Deep learning DDoS detection method based on feature distribution test
Through a deep learning method based on feature distribution test, temporal convolutional networks and convolutional neural networks are used to extract time domain and frequency domain features, and the Hilbert-Schmidt independence criterion is combined to optimize features. This solves the problems of high computing resources and poor interpretability of existing DDoS detection methods, and achieves efficient and accurate DDoS detection.
Patent Information
- Application Number
- CN202411878793.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-09-23
- Estimated Expiration
- 2044-12-19
AI Technical Summary
Existing DDoS detection methods have problems such as high computing resource requirements, poor model interpretability, and difficulty in feature selection when faced with complex traffic patterns, and it is difficult to achieve accurate real-time detection.
A deep learning method based on feature distribution test is adopted to extract time domain and frequency domain features through temporal convolutional network and convolutional neural network, and the Hilbert-Schmidt independence criterion is used for feature coupling and optimization, which is then combined with classifier for accurate classification.
It improves the accuracy of DDoS detection and the generalization ability of the network, achieves efficient real-time detection, reduces computing resource requirements and improves the interpretability of the model.
Smart Images
Figure CN119696904B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a deep learning DDoS detection method based on feature distribution verification, belongs to the field of information security, and in particular to a deep learning DDoS detection method based on feature distribution verification. Background Art
[0002] With the rapid development of the internet, network security issues are becoming increasingly prominent. Distributed Denial of Service (DDoS) attacks, in particular, have become a significant threat to the availability and stability of network services. DDoS attacks overwhelm target servers with massive amounts of malicious traffic, rendering them unable to respond to legitimate user requests. This attack not only disrupts business operations but can also cause significant financial losses and reputational damage. Therefore, developing effective DDoS detection methods is crucial.
[0003] At present, the detection technologies for DDoS attacks can be mainly divided into the following categories: (1) Threshold-based methods: This method determines whether a DDoS attack has occurred by setting a traffic threshold. When the traffic exceeds the set threshold, the system will issue an alarm. This method is simple and easy to implement, but it has significant limitations. First, attackers can evade threshold detection by dispersing traffic; second, fluctuations in normal traffic may also cause false alarms, affecting the reliability of the system. (2) Feature-based detection methods: This method identifies DDoS attacks by analyzing the characteristics of network traffic, such as traffic rate, number of connections, packet size, etc. Common feature extraction techniques include statistical analysis and traffic clustering. This method is relatively effective, but it still relies on manual feature selection and may not be able to adapt in time when facing new attacks. (3) Machine learning-based methods: With the development of machine learning technology, more and more research has begun to be applied to DDoS detection. By training the model, the system can automatically learn the difference between normal traffic and attack traffic. Common machine learning algorithms include support vector machines (SVM), decision trees, random forests, etc. These methods have improved the accuracy of detection to a certain extent, but still face challenges such as feature selection, model training, and real-time performance. (4) Deep learning-based methods: Deep learning models, such as convolutional neural networks and recurrent neural networks, can automatically extract high-dimensional features and adapt to complex traffic patterns. Although deep learning has shown good performance in DDoS detection, it requires high computing resources and has poor model interpretability, which may lead to difficulties in practical applications.
[0004] At its core, DDoS attack detection is a binary classification problem that can be solved using a classifier. The accuracy of the classification variables, or features, is crucial for classification accuracy. Single-dimensional features lead to incomplete information, while the fusion of features from multiple dimensions can cause information interference and confusion. Summary of the Invention
[0005] The present invention aims to overcome the shortcomings of the above-mentioned existing technologies and provides a deep learning DDoS detection method based on feature distribution testing for accurate detection of DDoS attacks. This method aims to extract decoupled features from the time and frequency domains through a deep learning network. It then couples the distribution features of the time and frequency domains using the Hilbert-Schmidt Independent Criterion (HSIC), thereby optimizing the parameters of the deep learning network. Finally, a classifier is used to accurately classify the features.
