Distributed denial of service attack defense method and system, medium and program product

Abstract

The invention discloses a distributed denial of service attack defense method and system, a medium and a program product, and the method comprises the steps: calculating feature parameters of network flow data; generating a multi-dimensional feature vector; constructing a time sequence state transition matrix; extracting a feature root sequence, and calculating a modulus length change rate; constructing a dynamic phase diagram based on the mode length change rate; the Euclidean distance between adjacent orbit points in the dynamic phase diagram is calculated, when it is determined that an abnormal attractor appears, corresponding flow data are extracted, and a self-similarity index is calculated; when the self-similarity index is greater than a third preset threshold value, determining a high danger level; when the value is greater than a fourth preset threshold and less than or equal to a third preset threshold, determining that the danger level is a middle danger level; when less than or equal to a fourth preset threshold, determining that the danger level is low; executing a discarding strategy on the high danger level; executing a bandwidth limiting strategy for the middle danger level; a delayed forwarding policy is performed for a low hazard level. The accuracy of formulating and implementing the protection strategy is improved, and the security of the network is further improved.

Description

Technical Field

[0001] The present application belongs to the field of server defense, and in particular, relates to a distributed denial of service attack defense method, system, medium and program product. Background Art

[0002] With the rapid development of Internet technology, distributed denial of service (DDoS) attacks have become one of the most threatening attack methods in the field of network security. DDoS attacks control a large number of infected hosts and send massive request data to the target system, causing the target system to run out of resources and unable to provide services to normal users. Traditional DDoS defense methods mainly rely on means such as traffic cleaning and access restrictions, but these methods often have a delayed response and are prone to accidentally injuring normal users, seriously affecting the system's service quality.

[0003] At present, DDoS attack defense technology based on traffic feature analysis has been widely used. This technology establishes a traffic baseline database by analyzing various characteristic parameters of network traffic in real time, such as packet size, arrival time interval, protocol type, etc. When it is detected that the traffic characteristics deviate from the baseline, the system automatically triggers the protection mechanism to filter or limit the abnormal traffic, thereby effectively reducing the harm of DDoS attacks. This method has higher recognition accuracy and faster response speed than traditional defense methods.

[0004] However, due to the continuous and progressive nature of DDoS attacks, the traffic characteristics within a single time window may not be able to reflect the entire attack process, which makes it difficult for the defense system to accurately grasp the development trend of the attack situation, thereby reducing the accuracy of the formulation and implementation of protection strategies, resulting in reduced network security. Summary of the invention

[0005] The present application provides a distributed denial of service attack defense method, system, medium and program product for improving the accuracy of formulation and implementation of protection strategies, thereby improving the security of the network.

[0006] In a first aspect, the present application provides a distributed denial of service attack defense method, which calculates characteristic parameters of network traffic data in each preset time window, the characteristic parameters including packet size, arrival time interval, protocol type, traffic burstiness and packet entropy value; The feature parameters are combined according to weighted coefficients to generate a multi-dimensional feature vector, where the weighted coefficients are determined based on historical attack data; Construct a time series state transfer matrix according to the multidimensional feature vector, wherein the row vector of the time series state transfer matrix represents the multidimensional feature vector of the current time window, and the column vector represents the multidimensional feature vector of the next time window; Extract the characteristic root sequence of the time series state transfer matrix and calculate the modulus length change rate of the characteristic root sequence; Construct a dynamic phase diagram based on the mode length change rate; Calculate the Euclidean distance of adjacent track points in the dynamic phase graph. When the Euclidean distance of adjacent track points is less than a first preset threshold and the aggregation degree of the track points is greater than a second preset threshold, it is determined that an abnormal attractor appears. The aggregation degree of the track points is obtained by calculating the number of track points within a unit area. Extract the flow data of the time window corresponding to the abnormal attractor and calculate the self-similarity index of the flow data; When the self-similarity index is greater than the third preset threshold, the flow data is determined to be at a high risk level; when the self-similarity index is greater than the fourth preset threshold and is less than or equal to the third preset threshold, the flow data is determined to be at a medium risk level; when the self-similarity index is less than or equal to the fourth preset threshold, the flow data is determined to be at a low risk level; A discard strategy is implemented for traffic data of a high-risk level; a bandwidth restriction strategy is implemented for traffic data of a medium-risk level; and a delayed forwarding strategy is implemented for traffic data of a low-risk level.

[0007] By adopting the above technical solution, the characteristic parameters of network traffic data in the preset time window are calculated and a multi-dimensional feature vector is generated according to the weighted coefficient combination, so that the expression of traffic characteristics is more comprehensive and accurate. The time series state transfer matrix constructed based on the multi-dimensional feature vector can reflect the dynamic change law of traffic characteristics, and the extracted characteristic root sequence and its modulus change rate can quantitatively describe the evolution process of traffic state. The modulus change rate is mapped to the dynamic phase diagram, and the abnormal change pattern of traffic characteristics can be discovered in time by analyzing the Euclidean distance and aggregation of adjacent track points. Combined with the self-similarity index of the traffic data in the time window corresponding to the abnormal attractor, and corresponding protection strategies are adopted for different danger levels, the accurate identification and hierarchical protection of distributed denial of service attacks are realized, while the false alarm rate is reduced while the detection accuracy is improved, and the impact on normal traffic is reduced through the hierarchical protection mechanism, which improves the accuracy of the formulation and implementation of the protection strategy, thereby improving the security of the network.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the feature parameters are combined according to weighted coefficients to generate a multidimensional feature vector, specifically including: Calculate the correlation between each characteristic parameter and the attack behavior based on historical attack data; Based on the correlation, the optimization objective function is constructed, and the particle swarm algorithm is used to solve the optimization objective function to obtain the initial weights of each characteristic parameter; Normalize the initial weights to obtain weighted coefficients; The characteristic parameters are linearly combined according to the weighting coefficients to obtain a multi-dimensional characteristic vector.

[0009] By adopting the above technical solution, the correlation between the feature parameters and the attack behavior is calculated to quantify the importance of the feature. The particle swarm algorithm is used to solve the optimization objective function containing the correlation information, and the optimal weight configuration of each feature parameter can be obtained. The weight coefficients obtained after normalizing the initial weights have good numerical stability. The multi-dimensional feature vectors generated by linearly combining the feature parameters using these weight coefficients can highlight the feature information that is highly correlated with the attack behavior, improve the feature vector's ability to characterize the attack traffic, and enhance the subsequent attack detection effect based on the feature vector. At the same time, due to the adaptive optimization characteristics of the weights, the system has the ability to continuously learn and optimize performance.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the modulus length change rate of the characteristic root sequence specifically includes: Calculate the difference in modulus length between two adjacent characteristic roots in the characteristic root sequence; Statistical change trend of module length difference within the preset time window; Based on the exponential smoothing method, the change trend is predicted to obtain the predicted module length difference; The module length change rate is calculated based on the deviation between the predicted module length difference and the module length difference.

