Distributed denial of service attack defense method, system, medium and program product

Abstract

A distributed denial of service attack defense method, system, medium, and program product are disclosed. The method calculates characteristic parameters of network traffic data, generates multidimensional feature vectors, constructs a time-series state transition matrix, extracts characteristic root sequences, calculates the modulus change rate, constructs a dynamic phase diagram based on the modulus change rate, calculates the Euclidean distance between adjacent track points in the dynamic phase diagram, and extracts corresponding traffic data when an abnormal attractor is detected. The self-similarity index is calculated and the corresponding traffic is determined to be a high-risk level when the self-similarity index is greater than a third preset threshold; a medium-risk level when the self-similarity index is greater than a fourth preset threshold and less than or equal to the third preset threshold; and a low-risk level when the self-similarity index is less than or equal to the fourth preset threshold. A discard policy is implemented for high-risk levels; a bandwidth restriction policy is implemented for medium-risk levels; and a delayed forwarding policy is implemented for low-risk levels. This method improves the accuracy of defense strategy formulation and implementation, thereby enhancing network security.

Description

Technical Field

[0001] The present application relates to the field of server defense, and in particular to a distributed denial of service attack defense method, system, medium, and program product. Background Art

[0002] With the rapid development of internet technology, distributed denial of service (DDoS) attacks have become one of the most threatening cybersecurity threats. DDoS attacks control a large number of infected hosts and send massive requests to the target system, causing it to exhaust its resources and become unable to provide services to legitimate users. Traditional DDoS defense methods rely primarily on traffic scrubbing and access restrictions, but these methods often have a delayed response time and can easily inadvertently harm legitimate users, severely impacting system service quality.

[0003] Currently, DDoS attack defense technology based on traffic signature analysis is widely used. This technology establishes a traffic baseline database by analyzing various characteristic parameters of network traffic in real time, such as packet size, arrival time interval, and protocol type. When traffic characteristics deviate from the baseline, the system automatically triggers a protection mechanism to filter or restrict the abnormal traffic, effectively reducing the damage caused by DDoS attacks. This approach offers higher identification accuracy and faster response times than traditional defense methods.

[0004] However, due to the continuous and progressive nature of DDoS attacks, the traffic characteristics within a single time window may not be able to fully reflect the attack process. This makes it difficult for defense systems to accurately grasp the development trend of the attack situation, thereby reducing the accuracy of the formulation and implementation of protection strategies and resulting in reduced network security. Summary of the Invention

[0005] The present application provides a distributed denial of service attack defense method, system, medium and program product for improving the accuracy of formulating and implementing protection strategies, thereby improving network security.

[0006] In a first aspect, the present application provides a distributed denial of service attack defense method, which calculates characteristic parameters of network traffic data in each preset time window, including packet size, arrival time interval, protocol type, traffic burstiness, and packet entropy value;

[0007] Combine feature parameters according to weighted coefficients to generate a multi-dimensional feature vector. The weighted coefficients are determined based on historical attack data.

[0008] Construct a time series state transfer matrix based on the multidimensional feature vector. The row vector of the time series state transfer matrix represents the multidimensional feature vector of the current time window, and the column vector represents the multidimensional feature vector of the next time window.

[0009] Extract the characteristic root sequence of the time series state transfer matrix and calculate the modulus change rate of the characteristic root sequence;

[0010] Construct a dynamic phase diagram based on the mode length change rate;

[0011] Calculating the Euclidean distance between adjacent track points in the dynamic phase graph. When the Euclidean distance between adjacent track points is less than a first preset threshold and the aggregation degree of the track points is greater than a second preset threshold, it is determined that an abnormal attractor has occurred. The aggregation degree of the track points is obtained by calculating the number of track points per unit area.

[0012] Extract the flow data of the time window corresponding to the abnormal attractor and calculate the self-similarity index of the flow data;

[0013] When the self-similarity index is greater than the third preset threshold, the flow data is determined to be at a high risk level; when the self-similarity index is greater than the fourth preset threshold and less than or equal to the third preset threshold, the flow data is determined to be at a medium risk level; when the self-similarity index is less than or equal to the fourth preset threshold, the flow data is determined to be at a low risk level;

[0014] A discard policy is implemented for traffic data of a high-risk level; a bandwidth restriction policy is implemented for traffic data of a medium-risk level; and a delayed forwarding policy is implemented for traffic data of a low-risk level.

[0015] By adopting the above technical solution, the characteristic parameters of network traffic data within a preset time window are calculated and combined according to weighted coefficients to generate a multidimensional feature vector, making the expression of traffic characteristics more comprehensive and accurate. The time series state transition matrix constructed based on the multidimensional feature vector can reflect the dynamic changes in traffic characteristics. The extracted characteristic root sequence and its modulus change rate can quantitatively describe the evolution of the traffic state. By mapping the modulus change rate into a dynamic phase diagram, and analyzing the Euclidean distance and clustering of adjacent track points, abnormal change patterns in traffic characteristics can be promptly detected. Combining the self-similarity index of traffic data in the time window corresponding to the abnormal attractor and adopting corresponding protection strategies for different risk levels, the precise identification and hierarchical protection of distributed denial of service attacks are achieved. While improving detection accuracy, it also reduces the false alarm rate. The hierarchical protection mechanism reduces the impact on normal traffic, improves the accuracy of the formulation and implementation of protection strategies, and thus enhances network security.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, combining feature parameters according to weighting coefficients to generate a multidimensional feature vector specifically includes:

[0017] Calculate the correlation between each characteristic parameter and attack behavior based on historical attack data;

[0018] Based on the correlation, the optimization objective function is constructed and the particle swarm algorithm is used to solve the optimization objective function to obtain the initial weights of each characteristic parameter;

[0019] Normalize the initial weights to obtain weighting coefficients;

[0020] The characteristic parameters are linearly combined according to the weighting coefficients to obtain a multidimensional characteristic vector.

[0021] By employing the aforementioned technical solution, the correlation between characteristic parameters and attack behavior is calculated to quantify the importance of the features. Using a particle swarm algorithm to solve the optimization objective function containing correlation information, the optimal weight configuration for each characteristic parameter can be obtained. The weighting coefficients obtained after normalizing the initial weights have good numerical stability. Using these weighting coefficients to linearly combine the characteristic parameters, the generated multidimensional feature vectors can highlight characteristic information highly correlated with attack behavior, improving the feature vector's ability to represent attack traffic and enhancing the effectiveness of subsequent feature vector-based attack detection. Furthermore, the adaptive optimization characteristics of the weights enable the system to continuously learn and optimize performance.

[0022] In conjunction with some embodiments of the first aspect, in some embodiments, calculating the modulus length change rate of the characteristic root sequence specifically includes:

[0023] Calculate the difference in modulus length between two adjacent characteristic roots in the characteristic root sequence;

[0024] Calculate the trend of module length difference within the preset time window;

[0025] The trend of change is predicted based on the exponential smoothing method to obtain the predicted module length difference;

[0026] The module length change rate is calculated based on the deviation between the predicted module length difference and the module length difference.

