Space-time network Boolean tomography method and system for confronting congestion attack

Abstract

The invention discloses a time-space network Boolean tomography method and system for resisting congestion attacks, and belongs to the field of communication, and the method comprises the following steps: obtaining a multi-time-slot path observation result on a network topology to be measured; carrying out congestion attack detection through a congestion attack detection algorithm based on Fisher divergence; if the attack is detected, determining the position of an attacked path by using a K-Means clustering method, and further finding the position of an attacked link by using a Tomo algorithm; and carrying out congestion link identification by using a maximum F-measure congestion link identification algorithm. According to the method, the problems that an existing network Boolean tomography method cannot cope with congestion attacks and is high in false negative rate are solved, higher weight can be given to the false negative rate (FNR), so that negative effects caused by the congestion attacks are effectively relieved, the false negative rate is reduced, and the congestion attacks are timely and effectively coped with.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to a space-time network Boolean tomography method and system for resisting congestion attacks. Background Art

[0002] The Internet is composed of many autonomous systems. Due to security and privacy considerations, autonomous systems are usually unwilling to share link-level performance parameters, so it is impossible to directly monitor every link in the Internet. In addition, the cost of monitoring each link far exceeds its benefits.

[0003] Network tomography breaks through these limitations. It does not require access to the internal network and can infer the required link-level performance parameters (such as packet loss rate and delay) based on a small amount of end-to-end path measurement results. It accurately captures the performance of the target link through a clever end-to-end path detection design, such as the "back-to-back" detection method for measuring link delay and the "sandwich" detection method for identifying the hops of shared links. Obviously, if the packet loss rate or delay of the link is known, it is easy to diagnose whether the link is congested, but this requires a highly complex detection scheme with a high error rate. Therefore, the network Boolean tomography method converts accurate numerical estimates into robust Boolean qualitative estimates. Under the routing constraints between given links and paths, the Boolean state of the internal links of the network is inferred based on the Boolean state of the end-to-end path.

[0004] Network Boolean tomography is ill-posed because the number of links in the actual network topology is usually greater than the number of paths, so a path observation result may correspond to multiple possible congested link set solutions. In order to solve the ill-posedness of network Boolean tomography, it is necessary to select the most reasonable congested link identification algorithm according to certain optimization criteria. There are many existing congested link identification algorithms, such as the Maximum A Posteriori Algorithm (MAP), the Boolean Satisfiability Problem (SAT), and the Congested Link Identification (CLINK). Among them, the MAP algorithm searches for the congested link set with the largest a posteriori probability based on the prior congestion probability of the link; the SAT algorithm treats network Boolean tomography as a Boolean satisfiability problem to find the minimum number of congested link sets; the CLINK algorithm is a greedy algorithm based on the MAP algorithm, which identifies congested links in the network by gradually selecting the optimal link.

[0005] Among the commonly used network Boolean tomography methods, the MAP algorithm has a high false negative rate (FNR) when facing congestion attacks. The reasoning results of the MAP algorithm are predictable, and network Boolean tomography is ill-posed. Attackers can inject large link delays into links other than the links predicted by the MAP algorithm to conceal the attack, causing the MAP algorithm to be unable to detect the attack. This concealment increases the false negative rate and continuously causes network performance to deteriorate.

[0006] Since the network Boolean tomography method itself is ill-posed, malicious attackers can use this feature to launch congestion attacks on links. Since most existing methods only rely on single-time slot information for analysis, it is difficult to effectively detect such attacks, resulting in a high false negative rate. Link congestion attacks can cause the joint distribution of path states to shift. Therefore, by analyzing the hidden information in multi-time slot observation data, the path state shift affected by the attack can be effectively identified, thereby detecting the attack.

[0007] Based on the above analysis, there is an urgent need for a reliable network Boolean tomography method with congestion attack perception capability and a new congestion identification strategy. Summary of the invention

[0008] In order to solve the problem that the existing network Boolean tomography method cannot cope with congestion attacks and has a high false negative rate, the present invention provides a spatiotemporal network Boolean tomography method and system for resisting congestion attacks.