[0011] By adopting the above technical solution, the difference in modulus length between adjacent characteristic roots and its changing trend are analyzed, and a quantitative description model of the evolution of traffic state is established. The exponential smoothing method is used to predict the changing trend of the modulus length difference, and abnormal changes in traffic characteristics can be discovered in time. The modulus length change rate calculated based on the deviation between the predicted value and the actual value has a strong time series correlation, which can accurately reflect the dynamic change characteristics of the traffic state, enhance the system's early warning ability for attack behaviors, and enable protective measures to respond to changes in traffic state more promptly and accurately.

[0012] In combination with some embodiments of the first aspect, in some embodiments, after executing the delayed forwarding strategy for the traffic data of the low risk level, the method further includes: Detect the queue length and waiting time of traffic in the delayed forwarding queue to obtain a queue state sequence; Calculate the queue congestion index based on the queue state sequence; When the queue congestion index exceeds a fifth preset threshold, re-evaluating the danger level of data traffic in the queue; The burst index and periodic index of data traffic are calculated based on the results of the risk level assessment. The burst index is determined based on the ratio of the peak value to the mean value of data traffic, and the periodic index is determined based on the autocorrelation function of the data traffic. When the burst index exceeds the sixth preset threshold or the periodic index exceeds the seventh preset threshold, the corresponding data traffic is increased to a medium risk level.

[0013] By adopting the above technical solution, the queue status is detected and the queue congestion index is calculated to monitor the processing of low-risk level traffic. When congestion occurs, the system will re-evaluate the risk level of the data traffic in the queue, and combine the burst index and periodic index to judge the change of traffic characteristics, and can timely discover the trend of low-risk level traffic evolving to high-risk level. By analyzing the burst and periodic characteristics of traffic, the system can accurately identify traffic with attack characteristics and adjust its risk level in time, thereby optimizing the execution effect of the protection strategy, improving the system's adaptability to attack behavior, and enhancing the accuracy of the protection strategy.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, re-evaluating the risk level of data traffic in the queue specifically includes: Extracting short-term statistical features of data traffic in the delayed forwarding queue, the short-term statistical features include packet arrival interval, packet length distribution and protocol type distribution; Calculate the change acceleration of flow characteristics based on short-term statistical characteristics; Use the changing acceleration to identify the mutation points and inflection points of traffic characteristics and obtain the key moment sequence; The occurrence frequency of the preset abnormal event is calculated according to the key moment sequence statistics. When the occurrence frequency exceeds an eighth preset threshold, the danger level of the corresponding data traffic is increased to the next level.

[0015] By adopting the above technical solution, the short-term statistical characteristics of the data traffic in the delayed forwarding queue are extracted, and the change acceleration of the traffic characteristics is calculated, so that the dynamic change characteristics of the data traffic can be grasped in real time. The mutation points and inflection points of the traffic characteristics are identified by using the change acceleration, and the obtained key moment sequence reflects the abnormal change pattern of the data traffic in the time dimension. Based on the occurrence frequency of the preset abnormal events in the key moment sequence statistics, it is judged whether the danger level of the data traffic needs to be increased by comparing with the preset threshold, so that the system can timely detect the attack traffic that evolves from a low danger level to a high danger level, improve the system's recognition sensitivity to attack behaviors, reduce the defense delay caused by the lag in the judgment of the danger level, enhance the system's defense capabilities against progressive attacks, and make the adjustment of the defense strategy more timely and accurate.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, after the corresponding data traffic is increased to a medium risk level, the method further includes: Based on the hazard level assessment results, a conversion probability matrix of data traffic at different hazard levels is constructed; The conversion probability matrix is ​​used to calculate the conversion trend of data flow at each hazard level; When the conversion probability of the data flow of the low danger level to the data flow of the medium danger level exceeds a ninth preset threshold, extracting characteristic parameters of the data flow of the low danger level; The execution parameters of the delayed forwarding strategy are adjusted according to the characteristic parameters.

[0017] By adopting the above technical solution, the conversion probability matrix of data traffic of different danger levels is constructed based on the danger level assessment results, and the conversion trend of data traffic of each danger level is calculated. The system can accurately grasp the migration law of data traffic between different danger levels. When the conversion probability of low-risk data traffic to medium-risk data traffic exceeds the preset threshold, by extracting the characteristic parameters of low-risk data traffic and adjusting the execution parameters of the delayed forwarding strategy accordingly, the system can optimize the defense strategy in a targeted manner, so that the system can pre-adjust the defense strategy when the data traffic shows a trend of increasing danger level, reducing the lag of waiting until the attack traffic completely evolves to a high-risk level before taking corresponding measures in the traditional solution. By analyzing the characteristic parameters of low-risk data traffic and dynamically adjusting the delayed forwarding strategy, the system's ability to prevent potential attack behaviors is improved, and the risk of reduced defense effect caused by the solidification of the defense strategy is reduced.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, adjusting the execution parameters of the delayed forwarding strategy according to the characteristic parameters specifically includes: Count the resource occupancy rate and processing delay of the delayed forwarding strategy to obtain the resource utilization state sequence; Calculate the system load balancing index based on the resource utilization state sequence; Allocate system processing resources based on system load balancing index and conversion trend; The execution priority of the delayed forwarding strategy is adjusted according to the allocation result of the system processing resources.

[0019] By adopting the above technical solution, the resource occupancy rate and processing delay of the delayed forwarding strategy are counted to obtain the resource utilization state sequence, and the system load balance index is calculated based on the sequence. The system processing resources are allocated in combination with the system load balance index and the conversion trend, so that the system can optimize resource utilization efficiency while ensuring the defense effect. The execution priority of the delayed forwarding strategy is adjusted according to the allocation result of the system processing resources, so that the system can allocate more processing power to data traffic that needs more attention when resources are limited.

[0020] In a second aspect, an embodiment of the present application provides a distributed denial of service attack defense system, which distributed denial of service attack defense system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to cause the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a system, causes the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer program product, characterized in that when the computer program product runs on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0023] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. The present application provides a distributed denial of service attack defense method, which calculates the characteristic parameters of network traffic data within a preset time window and generates a multidimensional feature vector according to the weighted coefficient combination, so that the expression of traffic characteristics is more comprehensive and accurate. The time series state transfer matrix constructed based on the multidimensional feature vector can reflect the dynamic change law of traffic characteristics, and the extracted characteristic root sequence and its modulus change rate can quantitatively describe the evolution process of the traffic state. The modulus change rate is mapped to the dynamic phase diagram, and the abnormal change pattern of traffic characteristics can be discovered in time by analyzing the Euclidean distance and aggregation of adjacent track points. Combined with the self-similarity index of the traffic data in the time window corresponding to the abnormal attractor, and corresponding protection strategies are adopted for different danger levels, the accurate identification and hierarchical protection of distributed denial of service attacks are realized, while improving the detection accuracy and reducing the false alarm rate, and reducing the impact on normal traffic through the hierarchical protection mechanism, improving the accuracy of the formulation and implementation of the protection strategy, and thus improving the security of the network.

