DDOS attack monitoring system based on hybrid neural network

Abstract

The invention relates to the technical field of network security, in particular to a DDOS attack monitoring system based on a hybrid neural network. The feature extraction and fusion unit is used for acquiring network traffic data, extracting network basic features in the network traffic data, extracting high-order depth features in the network traffic data by using a convolutional neural network, and fusing the high-order depth features to obtain network comprehensive features; the zero-day attack detection unit monitors a network flow state vector by using a neural network in combination with nonlinear dynamics, and constructs an attack response strategy by using the neural network in combination with a Q value function; the flow resource balancing unit is used for carrying out self-adaptive balancing on the system resources and optimizing an attack response strategy according to the real-time state of the system resources; and the strategy feedback execution unit is used for executing the attack response strategy and feeding back and adjusting the defense strategy. According to the DDOS attack monitoring system based on the hybrid neural network, the recognition capability of complex and variant attack modes is improved by combining deep adaptive learning and nonlinear time sequence modeling.

Description

Technical Field

[0001] The invention relates to the technical field of network security, and in particular to a DDOS attack monitoring system based on a hybrid neural network. Background Art

[0002] The DDOS attack monitoring system based on hybrid neural network aims to improve the detection accuracy of complex and zero-day attacks and optimize the adaptive ability of attack response strategies. It combines nonlinear dynamic models with recursive neural networks for real-time traffic analysis and anomaly detection, controls the state evolution of network traffic and the detection and response of attack patterns, realizes rapid identification of unknown attacks, and adjusts defense measures based on real-time traffic status.

[0003] Existing DDOS attack monitoring systems are usually difficult to cope with highly dynamic and complex attack patterns. In addition, since traditional static rule-based detection methods cannot handle nonlinear characteristics in traffic, the system has a low detection rate for zero-day attacks and variant attack patterns, and cannot detect new attacks in a timely manner. In addition, the system lacks sufficient adaptive capabilities, making it impossible for network protection to make real-time adjustments based on changes in traffic characteristics, resulting in the system facing problems such as untimely response or inaccurate defense strategies when attacked. Therefore, a DDOS attack monitoring system based on hybrid neural networks is designed. Summary of the invention

[0004] The purpose of the present invention is to provide a DDOS attack monitoring system based on a hybrid neural network to solve the problems raised in the above background technology and that the traditional static rule-based detection method cannot handle the nonlinear characteristics in the traffic, which will cause the system to have a low detection rate for zero-day attacks and variant attack modes, and cannot discover new attacks in time, and lacks sufficient adaptive capabilities, making it impossible for network protection to make real-time adjustments according to changes in traffic characteristics, resulting in the system facing problems such as untimely response or inaccurate defense strategies when attacked.

[0005] To achieve the above object, the present invention aims to provide a DDOS attack monitoring system based on a hybrid neural network, comprising: a feature extraction and fusion unit, the feature extraction and fusion unit is used to obtain network traffic data to extract network basic features in the network traffic data, use a convolutional neural network to extract high-order deep features in the network traffic data, and fuse the network basic features with the high-order deep features to obtain network comprehensive features; It also includes a zero-day attack detection unit, which uses a neural network combined with nonlinear dynamics to monitor the network traffic state vector based on the network comprehensive characteristics, and uses the neural network combined with a Q-value function to construct an attack response strategy; It also includes a traffic resource balancing unit, which is used to adaptively balance system resources according to real-time changes in network traffic and device health status, and optimize attack response strategies according to the real-time status of system resources; It also includes a strategy feedback execution unit, which is used to execute the attack response strategy and provide feedback to adjust the defense strategy.

[0006] As a further improvement of the technical solution, the feature extraction and fusion unit includes a feature extraction module and a feature fusion module; The feature extraction module is used to obtain network traffic data to extract basic network features in the network traffic data, and use a convolutional neural network to extract high-order deep features in the network traffic data; The feature fusion module is used to fuse the basic network features with the high-order deep features to obtain the comprehensive network features.