[0027] By employing this technical solution, we analyze the modulus differences between adjacent characteristic roots and their changing trends, establishing a quantitative model for traffic state evolution. Using exponential smoothing to predict the changing trends of modulus differences, we can promptly detect abnormal changes in traffic characteristics. The modulus change rate, calculated based on the deviation between the predicted and actual values, exhibits strong temporal correlation and accurately reflects the dynamic characteristics of traffic state changes. This enhances the system's ability to warn of attacks and enables protective measures to respond more promptly and accurately to changes in traffic state.

[0028] In conjunction with some embodiments of the first aspect, in some embodiments, after executing the delayed forwarding strategy for traffic data of a low risk level, the method further includes:

[0029] Detect the queue length and waiting time of traffic in the delayed forwarding queue and obtain the queue state sequence;

[0030] Calculate the queue congestion index based on the queue state sequence;

[0031] When the queue congestion index exceeds a fifth preset threshold, the data traffic in the queue is reassessed for a dangerous level;

[0032] Calculate the burstiness and periodicity indicators of data traffic based on the hazard level assessment results. The burstiness indicator is determined based on the ratio of the peak value to the mean value of data traffic, and the periodicity indicator is determined based on the autocorrelation function of the data traffic.

[0033] When the burst index exceeds the sixth preset threshold or the periodic index exceeds the seventh preset threshold, the corresponding data traffic is increased to a medium risk level.

[0034] By employing this technical solution, queue status is detected and queue congestion indexes are calculated to monitor the handling of low-risk traffic. When congestion occurs, the system reassesses the risk level of the data traffic in the queue and uses burstiness and periodicity indicators to determine changes in traffic characteristics, enabling timely detection of trends in low-risk traffic evolving toward high-risk levels. By analyzing the burstiness and periodicity of traffic, the system can accurately identify traffic with attack characteristics and promptly adjust its risk level, thereby optimizing the effectiveness of protection strategies, improving the system's adaptability to attack behavior, and enhancing the precision of protection strategies.

[0035] In conjunction with some embodiments of the first aspect, in some embodiments, re-evaluating the risk level of data traffic in the queue specifically includes:

[0036] Extracting short-term statistical features of data traffic in the delayed forwarding queue, including packet arrival interval, packet length distribution, and protocol type distribution;

[0037] Calculate the change acceleration of flow characteristics based on short-term statistical characteristics;

[0038] Using the changing acceleration to identify the mutation points and inflection points of the traffic characteristics, the critical moment sequence is obtained;

[0039] The occurrence frequency of the preset abnormal events is calculated according to the key moment sequence statistics. When the occurrence frequency exceeds an eighth preset threshold, the danger level of the corresponding data traffic is increased to the next level.

[0040] By adopting the above technical solution, the short-term statistical characteristics of data traffic in the delayed forwarding queue are extracted, and the acceleration of the change of traffic characteristics is calculated, so that the dynamic change characteristics of data traffic can be grasped in real time. The mutation points and inflection points of traffic characteristics are identified by using the acceleration of change. The resulting key moment sequence reflects the abnormal change pattern of data traffic in the time dimension. Based on the frequency of occurrence of preset abnormal events in the key moment sequence statistics, it is judged whether the danger level of data traffic needs to be increased by comparing it with the preset threshold. This enables the system to promptly detect attack traffic that evolves from a low danger level to a high danger level, improves the system's recognition sensitivity for attack behavior, reduces the defense delay caused by the lag in danger level judgment, enhances the system's defense capabilities against progressive attacks, and makes the adjustment of defense strategies more timely and accurate.

[0041] In conjunction with some embodiments of the first aspect, in some embodiments, after the corresponding data traffic is increased to a medium risk level, the method further includes:

[0042] Based on the hazard level assessment results, a conversion probability matrix of data flows at different hazard levels is constructed;

[0043] The conversion probability matrix is ​​used to calculate the conversion trend of data traffic at each hazard level;

[0044] When the conversion probability of the data flow of the low-risk level to the data flow of the medium-risk level exceeds a ninth preset threshold, extracting characteristic parameters of the data flow of the low-risk level;

[0045] Adjust the execution parameters of the delayed forwarding strategy according to the characteristic parameters.

[0046] By adopting the above technical solution, a conversion probability matrix for data traffic of different danger levels is constructed based on the danger level assessment results, and the conversion trend of data traffic of each danger level is calculated. This system can accurately grasp the migration patterns of data traffic between different danger levels. When the conversion probability of low-risk data traffic to medium-risk data traffic exceeds a preset threshold, by extracting the characteristic parameters of the low-risk data traffic and adjusting the execution parameters of the delayed forwarding strategy accordingly, the system can optimize the defense strategy in a targeted manner. This allows the system to pre-adjust the defense strategy when the data traffic shows an increasing danger level trend, reducing the lag in traditional solutions that require waiting until the attack traffic has fully evolved to a high-risk level before taking corresponding measures. By analyzing the characteristic parameters of low-risk data traffic and dynamically adjusting the delayed forwarding strategy, the system's ability to prevent potential attacks is enhanced and the risk of reduced defense effectiveness due to the solidification of the defense strategy is reduced.

[0047] In conjunction with some embodiments of the first aspect, in some embodiments, adjusting execution parameters of the delayed forwarding strategy according to the characteristic parameters specifically includes:

[0048] Count the resource occupancy rate and processing delay of the delayed forwarding strategy to obtain the resource utilization state sequence;

[0049] Calculate the system load balancing index based on the resource utilization state sequence;

[0050] Allocate system processing resources based on the system load balancing index and conversion trends;

[0051] Adjust the execution priority of the delayed forwarding strategy according to the allocation result of system processing resources.

[0052] By employing this technical solution, the resource utilization rate and processing delay of the delayed forwarding strategy are calculated to generate a resource utilization status sequence. Based on this sequence, the system load balancing index is calculated. This system's processing resources are then allocated based on the system load balancing index and conversion trends, enabling the system to optimize resource utilization while ensuring defensive effectiveness. Based on the resource allocation results, the execution priority of the delayed forwarding strategy is adjusted, enabling the system to allocate more processing power to more critical data traffic when resources are limited.

[0053] In second aspect, an embodiment of the present application provides a distributed denial of service attack defense system, which distributed denial of service attack defense system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to enable the system to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0054] In a third aspect, an embodiment of the present application provides a computer-readable storage medium comprising instructions, which, when executed on a system, enables the system to execute the method described in the first aspect and any possible implementation of the first aspect.

[0055] In a fourth aspect, an embodiment of the present application provides a computer program product, characterized in that when the computer program product is run on a system, the system executes the method described in any possible implementation manner in the first aspect.

[0056] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0057] 1. The present application provides a method for defending against distributed denial of service attacks, which calculates the characteristic parameters of network traffic data within a preset time window and generates a multi-dimensional feature vector according to a combination of weighted coefficients, so that the expression of traffic characteristics is more comprehensive and accurate. The time series state transition matrix constructed based on the multi-dimensional feature vector can reflect the dynamic change law of traffic characteristics, and the extracted characteristic root sequence and its modulus change rate can quantitatively describe the evolution process of the traffic state. The modulus change rate is mapped to the dynamic phase diagram, and by analyzing the Euclidean distance and aggregation of adjacent track points, the abnormal change pattern of traffic characteristics can be discovered in time. Combined with the self-similarity index of the traffic data in the time window corresponding to the abnormal attractor, and corresponding protection strategies for different risk levels, the accurate identification and hierarchical protection of distributed denial of service attacks are achieved, while improving the detection accuracy and reducing the false alarm rate. The hierarchical protection mechanism reduces the impact on normal traffic, improves the accuracy of the formulation and implementation of protection strategies, and thus improves the security of the network.