[0009] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0010] The present invention provides a spatiotemporal network Boolean tomography method for resisting congestion attacks, which specifically includes the following steps:

[0011] Step S1: obtaining multi-slot path observation results on the network topology to be measured;

[0012] Step S2: Perform congestion attack detection based on Fisher divergence congestion attack detection algorithm;

[0013] Step S3: If an attack is detected, the K-Means clustering method is first used to determine the location of the attacked path, and then the Tomo algorithm is used to further find the location of the attacked link;

[0014] Step S4: Congested links are identified using a congested link identification algorithm that maximizes F-measure.

[0015] Furthermore, in step S1, a multi-congested link path state model is established, and the path state is subdivided into: good, represented by 0; single congested link path, represented by 1; multi-congested link path, represented by >1; path state y j + and the status x of all links on the path i The following logical relationship exists:

[0016]

[0017] In a single time slot, the collected path observation results are represented as a vector Y, and the link status is represented as a vector X; in multiple time slots, the collected path observation results constitute a matrix Y, and the link status constitutes a matrix X.

[0018] Furthermore, the specific implementation process of step S2 is as follows:

[0019] S2.1: Multi-slot path observations in non-attack scenarios Add a small multivariate Gaussian noise ε to the current multi-slot path observation value Y, and we get and Y';

[0020] S2.2: Based on the multi-slot path observations in the non-attack scenario Get the Fisher divergence set {F' corresponding to each non-attack path j (b)|b=1,...,B};

[0021] S2.3: Based on and Y' to solve each path p j The corresponding Fisher divergence F j ;

[0022] S2.4: According to the Fisher divergence set {F' j (b)|b=1,...,B}, and the confidence interval method is used to determine the probability of each path p j The threshold τ j ;

[0023] S2.5: For each path p j Fisher divergence F j and threshold τ j Compare them one by one; once F appears j >τ j If the attack is successful, it is considered to be attacked; otherwise, it is considered not to be attacked.

[0024] Furthermore, in step S2.2, the multi-slot path observation value in the non-attack scenario Randomly divided into two and Use the multivariate Gaussian model to fit and get the joint distribution and For each path p j , use formula (3) and Monte Carlo method to approximate the joint distribution and Fisher divergence F' j ; Repeat the above operation B times, each path p j There is a Fisher divergence set {F' j (b)|b=1,...,B};

[0025]

[0026] Among them, F j represents the Fisher divergence, represents the state distribution of the path in the non-attack scenario, Ω(Y) represents the state distribution of the current path, and the symbol represents mathematical expectation.

[0027] Furthermore, in step S2.3, the multi-slot path observation value in the non-attack scenario and Y' are fitted using a multivariate Gaussian model to obtain the joint distribution and Ω; for each path p j , use formula (3) and Monte Carlo method to approximate the joint distribution and the Fisher divergence F of Ω j .

[0028] Furthermore, in step S2.4, the Fisher divergence set is sorted and the boundary value of the 95% confidence interval is used as the threshold τ j .

[0029] Furthermore, the specific implementation process of the K-Means clustering method is as follows:

[0030] Measure each path p j The difference in the empirical congestion probability of Δ in two multi-slots j :

[0031]

[0032] Among them, Y(j,t) represents the path p j The observation result at time t is: represents the indicator function, #{Y(:,t)} represents the current number of multi-slot observations, represents the number of multi-slot observations without attack; using two features (F j , Δ j) to perform K-Means clustering to distinguish non-attacked paths from attacked paths; since the attack increases the probability of path congestion, the cluster with a larger centroid is the attacked path.

[0033] Furthermore, the specific implementation process of the congested link identification algorithm that maximizes F-measure is as follows:

[0034] (1) For each Y in the current multi-slot path observation value Y, find all feasible congested link solutions S(Y);

[0035] (2) Obtain the posterior probability of each feasible congested link solution S(Y) based on the prior probability, and then sort each feasible congested link solution S(Y) according to the posterior probability; select the first few solutions with large posterior probabilities from each feasible congested link solution S(Y), and use these solutions to update S(Y);

[0036] (3) For each solution Assume that it is the true solution, that is, w i = 100%, for all j≠i, w j =0%, and the F-measure value to be optimized is calculated based on this

[0037] (4) Maximum F-measure value The corresponding solution It is the congested link solution identified by the congested link identification algorithm.

[0038] (5) Repeat the above steps to obtain the congested link solution of the current multi-slot path observation value Y

[0039] Furthermore, the F-measure value to be optimized The calculation formula is:

[0040]

[0041] Among them, w k represents the probability of the kth solution, S(Y) represents the set of feasible congested link solutions, represents the true solution, represents the solution of the congested link identification algorithm, represents any possible solution of the congested link identification algorithm, Indicates that the link state is given by the observation result Y The conditional probability of The true solution and congestion identification algorithm The F1 value between.

