DDoS attack detection method based on information entropy and improved random forest

Abstract

The invention relates to the technical field of DDoS attack detection, and discloses an information entropy and improved random forest-based DDoS attack detection method, which comprises the following steps of: acquiring switch flow table information; extracting a destination IP address from the flow table information; calculating a destination IP address entropy according to the destination IP address, and filtering the traffic to be detected by adopting a dynamic threshold method based on a 3-sigma rule of normal distribution to obtain suspicious DDoS attack traffic; and carrying out attack detection on the suspicious DDoS attack traffic by adopting an accelerated voting random forest model based on element classifier aggregation. According to the DDoS attack detection method, the detection efficiency can be improved while the DDoS attack detection accuracy is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of DDoS attack detection, and in particular to a DDoS attack detection method based on information entropy and improved random forest. Background Art

[0002] Software-Defined Networking (SDN) is a new type of network architecture that has emerged to solve the problem that traditional network architecture is complex and difficult to manage. It provides centralized control and network programmability. The centralized control feature of SDN architecture has brought convenience to network management and innovative development, and at the same time makes the control plane located in the middle layer particularly important. When subjected to distributed denial of service (DDoS) attacks, SDN architecture is prone to single point failure affecting the entire network. In order to cope with these challenges, DDoS detection technology has gradually emerged. As one of the important research directions of network attack detection technology, DDoS attack detection based on SDN architecture plays a key role in promoting network threat detection technology and building a secure network environment.

[0003] The DDoS attack detection method under the SDN architecture mainly includes two stages: suspicious attack traffic filtering and attack traffic classification. At present, the hybrid DDoS attack detection method based on information entropy and machine learning has achieved rapid identification of DDoS attacks and can identify more complex DDoS attacks, but the existing detection method still has room for improvement in the selection of information entropy, the setting of attack thresholds, and the detection efficiency and accuracy.

[0004] The traditional DDoS attack detection method (Wang R, Jia Z, Ju L. An Entropy-Based Distributed DDoS Detection Mechanism in Software-Defined Networking [C] / / 2015 IEEE Trustcom / BigDataSE / ISPA. IEEE, 2015: 310-317.) judges the attack by periodically extracting the destination IP in the data flow and calculating the information entropy. It cannot distinguish between the surge in normal access traffic and malicious DDoS attacks. Deepa et al. (Deepa V, Sudar K, Deepalakshmi P. Design of Ensemble Learning Methods for DDoS Detection in SDN Environment [C] / / 2019 International Conference on Vision Towards Emerging Trends in Communication and Networking (ViTECoN). IEEE, 2019: 1-6.) proposed a combined learning method to detect abnormal behavior of network traffic in SDN controllers. KNN, naive Bayes, SVM and self-organizing map neural network (SOM) were combined to improve the efficiency of DDoS attack detection. The classification performance of single methods and combined methods KNN-SOM, NB-SOM and SVM-SOM were compared under the same experimental environment. The results showed that SVM-SOM achieved a higher detection rate. Zhang et al. (Zhang L, Wang J. DDoS Attack Detection Model Based on Information Entropy and DNN in SDN [J]. Journal of Computer Research and Development, 2019, 56 (5): 909-918.) proposed a hybrid DDoS attack detection model that combines information entropy and DNN deep neural network. First, the pre-detection is performed through the change of the entropy value of the source IP and destination IP of the data packet, and then the abnormal traffic is deeply detected through the trained DNN model to determine whether it is a DDoS attack. This method achieved an accuracy rate of 99% and a low false alarm rate in the experimental environment of this article.Hu et al. (Hu D, Hong P, Chen Y. FADM: DDoS Flooding Attack Detection and Mitigation System in Software-Defined Networking [C] / / 2017 IEEE Global Communications Conference. IEEE, 2017: 1-7.) proposed a DDoS attack detection and mitigation system based on entropy and SVM classifier to identify network anomalies. The sFlow agent is used to collect network traffic information, and a mitigation agent is introduced to block attack traffic, while legitimate users can access network resources normally. This method improves detection efficiency, but the detection accuracy can be improved. However, these schemes still have room for improvement in the selection of information entropy, the setting of attack thresholds, and detection efficiency and accuracy.