[0058] 2. This application provides a distributed denial of service attack defense method that detects queue status and calculates the queue congestion index to monitor the processing of low-risk level traffic. When congestion occurs, the system will re-evaluate the risk level of the data traffic in the queue, and combine the burstiness index and periodicity index to judge the changes in traffic characteristics, and can promptly detect the trend of low-risk level traffic evolving to high-risk level. By analyzing the burstiness and periodicity characteristics of traffic, the system can accurately identify traffic with attack characteristics and adjust its risk level in a timely manner, thereby optimizing the execution effect of the protection strategy, improving the system's adaptability to attack behavior, and enhancing the accuracy of the protection strategy.

[0059] 3. The present application provides a method for defending against distributed denial of service attacks. Based on the results of the danger level assessment, a conversion probability matrix of data traffic at different danger levels is constructed, and the conversion trend of data traffic at each danger level is calculated. The system can accurately grasp the migration pattern of data traffic between different danger levels. When the conversion probability of low-risk data traffic to medium-risk data traffic exceeds a preset threshold, by extracting the characteristic parameters of the low-risk data traffic and adjusting the execution parameters of the delayed forwarding strategy accordingly, the system can optimize the defense strategy in a targeted manner, so that the system can pre-adjust the defense strategy when the data traffic shows a trend of increasing danger level, reducing the lag of the traditional solution in waiting until the attack traffic has completely evolved into a high-risk level before taking corresponding measures. By analyzing the characteristic parameters of low-risk data traffic and dynamically adjusting the delayed forwarding strategy, the system's ability to prevent potential attack behaviors is improved, and the risk of a decline in defense effectiveness due to the solidification of the defense strategy is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1This is a flow chart of a distributed denial of service attack defense method in an embodiment of the present application.

[0061] Figure 2 It is a flow chart of a dynamic management method of a delayed forwarding queue in an embodiment of the present application.

[0062] Figure 3 This is a schematic diagram of the physical device structure of a distributed denial of service attack defense system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "said," "above," "the," and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in this application refers to any or all possible combinations comprising one or more of the listed items.

[0064] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0065] The following uses an embodiment and combines Figure 1 , a distributed denial of service attack defense method in an embodiment of the present application is described:

[0066] See also Figure 1 , which is a flow chart of a distributed denial of service attack defense method in an embodiment of the present application.

[0067] S101, respectively calculating characteristic parameters of network traffic data within each preset time window;

[0068] The system calculates the characteristic parameters of network traffic data within each preset time window, including packet size, arrival time interval, protocol type, traffic burstiness and packet entropy value.

[0069] In this step, the system segments network traffic data into several preset time windows, such as 1, 5, or 10 seconds. It then extracts features from the traffic data within each time window and calculates a set of numerical indicators reflecting traffic characteristics, known as characteristic parameters. These characteristic parameters typically include packet size, inter-arrival time, protocol type, traffic burstiness, and packet entropy.

[0070] To accurately calculate characteristic parameters, the system can use a sliding time window approach, sliding the window continuously at a fixed time step to achieve continuous sampling and analysis of traffic data. At the same time, the system can also incorporate the concept of multi-scale analysis, using time windows of different sizes to extract the characteristics of traffic data at different time scales, capturing its dynamic changes at multiple scales and levels.

[0071] S102, combining the feature parameters according to the weighting coefficients to generate a multidimensional feature vector;

[0072] The system combines feature parameters according to weighted coefficients to generate a multidimensional feature vector. The weighted coefficients are determined based on historical attack data. Specifically, the correlation between each feature parameter and the attack behavior is calculated based on historical attack data. An optimization objective function is constructed based on the correlation, and the particle swarm algorithm is used to solve the optimization objective function to obtain the initial weights of each feature parameter. The initial weights are normalized to obtain the weighted coefficients. The feature parameters are linearly combined according to the weighted coefficients to obtain a multidimensional feature vector.

[0073] In this step, the system fuses the multiple feature parameters extracted in the previous step to generate a multidimensional feature vector that comprehensively reflects the traffic characteristics. Because different feature parameters have varying degrees of characterization of attack behavior, each feature parameter is assigned a weight to indicate its importance. These are then weighted and combined to form the final feature vector. This weighted fusion method effectively balances the contributions of different features, improving the robustness and discriminative power of the feature representation.

[0074] To determine the weight of each feature parameter, the system can employ statistical learning methods based on historical attack data. First, based on labeled attack traffic samples, the correlation between each feature parameter and the attack behavior is calculated, such as the Pearson correlation coefficient and mutual information, to obtain a set of correlation coefficients. These correlation coefficients are then used as the optimization objective function, employing heuristic search algorithms such as particle swarm optimization and genetic algorithms to find the optimal set of feature weights that maximizes the correlation between the weighted feature vector and the attack behavior.

[0075] In real-world applications, network environments and attack methods may change over time, necessitating adaptive adjustment of feature weights. The system can employ online learning strategies to dynamically update feature weights based on the latest attack sample data, adapting them to current traffic patterns. Furthermore, to mitigate instability in weight adjustment, the system can also incorporate regularization mechanisms, such as L1 and L2 regularization terms, to constrain the magnitude of weight updates and ensure smooth and continuous feature fusion.

[0076] S103, constructing a time series state transfer matrix according to the multidimensional feature vector;

[0077] The system constructs a time series state transfer matrix based on the multidimensional feature vector. The row vector of the time series state transfer matrix represents the multidimensional feature vector of the current time window, and the column vector represents the multidimensional feature vector of the next time window.

[0078] In this step, the system further abstracts the multidimensional feature vectors into a state transition matrix, which describes the evolution of traffic data across different time windows. The state transition matrix is ​​a two-dimensional matrix in which each element represents the probability of a feature vector from one time window transitioning to the feature vector of the next. By analyzing the structural characteristics of the state transition matrix, we can identify temporal correlations and changing trends in traffic data, providing important insights for subsequent anomaly detection.

[0079] To construct the time-series state transition matrix, the system can use a sliding window approach to partition the traffic data at fixed time steps, generating a continuous sequence of feature vectors. The feature vectors of two adjacent time windows are then used as row and column vectors of the state transition matrix, respectively. The transition frequencies between them are counted to generate a transition probability matrix. To improve the sparsity and robustness of the matrix, the system can also perform threshold filtering and normalization on the transition probabilities, removing low-probability transitions and highlighting the structural characteristics of high-probability transitions.

[0080] S104, extracting the characteristic root sequence of the time series state transfer matrix and calculating the modulus length change rate of the characteristic root sequence;

[0081] The system extracts the characteristic root sequence of the time series state transfer matrix and calculates the module length change rate of the characteristic root sequence. Specifically: the module length difference between two adjacent characteristic roots in the characteristic root sequence is calculated; the changing trend of the module length difference within a preset time window is statistically analyzed; the changing trend is predicted based on the exponential smoothing method to obtain the predicted module length difference; and the module length change rate is calculated based on the deviation between the predicted module length difference and the module length difference.