[0024] 2. This application provides a distributed denial of service attack defense method that detects queue status and calculates queue congestion index to monitor the processing of low-risk level traffic. When congestion occurs, the system will re-evaluate the risk level of the data traffic in the queue, and combine the burst index and periodic index to judge the change of traffic characteristics, and can promptly discover the trend of low-risk level traffic evolving to high-risk level. By analyzing the burst and periodic characteristics of traffic, the system can accurately identify traffic with attack characteristics and adjust its risk level in a timely manner, thereby optimizing the execution effect of the protection strategy, improving the system's adaptability to attack behaviors, and enhancing the accuracy of the protection strategy.

[0025] 3. The present application provides a distributed denial of service attack defense method. Based on the results of the danger level assessment, a conversion probability matrix of data traffic at different danger levels is constructed, and the conversion trend of data traffic at each danger level is calculated. The system can accurately grasp the migration law of data traffic between different danger levels. When the conversion probability of data traffic at a low danger level to data traffic at a medium danger level exceeds a preset threshold, by extracting the characteristic parameters of the data traffic at a low danger level and adjusting the execution parameters of the delayed forwarding strategy accordingly, the system can optimize the defense strategy in a targeted manner, so that the system can pre-adjust the defense strategy when the data traffic shows a trend of increasing danger levels, reducing the lag in the traditional solution of waiting until the attack traffic has completely evolved into a high danger level before taking corresponding measures. By analyzing the characteristic parameters of low-risk data traffic and dynamically adjusting the delayed forwarding strategy, the system's ability to prevent potential attack behaviors is improved, and the risk of reduced defense effectiveness caused by the solidification of the defense strategy is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of a distributed denial of service attack defense method in an embodiment of the present application.

[0027] Figure 2 It is a flow chart of a dynamic management method of a delayed forwarding queue in an embodiment of the present application.

[0028] Figure 3 It is a schematic diagram of the physical device structure of a distributed denial of service attack defense system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0030] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0031] The following uses an embodiment and combines Figure 1 , a distributed denial of service attack defense method in an embodiment of the present application is described: See also Figure 1 , which is a flow chart of a distributed denial of service attack defense method in an embodiment of the present application.

[0032] S101, respectively calculating characteristic parameters of network traffic data within each preset time window; The system calculates the characteristic parameters of network traffic data in each preset time window, including packet size, arrival time interval, protocol type, traffic burstiness and packet entropy value.

[0033] In this step, the system needs to segment the network traffic data and divide it into several preset time windows, such as 1 second, 5 seconds, 10 seconds, etc. Then, the traffic data in each time window is feature extracted to calculate a set of numerical indicators reflecting the traffic characteristics, namely characteristic parameters. These characteristic parameters usually include packet size, arrival time interval, protocol type, traffic burstiness, and packet entropy value.

[0034] In order to accurately calculate the characteristic parameters, the system can use a sliding time window to continuously slide the window at a fixed time step to achieve continuous sampling and analysis of traffic data. At the same time, the system can also introduce the idea of ​​multi-scale analysis, using time windows of different sizes to extract the characteristics of traffic data at different time scales and capture its multi-scale and multi-level dynamic change rules.

[0035] S102, combining the feature parameters according to the weighting coefficients to generate a multi-dimensional feature vector; The system combines the characteristic parameters according to the weighting coefficient to generate a multi-dimensional characteristic vector. The weighting coefficient is determined based on the historical attack data. Specifically: the correlation between each characteristic parameter and the attack behavior is calculated based on the historical attack data; the optimization objective function is constructed based on the correlation, and the particle swarm algorithm is used to solve the optimization objective function to obtain the initial weight of each characteristic parameter; the initial weight is normalized to obtain the weighting coefficient; the characteristic parameters are linearly combined according to the weighting coefficient to obtain a multi-dimensional characteristic vector.

[0036] In this step, the system needs to fuse the multiple feature parameters extracted in the previous step to generate a multi-dimensional feature vector that comprehensively reflects the traffic characteristics. Since different feature parameters have different representation capabilities for attack behaviors, it is necessary to assign a weight to each feature parameter to indicate its importance, and then combine them weightedly to form the final feature vector. This weighted fusion method can effectively balance the contribution of different features and improve the robustness and discrimination of feature representation.

[0037] In order to determine the weight of each feature parameter, the system can use a statistical learning method based on historical attack data. First, based on the labeled attack traffic samples, the correlation between each feature parameter and the attack behavior, such as the Pearson correlation coefficient, mutual information, etc., is calculated to obtain a set of correlation coefficients. Then, these correlation coefficients are used as the optimization objective function, and a heuristic search algorithm, such as particle swarm optimization, genetic algorithm, etc., is used to find a set of optimal feature weights so that the weighted feature vector has the greatest correlation with the attack behavior.

[0038] In actual applications, the network environment and attack methods may change over time, so feature weights also need to be adaptively adjusted. The system can adopt an online learning strategy to dynamically update feature weights based on the latest attack sample data to adapt them to the current traffic pattern. At the same time, in order to avoid the instability of weight adjustment, the system can also introduce regularization mechanisms, such as L1 and L2 regularization terms, to constrain the update amplitude of weights and ensure the smoothness and continuity of feature fusion.

[0039] S103, constructing a time series state transfer matrix according to the multi-dimensional feature vector; The system constructs a time series state transfer matrix based on the multidimensional feature vector. The row vector of the time series state transfer matrix represents the multidimensional feature vector of the current time window, and the column vector represents the multidimensional feature vector of the next time window.

[0040] In this step, the system needs to further abstract the multidimensional feature vector into a state transfer matrix to describe the evolution of traffic data between different time windows. The state transfer matrix is ​​a two-dimensional matrix in which each element represents the probability of transferring the feature vector from one time window to the feature vector of the next time window. By analyzing the structural characteristics of the state transfer matrix, the time series correlation and change trend of traffic data can be discovered, providing an important basis for subsequent anomaly detection.

[0041] In order to construct the time series state transfer matrix, the system can use a sliding window method to divide the traffic data with a fixed time step to obtain a series of continuous feature vector sequences. Then, the feature vectors of two adjacent time windows are used as the row vector and column vector of the state transfer matrix, and the transfer frequency between them is counted to obtain the transfer probability matrix. In order to improve the sparsity and robustness of the matrix, the system can also perform threshold filtering and normalization on the transfer probability to remove those low-probability transfers and highlight the structural characteristics of high-probability transfers.

[0042] S104, extracting the characteristic root sequence of the time series state transfer matrix, and calculating the modulus length change rate of the characteristic root sequence; The system extracts the characteristic root sequence of the time series state transfer matrix and calculates the module length change rate of the characteristic root sequence. Specifically: the module length difference between two adjacent characteristic roots in the characteristic root sequence is calculated; the changing trend of the module length difference within a preset time window is statistically analyzed; the changing trend is predicted based on the exponential smoothing method to obtain the predicted module length difference; the module length change rate is calculated based on the deviation between the predicted module length difference and the module length difference.

