DDoS attack real-time detection and traceability analysis method based on knowledge graph

Abstract

The invention relates to the technical field of network security, and discloses a DDoS attack real-time detection and traceability analysis method based on a knowledge graph. The system comprises a data acquisition module, a dynamic knowledge graph construction module, a dynamic knowledge graph updating module, an anomaly detection module, an attack chain traceability module and a visualization module. Network flow data is collected in real time, a dynamic knowledge graph with a network entity as a node and a communication relation as an edge is constructed, a dynamic model is combined to analyze the node state change rate, abnormal nodes are accurately detected, and attack paths are identified and attack sources are positioned through reverse derivation and path weight optimization technologies. Visual results generated by the system support visual display and analysis of abnormal behaviors, and meanwhile, a structured report is provided, so that a manager can make a decision quickly and conveniently. According to the method, the real-time performance of DDoS attack detection, the traceability accuracy and the operability of result analysis in the complex network are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a real-time detection and tracing analysis method for DDoS attacks based on a knowledge graph. Background Art

[0002] In the existing technology, detection and tracing of DDoS attacks mostly rely on static network modeling methods, such as static analysis models based on fixed topology structures or single traffic characteristics. This approach cannot adapt to the dynamic changes of network entities and communication relationships, especially in complex scenarios such as cloud computing and the Internet of Things. Network topology and communication behaviors often change in real time. Traditional static models are difficult to capture these dynamic changes, resulting in a lag in the understanding and description of attack behaviors. In addition, static modeling is usually difficult to effectively express complex relationships between nodes, such as communication behaviors across devices and subnets, which further limits the accuracy of detection and tracing.

[0003] In the existing technology, anomaly detection mostly uses rules or statistical analysis methods based on fixed thresholds, such as judging attack behavior by traffic surges or abnormal request frequencies. However, such methods have significant limitations: on the one hand, fixed thresholds are difficult to adapt to the diverse traffic patterns in different scenarios, and are prone to false positives or false negatives; on the other hand, detection methods based on simple statistical features cannot capture complex network behaviors, such as covert attacks initiated by multiple nodes in collaboration. In addition, existing methods lack continuous modeling of node behavior and cannot perform fine-grained analysis of abnormal behavior from a temporal dimension.

[0004] Existing attack tracing methods mostly rely on technical means such as log analysis and simple reverse path tracing. Log analysis usually has problems such as missing data and fuzzy attack paths, while simple path tracing is difficult to accurately distinguish between the real attack path and the normal communication path, especially in scenarios of multi-node coordinated attacks or cross-subnet attacks. These methods are difficult to restore the complete attack link. In addition, existing methods lack global optimization capabilities during the tracing process and cannot accurately select the optimal path, which may lead to inaccurate tracing results or even misjudgment.

[0005] When outputting detection and tracing results, existing technologies usually present them in text form or simple statistical data. This output form lacks intuitiveness, especially for complex attack links and multi-node correlation analysis. It is difficult for managers to quickly understand the full picture of attack behavior, which in turn affects the efficiency of defense decision-making. In addition, traditional output methods lack dynamic interactive capabilities and cannot provide in-depth detailed analysis in the results or support further tracking of abnormal node behavior. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides a real-time detection and tracing analysis method for DDoS attacks based on knowledge graphs, which solves the problems of the static nature of network modeling, the singleness of the detection method, the lack of accuracy in the tracing process, and the lack of intuitiveness in the expression of the results.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a real-time detection and source tracing analysis method of DDoS attacks based on knowledge graph, comprising the following steps:

[0008] Dynamic knowledge graph construction, with network entities as nodes and communication relationships between entities as edges, to build a knowledge graph containing dynamic changes in nodes and edges. Nodes include IP addresses, hosts, and attack events, and edges include communication flow relationships and access relationships. Edge weights are determined based on flow intensity and communication frequency.

[0009] Dynamic knowledge graph update: collect network traffic data and exception logs in real time through the stream processing framework, and dynamically update the node attributes and edge weights of the knowledge graph;

[0010] Anomaly detection uses the neighbor node states and edge weights of nodes in the knowledge graph to establish a dynamic model of node state changes and detect abnormal nodes based on the rate of change of node states;

[0011] Attack chain tracing starts from the detected abnormal node, reversely deduce the attack path based on the dynamic model, determine the attack link through path weight optimization, and finally identify the attack source;

[0012] Output analysis results, including abnormal nodes, attack links, attack sources, and time series information.

[0013] Preferably, the node attributes of the dynamic knowledge graph include anomaly scores, traffic characteristics and device attributes, and the calculation and processing steps thereof include:

[0014] The calculation of node anomaly score is realized through the cumulative impact value of node state change. The change of node state is affected by the state of its neighboring nodes and edge weight. The cumulative impact value of node state change is defined by the following formula:

[0015]

[0016] Among them, a i (t) is the anomaly score of node i at time t, N(i) is the neighbor set of node i, and w ij (t) is the weight of edge (i,j), g(a j (t)) is the influence function of the abnormal score of neighbor node j, and β is the attenuation factor of the node status;

[0017] Traffic characteristics include traffic size and communication protocol type. Traffic size is calculated by the total amount of data packets between nodes per unit time. The communication protocol type is obtained by parsing the protocol identification field in the network traffic. The representation of traffic characteristics is:

[0018] f i (t)=[Packet_Volume,Protocol_Type]

[0019] Among them, Packet_Volume is the size of the data packet that node i communicates with its neighbor node at time t, and Protocol_Type is the protocol type;

[0020] Device attributes include geographic location and device type. The geographic location is calculated by mapping the node's IP address to the physical location. The device type is obtained by parsing the device identification field. The device attributes are expressed as follows:

[0021] p i (t)=[Geo_Location,Device_Type]

[0022] Among them, Geo_Location is the geographical location information of the node, and Device_Type is the device type of the node;

[0023] The complete attributes of a node are composed of anomaly score, traffic characteristics, and device attributes. The attributes of node i at time t are expressed as:

[0024] x i (t) = [a i (t),f i (t),p i (t)]

[0025] Among them, x i (t) is the complete attribute vector of node i.

