Deep learning DDoS detection method based on feature distribution test

Abstract

The invention relates to a deep learning DDoS detection method based on feature distribution inspection, and belongs to the field of information security. The method comprises the following steps: S1, acquiring and preprocessing access data; s2, calculating statistical characteristics and frequency domain characteristics by using a statistical method and FFT; s3, dynamic features are extracted by using a TCN auto-encoder; s4, static features are extracted from the statistical features and the frequency domain features by using CNN; s5, establishing a loss function by using the HSIC to carry out parameter optimization on the TCN auto-encoder; s6, the dynamic features and the static features are spliced and then input into a classifier, and a detection result is obtained; s7, establishing a loss function, and training network parameters in combination with a result label; and S8, performing DDoS attack detection on the real-time access data by using the trained network. According to the method, the precision of a DDoS attack detection result can be improved, and meanwhile, efficient and accurate DDoS attack detection can be directly carried out on time sequence data in a time domain by adopting the cut and trained network.

Description

Technical Field

[0001] The present invention relates to a deep learning DDoS detection method based on feature distribution verification, belongs to the field of information security, and in particular to a deep learning DDoS detection method based on feature distribution verification. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent, especially Distributed Denial of Service (DDoS) attacks, which have become a major threat to the availability and stability of network services. DDoS attacks flood the target server with a large amount of malicious traffic, causing it to be unable to respond to legitimate users' requests normally. This type of attack not only affects the normal operation of the enterprise, but may also cause huge economic losses and reputation damage. Therefore, it is particularly important to study effective DDoS detection methods.

[0003] At present, detection technologies for DDoS attacks can be mainly divided into the following categories: (1) Threshold-based methods: This method determines whether a DDoS attack occurs by setting a traffic threshold. When the traffic exceeds the set threshold, the system will issue an alarm. This method is simple and easy to implement, but it has major limitations. First, attackers can evade threshold detection by dispersing traffic; second, fluctuations in normal traffic may also cause false alarms, affecting the reliability of the system. (2) Feature-based detection methods: This method identifies DDoS attacks by analyzing the characteristics of network traffic, such as traffic rate, number of connections, packet size, etc. Common feature extraction techniques include statistical analysis and traffic clustering. This method is relatively effective, but it still relies on manual feature selection and may not be able to adapt in time when facing new attacks. (3) Machine learning-based methods: With the development of machine learning technology, more and more research has begun to be applied to DDoS detection. By training the model, the system can automatically learn the difference between normal traffic and attack traffic. Common machine learning algorithms include support vector machines (SVM), decision trees, random forests, etc. These methods have improved the accuracy of detection to a certain extent, but still face challenges such as feature selection, model training, and real-time performance. (4) Deep learning-based methods: Deep learning models, such as convolutional neural networks and recurrent neural networks, can automatically extract high-dimensional features and adapt to complex traffic patterns. Although deep learning has shown good performance in DDoS detection, it has high requirements for computing resources and poor model interpretability, which may lead to difficulties in practical applications.

[0004] In essence, DDoS attack detection is a binary classification problem that can be implemented using a classifier. The accuracy of the classification variable, i.e., the feature, is the decisive factor in determining the accuracy of the classification. Features of a single dimension will lead to incomplete information, and the fusion of features of multiple dimensions will cause mutual interference and confusion of information. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies of the above prior art and provide a deep learning DDoS detection method based on feature distribution test for accurately detecting DDoS attacks. The method intends to extract the decoupled features of the time domain and frequency domain through a deep learning network, and then couple the distribution features of the time domain and frequency domain using the Hilbert-Schmidt Independent Criterion (HSIC), thereby optimizing the parameters of the deep learning network, and finally accurately classifying the features using a classifier.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] The deep learning DDoS detection method based on feature distribution test is characterized by comprising the following steps:

[0008] S1: Collect and preprocess the access data of the server to obtain time series data;

[0009] S2: Use statistical methods and fast Fourier transform (FFT) to process the time series data to obtain statistical features and frequency domain features;

[0010] S3: Use the temporal convolutional network (TCN) autoencoder to extract features from time series data and obtain the dynamic features of DDoS;

[0011] S4: Concatenate the statistical features and frequency domain features using Concat, and then use Convolutional Neural Network (CNN) to extract features to obtain the static features of DDoS.

