Early warning method, device, equipment and medium

Abstract

The invention relates to the technical field of network security, in particular to an early warning method and device, equipment and a medium. In the embodiment of the invention, the electronic equipment method collects the traffic data and the topology connection relationship of the target network topology, optimizes the existing BC algorithm to realize the betweenness centrality evaluation calculation of the target link, analyzes the potential LFA attack threat according to the abnormal change of the betweenness centrality calculation result of the target link, and improves the safety of the target link. And the network configuration is adjusted for the confirmed LFA attack, so that the influence of hostile attacks is reduced, and the service availability of the user is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an early warning method, device, equipment and medium. Background Art

[0002] With the development of IoT technology, attacks on IoT devices are increasing. In addition to traditional Distributed Denial of Service (DDoS) attacks, new Link Flooding Attacks (LFA) are also threatening network security. Unlike traditional attack methods, LFA attacks target the bandwidth resources of the links on the backbone network. Sometimes attackers divide the zombie hosts they control into two parts, and then control the zombie hosts to communicate with each zombie host on the other side of the link and send and receive large amounts of data. In this way, a large number of network data packets will pass through the target attack link on the backbone network, causing network congestion and delays.

[0003] Since LFA targets links rather than nodes, traditional attack detection methods cannot effectively detect LFA and thus cannot ensure network security. Summary of the invention

[0004] The present application provides an early warning method, device, equipment and medium to solve the problem that the existing LFA cannot be effectively detected and thus the network security cannot be guaranteed.

[0005] In a first aspect, an embodiment of the present application provides an early warning method, the method comprising:

[0006] Obtaining the traffic proportion and network communication frequency of the target network topology in the current period; determining the traffic pressure value of each link in the current period according to the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology;

[0007] According to the flow pressure value of each link, determine the total flow pressure value corresponding to each short path in the target network topology; according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed, determine the target betweenness centrality corresponding to the target link in the current period;

[0008] If the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, an alarm message indicating that the target link is attacked is generated.

[0009] In a second aspect, an embodiment of the present application further provides an early warning device, the device comprising:

[0010] A processing module, used to obtain the flow proportion and network communication frequency of the target network topology in the current period; determine the flow pressure value of each link in the current period according to the flow proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology; determine the total flow pressure value corresponding to each short path in the target network topology according to the flow pressure value of each link; determine the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed;

[0011] The early warning module is used to generate an alarm message indicating that the target link is attacked if the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold.

[0012] In a third aspect, an embodiment of the present application further provides an electronic device, which includes at least a processor and a memory, and the processor is used to implement the steps of any of the above-mentioned early warning methods when executing a computer program stored in the memory.

[0013] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which implements the steps of any of the above-mentioned early warning methods when executed by a processor.

[0014] In an embodiment of the present application, the electronic device obtains the flow proportion and network communication frequency of the target network topology in the current cycle; according to the flow proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology, the flow pressure value of each link in the current cycle is determined; according to the flow pressure value of each link, the total flow pressure value corresponding to each short path in the target network topology is determined; according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed, the target betweenness centrality corresponding to the target link in the current cycle is determined; if the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, an alarm message that the target link is attacked is generated. In an embodiment of the present application, the electronic device method collects the flow data and topological connection relationship of the target network topology, optimizes the existing BC algorithm to realize the evaluation and calculation of the betweenness centrality of the target link, analyzes the potential LFA attack threat according to the abnormal changes in the calculation results of the betweenness centrality of the target link, adjusts the network configuration for the confirmed LFA attack to reduce the impact of the malicious attack, and ensures the service availability of the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 A typical LFA attack diagram provided for related technologies;

[0017] Figure 2 A schematic diagram of an early warning process provided in an embodiment of the present application;

[0018] Figure 3 A schematic diagram of the target network graph topology provided in an embodiment of the present application;

[0019] Figure 4 A schematic diagram of the early warning process provided by the embodiment of the present application;

[0020] Figure 5 A schematic diagram of the structure of an early warning device provided in an embodiment of the present application;

[0021] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0023] In recent years, the development of the Internet of Things has attracted attention. Currently, the number of IoT devices in the world has exceeded 20 billion and is still growing rapidly. These huge number of various devices are relatively weak in processing resources and memory resources. Due to the limitations of size, cost and other factors, manufacturers can only pay more attention to the functions that the devices themselves should have when manufacturing these devices, and cannot take into account the security of the devices. This makes it easy for hackers to use malicious programs to control these easily controlled IoT devices, use them as zombie devices to launch DDoS attacks, and then use automated scripts to launch attacks on many targets including the Internet of Things on the network. Therefore, security protection measures against DDoS attacks are imminent.

[0024] In addition to the traditional flooding DDoS, the new link flooding attack LFA is also constantly threatening network security. Unlike traditional attack methods, the target of LFA attacks is not the resources of the server as the Internet endpoint, but the bandwidth resources of the link on the backbone network. Sometimes the attacker divides the zombie host under his control into two parts, and then controls the zombie host to communicate with each zombie host on the other side of the link and send and receive a large amount of data. In this way, a large number of network data packets will pass through the target attack link on the backbone network, causing network congestion and delay. Betweenness Centrality (BC) is a traditional method in graph theory. By calculating the centrality of nodes, it can help network administrators identify key nodes. However, researchers also pointed out that the target of LFA attacks is links rather than nodes, so traditional BC cannot effectively detect LFA.