[0026] Preferably, the edge weight is determined based on the intensity of communication traffic and access frequency, where the communication traffic intensity represents the number of data packets between nodes per unit time, and the access frequency represents the number of communication requests between nodes.

[0027] Preferably, the anomaly detection is achieved by the following steps:

[0028] According to the neighbor node states and edge weights of nodes in the knowledge graph, a dynamic equation for node state changes is established;

[0029] Based on the change rate of the node status, the abnormal node is judged. If the change rate of the node status exceeds the preset threshold, the node is marked as an abnormal node;

[0030] The global system stability function is used to constrain the detection results to ensure the accuracy of abnormal node marking.

[0031] Preferably, the attack chain tracing is achieved by the following steps:

[0032] Starting from the abnormal node, reversely deduce the attack path layer by layer;

[0033] Based on the path weight optimization method, the global optimal path of the attack path is calculated;

[0034] The path weight is determined by the edge weight and the path time decay factor. The path time decay factor is used to reduce the weight contribution of the path with larger delay;

[0035] Output attack link, including path starting point, relay node and attack source.

[0036] Preferably, the real-time update cycle of the knowledge graph is controlled by the time window of the stream processing framework, and each time window updates the attribute changes of nodes and edges to dynamically generate an updated adjacency matrix.

[0037] Preferably, the attack chain tracing adopts a path search method based on Laplace matrix optimization, and the difference between the node degree matrix and the adjacency matrix is ​​used to describe the optimal choice of the path.

[0038] Preferably, the influence of the abnormal node state change on the neighboring nodes is converted through a nonlinear activation function, and the nonlinear activation function includes a Sign function or a ReLU function.

[0039] Preferably, the system stability of the anomaly detection is defined by a Lyapunov function, which represents the sum of squares of anomaly scores of all nodes in the system, ensuring that node state changes meet stability constraints.

[0040] Preferably, the present invention also provides a real-time detection and source tracing analysis system for DDoS attacks based on a knowledge graph, comprising:

[0041] Data collection module, used to collect network traffic data and abnormal logs in real time;

[0042] A dynamic knowledge graph construction module is used to construct a dynamic knowledge graph with network entities as nodes and communication relationships between entities as edges;

[0043] The dynamic knowledge graph update module is used to update the node attributes and edge weights of the knowledge graph in real time according to the data collected by the data collection module;

[0044] An anomaly detection module, used to detect abnormal nodes according to the change rate of node status using a dynamic model;

[0045] The attack chain tracing module is used to reversely deduce the attack path based on the dynamic model and determine the attack link by combining the path weight optimization;

[0046] The visualization module is used to output anomaly detection results, attack links, and attack source information.

[0047] The present invention provides a real-time detection and source tracing analysis method for DDoS attacks based on knowledge graphs. It has the following beneficial effects:

[0048] 1. The present invention adopts a technical solution of dynamic knowledge graph construction and real-time update, and reflects the dynamic changes in the network environment in real time through a knowledge graph model with network entities as nodes and communication relationships as edges. It achieves the technical effect of accurate modeling and efficient updating of nodes and relationships in the network. Compared with the technical solution of using static network models or fixed topology structures in the prior art, it solves the problem of being unable to reflect the dynamic changes of the network and the complexity of communication behaviors in real time.

[0049] 2. The present invention adopts a node anomaly detection technical solution based on a dynamic model, and realizes accurate detection of abnormal nodes by calculating the node state change rate and combining it with anomaly scoring, achieving the technical effect of quickly identifying attack behaviors in large-scale networks. Compared with the technical solutions in the prior art that rely on fixed thresholds or statistical methods, it solves the problems of insufficient detection sensitivity and limited ability to identify complex attack behaviors.

[0050] 3. The present invention adopts a technical solution based on reverse deduction and path weight optimization based on a dynamic model, and performs global path optimization by comprehensively considering the node propagation relationship and the weight of the edge, achieving the technical effect of accurately restoring the attack link and effectively locating the attack source. Compared with the technical solution in the prior art that simply relies on log analysis or simple backtracking, it solves the problems of incomplete tracing paths and inaccurate tracing results.

[0051] 4. The present invention adopts the technical solution of visual display and structured analysis report output, and achieves the technical effect of facilitating security managers to quickly understand attack behaviors by generating intuitive attack link topology diagrams and node state change curves, combined with detailed anomaly detection and attack source location information. Compared with the technical solution of outputting text or simple statistical results in the prior art, it solves the shortcomings of non-intuitive expression of analysis results and low efficiency of information extraction. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is a flow chart of the method of the present invention;

[0053] Figure 2 It is a system architecture diagram of the present invention. DETAILED DESCRIPTION

[0054] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] Please refer to the attached Figure 1 The embodiment of the present invention provides a real-time detection and source tracing analysis method of DDoS attacks based on knowledge graph, comprising the following steps:

[0056] S1. Dynamic knowledge graph construction, with network entities as nodes and communication relationships between entities as edges, to build a knowledge graph containing dynamic changes in nodes and edges. Nodes include IP addresses, hosts, and attack events, and edges include communication flow relationships and access relationships. Edge weights are determined based on flow intensity and communication frequency.