[0007] As a further improvement of the technical solution, the feature extraction module is used to obtain network traffic data to extract network basic features in the network traffic data, and use a convolutional neural network to extract high-order deep features in the network traffic data, as follows: S1.1.1. Collect raw network traffic data from the network monitoring system: ; in, It is a collection of network traffic data; Network traffic data; Label network traffic data; is the total amount of network traffic data; Extract basic network features from network traffic data: ; in, It is a collection of basic network features; It is the basic characteristics of the network; Label the basic features of the network; is the total number of basic network features; S1.1.2. Use convolutional neural networks to extract high-order deep features from raw network traffic data: ; in, It is a high-order deep feature; For convolutional neural network operations; are the convolutional neural network parameters; The feature fusion module is used to fuse the basic network features with the high-order deep features to obtain the comprehensive network features, as follows: S1.2.1. Weighted fusion network basic features and high-order deep features are integrated to obtain network comprehensive features: ; in, is the network basic feature weight; is the high-order deep feature weight; It is the comprehensive characteristics of the network.

[0008] As a further improvement of the technical solution, the zero-day attack detection unit includes a behavior pattern detection module and a zero-day attack response module; The behavior pattern detection module uses a neural network combined with nonlinear dynamics to predict the network traffic state vector based on the comprehensive network features, and uses a recursive neural network combined with LSTM to perform anomaly detection on the network traffic state vector; The zero-day attack response module uses a neural network combined with a Q-value function to construct an optimized attack response strategy.

[0009] As a further improvement of the technical solution, the behavior pattern detection module uses a neural network combined with nonlinear dynamics to predict the network traffic state vector based on the comprehensive network characteristics, and uses a recursive neural network combined with LSTM to perform anomaly detection on the network traffic state vector. The specific method steps are as follows: S2.1.1. Based on the comprehensive network features, use the neural network model to predict the network traffic state vector: ; in, Predict the network traffic state vector at time t; is a neural network model; are neural network parameters; is the comprehensive network characteristics at time t; for the moment; S2.1.2. Based on the predicted network traffic state vector, the network traffic state vector update equation is constructed in combination with nonlinear dynamics: Network traffic state vector update equation: ; in, is the actual network traffic state vector at time t; is the system state transfer matrix; Enter the impact matrix for the system; is the noise impact matrix; is the external interference matrix; Predict the network traffic state vector at time t; S2.1.3. Based on the actual network traffic state vector at time t, a recursive neural network combined with LSTM is used to predict the network traffic state vector at the next moment and perform anomaly detection: ; ; in, Predict the network traffic state vector at time t-1; is the actual network traffic state vector at time t-1; For LSTM operation; is the LSTM parameter; is the abnormality of network traffic at time t; is the abnormality of network traffic at time t+1; S2.1.4. Setting the network traffic anomaly threshold , determine whether there is an abnormality in network traffic at time t: like , then the network traffic at time t is abnormal; like , then the network traffic at time t is normal.

[0010] As a further improvement of the technical solution, the zero-day attack response module uses a neural network combined with a Q-value function to construct an optimized attack response strategy. The specific method is as follows: S2.2.1, define state space and action space; The state space includes network traffic anomaly, network equipment health status, attack source information, and node load status; the action space includes network isolation, adjusting firewall rules, limiting network traffic, and initiating emergency response procedures; S2.2.2. Construct the Q-value function based on the state space and action space, and generate the Bellman equation: Bellman equation: ; in, is the state space at time t Take action space Q value; is the reward function at time t; is the discount factor; is the state space at time t; is the action space at time t; is the state space at time t+1; is the action space at time t+1; S2.2.3. Constructing a deep Q network based on the Bellman equation: Deep Q Network: ; in, are neural network parameters; is the output of the neural network to the state space at time t; S2.2.4. Design reward function: ; S2.2.5. Train the deep Q network constructed based on the Bellman equation and finally obtain the attack response strategy.

