DDos attack detection method and device based on depth automatic encoder

Abstract

The embodiment of the invention provides a DDos attack detection method and device based on a depth automatic encoder. The method comprises the following steps: acquiring feature data of to-be-detected service traffic; inputting feature data X in the service flow and preset label information of the feature data into the trained deep automatic encoder DAE model to obtain reconstructed feature data X'output by the DAE model; obtaining a reconstruction error of the feature data X and the reconstruction feature data X ', comparing the reconstruction error with an adaptive threshold value, and if the reconstruction error is greater than the adaptive threshold value, confirming that the current service flow has the DDos attack; wherein the adaptive threshold is an optimal value determined according to a measurement index of the DAE model after the trained DAE model is adopted to process feature data in the verification set and / or the test set and a reconstruction error is obtained. According to the method, the known type and unknown type of DDos attack traffic can be detected at the same time, and the network robustness and security are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a DDos attack detection method based on a deep autoencoder, a DDos attack detection device based on a deep autoencoder, an electronic device and a computer-readable medium. Background Art

[0002] The rapid development of cyberspace has brought many conveniences to people's lives. Nowadays, people's food, clothing, housing and transportation have gradually become dependent on the Internet. In other words, the people can no longer live without the Internet. However, with the development of network technology, various intrusion technologies have also made great progress, and it has become crucial to detect intrusion behaviors that undermine network security. DDos (Distributed Denial of Service) takes advantage of the openness and distributed nature of the Internet. Attackers use botnets or distributed attack tools to send a large amount of traffic to the target system in a short period of time. These traffic may be legitimate requests, or they may be forged, malicious requests, or even huge network data packets. Regardless of the type of traffic, the target system or server will crash or become extremely slow because it cannot handle it. The final result is that the target system or server has no time to process the user's normal requests, and the entire system is paralyzed. According to Google's data, one of their cloud customers received 46 million requests per second during the peak request in June 2022. According to Kaspersky Lab (2022b), the number of DDoS attacks in the fourth quarter of 2021 reached a record high and showed a significant growth trend. DDoS attacks include traditional traffic flooding attacks, reflection amplification attacks, application layer attacks, distributed reflection amplification attacks, and other types. Traditional traffic flooding attacks are one of the most common forms of DDoS attacks. Attackers use a large number of legitimate or forged requests to send massive amounts of data traffic to the target system to exceed its processing capacity. This may include flooding attacks of TCP, UDP, ICMP and other protocols, such as SYN flooding attacks, UDP flooding attacks, ICMP flooding attacks, etc. Reflection amplification attack (uses vulnerable servers or devices to reflect attack traffic to the target system, exposing it to a greater traffic load. Common reflection amplification attacks include DNS amplification attacks, NTP amplification attacks, SNMP amplification attacks, etc. Application layer attacks are different from traditional traffic flooding attacks. Application layer attacks attack the application layer protocols and resources of the target system. The attacker will simulate the requests of legitimate users, but these requests will consume the system's resources, causing the system to be unable to process legitimate user requests normally. Common application layer attacks include HTTP request attacks, Slowloris attacks, HTTP POST attacks, etc. Distributed reflection amplification attacks are a form of combined reflection amplification attacks and distributed attacks. Attackers use multiple servers or devices with reflection amplification vulnerabilities to send reflection amplification attacks to the target system at the same time in a distributed manner, thereby increasing the power of the attack. Due to its ease of implementation and difficulty in detection, DDos attacks have become a major problem in the network world. Summary of the invention

[0003] The embodiment of the present invention provides a DDos attack detection method and device based on a deep autoencoder to solve the problem that the traditional DDoS attack detection method cannot accurately identify new attack modes and has a high false alarm rate.

[0004] The embodiment of the present invention discloses a DDos attack detection method based on a deep autoencoder, comprising:

[0005] Obtain characteristic data of the service traffic to be detected;

[0006] Input the feature data X in the service traffic and the preset label information of the feature data into the trained deep autoencoder DAE model to obtain the reconstructed feature data X' output by the DAE model;

[0007] Obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current business traffic is under DDos attack;

[0008] The adaptive threshold is an optimal value determined according to a measurement indicator of the DAE model after the trained DAE model is used to process feature data in the validation set and / or the test set and obtain the reconstruction error.