[0025] Figure 1 A typical LFA attack diagram provided for related technologies, such as this Figure 1 As shown in Figure 1, the LFA attack blocks the transmission of legitimate browsing by congesting one or more core target links, thus achieving the effect of denial of service.

[0026] Based on this, in order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, the embodiments of the present application provide an early warning method, device, equipment and medium.

[0027] In an embodiment of the present application, the traffic proportion and network communication frequency of the target network topology in the current period are obtained; the traffic pressure value of each link in the current period is determined based on the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology; the total traffic pressure value corresponding to each short path in the target network topology is determined based on the traffic pressure value of each link; the target betweenness centrality corresponding to the target link in the current period is determined based on the total traffic pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed; if the difference between the target betweenness centrality and other betweenness centralities of the previous period exceeds a preset threshold, an alarm message indicating that the target link is attacked is generated.

[0028] Figure 2 A schematic diagram of an early warning process provided in an embodiment of the present application, the process includes:

[0029] S201: Obtain the traffic proportion and network communication frequency of the target network topology in the current period; determine the traffic pressure value of each link in the current period according to the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology.

[0030] An early warning method provided in an embodiment of the present application is applied to an electronic device, which may be a PC or a server.

[0031] The embodiment of the present application proposes a method for detecting link flooding attacks based on optimized link betweenness centrality, which is used to deal with the rampant DDoS attacks in the existing Internet and the lack of effective means and theoretical guidance in detecting its new variant LFA attacks. The embodiment of the present application collects and monitors link network traffic data and topological connection relationships based on graph theory-related theoretical algorithms, optimizes the existing BC algorithm to achieve incremental updates and link betweenness centrality evaluation calculations, analyzes potential LFA attack threats based on abnormal changes in betweenness centrality calculation results, adjusts network configuration for confirmed LFA attacks to reduce the impact of malicious attacks, and ensures user service availability.

[0032] In addition, the embodiment of the present application proposes a network monitoring and dynamic graph maintenance method, which monitors the flow data of the communication link between nodes in real time, collects and calculates key topology data, and improves the real-time performance of subsequent analysis of the solution.

[0033] Specifically, the electronic device monitors the traffic in the target network topology, determines the traffic value and network communication frequency of the target network topology in the current cycle, and determines the traffic proportion of the target network topology in the current cycle based on the traffic value and the pre-saved maximum supported communication traffic bandwidth of the target network topology. Specifically, the electronic device determines the ratio of the traffic value to the maximum supported communication traffic bandwidth, and determines the ratio as the traffic proportion of the target network topology in the current cycle.

[0034] The current period refers to the period from the last detection time of the target link to the current time.

[0035] After determining the traffic proportion and the network communication frequency, the electronic device can determine the traffic pressure value of each link in the current period based on the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology, so as to determine whether it is under LFA attack based on the traffic pressure value.

[0036] S202: Determine the total flow pressure value corresponding to each short path in the target network topology according to the flow pressure value of each link; determine the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed.

[0037] In practical applications, LFA attacks mainly exhaust bandwidth by sending long data packets or high-density traffic, so the absolute value of traffic on each link needs to be periodically counted. In addition, it is necessary to use tools such as Sflow or Netflow to periodically sample data packets, monitor the network at a more fine-grained level, obtain original information about the link status, and provide a data basis for subsequent functional modules. In addition, relevant methods and mechanisms are also needed in dynamic graph maintenance. Electronic devices can construct a connection relationship matrix between nodes to abstract the network topology, and automatically update the connection relationship matrix through traffic monitoring tools or network discovery tools to maintain the latest connection relationship of the network topology.

[0038] Based on this, in the embodiment of the present application, the electronic device determines the betweenness centrality of the target link to be detected based on the traffic characteristics and the connection relationship, thereby optimizing the betweenness centrality. Among them, the traffic characteristics are the traffic pressure values ​​of each link in the current period determined by the electronic device.

[0039] Among them, betweenness centrality is one of the measures for network topology centrality based on the shortest path. It mainly reflects the ability of a node to act as a "bridge" or "intermediary" in the network topology, that is, the frequency with which it acts as the shortest path between other nodes in the network topology.

[0040] Specifically, the electronic device determines the total flow pressure value corresponding to each short path in the target network topology based on the flow pressure value of each link, and determines the target betweenness centrality corresponding to the target link of the current cycle based on the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed.

[0041] In an embodiment of the present application, when the electronic device determines the shortest path in the target network topology, the electronic device can construct a connection relationship matrix based on the nodes and links in the target network topology, and determine the shortest path according to the connection relationship matrix. In the connection relationship matrix, each row and each column corresponds to a node, and if there is a link between two nodes, the value corresponding to the intersection of the row and column where the two nodes are located is 1, and if there is no link between the two nodes, the value corresponding to the intersection of the row and column where the two nodes are located is 0.

[0042] S203: If the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, an alarm message indicating that the target link is attacked is generated.

[0043] In an embodiment of the present application, other betweenness centralities of the previous cycle are pre-stored in the electronic device, and the electronic device can determine whether the target link is attacked based on the target betweenness centrality of the current cycle and the other betweenness centralities.

[0044] Specifically, if the electronic device determines that the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, it means that the traffic of the target link in the current cycle has surged, and the electronic device determines that the target link is attacked, generates and pushes an alarm message that the target link is attacked.

