025] According to the labeled fine-tuning sample, the preset self-supervised detection model is fine-tuned through a preset cross-entropy loss function; wherein the preset cross-entropy loss function is specifically:

[0026]

[0027] Wherein, M is the number of the fine-tuning sample, y i is the true label of the fine-tuning sample, p i is the probability that the model predicts the flow to be abnormal.

[0028] Further, the self-supervised detection model trained determines the attribute of the to-be-detected flow, specifically including:

[0029] The to-be-detected flow is input into the trained self-supervised detection model, so that the model calculates the cosine similarity between the to-be-detected flow and the positive sample;

[0030] When the cosine similarity is greater than a preset similarity threshold, it is determined that the to-be-detected flow is normal flow, and when the cosine similarity is less than the preset similarity threshold, it is determined that the to-be-detected flow is abnormal flow.

[0031] Preferably, after determining the attribute of the to-be-detected flow, it further includes:

[0032] When it is detected that there is a continuous time flow with a duration exceeding a preset duration threshold in the to-be-detected flow, and the cosine similarity between the continuous time flow and the positive sample is less than the preset similarity threshold, it is determined that the to-be-detected flow is potential abnormal flow, and the potential abnormal flow is updated as a negative sample to update the self-supervised detection model.

[0033] Another embodiment of the application provides a DDoS attack detection device based on self-supervised learning, comprising a data acquisition module, a model training module and a flow recognition module;

[0034] The data acquisition module is used to acquire flow feature data and pre-process the flow feature data; wherein the flow feature data includes normal feature data and abnormal feature data;

[0035] The model training module is used to train a preset self-supervised detection model according to the pre-processed flow feature data;

[0036] The flow recognition module is used to recognize the to-be-detected flow through the trained self-supervised detection model, and determine the attribute of the to-be-detected flow.

[0037] Further, the data acquisition module is used to acquire flow feature data, specifically including:

[0038] The traffic feature data is collected from the preset network device, and the traffic feature data meeting the preset abnormal condition is determined as the abnormal feature data, and other data except the abnormal feature data is determined as normal feature data; wherein the traffic feature data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal condition includes: bandwidth occupancy higher than a preset occupancy threshold, CPU usage rate increase of the SDN controller or switch greater than a preset increase threshold, and link request into the SDN environment greater than a preset request threshold.

[0039] Compared with the prior art, the present application has the following advantages:

[0040] The traffic feature can be efficiently extracted under the self-supervised condition, and the training of the self-supervised detection model can be completed without relying on a large amount of labeled data. The trained self-supervised detection model has the ability of real-time detection, and the detection efficiency of DDOS attack is improved. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 A method of self-supervised learning-based DDoS attack detection process schematic diagram is provided for an embodiment of the present application.

[0042] Figure 2 A self-supervised learning-based DDoS attack detection structure schematic diagram of an apparatus is provided for another embodiment of the present application. DETAILED DESCRIPTION

[0043] The drawings are only used for illustrative description and cannot be understood as limiting the patent;

[0044] For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings can be omitted.

[0045] The technical solutions of the present application will be further described below in combination with the drawings and embodiments.

[0046] Reference Figure 1 A method of self-supervised learning-based DDoS attack detection process schematic diagram is provided for an embodiment of the present application, including the following steps:

[0047] S1: Obtain traffic feature data and preprocess the traffic feature data; wherein the traffic feature data includes normal feature data and abnormal feature data;

[0048] S2: Train a preset self-supervised detection model according to the preprocessed traffic feature data;

[0049] S3: identifying the to-be-detected traffic by the self-supervised detection model trained, and determining the attribute of the to-be-detected traffic.

[0050] For step S1, specifically, the traffic feature data is acquired, specifically including:

[0051] The traffic feature data is collected from a preset network device, and the traffic feature data meeting a preset abnormal condition is determined as the abnormal feature data, and other data except the abnormal feature data is determined as normal feature data; wherein the traffic feature data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; the preset abnormal condition includes: bandwidth occupancy higher than a preset occupancy threshold, CPU usage increase amplitude of the SDN controller or switch greater than a preset increase amplitude threshold, and link request into the SDN environment greater than a preset request threshold.

[0052] In a preferred embodiment, after the traffic feature data is collected from a preset network device such as an OpenFlow switch, in order to make the positive and negative sample difference more significant, the traffic in the normal period is taken as the normal feature data, and the traffic in the resource occupancy abnormal period is collected as the abnormal feature data. The traffic feature data collected from the SDN mainly includes: traffic data such as packet rate, byte rate, and packet size; session information data such as source IP, destination IP, destination port, and protocol type; and time characteristics such as duration and interval time of the traffic.

[0053] The network device abnormal load period data, that is, the traffic data in the abnormal period, includes: traffic data when the bandwidth occupancy is abnormally high, traffic data when the CPU usage of the SDN controller or switch increases significantly, and traffic data when a large number of link requests flow into the SDN environment.