[0012] S5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic characteristics of DDoS and the static characteristics of DDoS, and optimize the parameters of the TCN autoencoder;

[0013] S6: Concatenate the dynamic features of DDoS and the static features of DDoS and input them into a classifier to obtain the detection result of DDoS attack;

[0014] S7: Establish a loss function and train the convolutional neural network, TCN autoencoder, and classifier based on the historical time series data with detection result labels;

[0015] S8: Use the network trained in step S7 to detect DDoS attacks on the real-time access data of the server.

[0016] Furthermore, the server access data is a network monitoring feature vector captured by selecting a suitable monitoring tool (such as Wireshark, tcpdump, etc.); at the same time, it also includes information such as the timestamp of the request, the source IP address, the target port, the request type, etc.

[0017] Further, the preprocessing described in step S1 comprises the following steps:

[0018] S101: Data cleaning, including processing missing values, duplicate data and outliers to ensure the integrity of the data set;

[0019] S102: Data formatting: encoding and normalizing the data format;

[0020] S103: Data sorting: sorting the data by timestamp for each IP address and dividing it by sampling period.

[0021] For time series data {x t |t=1,…,T}, the statistical features described in step S2 include: mean and variance {Dx t |t=1,…,T}; where x i,t is the monitoring feature vector of the i-th access device at time t, 1≤i≤d; T is the end time of the monitoring period; d is the total number of access devices; The frequency domain feature is the monitoring feature of any i-th access device in 1~T period using FFT. The processed output, 1≤i≤d.

[0022] It should be noted that the mean and variance reflect the overall static situation of the monitoring feature vector, with the purpose of correcting the accidental changes of a single access device; while the frequency domain characteristics reflect the local static situation of a single access device.

[0023] Furthermore, the input of the convolutional neural network is the statistical characteristics and frequency domain characteristics of a single access device within a 1 to T period; the input of the TCN autoencoder is the time series data of a single access device within a 1 to T period.

[0024] Furthermore, the dimensions of the dynamic feature x of DDoS and the static feature y of DDoS must be consistent, that is, the output dimensions of the convolutional neural network and the TCN autoencoder must be consistent.

[0025] Furthermore, the TCN autoencoder described in step S3 is an autoencoder constructed using a TCN network, wherein the Encoder and Decoder of the autoencoder are both TCN networks, and its loss function adopts a mean-square error (MSE) function.

[0026] Furthermore, the HSIC described in step S5 is used to measure the distribution difference between the dynamic feature x of DDoS and the static feature y of DDoS, and its loss function is: Among them: Cross-covariance operator μ x =E x φ(x), is the tensor product, φ(x), For a given nonlinear mapping of x and y, E x 、E y is the mean operator about x and y; E xy is the expectation operator for the joint distribution of x and y; for any matrix A = [a i,j ],have

[0027] Furthermore, the classifier is a binary classifier built by a support vector machine or a random forest, and the corresponding categories are the presence of DDoS attack behavior and the absence of DDoS attack behavior.

[0028] Preferably, the classifier is a multi-classifier, and the corresponding categories are all DDoS attack behaviors and no DDoS attack behaviors.

[0029] Preferably, the loss function described in step S7 is a cross entropy loss function.

[0030] Preferably, for the sake of real-time detection, the Concat connection described in step S6 is replaced by weighted average; during real-time monitoring, in step S8, only the trained TCN autoencoder series classifier is used to directly perform real-time detection of DDoS attacks.

[0031] Furthermore, for the interpretability of the results, the TCN autoencoder is replaced by Kolmogorov-Arnold Network (KAN for short), and the classifier is a linear transformation Y=A·X+B connected in series with a Sigmoid function, which can achieve efficient and interpretable real-time detection of DDoS attacks; wherein A and B are weight matrices to be trained, X is a weighted average vector, and Y is a one-dimensional result.