[0045] In an embodiment of the present application, an electronic device method collects traffic data and topological connection relationships of the target network topology, optimizes the existing BC algorithm to implement betweenness centrality evaluation calculation for the target link, analyzes potential LFA attack threats based on abnormal changes in the betweenness centrality calculation results of the target link, adjusts the network configuration for confirmed LFA attacks to reduce the impact of malicious attacks, and ensures user service availability.

[0046] Embodiment 2:

[0047] In order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, based on the above embodiments, in the embodiment of the present application, the flow pressure value of each link in the current period is determined according to the flow proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology, including:

[0048] For each link, a first parameter value is determined according to the traffic proportion, a second parameter value is determined according to the weight value corresponding to the link, and a third parameter value is determined according to the network communication frequency; the sum of the first parameter value, the second parameter value and the third parameter value is determined as the traffic pressure value corresponding to the link.

[0049] In the embodiment of the present application, when the electronic device determines the flow pressure value corresponding to each link, the electronic device determines the first parameter according to the flow ratio, determines the second parameter value according to the weight value corresponding to the link, and determines the third parameter value according to the network communication frequency. The electronic device determines the sum of the first parameter value, the second parameter value, and the third parameter value as the flow pressure value corresponding to the link.

[0050] Specifically, the electronic device can use the following formula to determine the flow pressure value corresponding to each link:

[0051]

[0052] Where w(s,t) represents the traffic pressure value of the link connecting node s and node t, T represents the traffic value of the current cycle, and B max Indicates the maximum communication traffic bandwidth supported by the target network topology. represents the traffic proportion, F represents the network communication frequency in the current period, Essential(s,t) represents the weight value corresponding to the link, and α, β and γ are the preset normalization coefficients.

[0053] It should be noted that in the embodiment of the present application, the weight value corresponding to the link can be determined based on the function Essential that defines the criticality of the traffic service from node s to node t, which needs to be determined in advance by the administrator, and F is the network communication frequency in the current period, and its logarithm is taken to obtain a more accurate evaluation result.

[0054] Embodiment 3:

[0055] In order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, based on the above embodiments, in the embodiment of the present application, the total flow pressure value corresponding to each shortest path in the target network topology is determined according to the flow pressure value of each link, including:

[0056] For each shortest path, each candidate link included in the shortest path is determined, and the candidate flow pressure value corresponding to each candidate link is determined; and the sum of the candidate flow pressure values ​​corresponding to each candidate link is determined as the total flow pressure value of the shortest path.

[0057] In an embodiment of the present application, the electronic device may determine the sum of the flow pressure values ​​of the links included in each shortest path as the total flow pressure value of the shortest path.

[0058] Specifically, for each shortest path, the electronic device determines each candidate link included in the shortest path and determines the candidate flow pressure value corresponding to each candidate link. The electronic device determines the sum of the candidate flow pressure values ​​corresponding to each candidate link as the total flow pressure value of the shortest path.

[0059] Figure 3 A schematic diagram of the target network topology provided in the embodiment of the present application, such as the Figure 3 As shown, the target network graph topology contains six nodes, namely Node1, Node2, Node3, Node4, Node5 and Node6, among which the flow pressure value of link 1 connecting Node1 and Node2 is 1.5, the flow pressure value of link 2 connecting Node3 and Node2 is 0.8, the flow pressure value of link 3 connecting Node5 and Node2 is 2.5, the flow pressure value of link 4 connecting Node4 and Node5 is 2.0, and the flow pressure value of link 5 connecting Node5 and Node6 is 1.2.

[0060] Based on this, the electronic device can determine that the total flow pressure value of the shortest path Node1-Node2-Node5-Node6 is 5.2, and can also determine that the total flow pressure value of the shortest path Node1-Node2-Node5-Node4 is 6, and can also determine that the total flow pressure value of the shortest path Node3-Node2-Node5 is 3.3, and can also determine that the total flow pressure value of the shortest path Node1-Node2-Node5 is 4.

[0061] Embodiment 4:

[0062] In order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, based on the above embodiments, in the embodiment of the present application, the target betweenness centrality corresponding to the target link in the current period is determined according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed, including:

[0063] For every two nodes, determine each candidate shortest path corresponding to the two nodes; determine the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path; according to the number of sub-paths of each candidate shortest path and the target number of sub-paths of the candidate shortest path containing the target link; determine a first ratio of the target number of sub-paths to the number of sub-paths, and determine the product of the first ratio and the node flow pressure value, and determine the product as the sub-betweenness centrality;

[0064] The sum of each sub-betweenness centrality is determined as the target betweenness centrality.

[0065] In an embodiment of the present application, the electronic device determines the target betweenness centrality of the target link based on the total flow pressure value corresponding to each shortest path, the number of shortest paths, and the target number of shortest paths passing through the target link.

[0066] Specifically, for every two nodes in the target network topology, the electronic device determines each candidate shortest path corresponding to the two nodes; determines the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path; determines the first ratio of the target sub-number to the sub-number according to the number of sub-numbers of each candidate shortest path and the target sub-number of the candidate shortest path containing the target link, and determines the product of the first ratio and the node flow pressure value, and determines the product as the sub-betweenness centrality. The electronic device determines the sum of each sub-betweenness centrality in the target network topology as the target betweenness centrality.