[0005] With the emergence of SDN, DDoS attacks have also become active in this new network architecture and have become the main security threat of SDN architecture. Therefore, how to detect DDoS attacks in a timely and effective manner is of great significance to ensure the security of SDN architecture. However, the current mainstream DDoS attack detection methods still have room for improvement in the selection of information entropy, the setting of attack thresholds, and the detection accuracy. Summary of the invention

[0006] In view of the above-mentioned deficiencies in the prior art, the present invention provides a DDoS attack detection method based on information entropy and improved random forest, which can improve the detection efficiency while ensuring the detection accuracy.

[0007] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0008] A DDoS attack detection method based on information entropy and improved random forest includes the following steps:

[0009] Get the switch flow table information;

[0010] Extract the destination IP address from the flow table information;

[0011] The destination IP address entropy is calculated based on the destination IP address, and the dynamic threshold method based on the 3-sigma law of normal distribution is used to filter the traffic to be detected to obtain suspicious DDoS attack traffic;

[0012] The accelerated voting random forest model based on meta-classifier aggregation is used to detect suspicious DDoS attack traffic.

[0013] Furthermore, the destination IP address entropy is calculated according to the destination IP address as follows:

[0014]

[0015] Among them, t i Indicates that all source IP addresses within the sampling period are d i K represents the number of packets in all flows within the sampling period, and n represents the number of source IP addresses of packets in all flows within the sampling period.

[0016] Furthermore, a dynamic threshold method based on the 3-sigma law of normal distribution is used to filter the traffic to be detected and obtain suspicious DDoS attack traffic, including:

[0017] Calculate the corresponding mean and standard deviation based on the destination IP address entropy of the historical normal state window;

[0018] The information entropy threshold is calculated based on the difference between the average value and the standard deviation of the destination IP address entropy corresponding to the historical normal state window;

[0019] The traffic with destination IP address entropy higher than the information entropy threshold is filtered out from the traffic to be detected, and the remaining traffic is regarded as suspicious DDoS attack traffic.

[0020] Furthermore, an accelerated voting random forest model based on meta-classifier aggregation is used to detect suspicious DDoS attack traffic, including:

[0021] Using suspicious DDoS attack traffic as sample data, a random forest model is constructed;

[0022] The meta-classifier aggregation method based on Kappa coefficient is used to cluster the meta-classifiers in the random forest model;

[0023] The accelerated voting method is used to optimize the voting results of the random forest model to obtain the final DDoS attack detection results.

[0024] Furthermore, the meta-classifier aggregation method based on the Kappa coefficient is used to cluster the meta-classifiers in the random forest model, including:

[0025] The Max-Min distance method is used to determine the set number of initial cluster centers;

[0026] Calculate the Kappa coefficient from each sample to each cluster center as a distance metric;

[0027] Determine the cluster label of the corresponding sample according to the cluster center closest to each sample, and assign the sample to the corresponding cluster cluster;

[0028] After traversing all samples, the cluster center is updated and the process is terminated when the maximum number of iterations is reached.

[0029] Furthermore, the Max-Min distance method is used to determine a set number of initial cluster centers, including:

[0030] Randomly select a sample from the sample set as the first initial cluster center;

[0031] Select the sample farthest from the first initial cluster center from the remaining samples as the second initial cluster center;

[0032] If the required number of cluster centers is reached, the process terminates; otherwise, the distances from all remaining samples to each cluster center are calculated, and the sample corresponding to the maximum value among the minimum distances is used as the new cluster center.

[0033] Furthermore, the distances from all remaining samples to each cluster center are calculated as follows:

[0034]

[0035] Among them, d(c i ,c j ) represents the sample x k As the cluster center c i To cluster center c j distance, max means taking the maximum value function, min means taking the minimum value function, d(x k ,c j ) represents the sample x k To cluster center c j distance.

[0036] Furthermore, the Kappa coefficient of each sample to each cluster center is calculated as follows:

[0037]

[0038] Where Kappa represents the Kappa coefficient, p o represents the actual consistency probability of the two prediction results, p e represents the probability of coincidence of the hypothesis.

[0039] Furthermore, the actual consistency probability of two prediction results is calculated as:

[0040]

[0041] Among them, M ii represents the number of samples whose first and second prediction results are both i, S represents the total number of samples, and K represents the total number of categories;

[0042] The probability of coincidence of the hypothesis is calculated as:

[0043]

[0044] Among them, M ij M represents the number of samples whose first prediction result is i and whose second observation result is j. ji It represents the number of samples whose first prediction result is j and the second observation result is i.