[0006] In order to achieve the above object, the present invention provides the following technical solutions:
[0007] A deep learning DDoS detection method based on feature distribution test is characterized by comprising the following steps:
[0008] S1: Collect and preprocess the server access data to obtain time series data;
[0009] S2: Use statistical methods and fast Fourier transform (FFT) to process time series data to obtain statistical features and frequency domain features;
[0010] S3: Use the temporal convolutional network (TCN) autoencoder to extract features from time series data and obtain dynamic features of DDoS.
[0011] S4: Use Concat to combine statistical features and frequency domain features, and then use Convolutional Neural Network (CNN) to extract features and obtain static features of DDoS.
[0012] S5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic and static characteristics of DDoS attacks, and optimize the parameters of the TCN autoencoder.
[0013] S6: Concatenate the dynamic features of DDoS and the static features of DDoS and input them into a classifier to obtain the DDoS attack detection result;
[0014] S7: Establish a loss function and train the convolutional neural network, TCN autoencoder, and classifier based on historical time series data with test result labels.
[0015] S8: Use the network trained in step S7 to detect DDoS attacks on the real-time access data of the server.
[0016] Furthermore, the server access data is a network monitoring feature vector captured by selecting a suitable monitoring tool (such as Wireshark, tcpdump, etc.); at the same time, it also includes information such as the request timestamp, source IP address, destination port, request type, etc.
[0017] Furthermore, the pre-processing in step S1 includes the following steps:
[0018] S101: Data cleaning, including processing missing values, duplicate data and outliers to ensure the integrity of the data set;
[0019] S102: Data formatting: encoding and normalizing the data format;
[0020] S103: Data sorting: sorting the data by timestamp for each IP address and dividing it by sampling period.
[0021] For time series data {x t |t=1,…,T}, the statistical features described in step S2 include: mean and variance {Dx t |t=1,…,T}; where x i,t is the monitoring feature vector of the i-th access device at time t, 1≤i≤d; T is the end of the monitoring period; d is the total number of access devices; The frequency domain characteristics are the monitoring characteristics of any i-th access device within 1~T period using FFT The processed output is 1≤i≤d.
[0022] It should be noted that the mean and variance reflect the overall static situation of the monitoring feature vector, with the purpose of correcting the accidental changes of a single access device; while the frequency domain characteristics reflect the local static situation of a single access device.
[0023] Furthermore, the input of the convolutional neural network is the statistical characteristics and frequency domain characteristics of a single access device within a 1 to T period; the input of the TCN autoencoder is the time series data of a single access device within a 1 to T period.
[0024] Furthermore, the dimensions of the dynamic feature x of DDoS and the static feature y of DDoS must be consistent, that is, the output dimensions of the convolutional neural network and the TCN autoencoder must be consistent.
[0025] Furthermore, the TCN autoencoder described in step S3 is an autoencoder constructed using a TCN network, wherein the encoder and decoder of the autoencoder are both TCN networks, and its loss function adopts a mean-square error (MSE) function.
[0026] Furthermore, the HSIC described in step S5 is used to measure the distribution difference between the dynamic feature x of DDoS and the static feature y of DDoS. Its loss function is: Among them: Cross-covariance operator μ x =E x φ(x), is the tensor product, φ(x), For a nonlinear mapping of given x and y, E x 、E y is the mean operator about x and y; E xy is the expectation operator of the joint distribution of x and y; for any matrix A = [a i,j ],have
[0027] Furthermore, the classifier is a binary classifier built by a support vector machine or a random forest, and the corresponding categories are the presence of DDoS attack behavior and the absence of DDoS attack behavior.
[0028] Preferably, the classifier is a multi-classifier, and the corresponding categories are all DDoS attack behaviors and no DDoS attack behaviors.
[0029] Preferably, the loss function in step S7 is a cross entropy loss function.
[0030] Preferably, for the sake of real-time detection, the Concat connection described in step S6 is replaced by weighted averaging; during real-time monitoring, in step S8, only the trained TCN autoencoder series classifier is used to directly perform real-time detection of DDoS attacks.
[0031] Furthermore, to enhance the interpretability of the results, the TCN autoencoder was replaced with a Kolmogorov-Arnold Network (KAN). The classifier was a linear transformation Y = A·X + B coupled with a Sigmoid function, enabling efficient and interpretable real-time detection of DDoS attacks. A and B are weight matrices to be trained, X is a weighted average vector, and Y is a one-dimensional result.