[0042] The present invention provides a space-time network Boolean tomography system for resisting congestion attacks, which is used to implement the space-time network Boolean tomography method for resisting congestion attacks. The system mainly includes:

[0043] A multi-congested link path state model building module is used to build a multi-congested link path state model and use the multi-congested link path state model to obtain multi-time slot path observation results on the network topology to be measured;

[0044] Congestion attack detection module, used for the congestion attack detection algorithm based on Fisher divergence, which uses Fisher divergence to measure the difference between the empirical distributions of multi-slot path states;

[0045] The congestion attack location module is used to determine the location of the attacked path using the K-Means clustering method when an attack is detected, and then use the classic Tomo algorithm to further find the location of the attacked link;

[0046] The congested link identification module is used to identify congested links by using a congested link identification algorithm that maximizes F-measure.

[0047] The beneficial effects of the present invention are:

[0048] The present invention provides a space-time network Boolean tomography method for resisting congestion attacks, which is mainly realized by a congestion attack detection method based on Fisher divergence and a congestion link identification method with F-measure as the optimization target. Among them, the congestion attack detection algorithm based on Fisher divergence used in the present invention uses Fisher divergence to measure the joint distribution displacement of multi-time slot path states, that is, the difference between the multi-time slot path state distributions, uses a self-help confidence interval threshold to detect whether it is subjected to a congestion attack, and locates the attacked path by clustering. In addition, the present invention also uses a congestion link identification algorithm with F-measure as the optimization target to identify congested links under attack conditions. Different from the maximization of the posterior probability of the traditional MAP algorithm, the congestion link identification algorithm used in the present invention is committed to maximizing F-measure. This optimization method can give a higher weight to the false negative rate (FNR), thereby effectively reducing the negative impact of congestion attacks, reducing the false negative rate, and responding to congestion attacks in a timely and effective manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flow chart of a spatiotemporal network Boolean tomography method for combating congestion attacks provided by the present invention.

[0050] Figure 2 This is the flow chart of the congestion attack detection algorithm based on Fisher divergence.

[0051] Figure 3 Flowchart of the congested link identification algorithm for maximizing F-measure.

[0052] Figure 4 The performance of attack detection, path localization, and link localization under different attack frequencies.

[0053] Figure 5 The performance of CLIF algorithm, CLIF+ algorithm, MAP algorithm, CLINK algorithm and SAT algorithm under different congestion probabilities. DETAILED DESCRIPTION

[0054] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0055] In a first aspect, the present invention provides a spatiotemporal network Boolean tomography method for combating congestion attacks.

[0056] See also Figure 1 As shown, the present invention provides a spatiotemporal network Boolean tomography method for resisting congestion attacks, and its specific implementation process is as follows:

[0057] Step S1: obtaining multi-slot path observation results on the network topology to be measured;

[0058] In the network Boolean tomography method, the link and path states are divided into two types: congested (represented by 1) and good (represented by 0). j and the status x of all links on the path i The following logical relationship exists:

[0059]

[0060] Among them, l i ∠p j Indicates link l i In the path p j Above, the symbol V represents the Boolean OR operation.

[0061] Based on this, the present invention establishes a multi-congested link path state model, and further subdivides the path state into three types: good (indicated by 0), single congested link path (indicated by 1) and multi-congested link path (indicated by >1). j + and the status x of all links on the path i The following logical relationship exists:

[0062]

[0063] In a single time slot, the collected path observation results are represented as a vector Y, and the link status is also represented as a vector X; in multiple time slots, the collected path observation results constitute a matrix Y, and the link status also constitutes a matrix X.

[0064] Step S2: Congestion attack detection through Fisher divergence;

[0065] The congestion attack detection algorithm of the present invention is based on Fisher divergence, and Fisher divergence is used to measure the difference between the empirical distributions of multi-slot path states. The Fisher divergence formula is as follows:

[0066]

[0067] in, represents the state distribution of the path in the non-attack scenario, Ω(Y) represents the state distribution of the current path, and the symbol represents mathematical expectation.