[0057] This step is mainly aimed at the structured modeling of network entities. Through the construction of knowledge graphs, a dynamic description of network traffic and the relationship between entities is realized, providing data support for the detection and tracing of DDoS attacks. The method of the present invention uses network entities as nodes and communication relationships as edges to construct a dynamic knowledge graph, in which the attributes of nodes and edges are modeled based on traffic characteristics and communication behaviors. This step is the basis for realizing real-time updating of dynamic knowledge graphs and anomaly detection.

[0058] Generally speaking, the construction of a dynamic knowledge graph requires the real-time collection of network traffic and the extraction of multi-dimensional relationships to construct a graph structure that can change dynamically, including the definition of nodes, the calculation of edge attributes, and the organization of overall topological relationships.

[0059] In this embodiment, the construction of the dynamic knowledge graph includes the following contents:

[0060] In this embodiment, the nodes in the knowledge graph represent key entities in the network, which specifically include the following types:

[0061] IP address node: represents the source IP and destination IP that appear in the network. For example, the IP address 192.168.0.1 represents the identification of a device.

[0062] Host node: represents a device node that actually participates in network communications, such as a server or client device.

[0063] Attack event node: represents the specific attack behavior identified by the system, including attack time, target, and attack type.

[0064] The attributes of a node are represented by a feature vector. The attribute vector of each node includes:

[0065] Abnormal score: Indicates whether the node has abnormal behavior, calculated using the cumulative impact value, defined as:

[0066]

[0067] Among them, a i (t) represents the anomaly score of node i at time t; N(i) represents the set of neighbor nodes of node i; w ij (t) represents the edge weight between node i and its neighbor node j; g(a j (t)) is the influence function of the abnormal score of neighbor node j; βa i (t) is the decay factor of the node anomaly score, which is used to represent the decay effect of the node status on time.

[0068] Traffic characteristics: used to describe the traffic behavior of nodes in the network, including:

[0069] f i (t)=[Packet_Volume,Protocol_Type]

[0070] Where Packet_Volume represents the amount of data packets transmitted by node i in time t; Packet_Volume represents the type of communication protocol, such as TCP or UDP.

[0071] Device attributes: used to describe the geographical and hardware information of the node, including:

[0072] p i (t)=[Geo_Location,Device_Type]

[0073] Among them, Geo_Location represents the geographical location information of the node; Device_Type represents the specific type of the node device, such as a server, router, or IoT device.

[0074] In some embodiments, IP address nodes and host nodes may be further associated with specific subnet topology structures to facilitate fine-grained analysis of the propagation path of large-scale DDoS attacks.

[0075] In this embodiment, the edges of the knowledge graph represent the communication relationship between nodes, specifically including:

[0076] Communication traffic relationship: The weight of the edge is determined by the traffic intensity, which is the total amount of data packets between nodes per unit time.

[0077] Access relationship: The weight of the edge is determined by the access frequency, which is the number of communication requests per unit time.

[0078] The edge weight is calculated using the following formula:

[0079] w ij (t)=Packet_Volume(i,j,t)+Request_Frequency(i,j,t)

[0080] Among them, Packet_Volume(i,j,t) represents the total amount of data packets transmitted by nodes i and j in time t; Request_Frequency(i,j,t) represents the number of communication requests between two nodes in time t.

[0081] Specifically, the weight values ​​of traffic intensity and access frequency can be adjusted according to the network environment to adapt to different network topologies.

[0082] As an option, in some embodiments, the communication traffic relationship can be expanded to a multi-dimensional weight, including the size of the transmitted file, the delay time, etc., to enhance the ability to describe the complexity of the DDoS attack behavior.

[0083] Generally, the node and edge structure of the knowledge graph can be represented by an adjacency matrix. In this embodiment, the knowledge graph represents a dynamic directed graph through an adjacency matrix A(t):

[0084]

[0085] Among them, a ij (t) represents the node v i With v j The edge weight at time t; ε(t) represents the set of edges that exist in the knowledge graph at time t.

[0086] In some possible implementations, the adjacency matrix can be combined with the attribute vector of the node to further form a high-order feature graph representation to enhance the analysis capability of network attack behaviors.

[0087] In one possible implementation, the initial construction of the knowledge graph includes the following steps:

[0088] Obtain historical network traffic data and extract source IP, destination IP and communication traffic information.

[0089] Based on the network communication log, the nodes and edges are initialized according to the above definition.

[0090] Calculate the weights based on the attribute values ​​of nodes and edges to generate the initial adjacency matrix.

[0091] By initializing the knowledge graph, a basic graph structure can be provided for real-time updates, ensuring that subsequent data can be written in real time.

[0092] In general, the construction of dynamic knowledge graphs can be optimized in combination with specific scenarios. For example:

[0093] In the IoT scenario, nodes can be extended to perception relationships between devices, and edge weights can be adjusted based on the frequency of data transmission.

[0094] In a cloud computing environment, nodes can be extended to virtual machine instances, and edges can represent cross-data center traffic between virtual machines.

[0095] As an option, in complex network attack scenarios, the knowledge graph can be further combined with a distributed computing framework to perform parallel construction of large-scale graph data to support efficient computing and real-time processing of large-scale network traffic.

[0096] The dynamic knowledge graph constructed in this step provides structured data support for subsequent steps, such as S2 dynamic update and S3 anomaly detection, ensuring that it can dynamically reflect changes in network entities, thereby effectively responding to the detection and tracing needs of DDoS attacks.