[0043] In this step, the system needs to perform eigendecomposition on the time series state transfer matrix constructed in the previous step to extract its inherent dynamic characteristics. According to linear algebra theory, any matrix can be decomposed into a linear combination of several eigenvectors and eigenroots. Among them, the eigenroot represents the scaling ratio of the matrix transformation, and the eigenvector represents the main direction of the transformation. For the time series state transfer matrix, the size and distribution of its eigenroot reflect the time correlation strength and stability of the traffic data, and the eigenvector characterizes the dominant mode of traffic change. Therefore, by analyzing the dynamic change law of the characteristic root sequence, it is possible to sensitively capture abnormal fluctuations in traffic data and provide strong support for attack detection.

[0044] In order to extract the characteristic root sequence of the time series state transfer matrix, the system can use numerical calculation methods, such as QR decomposition, power iteration, etc., to solve the characteristic equation of the matrix and obtain all the characteristic roots and eigenvectors. Then, the characteristic roots are sorted according to their modulus lengths, and the first K largest characteristic roots are extracted to form a K-dimensional characteristic root sequence. The K value here can be adaptively selected according to the dimension and sparsity of the matrix. It should be large enough to capture the main dynamic characteristics, but small enough to reduce the computational complexity.

[0045] After obtaining the characteristic root sequence, the system needs to further calculate its modulus change rate, that is, the trend of the modulus difference between two adjacent characteristic roots over time. The modulus change rate reflects the evolution speed and amplitude of the dynamic structure of traffic data at different time scales, and is an important abnormality indicator. In order to accurately predict the modulus change rate, the system can use time series prediction methods such as the autoregressive moving average model (ARMA) to estimate the current change trend and future change direction based on the historical modulus difference sequence. At the same time, the system can also introduce an adaptive filtering mechanism to dynamically adjust the model order and parameters according to the prediction error to improve the accuracy and real-time performance of the prediction.

[0046] S105, constructing a dynamic phase diagram based on the mode length change rate, calculating the Euclidean distance of adjacent track points in the dynamic phase diagram, and determining that an abnormal attractor appears when the Euclidean distance of adjacent track points is less than a first preset threshold and the aggregation degree of the track points is greater than a second preset threshold; The system calculates the Euclidean distance between adjacent track points in the dynamic phase diagram. When the Euclidean distance between adjacent track points is less than a first preset threshold and the aggregation of track points is greater than a second preset threshold, it is determined that an abnormal attractor has appeared. The aggregation of track points is obtained by calculating the number of track points per unit area.

[0047] In this step, the system needs to map the characteristic root modulus change rate calculated in the previous step to a two-dimensional phase plane to construct a dynamic phase diagram of the flow data. The dynamic phase diagram is a commonly used nonlinear time series analysis tool. It reveals the intrinsic dynamic structure and evolution law of the time series by embedding the time series into a high-dimensional phase space and then performing geometric analysis on the trajectory in the phase space. On the dynamic phase diagram, the state of the flow data at different times corresponds to different points in the phase space. These points are connected in chronological order to form a state evolution trajectory. By analyzing the geometry of the trajectory, density distribution and other characteristics, it can be determined whether the flow data has abnormal attractors, that is, signs of abnormal behavior.

[0048] In order to construct a dynamic phase diagram, the system first needs to select the appropriate embedding dimension and time delay to map the characteristic root modulus change rate sequence into the phase space. The embedding dimension determines the dimension of the phase space, and the time delay determines the time interval between state points. These two parameters need to be optimized and selected based on statistical characteristics such as the autocorrelation and mutual information of the time series, so as to fully unfold the dynamic structure of the time series while avoiding the introduction of noise interference due to excessive dimensions. After the phase space embedding is obtained, the system can calculate the coordinates of the state points at each moment, connect these state points, and generate a dynamic phase diagram.

[0049] In the dynamic phase diagram, the system focuses on two geometric features: the Euclidean distance between adjacent track points and the clustering of track points. The Euclidean distance reflects the similarity between state points. The smaller the distance, the stronger the correlation between states. The clustering reflects the distribution density of state points in the phase space. The higher the clustering, the longer the system stays near the state. When the Euclidean distance between adjacent track points is less than a preset threshold and the clustering of track points is greater than another preset threshold, the system can determine that an abnormal attractor has appeared in the phase space, that is, the traffic data has experienced abnormal fluctuations.

[0050] In order to quantify the clustering of orbital points, the system can use density clustering algorithms, such as DBSCAN, OPTICS, etc., to perform cluster analysis on orbital points in phase space and obtain clustering structures with different density levels. Then, the density of orbital points within each cluster, that is, the number of orbital points within a unit phase space volume, is calculated as a measure of the clustering of the state. In order to avoid errors and fluctuations in density estimation, the system can also introduce smoothing techniques such as kernel density estimation to perform local weighted averaging on the distribution of orbital points to obtain a more robust estimate of the clustering degree.

[0051] S106, extracting the flow data of the time window corresponding to the abnormal attractor, and calculating the self-similarity index of the flow data; In this step, the system needs to further analyze the abnormal attractor detected in the previous step to determine whether it corresponds to a real network attack. Since the abnormal attractor is only a geometric representation of traffic data in the phase space, it may be caused by a network attack or other factors such as network congestion, equipment failure, etc. In order to distinguish these different sources of abnormalities, the system needs to extract the original traffic data in the time window corresponding to the abnormal attractor and perform self-similarity analysis on it to obtain a quantitative abnormality score, namely the self-similarity index.

[0052] Self-similarity is an important feature of network traffic data, which means that the statistical characteristics of traffic at different time scales have similar fractal structures. Usually, normal network traffic has high self-similarity, and its self-similarity index is close to 1; while abnormal network traffic, such as DDoS attack traffic, shows low self-similarity, and its self-similarity index deviates a lot from 1. Therefore, by calculating the self-similarity index, the system can effectively distinguish normal traffic from attack traffic, providing a quantitative basis for anomaly detection.

[0053] In order to calculate the self-similarity index of traffic data, the system can use classic fractal analysis methods such as the R / S statistic method and the variance time graph method. The basic idea is to divide the traffic data into subsequences of different scales, calculate the mean, variance and other statistics of each subsequence, and then analyze the power law relationship of these statistics with scale changes to obtain the self-similarity parameter H, and then calculate the self-similarity index. In practical applications, due to the non-stationarity and long-range correlation of traffic data, traditional fractal analysis methods may face challenges in convergence and robustness. Therefore, the system can also introduce higher-order statistics, such as the generalized Hurst index, multifractal spectrum, etc., to characterize the multi-scale self-similarity characteristics of traffic.

[0054] When extracting traffic data corresponding to abnormal attractors, the system needs to determine the corresponding time window range based on the time position and duration of the attractor in the phase space. Since actual network attacks may have certain persistence and delay effects, abnormal attractors may appear multiple times or last for a period of time in the phase space. Therefore, when extracting traffic data, the system needs to consider a suitable time boundary, which should not only completely cover the influence range of the attractor, but also minimize the interference of irrelevant traffic. In order to achieve adaptive time boundary selection, the system can use data-driven methods such as cross-validation to learn and optimize the size and position of the time window based on historical attack data to improve the accuracy of traffic extraction.