[0068] like Figure 2 As shown in the figure, the specific implementation process of the congestion attack detection algorithm based on Fisher divergence is as follows:

[0069] S2.1: Multi-slot path observations in non-attack scenarios Add a small multivariate Gaussian noise ε to the current multi-slot path observation value Y, and we get and Y', so that it can fit the multivariate Gaussian model.

[0070] S2.2: Based on the multi-slot path observations in the non-attack scenario Get the Fisher divergence set {F' corresponding to each non-attack path j (b)|b=1,...,B}.

[0071] Specifically, the multi-slot path observations in the non-attack scenario are Randomly divided into two and Use the multivariate Gaussian model to fit and get the joint distribution and For each path p j , use formula (3) and Monte Carlo method to approximate the joint distribution and Fisher divergence F' j Repeat all the above operations B times, each path p j There is a Fisher divergence set {F' j (b)|b=1,...,B}.

[0072] S2.3: Based on and Y' to solve each path p j The corresponding Fisher divergence F j .

[0073] Specifically, for the multi-slot path observations in the non-attack scenario and Y' are fitted using a multivariate Gaussian model to obtain the joint distribution and Ω. For each path p j , use formula (3) and Monte Carlo method to approximate the joint distribution and the Fisher divergence F of Ω j .

[0074] S2.4: According to the Fisher divergence set {F' j (b)|b=1,...,B}, and the confidence interval method is used to determine the probability of each path p j The threshold τ j .

[0075] Specifically, for the Fisher divergence set {F' j (b) |b=1,...,B} are sorted and the boundary value of the 95% confidence interval is used as the threshold τ j .

[0076] S2.5: For each path p j Fisher divergence F j and threshold τ j Compare them one by one; once F appears j >τ j If the attack is successful, it is considered to be attacked; otherwise, it is considered not to be attacked.

[0077] Step S3: Use clustering to locate congestion attacks;

[0078] Specifically, if an attack is detected in step S2, the K-Means clustering method is first used to determine the location of the attacked path, and then the classic Tomo algorithm is used to further find the location of the attacked link.

[0079] The specific implementation process of using the K-Means clustering method to determine the location of the attacked path is as follows:

[0080] The present invention measures each path p j The difference in the empirical congestion probability of Δ in two multi-slots j :

[0081]

[0082] Among them, Y(j,t) represents the path pj The observation result at time t is: represents the indicator function, #{Y(:,t)} represents the current number of multi-slot observations, Represents the number of multi-slot observations without attack.

[0083] The present invention uses two features (F j , Δ j ) to perform K-Means clustering to distinguish non-attacked paths from attacked paths. Since the attack increases the probability of path congestion, the cluster with a larger centroid is the attacked path.

[0084] The specific implementation process of using the classic Tomo algorithm to further find the location of the attacked link is as follows:

[0085] Given the attacked path and network topology, the network Boolean tomography method can be used to solve the attacked link. The present invention uses the classic Tomo algorithm to locate the attacked link. The Tomo algorithm usually sets the shared link as the attacked link.

[0086] Step S4: Identify congested links by optimizing F-measure;

[0087] The present invention defines that when a path observation result Y of a given single time slot is given, the F-measure value to be optimized is:

[0088]

[0089] Among them, w k represents the probability of the kth solution, S(Y) represents the set of feasible congested link solutions, represents the true solution, represents the solution of the congested link identification algorithm, represents any possible solution of the congested link identification algorithm, Indicates that the link state is given by the observation result Y The conditional probability of The true solution and congestion identification algorithm Since each time slot is independent of each other, the F-measure can be optimized separately in each time slot to identify congested links.

[0090] The present invention proposes a congested link identification algorithm by optimizing the F-measure (CLIF for short). At present, the CLIF algorithm divides the path status into congested or good. If a multi-congested link path status model is adopted, the CLIF algorithm can be further expanded to a CLIF+ algorithm.

[0091] In the present invention, Figure 3 As shown in the figure, the specific implementation process of the CLIF algorithm is as follows:

[0092] (1) For each Y in the current multi-slot path observation value Y, find all feasible congested link solutions S(Y);

[0093] (2) Obtain the posterior probability of each feasible congested link solution S(Y) based on the prior probability, and then sort each feasible congested link solution S(Y) according to the posterior probability; select the first few solutions with large posterior probabilities from each feasible congested link solution S(Y), and use these solutions to update S(Y);

[0094] (3) For each solution Assume that it is the true solution, that is, w i = 100%, for all j≠i, w j =0%, and the F-measure value to be optimized is obtained according to formula (5)

[0095] (4) Maximum F-measure value The corresponding solution It is the congested link solution identified by the congested link identification algorithm.