[0067] Among them, the electronic device can use the following formula to determine the target betweenness centrality of the target link:

[0068]

[0069] Among them, C B (e) represents the target betweenness centrality, W(s,t) represents the node flow pressure value between node s and node t, σ st represents the number of children of each candidate shortest path between node s and node t, σ st (e) represents the number of target sub-paths in each candidate shortest path between node s and node t that contains the target link, represents the first ratio, Represents the sub-betweenness centrality.

[0070] It should be noted that in the embodiment of the present application, W(s,t) is a comprehensive evaluation of the traffic on the path from node s to node t, including but not limited to the ratio of the traffic to the maximum bandwidth of the link communication, business importance, communication frequency, etc.

[0071] In order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, based on the above embodiments, in the embodiment of the present application, the node flow pressure value between the two nodes is determined according to the total flow pressure value corresponding to each candidate shortest path, including:

[0072] Determine the average of the total flow pressure values ​​corresponding to each candidate shortest path;

[0073] The mean value is determined as the node flow pressure value between the two nodes.

[0074] In the embodiment of the present application, there may be one or more candidate shortest paths between two nodes. If there is one candidate shortest path between the two nodes, the electronic device determines the total flow pressure value corresponding to the candidate shortest path as the node flow pressure value between the two nodes. If there are multiple candidate shortest paths between the two nodes, the electronic device determines the average of the total flow pressure values ​​corresponding to each candidate shortest path, and determines the average as the node flow pressure value between the two nodes.

[0075] Embodiment 5:

[0076] In order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, based on the above embodiments, in the embodiment of the present application, if the difference between the target betweenness centrality and other betweenness centralities in the previous period does not exceed the preset threshold, the method further includes:

[0077] For every two nodes, obtain the historical sub-number of each historical shortest path of the two nodes in the target network topology of the last cycle saved, and the historical target sub-number of the historical shortest path containing the target link; determine a first ratio of the target sub-number of candidate shortest paths containing the target link corresponding to the two nodes to the sub-number of candidate shortest paths corresponding to the two nodes, and determine a second ratio of the historical target sub-number to the historical sub-number; determine the difference between the first ratio and the second ratio, and determine the product of the difference and the node flow pressure value corresponding to the two nodes as the incremental sub-betweenness centrality corresponding to the two nodes;

[0078] The sum of the incremental sub-betweenness centralities corresponding to every two sub-nodes is determined as the incremental betweenness centrality of the target link;

[0079] If the incremental betweenness centrality exceeds a preset incremental threshold, an alarm message indicating that the target link is attacked is generated.

[0080] In related applications, the target link can also be attacked by increasing the shortest path containing the target link to occupy the bandwidth of the target link. Based on this, in an embodiment of the present application, the electronic device can also provide an early warning by detecting the change of the shortest path in the target network topology.

[0081] In an embodiment of the present application, the electronic device determines the incremental sub-betweenness centrality corresponding to every two nodes based on the shortest path of the current cycle and the historical shortest path of the previous cycle, thereby determining the incremental betweenness centrality of the target link, and then determines whether the target link is attacked based on the incremental betweenness centrality and the preset incremental threshold.

[0082] Specifically, for every two nodes, the electronic device obtains the historical sub-number of each historical shortest path of the two nodes in the target network topology saved in the previous cycle, and the historical target sub-number of the historical shortest path containing the target link; determines a first ratio of the target sub-number of candidate shortest paths containing the target link corresponding to the two nodes to the sub-number of candidate shortest paths corresponding to the two nodes, and determines a second ratio of the historical target sub-number to the historical sub-number; determines the difference between the first ratio and the second ratio, and determines the product of the difference and the node flow pressure value corresponding to the two nodes as the incremental sub-betweenness centrality corresponding to the two nodes.

[0083] The electronic device determines the sum of the incremental sub-betweenness centralities corresponding to every two sub-nodes as the incremental betweenness centrality of the target link; if the incremental betweenness centrality exceeds a preset incremental threshold, the electronic device generates an alarm message that the target link is attacked.

[0084] Among them, the electronic device can determine the incremental betweenness centrality of the target link based on the following formula:

[0085]

[0086] Where, ΔC B (e) represents the incremental betweenness centrality, W(s,t) represents the node flow pressure value between node s and node t, represents the number of children of each candidate shortest path between node s and node t, represents the number of target sub-paths of each candidate shortest path between node s and node t that contains the target link, represents the number of historical sub-paths for each historical candidate shortest path between node s and node t, represents the number of historical target sub-paths of each historical candidate shortest path between node s and node t that contains the target link, represents the first ratio, represents the second ratio, represents the incremental sub-betweenness centrality.

[0087] In the embodiment of the present application, if the network topology changes, ΔC B (e) is not 0, it will affect the original C B (e) k In addition, if the network topology does not change, W(s,t) will also be affected by the real-time changes in traffic, which can reflect traffic fluctuations.

[0088] Based on the above embodiment, in the embodiment of the present application, if the flow rate does not change, the target betweenness centrality of the current cycle can also be expressed as: C B (e) k+1 =C B (e) k +ΔC B (e), where C B (e) k+1 represents the target betweenness centrality of the current cycle, C B (e) k represents the other betweenness centrality of the previous period, ΔC B (e) represents incremental betweenness centrality.

[0089] Embodiment 6:

[0090] In order to improve the efficiency and accuracy of early warning and realize early warning of FLA attacks, based on the above embodiments, in the embodiment of the present application, the method further includes:

[0091] According to the preset routing configuration information, the target link is switched to a preset standby link.