[0032] Furthermore, the loss function is Loss = L cross (s,label)+||A||2+||B||2, where L cross(s, label) is the cross entropy loss function; s is the detection result of DDoS attack output by the classifier, and label is the label of the time series data.

[0033] An electronic device comprises at least one processor; and a memory connected to the at least one processor in communication; wherein:

[0034] The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned deep learning DDoS detection method based on feature distribution inspection.

[0035] Finally, the present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the above-mentioned deep learning DDoS detection method based on feature distribution inspection when executed.

[0036] The beneficial effects of the present invention are: providing a deep learning DDoS detection method based on feature distribution test, decoupling features from the time domain and frequency domain, and then combining statistical analysis to achieve separation of dynamic and static features, and extracting features through parallel convolutional neural networks for extracting static features of DDoS and TCN autoencoders for extracting dynamic features of DDoS, and then using HSIC to achieve orthogonalization of feature distribution space, thereby improving the generalization ability of the network and the expression accuracy of features. The present invention uses supervised learning to improve the accuracy of DDoS attack detection results. At the same time, the use of a pruned trained network can directly perform efficient and accurate DDoS attack detection on time series data in the time domain. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to make the purpose and technical solution of the present invention more clear, the present invention provides the following drawings for explanation:

[0038] Figure 1 Flow chart of the deep learning DDoS detection method based on feature distribution inspection in Example 1 of the present invention; wherein the solid arrow is the data transmission direction, and the dotted arrow is the training feedback direction;

[0039] Figure 2 Flow chart of the deep learning DDoS detection method based on feature distribution inspection in Example 2 of the present invention; wherein the solid arrow is the data transmission direction, and the dotted arrow is the training feedback direction;

[0040] Figure 3 This is a network architecture diagram of the trained DDoS detection in Example 2 of the present invention;

[0041] Figure 4Flow chart of the deep learning DDoS detection method based on feature distribution inspection in Example 3 of the present invention; wherein the solid arrow is the data transmission direction, and the dotted arrow is the training feedback direction;

[0042] Figure 5 This is a network architecture diagram of the trained DDoS detection in Example 3 of the present invention;

[0043] Figure 6 It is a schematic diagram of the structure of an electronic device in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose and technical solution of the present invention more clearly understood, the present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0045] Example 1: For a server that provides access query services to the outside world, in order to ensure its security, it is now proposed to perform real-time detection of DDoS attacks and their types. However, due to the lack of historical data on the server, it is considered to use the CSE-CIC-IDS2018 dataset (https: / / www.unb.ca / cic / datasets / ids-2018.html) as a historical dataset for training and testing, and then analyze the monitoring features of the server sampled in real time. This embodiment provides a "deep learning DDoS detection method based on feature distribution verification".

[0046] Specific, combined Figure 1 , including the following steps:

[0047] Step 1: Preprocess the CSE-CIC-IDS2018 dataset to obtain time series data.

[0048] Among them, the CSE-CIC-IDS2018 dataset contains a total of 80 monitoring feature vectors, which cover various attributes of network traffic and aim to provide comprehensive data support for the research of intrusion detection systems. In this embodiment, only whether there is a DDoS attack is considered, and only some features in the CSE-CIC-IDS2018 dataset are used, such as timestamp, source IP address, access traffic and other monitoring features, and also include labels for specific attack categories.

[0049] The preprocessing steps are as follows:

[0050] S101: Data cleaning, including processing missing values, duplicate data and outliers to ensure the integrity of the data set;

[0051] S102: Data formatting: Encode the data format using one-hot encoding and normalize it using Z-ScoreNormalization;

[0052] S103: Data sorting: sorting the data by timestamp for each IP address and dividing it by sampling period.

[0053] Step 2: Use statistical methods and fast Fourier transform (FFT) to process the time series data respectively to obtain statistical features and frequency domain features.

[0054] For time series data {x t |t=1,…,T}, the statistical features include: mean and variance {Dx t |t=1,…,T}; where x i,t is the monitoring feature vector of the i-th access device at time t, 1≤i≤d; T is the end time of the monitoring period; d is the total number of access devices; The frequency domain feature is the monitoring feature of any i-th access device in 1~T period using FFT. The processed output, 1≤i≤d.