[0096] (5) Repeat the above steps to obtain the congested link solution of the current multi-slot path observation value Y

[0097] In a second aspect, the present invention provides a space-time network Boolean tomography system for resisting congestion attacks, which is mainly used to implement a space-time network Boolean tomography method for resisting congestion attacks provided in the first aspect of the present invention.

[0098] The present invention provides a space-time network Boolean tomography system for resisting congestion attacks, which mainly includes the following modules: a multi-congestion link path state model building module, a congestion attack detection module, a congestion attack positioning module, and a congestion link identification module. The specific functions and effects of each module are as follows:

[0099] A multi-congested link path state model building module is used to build a multi-congested link path state model and use the multi-congested link path state model to obtain multi-time slot path observation results on the network topology to be measured;

[0100] The congestion attack detection module is mainly used for the congestion attack detection algorithm based on Fisher divergence, which uses Fisher divergence to measure the difference between the empirical distributions of multi-slot path states;

[0101] The congestion attack location module is mainly used to determine the location of the attacked path using the K-Means clustering method when an attack is detected, and then use the classic Tomo algorithm to further find the location of the attacked link;

[0102] The congested link identification module is mainly used to identify congested links using the congested link identification algorithm that maximizes F-measure.

[0103] In order to verify the effect of the space-time network Boolean tomography method and system for counteracting congestion attacks provided by the present invention, experiments were conducted to verify the specific performance of the present invention in attack detection, path location and link location at different attack frequencies. Figure 4 As shown in the figure, under different attack frequencies (25%, 50%, 75%, 100%), the accuracy of attack detection and F1 score always remain above 90%, while the accuracy and F1 score of the attacked path are also maintained above 80%. As the attack frequency increases, the accuracy and F1 score of the attacked link also increase. This is because a higher attack frequency leads to an increase in the probability of congestion for each link, allowing the Tomo algorithm to detect these links more effectively.

[0104] The performance of the CLIF algorithm, CLIF+ algorithm and existing algorithms (MAP algorithm, CLINK algorithm and SAT algorithm) under different congestion probabilities was verified by experiments. Figure 5 As shown in the figure, CLIF and CLIF+ surpass other algorithms in all performance indicators, and their false positive rate (FNR) is significantly lower than other algorithms, which fully proves the effectiveness of the optimization strategy of the present invention. Since the CLIF+ algorithm adopts a multi-congested link path state model, it can provide richer information, so it outperforms the CLIF algorithm in performance.

[0105] The present invention provides a space-time network Boolean tomography method and system for counteracting congestion attacks, which can not only effectively detect congestion attacks that the traditional Boolean tomography method (MAP) cannot cope with, but also accurately locate the attacked paths and links. The congested link identification algorithms CLIF and CLIF+ proposed in the present invention significantly reduce the false negative FNR and greatly improve the identification performance of congested links compared with existing algorithms such as MAP, CLINK, and SAT.

[0106] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A spatiotemporal network Boolean tomography method for counteracting congestion attacks, characterized in that: The following steps are involved: Step S1: obtaining multi-slot path observation results on the network topology to be measured; Step S2: Perform congestion attack detection based on Fisher divergence congestion attack detection algorithm; Step S3: If an attack is detected, the K-Means clustering method is first used to determine the location of the attacked path, and then the Tomo algorithm is used to further find the location of the attacked link; Step S4: Congested links are identified using a congested link identification algorithm that maximizes F-measure.

2. A spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 1, characterized in that: In step S1, a multi-congested link path state model is established, and the path state is subdivided into: good, represented by 0; single congested link path, represented by 1; multi-congested link path, represented by >1; path state y j + and the status x of all links on the path i The following logical relationship exists: In a single time slot, the collected path observation results are represented as a vector Y, and the link status is represented as a vector X; in multiple time slots, the collected path observation results constitute a matrix Y, and the link status constitutes a matrix X.

3. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 1, characterized in that: The specific implementation process of step S2 is as follows: S2.1: Multi-slot path observations in non-attack scenarios Add a small multivariate Gaussian noise ε to the current multi-slot path observation value Y, and we get and Y'; S2.2: Based on the multi-slot path observations in the non-attack scenario Get the Fisher divergence set {F' corresponding to each non-attack path j (b)|b=1,...,B}; S2.3: Based on and Y' to solve each path p j The corresponding Fisher divergence F j ; S2.4: According to the Fisher divergence set {F' j (b)|b=1,...,B}, and the confidence interval method is used to determine the probability of each path p j The threshold τ j ; S2.5: For each path p j Fisher divergence F j and threshold τ j Compare them one by one; once F appears j >τ j If the attack is successful, it is considered to be attacked; otherwise, it is considered not to be attacked.

4. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 3 is characterized in that: In step S2.2, the multi-slot path observation value in the non-attack scenario is Randomly divided into two and Use the multivariate Gaussian model to fit and get the joint distribution and For each path p j , use formula (3) and Monte Carlo method to approximate the joint distribution and Fisher divergence F' j ; Repeat the above operation B times, each path p j There is a Fisher divergence set {F' j (b)|b=1,...,B}; Among them, F j represents the Fisher divergence, represents the state distribution of the path in a non-attack scenario, Ω(Y) represents the state distribution of the current path, and the symbol E represents the mathematical expectation.

5. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 4, characterized in that: In step S2.3, the multi-slot path observation value in the non-attack scenario and Y' are fitted using a multivariate Gaussian model to obtain the joint distribution and Ω; for each path p j , use formula (3) and Monte Carlo method to approximate the joint distribution and the Fisher divergence F of Ω j .

6. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 3, characterized in that: In step S2.4, the Fisher divergence set {F' j (b) |b=1,...,B} are sorted and the boundary value of the 95% confidence interval is used as the threshold τ j .

7. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 1, characterized in that: The specific implementation process of the K-Means clustering method is as follows: Measure each path p j The difference in the empirical congestion probability of Δ in two multi-slots j : Among them, Y(j,t) represents the path p j The observation result at time t is: represents the indicator function, #{Y(:,t)} represents the current number of multi-slot observations, represents the number of multi-slot observations without attack; using two features (F j , Δ j ) to perform K-Means clustering to distinguish non-attacked paths from attacked paths; since the attack increases the probability of path congestion, the cluster with a larger centroid is the attacked path.

8. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 1, characterized in that: The specific implementation process of the congested link identification algorithm that maximizes F-measure is as follows: (1) For each Y in the current multi-slot path observation value Y, find all feasible congested link solutions S(Y); (2) Obtain the posterior probability of each feasible congested link solution S(Y) based on the prior probability, and then sort each feasible congested link solution S(Y) according to the posterior probability; select the first few solutions with large posterior probabilities from each feasible congested link solution S(Y), and use these solutions to update S(Y); (3) For each solution Assume that it is the true solution, that is, w i = 100%, for all j≠i, w j =0%, and the F-measure value to be optimized is calculated based on this (4) Maximum F-measure value The corresponding solution It is the congested link solution identified by the congested link identification algorithm. (5) Repeat the above steps to obtain the congested link solution of the current multi-slot path observation value Y 9. The spatiotemporal network Boolean tomography method for resisting congestion attacks according to claim 8, characterized in that: The F-measure value to be optimized The calculation formula is: Among them, w k represents the probability of the kth solution, S(Y) represents the set of feasible congested link solutions, represents the true solution, represents the solution of the congested link identification algorithm, represents any possible solution of the congested link identification algorithm, Indicates that the link state is given by the observation result Y The conditional probability of The true solution and congestion identification algorithm The F1 value between.

10. A spatiotemporal network Boolean tomography system for counteracting congestion attacks, characterized in that: The system is used to implement a spatiotemporal network Boolean tomography method for resisting congestion attacks as described in any one of claims 1 to 9, comprising: A multi-congested link path state model building module is used to build a multi-congested link path state model and use the multi-congested link path state model to obtain multi-time slot path observation results on the network topology to be measured; Congestion attack detection module, used for the congestion attack detection algorithm based on Fisher divergence, which uses Fisher divergence to measure the difference between the empirical distributions of multi-slot path states; The congestion attack location module is used to determine the location of the attacked path using the K-Means clustering method when an attack is detected, and then use the classic Tomo algorithm to further find the location of the attacked link; The congested link identification module is used to identify congested links by using a congested link identification algorithm that maximizes F-measure.

Images