[0011] As a further improvement of the technical solution, the traffic resource balancing unit includes an adaptive dynamic balancing module and a feedback adjustment optimization module; The adaptive dynamic balancing module is used to adaptively balance system resources according to real-time changes in network traffic and device health status; The feedback adjustment optimization module is used to optimize the attack response strategy described in S2.2.5 according to the real-time status of system resources.

[0012] As a further improvement of the technical solution, the adaptive dynamic balancing module is used to adaptively balance system resources according to real-time changes in network traffic and device health status. The specific method steps are as follows: S3.1.1, define the load balancing factor as : ; in, is the load balancing factor; is the system load at time t; is the maximum load that the system can withstand at time t; S3.1.2. Based on the load balancing factor, the actual network traffic state vector and the comprehensive network characteristics, a load flow balancing model is constructed: Load flow balancing model: ; in, is the state transfer matrix; is the network feature influence matrix; is the load balancing impact matrix; is the load regulation function; S3.1.3. Solve the load flow balancing model to obtain the self-balancing of network flow and system resources.

[0013] As a further improvement of the technical solution, the feedback adjustment optimization module is used to optimize the attack response strategy described in S2.2.5 according to the real-time status of system resources. The specific method steps are as follows: S3.2.1. Construct the loss function based on the actual network traffic state vector and load balancing factor: Loss function: ; in, is the loss function; is the target network traffic state vector; is the target load balancing factor; is the network traffic state weight; is the load balancing factor weight; S3.2.2. Based on the loss function, the back propagation algorithm is used to minimize the loss function and adjust the attack response strategy: ; in, is the adjusted optimal attack response strategy.

[0014] As a further improvement of the technical solution, the strategy feedback execution unit is used to execute the attack response strategy and feedback and adjust the defense strategy, as follows: S4.1. Obtain the network traffic state vector, state space and optimal attack response strategy from the zero-day attack detection unit and the traffic resource balancing unit, and execute the optimal attack response strategy; S4.2. After executing the optimal attack response strategy, feedback is given on the effectiveness of the current strategy, and the real-time network traffic state vector is fed back to the zero-day attack detection unit to re-analyze and adjust the attack response strategy.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. In this hybrid neural network-based DDOS attack monitoring system, based on deep adaptive learning and nonlinear time series modeling, it can capture and analyze complex dynamic patterns in traffic in real time, and model traffic time series through recursive neural networks, so that the system can identify variant attack types that are difficult to capture by traditional detection methods, as well as unknown features for zero-day attacks; 2. In this DDOS attack monitoring system based on hybrid neural networks, by combining convolutional neural networks with long short-term memory networks, static feature attacks can be detected, and attack patterns generated over time can be accurately identified, thereby improving the system's response capability and protection effect against complex DDOS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is the overall flow chart of the present invention; The meaning of each number in the figure is: 1. Feature extraction and fusion unit; 11. Feature extraction module; 12. Feature fusion module; 2. Zero-day attack detection unit; 21. Behavior pattern detection module; 22. Zero-day attack response module; 3. Traffic resource balancing unit; 31. Adaptive dynamic balancing module; 32. Feedback adjustment and optimization module; 4. Strategy feedback execution unit. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1 As shown, a DDOS attack monitoring system based on a hybrid neural network is provided, including: a feature extraction and fusion unit 1, wherein the feature extraction and fusion unit 1 is used to obtain network traffic data to extract network basic features in the network traffic data, use a convolutional neural network to extract high-order deep features in the network traffic data, and fuse the network basic features with the high-order deep features to obtain network comprehensive features; In this embodiment, the feature extraction and fusion unit 1 includes a feature extraction module 11 and a feature fusion module 12; The feature extraction module 11 is used to obtain network traffic data to extract basic network features in the network traffic data, and use a convolutional neural network to extract high-order deep features in the network traffic data; The feature fusion module 12 is used to fuse the basic network features with the high-order deep features to obtain the comprehensive network features.