[0055] Step 3: Use the TCN autoencoder to extract features from time series data to obtain the dynamic features of DDoS.

[0056] The TCN autoencoder is an autoencoder constructed using a TCN network, wherein the encoder and decoder of the autoencoder are both TCN networks, and its loss function adopts a mean-square error (MSE) function. The input of the TCN autoencoder is the time series data of a single access device within 1 to T cycles.

[0057] Step 4: Use Concat to concatenate the statistical features and frequency domain features, and then use the convolutional neural network (CNN) to extract features to obtain the static features of DDoS.

[0058] The dimensions of the dynamic feature x of DDoS and the static feature y of DDoS must be consistent, that is, the output dimensions of the convolutional neural network and the TCN autoencoder must be consistent. The input of the convolutional neural network is the statistical features and frequency domain features of a single access device within 1 to T cycles.

[0059] Step 5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic characteristics of DDoS and the static characteristics of DDoS, and optimize the parameters of the TCN autoencoder.

[0060] The HSIC is used to measure the distribution difference between the dynamic feature x of DDoS and the static feature y of DDoS, and its loss function is: Among them: Cross-covariance operator is the tensor product, φ(x), For a given nonlinear mapping of x and y, E x 、E y is the mean operator about x and y; E xy is the expectation operator for the joint distribution of x and y; for any matrix A = [a i,j ],have

[0061] Step 6: Concatenate the dynamic features of DDoS and the static features of DDoS and input them into a classifier to obtain the detection result of DDoS attack.

[0062] The classifier is a multi-classifier of a support vector machine, and the corresponding categories are all DDoS attack behaviors and no DDoS attack behaviors.

[0063] Step 7: Establish a focal loss function based on cross entropy, combine historical time series data with detection result labels, and train the convolutional neural network, TCN autoencoder, and classifier.

[0064] Step 8: Use the network trained in step S7 to detect DDoS attacks on the real-time access data of the server.

[0065] Example 2: For the scenario of Example 1, we only need to consider real-time detection of whether there is a DDoS attack or not. Considering improving the timeliness of real-time data detection, this example provides a "deep learning DDoS detection method based on feature distribution verification".

[0066] The same parts as those in Example 1 will not be described in detail here. Figure 2 , including the following steps:

[0067] Step 1: Preprocess the CSE-CIC-IDS2018 dataset to obtain time series data.

[0068] Among them, the labels of the CSE-CIC-IDS2018 dataset need to be reprocessed into two categories: DDoS attack and non-DDoS attack.

[0069] Step 2: Use statistical methods and fast Fourier transform (FFT) to process the time series data respectively to obtain statistical features and frequency domain features.

[0070] Step 3: Use the TCN autoencoder to extract features from time series data to obtain the dynamic features of DDoS.

[0071] Step 4: Use Concat to concatenate the statistical features and frequency domain features, and then use the convolutional neural network (CNN) to extract features to obtain the static features of DDoS.

[0072] Step 5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic characteristics of DDoS and the static characteristics of DDoS, and optimize the parameters of the TCN autoencoder.

[0073] Step 6: The dynamic features and static features of DDoS are weighted averaged and input into a classifier to obtain the detection result of DDoS attack.

[0074] The classifier is a binary classifier built by random forest, and the corresponding categories are the presence of DDoS attack behavior and the absence of DDoS attack behavior.

[0075] Step 7: Establish a binary cross entropy loss function, combine historical time series data with detection result labels, and train the convolutional neural network, TCN autoencoder, and classifier.

[0076] Step 8: Combine Figure 3 ,The TCN autoencoder in series with the classifier trained in step S7 is used to directly perform real-time detection of DDoS attacks.

[0077] Example 3: For personal electronic devices, such as mobile computers, mobile phones, smart wearable devices, etc., in order to protect the devices from DDoS attacks and analyze the causes of the attacks, the present invention provides a "deep learning DDoS detection method based on feature distribution verification".