[0045] Furthermore, the accelerated voting method is used to optimize the voting results of the random forest model to obtain the final DDoS attack detection results, including:

[0046] Initialize the statistical set of category label voting results;

[0047] When calling each meta-classifier to vote for the predicted sample, update the value of the corresponding label in the label voting result statistical set;

[0048] After each update, determine whether there is an element value in the label voting result statistical set that exceeds half of the number of meta-classifiers; if so, the category label corresponding to the element value is used as the final DDoS attack detection result and the process ends; otherwise, continue the prediction and voting process of the next meta-classifier. After all meta-classifiers have completed the voting process, if no element value exceeds half of the number of meta-classifiers, the label with the largest number of votes is used as the final DDoS attack detection result and the process ends.

[0049] The present invention has the following beneficial effects:

[0050] The present invention first filters out normal traffic from the traffic to be detected by calculating the entropy of the destination IP address, leaving the suspicious DDoS attack traffic. Then, the trained improved random forest model is used to perform attack detection based on flow features on the suspicious DDoS attack traffic. The filtering in the first stage reduces the detection amount of the improved random forest model in the second stage, and improves the detection efficiency. At the same time, the attack samples and normal samples in the filtered suspicious attack traffic reach a relative balance, which improves the deficiency that the random forest model cannot handle unbalanced data sets well. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flowchart of a DDoS attack detection method based on information entropy and improved random forest;

[0052] Figure 2 This is a schematic diagram of the overall architecture of the DDoS attack detection model;

[0053] Figure 3 Schematic diagram of high similarity decision tree aggregation. DETAILED DESCRIPTION

[0054] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0055] The DDoS attack detection method of the present invention first collects through the flow table, and then extracts the features related to the DDoS attack detection; secondly, the DDoS attack detection under the SDN architecture is different from the DDoS attack detection under the traditional network architecture in the selection of features. The OpenFlow switch in the SDN architecture records the traffic statistics of the current network in the form of a flow table, and the controller periodically sends a request message to the switch, so that the required flow features can be obtained from the switch; then after the destination IP address is extracted from the flow table by the controller, the destination IP address entropy is calculated, and the threshold is set and updated by a dynamic threshold setting method based on the 3-sigma law of the normal distribution, and then the DDoS attack traffic filtering method based on the destination IP address entropy is used to filter the traffic to be detected; finally, the DDoS attack training data is used to train the improved random forest to generate a DDoS attack detection model. For the suspicious attack traffic after attack filtering, combined with the extracted flow features, the trained model is used to perform DDoS attack detection. The implementation of this series of processes enables the detection model to efficiently and accurately complete the DDoS attack traffic detection under the SDN architecture.

[0056] like Figure 1 and Figure 2 As shown, a DDoS attack detection method based on information entropy and improved random forest is provided in an embodiment of the present invention, comprising the following steps S1 to S4:

[0057] S1. Obtain switch flow table information;

[0058] In an optional embodiment of the present invention, step S1 records the traffic statistics of the current network in the form of a flow table from the OpenFlow switch, and the controller periodically sends a request message to the switch, so that the required flow characteristics can be obtained from the switch.

[0059] S2, extract the destination IP address from the flow table information;

[0060] In an optional embodiment of the present invention, step S2 analyzes commonly used traffic features such as source IP address, destination IP address, data packet size, etc., verifies the effectiveness through analysis, and summarizes traffic features suitable for the method.

[0061] This embodiment selects the destination IP address entropy as the only feature through feature analysis.

[0062] S3. Calculate the destination IP address entropy according to the destination IP address, and use the dynamic threshold method based on the 3-sigma law of normal distribution to filter the traffic to be detected, and obtain suspicious DDoS attack traffic;

[0063] In an optional embodiment of the present invention, step S3 establishes a normal benchmark based on the normal state in the historical data, and regards the state that deviates from the normal benchmark by a certain range as an abnormal state; in the case of normal network communication, data packets are usually sent to different hosts, so the randomness of the destination IP address is relatively large, and the corresponding entropy value is increased. In the case of a DDoS attack, a large number of data packets are sent to the same host, resulting in a decrease in the randomness of the destination IP address and a decrease in the corresponding entropy. Therefore, this embodiment sets a dynamic attack threshold based on the 3-sigma law of the normal distribution, and regards the part above the threshold as normal traffic and filters it out from the traffic to be detected, and the remaining part is treated as suspicious DDoS attack traffic for subsequent detection.