[0009] Optionally, the method further comprises:

[0010] Preprocess the specified data set and randomly sample to obtain training set, validation set and test set;

[0011] The DAE model is trained using the training set to obtain a trained DAE model;

[0012] The trained DAE model is verified using the verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold.

[0013] The test set is used to test the result of the DAE model. If a better threshold exists during the test, the adaptive threshold is updated.

[0014] Optionally, the DAE model includes: an input layer, an encoding layer, a decoding layer and an output layer;

[0015] The encoding layer includes two encoders, the decoding layer includes two decoders, and the encoding layer and the decoding layer are completely symmetrical;

[0016] The DAE model is trained using the training set to obtain the trained DAE model, including:

[0017] In the encoding stage, the encoding function f is used to transform the initial input feature data x into the hidden representation h, which is calculated using formula (1), where σ is the sigmoid function, W is the weight, and b is the bias;

[0018] h=f(x)=σ(Wx+b) Formula (1)

[0019] In the decoding stage, the function g is used to reconstruct the hidden representation h into x', and the nonlinear activation function σ' is selected for reconstruction. W' represents the weight, b' represents the bias, and the reconstruction is performed using formula (2):

[0020] x'=g(h)=σ'(W'h+b') Formula (2)

[0021] The back propagation algorithm is used to find the parameters θ = {W, b, b'} to minimize the objective function in the training set D. The objective function J(θ) is:

[0022] L is the reconstruction error, i represents the sequence number of the feature data in the training set;

[0023] When the objective function J(θ) is minimized, the trained DAE model is obtained.

[0024] Optionally, a validation set is used to validate the trained DAE model. During the validation process, an optimal threshold of the validation set is obtained as an initial value of the adaptive threshold, including:

[0025] Use the trained DAE model to process the feature data x in the training set D to obtain the maximum reconstruction error Max_RE and the minimum reconstruction error Min_RE;

[0026] In the initialization stage, Max_RE is used as the optimal threshold, and the trained DAE model is used to process each feature data in the validation set to obtain the reconstruction error RE of each feature data.

[0027] Based on the reconstruction error of each feature data, the reconstruction error RE of all feature data is compared with the optimal threshold to obtain the detection results of all feature data, and the measurement index is used for measurement, and the reconstruction error RE of the measurement index greater than the largest measurement index among the specified measurement indexes is selected as the updated optimal threshold, i.e., the adaptive threshold;

[0028] Otherwise, Max_RE is reduced by a specified value as the updated optimal threshold, and the reconstruction error RE of all feature data is repeatedly compared with the optimal threshold Max_RE until the optimal threshold is selected.

[0029] Optionally, it also includes:

[0030] During the test set testing process, if the reconstruction error of all feature data in the test set is compared with the adaptive threshold, the detection results of all feature data in the test set are obtained, and the measurement index is used for measurement. If there is a measurement index that is greater than the optimal threshold in the validation set, the reconstruction error RE to which the measurement index belongs is used as the adaptive threshold.

[0031] Optionally, the measurement indicator is accuracy.

[0032] Alternatively, the measurement indicators include: Accuracy, Precision, Recall, and F1 indicators.

[0033]

[0034] TP is a true positive example where the prediction is correct and the actual situation is also correct, TN is a true negative example where the prediction is incorrect and the actual situation is also incorrect, FP is a false positive example where the prediction is incorrect but the actual situation is correct, and FN is a false negative example where the prediction is correct but the actual situation is incorrect.

[0035] The embodiment of the present invention also discloses a DDos attack detection model training method, including:

[0036] Preprocess the specified data set and randomly sample to obtain training set, validation set and test set;

[0037] The training set is used to train the deep autoencoder DAE model to obtain the trained DAE model;

[0038] The trained DAE model is verified using the verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold.

[0039] The adaptive threshold is a reference standard for the trained DAE model to detect whether there are known and / or unknown types of DDos attacks in the business traffic.

[0040] Optionally, it also includes:

[0041] The test set is used to test the result of the DAE model. If a better threshold exists during the test, the adaptive threshold is updated.