[0055] S107, when the self-similarity index is greater than the third preset threshold, the flow data is determined to be at a high risk level; when the self-similarity index is greater than the fourth preset threshold and is less than or equal to the third preset threshold, the flow data is determined to be at a medium risk level; when the self-similarity index is less than or equal to the fourth preset threshold, the flow data is determined to be at a low risk level; In this step, the system needs to classify the abnormal traffic data into dangerous levels according to the self-similarity index calculated in the previous step. Since the self-similarity index quantifies the degree to which the traffic data deviates from normal self-similarity, it can be used as an effective abnormality scoring indicator. The system divides the value range of the self-similarity index into three intervals by setting two preset thresholds, corresponding to the three dangerous levels of high, medium, and low. When the self-similarity index falls within different intervals, the system can quickly determine the severity of the current abnormality and take corresponding defensive measures.

[0056] The setting of thresholds needs to take into account many factors, such as network environment, attack type, defense requirements, etc. Usually, the third threshold is set higher to identify those flows with serious self-similarity damage, which usually correspond to large-scale DDoS attacks and are highly dangerous; the fourth threshold is set lower to identify those flows with slight deviations from self-similarity, which may be caused by some low-intensity attacks or network anomalies and are relatively less dangerous. The flows between the two thresholds are of medium risk level and need further analysis and monitoring.

[0057] In order to determine the optimal threshold, the system can use a statistical learning method based on attack samples. First, collect a set of known attack traffic and normal traffic data, and calculate their self-similar exponential distribution characteristics, such as mean, variance, quantile, etc. Then, through methods such as cross-validation, evaluate the performance indicators such as accuracy, recall rate, F1 score, etc. of anomaly detection under different threshold combinations, and select the threshold with the best comprehensive performance as the initial setting. In actual operation, the system can also dynamically adjust and optimize the threshold based on the detection results and expert knowledge through the feedback mechanism to adapt to changes in the network environment.

[0058] In practical applications, due to the complexity and diversity of network traffic, it may be difficult to accurately identify all types of network attacks by relying solely on a single self-similarity index. Therefore, the system can adopt a multi-index fusion strategy to comprehensively consider multiple abnormal characteristics of traffic, such as self-similarity, burstiness, and persistence, to build a more comprehensive and reliable risk assessment model. For example, the system can introduce a clustering-based anomaly detection method to map multiple abnormal indicators into a high-dimensional feature space, and identify traffic clusters of different danger levels through cluster analysis. For another example, the system can introduce a dimensionality reduction method based on principal component analysis to extract the common features of multiple abnormal indicators and obtain a comprehensive abnormality scoring indicator.

[0059] In addition, for some special types of network attacks, such as APT (Advanced Persistent Threat), they may use covert methods to slowly penetrate over a long period of time without causing obvious traffic anomalies. In order to detect these hidden threats, the system also needs to introduce higher-level semantic analysis and behavior modeling technologies, such as anomaly detection based on machine learning, threat intelligence association based on graph models, etc., to mine the hidden abnormal patterns and attack chains in traffic data from multiple dimensions, and achieve more intelligent and proactive network security defense.

[0060] S108, executing a discarding strategy for traffic data of a high-risk level; executing a bandwidth limiting strategy for traffic data of a medium-risk level; and executing a delayed forwarding strategy for traffic data of a low-risk level.

[0061] In this step, the system needs to dynamically select and execute the corresponding traffic control strategy according to the traffic danger level determined in the previous step, suppress and isolate potential attack traffic, and ensure the security and availability of the network. Since traffic of different danger levels has different attack strengths and harmfulness, different control measures need to be taken to effectively block high-risk attack traffic while minimizing the impact on normal business traffic.

[0062] For high-risk traffic data, the system directly executes the discard strategy to completely isolate it from the network. These traffic usually have obvious attack characteristics, such as a large number of repeated SYN requests, malformed data packets, etc., which pose a serious threat to network security, so they must be blocked at the first time. When executing the discard strategy, the system also needs to record and analyze the discarded traffic data, extract the attack characteristics and patterns, and use them to optimize the anomaly detection model and update the blacklist library to improve the efficiency of future detection and defense.

[0063] For traffic data with a medium-risk level, the system implements a bandwidth restriction strategy to reduce its impact on the network by limiting its network transmission rate. Compared with direct discarding, bandwidth restriction is a more flexible control method that can not only suppress potential attack traffic, but also maintain a certain degree of network availability to avoid accidental damage to normal services. When implementing bandwidth restriction, the system needs to dynamically adjust the restriction threshold and strategy according to the network environment and attack type. For example, when the network load is high, the bandwidth threshold can be appropriately lowered; when a certain type of attack is detected, the traffic of certain protocols or ports can be specifically restricted. At the same time, the system can also use technologies such as traffic shaping and priority control to differentiate the traffic of different services to ensure the performance of key services.

[0064] For low-risk traffic data, the system implements a delayed forwarding strategy, and through the cache and scheduling mechanism, delays its transmission time in the network to reduce its real-time impact. Although these flows have certain abnormal characteristics, their danger is relatively low, and direct discarding or restriction may affect normal business. Through delayed forwarding, the system can have more time to conduct in-depth analysis, extract more feature information, and optimize the accuracy of anomaly detection. At the same time, delayed forwarding can also play a certain role in buffering and peak reduction, avoiding the impact of instantaneous traffic surges on the network. When implementing delayed forwarding, the system needs to set a reasonable delay time and cache queue length, which should be able to effectively absorb burst traffic while avoiding introducing excessive transmission delays that affect user experience.

[0065] In the above embodiment, the characteristic parameters of the network traffic data in the preset time window are calculated and a multi-dimensional feature vector is generated according to the weighted coefficient combination, so that the expression of the traffic characteristics is more comprehensive and accurate. The time series state transfer matrix constructed based on the multi-dimensional feature vector can reflect the dynamic change law of the traffic characteristics, and the extracted characteristic root sequence and its modulus change rate can quantitatively describe the evolution process of the traffic state. The modulus change rate is mapped to the dynamic phase diagram, and the abnormal change pattern of the traffic characteristics can be discovered in time by analyzing the Euclidean distance and aggregation of adjacent track points. Combined with the self-similarity index of the traffic data in the time window corresponding to the abnormal attractor, and corresponding protection strategies are adopted for different danger levels, the accurate identification and hierarchical protection of distributed denial of service attacks are realized, while the false alarm rate is reduced while the detection accuracy is improved, and the impact on normal traffic is reduced through the hierarchical protection mechanism, which improves the accuracy of the formulation and implementation of the protection strategy, thereby improving the security of the network.

[0066] On the basis of the above embodiments, in order to further improve the system's monitoring and protection capabilities for low-risk data traffic, the present application also provides a method for dynamically managing a delayed forwarding queue. This solution monitors the operating status of the delayed forwarding queue in real time, and promptly triggers a reassessment of the risk level when an anomaly is found, thereby ensuring that the system can accurately identify and process data traffic that exhibits attack characteristics during the delayed forwarding process. Figure 2 , a dynamic management method of a delayed forwarding queue in an embodiment of the present application is described: See also Figure 2 , which is a flow chart of a method for dynamically managing a delayed forwarding queue in an embodiment of the present application.