[0054] For step S1, further, the traffic feature data is preprocessed, specifically including:

[0055] The same data packets in the traffic feature data are de-duplicated, and the de-duplicated traffic feature data is denoised based on time series;

[0056] The normal feature data after denoising is determined as a positive sample, and the abnormal feature data after denoising is determined as a negative sample.

[0057] For step S2, specifically, the preset self-supervised detection model is trained according to the preprocessed traffic feature data, specifically including:

[0058] Training samples are obtained by window sampling from the positive samples, and heterogeneous samples are obtained by window sampling from the negative samples. The training samples and heterogeneous samples are then labeled as dissimilar.

[0059] The training samples are augmented to obtain augmented samples, and the augmented samples and the training samples are labeled as similar.

[0060] The pre-defined self-supervised detection model is trained based on the training samples, the labeled heterogeneous samples, and the augmented samples to obtain the trained self-supervised detection model.

[0061] Preferably, the loss function of the preset self-supervised detection model is as follows:

[0062]

[0063] Among them, L i Z represents the loss function value, N is the number of samples, and z is the value of the loss function. i z is the low-dimensional embedding representation of the training samples. i ε Compared to z i The low-dimensional embedding representation of the augmented sample corresponding to the training sample, z j Compared to z i The corresponding training samples are heterogeneous low-dimensional embeddings, sim() represents the cosine similarity calculation, and τ is a preset hyperparameter.

[0064] In a preferred embodiment, after obtaining positive and negative samples, the training sample x is obtained by sampling from the positive samples within a time window. i Then, based on the training sample x i Augmented sample x is obtained through data augmentation methods. i ε and label x i and x i ′ They are similar.

[0065] In this preferred embodiment, data augmentation refers to making subtle changes to the traffic characteristics themselves, such as perturbing the number of packets per second or the packet size. These operations can generate different variants of positive samples, simulating the variability of network traffic in a real-world environment. Simultaneously, random masking is performed, randomly discarding certain feature values ​​within the samples to simulate packet loss or incomplete transmission.

[0066] Then, the heterosample x is obtained again from the negative sample by sampling within a time window. j and mark x i and x j They are not similar.

[0067] Finally, the preset self-supervised detection model is trained by using x i , x i , x ε and x j . Before training, x i also needs to be preprocessed. The pre-processing process specifically includes:

[0068] The long short-term memory network (LSTM) is used as an encoder model. Taking a sample x i as an example, assuming that a window time length is T, each traffic sample x i can be represented as a feature sequence:

[0069]

[0070] wherein, represents a feature vector of the t-th time step.

[0071] The feature sequence in each time step is normalized to make all feature values in the same numerical range, avoiding the influence of feature scale difference on model training. The normalized feature vector is:

[0072]

[0073] The feature vector of each time step t is input into the LSTM to update the hidden state:

[0074]

[0075] wherein, is the hidden state of the current time step t, containing the feature information of the traffic sequence to the time step t.

[0076] The high-dimensional hidden state h i is projected into a low-dimensional embedding space, and a simple fully connected layer is introduced as a projection head to map the high-dimensional hidden state generated by the LSTM to a low-dimensional representation z i required for contrastive learning, facilitating similarity calculation.

[0077] The hidden state h is mapped to the low-dimensional embedding space through the projection head:

[0078] z i =g(h i )=W h h i +b h

[0079] wherein, W h is a weight matrix of the fully connected layer, and b h is a bias term. z iis the final generated low-dimensional embedding representation.

[0080] After the pre-processing is completed, the preset self-supervised detection model is trained using the loss function:

[0081]

[0082] where N is the number of samples, z i is the low-dimensional embedding representation of the training sample, z i ′ is the enhanced sample compared to z i , z j is the abnormal sample compared to z i , sim() represents the cosine similarity calculation, and τ is a preset hyperparameter.

[0083] The specific formula of the cosine similarity calculation is:

[0084]

[0085] where ||z i || represents the Euclidean norm of the vector z i .

[0086] Preferably, before obtaining the self-supervised detection model trained, the method further comprises:

[0087] respectively selecting a plurality of samples from the positive samples and the negative samples as fine-tuning samples, and labeling the fine-tuning samples;

[0088] According to the labeled fine-tuning samples, the preset self-supervised detection model is fine-tuned through a preset cross-entropy loss function; wherein the preset cross-entropy loss function is specifically:

[0089]

[0090] where M is the number of fine-tuning samples, y i is the true label of the fine-tuning sample, p i is the probability that the model predicts the flow to be abnormal.

[0091] In one preferred embodiment, in order to improve the detection accuracy of the model, after training using the loss function of the self-supervised detection model, the flow feature vector needs to be extracted for further classification to finally fine-tune the model.