[0064] Let vector D = {d1, d2, ..., d n} represents the set of source IP addresses of all packets in the flow within the sampling period. For any value d in the set i , let all source IP addresses in the sampling period be d i The number of packets is t i , then the calculation formula for the source IP address entropy in the flow within this period is:

[0065]

[0066] Among them, t i Indicates that all source IP addresses within the sampling period are d i The number of packets in the sampling period, K represents the number of packets in all flows. n represents the number of source IP addresses of packets in all flows within the sampling period. The calculation of destination IP address entropy and packet size entropy is similar to this; the change of destination IP address entropy obtained through feature analysis can preliminarily distinguish obviously normal traffic from suspicious DDoS attack traffic, so the change of destination IP address entropy is selected as the traffic feature for analysis.

[0067] This embodiment uses a dynamic threshold method based on the 3-sigma rule of normal distribution to filter the traffic to be detected and obtain suspicious DDoS attack traffic, including:

[0068] Calculate the corresponding mean and standard deviation based on the destination IP address entropy of the historical normal state window;

[0069] The information entropy threshold is calculated based on the difference between the average value and the standard deviation of the destination IP address entropy corresponding to the historical normal state window;

[0070] The traffic with destination IP address entropy higher than the information entropy threshold is filtered out from the traffic to be detected, and the remaining traffic is regarded as suspicious DDoS attack traffic.

[0071] The dynamic threshold setting method proposed in this embodiment is based on the 3-sigma rule. This rule can be described as that in a normal distribution, the percentage of values ​​less than one standard deviation, two standard deviations, and three standard deviations from the mean value are 68.27%, 95.45%, and 99.73%, respectively. It can be expressed as:

[0072] Pr(μ-1σ≤X≤μ+1σ)≈0.682689492139086

[0073] Pr(μ-2σ≤X≤μ+2σ)≈0.954499736103642

[0074] Pr(μ-3σ≤X≤μ+3σ)≈0.997300203936740

[0075] Where X represents the observed value of the normally distributed random variable, μ represents the mean of the normal distribution function, and σ is the standard deviation of the normal distribution function.

[0076] The 3-sigma rule can be applied to DDoS attack detection based on information entropy. It can be expressed as follows: Under normal conditions, about 68.27% of the possible values ​​of the destination IP address entropy of the current window will fall within the range of ±1 standard deviation [μ-σ,μ+σ] of the average value of the destination IP address entropy in the past period of time; about 95.45% of the possible values ​​will fall within the range of ±2 standard deviations [μ-2σ,μ+2σ] of the average value of the destination IP address entropy in the past period of time; about 99.73% of the possible values ​​will fall within the range of ±3 standard deviations [μ-3σ,μ+3σ] of the average value of the destination IP address entropy in the past period of time. Since the entropy of the destination IP address in the attack state is lower than that in the normal state, it is located to the right of the above range, that is, (μ+nσ,+∞), the entropy values ​​of the part where n=1,2,3 can be directly regarded as normal. In order to strengthen the filtering conditions for normal traffic, so that the traffic judged as normal traffic does not contain or contains very little abnormal traffic, this embodiment sets the threshold to μ-σ, that is,

[0077] Threshold attack =μ entropy -σ entropy

[0078] Among them, μ entropy is the average entropy of the destination IP address in the most recent k normal state windows, σentropy is the standard deviation of the destination IP address entropy of the most recent k normal state windows. The calculation formulas for the two are as follows:

[0079]

[0080] The DDoS attack traffic filtering method based on destination IP address entropy proposed in this embodiment is different from the existing DDoS attack detection method based on information entropy in that the method of the present invention does not directly use information entropy to perform DDoS attack detection on traffic, but filters out part of the normal traffic from the traffic to be detected and leaves the suspicious DDoS attack traffic. The method focuses on the fact that the normal traffic filtered out does not contain attack traffic as much as possible, and the attack traffic is kept in the suspicious attack traffic as much as possible for subsequent detection. Therefore, this embodiment sets the judgment conditions for abnormal values ​​more loosely and the judgment conditions for normal values ​​more strictly. In this embodiment, about 84.2% of the values ​​in the range of [μ-σ,∞) under the normal distribution are regarded as normal values, and about 15.8% of the values ​​in the range of (0,μ-σ] are regarded as abnormal values. This allows values ​​that are close enough to the mean of the normal range to be judged as normal values, ensuring that the traffic that is judged as normal traffic during filtering does not contain or contains very little abnormal traffic, so that the underreporting rate of the filtering method is at a low level.