[0067] S201, detecting the queue length and waiting time of traffic in a delayed forwarding queue to obtain a queue state sequence; In this step, the system needs to monitor the running status of the delayed forwarding queue in real time and obtain key indicators that reflect the degree of queue congestion, namely queue length and waiting time. Queue length indicates the number of packets accumulated in the current queue, and waiting time indicates the time interval from each packet entering the queue to being processed. These two indicators directly reflect the load intensity and service quality of the queue, and are important bases for evaluating queue performance.

[0068] In order to obtain these two indicators, the system needs to deploy traffic monitoring probes at the entrance and exit of the delayed forwarding queue to collect queue status information in real time. The probes can record the arrival time, departure time, packet length and other metadata of each data packet through passive packet capture or active detection, and report them to the central controller regularly. The controller aggregates the measurement data of multiple probes, calculates the queue length and waiting time of the queue at different times, and forms a time series, namely the queue status series.

[0069] In order to improve the time resolution and accuracy of the queue state sequence, the system can adopt an adaptive sampling and estimation strategy. For example, when the queue load is high, the sampling frequency of the probe is increased to obtain more fine-grained state information; when the queue load is low, the sampling frequency is reduced to reduce the resource overhead of the probe. In addition, the system can also use sliding window, exponential smoothing and other technologies to denoise and predict the queue state sequence to achieve smoother and more accurate state tracking.

[0070] S202, calculating a queue congestion index based on a queue state sequence; In this step, the system needs to calculate a quantitative indicator based on the queue state sequence obtained in the previous step to evaluate the congestion level of the queue, namely the queue congestion index. This indicator comprehensively considers the two dimensions of queue length and waiting time, reflects the accumulation and retention time of packets in the queue, and is a key factor in measuring queue performance.

[0071] The calculation of queue congestion index can adopt a variety of mathematical models and algorithms, such as queue theory model, time series analysis, etc. A common method is to take the weighted average of queue length and waiting time to obtain a comprehensive congestion measure. The system can design different weight coefficients according to the scheduling strategy and service model of the queue to reflect the importance of different indicators. For example, for higher priority business traffic, the weight of waiting time should be greater than queue length; while for ordinary best-effort business, the weight of queue length can be appropriately increased.

[0072] In addition to weighted average, the system can also use more complex nonlinear combination methods, such as exponential function, logarithmic function, etc., to highlight the nonlinear effect of queue congestion. When the queue length or waiting time exceeds a certain critical value, the performance of the queue will drop sharply, triggering a congestion avalanche. Therefore, the calculation of the queue congestion index should be able to sensitively capture this critical state and give a clear early warning signal.

[0073] S203, when the queue congestion index exceeds the fifth preset threshold, re-evaluate the danger level of the data traffic in the queue; When the queue congestion index exceeds the fifth preset threshold, the data traffic in the queue is re-evaluated for danger level, specifically: extracting the short-term statistical characteristics of the data traffic in the delayed forwarding queue, the short-term statistical characteristics include data packet arrival interval, packet length distribution and protocol type distribution; calculating the change acceleration of the traffic characteristics based on the short-term statistical characteristics; using the change acceleration to identify the mutation points and inflection points of the traffic characteristics, and obtaining a critical moment sequence; according to the critical moment sequence statistics, the frequency of occurrence of preset abnormal events is calculated, and when the occurrence frequency exceeds the eighth preset threshold, the danger level of the corresponding data traffic is increased to the next level.

[0074] In this step, the system needs to determine whether the delayed forwarding queue is seriously congested based on the queue congestion index calculated in the previous step, thereby triggering a reassessment of the data traffic in the queue. Since the characteristics of low-risk traffic may change significantly after entering the delayed forwarding queue, some traffic may gradually expose higher risks. Therefore, when the queue congestion reaches a certain level, it is necessary to re-determine the risk level of these flows and promptly discover those flows that were originally underestimated.

[0075] Specifically, the system first needs to set a queue congestion index threshold, which is the fifth preset threshold. When the actual congestion index exceeds the threshold for a period of time, it is considered that the queue is seriously congested and the traffic needs to be re-evaluated. The setting of the threshold needs to comprehensively consider factors such as the system's processing capacity and traffic characteristics. It must be able to capture congestion signs in a timely manner, while avoiding too frequent evaluation triggers that introduce unnecessary overhead.

[0076] After triggering the reassessment, the system will extract a series of short-term statistical features of each data flow in the delayed forwarding queue, including packet arrival interval, packet length distribution, protocol type distribution, etc. These features represent the dynamic changes of traffic during delayed forwarding and reflect its statistical laws on multiple time scales. By analyzing the evolution trend of these features over time, the system can track and predict the changes in the risk of each flow in real time.

[0077] In order to accurately characterize the dynamic characteristics of traffic, the system will calculate a key indicator, the acceleration of change, based on short-term statistical characteristics. The acceleration of change measures the severity of the change in traffic characteristics and is an important basis for evaluating traffic anomalies. The system can use numerical calculation methods such as differential method and derivative estimation to calculate the acceleration of change for the time series of each statistical feature. When the absolute value of the acceleration exceeds a certain threshold, it is considered that the traffic has undergone a significant mutation or inflection point, representing a potential dangerous event.

[0078] By tracking the acceleration of changes, the system can automatically identify the key moments in the flow evolution process and generate a key moment sequence. This sequence records the time points when each flow has abnormalities at different times, which is an important reference for evaluating the danger level of the flow. The system will count the frequency of abnormalities in each flow over a period of time. When the frequency exceeds the eighth preset threshold, it is considered that the flow has shown obvious attack characteristics and its danger level needs to be raised to medium or above.

[0079] S204. Calculate the burst index and periodic index of the data traffic according to the risk level assessment result; In this step, the system needs to further analyze the two key characteristic indicators of each data flow - the burst indicator and the periodic indicator based on the risk level re-evaluated in the previous step. These two indicators describe the dynamic laws of traffic in the time domain from different angles and are an important basis for achieving refined traffic control. By calculating and tracking these two indicators, the system can more comprehensively evaluate the risk of each flow and identify malicious traffic with hidden attack characteristics.

[0080] The burst index measures the severity of traffic bursts in a short period of time and reflects the changing characteristics of its instantaneous bandwidth. For normal business traffic, its bandwidth is usually relatively stable and the burst index is low; however, for many attack traffic, such as DDoS and scanning, they often show significant burst characteristics, generating a large number of data packets in a short period of time, causing the burst index to rise sharply. Therefore, the burst index is a sensitive signal for detecting traffic anomalies.

[0081] In order to calculate the burst index, the system can use the sliding window method to perform local statistical analysis on the arrival process of each flow. Specifically, in each window, the instantaneous rate of the traffic, the variance of the packet arrival interval and other indicators are statistically analyzed, and then the threshold is set to determine whether the traffic has a burst. The system can also use an adaptive window size and threshold selection mechanism to dynamically adjust the window time scale and judgment threshold according to the statistical characteristics of the traffic, which can not only sensitively capture sudden events, but also reduce the risk of false alarms.