[0082] In this step, the system performs eigendecomposition on the time-series state transition matrix constructed in the previous step to extract its inherent dynamic characteristics. According to linear algebra theory, any matrix can be decomposed into a linear combination of several eigenvectors and eigenroots. Eigenroots represent the scaling ratio of the matrix transformation, while eigenvectors represent the primary direction of the transformation. For a time-series state transition matrix, the size and distribution of its eigenroots reflect the strength and stability of the temporal correlation of the traffic data, while the eigenvectors characterize the dominant pattern of traffic changes. Therefore, by analyzing the dynamic changes in the eigenroot sequence, it is possible to sensitively capture abnormal fluctuations in traffic data, providing strong support for attack detection.

[0083] To extract the eigenvalue sequence of the time-series state transition matrix, the system can use numerical calculation methods such as QR decomposition and power iteration to solve the matrix's characteristic equation and obtain all eigenvalues ​​and eigenvectors. The eigenvalues ​​are then sorted by their modulus length, and the top K largest eigenvalues ​​are extracted to form a K-dimensional eigenvalue sequence. The value of K here can be adaptively selected based on the matrix's dimension and sparsity, requiring it to be large enough to capture the main dynamic characteristics but small enough to reduce computational complexity.

[0084] After obtaining the characteristic root sequence, the system needs to further calculate its modulus change rate, that is, the temporal trend of the modulus difference between two adjacent characteristic roots. The modulus change rate reflects the evolution speed and magnitude of the dynamic structure of traffic data at different time scales and is an important anomaly indicator. To accurately predict the modulus change rate, the system can use time series prediction methods such as the autoregressive moving average (ARMA) model. Based on the historical modulus difference sequence, it estimates the current trend and future direction of change. Furthermore, the system can also introduce an adaptive filtering mechanism to dynamically adjust the model order and parameters based on the prediction error, improving the accuracy and real-time performance of the prediction.

[0085] S105: constructing a dynamic phase diagram based on the modulus change rate, calculating the Euclidean distance between adjacent track points in the dynamic phase diagram, and determining that an abnormal attractor is present when the Euclidean distance between adjacent track points is less than a first preset threshold and the clustering degree of the track points is greater than a second preset threshold;

[0086] The system calculates the Euclidean distance between adjacent track points in the dynamic phase diagram. When the Euclidean distance between adjacent track points is less than a first preset threshold and the aggregation of track points is greater than a second preset threshold, it is determined that an abnormal attractor has appeared. The aggregation of track points is obtained by calculating the number of track points per unit area.

[0087] In this step, the system needs to map the characteristic root modulus change rate calculated in the previous step onto a two-dimensional phase plane to construct a dynamic phase diagram of the flow data. The dynamic phase diagram is a commonly used nonlinear time series analysis tool. It reveals the intrinsic dynamic structure and evolution laws of the time series by embedding the time series into a high-dimensional phase space and then performing geometric analysis on the trajectory in the phase space. On the dynamic phase diagram, the state of the flow data at different times corresponds to different points in the phase space. These points are connected in chronological order to form a state evolution trajectory. By analyzing the geometry of the trajectory, density distribution and other characteristics, it is possible to determine whether the flow data has abnormal attractors, that is, signs of abnormal behavior.

[0088] To construct a dynamic phase diagram, the system first needs to select an appropriate embedding dimension and time delay to map the characteristic root modulus change rate sequence into phase space. The embedding dimension determines the dimensionality of the phase space, while the time delay determines the time interval between state points. These two parameters must be optimized based on statistical characteristics such as the autocorrelation and mutual information of the time series. They must fully reveal the dynamic structure of the time series while avoiding noise interference caused by excessive dimensionality. Once the phase space embedding is obtained, the system can calculate the coordinates of the state points at each moment, connect these state points, and generate a dynamic phase diagram.

[0089] In the dynamic phase diagram, the system focuses on two geometric features: the Euclidean distance between adjacent track points and the clustering of track points. The Euclidean distance reflects the similarity between state points; the smaller the distance, the stronger the correlation between the states. The clustering reflects the distribution density of state points in phase space; the higher the clustering, the longer the system stays near that state. When the Euclidean distance between adjacent track points is less than a preset threshold, and the clustering of track points is greater than another preset threshold, the system can determine that an abnormal attractor has appeared in the phase space, indicating that the traffic data has experienced abnormal fluctuations.

[0090] To quantify the clustering of orbital points, the system can employ density clustering algorithms, such as DBSCAN and OPTICS, to cluster the orbital points in phase space and obtain cluster structures at different density levels. The density of orbital points within each cluster—the number of orbital points per unit phase space volume—is then calculated as a measure of the clustering of that state. To mitigate errors and fluctuations in density estimates, the system can also employ smoothing techniques, such as kernel density estimation, to perform a local weighted average of the distribution of orbital points, yielding a more robust estimate of clustering.

[0091] S106, extracting the flow data of the time window corresponding to the abnormal attractor, and calculating the self-similarity index of the flow data;

[0092] In this step, the system further analyzes the anomaly attractors detected in the previous step to determine whether they correspond to actual network attacks. Because an anomaly attractor is merely a geometric representation of traffic data in phase space, it can be caused by a network attack or other factors such as network congestion or equipment failure. To distinguish these different anomaly sources, the system extracts the raw traffic data within the time window corresponding to the anomaly attractor and performs a self-similarity analysis on it, resulting in a quantitative anomaly score, known as the self-similarity index.

[0093] Self-similarity is a key characteristic of network traffic data, indicating that the statistical characteristics of traffic at different time scales share similar fractal structures. Normal network traffic typically exhibits high self-similarity, with a self-similarity index close to 1. Abnormal network traffic, such as DDoS attack traffic, exhibits low self-similarity, with a self-similarity index significantly deviating from 1. Therefore, by calculating the self-similarity index, the system can effectively distinguish between normal and attack traffic, providing a quantitative basis for anomaly detection.

[0094] To calculate the self-similarity index of traffic data, the system can employ classic fractal analysis methods such as the R / S statistic and variance-time graph methods. The basic idea is to divide traffic data into subsequences of varying scales, calculate statistics such as the mean and variance for each subsequence, and then analyze the power-law relationship between these statistics and scale to obtain the self-similarity parameter H, which is then used to calculate the self-similarity index. In practical applications, due to the non-stationarity and long-range correlation of traffic data, traditional fractal analysis methods may face challenges in convergence and robustness. Therefore, the system can also introduce higher-order statistics, such as the generalized Hurst exponent and the multifractal spectrum, to characterize the multi-scale self-similarity characteristics of traffic.

[0095] When extracting traffic data corresponding to an anomalous attractor, the system needs to determine the corresponding time window range based on the attractor's location and duration in phase space. Because actual cyberattacks can have a certain degree of persistence and delayed effects, an anomalous attractor may appear multiple times in phase space or persist for a period of time. Therefore, when extracting traffic data, the system needs to consider an appropriate time boundary that fully covers the attractor's influence range while minimizing interference from irrelevant traffic. To achieve adaptive time boundary selection, the system can use data-driven methods such as cross-validation to learn and optimize the size and position of the time window based on historical attack data, thereby improving the accuracy of traffic extraction.

