A DDoS attack identification method for cloud-edge-device collaborative environment

Abstract

This paper proposes a DDoS attack identification method for a cloud-edge collaborative environment. By using information entropy calculation and a random forest approach, it discovers and extracts important features from packets. These features are then fed into a CNN network for training and classification. The DQN network is then deployed in the cloud-edge environment and modified and iteratively updated using the CNN model. This method detects and mitigates DDoS attacks, providing a new approach for building cloud-edge environments that can mitigate DDoS attacks.

Description

Technical field:

[0001] The present invention relates to a DDoS attack identification method for a cloud-edge collaborative environment. Specifically, this is a method that can detect and identify DDoS attacks in a cloud-edge environment, with good detection rate and self-learning ability. Background technology:

[0002] With the rapid development of network technology and computing infrastructure, cloud computing and edge computing have become indispensable new infrastructure for providing efficient and stable computing services. Furthermore, the evolution and advancement of smart devices have enabled more mobile devices, or previously standalone terminal devices, to join the internet ecosystem, facilitating the digital transformation of traditional industries.

[0003] Unlike typical distributed systems, cloud-edge environments involve a wider range of network connectivity options and architectural designs. Cloud computing, as the mainstream computing infrastructure for commercial use, carries the storage and computing tasks of major internet applications. Enterprises can store large, non-core data on cloud servers to reduce the cost of building their own clusters. Enterprise clients (or users) can remotely access services deployed on cloud nodes to obtain online products and other services. While cloud computing brings more convenient services to enterprises and users, it still has some limitations and cannot fully support the diverse needs of users. For example, cloud centers are often geographically distant from users, resulting in high communication latency and overhead. Under these conditions, time-sensitive applications face significant challenges. Edge computing has emerged as a response to this challenge. It is geographically closer to users, provides faster feedback, and is compact, flexible, and easy to deploy. In typical distributed clusters, internal connections are via local area Ethernet and external connections are via wide area networks (WANs). In cloud-edge environments, however, the cloud and edge may rely on local or wide area networks for connectivity, while users and the edge may connect via WiFi, 4G, or 5G. In addition, the architectures of the cloud and edge are not exactly the same. In the cloud center, the server configurations are generally similar and more symmetrical; the differences between edge nodes may be greater. Some nodes are servers themselves and may have the storage and computing capabilities of a single server in the cloud center, while other nodes may only be workstations or desktops with weaker capabilities.

[0004] In the current cloud-edge environment, both the cloud and the edge face different levels of network threats. Traditional network-based DDoS (Distributed Denial of Service) attacks remain a persistent threat within cloud clusters, while the cloud also faces unique DDoS attack threats. The smaller scale of edge clusters means they lack the robust defense capabilities typically associated with cloud centers, requiring only simpler defenses. Furthermore, due to the multi-access nature of users and their mobility in some scenarios, edge nodes are more vulnerable to attacks from within the user community. DDoS attacks are ubiquitous, and online services of all types worldwide have been subject to attacks of varying severity and origin.

[0005] The following describes the current situation. Currently, DDoS attack detection methods often employ statistical strategies. Specifically, statistical methods can construct a traffic matrix based on network traffic characteristics, such as bandwidth usage, source (i.e., the source address of the traffic packet), and protocol type, thereby establishing a detection model. Alternatively, traffic correlation coefficients can be established, or data volume and information distance can be used to distinguish between normal access and attack information. Common statistical methods include Markov and Bayesian methods. In addition to general statistical methods, some methods utilize machine learning to achieve traffic identification and classification. Machine learning, as a technology that can process multidimensional information, is widely used in fields such as image recognition and natural language processing, and is gradually becoming more deeply embedded in computer systems to support system optimization. Currently, machine learning methods often use basic machine learning methods such as random forests (RF) and support vector machines (SVM) and neural networks to identify DDoS attacks. For example, some studies have utilized deep neural networks (DNNs), convolutional neural networks (CNNs), and long short-term memory (LSTMs), or further combined these networks, to achieve detection and identification.

[0006] Through comprehensive observation, the inventors believe that while the aforementioned strategies have their own advantages in identifying DDoS attacks, they also have certain shortcomings. For statistical methods, insufficient or inaccurate features can seriously affect detection effectiveness. For machine learning methods, overfitting and excessive training time can also be a problem.