[0082] The periodicity index measures the repetitive pattern of traffic over a long time scale, reflecting the strength of its time correlation. Many normal business traffic, such as video and voice, usually have obvious periodicity, that is, similar statistical features reappear in a certain time interval. However, some special attack traffic, such as slow-rate DDoS and Stealthy probe, may also disguise periodic characteristics to evade detection mechanisms based on burst characteristics. Therefore, accurately identifying the periodicity of traffic is of great significance for the detection of more covert attacks.

[0083] The calculation of periodic indicators can be done with the help of various methods of signal processing and time series analysis. For example, the system can perform autocorrelation analysis on the time series of each flow, and determine the periodic strength of the series by calculating the autocorrelation coefficients at different lag orders. In addition, methods such as power spectrum analysis and wavelet analysis can be used to characterize the periodic structure of traffic from a frequency domain perspective. For traffic with significant periodicity, the system will extract its main periodic components and calculate key parameters such as period length and frequency as a basis for evaluating the danger of traffic.

[0084] S205. When the burst index exceeds the sixth preset threshold or the periodic index exceeds the seventh preset threshold, the corresponding data traffic is increased to a medium risk level.

[0085] In this step, the system needs to dynamically adjust the risk level of each flow based on the burst index and periodic index calculated in the previous step. By setting two key thresholds, namely the sixth preset threshold and the seventh preset threshold, the system can flexibly control the criteria for judging the risk of traffic, detect those malicious flows that are hidden deep in time, upgrade them to the medium risk level, and take corresponding control measures.

[0086] Specifically, when the burst index of a flow exceeds the sixth preset threshold, it is considered that the flow exhibits significant abnormal burst characteristics in a short time scale and is likely to contain attack or abnormal components. At this time, the system will immediately raise the danger level of the flow from low risk to medium risk, and trigger the corresponding flow control and cleaning mechanism to focus on monitoring and managing the flow. By timely handling of burst traffic, its impact on network bandwidth and service quality can be effectively reduced.

[0087] Similarly, when the periodicity index of a flow exceeds the seventh preset threshold, it is considered that the flow presents an abnormal repetitive pattern over a long time scale and is highly suspicious. This periodic anomaly may originate from some hidden low-speed attacks, such as Slowloris and LOIC, which evade conventional anomaly detection mechanisms by disguising themselves as normal business access rhythms. For this type of traffic, the system will also decisively raise its danger level to medium, and take corresponding speed limiting, filtering and other measures to control its occupation of network resources.

[0088] In the above embodiment, the queue state is detected and the queue congestion index is calculated to monitor the processing of low-risk level traffic. When congestion occurs, the system will re-evaluate the risk level of the data traffic in the queue, and combine the burst index and the periodic index to judge the change of traffic characteristics, so as to timely discover the trend of low-risk level traffic evolving to high-risk level. By analyzing the burst and periodic characteristics of traffic, the system can accurately identify traffic with attack characteristics and adjust its risk level in time, thereby optimizing the execution effect of the protection strategy, improving the system's adaptability to attack behaviors, and enhancing the accuracy of the protection strategy.

[0089] Further, after step S108, the system constructs a conversion probability matrix of data flows of different danger levels based on the danger level assessment result; The conversion probability matrix is ​​used to calculate the conversion trend of data flow at each hazard level; When the conversion probability of the data flow of the low danger level to the data flow of the medium danger level exceeds a ninth preset threshold, extracting characteristic parameters of the data flow of the low danger level; Adjust the execution parameters of the delayed forwarding strategy according to the characteristic parameters, specifically: count the resource occupancy rate and processing delay of the delayed forwarding strategy to obtain a resource utilization state sequence; Calculate the system load balancing index based on the resource utilization state sequence; Allocate system processing resources based on system load balancing index and conversion trend; The execution priority of the delayed forwarding strategy is adjusted according to the allocation result of the system processing resources.

[0090] First, based on the hazard level assessment results of the previous step, the system needs to construct a probability matrix that reflects the conversion relationship between data flows of different hazard levels, namely the conversion probability matrix. Each element of the matrix represents the probability of converting from one hazard level of flow to another hazard level of flow within a given time window. By statistically analyzing historical assessment data, the system can estimate the empirical values ​​of these conversion probabilities.

[0091] The conversion probability matrix describes the dynamic evolution of data traffic between different danger levels and is an important tool for predicting future trends in traffic danger. In order to quantify this conversion trend, the system will calculate the probability distribution of traffic at each danger level converting to other levels based on the conversion probability matrix to form a conversion trend vector. Each component of this vector represents the probability of the current level of traffic converting to the target level in the next time window.

[0092] The system focuses on the trend of conversion from low-risk level to medium-risk level. When the conversion probability of this trend exceeds a preset threshold (the ninth preset threshold), it means that the current low-risk traffic has a high risk of conversion to medium-risk traffic, and timely measures need to be taken to control it. At this time, the system will extract a series of characteristic parameters of the current low-risk traffic, such as message length, arrival interval, peak-to-average ratio, etc., to guide subsequent policy adjustments.

[0093] Based on the extracted characteristic parameters, the system will adaptively adjust the execution parameters of the delayed forwarding strategy to optimize the utilization efficiency of system resources. First, the system will continuously monitor the execution effect of the current delayed forwarding strategy, count key indicators such as resource occupancy and processing delay, and form a resource utilization state sequence. This sequence reflects the system's operating performance under different load conditions.

[0094] Then, based on the resource utilization state sequence, the system will calculate a quantitative indicator, the system load balance index, to evaluate the rationality of the current system resource allocation. This indicator comprehensively considers the utilization balance of each resource dimension and the overall load level, and can be defined by imbalance metrics such as the Gini coefficient and entropy value. The higher the load balance index, the better the balance and efficiency of system resource utilization.

[0095] After obtaining the system load balance index and conversion trend vector, the system will comprehensively consider the two and dynamically allocate processing resources for traffic of different danger levels. Specifically, when the conversion trend of low-risk traffic to medium-risk traffic is obvious, the system will appropriately reduce the processing resources for low-risk traffic and adjust the resource reservation for medium-risk traffic to cope with the possible increase in danger. At the same time, the system will also refer to the load balance index and optimize the resource allocation plan on the premise of ensuring balance to improve the processing efficiency of key traffic.

[0096] Finally, the system will dynamically adjust the execution priority of the delayed forwarding strategy based on the optimized resource allocation plan. For low-risk traffic with higher risks, the priority of delayed forwarding will be appropriately increased so that it can be imported into the analysis and control process in a timely manner; while for processing nodes with higher loads, their task priority will be appropriately reduced to reduce system pressure and avoid cascading failures. Through dynamic scheduling of priorities, security and performance can be balanced more flexibly.