[0032] Furthermore, the loss function is Loss = L cross (s,label)+||A||2+||B||2, where L cross(s, label) is the cross entropy loss function; s is the DDoS attack detection result output by the classifier, and label is the label of the time series data.
[0033] An electronic device comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein,
[0034] The memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the above-mentioned deep learning DDoS detection method based on feature distribution inspection.
[0035] Finally, the present invention also discloses a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the above-mentioned deep learning DDoS detection method based on feature distribution verification when executed.
[0036] The beneficial effects of the present invention are: providing a deep learning DDoS detection method based on feature distribution testing, decoupling features from the time and frequency domains, then combining statistical analysis to achieve separation of dynamic and static features. Feature extraction is achieved through a parallel convolutional neural network for extracting static DDoS features and a TCN autoencoder for extracting dynamic DDoS features. HSIC is then used to orthogonalize the feature distribution space, improving the network's generalization ability and feature expression accuracy. The present invention uses supervised learning to improve the accuracy of DDoS attack detection results. At the same time, the use of a pruned trained network can directly perform efficient and accurate DDoS attack detection on time series data in the time domain. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to make the purpose and technical solution of the present invention more clear, the present invention provides the following drawings for illustration:
[0038] Figure 1 Flowchart of the deep learning DDoS detection method based on feature distribution inspection in Example 1 of the present invention; wherein the solid arrows represent the data transmission direction, and the dotted arrows represent the training feedback direction;
[0039] Figure 2 Flowchart of a deep learning DDoS detection method based on feature distribution verification in Example 2 of the present invention; wherein the solid arrows represent the data transmission direction, and the dotted arrows represent the training feedback direction;
[0040] Figure 3 This is a diagram of the network architecture for DDoS detection trained in Example 2 of the present invention;
[0041] Figure 4Flowchart of the deep learning DDoS detection method based on feature distribution inspection in Example 3 of the present invention; wherein the solid arrows represent the data transmission direction, and the dotted arrows represent the training feedback direction;
[0042] Figure 5 This is a diagram of the network architecture for DDoS detection trained in Example 3 of the present invention;
[0043] Figure 6 This is a schematic diagram of the structure of an electronic device in Example 4 of the present invention. DETAILED DESCRIPTION
[0044] In order to make the purpose and technical solution of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and embodiments.
[0045] Example 1: To ensure the security of a server providing external access query services, real-time detection of DDoS attacks and their types is proposed. However, due to a lack of historical data for this server, we consider using the CSE-CIC-IDS2018 dataset (https: / / www.unb.ca / cic / datasets / ids-2018.html) as a historical dataset for training and testing, and then analyzing the real-time monitoring features of the server. This example provides a "deep learning DDoS detection method based on feature distribution verification."
[0046] Specific, combined Figure 1 , which includes the following steps:
[0047] Step 1: Preprocess the CSE-CIC-IDS2018 dataset to obtain time series data.
[0048] The CSE-CIC-IDS2018 dataset contains 80 monitoring feature vectors, covering various attributes of network traffic and aiming to provide comprehensive data support for intrusion detection system research. In this example, only the presence of a DDoS attack is considered, using only a subset of the CSE-CIC-IDS2018 dataset features, such as timestamps, source IP addresses, and access traffic. The dataset also includes labels for specific attack categories.
[0049] The preprocessing steps are as follows:
[0050] S101: Data cleaning, including processing missing values, duplicate data and outliers to ensure the integrity of the data set;
[0051] S102: Data formatting: Encode the data format using one-hot encoding and normalize it using Z-Score Normalization;
[0052] S103: Data sorting: sorting the data by timestamp for each IP address and dividing it by sampling period.
[0053] Step 2: Use statistical methods and fast Fourier transform (FFT) to process the time series data respectively to obtain statistical features and frequency domain features.
[0054] For time series data {x t |t=1,…,T}, the statistical features include: mean and variance {Dx t |t=1,…,T}; where x i,t is the monitoring feature vector of the i-th access device at time t, 1≤i≤d; T is the end of the monitoring period; d is the total number of access devices; The frequency domain characteristics are the monitoring characteristics of any i-th access device within 1~T period using FFT The processed output is 1≤i≤d.