[0042] The embodiment of the present invention also discloses a DDos attack detection device based on a deep autoencoder, comprising:

[0043] A characteristic data acquisition unit, used to acquire characteristic data of the service flow to be detected;

[0044] A model detection unit, used to input feature data X in the service traffic and label information preset for the feature data into a trained deep autoencoder DAE model to obtain reconstructed feature data X' output by the DAE model;

[0045] A judgment unit is used to obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current business traffic has a DDos attack;

[0046] The adaptive threshold is an optimal value determined according to the measurement index of the DAE model after the trained DAE model is used to process the feature data in the validation set and / or the test set and the detection data and obtain the reconstruction error.

[0047] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0048] The memory is used to store computer programs;

[0049] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0050] The embodiment of the present invention further discloses one or more computer-readable media on which instructions are stored. When executed by one or more processors, the processors are enabled to execute the method described in the embodiment of the present invention.

[0051] The embodiments of the present invention include the following advantages:

[0052] The DDos attack detection method of this embodiment can adapt to the attack detection needs in different environments, without confirming whether it is a known type of DDos attack or an unknown type of DDos attack, and can effectively improve the security of the network and reduce the impact of DDoS attacks on the system. It has high feasibility and effect in practical applications and can improve the security and stability of the network. At the same time, it can accurately identify DDoS attacks, solving the problems of the inability to accurately identify new attack methods and high false alarm rate in traditional DDoS attack detection.

[0053] The training method of the embodiment of the present invention can learn the difference between attack traffic and normal traffic by training a specified data set, thereby achieving accurate attack detection. Specifically, a deep autoencoder is used to perform encoding and decoding operations, and the model is trained by minimizing the reconstruction error in the training set. The trained model can reconstruct the input data and calculate the reconstruction error. When the reconstruction error exceeds the set threshold, the data can be judged as attack traffic.

[0054] Furthermore, in the embodiment of the present invention, the optimal threshold is selected by calculating the accuracy on the validation set. By iteratively updating the threshold, a model that can accurately detect attack traffic and avoid misjudgment as much as possible can be obtained. Thus, known and unknown types of DDoS attack traffic can be detected at the same time, the network robustness and security can be improved, and the impact of DDoS attacks on the system can be reduced. This has important practical application value for protecting network security and maintaining normal network operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a step flow chart of a DDos attack detection method based on a deep autoencoder provided in an embodiment of the present invention;

[0056] Figure 2 It is a step flow chart of a DDos attack detection method based on a deep autoencoder provided in an embodiment of the present invention;

[0057] Figure 3 This is a schematic diagram of the DDos attack types included in the CIC-DDoS2019 dataset;

[0058] Figure 4 is a schematic diagram of the structural framework of the DAE model provided in an embodiment of the present invention;

[0059] Figure 5 It is a structural block diagram of a DDos attack detection device based on a deep autoencoder provided in an embodiment of the present invention;

[0060] Figure 6 is a block diagram of an electronic device provided in an embodiment of the present invention;

[0061] Figure 7 is a schematic diagram of a computer-readable medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0063] DDoS (Distributed Denial of Service) attack is a network attack method in which the attacker uses a large number of controlled computers (called zombie networks or botnets) to send a large number of requests to the target server, causing the target server to be unable to process the requests of legitimate users, thus causing the service to be unavailable. DDoS attacks can target various network resources, such as websites, online services, network infrastructure, etc.

[0064] DDoS attacks are a common network threat that consumes the resources of the target server and makes it unable to provide normal services. In order to prevent DDoS attacks, it is usually necessary to take multi-layered protection measures, including the network layer, application layer and the use of third-party services.

[0065] Traditional methods generally detect received requests when dealing with DDos attacks. They include traffic analysis, behavioral analysis, and statistical methods. Traffic analysis detects and analyzes network traffic in real time to identify abnormal traffic patterns and behaviors. This method can detect a large number of source IP addresses sending requests at the same time or abnormal peak traffic. Behavioral analysis identifies possible DDoS attacks by analyzing the behavioral characteristics of network traffic. This method detects a large number of repeated requests, very short connection times, or abnormally frequent requests. Statistical methods detect deviations and anomalies in traffic by establishing a statistical model of normal traffic. For example, statistical indicators such as mean and variance are used to detect abnormal traffic. Most existing intrusion detection systems are usually unable to detect unknown attacks due to their reliance on predefined attack patterns and signatures. Even if the accuracy is good in known attack patterns, errors may occur when encountering high false positive examples.