[0019] In this embodiment, the feature extraction module 11 is used to obtain network traffic data to extract network basic features in the network traffic data, and use a convolutional neural network to extract high-order deep features in the network traffic data, as follows: S1.1.1. Collect raw network traffic data from the network monitoring system: ; in, It is a collection of network traffic data; Network traffic data; Label network traffic data; is the total amount of network traffic data; Extract basic network features from network traffic data: ; in, It is a collection of basic network features; It is the basic characteristics of the network; Label the basic features of the network; is the total number of basic network features; In this embodiment, the network traffic data includes source IP, destination IP, traffic rate, number of sessions, etc.; the network traffic data label Label them in the order of acquisition time; S1.1.2. Use convolutional neural networks to extract high-order deep features from raw network traffic data: ; in, It is a high-order deep feature; For convolutional neural network operations; are the convolutional neural network parameters; In this embodiment, the feature fusion module 12 is used to fuse the basic network features with the high-order deep features to obtain the comprehensive network features, as follows: S1.2.1. Weighted fusion network basic features and high-order deep features are integrated to obtain network comprehensive features: ; in, is the network basic feature weight; is the high-order deep feature weight; It is the comprehensive characteristics of the network.

[0020] It also includes a zero-day attack detection unit 2, which uses a neural network combined with nonlinear dynamics to monitor the network traffic state vector based on the network comprehensive characteristics, and uses the neural network combined with the Q value function to construct an attack response strategy; In this embodiment, the zero-day attack detection unit 2 includes a behavior pattern detection module 21 and a zero-day attack response module 22; The behavior pattern detection module 21 uses a neural network combined with nonlinear dynamics to predict the network traffic state vector based on the comprehensive network features, and uses a recursive neural network combined with LSTM to perform anomaly detection on the network traffic state vector; The zero-day attack response module 22 uses a neural network in combination with a Q-value function to construct an optimized attack response strategy.

[0021] In this embodiment, the behavior pattern detection module 21 uses a neural network combined with nonlinear dynamics to predict the network traffic state vector based on the comprehensive network features, and uses a recursive neural network combined with LSTM to perform anomaly detection on the network traffic state vector. The specific method steps are as follows: S2.1.1. Based on the comprehensive network features, use the neural network model to predict the network traffic state vector: ; in, Predict the network traffic state vector at time t; is a neural network model; are neural network parameters; is the comprehensive network characteristics at time t; for the moment; S2.1.2. Based on the predicted network traffic state vector, the network traffic state vector update equation is constructed in combination with nonlinear dynamics: Network traffic state vector update equation: ; in, is the actual network traffic state vector at time t; is the system state transfer matrix; Enter the impact matrix for the system; is the noise impact matrix; is the external interference matrix; Predict the network traffic state vector at time t; S2.1.3. Based on the actual network traffic state vector at time t, a recursive neural network combined with LSTM is used to predict the network traffic state vector at the next moment and perform anomaly detection: ; ; in, Predict the network traffic state vector at time t-1; is the actual network traffic state vector at time t-1; For LSTM operation; is the LSTM parameter; is the abnormality of network traffic at time t; is the abnormality of network traffic at time t+1; S2.1.4. Setting the network traffic anomaly threshold , determine whether there is an abnormality in network traffic at time t: like , then the network traffic at time t is abnormal; like , then the network traffic at time t is normal.

[0022] In this embodiment, the zero-day attack response module 22 uses a neural network combined with a Q-value function to construct an optimized attack response strategy, and the specific method is as follows: S2.2.1, define state space and action space; The state space includes network traffic anomaly, network equipment health status, attack source information, and node load status; the action space includes network isolation, adjusting firewall rules, limiting network traffic, and initiating emergency response procedures; S2.2.2. Construct the Q-value function based on the state space and action space, and generate the Bellman equation: Bellman equation: ; in, is the state space at time t Take action space Q value; is the reward function at time t; is the discount factor; is the state space at time t; is the action space at time t; is the state space at time t+1; is the action space at time t+1; S2.2.3. Constructing a deep Q network based on the Bellman equation: Deep Q Network: ; in, are neural network parameters; is the output of the neural network to the state space at time t; S2.2.4. Design reward function: ; S2.2.5. Train the deep Q network constructed based on the Bellman equation and finally obtain the attack response strategy.