[0096] S107: When the self-similarity index is greater than the third preset threshold, the flow data is determined to be at a high risk level; when the self-similarity index is greater than the fourth preset threshold and less than or equal to the third preset threshold, the flow data is determined to be at a medium risk level; when the self-similarity index is less than or equal to the fourth preset threshold, the flow data is determined to be at a low risk level;

[0097] In this step, the system classifies the abnormal traffic data into different danger levels based on the self-similarity index calculated in the previous step. Because the self-similarity index quantifies the degree to which traffic data deviates from normal self-similarity, it serves as an effective anomaly scoring metric. The system uses two preset thresholds to divide the self-similarity index into three ranges, corresponding to high, medium, and low danger levels. When the self-similarity index falls within different ranges, the system can quickly determine the severity of the anomaly and take appropriate defensive measures.

[0098] Threshold settings require comprehensive consideration of multiple factors, such as the network environment, attack type, and defense requirements. Typically, the third threshold is set higher to identify traffic with severe self-similarity violations, typically associated with large-scale DDoS attacks and posing a higher risk. The fourth threshold is set lower to identify traffic with slight deviations from self-similarity, likely caused by low-intensity attacks or network anomalies, posing a relatively lower risk. Traffic falling between the two thresholds is considered moderately dangerous and requires further analysis and monitoring.

[0099] To determine the optimal threshold, the system can employ statistical learning methods based on attack samples. First, a set of known attack traffic and normal traffic data is collected, and their self-similarity index distribution characteristics, such as mean, variance, and quantiles, are calculated. Then, through methods such as cross-validation, performance metrics such as anomaly detection accuracy, recall, and F1 score are evaluated under different threshold combinations. The threshold with the best overall performance is selected as the initial setting. In actual operation, the system can also dynamically adjust and optimize the threshold based on detection results and expert knowledge through a feedback mechanism to adapt to changes in the network environment.

[0100] In practical applications, due to the complexity and diversity of network traffic, relying solely on a single self-similarity index may not accurately identify all types of network attacks. Therefore, the system can adopt a multi-index fusion strategy, comprehensively considering multiple abnormal characteristics of traffic, such as self-similarity, burstiness, and persistence, to build a more comprehensive and reliable risk assessment model. For example, the system can introduce a clustering-based anomaly detection method to map multiple anomaly indicators into a high-dimensional feature space and identify traffic clusters of different risk levels through cluster analysis. Alternatively, the system can introduce a dimensionality reduction method based on principal component analysis to extract the common features of multiple anomaly indicators and obtain a comprehensive anomaly scoring metric.

[0101] Furthermore, some special types of network attacks, such as APTs (Advanced Persistent Threats), may employ covert methods, slowly penetrating over long periods of time without causing noticeable traffic anomalies. To detect these subtle threats, the system must also incorporate higher-level semantic analysis and behavioral modeling technologies, such as machine learning-based anomaly detection and graph-based threat intelligence correlation. These technologies can mine traffic data from multiple dimensions for hidden anomaly patterns and attack chains, enabling more intelligent and proactive network security defenses.

[0102] S108. Execute a discard policy for traffic data of a high-risk level; execute a bandwidth restriction policy for traffic data of a medium-risk level; and execute a delayed forwarding policy for traffic data of a low-risk level.

[0103] In this step, the system dynamically selects and executes appropriate traffic control policies based on the traffic risk level determined in the previous step. This policy suppresses and isolates potential attack traffic, ensuring network security and availability. Because traffic of different risk levels has varying attack strengths and harmfulness, different control measures are required to effectively block high-risk attack traffic while minimizing the impact on normal business traffic.

[0104] For high-risk traffic, the system directly executes a discard policy, completely isolating it from the network. This traffic often exhibits obvious attack characteristics, such as large numbers of repeated SYN requests and malformed packets, posing a serious threat to network security and requiring immediate blocking. While executing the discard policy, the system also records and analyzes the discarded traffic data, extracting attack characteristics and patterns. This is used to optimize anomaly detection models and update blacklists, improving future detection and defense efficiency.

[0105] For traffic data with a medium-risk level, the system implements a bandwidth limiting policy, limiting its network transmission rate and reducing its impact on the network. Compared to direct discarding, bandwidth limiting is a more flexible control method that can suppress potential attack traffic while maintaining a certain level of network availability and avoiding accidental damage to normal services. When implementing bandwidth limiting, the system needs to dynamically adjust the limiting thresholds and policies based on the network environment and attack type. For example, when the network load is high, the bandwidth threshold can be appropriately lowered; when a specific type of attack is detected, the traffic of certain protocols or ports can be specifically restricted. At the same time, the system can also use technologies such as traffic shaping and priority control to differentiate the traffic of different services to ensure the performance of critical services.

[0106] For low-risk traffic data, the system implements a delayed forwarding strategy. Through caching and scheduling mechanisms, it delays its transmission time in the network, reducing its real-time impact. Although this traffic has certain abnormal characteristics, its risk is relatively low, and directly discarding or restricting it may affect normal business. Through delayed forwarding, the system has more time to conduct in-depth analysis, extract more feature information, and optimize the accuracy of anomaly detection. At the same time, delayed forwarding can also play a certain buffering and peak-cutting role, preventing instantaneous traffic surges from impacting the network. When implementing delayed forwarding, the system needs to set a reasonable delay time and cache queue length to effectively absorb burst traffic while avoiding introducing excessive transmission delays that affect the user experience.

[0107] In the above embodiment, the characteristic parameters of the network traffic data within a preset time window are calculated and combined according to weighted coefficients to generate a multidimensional feature vector, making the expression of traffic characteristics more comprehensive and accurate. The time series state transition matrix constructed based on the multidimensional feature vector can reflect the dynamic change pattern of traffic characteristics. The extracted characteristic root sequence and its modulus change rate can quantitatively describe the evolution process of the traffic state. The modulus change rate is mapped to the dynamic phase diagram. By analyzing the Euclidean distance and aggregation of adjacent track points, abnormal change patterns of traffic characteristics can be discovered in a timely manner. Combined with the self-similarity index of the traffic data in the time window corresponding to the abnormal attractor, and adopting corresponding protection strategies for different risk levels, accurate identification and hierarchical protection of distributed denial of service attacks are achieved. While improving detection accuracy, it also reduces the false alarm rate. The hierarchical protection mechanism reduces the impact on normal traffic, improves the accuracy of the formulation and implementation of protection strategies, and thus improves network security.

[0108] On the basis of the above embodiments, in order to further improve the system's monitoring and protection capabilities for low-risk data traffic, this application also provides a dynamic management method for delayed forwarding queues. This solution monitors the operating status of delayed forwarding queues in real time and promptly triggers a reassessment of the risk level when an anomaly is found, thereby ensuring that the system can accurately identify and process data traffic that exhibits attack characteristics during delayed forwarding. Figure 2 , a dynamic management method for a delayed forwarding queue in an embodiment of the present application is described:

[0109] See also Figure 2 , which is a flow chart of a dynamic management method of a delayed forwarding queue in an embodiment of the present application.

[0110] S201, detecting the queue length and waiting time of traffic in a delayed forwarding queue to obtain a queue state sequence;

[0111] In this step, the system monitors the status of the delayed forwarding queue in real time to obtain key metrics reflecting queue congestion: queue length and wait time. Queue length represents the number of packets currently in the queue, while wait time represents the interval between each packet entering the queue and being processed. These two metrics directly reflect the queue's load intensity and service quality, and are crucial for evaluating queue performance.