[0055] Step 3: Use the TCN autoencoder to extract features from the time series data to obtain the dynamic features of DDoS.
[0056] The TCN autoencoder is constructed using a TCN network. Both the encoder and decoder are TCN networks, and the loss function uses a mean-square error (MSE) function. The input of the TCN autoencoder is the time series data of a single access device within a period of 1 to T.
[0057] Step 4: Use Concat to concatenate the statistical features and frequency domain features, and then use a convolutional neural network (CNN) to extract features to obtain static features of DDoS.
[0058] The dimensions of the dynamic DDoS feature x and the static DDoS feature y must be consistent. That is, the output dimensions of the convolutional neural network and the TCN autoencoder must be consistent. The convolutional neural network input is the statistical and frequency domain features of a single access device within 1 to T cycles.
[0059] Step 5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic and static characteristics of DDoS, and optimize the parameters of the TCN autoencoder.
[0060] The HSIC is used to measure the distribution difference between the dynamic feature x of DDoS and the static feature y of DDoS. Its loss function is: Among them: Cross-covariance operator is the tensor product, φ(x), For a nonlinear mapping of given x and y, E x 、E y is the mean operator about x and y; E xy is the expectation operator of the joint distribution of x and y; for any matrix A = [a i,j ],have
[0061] Step 6: Concatenate the dynamic features of DDoS and the static features of DDoS and input them into a classifier to obtain the detection results of DDoS attacks.
[0062] The classifier is a multi-classifier of a support vector machine, and the corresponding categories are all DDoS attack behaviors and no DDoS attack behaviors.
[0063] Step 7: Establish a Focal loss function based on cross entropy, combine historical time series data with detection result labels, and train the convolutional neural network, TCN autoencoder, and classifier.
[0064] Step 8: Use the network trained in step S7 to detect DDoS attacks on the server's real-time access data.
[0065] Example 2: For the scenario of Example 1, we only need to consider real-time detection of whether there is a DDoS attack. In order to improve the timeliness of real-time data detection, this example provides a "deep learning DDoS detection method based on feature distribution test".
[0066] The same parts as in Example 1 will not be described in detail here. Figure 2 , which includes the following steps:
[0067] Step 1: Preprocess the CSE-CIC-IDS2018 dataset to obtain time series data.
[0068] Among them, the labels of the CSE-CIC-IDS2018 dataset need to be reprocessed into two categories: DDoS attack and non-DDoS attack.
[0069] Step 2: Use statistical methods and fast Fourier transform (FFT) to process the time series data respectively to obtain statistical features and frequency domain features.
[0070] Step 3: Use the TCN autoencoder to extract features from the time series data to obtain the dynamic features of DDoS.
[0071] Step 4: Use Concat to concatenate the statistical features and frequency domain features, and then use a convolutional neural network (CNN) to extract features to obtain static features of DDoS.
[0072] Step 5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic and static characteristics of DDoS, and optimize the parameters of the TCN autoencoder.
[0073] Step 6: The dynamic features and static features of DDoS are weighted averaged and input into a classifier to obtain the DDoS attack detection results.
[0074] The classifier is a binary classifier built using random forest, and the corresponding categories are the presence of DDoS attack behavior and the absence of DDoS attack behavior.
[0075] Step 7: Establish a binary cross-entropy loss function, combine historical time series data with detection result labels, and train the convolutional neural network, TCN autoencoder, and classifier.
[0076] Step 8: Combine Figure 3 ,The TCN autoencoder series classifier trained in step S7 is used to directly perform real-time detection of DDoS attacks.
[0077] Example 3: For personal electronic devices such as mobile computers, mobile phones, smart wearable devices, etc., in order to protect the devices from DDoS attacks and analyze the causes of the attacks, the present invention provides a "deep learning DDoS detection method based on feature distribution verification".
[0078] The training set and test set used are still the same as those in Example 2, and the method steps are also roughly the same as those in Example 2. The same parts will not be repeated here. Figure 4 , which includes the following steps:
[0079] Step 1: Preprocess the CSE-CIC-IDS2018 dataset to obtain time series data.
