DDoS attack identification method oriented to cloud edge-end collaborative environment

Abstract

The invention provides a DDoS (Distributed Denial of Service) attack identification method oriented to a cloud edge-end collaborative environment. Important features in a message are found and extracted by using information entropy calculation and a random forest method, the features are further input into a CNN network to be trained and classified, then the DQN network is deployed in a cloud edge environment, the CNN model is used to correct and iteratively update the DQN network, DDoS attack detection and defense are realized, and the DDoS attack detection and defense efficiency is improved. And a new thought is provided for constructing a cloud-side environment capable of relieving DDoS attacks.

Description

Technical field:

[0001] The present invention relates to a DDoS attack identification method for a cloud-edge collaborative environment. Specifically, this is a method that can detect and identify DDoS attacks in a cloud-edge environment, and has a good detection rate and self-learning ability. Background technology:

[0002] With the rapid development of network technology and computing facilities, cloud computing and edge computing have become indispensable new infrastructures for providing efficient and stable computing services. In addition, the iteration and advancement of smart devices have enabled more mobile devices or earlier independent terminal devices to join the Internet system, promoting the digital transformation of traditional industries.

[0003] Unlike general distributed systems, cloud-edge environments involve a wider range of network connection forms and architectural designs. As the current mainstream computing infrastructure for commercial use, cloud computing carries the storage and computing tasks of major Internet applications: enterprises can place some of their large but non-core data on cloud servers to reduce the cost of building their own clusters; the enterprise's customers (or users) remotely access services deployed on cloud nodes to obtain online products provided by the enterprise, etc. Although cloud computing has brought more convenient services to enterprises and users, it still has some limitations and cannot fully support the various needs of users. For example, cloud centers are usually geographically far away from users, and the physical distance causes high communication delays and overhead. Under such conditions, time-sensitive applications face great challenges. Edge computing came into being, which is geographically closer to users, has faster feedback speed, and is more compact, flexible, and easy to deploy. For general distributed clusters, the internal connection is through local Ethernet, and the external connection is through wide area network; for cloud-edge environments, the cloud and edge may rely on local area or wide area network connection, and the user and edge may be connected through WiFi, 4G, 5G, etc. In addition, the architectures of the cloud and edge are not exactly the same. In the cloud center, the configurations of servers are generally similar and more symmetrical; the differences between edge nodes may be greater. Some nodes are servers themselves and may have the storage and computing capabilities of a single server in the cloud center, while other nodes may only be workstations or desktops with weaker capabilities.

[0004] In the current cloud-edge environment, the cloud and edge face network threats at different levels. In cloud clusters, DDoS (distributed denial of service) attacks from traditional networks continue to pose a threat, and the cloud also faces unique DDoS attack threats. For edge clusters, the overall small scale means that they cannot have the strong defense capabilities of cloud centers, and can only deploy simpler defense measures; and due to the multi-accessibility of users and user mobility in some scenarios, edge nodes are more vulnerable to attacks mixed in with ordinary users. DDoS attacks are ubiquitous, and all types of online services around the world have been attacked at different levels and sources.

[0005] The following is an introduction to the current situation. At present, the detection methods of DDoS attacks often adopt strategies based on statistics. Specifically, statistical methods can establish a traffic matrix based on the characteristics of network traffic, such as bandwidth usage, source (i.e., source address of traffic packets), protocol type, etc., so as to establish a detection model; or, a traffic correlation coefficient can be established, or normal access and attack information can be distinguished by data volume and information distance. Common statistical methods include Markov and Bayes methods. In addition, in addition to general statistical methods, there are some methods that use machine learning to achieve traffic identification and classification. As a technology that can process multi-dimensional information, machine learning is widely used in image recognition, natural language processing and other fields, and gradually penetrates into computer systems to support system optimization. At present, machine learning methods mostly use basic machine learning and neural networks such as random forest (RF) and support vector machine (SVM) to identify DDoS attacks. For example, some studies use DNN (deep network), CNN (convolutional neural network), LSTM (long short-term memory network), etc., or further combine these networks to achieve the purpose of detection and identification.

[0006] Through comprehensive observation, the inventor believes that although the above strategies have their own advantages in identifying DDoS attacks, they have certain shortcomings. For statistical methods, if the features are insufficient or inaccurate, the detection effect may be seriously affected; for machine learning methods, there may also be problems of overfitting and too long training time.