[0092] In an embodiment of the present application, after the electronic device generates an alarm message indicating that the target link is attacked, in order to ensure network security, the electronic device will switch the target link to a preset backup link according to preset routing configuration information.

[0093] In an embodiment of the present application, when the betweenness centrality of a target link changes greatly before and after a certain period of update, the electronic device determines that an abnormality has occurred in the target link. A threshold value can be introduced for the evaluation of the difference in change. During the normal network test operation, normal fluctuations and normal link switching for multiple cycles are accumulated and trained to obtain a threshold value. In this way, the importance of a link and the possibility of becoming an attack target are automatically evaluated, thereby improving the detection accuracy. Once an abnormality is detected, the electronic device generates a real-time alarm and provides detailed information about the threatened or important link, including the size of the abnormal fluctuation, the types of services that may be affected, and the specific degree of change in the traffic.

[0094] In order to deal with the detected LFA attacks, it is necessary to adjust the links accordingly based on the analysis results. On the one hand, when the main link is attacked or fails, it automatically switches to the predefined backup link. On the other hand, it is necessary to adjust the firewall policy according to the analyzed attack information to filter the attack traffic in the network. In addition, during normal operation, the module also needs to periodically allocate and check the backup links, update the firewall policy, and set the interception rules that may be needed.

[0095] In order to make the method content of this application clearer, the steps of optimizing link betweenness centrality to detect link flooding attack are described in detail. Figure 3 As an example of the target network topology and traffic pressure distribution, an implementation example is as follows:

[0096] Step 101:

[0097] Monitor the traffic situation of each link in the target network topology and obtain the connection relationship between nodes. At this time, the connection relationship matrix is:

[0098]

[0099] Step 102:

[0100] According to the maximum bandwidth of each link, the number of shortest paths between every two nodes is calculated. And the number of shortest paths passing through a certain link is calculated. The numbers shown in the figure represent the flow pressure value w(s, t) of the link between two adjacent nodes, and the total flow pressure value W(s, t) between non-connected nodes can be added up. For example, the shortest path from Node1 to Node3 is: Node1-Node2-Node3 (total flow pressure value: 2.3), and the shortest path from Node3 to Node1 is: Node3-Node2-Node1 (total flow pressure value: 2.3).

[0101] Step 103:

[0102] Substitute each w(s, t) into the optimized betweenness centrality calculation method. Taking the target link Node2-Node5 as an example, all paths to or from Node2 and Node5 will pass through this target link, including: Node1 to Node4, Node1 to Node6, Node3 to Node6, Node3 to Node4. The sum of the flow pressures of these four shortest paths is 6.0, 5.2, 5.3, and 4.5 respectively. Based on this, the target betweenness centrality of the target link can be determined:

[0103] C B (Node2-Node5)

[0104] =W(Node1,Node4)+W(Node1,Node6)+W(Node3,Node4)

[0105] +W(Node3,Node6)=21

[0106] This is a specific example of all link evaluations. In actual use, each link will be calculated periodically, except for the first calculation, the other calculations are lightweight incremental calculations performed when there are changes.

[0107] Step 104:

[0108] If the attacker launches an LFA attack on the target link Node2-Node5, the target link will undergo significant changes, such as C B (Node2-Node5) further increases, such as increasing by 10. The maximum threshold of normal fluctuation is 5, so it can be determined that an LFA attack has occurred at this time, and a real-time alarm is generated to give the specific link that has been attacked by LFA and the specific composition of the link W(s, t) at this time.

[0109] Step 105:

[0110] Select the corresponding backup disaster recovery link of the link that is attacked by LFA, and switch part of the traffic to it to guide and disperse the traffic pressure. At the same time, implement the corresponding firewall strategy and interception rules according to the information in W(s,t) and the information of periodic traffic data packet sampling.

[0111] Figure 4 A schematic diagram of the early warning process provided in the embodiment of the present application, such as the Figure 4 As shown, the process includes:

[0112] Step S401: Monitor the traffic status of each link in the network and obtain the connection relationship between nodes.

[0113] Step S404: Calculate the total number of shortest paths between every two nodes, and calculate the number of shortest paths passing through each link.

[0114] Step S403: Calculate w(s, t) of each shortest path and use it in the formula to calculate the betweenness centrality C B .

[0115] Step S404: evaluate the result and the fluctuation size, and if the result is abnormal, if no LFA attack occurs, return to step S401.

[0116] Step S405: If an LFA attack occurs, the predefined backup link is automatically switched according to the number of the attacked link, and the firewall policy is adjusted accordingly to filter the attack traffic in the network.

[0117] The embodiment of the present application proposes a method for detecting link flooding attacks based on optimized link betweenness centrality. In order to deal with the rampant DDoS attacks in the existing Internet and the lack of effective means and theoretical guidance in detecting its new variant LFA attacks, the embodiment of the present application collects and monitors link network traffic data and topological connection relationships based on graph theory-related theoretical algorithms, optimizes the existing BC algorithm to achieve incremental updates and link betweenness centrality evaluation calculations, analyzes potential LFA attack threats based on abnormal changes in betweenness centrality calculation results, adjusts network configuration for confirmed LFA attacks to reduce the impact of malicious attacks, and ensures user service availability.