[0112] To obtain these two metrics, the system deploys traffic monitoring probes at the ingress and egress of the delayed forwarding queue to collect queue status information in real time. The probes can record metadata such as the arrival time, departure time, and packet length of each data packet through passive or active detection, and regularly report these data to the central controller. The controller aggregates the measurement data from multiple probes to calculate the queue length and waiting time at different times, forming a time series known as the queue status series.

[0113] To improve the temporal resolution and accuracy of queue state sequences, the system can employ adaptive sampling and estimation strategies. For example, when queue load is high, the probe sampling frequency can be increased to obtain more fine-grained state information; when queue load is low, the sampling frequency can be reduced to reduce probe resource overhead. Furthermore, the system can employ techniques such as sliding windows and exponential smoothing to denoise and predict queue state sequences, achieving smoother and more accurate state tracking.

[0114] S202, calculating a queue congestion index based on a queue state sequence;

[0115] In this step, the system calculates a quantitative metric based on the queue status sequence obtained in the previous step to assess the queue's congestion level. This metric, called the queue congestion index (QCI), comprehensively considers both queue length and wait time. It reflects the cumulative volume and retention time of packets in the queue and is a key factor in measuring queue performance.

[0116] The queue congestion index can be calculated using a variety of mathematical models and algorithms, such as queuing theory models and time series analysis. A common approach is to take a weighted average of queue length and wait time to obtain a comprehensive congestion metric. The system can design different weighting coefficients based on the queue's scheduling policy and service model to reflect the importance of different indicators. For example, for high-priority traffic, wait time should be weighted more heavily than queue length; for standard best-effort services, queue length can be weighted more heavily.

[0117] In addition to weighted averaging, the system can also employ more complex nonlinear combinations, such as exponential and logarithmic functions, to highlight the nonlinear effects of queue congestion. When queue length or wait time exceeds a certain critical value, queue performance degrades dramatically, triggering a congestion avalanche. Therefore, the calculation of the queue congestion index should be able to sensitively capture this critical state and provide a clear early warning signal.

[0118] S203: When the queue congestion index exceeds a fifth preset threshold, re-evaluate the risk level of the data traffic in the queue;

[0119] When the queue congestion index exceeds the fifth preset threshold, the data traffic in the queue is re-evaluated for its danger level. Specifically, the short-term statistical characteristics of the data traffic in the delayed forwarding queue are extracted, and the short-term statistical characteristics include the packet arrival interval, packet length distribution, and protocol type distribution; the change acceleration of the traffic characteristics is calculated based on the short-term statistical characteristics; the change acceleration is used to identify the mutation points and inflection points of the traffic characteristics to obtain a critical moment sequence; the frequency of occurrence of preset abnormal events is calculated based on the critical moment sequence. When the occurrence frequency exceeds the eighth preset threshold, the danger level of the corresponding data traffic is raised to the next level.

[0120] In this step, the system determines whether the delayed forwarding queue is severely congested based on the queue congestion index calculated in the previous step, triggering a reassessment of the data traffic in the queue. Since low-risk traffic may experience significant changes in characteristics after entering the delayed forwarding queue, some traffic may gradually become more risky. Therefore, when queue congestion reaches a certain level, it is necessary to reassess the risk level of these traffic flows to promptly identify traffic with previously underestimated risk.

[0121] Specifically, the system first sets a queue congestion index threshold, known as the fifth preset threshold. If the actual congestion index exceeds this threshold for a sustained period, the queue is considered severely congested and traffic flow reassessment is initiated. Setting the threshold requires comprehensive consideration of factors such as the system's processing capacity and traffic characteristics. It must be able to detect signs of congestion promptly while avoiding overly frequent assessment triggers that introduce unnecessary overhead.

[0122] After triggering a reassessment, the system extracts a series of short-term statistical features for each data flow in the delayed forwarding queue, including packet arrival intervals, packet length distribution, and protocol type distribution. These features represent the dynamic changes in traffic during the delayed forwarding process and reveal its statistical patterns at multiple timescales. By analyzing the evolution of these features over time, the system can track and predict changes in the riskiness of each flow in real time.

[0123] To accurately characterize the dynamic characteristics of traffic flow, the system calculates a key metric—acceleration of change—based on short-term statistical features. Acceleration of change measures the severity of changes in traffic characteristics and is an important indicator for assessing traffic anomalies. The system uses numerical calculation methods such as differential methods and derivative estimation to calculate acceleration of change for each statistical feature's time series. When the absolute value of the acceleration exceeds a certain threshold, it is considered a significant sudden change or inflection point in traffic flow, indicating a potential dangerous event.

[0124] By tracking the acceleration of change, the system automatically identifies critical moments in traffic evolution and generates a sequence of critical moments. This sequence records the time points at which each flow experienced anomalies, providing a valuable reference for assessing the traffic risk level. The system then calculates the frequency of anomalies for each flow over a period of time. When the frequency exceeds the eighth preset threshold, the flow is deemed to exhibit clear attack characteristics and its risk level should be raised to medium or above.

[0125] S204. Calculate the burstiness index and periodicity index of the data traffic based on the risk level assessment result;

[0126] In this step, the system further analyzes two key characteristic indicators for each data flow: burstiness and periodicity, based on the risk level reassessed in the previous step. These indicators describe the dynamic patterns of traffic flow over time from different perspectives and are crucial for implementing refined traffic control. By calculating and tracking these two indicators, the system can more comprehensively assess the risk of each flow and identify malicious traffic with covert attack characteristics.

[0127] The burstiness metric measures the intensity of traffic bursts within a short period of time and reflects the variability of instantaneous bandwidth. Normal business traffic typically maintains a relatively stable bandwidth and exhibits a low burstiness metric. However, many attack traffic types, such as DDoS and scanning, often exhibit significant burstiness, generating a large number of packets within a short period of time, leading to a sharp increase in the burstiness metric. Therefore, the burstiness metric is a sensitive signal for detecting traffic anomalies.

[0128] To calculate burstiness indicators, the system can use a sliding window approach to perform local statistical analysis of each flow's arrival process. Specifically, within each window, statistics are collected on metrics such as the instantaneous rate of traffic and the variance of packet arrival intervals. Then, thresholds are set to determine whether traffic bursts are occurring. The system can also employ an adaptive window size and threshold selection mechanism to dynamically adjust the window time scale and judgment threshold based on the statistical characteristics of the traffic. This allows for sensitive detection of sudden events while reducing the risk of false alarms.

[0129] Periodicity measures the repetitive patterns of traffic over long timescales, reflecting the strength of its temporal correlation. Many normal service traffic flows, such as video and voice, often exhibit significant periodicity, with similar statistical features recurring over a certain time interval. However, certain attack traffic, such as slow-rate DDoS and stealthy probes, can also disguise periodicity to evade detection mechanisms based on burst characteristics. Therefore, accurately identifying traffic periodicity is crucial for detecting more subtle attacks.