[0023] In this embodiment, S2.2.5, a deep Q network constructed based on the Bellman equation is trained to finally obtain an attack response strategy, which is as follows: By interacting with the environment, the Q value and strategy are continuously updated, and finally converge to an optimal strategy; According to the state space, a deep Q network is used to evaluate the Q value of each possible action, and the action with the largest Q value is selected as the attack response measure; The final attack response strategy can be used to respond to zero-day attacks in real time in an actual environment, and the specific response action is selected based on the current state and Q value.

[0024] It also includes a traffic resource balancing unit 3, which is used to adaptively balance system resources according to real-time changes in network traffic and device health status, and optimize attack response strategies according to the real-time status of system resources; In this embodiment, the traffic resource balancing unit 3 includes an adaptive dynamic balancing module 31 and a feedback adjustment optimization module 32; The adaptive dynamic balancing module 31 is used to adaptively balance system resources according to real-time changes in network traffic and device health status; The feedback adjustment and optimization module 32 is used to optimize the attack response strategy described in S2.2.5 according to the real-time status of system resources.

[0025] In this embodiment, the adaptive dynamic balancing module 31 is used to adaptively balance system resources according to real-time changes in network traffic and device health status. The specific method steps are as follows: S3.1.1, define the load balancing factor as : ; in, is the load balancing factor; is the system load at time t; is the maximum load that the system can withstand at time t; S3.1.2. Based on the load balancing factor, the actual network traffic state vector and the comprehensive network characteristics, a load flow balancing model is constructed: Load flow balancing model: ; in, is the state transfer matrix; is the network feature influence matrix; is the load balancing impact matrix; is the load regulation function; S3.1.3. Solve the load flow balancing model to obtain the self-balancing of network flow and system resources.

[0026] In this embodiment, the feedback adjustment and optimization module 32 is used to optimize the attack response strategy described in S2.2.5 according to the real-time status of system resources. The specific method steps are as follows: S3.2.1. Construct a loss function based on the actual network traffic state vector and load balancing factor: Loss function: ; in, is the loss function; is the target network traffic state vector; is the target load balancing factor; is the network traffic state weight; is the load balancing factor weight; S3.2.2. Based on the loss function, the back propagation algorithm is used to minimize the loss function and adjust the attack response strategy: ; in, is the adjusted optimal attack response strategy.

[0027] It also includes a strategy feedback execution unit 4, which is used to execute the attack response strategy and feedback and adjust the defense strategy, as follows: S4.1, obtaining the network traffic state vector, state space and optimal attack response strategy from the zero-day attack detection unit 2 and the traffic resource balancing unit 3, and executing the optimal attack response strategy; S4.2. After executing the optimal attack response strategy, feedback is given on the effectiveness of the current strategy, and the real-time network traffic state vector is fed back to the zero-day attack detection unit 2 to re-analyze and adjust the attack response strategy.

[0028] In this embodiment, after the attack response strategy is executed, the system will evaluate the effectiveness of the current strategy through the feedback mechanism, adjust the optimization strategy in real time according to the changes in network traffic and device status to adapt to the changes in attack patterns, and calculate the following indicators: Attack success rate: monitors whether zero-day attacks are successfully identified and defended; Network performance: evaluate whether network performance is affected, such as latency, throughput, and packet loss rate; Device health: Monitors the health of devices while executing defense policies.

[0029] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only preferred examples of the present invention, and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements all fall within the scope of the present invention to be protected.