[0092] For step S3, specifically, the trained self-supervised detection model is used to identify the to-be-detected flow and determine the attribute of the to-be-detected flow, which specifically includes:

[0093] input the to-be-detected traffic into the self-supervised detection model trained to calculate the cosine similarity between the to-be-detected traffic and the positive sample;

[0094] When the cosine similarity is greater than the preset similarity threshold, the to-be-detected traffic is determined to be normal traffic, and when the cosine similarity is less than the preset similarity threshold, the to-be-detected traffic is determined to be abnormal traffic.

[0095] In a preferred embodiment, when a new traffic sample (i.e., the to-be-detected traffic) enters, the similarity value of the sample to normal traffic characteristics is calculated, and the cosine similarity is used to determine whether the traffic is normal traffic or abnormal traffic by using a preset threshold θ.

[0096] When the similarity value of the new traffic sample to normal traffic characteristics is greater than or equal to the threshold θ, it is considered to be normal traffic and no special processing is performed; otherwise, it is considered to be abnormal traffic. The specific determination formula is:

[0097]

[0098] Preferably, after determining the attribute of the to-be-detected traffic, the method further comprises:

[0099] When it is detected that there is a continuous time traffic with a duration exceeding a preset duration threshold in the to-be-detected traffic, and the cosine similarity between the continuous time traffic and the positive sample is less than the preset similarity threshold, the to-be-detected traffic is determined to be potential abnormal traffic, and the potential abnormal traffic is used as a negative sample to update the self-supervised detection model.

[0100] In a preferred embodiment, network traffic characteristics may change over time, so the detection model needs to be updated regularly. The self-supervised learning model is continuously trained using new network traffic data to ensure that the model can adapt to changing traffic patterns.

[0101] Therefore, when it is detected that there is a continuous time traffic with a duration exceeding a preset duration threshold in the to-be-detected traffic, and the cosine similarity between the continuous time traffic and the positive sample is less than the preset similarity threshold, the to-be-detected traffic is determined to be potential abnormal traffic, and the potential abnormal traffic is used as a negative sample to update the self-supervised detection model.

[0102] Reference Figure 2 A self-supervised learning-based DDoS attack detection structure diagram of an apparatus provided by another embodiment of the present application comprises a data acquisition module 101, a model training module 102, and a traffic identification module 103.

[0103] The data acquisition module 101 is configured to acquire traffic feature data and pre-process the traffic feature data; wherein the traffic feature data comprises normal feature data and abnormal feature data;

[0104] The model training module 102 is configured to train a preset self-supervised detection model according to the pre-processed traffic feature data.

[0105] The traffic recognition module 103 is configured to recognize the to-be-detected traffic by using the trained self-supervised detection model, and determine the attribute of the to-be-detected traffic.

[0106] Further, the data acquisition module 101 is configured to acquire traffic feature data, specifically comprising:

[0107] The traffic feature data is collected from a preset network device, and the traffic feature data meeting a preset abnormal condition is determined as the abnormal feature data, and other data except the abnormal feature data is determined as the normal feature data; wherein the traffic feature data comprises packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval time of the traffic; and the preset abnormal condition comprises that bandwidth occupancy is higher than a preset occupancy threshold, CPU usage rate of an SDN controller or a switch increases by more than a preset increase threshold, and link requests into an SDN environment are greater than a preset request threshold.

[0108] Obviously, the above embodiments of the present application are only examples for clearly illustrating the present application, and are not intended to limit the embodiments of the present application. For those skilled in the art, on the basis of the above description, other different forms of changes or variations can also be made. Here, all the embodiments need not and cannot be exhausted. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the claims of the present application.

Claims

1. A DDoS attack detection method based on self-supervised learning, characterized in that, Includes the following steps: Acquire traffic feature data and preprocess the traffic feature data; wherein the traffic feature data includes normal feature data and abnormal feature data, and the preprocessing process includes: The traffic feature data is deduplicated for identical data packets, and the deduplicated traffic feature data is then subjected to time-series-based noise reduction. The normal feature data after noise reduction is identified as positive samples, and the abnormal feature data after noise reduction is identified as negative samples; The pre-defined self-supervised detection model is trained based on the preprocessed traffic feature data, specifically including: Training samples are obtained by window sampling from the positive samples, and heterogeneous samples are obtained by window sampling from the negative samples. The training samples and heterogeneous samples are then labeled as dissimilar. The training samples are augmented to obtain augmented samples, and the augmented samples and the training samples are labeled as similar. Based on the training samples, the labeled heterogeneous samples, and the augmented samples, the preset self-supervised detection model is trained to obtain the trained self-supervised detection model; wherein, the loss function of the preset self-supervised detection model is specifically: in, The loss function value is N, where N is the number of samples. This is a low-dimensional embedding representation of the training samples. Compared to The augmented sample low-dimensional embedding representation corresponding to the training samples, Compared to The heterogeneous low-dimensional embedding representation corresponding to the training samples, This indicates the calculation of cosine similarity. These are preset hyperparameters; The trained self-supervised detection model is used to identify the traffic to be detected and determine the attributes of the traffic to be detected. Specifically, the traffic to be detected is input into the trained self-supervised detection model so that the model calculates the cosine similarity between the traffic to be detected and the positive sample. When the cosine similarity is greater than a preset similarity threshold, the traffic to be detected is determined to be normal traffic; when the cosine similarity is less than the preset similarity threshold, the traffic to be detected is determined to be abnormal traffic.