[0007] The inventor found through research that reinforcement learning has strong optimization decision-making and autonomous exploration capabilities, and can perform autonomous mining and tuning according to the input data set. Therefore, the inventor introduced the reinforcement learning method and added the analysis of DDoS attack traffic. In summary, the present invention first uses basic machine learning methods to classify DDoS attacks, and then deploys and feedbacks based on the reinforcement learning method, further optimizes the results obtained by machine learning, and improves the detection effect of DDoS attacks. Summary of the invention:

[0008] In view of the need to detect and resist DDoS attacks in the cloud-edge environment, the present invention proposes a DDoS attack identification method for the cloud-edge collaborative environment. By using traditional statistical methods to preliminarily divide the network traffic, a set of traffic with different danger levels is formed, and then the traffic characteristics are further captured using the reinforcement learning method to achieve a relatively fast and effective distinction between DDoS attack traffic and normal traffic. The present invention mainly consists of the following steps:

[0009] Step 1: Data preprocessing module. Including:

[0010] Step 1.1, message information extraction. This step mainly realizes the extraction of message information. In the TCP / IP protocol, data will be split into messages by the protocol and transmitted in the network. The message has header information, which covers the starting point (sending address), end point (receiving address), port number, timestamp, message checksum, message type, message length, etc.

[0011] The message information extraction step extracts the above message header information from the message according to the protocol format, and classifies the information and stores it in a file with a format that can be directly recognized and used by the program (such as json, csv, etc.).

[0012] Step 2: Feature screening and sorting module. Including:

[0013] Step 2.1: digitize the message information. After obtaining the message information, each piece of information (such as the starting point and end point in the message) should be digitized, and the existing character meaning information should be transformed into a numerical type that can be used for calculation, forming a numerical value under a unified standard to facilitate feature screening.

[0014] The information entropy calculation standard is adopted, as shown in formula (1):

[0015]

[0016] Where i is a single sample (for example, it can be the starting point, end point, message type, etc. extracted from a message), p i is the probability of occurrence of the sample in the sampling space, and k is the number of information items.

[0017] The information entropy value of each piece of information is calculated using the above information entropy formula and stored.

[0018] Step 2.2: Select the random forest method as the basic algorithm for feature screening. The random forest method has the advantages of being easy to implement and having low computational overhead, and can screen out necessary features relatively quickly.

[0019] Step 2.3, Ranking of feature importance based on random forest. The entire random forest consists of input, multiple decision trees, combiner and output. The information entropy value and traffic type of the message information are used to form the input of the random forest. For each decision tree, different types of information entropy values ​​will be used as the sampling basis, covering all major information entropies. The combiner combines the outputs of each decision tree and gives a final result. The output presents the above results to the user / program / application.

[0020] After the random forest is built, a portion of the data will be used to test the classification effect of the random forest. The traffic mark (i.e., whether the traffic itself is normal traffic or attack traffic) is compared with the test results to find the correct traffic set. The importance of the decision tree is further inferred. The mean decrease accuracy strategy is used to calculate the importance of each feature, and the top 16 features are selected as the basis for subsequent selection.

[0021] Step 3: DDoS attack traffic detection module. Including:

[0022] Step 3.1, select CNN as the neural network base for traffic classification. CNN network has good classification ability and is suitable for distinguishing different types of things. In order to avoid complex calculations or poor fitting due to too many or too few layers, the present invention sets the input dimension to 4×4, that is, 16 features; sets the convolution kernel size to 2×2, and allocates 4 different convolution kernels with a step size of 1, to obtain 4 layers of activation layers with a size of 3×3. Among them, the activation layer uses softmax as the activation function. Define the pooling layer and adopt the maximum pooling strategy. Configure the above parameters and build a CNN network.

[0023] Step 3.2: Input the features obtained in the previous module into the CNN model. Reorganize the 16 different features and transform them into a 4×4 format. The matrix data is read into the network by the reading module of the CNN network.

[0024] Step 3.3: Execute CNN model training and obtain the model. Use cross entropy loss to complete the classification work; set the number of training times (initially set to 50), and then use the Sun Shu function to update the weights in the model. After completing the training, a model that can be used to classify DDoS attack traffic and normal traffic is obtained.

[0025] Step 4: Deployment detection:

[0026] Step 4.1. Select the DQN algorithm as the adjustment strategy in the deployment. The DQN algorithm is short for Deep Q Network, which is a method that combines deep networks and Q-Learning reinforcement learning. Set the input of the DQN network to the information extracted from the network traffic packet. DQN determines and filters a certain amount of traffic. For the reward value r, make the following settings:

[0027]

[0028] Where p is the network traffic packet. When the DQN algorithm correctly determines the traffic type, r retain As a non-feedback reward, DQN is required to maintain the existing judgment and maintain the filtering strength. When the DQN algorithm judges the attack traffic as normal traffic, r strength As a positive feedback reward, DQN will be required to improve the detection and filtering strength. When the DQN algorithm judges normal traffic as attack traffic, r weaken As a negative feedback reward, DQN will be required to reduce the detection and filtering intensity. The purpose of this setting is to use reinforcement learning to filter attack traffic and quickly implement online updates based on the current traffic status and intensity, correspondingly enhance or relax traffic access, detect and resist DDoS attacks, and ensure basic user access.