[0118] The embodiment of the present application proposes a network monitoring and dynamic graph maintenance method, which monitors the traffic data of the communication links between nodes in real time, collects and calculates the key topology data, and improves the real-time performance of subsequent analysis; proposes a dynamic link betweenness centrality calculation method, which optimizes and improves the traditional node betweenness centrality calculation method, so that it can accurately evaluate the key communication links in the network, and supports incremental updates, providing data support and lightweight attributes for identifying potential attack targets; proposes a link threat degree analysis and alarm method, which automatically evaluates the importance of the link and the possibility of becoming an attack target based on the calculation results of the betweenness centrality, thereby improving the detection accuracy of the scheme; proposes a network adaptive adjustment method, which responds in a timely manner when the network is confirmed to have encountered an LFA attack, adjusts the routing configuration according to the plan prepared in advance, enables the backup communication link, and improves the integrity and robustness of the scheme.

[0119] Based on this, the embodiments of the present application can quickly and accurately detect LFA attacks in existing Internet scenarios according to the network topology and traffic characteristic status of the defender, and adjust the routing configuration according to the LFA attack, thereby reducing the effect of the LFA attack while ensuring the user's service availability.

[0120] Compared with the prior art, the embodiments of the present application have the following advantages:

[0121] 1. The embodiment of the present application provides a network monitoring and dynamic graph maintenance method, which can monitor the flow data of the communication link between nodes in real time, collect and calculate key topology data, and improve the real-time performance of subsequent analysis of the solution;

[0122] 2. The embodiment of the present application provides a dynamic link betweenness centrality calculation method, which can optimize and improve the traditional node betweenness centrality calculation method, so that it can accurately evaluate the key communication links in the network, support incremental updates, and provide data support and lightweight attributes for identifying potential attack targets;

[0123] 3. The embodiment of the present application provides a link threat analysis and alarm method, which can automatically evaluate the importance of the link and the possibility of becoming an attack target based on the calculation results of the betweenness centrality, thereby improving the detection accuracy of the solution;

[0124] 4. The embodiment of the present application provides a network adaptive adjustment method, which can respond in a timely manner when the network confirms that it has encountered an LFA attack, adjust the routing configuration according to the plan prepared in advance, enable the backup communication link, and improve the integrity and robustness of the solution.

[0125] Embodiment 7:

[0126] Based on the above embodiments, Figure 5 A schematic diagram of the structure of an early warning device provided in an embodiment of the present application, the device comprises:

[0127] Processing module 501 is used to obtain the flow proportion and network communication frequency of the target network topology in the current period; determine the flow pressure value of each link in the current period according to the flow proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology; determine the total flow pressure value corresponding to each short path in the target network topology according to the flow pressure value of each link; determine the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed;

[0128] The warning module 502 is used to generate a warning message that the target link is attacked if the difference between the target betweenness centrality and other betweenness centralities in the previous period exceeds a preset threshold.

[0129] In a possible implementation, the processing module 501 is specifically used to determine, for each link, a first parameter value according to the traffic proportion, determine a second parameter value according to a weight value corresponding to the link, and determine a third parameter value according to the network communication frequency; and determine the sum of the first parameter value, the second parameter value, and the third parameter value as the traffic pressure value corresponding to the link.

[0130] In one possible implementation, the processing module 501 is specifically used to determine, for each shortest path, each candidate link included in the shortest path, and determine a candidate flow pressure value corresponding to each candidate link; and determine the sum of the candidate flow pressure values ​​corresponding to each candidate link as the total flow pressure value of the shortest path.

[0131] In a possible implementation, the processing module 501 is specifically used to determine, for every two nodes, each candidate shortest path corresponding to the two nodes; determine the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path; determine a first ratio of the target sub-number to the sub-number, and determine the product of the first ratio and the node flow pressure value, and determine the product as the sub-betweenness centrality; and determine the sum of each sub-betweenness centrality as the target betweenness centrality.

[0132] In a possible implementation, the processing module 501 is specifically configured to determine a mean value of the total flow pressure values ​​corresponding to each candidate shortest path; and determine the mean value as the node flow pressure value between the two nodes.

[0133] In a possible implementation, the processing module 501 is also used to obtain, for each two nodes, the historical sub-number of each historical shortest path of the two nodes in the target network topology of the previous cycle saved in the target network topology of the previous cycle, and the historical target sub-number of the historical shortest path containing the target link if the difference between the target betweenness centrality and other betweenness centralities of the previous cycle does not exceed a preset threshold; determine a first ratio of the target sub-number of candidate shortest paths containing the target link corresponding to the two nodes to the sub-number of candidate shortest paths corresponding to the two nodes, and determine a second ratio of the historical target sub-number to the historical sub-number; determine the difference between the first ratio and the second ratio, and determine the product of the difference and the node flow pressure value corresponding to the two nodes as the incremental sub-betweenness centrality corresponding to the two nodes; determine the sum of the incremental sub-betweenness centralities corresponding to each two sub-nodes as the incremental betweenness centrality of the target link;

[0134] The warning module 502 is further configured to generate warning information indicating that the target link is attacked if the incremental betweenness centrality exceeds a preset incremental threshold.

[0135] In a possible implementation manner, the processing module 501 is further configured to switch the target link to a preset backup link according to preset routing configuration information.

[0136] Embodiment 8:

[0137] Based on the above embodiments, the present application also provides an electronic device, Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, it includes: a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604;

[0138] The memory 603 stores a computer program. When the program is executed by the processor 601, the processor 601 performs the following steps:

[0139] Obtaining the traffic proportion and network communication frequency of the target network topology in the current period; determining the traffic pressure value of each link in the current period according to the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology;

[0140] According to the flow pressure value of each link, determine the total flow pressure value corresponding to each short path in the target network topology; according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed, determine the target betweenness centrality corresponding to the target link in the current period;

[0141] If the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, an alarm message indicating that the target link is attacked is generated.