[0066] In order to solve the problems in the existing technology, traditional machine learning methods such as support vector machines (SVM) and decision trees (Decision Tree) have been applied to such problems. However, such shallow machine learning methods are difficult to detect attacks in large data sets. Deep learning models have their own advantages in extracting unique self-generated features in complex networks where manual feature extraction is not applicable. Deep autoencoders are used to learn low-dimensional representations of data and reconstruct data. It consists of multiple encoder and decoder layers, and learns the feature representation of data through layer-by-layer training.

[0067] The embodiment of the present invention proposes a method for DDoS attack detection using a deep autoencoder based on the CIC-DDoS2019 dataset. The method obtains a high-precision detection model by training the deep autoencoder, which can accurately identify DDoS attacks. This is of great significance to the field of network security. Traditional DDoS attack detection methods have some problems, such as the inability to accurately identify new attack methods and high false alarm rate. The method based on the deep autoencoder proposed in the embodiment of the present invention can learn the difference between attack traffic and normal traffic by training the CIC-DDoS2019 dataset, thereby achieving accurate attack detection.

[0068] In the embodiment of the present invention, a deep autoencoder is used to extract features from the DDos data set, and the features are reconstructed through a multi-layer decoder, ultimately achieving the purpose of detecting DDos attacks. Different from the previous supervised learning (Supervised Machine Learning), the autoencoder here uses a dynamically selected threshold to determine whether the sample data is a DDos attack. The specific scheme is described in the following embodiments.

[0069] Reference Figure 1 , shows a flowchart of a DDos attack detection method based on a deep autoencoder provided in an embodiment of the present invention, which may specifically include the following steps:

[0070] 101. Obtain characteristic data of the service traffic to be detected;

[0071] For example, the DDos attack detection method can be applied to game servers, cloud service providers, or financial or e-commerce detection. It can configure a mirror port on a network switch or router, copy the traffic to a specified port, and then use the method of this embodiment on the port to obtain the business traffic to be detected, and analyze the characteristic data of the business traffic in real time. Alternatively, a network splitter can be used to losslessly copy network traffic for detection, which will not affect network performance. In a virtual environment, traffic between virtual machines can also be captured through a virtual switch.

[0072] 102. Input the feature data X in the service traffic and the label information preset for the feature data into the trained deep autoencoder DAE model to obtain the reconstructed feature data X' output by the DAE model;

[0073] 103. Obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current service traffic has a DDos attack;

[0074] The adaptive threshold is an optimal value determined according to a measurement indicator of the DAE model after the trained DAE model is used to process feature data in the validation set and / or the test set and obtain the reconstruction error.

[0075] The DDos attack detection method of this embodiment can adapt to the attack detection needs in different environments. There is no need to confirm whether it is a known type of DDos attack or an unknown type of DDos attack. It can effectively improve the security of the network and reduce the impact of DDoS attacks on the system. It has high feasibility and effect in practical applications and can improve the security and stability of the network.

[0076] Reference Figure 2, shows a flowchart of a DDos attack detection method based on a deep autoencoder provided in an embodiment of the present invention, which may specifically include the following steps:

[0077] 201. Preprocess the specified data set and randomly sample to obtain the training set, validation set and test set.

[0078] For example, the data set is preprocessed first, and after removing duplicate data, the data set is divided into three parts. 80% of the total data set is randomly sampled as the training set for training, 10% of the total data set is used as the validation set for selecting the threshold, and 10% of the total data set is used as the test set to measure the training effect of the trained model. The above method can increase the generalization ability of the trained model. Next, the normalization strategy is used to process the original data, namely the training set, validation set, and test set, and the data of different dimensions are normalized to [0,1], eliminating the impact of different dimensions of data of different dimensions and accelerating the convergence speed of subsequent training models.