[0029] Step 4.2: Model iteration and optimization: Update the model for classifying DDoS attack traffic and normal traffic periodically, and re-execute the instructions in step 3 based on the traffic received over a period of time to upgrade. Description of the drawings:

[0030] Figure 1 This is the overall process of the composite detection method for DDoS attacks in cloud-edge environments. Specific implementation method:

[0032] The present invention proposes a DDoS attack identification method for a cloud-edge collaborative environment. By using a composite method based on deep learning and reinforcement learning, DDoS attack detection and defense are achieved, providing a new idea for building a cloud-edge environment that can mitigate DDoS attacks. The following is a detailed explanation of the invention with the help of the accompanying drawings.

[0033] Figure 1 The overall process of the present invention is explained. Step one is to preprocess the message and convert the useful information in the message into an information list that can be processed by the program. Step two is feature screening and sorting, calculating the information entropy value of the information list, and then inputting it into the random forest to obtain the 16 most relevant features. Step three uses a neural network to detect DDoS attack traffic, inputs the features obtained in the previous step into the neural network for classification, and obtains a classification model. Step four deploys the DQN network to the cloud edge environment to detect and defend against DDoS attack traffic.

[0034] In addition, some steps are supplemented.

[0035] Step 2.3, when constructing a random forest decision tree, mixed data should be used as the input of the decision tree, that is, a decision tree should not be allowed to have only one information entropy value, but should include various information such as the starting point, end point, port number, timestamp, etc. When configuring the decision tree, this method uses a random method to select the corresponding features of the nodes in the tree. The idea of ​​this operation is: first, to avoid one or several decision trees being too deep, affecting the decision-making progress and greatly increasing storage consumption; second, random selection reduces the possible bias of human selection and reduces the possibility of overfitting.

[0036] Step 3.1: When building a CNN network, PyTorch can usually be used as the basic machine learning framework for development. In the cloud-edge environment, the actual node configuration environment is mostly an operating system based on the Linux kernel. Using Python and PyTorch, it is easy to develop and debug in the system.

[0037] Step 3.3: Configure the number of training rounds for CNN. You can set the loss function during the training process, output the loss function value after each round of training, and perform visualization operations. By observing the downward trend and stable rounds of the loss function, adjust the number of training rounds appropriately, increase or decrease accordingly, so as to achieve accurate training or reduce unnecessary overhead.

[0038] The present invention proposes a DDoS attack identification method for a cloud-edge collaborative environment. By using information entropy calculation and random forest methods, important features in the message are discovered and extracted, and the aforementioned features are further input into the CNN network for training and classification. Then, the DQN network is deployed in the cloud-edge environment, and the CNN model is used to correct and iteratively update it, so as to detect and resist DDoS attacks, providing a new idea for building a cloud-edge environment that can mitigate DDoS attacks.

[0039] A DDoS attack identification method for a cloud-edge collaborative environment includes: (1) using a data preprocessing module to extract header information from network messages and organize and store the information in a format file that can be used by the program; (2) using a feature screening and sorting module to screen features that are most closely related to attack traffic from the header information and sort them; (3) using a DDoS attack traffic detection module to train a CNN model using features calculated by the feature screening and sorting module for DDoS attack traffic classification; (4) using a deployment detection strategy to deploy a DQN in a cloud-edge environment and increase or decrease the defense strength according to the network situation.

[0040] The feature screening and sorting module performs the following process: Step 2.1, digitization of message information: after obtaining the message information, each piece of information is digitized, and the existing character meaning information is transformed into a numerical type that can be used for calculation, forming a numerical value under a unified standard, which is convenient for feature screening;

[0041] The information entropy calculation standard is adopted, including the following formula:

[0042]

[0043] Where e is the information entropy, i is a single sample, p i is the probability of occurrence of the sample in the sampling space, k is the number of information;

[0044] According to the above formula, the information entropy value of each piece of information is calculated and stored;

[0045] Step 2.2, select the random forest method as the basic algorithm for feature screening to screen out the necessary features; Step 2.3, feature importance ranking based on random forest: the entire random forest consists of input, multiple decision trees, combiners and outputs; the information entropy value and traffic type of the message information are used to form the input of the random forest; for each decision tree, different types of information entropy values ​​will be used as the sampling basis, covering all major information entropies; the combiner combines the outputs of each decision tree and gives a final result; the output presents the above results to the user / program / application; after completing the construction of the random forest, part of the data will be used to test the classification effect of the random forest; the traffic mark, that is, the traffic itself is normal traffic or attack traffic, is compared with the test results to find the correct traffic set; further infer the importance of the decision tree; the average descent accuracy strategy is used to calculate the importance of each feature, and the top 16 features are selected as the basis for subsequent selection.