[0097] S2, dynamic knowledge graph update, collects network traffic data and exception logs in real time through the stream processing framework, and dynamically updates the node attributes and edge weights of the knowledge graph;

[0098] After the initial construction of the knowledge graph is completed, in order to accurately express the dynamic changes of network entities and their relationships, the present invention designs a real-time update mechanism for the dynamic knowledge graph. By collecting data such as network traffic, communication logs, and abnormal behavior records in real time, the node attributes, edge attributes, and overall graph structure in the knowledge graph are dynamically adjusted to ensure that the knowledge graph can reflect changes in the network environment in real time. This step provides dynamic data support with high real-time and accuracy for subsequent anomaly detection and traceability analysis.

[0099] Generally speaking, network traffic and communication behavior change frequently, and single static modeling is difficult to meet the real-time detection needs of complex network attacks. Therefore, through the stream processing framework and real-time update mechanism, the node and edge attributes of the knowledge graph can be dynamically adjusted to achieve rapid response to the network environment.

[0100] In this embodiment, the dynamic knowledge graph update includes the following contents:

[0101] In this embodiment, node attributes include anomaly scores, traffic characteristics, and device attributes. These attributes are dynamically adjusted as network data changes.

[0102] Abnormal scorea i (t) is calculated by accumulating the influence of neighbor nodes on the target node, and its update rule is:

[0103]

[0104] in:

[0105] a i (t) is the anomaly score of node i at time t;

[0106] N(i) is the set of neighbor nodes of node i;

[0107] w ij (t) is the edge weight, which represents the communication intensity or access frequency between node i and its neighbor node j;

[0108] g(a j (t)) is the influence function of the abnormal score of neighbor node j, which is usually a nonlinear activation function, such as Sigmoid function or ReLU function;

[0109] β is the node’s abnormal score attenuation factor, which is used to balance historical impact and real-time changes.

[0110] As an option, in some embodiments, the update of the node anomaly score can also be combined with the node's historical behavior pattern to further enhance the stability and accuracy of the score. For example, a time weighting factor can be introduced to attenuate the historical behavior.

[0111] Traffic characteristics i (t) is updated based on real-time communication data between nodes, including packet size and communication protocol type:

[0112] f i (t)=[Packet_Volume(t),Protocol_Type(t)]

[0113] in:

[0114] Packet_Volume(t) represents the total amount of data packets communicated by node i with other nodes in time t;

[0115] Protocol_Type(t) indicates the communication protocol type of node i, such as TCP, UDP or ICMP.

[0116] Device Properties i The update of (t) includes the node's geographic location and device type:

[0117] p i (t)=[Geo_Location(t),Device_Type(t)]

[0118] in:

[0119] Geo_Location(t) maps the IP address to the physical geographic location;

[0120] Device_Type(t) infers the device type based on the device identification or communication characteristics, such as router, IoT device, or server.

[0121] In a possible implementation, the update cycle of node attributes can be controlled by a time window of a stream processing framework, for example, updated once per second, to ensure that node attributes can quickly adapt to network changes.

[0122] In this embodiment, the edge attributes are mainly expressed by weight w ij (t), and its update rule is:

[0123] w ij (t)=Packet_Volume(i,j,t)+Request_Frequency(i,j,t)

[0124] in:

[0125] Packet_Volume(i,j,t) represents the total amount of data packets transmitted between node i and node j in time t;

[0126] Request_Frequency(i,j,t) represents the number of communication requests between two nodes within time t.

[0127] Specifically, the update of edge weights can reflect the dynamic changes in the communication strength between nodes. In some embodiments, factors such as communication delay and data packet loss rate can be further incorporated into the calculation of edge weights to enhance the ability to describe network communication behavior.

[0128] As a possible implementation method, the dynamic update of edge weights can be done by incremental calculation, which only updates the edges that have changed, reducing the overhead of recalculating the entire graph.

[0129] In this embodiment, the dynamic knowledge graph is represented by the adjacency matrix A(t), and the update rule of the adjacency matrix is:

[0130]

[0131] in:

[0132] a ij (t) represents the node v i With node v j The edge weights between

[0133] ε(t) is the set of edges in the knowledge graph at time t.

[0134] Generally, the update of the adjacency matrix is ​​driven by the changes in node attributes and edge attributes. For example, when the communication traffic between nodes suddenly increases, the weight of the corresponding edge will also be dynamically adjusted, thus triggering the update of the adjacency matrix.

[0135] In a possible implementation, the adjacency matrix can be expanded into a multi-dimensional weight matrix to express node relationships of different dimensions. For example, one dimension can be added to represent the communication direction to distinguish between sending and receiving behaviors between nodes.

[0136] Generally, network traffic data and communication logs change dynamically, so in this embodiment, a stream processing framework is used to collect and process these data in real time.

[0137] Specifically, the stream processing framework splits network traffic data into small batch streams according to fixed time windows, extracts key features (such as packet size, protocol type, etc.) and writes them into the knowledge graph.

[0138] As an option, in some embodiments, the updated results of the dynamic knowledge graph can also be stored in a distributed graph database, thereby achieving real-time processing capabilities for large-scale networks.

[0139] Through the above dynamic update mechanism, the present invention realizes the real-time description of network entities and communication behaviors, and provides efficient dynamic data support for subsequent anomaly detection. The real-time update of the dynamic knowledge graph can not only reflect the latest changes in network traffic, but also quickly capture the propagation characteristics of DDoS attack behaviors, ensuring the timeliness and accuracy of detection.