[0079] The normalization formula is as follows: X is the data in the data set, and A represents the data set.

[0080] In addition, the specified data set of this embodiment can select the CIC-DDoS2019 data set, which is a data set with 66 features and is one of the main public data sets for verifying DDos attack detection. The CIC-DDoS2019 data set contains the following Figure 3 The DDos attack type shown in the figure. In this embodiment, a deep autoencoder is used to train on this data set to obtain a high-precision detection model.

[0081] 202. Use the training set to train the DAE model to obtain a trained DAE model.

[0082] The structure of the DAE model in this embodiment is as follows Figure 4 shown.

[0083] The deep autoencoder used in this embodiment uses a combination of two encoders and two decoders. The hidden layers of the two encoders use a fully connected layer activation function using a sigmoid function, the number of neurons is 32 and 16 respectively, and the decoder is completely symmetrical with the encoder. The deep autoencoder inputs a feature vector x with 66 features, which is encoded by two encoders and then decoded by two symmetrical decoders.

[0084] 203. The trained DAE model is verified using a verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold.

[0085] In this embodiment, the attack detection method of the deep autoencoder is trained using normal data. When the input is normal data, a lower reconstruction error is obtained, while a higher reconstruction error indicates that the input data is abnormal and is attack traffic.

[0086] Therefore, the reconstruction error threshold needs to be carefully selected. A higher or lower reconstruction error will lead to misjudgment of the data. For example, a lower threshold will lead to a large amount of attack traffic being judged as normal traffic, which may indirectly cause the system to crash in serious cases. For the threshold selection method, this embodiment uses a validation set to provide an optimal threshold selection method, as shown in the following code.

[0087]

[0088] The input in the above code also includes the training set. In practical applications, after the DAE model is trained, only the validation set can be input to obtain the optimal threshold.

[0089] In the above process of obtaining the optimal threshold, Accuracy is needed. Accuracy is the accuracy rate, which is used as an evaluation criterion for the quality of DAE model training. The same evaluation criteria include Precision, Recall, and F1 indicators.

[0090]

[0091]

[0092] Among them, TP is a true positive example that is predicted to be correct and the actual situation is also correct, TN is a true negative example that is predicted to be wrong and the actual situation is also wrong, FP is a false positive example that is predicted to be wrong but the actual situation is correct, and FN is a false negative example that is predicted to be correct but the actual situation is wrong. In this embodiment, the above four indicators are also used in the test set to measure the training effect.

[0093] The above threshold selection method starts with the highest RE of the training data as the abnormal threshold, uses the validation set to calculate the accuracy of the model, and caches the accuracy and threshold if the accuracy obtained in this iteration is better than the previous accuracy. The limit value of the threshold is set to the lowest reconstruction error, and the optimal threshold and the highest accuracy are found through continuous iteration. If the calculated accuracy is not the highest accuracy round during the iteration, the threshold is subtracted by 0.001 to avoid the iteration falling into an infinite loop.

[0094] 204. Obtain characteristic data of the service traffic to be tested in the test set;

[0095] 205. Input the feature data X in the service traffic and the label information preset for the feature data into the trained deep autoencoder DAE model to obtain the reconstructed feature data X' output by the DAE model;

[0096] 206. Obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current service traffic has a DDos attack.

[0097]

[0098]

[0099] In addition, in other embodiments, a test set is used to test the result of the DAE model, and if a better threshold exists during the test, the adaptive threshold is updated.

[0100] After the optimal threshold is calculated from the validation set data, this optimal threshold and the test set data are used for verification. First, the trained DAE model is used to reconstruct the input data. When the calculated reconstruction error is less than the threshold, the data is marked as normal traffic. If the calculated reconstruction error is greater than the threshold, the data is marked as attack traffic. The threshold-based method does not rely on the judgment of the type of DDos attack to determine whether the input feature is DDos attack data, but judges through the calculated reconstruction error. In other words, the method of this embodiment can simultaneously detect known and unknown types of DDos attack traffic, which can greatly improve the robustness and security of the network.

[0101] In the specific implementation, in order to better understand the process of the DAE model in the encoding and decoding stages, the following is a specific explanation combined with the formula.