[0080] Among them, the labels of the CSE-CIC-IDS2018 dataset need to be reprocessed into two categories: DDoS attack and non-DDoS attack.
[0081] Step 2: Use statistical methods and fast Fourier transform (FFT) to process the time series data respectively to obtain statistical features and frequency domain features.
[0082] Step 3: Use KAN to extract features from time series data to obtain dynamic features of DDoS.
[0083] Step 4: Use Concat to concatenate the statistical features and frequency domain features, and then use a convolutional neural network (CNN) to extract features to obtain static features of DDoS.
[0084] Step 5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic and static characteristics of DDoS, and optimize the parameters of the TCN autoencoder.
[0085] Step 6: The dynamic features and static features of DDoS are weighted averaged and input into the classifier to obtain the DDoS attack detection results.
[0086] The classifier is a linear transformation Y = A·X + B connected in series with a Sigmoid function, where A and B are weight matrices to be trained, X is the weighted average vector, and Y is the one-dimensional result. The threshold of the Sigmoid function is set to 0.5.
[0087] Step 7: Establish the loss function as Loss = L cross (s,label)+||A||2+||B||2,Combined with historical time series data with detection result labels, the convolutional neural network, KAN,classifier is trained.
[0088] Among them, L cross (s, label) is the cross entropy loss function; s is the DDoS attack detection result output by the classifier, and label is the label of the time series data.
[0089] Step 8: Combine Figure 5 ,The KAN tandem classifier trained in step S7 is used to directly perform real-time detection of DDoS attacks.
[0090] Step 9: When a DDoS attack is detected, access to the device is disconnected. At the same time, the symbolic expression function of KAN is used to generate symbolic expressions corresponding to the input and output. The features corresponding to the time series data with the largest weight are selected through weight analysis.
[0091] Example 4: For the scenario of Example 1, Figure 6 A schematic diagram of an electronic device (90) that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers.
[0092] Electronic devices may also refer to various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the invention described and / or claimed herein.
[0093] like Figure 3 As shown, the electronic device (90) includes at least one processor (91) and a memory connected to the at least one processor (91), such as a read-only memory (ROM) (92), a random access memory (RAM) (93), etc., wherein the memory stores a computer program that can be executed by the at least one processor, and the processor (91) can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) (92) or the computer program loaded from the storage unit (98) to the random access memory (RAM) (93). Various programs and data required for the operation of the electronic device (90) can also be stored in the RAM 43. The processor (91), ROM 42 and RAM 43 are connected to each other via a bus (94). An input / output (I / O) interface (95) is also connected to the bus (94).
[0094] Multiple components in the electronic device (90) are connected to the I / O interface (95), including: an input unit (96), such as a keyboard, a mouse, etc.; an output unit (97), such as various types of displays, speakers, etc.; a storage unit (98), such as a magnetic disk, an optical disk, etc.; and a communication unit (99), such as a network card, a modem, a wireless communication transceiver, etc. The communication unit (99) allows the electronic device (90) to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.
[0095] The processor (91) can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor (91) include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor (91) executes the various methods and processes described above, such as the deep learning DDoS detection method based on feature distribution inspection.
[0096] In some embodiments, the deep learning DDoS detection method based on feature distribution inspection can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit (98). In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device (90) via the ROM (92) and / or the communication unit (99). When the computer program is loaded into the RAM (93) and executed by the processor (91), one or more steps of the deep learning DDoS detection method based on feature distribution inspection described above can be performed. Alternatively, in other embodiments, the processor (91) can be configured to perform the deep learning DDoS detection method based on feature distribution inspection by any other appropriate means (e.g., by means of firmware).
[0097] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0098] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.
[0099] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0100] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).
[0101] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0102] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.
[0103] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present invention.