2. The DDoS attack detection method based on self-supervised learning as described in claim 1, characterized in that, The acquisition of traffic characteristic data specifically includes: Traffic characteristic data is collected from preset network devices, and traffic characteristic data that meets preset abnormal conditions is identified as abnormal characteristic data, while other data besides the abnormal characteristic data is identified as normal characteristic data. The traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval of the traffic. The preset abnormal conditions include: bandwidth usage exceeding a preset usage threshold, CPU utilization of the SDN controller or switch increasing more than a preset increase threshold, and the number of connection requests entering the SDN environment exceeding a preset request threshold.

3. The DDoS attack detection method based on self-supervised learning as described in claim 1, characterized in that, Before obtaining the trained self-supervised detection model, the following steps are also included: Several samples are selected from both the positive and negative samples as fine-tuning samples, and the fine-tuning samples are labeled. Based on the labeled fine-tuned samples, the preset self-supervised detection model is fine-tuned using a preset cross-entropy loss function; wherein, the preset cross-entropy loss function is specifically: Where M is the number of the fine-tuning samples. The true label of the fine-tuned sample. This determines the probability that the predicted traffic flow is abnormal.

4. The DDoS attack detection method based on self-supervised learning as described in claim 1, characterized in that, After determining the attributes of the traffic to be detected, the process also includes: When it is detected that there is a continuous time flow in the traffic to be detected that has a duration exceeding a preset duration threshold and the cosine similarity between the continuous time flow and the positive sample is less than the preset similarity threshold, the traffic to be detected is determined to be potential abnormal traffic, and the potential abnormal traffic is used as a negative sample to update the self-supervised detection model.

5. A DDoS attack detection device based on self-supervised learning, characterized in that, include: Data acquisition module, model training module, and traffic identification module; The data acquisition module is used to acquire traffic feature data and preprocess the traffic feature data; wherein, the traffic feature data includes normal feature data and abnormal feature data, and the preprocessing process includes: The traffic feature data is deduplicated for identical data packets, and the deduplicated traffic feature data is then subjected to time-series-based noise reduction. The normal feature data after noise reduction is identified as positive samples, and the abnormal feature data after noise reduction is identified as negative samples; The model training module is used to train a preset self-supervised detection model based on the preprocessed traffic feature data, specifically including: Training samples are obtained by window sampling from the positive samples, and heterogeneous samples are obtained by window sampling from the negative samples. The training samples and heterogeneous samples are then labeled as dissimilar. The training samples are augmented to obtain augmented samples, and the augmented samples and the training samples are labeled as similar. Based on the training samples, the labeled heterogeneous samples, and the augmented samples, the preset self-supervised detection model is trained to obtain the trained self-supervised detection model; wherein, the loss function of the preset self-supervised detection model is specifically: in, The loss function value is N, where N is the number of samples. This is a low-dimensional embedding representation of the training samples. Compared to The augmented sample low-dimensional embedding representation corresponding to the training samples, Compared to The heterogeneous low-dimensional embedding representation corresponding to the training samples, This indicates the calculation of cosine similarity. These are preset hyperparameters; The traffic identification module is used to identify the traffic to be detected using a trained self-supervised detection model and determine the attributes of the traffic to be detected. Specifically, it includes: inputting the traffic to be detected into the trained self-supervised detection model so that the model can calculate the cosine similarity between the traffic to be detected and the positive sample.

6. The DDoS attack detection device based on self-supervised learning as described in claim 5, characterized in that, The data acquisition module is used to acquire traffic characteristic data, specifically including: Traffic characteristic data is collected from preset network devices, and traffic characteristic data that meets preset abnormal conditions is identified as abnormal characteristic data, while other data besides the abnormal characteristic data is identified as normal characteristic data. The traffic characteristic data includes: packet rate, byte rate, packet size, source IP, destination IP, destination port, protocol type, and duration and interval of the traffic. The preset abnormal conditions include: bandwidth usage exceeding a preset usage threshold, CPU utilization of the SDN controller or switch increasing more than a preset increase threshold, and the number of connection requests entering the SDN environment exceeding a preset request threshold.

Images