[0140] S3, anomaly detection, using the neighbor node states and edge weights of nodes in the knowledge graph, establishes a dynamic model of node state changes, and detects abnormal nodes based on the change rate of node states;

[0141] After the dynamic knowledge graph is updated in real time, the change rate of the node state in the knowledge graph is calculated by establishing a dynamic model of the node state, and then judging whether the node has abnormal behavior. The anomaly detection mechanism of the present invention takes the change of the node's neighbor state as the core, combines the dynamic adjustment of the edge weight, calculates the change rate of the node's abnormal score and compares it with the preset threshold, so as to accurately identify abnormal nodes.

[0142] In general, the core of anomaly detection is to identify abnormal behavior patterns through real-time network data analysis. To this end, the present invention designs an anomaly scoring calculation method based on dynamic equations, which makes full use of the adjacency relationship and edge weights in the dynamic knowledge graph to achieve efficient calculation and marking of node abnormal states.

[0143] In this embodiment, the implementation of anomaly detection includes the following:

[0144] In this embodiment, the state change of a node is determined by its own attributes and the attributes of its neighboring nodes, which are specifically modeled by a dynamic equation. It is defined by the following formula:

[0145]

[0146] in:

[0147] x i (t) = [a i (t),f i (t)] is the state vector of node i at time t;

[0148] a i (t) is the anomaly score of node i;

[0149] f i (t) is the traffic characteristics of node i;

[0150] N(i) is the set of neighbor nodes of node i,

[0151] w ij (t) is the weight of edge (i, j), which indicates the strength of the communication relationship between node i and its neighbor node j;

[0152] g(x j (t)) is the neighbor node state x j The influence function of (t) is usually a nonlinear activation function, such as

[0153] ReLU function or Sigmoid function;

[0154] f(·) is the comprehensive state update function, which is used to describe the overall change trend of the node state.

[0155] As an option, in some embodiments, the comprehensive update function f(·) of the node state may also be combined with a time decay factor to reduce the impact of historical behavior on the current state of the node.

[0156] The anomaly score update of node i is calculated by the combined influence of the state changes of its neighboring nodes and the edge weights. The update rule of the anomaly score is:

[0157]

[0158] in:

[0159] g(a j (t))=σ(a j (t)) is the nonlinear transformation of the anomaly score of neighbor node j, and σ(·) is the activation function;

[0160] β is the attenuation factor of the anomaly score, which is used to balance the historical status and real-time changes;

[0161] ∑ j∈N(i) w ij (t)g(a j (t)) represents the cumulative impact of neighbor nodes on target node i.

[0162] In general, the abnormal score change rate of a node is Δa i (t) is expressed as:

[0163]

[0164] If Δa i (t) exceeds the preset threshold θ, the node i is marked as an abnormal node.

[0165] As a possible implementation method, the calculation of the anomaly score can also be combined with the changes in the traffic characteristics of the node. For example, the abnormal behavior of the node can be further verified by a sudden increase in the size of the data packet or an abnormal change in the communication protocol.

[0166] Specifically, the abnormal node marking rules in this embodiment are as follows:

[0167] When the node state change rate Δa i (t) When it exceeds the threshold θ, the system marks node i as abnormal.

[0168] The setting of the threshold θ can be adjusted according to the network scale and traffic characteristics. For example, in a small-scale local area network, θ can be set to a lower value to improve detection sensitivity; in a large-scale distributed network, θ can be set to a higher value to reduce false positives.

[0169] In a possible implementation, the accuracy of node marking can also be verified by a global stability constraint function. Specifically, by defining a global stability function V(t), it is ensured that the node state meets the stability condition during the update process:

[0170]

[0171] when When , the anomaly detection results of the system are considered to be stable.

[0172] In general, the anomaly detection process mainly calculates and marks the rate of change of node anomaly scores. However, in some special scenarios, other features can be combined for multi-dimensional analysis.

[0173] As an option, in some embodiments, the abnormal node marking rule can be combined with time series features, such as detecting the fluctuation frequency of the node anomaly score, to identify periodic attack patterns.

[0174] In another possible implementation, the anomaly detection process can be combined with a distributed computing framework, such as distributing node status updates and anomaly marking tasks to multiple computing nodes, thereby improving detection efficiency in large-scale network scenarios.

[0175] In complex network attack scenarios, the anomaly detection process can also be extended to a subgraph-based detection method. For example:

[0176] For high-traffic areas in a local network, the nodes and edges in the area can be analyzed separately by extracting a subgraph of the knowledge graph;

[0177] The anomaly score of a subgraph can be calculated by taking the weighted average of all node anomaly scores to comprehensively evaluate the degree of anomaly in the local network.

[0178] In the IoT scenario, the anomaly detection process can be further combined with device behavior patterns. For example, by monitoring the low-frequency communication relationship between nodes, possible zombie devices can be identified, thereby improving the pertinence of detection.

[0179] Through the above anomaly detection mechanism, the present invention can accurately mark abnormal nodes in the network based on the dynamic update data of the knowledge graph, providing high-quality data input for attack chain tracing. The detection process fully combines node attributes, edge weights and dynamic characteristics, making the detection results more real-time and accurate.

[0180] S4, attack chain tracing, starting from the detected abnormal node, reversely deduce the attack path based on the dynamic model, determine the attack link through path weight optimization, and finally identify the attack source;

[0181] After identifying the possible abnormal nodes in the network through anomaly detection, the present invention uses the dynamic properties of nodes and edges in the dynamic knowledge graph and the reverse deduction method based on the dynamic model to deduce and optimize the attack path, and finally generate a complete attack link and locate the attack source. The goal of attack chain tracing is to identify all relay nodes and the real attack origin in the attack chain by reversely tracing the propagation relationship between abnormal nodes, so as to provide a basis for subsequent attack response and defense strategies.