[0097] In the above embodiment, based on the danger level assessment results, a conversion probability matrix of data traffic at different danger levels is constructed, and the conversion trend of data traffic at each danger level is calculated, so that the system can accurately grasp the migration law of data traffic between different danger levels. When the conversion probability of data traffic at a low danger level to data traffic at a medium danger level exceeds a preset threshold, by extracting the characteristic parameters of the data traffic at a low danger level and adjusting the execution parameters of the delayed forwarding strategy accordingly, the system can optimize the defense strategy in a targeted manner, so that the system can pre-adjust the defense strategy when the data traffic shows a trend of increasing danger level, reducing the lag of the traditional solution in waiting until the attack traffic completely evolves to a high danger level before taking corresponding measures. By analyzing the characteristic parameters of the data traffic at a low danger level and dynamically adjusting the delayed forwarding strategy, the system's ability to prevent potential attack behaviors is improved, and the risk of a decline in defense effectiveness caused by the solidification of the defense strategy is reduced.

[0098] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of a distributed denial of service attack defense system provided in an embodiment of the present application.

[0099] It should be noted that Figure 3 The structure of the system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0100] like Figure 3As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303, such as executing the method in the above embodiment. In RAM 303, various programs and data required for system operation are also stored. CPU 301, ROM 302 and RAM 303 are connected to each other through a bus 304. Input / output (I / O) interface 305 is also connected to bus 304.

[0101] The following components are connected to the I / O interface 305: an input section 306 including a camera, an infrared sensor, etc.; an output section 307 including a liquid crystal display (LCD) and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

[0102] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 309, and / or installed from a removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, various functions defined in the present invention are performed.

[0103] It should be noted that the computer-readable medium shown in the embodiment of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing.

[0104] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Among them, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0105] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the system described in the above embodiment; or may exist independently without being assembled into the system. The above storage medium carries one or more computer programs, and when the above one or more computer programs are executed by a processor of a system, the system implements the method provided in the above embodiment.

[0106] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0107] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0108] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0109] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A distributed denial of service attack defense method, characterized in that: include: Calculate the characteristic parameters of the network traffic data in each preset time window respectively, wherein the characteristic parameters include data packet size, arrival time interval, protocol type, traffic burstiness and data packet entropy value; Combining the characteristic parameters according to weighted coefficients to generate a multi-dimensional characteristic vector, wherein the weighted coefficients are determined based on historical attack data; Constructing a time series state transfer matrix according to the multidimensional feature vector, wherein the row vector of the time series state transfer matrix represents the multidimensional feature vector of the current time window, and the column vector represents the multidimensional feature vector of the next time window; Extracting the characteristic root sequence of the time series state transfer matrix, and calculating the modulus length change rate of the characteristic root sequence; constructing a dynamic phase diagram based on the mode length change rate; Calculating the Euclidean distance of adjacent track points in the dynamic phase diagram, and determining that an abnormal attractor appears when the Euclidean distance of the adjacent track points is less than a first preset threshold and the aggregation degree of the track points is greater than a second preset threshold, wherein the aggregation degree of the track points is obtained by calculating the number of track points within a unit area; Extracting the flow data of the time window corresponding to the abnormal attractor, and calculating the self-similarity index of the flow data; When the self-similarity index is greater than the third preset threshold, the flow data is determined to be at a high risk level; when the self-similarity index is greater than the fourth preset threshold and is less than or equal to the third preset threshold, the flow data is determined to be at a medium risk level; when the self-similarity index is less than or equal to the fourth preset threshold, the flow data is determined to be at a low risk level; A discard strategy is executed for the traffic data of the high-risk level; a bandwidth restriction strategy is executed for the traffic data of the medium-risk level; and a delayed forwarding strategy is executed for the traffic data of the low-risk level.

2. The method according to claim 1, characterized in that The step of combining the feature parameters according to weighted coefficients to generate a multi-dimensional feature vector specifically includes: Calculating the correlation between each of the characteristic parameters and the attack behavior according to the historical attack data; An optimization objective function is constructed based on the correlation, and a particle swarm algorithm is used to solve the optimization objective function to obtain an initial weight of each characteristic parameter; Normalizing the initial weights to obtain weighting coefficients; The characteristic parameters are linearly combined according to the weighting coefficients to obtain a multi-dimensional characteristic vector.

3. The method according to claim 1, characterized in that The calculating the modulus length change rate of the characteristic root sequence specifically includes: Calculating the difference in modulus length between two adjacent characteristic roots in the characteristic root sequence; Counting the change trend of the module length difference within a preset time window; Predicting the change trend based on the exponential smoothing method to obtain a predicted module length difference; The module length change rate is calculated based on the deviation between the predicted module length difference and the module length difference.

4. The method according to claim 1, characterized in that: After executing the delayed forwarding strategy for the traffic data of the low risk level, the method further includes: Detect the queue length and waiting time of traffic in the delayed forwarding queue to obtain a queue state sequence; Calculating a queue congestion index based on the queue state sequence; When the queue congestion index exceeds a fifth preset threshold, re-evaluating the danger level of the data traffic in the queue; Calculating a burstiness index and a periodicity index of the data traffic according to the risk level assessment result, wherein the burstiness index is determined based on a ratio of a peak value to a mean value of the data traffic, and the periodicity index is determined based on an autocorrelation function of the data traffic; When the burst index exceeds the sixth preset threshold or the periodic index exceeds the seventh preset threshold, the corresponding data traffic is increased to the medium risk level.

5. The method according to claim 4, characterized in that The re-evaluating the risk level of the data traffic in the queue specifically includes: Extracting short-term statistical features of data traffic in the delayed forwarding queue, wherein the short-term statistical features include data packet arrival interval, packet length distribution, and protocol type distribution; Calculate the change acceleration of the flow characteristic based on the short-term statistical characteristic; Using the change acceleration to identify the mutation point and inflection point of the flow characteristics, and obtain a key moment sequence; The occurrence frequency of the preset abnormal event is calculated according to the key moment sequence statistics, and when the occurrence frequency exceeds an eighth preset threshold, the danger level of the corresponding data traffic is increased to the next level.

6. The method according to claim 4 or 5, characterized in that: After the corresponding data traffic is increased to the medium risk level, the method further includes: Constructing a conversion probability matrix of data flows of different danger levels based on the danger level assessment result; Calculating the conversion trend of the data flow of each danger level by using the conversion probability matrix; When the conversion probability of the data flow of the low danger level to the data flow of the medium danger level exceeds a ninth preset threshold, extracting characteristic parameters of the data flow of the low danger level; The execution parameters of the delayed forwarding strategy are adjusted according to the characteristic parameters.

7. The method according to claim 6, characterized in that The step of adjusting the execution parameters of the delayed forwarding strategy according to the characteristic parameters specifically includes: Counting resource occupancy and processing delay of the delayed forwarding strategy to obtain a resource utilization state sequence; Calculating a system load balancing index based on the resource utilization state sequence; Allocating system processing resources in combination with the system load balancing index and the conversion trend; The execution priority of the delayed forwarding strategy is adjusted according to the allocation result of the system processing resources.

8. A distributed denial of service attack defense system, characterized in that: The system comprises: One or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to execute the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to execute the method according to any one of claims 1 to 7.

Images