[0102] In the encoding phase, the encoding function f is used to transform the initial input x into a hidden representation h, which is calculated using formula (1), where the nonlinear activation function σ is chosen as sigmoid, W represents the weight, and b represents the bias. The randomly initialized autoencoder iteratively updates the parameters through back propagation.

[0103] h=f(x)=σ(Wx+b) (1)

[0104] In the decoding stage, the function g is used to reconstruct the hidden representation h into x'. Here, a nonlinear activation function σ' is also selected for reconstruction. W' represents the weight and b' represents the bias. The reconstruction process is shown in formula (2):

[0105] x'=g(h)=σ'(W'h+b') (2)

[0106] The training of the autoencoder is to find the parameter θ = {W, b, b'} through the back propagation algorithm to minimize the sum of the reconstruction errors in the training set D, that is, the objective function. The calculation formula of the objective function J(θ) is shown in formula (3):

[0107]

[0108] Where L is the reconstruction error. In the deep autoencoder DAE model, since the data has been normalized, the cross entropy loss is used to represent the reconstruction error. The calculation formula is shown in formula (4):

[0109]

[0110] In this embodiment, a deep autoencoder is used for encoding and decoding operations, and the model is trained by minimizing the reconstruction error in the training set. The trained model can reconstruct the input data and calculate the reconstruction error. When the reconstruction error exceeds the set threshold, the data can be judged as attack traffic. In this embodiment, the optimal threshold is selected by calculating the accuracy on the validation set. By iteratively updating the threshold, a model that can accurately detect attack traffic and avoid misjudgment as much as possible can be obtained. In addition, the threshold-based method can simultaneously detect known types and unknown types of DDos attack traffic, thereby improving network robustness and security.

[0111] In addition, this embodiment also provides a DDos attack detection model training method, including:

[0112] 301. Preprocess the specified data set and randomly sample to obtain a training set, a validation set, and a test set;

[0113] 302. Use the training set to train a deep auto encoder DAE model to obtain a trained DAE model;

[0114] 303. The trained DAE model is verified using the verification set, and during the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold;

[0115] The adaptive threshold is a reference standard for the trained DAE model to detect whether there are known and / or unknown types of DDos attacks in the business traffic.

[0116] Furthermore, the test set is used to test the results of the DAE model. If a better threshold exists during the test, the adaptive threshold is updated.

[0117] In this embodiment, a deep autoencoder is trained based on the CIC-DDoS2019 dataset to obtain a high-precision DAE model that can accurately identify DDoS attacks. This is of great significance to the field of network security. At the same time, it solves the problems of the inability to accurately identify new attack methods and high false alarm rate in traditional DDoS attack detection.

[0118] The training method of this embodiment can learn the difference between attack traffic and normal traffic by training the CIC-DDoS2019 data set, thereby achieving accurate attack detection. For example, the data set is first preprocessed, and a normalization strategy is used to eliminate the influence of data of different dimensions. Then, a deep autoencoder is used for encoding and decoding operations, and the model is trained by minimizing the reconstruction error in the training set. The trained model can reconstruct the input data and calculate the reconstruction error. When the reconstruction error exceeds the set threshold, the data can be judged as attack traffic.

[0119] In addition, this embodiment also proposes a threshold selection method, which selects the optimal threshold by calculating the accuracy on the verification set. By iteratively updating the threshold, a model that can accurately detect attack traffic and avoid misjudgment as much as possible can be obtained. The threshold-based method of this embodiment can simultaneously detect known and unknown types of DDos attack traffic, thereby improving network robustness and security.

[0120] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0121] Reference Figure 5 , shows a structural block diagram of a DDos attack detection device based on a deep autoencoder provided in an embodiment of the present invention, which may specifically include the following units:

[0122] A characteristic data acquisition unit, used to acquire characteristic data of the service flow to be detected;

[0123] A model detection unit, used to input feature data x in the service traffic and label information preset for the feature data into a trained deep autoencoder DAE model to obtain reconstructed feature data x' output by the DAE model;

[0124] A judgment unit is used to obtain the reconstruction error of the feature data x and the reconstructed feature data x', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current business traffic has a DDos attack;

[0125] The adaptive threshold is an optimal value determined according to the measurement index of the DAE model after the trained DAE model is used to process the feature data in the validation set and / or the test set and the detection data and obtain the reconstruction error.