[0007] Through research, the inventors discovered that reinforcement learning possesses strong optimization decision-making and autonomous exploration capabilities, capable of autonomous mining and tuning based on the input dataset. Therefore, the inventors incorporated reinforcement learning into the analysis of DDoS attack traffic. In summary, the present invention first utilizes basic machine learning methods to classify DDoS attacks, then deploys and provides feedback based on reinforcement learning methods, further optimizing the machine learning results and improving DDoS attack detection. Summary of the invention:

[0008] In response to the need to detect and defend against DDoS attacks in cloud-edge environments, this paper proposes a DDoS attack identification method for cloud-edge collaborative environments. This method uses traditional statistical methods to perform a preliminary division of network traffic to form traffic sets of different risk levels. Reinforcement learning methods are then used to further capture traffic features, enabling a relatively fast and effective distinction between DDoS attack traffic and normal traffic. This method primarily consists of the following steps:

[0009] Step 1: Data preprocessing module. Including:

[0010] Step 1.1: Extract message information. This step primarily extracts message information. In the TCP / IP protocol, data is split into messages for transmission across the network. Messages contain header information, including the source (sending address), destination (receiving address), port number, timestamp, message checksum, message type, and message length.

[0011] The message information extraction step extracts the above message header information from the message according to the protocol format, and classifies this information and stores it in a file format that can be directly recognized and used by the program (such as json, csv, etc.).

[0012] Step 2: Feature screening and sorting module. This includes:

[0013] Step 2.1: digitize message information. After obtaining the message information, each piece of information (e.g., the starting point and end point in the message) should be digitized. The existing character-based information should be transformed into a numerical type that can be used for calculation, forming a numerical value under a unified standard to facilitate feature screening.

[0014] The information entropy calculation standard is adopted, as shown in formula (1):

[0015]

[0016] Where i is a single sample (for example, it can be the starting point, end point, message type, etc. extracted from a message), p i is the probability of occurrence of the sample in the sampling space, and k is the number of information items.

[0017] The information entropy value of each piece of information is calculated using the above information entropy formula and stored.

[0018] Step 2.2: Select the random forest method as the basic algorithm for feature screening. The random forest method has the advantages of being easy to implement and having low computational overhead, and can quickly screen out necessary features.

[0019] Step 2.3: Random Forest-Based Feature Importance Ranking. The entire random forest consists of input, multiple decision trees, a combiner, and output. The input to the random forest is based on the digitized entropy values ​​of the packet information and the traffic type. For each decision tree, different types of entropy values ​​are used as the sampling basis, covering all major entropy values. The combiner combines the outputs of each decision tree and generates a final result. The output presents these results to the user, program, or application.

[0020] After the random forest is constructed, a portion of the data is used to test its classification performance. Traffic labels (i.e., whether the traffic itself is normal traffic or attack traffic) are compared with the test results to identify the correct traffic set. This is then used to infer the importance of the decision tree. The mean decrease accuracy strategy is used to calculate the importance of each feature, and the top 16 features are selected as the basis for subsequent evaluation.

[0021] Step 3: DDoS attack traffic detection module. This includes:

[0022] Step 3.1. Select CNN as the neural network base for traffic classification. The CNN network has good classification capabilities and is suitable for distinguishing different types of things. To avoid computational complexity or poor fitting due to too many or too few layers, the present invention sets the input dimension to 4×4, i.e., 16 features; sets the convolution kernel size to 2×2, and allocates 4 different convolution kernels with a step size of 1, resulting in 4 activation layers of 3×3 in size. Among them, the activation layer uses softmax as the activation function. Define the pooling layer and adopt the maximum pooling strategy. Configure the above parameters and build the CNN network.

[0023] Step 3.2: Input the features obtained in the previous module into the CNN model. Reorganize the 16 different features into a 4×4 format. The CNN network's input module reads the matrix data into the network.

[0024] Step 3.3: Execute CNN model training and obtain the model. Use cross-entropy loss to complete the classification. Set the number of training iterations (initially set to 50) and use the Sun Shu function to update the model weights. After training, you will obtain a model that can be used to classify DDoS attack traffic and normal traffic.

[0025] Step 4: Deployment and testing:

[0026] Step 4.1: Select the DQN algorithm as the adjustment strategy for deployment. The DQN algorithm, short for Deep Q Network, is a method that combines deep networks with Q-Learning reinforcement learning. Set the DQN network input to information extracted from network traffic packets. DQN determines and filters certain traffic. For the reward value r, set the following:

[0027]

[0028] Where p is the network traffic packet. When the DQN algorithm correctly determines the traffic type, r retain As a non-feedback reward, DQN is required to maintain the existing judgment and maintain the filtering strength. When the DQN algorithm judges the attack traffic as normal traffic, r strength As a positive feedback reward, DQN will be required to improve the detection and filtering strength. When the DQN algorithm judges normal traffic as attack traffic, r weaken As a negative feedback reward, DQN will be required to reduce the intensity of detection and filtering. The purpose of this setting is to use reinforcement learning to filter attack traffic and quickly implement online updates based on the current traffic status and intensity, correspondingly strengthening or relaxing traffic admission, detecting and resisting DDoS attacks, and ensuring basic user access.