[0078] The training set and test set used are still the same as those in Example 2, and the method steps are also substantially the same as those in Example 2, and the same parts will not be repeated here. Figure 4 , including the following steps:

[0079] Step 1: Preprocess the CSE-CIC-IDS2018 dataset to obtain time series data.

[0080] Among them, the labels of the CSE-CIC-IDS2018 dataset need to be reprocessed into two categories: DDoS attack and non-DDoS attack.

[0081] Step 2: Use statistical methods and fast Fourier transform (FFT) to process the time series data respectively to obtain statistical features and frequency domain features.

[0082] Step 3: Use KAN to extract features from time series data to obtain the dynamic features of DDoS.

[0083] Step 4: Use Concat to concatenate the statistical features and frequency domain features, and then use the convolutional neural network (CNN) to extract features to obtain the static features of DDoS.

[0084] Step 5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic characteristics of DDoS and the static characteristics of DDoS, and optimize the parameters of the TCN autoencoder.

[0085] Step 6: The dynamic features and static features of DDoS are input into the classifier through weighted averaging to obtain the detection result of DDoS attack.

[0086] Among them, the classifier is a linear transformation Y = A·X + B connected in series with a Sigmoid function, A and B are weight matrices to be trained, X is the weighted average vector, and Y is the one-dimensional result. The threshold of the Sigmoid function is set to 0.5.

[0087] Step 7: Establish the loss function as Loss = L cross (s,label)+||A||2+||B||2,Combined with the historical time series data with detection result labels, the convolutional neural network, KAN,classifier are trained.

[0088] Among them, L cross (s, label) is the cross entropy loss function; s is the detection result of DDoS attack output by the classifier, and label is the label of the time series data.

[0089] Step 8: Combine Figure 5 ,The KAN tandem classifier trained in step S7 is used to directly perform real-time detection of DDoS attacks.

[0090] Step 9: When a DDoS attack is detected, the access to the device is disconnected. At the same time, the symbolic expression function of KAN is used to generate symbolic expressions corresponding to the input and output, and the features corresponding to the time series data with the largest weight are selected through weight analysis.

[0091] Embodiment 4: For the scenario of embodiment 1, Figure 6 A schematic diagram of an electronic device (90) that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers.

[0092] Electronic devices may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples and are not intended to limit the implementation of the invention described and / or claimed herein.

[0093] like Figure 3 As shown, the electronic device (90) includes at least one processor (91), and a memory connected to the at least one processor (91) in communication, such as a read-only memory (ROM) (92), a random access memory (RAM) (93), etc., wherein the memory stores a computer program that can be executed by the at least one processor, and the processor (91) can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) (92) or the computer program loaded from the storage unit (98) to the random access memory (RAM) (93). In RAM 43, various programs and data required for the operation of the electronic device (90) can also be stored. The processor (91), ROM 42 and RAM 43 are connected to each other through a bus (94). An input / output (I / O) interface (95) is also connected to the bus (94).

[0094] A number of components in the electronic device (90) are connected to the I / O interface (95), including: an input unit (96), such as a keyboard, a mouse, etc.; an output unit (97), such as various types of displays, speakers, etc.; a storage unit (98), such as a disk, an optical disk, etc.; and a communication unit (99), such as a network card, a modem, a wireless communication transceiver, etc. The communication unit (99) allows the electronic device (90) to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0095] The processor (91) may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor (91) include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor (91) executes the various methods and processes described above, such as the deep learning DDoS detection method based on feature distribution inspection.

[0096] In some embodiments, the deep learning DDoS detection method based on feature distribution verification can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit (98). In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device (90) via the ROM (92) and / or the communication unit (99). When the computer program is loaded into the RAM (93) and executed by the processor (91), one or more steps of the deep learning DDoS detection method based on feature distribution verification described above can be performed. Alternatively, in other embodiments, the processor (91) can be configured to perform the deep learning DDoS detection method based on feature distribution verification in any other suitable manner (e.g., by means of firmware).

[0097] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0099] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0100] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0101] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0102] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0103] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present invention.