[0081] S4. Use the accelerated voting random forest model based on meta-classifier aggregation to detect suspicious DDoS attack traffic.

[0082] In an optional embodiment of the present invention, after obtaining the suspicious DDoS attack traffic in step S4, the DDoS attack training data is used to train the improved random forest to generate a DDoS attack detection model. The suspicious attack traffic after attack filtering is combined with the extracted flow features and the trained model is used to detect DDoS attacks. The detection model merges the decision trees with high correlation in the random forest through the k-means algorithm optimized based on the Max-Min distance algorithm, reduces the number of decision trees in the random forest model to reduce the complexity of the model, and introduces an improved voting strategy to stop the prediction when a category obtains half of the votes, without waiting for all decision trees to complete the voting.

[0083] This embodiment uses an accelerated voting random forest model based on meta-classifier aggregation to detect suspicious DDoS attack traffic, including:

[0084] Using suspicious DDoS attack traffic as sample data, a random forest model is constructed;

[0085] The meta-classifier aggregation method based on Kappa coefficient is used to cluster the meta-classifiers in the random forest model;

[0086] The accelerated voting method is used to optimize the voting results of the random forest model to obtain the final DDoS attack detection results.

[0087] Among them, the meta-classifier aggregation method based on the Kappa coefficient is used to cluster the meta-classifiers in the random forest model, including:

[0088] The Max-Min distance method is used to determine the set number of initial cluster centers;

[0089] Calculate the Kappa coefficient from each sample to each cluster center as a distance metric;

[0090] Determine the cluster label of the corresponding sample according to the cluster center closest to each sample, and assign the sample to the corresponding cluster cluster;

[0091] After traversing all samples, the cluster center is updated and the process is terminated when the maximum number of iterations is reached.

[0092] Among them, the Max-Min distance method is used to determine the set number of initial cluster centers, including:

[0093] Randomly select a sample from the sample set as the first initial cluster center;

[0094] Select the sample farthest from the first initial cluster center from the remaining samples as the second initial cluster center;

[0095] If the required number of cluster centers is reached, the process terminates; otherwise, the distances from all remaining samples to each cluster center are calculated, and the sample corresponding to the maximum value among the minimum distances is used as the new cluster center.

[0096] Among them, the accelerated voting method is used to optimize the voting results of the random forest model to obtain the final DDoS attack detection results, including:

[0097] Initialize the statistical set of category label voting results;

[0098] When calling each meta-classifier to vote for the predicted sample, update the value of the corresponding label in the label voting result statistical set;

[0099] After each update, determine whether there is an element value in the label voting result statistical set that exceeds half of the number of meta-classifiers; if so, the category label corresponding to the element value is used as the final DDoS attack detection result and the process ends; otherwise, continue the prediction and voting process of the next meta-classifier. After all meta-classifiers have completed the voting process, if no element value exceeds half of the number of meta-classifiers, the label with the largest number of votes is used as the final DDoS attack detection result and the process ends.

[0100] This embodiment uses Bagging technology to randomly select n bootstrap sampling samples from a complete training set T containing N samples. These selected n samples are used to train a decision tree, representing the samples at the root node of the decision tree. Each sample consists of M attributes. When a node in the decision tree needs to be split, m attributes are randomly selected from these M attributes, where m<<M. From the m attributes, a specific strategy (such as information gain) is used to specify an attribute as the split attribute of the node. The above process is repeated to build a large number of decision trees, and finally a random forest is formed. Secondly, decision trees with significant similarity are called "highly similar decision trees", which are characterized by always producing the same classification results in most samples. Therefore, if a decision tree model makes an accurate prediction for a specific sample, other highly similar decision tree models may also make the same correct prediction. By using clustering technology to merge these highly similar decision trees, the number of decision trees in the random forest can be reduced. This reduction effectively reduces the complexity of the random forest ensemble while maintaining its classification accuracy to a large extent, thereby improving the prediction speed of the model.