[0182] Generally speaking, DDoS attack tracing faces complex network environments and highly hidden attack paths. By introducing a reverse inference algorithm based on knowledge graphs and a global path optimization mechanism, the accuracy and efficiency issues in path tracing can be effectively solved.

[0183] In this embodiment, the implementation of attack chain tracing includes the following contents:

[0184] In this embodiment, the reverse derivation of the attack path takes the detected abnormal node as the starting point, and traces back the propagation relationship of the abnormal state layer by layer until the origin node in the attack chain is found.

[0185] Specifically, the reverse derivation formula of the node state is:

[0186] x i (t-Δt)=f -1 (x i (t),A(t))

[0187] in:

[0188] x i (t) is the state vector of node i at time t;

[0189] f -1 (·) is the inverse mapping function of the dynamics equation, which derives the state of the previous time step through the current state of the node and the adjacency matrix;

[0190] A(t) is the adjacency matrix of the knowledge graph, which is used to represent the edge weights between nodes.

[0191] Generally, the iterative process of reverse deduction will visit the neighbor nodes of the abnormal node in turn, build the time series relationship between the nodes, and thus restore the attack path.

[0192] As an option, in some embodiments, the step size Δt of the reverse derivation can be dynamically adjusted according to the communication delay characteristics of the network. For example, in a high-delay network, Δt can be set to a larger time step to reduce redundant calculations in the derivation process.

[0193] In this embodiment, the weight of the attack path is calculated by comprehensively considering the edge weight and the time decay factor. The path weight function is defined as:

[0194]

[0195] in:

[0196] P is the attack path;

[0197] w ij (t) is the weight of edge (i,j);

[0198] t ij is the time delay of edge (i,j);

[0199] α is the time decay factor, which is used to reduce the impact of historical data on path weight.

[0200] Specifically, the smaller the path weight is, the more likely the path is an attack path. In a possible implementation, the robustness of the path weight calculation can be further improved by normalizing the edge weight and time delay.

[0201] In this embodiment, in order to select the optimal path from multiple possible attack paths, a global path optimization method based on the Laplace matrix is ​​introduced.

[0202] The global optimization problem of the attack chain path is defined as:

[0203]

[0204] in:

[0205] P * is the optimal attack path;

[0206] is the path weight.

[0207] The global optimization of the path is achieved through the Laplace matrix L(P), which is defined as:

[0208] L(P)=DA(t)

[0209] in:

[0210] D is the degree matrix of the node;

[0211] A(t) is the adjacency matrix.

[0212] In general, the optimal path in the attack chain can be quickly determined by minimizing the eigenvalues ​​of the path Laplacian matrix.

[0213] As an option, in some embodiments, the path optimization process can also be combined with the abnormality score of the node to further improve the traceability accuracy. For example, nodes with higher abnormality scores are preferentially selected as relay nodes in the traceability path.

[0214] In this embodiment, after completing the path weight calculation and global path optimization, a complete attack link will be generated, including the starting point, relay nodes, and end point.

[0215] Specifically, the attack chain generation process is as follows:

[0216] Starting from the abnormal node, trace back all possible paths layer by layer;

[0217] Calculate the path weight for each path and select the optimal path as the attack link;

[0218] Output the complete structure of the attack chain, including the time series information of each node.

[0219] As an implementation method, the output of the attack chain can be displayed through a visualization tool. For example, the attack chain can be drawn as a topology diagram so that security managers can intuitively understand the attack path.

[0220] In some complex network scenarios, attack chain tracing can also be combined with the following extension methods:

[0221] For distributed DDoS attacks, abnormal nodes can be grouped using clustering algorithms to identify multiple attack sources;

[0222] In a cloud computing environment, a virtual topology map can be constructed through the traffic relationship between virtual machines to more accurately identify virtual resources in the attack chain.

[0223] In another possible implementation, the time series information of the attack chain can be used to predict the subsequent evolution of the attack. For example, by analyzing the change pattern of the node status in the attack chain, the target nodes that may be affected can be identified in advance.

[0224] Through the above attack chain tracing mechanism, the present invention can effectively identify the DDoS attack path in a complex network environment and accurately locate the attack source. The tracing process combines the reverse deduction of the dynamic model with the global path optimization method to ensure the accuracy and reliability of the tracing results, providing key technical support for network security protection.

[0225] S5. Output analysis results, including abnormal nodes, attack links, attack sources, and time series information;

[0226] After the attack chain is traced, in order to facilitate network security managers to understand the attack behavior and take further defensive measures, the present invention comprehensively organizes and outputs the results of detection and tracing. The output analysis results include abnormal nodes, attack links, attack sources, and time series information of each node, and combined with visualization methods, a structured analysis report and visualization chart are generated to quickly locate anomalies and assess the degree of network damage.

[0227] Generally, the amount of data generated by attack detection and tracing is large, and directly outputting all the details may not be conducive to rapid analysis. This invention provides concise and intuitive output content by screening and refining key results, while retaining detailed time series and node status information, ensuring that security managers can deeply analyze and verify the results.

[0228] In this embodiment, the content and implementation of output analysis results include the following aspects:

[0229] In this embodiment, the output content of the abnormal node includes basic information, state attributes and abnormality score of the node.

[0230] Specifically, the basic information of the abnormal node includes the node identification (such as IP address or device ID) and the node type (such as host node or attack event node).

[0231] The state attribute x of the node i (t) is represented by the following vector:

[0232] x i (t) = [a i (t),f i (t),p i (t)]

[0233] in:

[0234] a i (t) is the abnormality score of the node, indicating the abnormality degree of the node status;

[0235] f i (t) is the traffic characteristics of the node, including packet size and protocol type;

[0236] p i (t) is the device attribute of the node, including geographical location and device type.