[0126] The DDos attack detection device of this embodiment can adapt to the attack detection needs in different environments, without confirming whether it is a known type of DDos attack or an unknown type of DDos attack, and can effectively improve the security of the network and reduce the impact of DDoS attacks on the system. It has high feasibility and effect in practical applications and can improve the security and stability of the network. This is of great significance to the field of network security. At the same time, it solves the problems of the inability to accurately identify new attack methods and high false alarm rate in traditional DDoS attack detection.

[0127] Specifically, the above-mentioned device can be applied to DDos attack detection of websites and Web applications. DDos attack detection can effectively identify and mitigate attacks on Web servers to ensure the normal operation of the website; or, companies that provide online services or open APIs can perform detection to protect these services from attacks and ensure that users can access them smoothly; or, financial institutions and e-commerce websites require highly reliable services, and the device of this embodiment can be deployed to improve reliability; or, it can be deployed in a game server to maintain the smoothness of the gaming experience through DDos attack detection; and, for the stable operation of government websites or public service systems, the detection device of this embodiment is deployed to ensure the DDos defense mechanism, and further, it can also provide services for cloud service providers.

[0128] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0129] In addition, an embodiment of the present invention further provides an electronic device, such as Figure 6 As shown, it includes a processor 1301, a communication interface 1302, a memory 1303 and a communication bus 1304, wherein the processor 1301, the communication interface 1302, and the memory 1303 communicate with each other through the communication bus 1304.

[0130] Memory 1303, used for storing computer programs;

[0131] The processor 1301 is used to implement the following steps when executing the program stored in the memory 1303:

[0132] Obtain characteristic data of the service traffic to be detected;

[0133] Input the feature data X in the service traffic and the preset label information of the feature data into the trained deep autoencoder DAE model to obtain the reconstructed feature data X' output by the DAE model;

[0134] Obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current business traffic is under DDos attack;

[0135] The adaptive threshold is an optimal value determined according to a measurement indicator of the DAE model after the trained DAE model is used to process feature data in the validation set and / or the test set and obtain the reconstruction error.

[0136] Alternatively, implement the following steps:

[0137] Preprocess the specified data set and randomly sample to obtain training set, validation set and test set;

[0138] The training set is used to train the deep autoencoder DAE model to obtain the trained DAE model;

[0139] The trained DAE model is verified using the verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold.

[0140] The adaptive threshold is a reference standard for the trained DAE model to detect whether there are known and / or unknown types of DDos attacks in the business traffic.

[0141] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0142] The communication interface is used for communication between the above terminal and other devices.

[0143] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0144] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0145] like Figure 7 As shown, in another embodiment provided by the present invention, a computer-readable storage medium 1401 is also provided, in which instructions are stored. When the computer-readable storage medium 1401 is run on a computer, the computer executes the DDos attack detection method based on the deep autoencoder described in the above embodiment.

[0146] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the DDos attack detection method based on deep autoencoder described in the above embodiment.

[0147] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0148] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0149] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0150] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A DDos attack detection method based on deep autoencoder, characterized in that: include: Obtain characteristic data of the service traffic to be detected; Input the feature data X in the service traffic and the preset label information of the feature data into the trained deep autoencoder DAE model to obtain the reconstructed feature data X' output by the DAE model; Obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current business traffic is under DDos attack; The adaptive threshold is an optimal value determined according to a measurement indicator of the DAE model after the trained DAE model is used to process feature data in the validation set and / or the test set and obtain the reconstruction error.

2. The method according to claim 1, characterized in that The method further comprises: Preprocess the specified data set and randomly sample to obtain training set, validation set and test set; The DAE model is trained using the training set to obtain a trained DAE model; The trained DAE model is verified using the verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold. The test set is used to test the result of the DAE model. If a better threshold exists during the test, the adaptive threshold is updated.