[0130] Calculating periodicity indicators can be accomplished through various signal processing and time series analysis methods. For example, the system can perform autocorrelation analysis on each flow's time series, calculating the autocorrelation coefficient at different lag orders to determine the strength of the series' periodicity. Furthermore, methods such as power spectrum analysis and wavelet analysis can be used to characterize the periodic structure of traffic flow from a frequency domain perspective. For flows with significant periodicity, the system extracts its primary periodic components and calculates key parameters such as period length and frequency to serve as a basis for assessing the riskiness of the flow.

[0131] S205: When the burst index exceeds the sixth preset threshold or the periodic index exceeds the seventh preset threshold, the corresponding data traffic is increased to a medium risk level.

[0132] In this step, the system dynamically adjusts the risk level of each flow based on the burstiness and periodicity indicators calculated in the previous step. By setting two key thresholds—the sixth and seventh preset thresholds—the system can flexibly control the criteria for determining traffic risk, promptly detecting even deeply hidden malicious traffic, elevating it to a medium risk level, and implementing appropriate control measures.

[0133] Specifically, when a flow's burstiness index exceeds the sixth preset threshold, it is considered to exhibit significant abnormal burst characteristics over a short time scale, likely containing attack or anomaly components. At this point, the system immediately raises the flow's risk level from low to medium, triggering appropriate traffic control and cleaning mechanisms to monitor and manage the flow. By promptly addressing bursty traffic, the impact on network bandwidth and service quality can be effectively reduced.

[0134] Similarly, when a flow's periodicity indicator exceeds the seventh preset threshold, the flow is considered to exhibit an unusually repetitive pattern over a long period of time, making it highly suspicious. This periodic anomaly may stem from subtle, low-speed attacks, such as Slowloris and LOIC, which evade conventional anomaly detection mechanisms by disguising themselves as normal business access patterns. For such traffic, the system will decisively raise its risk level to medium and implement appropriate measures, such as rate limiting and filtering, to control its use of network resources.

[0135] In the above-described embodiment, queue status is detected and the queue congestion index is calculated to monitor the handling of low-risk traffic. When congestion occurs, the system reassesses the risk level of the data traffic in the queue and, combining burstiness and periodicity indicators, determines changes in traffic characteristics. This allows for the timely detection of trends in low-risk traffic evolving toward high-risk levels. By analyzing the burstiness and periodicity of traffic, the system can accurately identify traffic with attack characteristics and promptly adjust its risk level, thereby optimizing the effectiveness of protection strategies, improving the system's adaptability to attack behavior, and enhancing the accuracy of protection strategies.

[0136] Furthermore, after step S108, the system constructs a conversion probability matrix of data flows of different danger levels based on the danger level assessment results;

[0137] The conversion probability matrix is ​​used to calculate the conversion trend of data traffic at each hazard level;

[0138] When the conversion probability of the data flow of the low-risk level to the data flow of the medium-risk level exceeds a ninth preset threshold, extracting characteristic parameters of the data flow of the low-risk level;

[0139] Adjust the execution parameters of the delayed forwarding strategy according to the characteristic parameters. Specifically, calculate the resource occupancy rate and processing delay of the delayed forwarding strategy to obtain a resource utilization state sequence.

[0140] Calculate the system load balancing index based on the resource utilization state sequence;

[0141] Allocate system processing resources based on the system load balancing index and conversion trends;

[0142] Adjust the execution priority of the delayed forwarding strategy according to the allocation result of system processing resources.

[0143] First, based on the hazard level assessment results from the previous step, the system constructs a probability matrix that reflects the transition relationships between traffic flows of different hazard levels. This is known as the transition probability matrix. Each element of this matrix represents the probability of traffic flows of one hazard level transitioning to another within a given time window. By statistically analyzing historical assessment data, the system estimates empirical values ​​for these transition probabilities.

[0144] The transition probability matrix captures the dynamic evolution of data traffic between different risk levels and is a crucial tool for predicting future trends in traffic risk. To quantify these transition trends, the system calculates the probability distribution of traffic from each risk level transitioning to other levels based on the transition probability matrix, forming a transition trend vector. Each component of this vector represents the probability of traffic from the current risk level transitioning to the target level within the next time window.

[0145] The system focuses on trends transitioning from low-risk to medium-risk levels. When the probability of this transition exceeds a preset threshold (the ninth preset threshold), it indicates that the current low-risk traffic is at high risk of transitioning to medium-risk traffic, requiring prompt management and control. At this point, the system extracts a series of characteristic parameters of the current low-risk traffic, such as packet length, arrival interval, and peak-to-average ratio, to guide subsequent policy adjustments.

[0146] Based on the extracted characteristic parameters, the system adaptively adjusts the execution parameters of the delayed forwarding strategy to optimize system resource utilization. First, the system continuously monitors the effectiveness of the current delayed forwarding strategy, compiling statistics on key indicators such as resource utilization and processing latency to form a resource utilization status sequence. This sequence reflects the system's performance under different load conditions.

[0147] Based on the resource utilization status sequence, the system then calculates a quantitative metric—the system load balance index—to assess the rationality of current system resource allocation. This metric comprehensively considers the utilization balance of various resource dimensions and the overall load level. It can be defined using imbalance metrics such as the Gini coefficient and entropy. A higher load balance index indicates more balanced and efficient system resource utilization.

[0148] After determining the system load balance index and the conversion trend vector, the system will take both into account and dynamically allocate processing resources for traffic of varying risk levels. Specifically, when a significant shift in low-risk to medium-risk traffic occurs, the system will appropriately reduce processing resources for low-risk traffic and increase the reserved resources for medium-risk traffic to address the potential increase in risk. The system will also consider the load balance index to optimize resource allocation while ensuring balance, thereby improving the processing efficiency of critical traffic.

[0149] Finally, the system dynamically adjusts the execution priority of the delayed forwarding policy based on the optimized resource allocation plan. For low-risk traffic with higher risks, its delayed forwarding priority will be appropriately increased to facilitate timely integration into analysis and control processes. For processing nodes with higher loads, its task priority will be appropriately lowered to reduce system pressure and avoid cascading failures. This dynamic scheduling of priorities allows for a more flexible balance between security and performance.

[0150] In the above embodiment, based on the results of the danger level assessment, a conversion probability matrix of data traffic at different danger levels is constructed, and the conversion trend of data traffic at each danger level is calculated. The system can accurately grasp the migration pattern of data traffic between different danger levels. When the conversion probability of data traffic at a low danger level to data traffic at a medium danger level exceeds a preset threshold, by extracting the characteristic parameters of the data traffic at the low danger level and adjusting the execution parameters of the delayed forwarding strategy accordingly, the system can optimize the defense strategy in a targeted manner, so that the system can pre-adjust the defense strategy when the data traffic shows a trend of increasing danger level, reducing the lag in the traditional solution of waiting until the attack traffic has completely evolved into a high danger level before taking corresponding measures. By analyzing the characteristic parameters of the low danger level data traffic and dynamically adjusting the delayed forwarding strategy, the system's ability to prevent potential attack behaviors is improved, and the risk of a decline in defense effectiveness caused by the solidification of the defense strategy is reduced.

[0151] The following describes the system in the embodiment of the present invention from the perspective of hardware processing. Figure 3 , which is a schematic diagram of the physical device structure of a distributed denial of service attack defense system provided in an embodiment of the present application.