[0101] In order to measure the similarity between decision trees, the present embodiment uses the Kappa coefficient. The Kappa coefficient is a statistical measure used to evaluate the consistency between two sets of observations. Here, the two sets of observations may come from two situations: one is that the same observer examines an object twice, and the other is that two different observers each examine the same object once. In the classification task, there is a consistency problem between the predicted results of the model and the actual results. Therefore, the Kappa coefficient can also be used to measure the predictive performance of the classification model. Among them, the calculation method of calculating the Kappa coefficient of each sample to each cluster center is:

[0102]

[0103] Where Kappa represents the Kappa coefficient, p o represents the actual consistency probability of the two prediction results, p e represents the probability of coincidence of the hypothesis.

[0104] Among them, the actual consistency probability of two prediction results is calculated as follows:

[0105]

[0106] Among them, M ii represents the number of samples whose first and second prediction results are both i, S represents the total number of samples, and K represents the total number of categories;

[0107] The probability of coincidence of the hypothesis is calculated as:

[0108]

[0109] Among them, M ij M represents the number of samples whose first prediction result is i and whose second observation result is j. ji It represents the number of samples whose first prediction result is j and the second observation result is i.

[0110] The absolute value of the Kappa coefficient is less than or equal to 1, that is, |Kappa|≤1. If the two prediction results are completely consistent, the value of the Kappa coefficient is 1. If there is no consistency between the two prediction results, the value of the Kappa coefficient is less than or equal to 0.

[0111] Clustering is an unsupervised learning task that is usually used to divide unlabeled samples by a specified distance metric, aggregating samples with proximity into cohesive clusters. This embodiment uses the k-means algorithm optimized by the maximum and minimum distance method to cluster the meta-classifiers in the random forest ensemble. In order to determine the similarity between the meta-classifiers, this embodiment calculates the Kappa coefficient value based on their prediction results on the test set. After normalization, this value is used as a distance metric to facilitate the clustering process. Meta-classifiers with similar distances are combined into clusters. From each cluster, the meta-classifier that exhibits the highest classification accuracy is selected to form a random forest ensemble.

[0112] First, the Max-Min method is used to determine k initial cluster centers, and the optimal value of k is determined through experiments. For samples outside the cluster center, the distance from each sample to each cluster center is calculated. Subsequently, the cluster label of the sample is determined according to the proximity of the sample to the nearest cluster center, so that the sample is assigned to the corresponding cluster. The cluster center is updated after each clustering iteration. The algorithm process terminates when the maximum number of iterations is reached. From each resulting cluster, the decision tree with the highest classification accuracy is selected to form an improved random forest model, such as Figure 3 As shown. The core principle of the maximum and minimum distance algorithm for determining the initial cluster centers is to maximize the distance between cluster centers during the selection process. This approach ensures that the selected sample points of the cluster centers are not concentrated in any particular dense area, thereby preventing the clustering algorithm from converging to a local optimum in its final result.

[0113] This embodiment uses the k-means algorithm to cluster and merge high-similarity decision trees to reduce the number of meta-classifiers in the random forest, thereby improving the prediction speed of the random forest model; and adopts a strategy of terminating when more than half of the votes are obtained in the voting stage, thereby reducing the prediction time of the random forest model.

[0114] This embodiment adopts an algorithm for selecting initial cluster centers based on the Max-Min distance algorithm. First, a sample is randomly selected from the sample set as the first initial cluster center. Next, from the remaining samples except the selected sample, the sample farthest from the first initial cluster center is selected as the second initial cluster center. If the required number of cluster centers is reached, the algorithm terminates. Otherwise, the distance from all remaining samples to each cluster center is calculated. From these distances, the minimum distance of each sample is selected to form a group. Then, the maximum value is selected from this group of minimum distances. The sample corresponding to the maximum value is designated as the next cluster center sample. The distance from all remaining samples to each cluster center is calculated as follows:

[0115]

[0116] Among them, d(c i ,c j ) represents the sample x k As the cluster center c i To cluster center c j distance, max means taking the maximum value function, min means taking the minimum value function, d(x k ,c j ) represents the sample x k To cluster center c j distance.