Claims

1. A DDOS attack monitoring system based on a hybrid neural network is characterized by: include: A feature extraction and fusion unit (1), wherein the feature extraction and fusion unit (1) is used to obtain network traffic data to extract basic network features in the network traffic data, use a convolutional neural network to extract high-order deep features in the network traffic data, and fuse the basic network features with the high-order deep features to obtain comprehensive network features; A zero-day attack detection unit (2), wherein the zero-day attack detection unit (2) uses a neural network combined with nonlinear dynamics to monitor a network traffic state vector based on comprehensive network characteristics, and uses a neural network combined with a Q-value function to construct an attack response strategy; A traffic resource balancing unit (3), the traffic resource balancing unit (3) being used to adaptively balance system resources according to real-time changes in network traffic and device health status, and to optimize attack response strategies according to real-time status of system resources; A strategy feedback execution unit (4), wherein the strategy feedback execution unit (4) is used to execute the attack response strategy and provide feedback to adjust the defense strategy.

2. The DDOS attack monitoring system based on hybrid neural network according to claim 1 is characterized in that: The feature extraction and fusion unit (1) comprises a feature extraction module (11) and a feature fusion module (12); The feature extraction module (11) is used to obtain network traffic data to extract basic network features in the network traffic data, and use a convolutional neural network to extract high-order deep features in the network traffic data; The feature fusion module (12) is used to fuse the basic network features with the high-order deep features to obtain comprehensive network features.

3. The DDOS attack monitoring system based on hybrid neural network according to claim 2 is characterized in that: The feature extraction module (11) is used to obtain network traffic data to extract basic network features in the network traffic data, and use a convolutional neural network to extract high-order deep features in the network traffic data, as follows: S1.1.

1. Collect raw network traffic data from the network monitoring system: ; in, It is a collection of network traffic data; Network traffic data; Label network traffic data; is the total amount of network traffic data; Extract basic network features from network traffic data: ； in, It is a collection of basic network features; It is the basic characteristics of the network; Label the basic features of the network; is the total number of basic network features; S1.1.

2. Use convolutional neural networks to extract high-order deep features from raw network traffic data: ； in, It is a high-order deep feature; For convolutional neural network operations; are the convolutional neural network parameters; The feature fusion module (12) is used to fuse the basic network features with the high-order deep features to obtain the comprehensive network features, as follows: S1.2.

1. Weighted fusion network basic features and high-order deep features are integrated to obtain network comprehensive features: ； in, is the network basic feature weight; is the high-order deep feature weight; It is the comprehensive characteristics of the network.

4. The DDOS attack monitoring system based on hybrid neural network according to claim 3 is characterized in that: The zero-day attack detection unit (2) comprises a behavior pattern detection module (21) and a zero-day attack response module (22); The behavior pattern detection module (21) uses a neural network combined with nonlinear dynamics to predict the network traffic state vector based on the comprehensive network features, and uses a recursive neural network combined with LSTM to perform anomaly detection on the network traffic state vector; The zero-day attack response module (22) uses a neural network combined with a Q-value function to construct an optimized attack response strategy.

5. The DDOS attack monitoring system based on hybrid neural network according to claim 4 is characterized in that: The behavior pattern detection module (21) uses a neural network combined with nonlinear dynamics to predict the network traffic state vector based on the comprehensive network characteristics, and uses a recursive neural network combined with LSTM to perform anomaly detection on the network traffic state vector. The specific method steps are as follows: S2.1.

1. Based on the comprehensive network features, use the neural network model to predict the network traffic state vector: ； in, Predict the network traffic state vector at time t; is a neural network model; are neural network parameters; is the comprehensive network characteristics at time t; for the moment; S2.1.

2. Based on the predicted network traffic state vector, the network traffic state vector update equation is constructed in combination with nonlinear dynamics: Network traffic state vector update equation: ； in, is the actual network traffic state vector at time t; is the system state transfer matrix; Enter the impact matrix for the system; is the noise impact matrix; is the external interference matrix; Predict the network traffic state vector at time t; S2.1.