[0237] Generally, the output of abnormal nodes is sorted according to the abnormality score to help security managers prioritize the analysis of nodes with higher scores. i (t) will also be output to analyze the historical change trend of the node status.

[0238] In this embodiment, the output content of the attack link includes the topological structure, path weight and time series information of the link.

[0239] The topology of the attack link is represented by a set of nodes and edges:

[0240] P = {v 1 ,v 2 ,…,v n},E={(v i ,v j )|(i,j)∈ε}

[0241] in:

[0242] P is the set of nodes in the attack link;

[0243] E is the edge set in the attack link, and ε is the edge set of the knowledge graph.

[0244] Each edge e in the link ij Weight Calculated by the following formula:

[0245]

[0246] Where: w ij (t) is the communication weight of the edge; t ij is the time delay of the edge; α is the time decay factor.

[0247] The time series information of the attack link includes the access time and abnormal state changes of each node, which is used to show the evolution process of the attack behavior in the time dimension.

[0248] As an option, in some embodiments, the output of the attack link can be combined with the communication data between nodes, such as the traffic size and communication direction, to further verify the accuracy of the attack path.

[0249] In this embodiment, the output content of the attack source includes the identification, attributes and time information of the attack source node.

[0250] Specifically, the identification of the attack source node includes the IP address or device ID, and its attribute information x source (t) is similar to other nodes and is represented by the following vector:

[0251] x source (t) = [a source (t),f source (t),p source (t)]

[0252] in:

[0253] a source (t) represents the anomaly score of the attack source;

[0254] f source (t) including attack traffic characteristics;

[0255] p source (t) Include the geographic location and device type of the attack source.

[0256] As a possible implementation method, the output of the attack source can also be combined with the propagation relationship of other nodes in the attack link to generate a complete behavior chain of the attack source. For example, all relay nodes from the attack source to the target node and their communication time can be output.

[0257] In this embodiment, in order to facilitate the understanding of the detection and traceability results, a set of graphical visualization tools is designed.

[0258] Specifically, the visualization results include the following:

[0259] Abnormal node list: displays the basic information of abnormal nodes and the abnormal score ranking in a table form;

[0260] Attack link topology diagram: displays the topology of the attack link in the form of a node-edge diagram. The color and size of each node reflect the anomaly score, and the width of each edge reflects the communication strength.

[0261] Time series graph: shows the state change trend of each node in the attack chain, such as the curve of the anomaly score changing over time.

[0262] Generally, the visualization results are displayed in a dynamic interactive form, for example, allowing users to click on nodes to view their detailed properties and associations. In some embodiments, the visualization tool also supports exporting static reports of attack links for archiving or sharing.

[0263] In some complex network scenarios, the output analysis results can be expanded by combining context information. For example:

[0264] In the IoT scenario, the device type distribution and geographic location distribution of abnormal nodes can be output to assess the scale and spread of the botnet;

[0265] In the cloud computing scenario, the communication topology between virtual machines and the virtual machine nodes in the attack chain can be output to locate the victim resources in the attack chain.

[0266] As an implementation method, the format of the output results can be customized according to the usage scenario. For example, structured data can be output in JSON format for secondary analysis by other security tools; or analysis reports can be generated in PDF format for management personnel to refer to.

[0267] Through the above steps, the present invention outputs complete analysis results including abnormal nodes, attack links and attack sources, and provides an intuitive display method in combination with visualization tools. These output results provide accurate analysis basis for network security managers and support rapid decision-making and defense strategy formulation.

[0268] Please refer to the attached Figure 2 The present invention also provides a real-time detection and source tracing analysis system for DDoS attacks based on a knowledge graph, including:

[0269] Data collection module, used to collect network traffic data, abnormal logs and other auxiliary information in real time, providing high-quality data support for subsequent analysis;

[0270] Dynamic knowledge graph construction module, which is used to dynamically construct the knowledge graph of the network by taking network entities as nodes and the communication relationships between entities as edges, combining traffic characteristics and communication behavior attributes;

[0271] The dynamic knowledge graph update module is used to adjust the node attributes (such as anomaly scores, traffic characteristics, etc.) and edge weights (such as communication strength, access frequency, etc.) in the knowledge graph in real time according to the latest network data collected by the data collection module to ensure that the graph always reflects the dynamic changes of the network environment;

[0272] The anomaly detection module, based on the dynamic model, accurately identifies nodes that may have abnormal behavior by calculating the node state change rate and anomaly score;

[0273] The attack chain tracing module uses the propagation relationship between nodes in the knowledge graph, the reverse deduction algorithm based on the dynamics model, and the path weight optimization technology to accurately restore the attack chain and locate the attack source;

[0274] The visualization module is used to display anomaly detection results, attack links, and attack source information in an intuitive and interactive form. It supports detailed information viewing at the node level and a global view at the link level. It also provides analysis report generation and export functions, making it easier for network managers to quickly understand attack behaviors and take effective defense measures.

[0275] The module collaboration of this system effectively solves the problems of insufficient real-time performance and high difficulty in tracing in traditional DDoS attack detection, improves the attack detection and tracing capabilities in complex network environments, and provides reliable technical support for network security protection.