[0046] The deployment detection strategy includes the following process: Step 4.1, select the DQN algorithm as the adjustment strategy in the deployment: The DQN algorithm is the abbreviation of Deep Q Network, which is a method that combines deep network and Q-Learning reinforcement learning. The input of the DQN network is set to the information extracted from the network traffic packet, and DQN judges and filters a certain amount of traffic. For the reward value r, make the following settings:

[0047]

[0048] Among them, p is the network traffic packet. When the DQN algorithm correctly determines the traffic type, r retain As a non-feedback reward, DQN is required to maintain the existing judgment and maintain the filtering strength; when the DQN algorithm judges the attack traffic as normal traffic, r strengthAs a positive feedback reward, DQN will be required to improve the detection and filtering strength; when the DQN algorithm judges normal traffic as attack traffic, r weaken As a negative feedback reward, DQN will be required to reduce the detection and filtering intensity; the purpose of this setting is to use reinforcement learning to filter attack traffic and quickly implement online updates based on the current traffic status and intensity, correspondingly enhance or relax traffic access, detect and resist DDoS attacks, and ensure basic user access; Step 4.2, model iteration optimization: periodically update the model for classifying DDoS attack traffic and normal traffic, and re-execute step (3) based on the traffic received over a period of time for upgrading.

Claims

1. A DDoS attack identification method for a cloud-edge-end collaborative environment, characterized in that: include: (1) Using the data preprocessing module, extract the header information from the network message and organize and store the information in a format file that can be used by the program; (2) Using the feature screening and sorting module, the features most closely associated with the attack traffic are screened from the header information and sorted; (3) Using the DDoS attack traffic detection module, the features calculated by the feature screening and sorting module are used to train the CNN model for DDoS attack traffic classification; (4) Using the deployment detection strategy, DQN is deployed in the cloud-edge environment, and the defense strength is increased or decreased according to the network conditions.

2. The DDoS attack identification method for a cloud-edge-end collaborative environment according to claim 1 is characterized in that: The feature screening and sorting module performs the following process: Step 2.1, digitization of message information: After obtaining the message information, each piece of information is digitized, and the existing character meaning information is transformed into a numerical type that can be used for calculation, forming a numerical value under a unified standard, which is convenient for feature screening; The information entropy calculation standard is adopted, including the following formula: Where e is the information entropy, i is a single sample, p i is the probability of occurrence of the sample in the sampling space, k is the number of information; According to the above formula, the information entropy value of each piece of information is calculated and stored; Step 2.2, select the random forest method as the basic algorithm for feature screening to screen out the necessary features; Step 2.3, Ranking of feature importance based on random forest: The entire random forest consists of input, multiple decision trees, combiner and output; the information entropy value and traffic type of the message information are used to form the input of the random forest; for each decision tree, different types of information entropy values ​​will be used as the sampling basis, covering all major information entropies; the combiner combines the outputs of each decision tree and gives a final result; the output presents the above results to the user / program / application; After the construction of the random forest is completed, a part of the data will be used to test the classification effect of the random forest; the traffic mark, that is, the traffic itself is normal traffic or attack traffic, is compared with the test results to find the correct traffic set; the importance of the decision tree is further inferred; the average descent accuracy strategy is used to calculate the importance of each feature, and the top 16 features are selected as the basis for subsequent selection.

3. The DDoS attack identification method for a cloud-edge-end collaborative environment according to claim 1 is characterized in that: The deployment detection strategy includes the following processes: Step 4.1, select the DQN algorithm as the adjustment strategy in deployment: DQN algorithm is the abbreviation of Deep Q Network, which is a method that combines deep network and Q-Learning reinforcement learning. The input of the DQN network is set as the information extracted from the network traffic packet, and DQN judges and filters a certain amount of traffic. For the reward value r, make the following settings: Among them, p is the network traffic packet. When the DQN algorithm correctly determines the traffic type, r retain As a non-feedback reward, DQN is required to maintain the existing judgment and maintain the filtering strength; when the DQN algorithm judges the attack traffic as normal traffic, r strength As a positive feedback reward, DQN will be required to improve the detection and filtering strength; when the DQN algorithm judges normal traffic as attack traffic, r weaken As a negative feedback reward, DQN will be required to reduce the detection and filtering intensity; the purpose of this setting is to use reinforcement learning to filter attack traffic and quickly implement online updates based on the current traffic status and intensity, correspondingly enhance or relax traffic access, detect and resist DDoS attacks, and ensure basic user access; Step 4.2, model iteration optimization: periodically update the model for classifying DDoS attack traffic and normal traffic, and re-execute step (3) based on the traffic received over a period of time to upgrade.

Images