3. Based on the actual network traffic state vector at time t, a recursive neural network combined with LSTM is used to predict the network traffic state vector at the next moment and perform anomaly detection: ； ； in, Predict the network traffic state vector at time t-1; is the actual network traffic state vector at time t-1; For LSTM operation; is the LSTM parameter; is the abnormality of network traffic at time t, is the abnormality of network traffic at time t+1; S2.1.

4. Setting the network traffic anomaly threshold , determine whether there is an abnormality in network traffic at time t: like , then the network traffic at time t is abnormal; like , then the network traffic at time t is normal.

6. The DDOS attack monitoring system based on hybrid neural network according to claim 5 is characterized in that: The zero-day attack response module (22) uses a neural network combined with a Q-value function to construct an optimized attack response strategy, and the specific method is as follows: S2.2.1, define state space and action space; The state space includes network traffic anomaly, network equipment health status, attack source information, and node load status; the action space includes network isolation, adjusting firewall rules, limiting network traffic, and initiating emergency response procedures; S2.2.

2. Construct the Q-value function based on the state space and action space, and generate the Bellman equation: Bellman equation: ； in, is the state space at time t Take action space Q value; is the reward function at time t; is the discount factor; is the state space at time t; is the action space at time t; is the state space at time t+1; is the action space at time t+1; S2.2.

3. Constructing a deep Q network based on the Bellman equation: Deep Q Network: ； in, are neural network parameters; is the output of the neural network to the state space at time t; S2.2.

4. Design reward function: ； S2.2.

5. Train the deep Q network constructed based on the Bellman equation and finally obtain the attack response strategy.

7. The DDOS attack monitoring system based on hybrid neural network according to claim 6 is characterized in that: The flow resource balancing unit (3) comprises an adaptive dynamic balancing module (31) and a feedback adjustment optimization module (32); The adaptive dynamic balancing module (31) is used to adaptively balance system resources according to real-time changes in network traffic and device health status; The feedback adjustment and optimization module (32) is used to optimize the attack response strategy described in S2.2.5 according to the real-time status of system resources.

8. The DDOS attack monitoring system based on hybrid neural network according to claim 7 is characterized in that: The adaptive dynamic balancing module (31) is used to adaptively balance system resources according to real-time changes in network traffic and device health status. The specific method steps are as follows: S3.1.1, define the load balancing factor as : ； in, is the load balancing factor; is the system load at time t; is the maximum load that the system can withstand at time t; S3.1.

2. Based on the load balancing factor, the actual network traffic state vector and the comprehensive network characteristics, a load flow balancing model is constructed: Load flow balancing model: ； in, is the state transfer matrix; is the network feature influence matrix; is the load balancing impact matrix; is the load regulation function; S3.1.

3. Solve the load flow balancing model to obtain the self-balancing of network flow and system resources.

9. The DDOS attack monitoring system based on hybrid neural network according to claim 8 is characterized in that: The feedback adjustment and optimization module (32) is used to optimize the attack response strategy described in S2.2.5 according to the real-time status of system resources. The specific method steps are as follows: S3.2.

1. Construct the loss function based on the actual network traffic state vector and load balancing factor: Loss function: ； in, is the loss function; is the target network traffic state vector; is the target load balancing factor; is the network traffic state weight; is the load balancing factor weight; S3.2.

2. Based on the loss function, the back propagation algorithm is used to minimize the loss function and adjust the attack response strategy: ； in, is the optimal attack response strategy after adjustment.

10. The DDOS attack monitoring system based on hybrid neural network according to claim 1 is characterized in that: The strategy feedback execution unit (4) is used to execute the attack response strategy and provide feedback to adjust the defense strategy, as follows: S4.1, obtaining a network traffic state vector, a state space, and an optimal attack response strategy from the zero-day attack detection unit (2) and the traffic resource balancing unit (3), and executing the optimal attack response strategy; S4.

2. After executing the optimal attack response strategy, the effectiveness of the current strategy is fed back, and the real-time network traffic state vector is fed back to the zero-day attack detection unit (2) to re-analyze and adjust the attack response strategy.

Images