[0029] Step 4.2: Model Iteration and Optimization. Periodically update the model for classifying DDoS attack traffic and normal traffic. Based on the traffic received over a period of time, re-execute the instructions in Step 3 to upgrade. Description of the drawings:

[0030] Figure 1 This is the overall process of the composite detection method for DDoS attacks in cloud-edge environments. Specific implementation methods:

[0031] This paper proposes a DDoS attack identification method for a cloud-edge collaborative environment. By using a hybrid approach based on deep learning and reinforcement learning, it detects and mitigates DDoS attacks, providing a new approach for building a cloud-edge environment that can mitigate DDoS attacks. The following text explains the invention in detail with accompanying figures.

[0032] Figure 1 The overall process of the present invention is described. Step 1 is to preprocess the message and convert the useful information in the message into an information list that can be processed by the program. Step 2 is feature screening and sorting. The information entropy value of the information list is calculated and then input into the random forest to obtain the 16 most relevant features. Step 3 uses a neural network to detect DDoS attack traffic. The features obtained in the previous step are input into the neural network for classification and obtain a classification model. Step 4 deploys the DQN network to the cloud edge environment to detect and resist DDoS attack traffic.

[0033] In addition, some steps are supplemented.

[0034] In step 2.3, when constructing a random forest decision tree, mixed data should be used as input. This means that a decision tree should not contain only a single entropy value, but rather should include a variety of information, such as the starting point, end point, port number, and timestamp. When configuring the decision tree, this method uses a random method to select features that correspond to the nodes within the tree. The rationale behind this operation is: first, to avoid making one or more decision trees too deep, which would affect decision-making progress and significantly increase storage consumption; second, random selection reduces the potential bias of human selection and reduces the possibility of overfitting.

[0035] When building a CNN network in Step 3.1, PyTorch is typically used as the basic machine learning framework. In a cloud-edge environment, the actual node configuration environment is often based on a Linux kernel-based operating system. Using Python and PyTorch, development and debugging within the system is easy.

[0036] Step 3.3: Configure the number of CNN training rounds. You can set the loss function during the training process and output the loss function value after each round of training and perform visualization operations. By observing the downward trend and stable rounds of the loss function, you can appropriately adjust the number of training rounds, increasing or decreasing them accordingly, to achieve accurate training or reduce unnecessary overhead.

[0037] This paper proposes a DDoS attack identification method for a cloud-edge collaborative environment. By using information entropy calculation and a random forest approach, it discovers and extracts important features from packets. These features are then fed into a CNN network for training and classification. The DQN network is then deployed in the cloud-edge environment and modified and iteratively updated using the CNN model. This method detects and mitigates DDoS attacks, providing a new approach for building cloud-edge environments that can mitigate DDoS attacks.

[0038] A DDoS attack identification method for a cloud-edge collaborative environment includes: (1) using a data preprocessing module to extract header information from network packets and organize and store the information in a format file that can be used by the program; (2) using a feature screening and sorting module to screen features most closely associated with attack traffic from the header information and sort them; (3) using a DDoS attack traffic detection module to train a CNN model using features calculated by the feature screening and sorting module for DDoS attack traffic classification; (4) using a deployment detection strategy to deploy a DQN in the cloud-edge environment and increase or decrease the defense strength according to the network situation.

[0039] The feature screening and sorting module performs the following process: Step 2.1, digitization of message information: After obtaining the message information, each piece of information is digitized, and the existing character meaning information is transformed into a numerical type that can be used for calculation, forming a numerical value under a unified standard to facilitate feature screening;

[0040] The information entropy calculation standard is adopted, including the following formula:

[0041]

[0042] Where e is the information entropy, i is a single sample, p i is the probability of occurrence of the sample in the sampling space, k is the number of information;

[0043] According to the above formula, the information entropy value of each piece of information is calculated and stored;

[0044] Step 2.2, select the random forest method as the basic algorithm for feature screening to screen out the necessary features; Step 2.3, feature importance ranking based on random forest: the entire random forest consists of input, multiple decision trees, combiner and output; the information entropy value and traffic type of the message information are used to form the input of the random forest; for each decision tree, different types of information entropy values ​​will be used as the sampling basis, covering all major information entropies; the combiner will combine the outputs of each decision tree and give a final result; the output presents the above results to the user / program / application; after the random forest is constructed, part of the data will be used to test the classification effect of the random forest; the traffic mark, that is, the traffic itself is normal traffic or attack traffic, is compared with the test results to find the correct traffic set; further infer the importance of the decision tree; the average descent accuracy strategy is used to calculate the importance of each feature, and the top 16 features are selected as the basis for subsequent selection.