Claims
1. A deep learning DDoS detection method based on feature distribution test, characterized by: The following steps are involved: S1: Collect and preprocess the server access data to obtain time series data; S2: Use statistical methods and fast Fourier transform (FFT) to process time series data to obtain statistical features and frequency domain features; S3: Use the temporal convolutional network (TCN) autoencoder to extract features from time series data and obtain dynamic features of DDoS. S4: Use Concat to combine statistical features and frequency domain features, and then use Convolutional Neural Network (CNN) to extract features and obtain static features of DDoS. S5: Use HSIC to establish a loss function to measure the distribution difference between the dynamic and static characteristics of DDoS attacks, and optimize the parameters of the TCN autoencoder. S6: Concatenate the dynamic features of DDoS and the static features of DDoS and input them into a classifier to obtain the DDoS attack detection result; S7: Establish a loss function and train the convolutional neural network, TCN autoencoder, and classifier based on historical time series data with test result labels. S8: Using the network trained in step S7 to detect DDoS attacks on the server's real-time access data; For time series data {x t |t=1,…,T}, the statistical features described in step S2 include: mean and variance {Dx t |t=1,…,T}; where x i,t is the monitoring feature vector of the i-th access device at time t, 1≤i≤d; T is the end of the monitoring period; d is the total number of access devices; The frequency domain characteristics are the monitoring characteristics of any i-th access device within 1~T period using FFT The processed output is 1≤i≤d; The input of the convolutional neural network is the statistical characteristics and frequency domain characteristics of a single access device within a period of 1 to T; the input of the TCN autoencoder is the time series data of a single access device within a period of 1 to T; The dimensions of the DDoS dynamic feature x and the DDoS static feature y must be consistent, that is, the output dimensions of the convolutional neural network and the TCN autoencoder must be consistent; The TCN autoencoder described in step S3 is an autoencoder constructed using a TCN network, wherein both the encoder and decoder of the autoencoder are TCN networks, and its loss function adopts a mean-square error (MSE) function; The HSIC described in step S5 is used to measure the distribution difference between the dynamic feature x of DDoS and the static feature y of DDoS. Its loss function is: Among them: Cross-covariance operator μ x =E x φ(x), is the tensor product, φ(x), For a nonlinear mapping of given x and y, E x 、E y is the mean operator about x and y; E xy is the expectation operator of the joint distribution of x and y; for any matrix A = [a i,j ],have The classifier is a binary classifier built by a support vector machine or a random forest, and the corresponding categories are the presence of DDoS attack behavior and the absence of DDoS attack behavior.
2. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The pre-processing described in step S1 comprises the following steps: S101: Data cleaning, including processing missing values, duplicate data and outliers to ensure the integrity of the data set; S102: Data formatting: encoding and normalizing the data format; S103: Data sorting: sorting the data by timestamp for each IP address and dividing it by sampling period.
3. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The classifier is a multi-classifier, and the corresponding categories are all DDoS attack behaviors and no DDoS attack behaviors.
4. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The loss function described in step S7 is a cross entropy loss function.
5. The deep learning DDoS detection method based on feature distribution inspection according to claim 1 is characterized in that: The Concat connection described in step S6 is replaced by weighted averaging; during real-time monitoring, in step S8, only the trained TCN autoencoder series classifier is used to directly perform real-time detection of DDoS attacks.
6. The deep learning DDoS detection method based on feature distribution inspection according to claim 5 is characterized in that: The TCN autoencoder is replaced with a Kolmogorov-Arnold Network (KAN), and the classifier is a linear transformation Y = A·X + B connected in series with a Sigmoid function, which can achieve efficient and explainable real-time detection of DDoS attacks. Among them, A and B are weight matrices to be trained, X is a weighted average vector, and Y is a one-dimensional result.
7. The deep learning DDoS detection method based on feature distribution inspection according to claim 6 is characterized in that: The loss function is Loss = L cross (s,label)+||A||2+||B||2, where L cross (s, label) is the cross entropy loss function; s is the DDoS attack detection result output by the classifier, and label is the label of the time series data.
8. An electronic device according to any one of claims 1 to 7, characterized in that: The electronic device includes at least one processor; and a memory in communication with the at least one processor; wherein the memory stores a computer program executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the above-mentioned deep learning DDoS detection method based on feature distribution verification.
9. A computer-readable storage medium as claimed in any one of claims 1 to 7, characterized in that: The computer-readable storage medium stores computer instructions, which are used to enable a processor to implement the above-mentioned deep learning DDoS detection method based on feature distribution inspection when executed.