[0117] When using traditional random forests for classification, the model's final prediction is determined by voting based on the predictions of each individual classifier. The model aggregates these individual predictions only after the last classifier has finished its voting process. Using the simple majority rule, the final output is determined by the class label with the highest number of votes. In binary or multi-classification scenarios, if a specific class label receives more than 50% of the votes, it becomes the label with the most votes among all classes. Therefore, it can be output as the final prediction immediately without waiting for the prediction and voting process to complete.

[0118] This embodiment proposes a strategy of terminating when more than half of the votes are obtained to speed up the voting speed of the traditional random forest. In order to count the number of votes obtained by each category label in the prediction process of the random forest, a category label vote result statistical set V = {vote j, j=1,2,…,n}. In the process of calling each meta-classifier to vote for the predicted sample, update the value of the corresponding label in the voting result statistical set. At the same time, after each update, determine whether there is an element value that exceeds half of the number of meta-classifiers (here it is assumed that each meta-classifier has the same weight and is 1). If so, it means that at this time, a category label has obtained more than half of the votes and has become the category label with the most votes. It should be output as the final result and the algorithm process ends. Otherwise, continue the prediction and voting process of the next meta-classifier. When all meta-classifiers have completed the voting process, if it is not found that a category label has obtained more than half of the votes in the total number, the traditional simple majority principle is used to determine the final result as the label with the most votes.

[0119] Based on the above analysis, the termination strategy is triggered when the number of votes exceeds half, with the aim of speeding up the voting process in the traditional random forest. The above enhancements are only for the voting stage of the traditional random forest and do not affect the prediction accuracy of the model. Compared with the traditional random forest method, the random forest with the "terminate when majority" strategy quickly ends the prediction process after determining the prediction result, thereby speeding up the prediction speed.

[0120] This embodiment divides the detection process into two stages. In the first stage, the DDoS attack traffic filtering method based on the dynamic threshold destination IP address entropy is used to filter out the normal traffic in the traffic sample to be detected, leaving the suspicious attack traffic. This part of the suspicious DDoS attack traffic contains the real attack traffic and the normal traffic that is regarded as the attack traffic. In the second stage, the improved random forest algorithm is used for more accurate classification detection.

[0121] The advantage of this two-stage detection is that the first stage uses a lightweight method based on the entropy of the destination IP address to quickly filter out suspicious traffic, which reduces the amount of detection for the second stage using the improved random forest-based detection method and improves the detection efficiency of the entire method. Compared with the method based only on information entropy, the more accurate detection in the second stage ensures the detection accuracy of the entire method. At the same time, after filtering in the first stage, the normal traffic and attack traffic reaching the second stage are relatively balanced, which improves the deficiency that random forests cannot handle unbalanced data well. The specific steps are as follows:

[0122] Flow table collection: By periodically sending ofp_flow_stats_request messages to the switch, the SDN controller can collect flow table information from the switch's response messages.

[0123] Feature extraction: The purpose of feature extraction is to extract features related to DDoS attack detection from the flow table information collected in the previous step. By periodically sending request messages to the switch through the controller, the required flow features can be obtained from the switch.

[0124] Attack filtering: After the controller extracts the destination IP address from the flow table, it calculates the destination IP address entropy and uses a dynamic threshold setting method based on the 3-sigma law of normal distribution to set and update the threshold. The calculated destination IP address entropy is compared with the corresponding attack threshold. If it is greater than the attack threshold, it is considered normal traffic filtering. Otherwise, it is considered suspicious attack traffic and handed over to subsequent steps for more accurate attack detection.

[0125] Attack detection: The improved random forest method proposed in this invention is used to perform DDoS attack classification detection. First, the improved random forest is trained using DDoS attack training data to generate a DDoS attack detection model. The trained model is used to perform DDoS attack detection on the suspicious attack traffic after attack filtering, combined with the extracted flow features.

[0126] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0127] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0129] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0130] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A DDoS attack detection method based on information entropy and improved random forest, characterized in that: The following steps are involved: Get the switch flow table information; Extract the destination IP address from the flow table information; The destination IP address entropy is calculated based on the destination IP address, and the dynamic threshold method based on the 3-sigma law of normal distribution is used to filter the traffic to be detected to obtain suspicious DDoS attack traffic; The accelerated voting random forest model based on meta-classifier aggregation is used to detect suspicious DDoS attack traffic.