[0152] It should be noted that Figure 3 The structure of the system shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0153] like Figure 3 As shown, the system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes, such as the methods described in the above embodiments, based on programs stored in a read-only memory (ROM) 302 or programs loaded from a storage unit 308 into a random access memory (RAM) 303. RAM 303 also stores various programs and data required for system operation. CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to bus 304.

[0154] The following components are connected to the I / O interface 305: an input section 306 including a camera, infrared sensor, and the like; an output section 307 including a liquid crystal display (LCD) and speakers; a storage section 308 including a hard disk and the like; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. Removable media 311, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, is installed in the drive 310 as needed, so that computer programs read from the media can be installed in the storage section 308 as needed.

[0155] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for executing the methods illustrated in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 309 and / or installed from removable media 311. When executed by the central processing unit (CPU) 301, the computer program performs the various functions defined in the present invention.

[0156] It should be noted that the computer-readable medium described in the embodiments of the present invention may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium may include a data signal transmitted in baseband or as part of a carrier wave, which carries a computer-readable computer program. Such a propagated data signal may take any of a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0157] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. Each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes shown in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0158] As another aspect, the present invention further provides a computer-readable storage medium, which may be included in the system described in the above embodiments, or may exist independently and not incorporated into the system. The storage medium carries one or more computer programs, and when executed by a processor of a system, the system implements the methods provided in the above embodiments.

[0159] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0160] As used in the above embodiments, the term “when” may be interpreted to mean “if” or “after” or “in response to determining that” or “in response to detecting that”, depending on the context. Similarly, the phrases “upon determining that” or “if (stated condition or event) is detected” may be interpreted to mean “if determining that” or “in response to determining that” or “upon detecting (stated condition or event)” or “in response to detecting (stated condition or event)”, depending on the context.

[0161] In the above embodiments, all or part of the embodiments can be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, hard disk, tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0162] Those skilled in the art will appreciate that all or part of the process steps in the above-described method embodiments can be implemented by a computer program instructing the relevant hardware. The program can be stored in a computer-readable storage medium, and when executed, the program can include the process steps in the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A distributed denial of service attack defense method, characterized in that: include: Calculate the characteristic parameters of network traffic data in each preset time window respectively, wherein the characteristic parameters include packet size, arrival time interval, protocol type, traffic burstiness and packet entropy value; Combining the characteristic parameters according to weighting coefficients to generate a multidimensional characteristic vector, wherein the weighting coefficients are determined based on historical attack data; Constructing a time series state transfer matrix based on the multidimensional feature vector, wherein the row vector of the time series state transfer matrix represents the multidimensional feature vector of the current time window, and the column vector represents the multidimensional feature vector of the next time window; Extracting the characteristic root sequence of the time series state transfer matrix and calculating the modulus change rate of the characteristic root sequence; constructing a dynamic phase diagram based on the mode length change rate; Calculating the Euclidean distance between adjacent track points in the dynamic phase graph, and determining that an abnormal attractor exists when the Euclidean distance between adjacent track points is less than a first preset threshold and the aggregation degree of the track points is greater than a second preset threshold, wherein the aggregation degree of the track points is obtained by calculating the number of track points per unit area; Extracting the flow data of the time window corresponding to the abnormal attractor and calculating the self-similarity index of the flow data; When the self-similarity index is greater than a third preset threshold, the flow data is determined to be at a high risk level; when the self-similarity index is greater than a fourth preset threshold and less than or equal to the third preset threshold, the flow data is determined to be at a medium risk level; when the self-similarity index is less than or equal to the fourth preset threshold, the flow data is determined to be at a low risk level; A discard strategy is executed for the traffic data of the high-risk level; a bandwidth restriction strategy is executed for the traffic data of the medium-risk level; and a delayed forwarding strategy is executed for the traffic data of the low-risk level.

2. The method according to claim 1, characterized in that The step of combining the feature parameters according to weighted coefficients to generate a multi-dimensional feature vector specifically includes: Calculating the correlation between each characteristic parameter and the attack behavior according to the historical attack data; Constructing an optimization objective function based on the correlation, and solving the optimization objective function using a particle swarm algorithm to obtain an initial weight of each characteristic parameter; Normalizing the initial weights to obtain weighting coefficients; The characteristic parameters are linearly combined according to the weighting coefficients to obtain a multi-dimensional characteristic vector.

3. The method according to claim 1, characterized in that The calculating of the modulus length change rate of the characteristic root sequence specifically includes: Calculating the difference in modulus length between two adjacent characteristic roots in the characteristic root sequence; Counting the changing trend of the module length difference within a preset time window; Predicting the change trend based on the exponential smoothing method to obtain a predicted module length difference; The module length change rate is calculated based on the deviation between the predicted module length difference and the module length difference.

4. The method according to claim 1, wherein After executing the delayed forwarding strategy for the traffic data of the low risk level, the method further includes: Detect the queue length and waiting time of traffic in the delayed forwarding queue and obtain the queue state sequence; Calculating a queue congestion index based on the queue state sequence; When the queue congestion index exceeds a fifth preset threshold, re-evaluating the risk level of data traffic in the queue; Calculating a burstiness index and a periodicity index of the data traffic according to the hazard level assessment result, wherein the burstiness index is determined based on a ratio of a peak value to a mean value of the data traffic, and the periodicity index is determined based on an autocorrelation function of the data traffic; When the burst index exceeds the sixth preset threshold or the periodic index exceeds the seventh preset threshold, the corresponding data traffic is increased to the medium risk level.

5. The method according to claim 4, characterized in that The re-evaluating the risk level of the data traffic in the queue specifically includes: Extracting short-term statistical features of data traffic in the delayed forwarding queue, wherein the short-term statistical features include data packet arrival interval, packet length distribution, and protocol type distribution; Calculating the change acceleration of the flow characteristic based on the short-term statistical characteristic; Using the change acceleration to identify the mutation point and inflection point of the flow characteristic, and obtain a critical moment sequence; The occurrence frequency of the preset abnormal event is calculated according to the key moment sequence statistics. When the occurrence frequency exceeds an eighth preset threshold, the danger level of the corresponding data traffic is increased to the next level.

6. The method according to claim 4 or 5, characterized in that After the corresponding data traffic is increased to the medium risk level, the method further includes: Constructing a conversion probability matrix of data flows of different danger levels based on the danger level assessment result; Calculating the conversion trend of the data flow of each danger level using the conversion probability matrix; When the conversion probability of the data flow of the low-risk level to the data flow of the medium-risk level exceeds a ninth preset threshold, extracting characteristic parameters of the data flow of the low-risk level; The execution parameters of the delayed forwarding strategy are adjusted according to the characteristic parameters.

7. The method according to claim 6, characterized in that The adjusting the execution parameters of the delayed forwarding strategy according to the characteristic parameters specifically includes: Counting the resource occupancy rate and processing delay of the delayed forwarding strategy to obtain a resource utilization state sequence; Calculating a system load balancing index based on the resource utilization state sequence; Allocating system processing resources based on the system load balancing index and the conversion trend; The execution priority of the delayed forwarding strategy is adjusted according to the allocation result of the system processing resources.

8. A distributed denial of service attack defense system, characterized in that: The system comprises: One or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the system to execute the method according to any one of claims 1 to 7.

9. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on a system, the system is caused to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program product is run on a system, the system is caused to perform the method according to any one of claims 1 to 7.

Images