Claims

1. A deep learning DDoS detection method based on feature distribution inspection, characterized in that: The following steps are involved: S1: Collect and preprocess the access data of the server to obtain time series data; S2: Use statistical methods and fast Fourier transform (FFT) to process the time series data to obtain statistical features and frequency domain features; S3: Use the temporal convolutional network (TCN) autoencoder to extract features from time series data and obtain the dynamic features of DDoS; S4: Concatenate the statistical features and frequency domain features using Concat, and then use Convolutional Neural Network (CNN) to extract features to obtain the static features of DDoS. S5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic characteristics of DDoS and the static characteristics of DDoS, and optimize the parameters of the TCN autoencoder; S6: Concatenate the dynamic features of DDoS and the static features of DDoS and input them into a classifier to obtain the detection result of DDoS attack; S7: Establish a loss function and train the convolutional neural network, TCN autoencoder, and classifier based on the historical time series data with detection result labels; S8: Using the network trained in step S7 to detect DDoS attacks on the real-time access data of the server; For time series data {x t |t=1,…,T}, the statistical features described in step S2 include: mean and variance {Dx t |t=1,…,T}; where x i,t is the monitoring feature vector of the i-th access device at time t, 1≤i≤d; T is the end time of the monitoring period; d is the total number of access devices; The frequency domain feature is the monitoring feature of any i-th access device in 1~T period using FFT. The processed output, 1≤i≤d; The input of the convolutional neural network is the statistical characteristics and frequency domain characteristics of a single access device within a 1-T period; the input of the TCN autoencoder is the time series data of a single access device within a 1-T period; The dimensions of the dynamic feature x of DDoS and the static feature y of DDoS must be consistent, that is, the output dimensions of the convolutional neural network and the TCN autoencoder must be consistent; The TCN autoencoder described in step S3 is an autoencoder constructed using a TCN network, wherein the Encoder and Decoder of the autoencoder are both TCN networks, and its loss function adopts a mean-square error (MSE) function; The HSIC described in step S5 is used to measure the distribution difference between the dynamic feature x of DDoS and the static feature y of DDoS, and its loss function is: Among them: Cross-covariance operator μ x =E x φ(x), is the tensor product, φ(x), For a given nonlinear mapping of x and y, E x 、E y is the mean operator about x and y; E xy is the expectation operator for the joint distribution of x and y; for any matrix A = [a i,j ],have The classifier is a binary classifier built by a support vector machine or a random forest, and the corresponding categories are the presence of DDoS attack behavior and the absence of DDoS attack behavior.

2. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The pre-processing described in step S1 comprises the following steps: S101: Data cleaning, including processing missing values, duplicate data and outliers to ensure the integrity of the data set; S102: Data formatting: encoding and normalizing the data format; S103: Data sorting: sorting the data by timestamp for each IP address and dividing it by sampling period.

3. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The classifier is a multi-classifier, and the corresponding categories are all DDoS attack behaviors and no DDoS attack behaviors.

4. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The loss function described in step S7 is a cross entropy loss function.

5. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The Concat connection described in step S6 is replaced by weighted average; during real-time monitoring, in step S8, only the trained TCN autoencoder series classifier is used to directly perform real-time detection of DDoS attacks.

6. The deep learning DDoS detection method based on feature distribution inspection according to claim 5 is characterized in that: The TCN autoencoder is replaced by Kolmogorov-Arnold Network (KAN for short), and the classifier is a linear transformation Y=A·X+B connected in series with a Sigmoid function, which can realize efficient and explainable real-time detection of DDoS attacks; wherein A and B are weight matrices to be trained, X is a weighted average vector, and Y is a one-dimensional result.

7. The deep learning DDoS detection method based on feature distribution inspection according to claim 6 is characterized in that: The loss function is Loss = L cross (s,label)+||A||2+||B||2, where L cross (s, label) is the cross entropy loss function; s is the detection result of DDoS attack output by the classifier, and label is the label of the time series data.

8. An electronic device applied to any one of claims 1 to 7, characterized in that: The electronic device comprises at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the deep learning DDoS detection method based on feature distribution inspection described above.

9. A computer-readable storage medium as claimed in any one of claims 1 to 7, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the processor to implement the above-mentioned deep learning DDoS detection method based on feature distribution inspection when executed.

Images