2. According to claim 1, a DDoS attack detection method based on information entropy and improved random forest is characterized in that: The calculation method of destination IP address entropy is as follows: Among them, t i Indicates that all source IP addresses within the sampling period are d i K represents the number of packets in all flows within the sampling period, and n represents the number of source IP addresses of packets in all flows within the sampling period.

3. According to claim 1, a DDoS attack detection method based on information entropy and improved random forest is characterized in that: The dynamic threshold method based on the 3-sigma law of normal distribution is used to filter the traffic to be detected and obtain suspicious DDoS attack traffic, including: Calculate the corresponding mean and standard deviation based on the destination IP address entropy of the historical normal state window; The information entropy threshold is calculated based on the difference between the average value and the standard deviation of the destination IP address entropy corresponding to the historical normal state window; The traffic with destination IP address entropy higher than the information entropy threshold is filtered out from the traffic to be detected, and the remaining traffic is regarded as suspicious DDoS attack traffic.

4. According to claim 1, a DDoS attack detection method based on information entropy and improved random forest is characterized in that: The accelerated voting random forest model based on meta-classifier aggregation is used to detect suspicious DDoS attack traffic, including: Using suspicious DDoS attack traffic as sample data, a random forest model is constructed; The meta-classifier aggregation method based on Kappa coefficient is used to cluster the meta-classifiers in the random forest model; The accelerated voting method is used to optimize the voting results of the random forest model to obtain the final DDoS attack detection results.

5. According to claim 4, a DDoS attack detection method based on information entropy and improved random forest is characterized in that: The meta-classifier aggregation method based on the Kappa coefficient is used to cluster the meta-classifiers in the random forest model, including: The Max-Min distance method is used to determine the set number of initial cluster centers; Calculate the Kappa coefficient from each sample to each cluster center as a distance metric; Determine the cluster label of the corresponding sample according to the cluster center closest to each sample, and assign the sample to the corresponding cluster; After traversing all samples, the cluster center is updated and the process is terminated when the maximum number of iterations is reached.

6. A DDoS attack detection method based on information entropy and improved random forest according to claim 5, characterized in that: The Max-Min distance method is used to determine the set number of initial cluster centers, including: Randomly select a sample from the sample set as the first initial cluster center; Select the sample farthest from the first initial cluster center from the remaining samples as the second initial cluster center; If the required number of cluster centers is reached, the process terminates; otherwise, the distances from all remaining samples to each cluster center are calculated, and the sample corresponding to the maximum value among the minimum distances is used as the new cluster center.

7. A DDoS attack detection method based on information entropy and improved random forest according to claim 6, characterized in that: The distances of all remaining samples to each cluster center are calculated as: Among them, d(c i ,c j ) represents the sample x k As the cluster center c i To cluster center c j distance, max means taking the maximum value function, min means taking the minimum value function, d)x k ,c j ) represents the sample x k To cluster center c j distance.

8. A DDoS attack detection method based on information entropy and improved random forest according to claim 5, characterized in that: The calculation method for calculating the Kappa coefficient of each sample to each cluster center is: Where Kappa represents the Kappa coefficient, p o represents the actual consistency probability of the two prediction results, p e represents the probability of coincidence of the hypothesis.

9. A DDoS attack detection method based on information entropy and improved random forest according to claim 8, characterized in that: The actual probability of agreement between two predictions is calculated as: Among them, M ii represents the number of samples whose first and second prediction results are both i, S represents the total number of samples, and K represents the total number of categories; The probability of coincidence of the hypothesis is calculated as: Among them, M ij M represents the number of samples whose first prediction result is i and whose second observation result is j. ji It represents the number of samples whose first prediction result is j and the second observation result is i.

10. A DDoS attack detection method based on information entropy and improved random forest according to claim 4, characterized in that: The accelerated voting method is used to optimize the voting results of the random forest model to obtain the final DDoS attack detection results, including: Initialize the statistical set of category label voting results; When calling each meta-classifier to vote for the predicted sample, update the value of the corresponding label in the label voting result statistical set; After each update, determine whether there is an element value in the label voting result statistical set that exceeds half of the number of meta-classifiers; if so, the category label corresponding to the element value is used as the final DDoS attack detection result and the process ends; otherwise, continue the prediction and voting process of the next meta-classifier. After all meta-classifiers have completed the voting process, if no element value exceeds half of the number of meta-classifiers, the label with the largest number of votes is used as the final DDoS attack detection result and the process ends.

Images