3. The method according to claim 2, characterized in that The DAE model includes: an input layer, an encoding layer, a decoding layer and an output layer; The encoding layer includes two encoders, the decoding layer includes two decoders, and the encoding layer and the decoding layer are completely symmetrical; The DAE model is trained using the training set to obtain the trained DAE model, including: In the encoding stage, the encoding function f is used to transform the initial input feature data x into the hidden representation h, which is calculated using formula (1), where σ is the sigmoid function, W is the weight, and b is the bias; h=f(x)=σ(Wx+b) Formula (1) In the decoding stage, the function g is used to reconstruct the hidden representation h into x', and the nonlinear activation function σ' is selected for reconstruction. W' represents the weight, b' represents the bias, and the reconstruction is performed using formula (2): x'=g(h)=σ'(W'h+b') Formula (2) The back propagation algorithm is used to find the parameters θ = {W, b, b'} to minimize the objective function in the training set D. The objective function J(θ) is: L is the reconstruction error, i represents the sequence number of the feature data in the training set; When the objective function J(θ) is minimized, the trained DAE model is obtained.

4. The method according to claim 2 or 3, characterized in that: The trained DAE model is verified using the verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold, including: Use the trained DAE model to process the feature data x in the training set D to obtain the maximum reconstruction error Max_RE and the minimum reconstruction error Min_RE; In the initialization stage, Max_RE is used as the optimal threshold, and the trained DAE model is used to process each feature data in the validation set to obtain the reconstruction error RE of each feature data. Based on the reconstruction error of each feature data, the reconstruction error RE of all feature data is compared with the optimal threshold to obtain the detection results of all feature data, and the measurement index is used for measurement, and the reconstruction error RE of the measurement index greater than the largest measurement index among the specified measurement indexes is selected as the updated optimal threshold, i.e., the adaptive threshold; Otherwise, Max_RE is reduced by a specified value as the updated optimal threshold, and the reconstruction error RE of all feature data is repeatedly compared with the optimal threshold Max_RE until the optimal threshold is selected.

5. The method according to claim 4, characterized in that Also includes: During the test set testing process, if the reconstruction error of all feature data in the test set is compared with the adaptive threshold, the detection results of all feature data in the test set are obtained, and the measurement index is used for measurement. If there is a measurement index that is greater than the optimal threshold in the validation set, the reconstruction error RE to which the measurement index belongs is used as the adaptive threshold.

6. The method according to claim 5, characterized in that The measurement indicator is accuracy. Alternatively, the measurement indicators include: Accuracy, Precision, Recall, and F1 indicators. TP is a true positive example where the prediction is correct and the actual situation is also correct, TN is a true negative example where the prediction is incorrect and the actual situation is also incorrect, FP is a false positive example where the prediction is incorrect but the actual situation is correct, and FN is a false negative example where the prediction is correct but the actual situation is incorrect.

7. A training method for a DDos attack detection model, characterized in that: include: Preprocess the specified data set and randomly sample to obtain training set, validation set and test set; The training set is used to train the deep autoencoder DAE model to obtain the trained DAE model; The trained DAE model is verified using the verification set. During the verification process, the optimal threshold of the verification set is obtained as the initial value of the adaptive threshold. The adaptive threshold is a reference standard for the trained DAE model to detect whether there are known and / or unknown types of DDos attacks in the business traffic.

8. The method according to claim 7, characterized in that Also includes: The test set is used to test the result of the DAE model. If a better threshold exists during the test, the adaptive threshold is updated.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 8 when executing the program stored in the memory.

10. A DDos attack detection device based on deep autoencoder, characterized in that: include: A characteristic data acquisition unit, used to acquire characteristic data of the service flow to be detected; A model detection unit, used to input feature data X in the service traffic and label information preset for the feature data into a trained deep autoencoder DAE model to obtain reconstructed feature data X' output by the DAE model; A judgment unit is used to obtain the reconstruction error of the feature data X and the reconstructed feature data X', and compare it with the adaptive threshold. If it is greater than the adaptive threshold, it is confirmed that the current business traffic has a DDos attack; The adaptive threshold is an optimal value determined according to the measurement index of the DAE model after the trained DAE model is used to process the feature data in the validation set and / or the test set and the detection data and obtain the reconstruction error.

Images