[0045] The deployment detection strategy includes the following process: Step 4.1: Select the DQN algorithm as the adjustment strategy for deployment: The DQN algorithm is short for Deep Q Network, a method that combines deep networks and Q-Learning reinforcement learning. The input of the DQN network is set to information extracted from network traffic packets, and DQN judges and filters certain traffic. For the reward value r, make the following settings:

[0046]

[0047] Among them, p is the network traffic packet. When the DQN algorithm correctly determines the traffic type, r retain As a non-feedback reward, DQN is required to maintain the existing judgment and maintain the filtering strength; when the DQN algorithm judges the attack traffic as normal traffic, r strengthAs a positive feedback reward, DQN will be required to improve the detection and filtering strength; when the DQN algorithm judges normal traffic as attack traffic, r weaken As a negative feedback reward, DQN will be required to reduce the detection and filtering intensity; the purpose of this setting is to use reinforcement learning to filter attack traffic and quickly implement online updates based on the current traffic status and intensity, correspondingly enhancing or relaxing traffic access, detecting and resisting DDoS attacks, and ensuring basic user access; Step 4.2, model iterative optimization: periodically update the model for classifying DDoS attack traffic and normal traffic, and re-execute step (3) based on the traffic received over a period of time for upgrading.

Claims

1. A DDoS attack identification method for a cloud-edge collaborative environment, characterized by: include: (1) Using the data preprocessing module, extract the header information from the network message and organize and store the information in a format file that can be used by the program; (2) Using the feature screening and sorting module, the features most closely associated with the attack traffic are screened from the header information and sorted; (3) Using the DDoS attack traffic detection module, the features calculated by the feature screening and sorting module are used to train the CNN model for DDoS attack traffic classification; (4) Using the deployment detection strategy, DQN is deployed in the cloud-edge environment, and the defense strength is increased or decreased according to the network conditions; The feature screening and ranking module performs the following steps 2.1 to 2.3: Step 2.1, digitizing message information: After obtaining the message information, each piece of information is digitized, transforming the existing character meaning information into a numerical type that can be used for calculation, forming a numerical value under a unified standard to facilitate feature screening; Step 2.2, select the random forest method as the basic algorithm for feature screening to screen out the necessary features; Step 2.3, Ranking of Feature Importance Based on Random Forest: The entire random forest consists of input, multiple decision trees, a combiner, and output. The input of the random forest is composed of the numerical entropy value of the message information and the traffic type. For each decision tree, different types of entropy values ​​are used as the sampling basis, covering all major entropies. The combiner combines the outputs of each decision tree and gives a final result. The output presents the above results to the user / program / application. After the random forest is constructed, a portion of the data will be used to test the classification effect of the random forest. The traffic mark, that is, the traffic itself is normal traffic or attack traffic, is compared with the test results to find the correct traffic set. The importance of the decision tree is further inferred. The average descending accuracy strategy is used to calculate the importance of each feature, and the top 16 features are selected as the basis for subsequent selection. The deployment detection strategy performs the following steps 4.1: In step 4.1, select the DQN algorithm as the adjustment strategy for deployment. The DQN algorithm, short for Deep Q Network, is a method that combines deep networks with Q-Learning reinforcement learning. The input of the DQN network is set to information extracted from network traffic packets. DQN determines and filters a certain amount of traffic. For the reward value r, make the following settings: Among them, p is the network traffic packet. When the DQN algorithm correctly determines the traffic type, r retain As a non-feedback reward, DQN is required to maintain the existing judgment and maintain the filtering strength; when the DQN algorithm judges the attack traffic as normal traffic, r strength As a positive feedback reward, DQN will be required to improve the detection and filtering strength; when the DQN algorithm judges normal traffic as attack traffic, r weaken As a negative feedback reward, DQN will be required to reduce the detection and filtering intensity. The purpose of this setting is to use reinforcement learning to filter attack traffic and quickly implement online updates based on the current traffic status and intensity, correspondingly enhancing or relaxing traffic admission, detecting and resisting DDoS attacks, and ensuring basic user access.

2. The DDoS attack identification method for cloud-edge-end collaborative environment according to claim 1 is characterized in that: The information entropy calculation standard includes the following formula: Where e is the information entropy, i is a single sample, p i is the probability of occurrence of the sample in the sampling space, k is the number of information; According to the above formula, the information entropy value of each piece of information is calculated and stored.

3. The DDoS attack identification method for cloud-edge-end collaborative environment according to claim 1 is characterized in that: After executing step 4.1, the deployment detection strategy continues to execute the following step 4.2: Step 4.2, model iterative optimization: The model for classifying DDoS attack traffic and normal traffic is updated periodically. Based on the traffic received over a period of time, step (3) is re-executed to perform an upgrade.

Images