[0142] In a possible implementation, determining the flow pressure value of each link in the current period according to the flow proportion, the network communication frequency, and the preset weight value corresponding to each link in the target network topology includes:

[0143] For each link, a first parameter value is determined according to the traffic proportion, a second parameter value is determined according to the weight value corresponding to the link, and a third parameter value is determined according to the network communication frequency; the sum of the first parameter value, the second parameter value and the third parameter value is determined as the traffic pressure value corresponding to the link.

[0144] In a possible implementation manner, determining the total flow pressure value corresponding to each shortest path in the target network topology according to the flow pressure value of each link includes:

[0145] For each shortest path, each candidate link included in the shortest path is determined, and the candidate flow pressure value corresponding to each candidate link is determined; and the sum of the candidate flow pressure values ​​corresponding to each candidate link is determined as the total flow pressure value of the shortest path.

[0146] In a possible implementation, determining the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed includes:

[0147] For every two nodes, determine each candidate shortest path corresponding to the two nodes; determine the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path; according to the number of sub-paths of each candidate shortest path and the target number of sub-paths of the candidate shortest path containing the target link; determine a first ratio of the target number of sub-paths to the number of sub-paths, and determine the product of the first ratio and the node flow pressure value, and determine the product as the sub-betweenness centrality;

[0148] The sum of each sub-betweenness centrality is determined as the target betweenness centrality.

[0149] In a possible implementation manner, determining the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path includes:

[0150] Determine the average of the total flow pressure values ​​corresponding to each candidate shortest path;

[0151] The mean value is determined as the node flow pressure value between the two nodes.

[0152] In a possible implementation, if the difference between the target betweenness centrality and other betweenness centralities in the previous period does not exceed a preset threshold, the method further includes:

[0153] For every two nodes, obtain the historical sub-number of each historical shortest path of the two nodes in the target network topology of the last cycle saved, and the historical target sub-number of the historical shortest path containing the target link; determine a first ratio of the target sub-number of candidate shortest paths containing the target link corresponding to the two nodes to the sub-number of candidate shortest paths corresponding to the two nodes, and determine a second ratio of the historical target sub-number to the historical sub-number; determine the difference between the first ratio and the second ratio, and determine the product of the difference and the node flow pressure value corresponding to the two nodes as the incremental sub-betweenness centrality corresponding to the two nodes;

[0154] The sum of the incremental sub-betweenness centralities corresponding to every two sub-nodes is determined as the incremental betweenness centrality of the target link;

[0155] If the incremental betweenness centrality exceeds a preset incremental threshold, an alarm message indicating that the target link is attacked is generated.

[0156] In a possible implementation, the method further includes:

[0157] According to the preset routing configuration information, the target link is switched to a preset standby link.

[0158] Since the principle of solving the problem by the above electronic device is similar to that of the early warning method, the implementation of the above electronic device can refer to the embodiment of the method, and the repeated parts will not be repeated.

[0159] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 602 is used for communication between the above electronic device and other devices. The memory may include a random access memory (RAM) and may also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0160] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0161] Embodiment 9:

[0162] On the basis of the above embodiments, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0163] Obtaining the traffic proportion and network communication frequency of the target network topology in the current period; determining the traffic pressure value of each link in the current period according to the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology;

[0164] According to the flow pressure value of each link, determine the total flow pressure value corresponding to each short path in the target network topology; according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed, determine the target betweenness centrality corresponding to the target link in the current period;

[0165] If the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, an alarm message indicating that the target link is attacked is generated.

[0166] In a possible implementation, determining the flow pressure value of each link in the current period according to the flow proportion, the network communication frequency, and a preset weight value corresponding to each link in the target network topology includes:

[0167] For each link, a first parameter value is determined according to the traffic proportion, a second parameter value is determined according to the weight value corresponding to the link, and a third parameter value is determined according to the network communication frequency; the sum of the first parameter value, the second parameter value and the third parameter value is determined as the traffic pressure value corresponding to the link.

[0168] In a possible implementation manner, determining the total flow pressure value corresponding to each shortest path in the target network topology according to the flow pressure value of each link includes:

[0169] For each shortest path, each candidate link included in the shortest path is determined, and the candidate flow pressure value corresponding to each candidate link is determined; and the sum of the candidate flow pressure values ​​corresponding to each candidate link is determined as the total flow pressure value of the shortest path.

[0170] In a possible implementation, determining the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed includes:

[0171] For every two nodes, determine each candidate shortest path corresponding to the two nodes; determine the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path; according to the number of sub-paths of each candidate shortest path and the target number of sub-paths of the candidate shortest path containing the target link; determine a first ratio of the target number of sub-paths to the number of sub-paths, and determine the product of the first ratio and the node flow pressure value, and determine the product as the sub-betweenness centrality;

[0172] The sum of each sub-betweenness centrality is determined as the target betweenness centrality.

[0173] In a possible implementation manner, determining the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path includes:

[0174] Determine the average of the total flow pressure values ​​corresponding to each candidate shortest path;

[0175] The mean value is determined as the node flow pressure value between the two nodes.