[0276] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A real-time detection and source tracing analysis method for DDoS attacks based on knowledge graph, characterized in that: The following steps are involved: Dynamic knowledge graph construction, with network entities as nodes and communication relationships between entities as edges, to build a knowledge graph containing dynamic changes in nodes and edges. Nodes include IP addresses, hosts, and attack events, and edges include communication flow relationships and access relationships. Edge weights are determined based on flow intensity and communication frequency. Dynamic knowledge graph update: collect network traffic data and exception logs in real time through the stream processing framework, and dynamically update the node attributes and edge weights of the knowledge graph; Anomaly detection uses the neighbor node states and edge weights of nodes in the knowledge graph to establish a dynamic model of node state changes and detect abnormal nodes based on the rate of change of node states; Attack chain tracing starts from the detected abnormal node, reversely deduce the attack path based on the dynamic model, determine the attack link through path weight optimization, and finally identify the attack source; Output analysis results, including abnormal nodes, attack links, attack sources, and time series information.

2. According to the knowledge graph-based real-time detection and source tracing analysis method of DDoS attacks according to claim 1, it is characterized in that: The node attributes of the dynamic knowledge graph include anomaly scores, traffic characteristics, and device attributes, and the calculation and processing steps thereof include: The calculation of node anomaly score is realized through the cumulative impact value of node state change. The change of node state is affected by the state of its neighboring nodes and edge weight. The cumulative impact value of node state change is defined by the following formula: Among them, a i (t) is the anomaly score of node i at time t, N(i) is the neighbor set of node i, and w ij (t) is the weight of edge (i,j), g(a j (t)) is the influence function of the abnormal score of neighbor node j, and β is the attenuation factor of the node status; Traffic characteristics include traffic size and communication protocol type. Traffic size is calculated by the total amount of data packets between nodes per unit time. The communication protocol type is obtained by parsing the protocol identification field in the network traffic. The representation of traffic characteristics is: f i (t)=[Packet_Volume,Protocol_Type] Among them, Packet_Volume is the size of the data packet that node i communicates with its neighbor node at time t, and Protocol_Type is the protocol type; Device attributes include geographic location and device type. The geographic location is calculated by mapping the node's IP address to the physical location. The device type is obtained by parsing the device identification field. The device attributes are expressed as follows: p i (t)=[Geo_Location,Device_Type] Among them, Geo_Location is the geographical location information of the node, and Device_Type is the device type of the node; The complete attributes of a node are composed of anomaly score, traffic characteristics, and device attributes. The attributes of node i at time t are expressed as: x i (t)=[a i (t),f i (t),p i (t)] Among them, x i (t) is the complete attribute vector of node i.

3. The method for real-time detection and source tracing of DDoS attacks based on knowledge graph according to claim 1 is characterized in that: The edge weight is determined according to the intensity of communication traffic and the access frequency. The communication traffic intensity represents the number of data packets between nodes per unit time, and the access frequency represents the number of communication requests between nodes.

4. According to the knowledge graph-based real-time detection and source tracing analysis method for DDoS attacks according to claim 1, it is characterized in that: The anomaly detection is achieved by the following steps: According to the neighbor node states and edge weights of nodes in the knowledge graph, a dynamic equation for node state changes is established; Based on the change rate of the node status, the abnormal node is judged. If the change rate of the node status exceeds the preset threshold, the node is marked as an abnormal node; The global system stability function is used to constrain the detection results to ensure the accuracy of abnormal node marking.

5. According to the knowledge graph-based real-time detection and source tracing analysis method for DDoS attacks according to claim 1, it is characterized in that: The attack chain tracing is achieved through the following steps: Starting from the abnormal node, reversely deduce the attack path layer by layer; Based on the path weight optimization method, the global optimal path of the attack path is calculated; The path weight is determined by the edge weight and the path time decay factor. The path time decay factor is used to reduce the weight contribution of the path with larger delay; Output attack link, including path starting point, relay node and attack source.

6. The method for real-time detection and source tracing of DDoS attacks based on knowledge graph according to claim 1 is characterized in that: The real-time update cycle of the knowledge graph is controlled by the time window of the stream processing framework. Each time window updates the attribute changes of nodes and edges and dynamically generates an updated adjacency matrix.

7. The method for real-time detection and source tracing of DDoS attacks based on knowledge graph according to claim 1 is characterized in that: The attack chain tracing adopts a path search method based on Laplace matrix optimization, and the difference between the node degree matrix and the adjacency matrix is ​​used to describe the optimal choice of the path.

8. The method for real-time detection and source tracing of DDoS attacks based on knowledge graph according to claim 1 is characterized in that: The influence of the abnormal node state change on the neighboring nodes is converted through a nonlinear activation function, and the nonlinear activation function includes a Sigmoid function or a ReLU function.

9. The method for real-time detection and source tracing of DDoS attacks based on knowledge graph according to claim 1 is characterized in that: The system stability of the anomaly detection is defined by the Lyapunov function, which represents the sum of squares of anomaly scores of all nodes in the system, ensuring that the node state changes meet the stability constraints.

10. A real-time detection and source tracing analysis system for DDoS attacks based on knowledge graph, applied to a real-time detection and source tracing analysis method for DDoS attacks based on knowledge graph as claimed in any one of claims 1 to 9, characterized in that: include: Data collection module, used to collect network traffic data and abnormal logs in real time; A dynamic knowledge graph construction module is used to construct a dynamic knowledge graph with network entities as nodes and communication relationships between entities as edges; The dynamic knowledge graph update module is used to update the node attributes and edge weights of the knowledge graph in real time according to the data collected by the data collection module; An anomaly detection module, used to detect abnormal nodes according to the change rate of node status using a dynamic model; The attack chain tracing module is used to reversely deduce the attack path based on the dynamic model and determine the attack link by combining the path weight optimization; The visualization module is used to output anomaly detection results, attack links, and attack source information.

Images