[0176] In a possible implementation, if the difference between the target betweenness centrality and other betweenness centralities in the previous period does not exceed a preset threshold, the method further includes:

[0177] For every two nodes, obtain the historical sub-number of each historical shortest path of the two nodes in the target network topology of the last cycle saved, and the historical target sub-number of the historical shortest path containing the target link; determine a first ratio of the target sub-number of candidate shortest paths containing the target link corresponding to the two nodes to the sub-number of candidate shortest paths corresponding to the two nodes, and determine a second ratio of the historical target sub-number to the historical sub-number; determine the difference between the first ratio and the second ratio, and determine the product of the difference and the node flow pressure value corresponding to the two nodes as the incremental sub-betweenness centrality corresponding to the two nodes;

[0178] The sum of the incremental sub-betweenness centralities corresponding to every two sub-nodes is determined as the incremental betweenness centrality of the target link;

[0179] If the incremental betweenness centrality exceeds a preset incremental threshold, an alarm message indicating that the target link is attacked is generated.

[0180] In a possible implementation, the method further includes:

[0181] According to the preset routing configuration information, the target link is switched to a preset standby link.

[0182] Since the principle of solving the problem by the above-mentioned computer program product is similar to that of the early warning method, the implementation of the above-mentioned computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0183] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0184] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0185] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0186] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0187] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An early warning method, characterized in that: The method comprises: Obtaining the traffic proportion and network communication frequency of the target network topology in the current period; determining the traffic pressure value of each link in the current period according to the traffic proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology; According to the flow pressure value of each link, determine the total flow pressure value corresponding to each short path in the target network topology; according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed, determine the target betweenness centrality corresponding to the target link in the current period; If the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold, an alarm message indicating that the target link is attacked is generated.

2. The method according to claim 1, characterized in that Determining the flow pressure value of each link in the current period according to the flow proportion, the network communication frequency, and the preset weight value corresponding to each link in the target network topology includes: For each link, a first parameter value is determined according to the traffic proportion, a second parameter value is determined according to the weight value corresponding to the link, and a third parameter value is determined according to the network communication frequency; the sum of the first parameter value, the second parameter value and the third parameter value is determined as the traffic pressure value corresponding to the link.

3. The method according to claim 1, characterized in that: Determining the total flow pressure value corresponding to each shortest path in the target network topology according to the flow pressure value of each link includes: For each shortest path, each candidate link included in the shortest path is determined, and the candidate flow pressure value corresponding to each candidate link is determined; and the sum of the candidate flow pressure values ​​corresponding to each candidate link is determined as the total flow pressure value of the shortest path.

4. The method according to claim 1, characterized in that Determining the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed includes: For every two nodes, determine each candidate shortest path corresponding to the two nodes; determine the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path; according to the number of sub-paths of each candidate shortest path and the target number of sub-paths of the candidate shortest path containing the target link; determine a first ratio of the target number of sub-paths to the number of sub-paths, and determine the product of the first ratio and the node flow pressure value, and determine the product as the sub-betweenness centrality; The sum of each sub-betweenness centrality is determined as the target betweenness centrality.

5. The method according to claim 4, characterized in that Determining the node flow pressure value between the two nodes according to the total flow pressure value corresponding to each candidate shortest path includes: Determine the average of the total flow pressure values ​​corresponding to each candidate shortest path; The mean value is determined as the node flow pressure value between the two nodes.

6. The method according to claim 1, characterized in that If the difference between the target betweenness centrality and other betweenness centralities in the previous period does not exceed a preset threshold, the method further includes: For every two nodes, obtain the historical sub-number of each historical shortest path of the two nodes in the target network topology of the last cycle saved, and the historical target sub-number of the historical shortest path containing the target link; determine a first ratio of the target sub-number of candidate shortest paths containing the target link corresponding to the two nodes to the sub-number of candidate shortest paths corresponding to the two nodes, and determine a second ratio of the historical target sub-number to the historical sub-number; determine the difference between the first ratio and the second ratio, and determine the product of the difference and the node flow pressure value corresponding to the two nodes as the incremental sub-betweenness centrality corresponding to the two nodes; The sum of the incremental sub-betweenness centralities corresponding to every two sub-nodes is determined as the incremental betweenness centrality of the target link; If the incremental betweenness centrality exceeds a preset incremental threshold, an alarm message indicating that the target link is attacked is generated.

7. The method according to claim 1 or 6, characterized in that: The method further comprises: According to the preset routing configuration information, the target link is switched to a preset standby link.

8. An early warning device, characterized in that: The device comprises: A processing module, used to obtain the flow proportion and network communication frequency of the target network topology in the current period; determine the flow pressure value of each link in the current period according to the flow proportion, the network communication frequency and the preset weight value corresponding to each link in the target network topology; determine the total flow pressure value corresponding to each short path in the target network topology according to the flow pressure value of each link; determine the target betweenness centrality corresponding to the target link in the current period according to the total flow pressure value corresponding to each shortest path, the number of each shortest path, and the target number of shortest paths passing through the target link to be processed; The early warning module is used to generate an alarm message indicating that the target link is attacked if the difference between the target betweenness centrality and other betweenness centralities in the previous cycle exceeds a preset threshold.

9. An electronic device, characterized in that: The electronic device comprises at least a processor and a memory, and the processor is used to implement the steps of the early warning method as claimed in any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the steps of the early warning method as described in any one of claims 1 to 7.

Images