Anti-DDoS (Distributed Denial of Service) attack collaborative mitigation architecture and method

Abstract

The invention provides an anti-DDoS (Distributed Denial of Service) attack collaborative mitigation architecture and method. Comprising a feature extraction module used for responding to a detected distributed denial of service (DDoS) attack, extracting a target traffic fingerprint of a corresponding hierarchical network space based on a feature fingerprint corresponding to each hierarchical network space in a multi-hierarchical network space, and transmitting the target traffic fingerprint to a mitigation strategy generation module; the mitigation strategy generation module is used for responding to the received target traffic fingerprint, constructing a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmitting the global anti-DDoS attack mitigation strategy to the strategy distribution module; and the strategy distribution module is used for transmitting the anti-DDoS attack mitigation strategy to the corresponding hierarchy network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy. According to the invention, through the anti-DDoS attack cooperative mitigation architecture, the defense effect on novel complex network attacks can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an anti-DDoS attack collaborative mitigation architecture and method. Background Art

[0002] With the development of the Internet, Distributed Denial of Service (DDoS) attacks have become a common threat in the field of network security, frequently targeting various websites, servers and infrastructure. The current status of DDoS attacks is characterized by high frequency, large scale and diversified means, which poses a huge challenge to network security. At present, the enterprise-side attack defense strategy cannot solve the congestion of upstream links; however, although operators have the advantage of link pipelines, the detection and disposal are not sophisticated enough due to factors such as the difficulty in coordinating network requirements at different levels and the difficulty in balancing detection costs, and the weak ability to detect new attacks. It is difficult to effectively resist emerging and complex DDoS attack modes by relying solely on unilateral defense technology. Therefore, there is an urgent need to explore available collaborative defense architectures.

[0003] The existing collaborative defense architecture mainly opens interfaces from the network side to the end side. When the end side encounters a large-volume attack that threatens the network bandwidth, cloud cleaning or cleaning alliances can be triggered to protect the enterprise's business and network bandwidth. Among them, the cleaning alliance provides users with powerful DDoS near-source cloud cleaning services by uniformly managing and scheduling DDoS cleaning resources within the alliance. At the same time, it can also solve the network congestion problem of upstream pipelines for users and protect upstream bandwidth.

[0004] However, although the existing collaborative defense method can solve the link blocking problem during large-traffic attacks, it still lacks the defense capability against new complex network attacks with high intensity and strong confrontation characteristics, such as security threats of the Quick User Datagram Protocol Internet Connections (QUIC) protocol, segment scanning attacks, and anthropomorphic attacks. Summary of the invention

[0005] The present application provides an anti-DDoS attack collaborative mitigation architecture and method to solve the technical problem of insufficient defense capabilities against new complex network attacks with high intensity and strong confrontation characteristics.

[0006] In a first aspect, the present application provides an anti-DDoS attack collaborative mitigation architecture, including:

[0007] A feature extraction module, for responding to the detection of a distributed denial of service (DDoS) attack, extracting a target traffic fingerprint of a corresponding layer of network space based on a feature fingerprint corresponding to each layer of network space in the multi-layer network space, and transmitting the target traffic fingerprint to a mitigation strategy generation module, wherein the multi-layer network space includes an access network, an intra-domain network, and an inter-domain network;

[0008] A mitigation strategy generation module is used to respond to receiving a target traffic fingerprint, build a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph according to the target traffic fingerprint, and transmit the global anti-DDoS attack mitigation strategy to the strategy distribution module. The anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies;

[0009] The policy distribution module is used to transmit the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

[0010] Optionally, in the above anti-DDoS attack collaborative mitigation architecture, the mitigation strategy generation module is specifically used for:

[0011] Through link correlation search technology, the global anti-DDoS attack mitigation strategy corresponding to the target traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

[0012] Optionally, the above anti-DDoS attack collaborative mitigation architecture further includes:

[0013] The collaborative control module is used to collect and analyze the traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and update the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

[0014] Optionally, in the above anti-DDoS attack collaborative mitigation architecture, the collaborative control module is specifically used for:

[0015] Analyze the traffic data information of the hierarchical network space and obtain the traffic curve after the hierarchical network space implements the anti-DDoS attack mitigation strategy. The traffic curve reflects the anti-DDoS attack effect;

[0016] The anti-DDoS attack mitigation strategy knowledge graph is updated according to the anti-DDoS attack effect, including: if the traffic curve contains traffic greater than the traffic threshold, then the correspondence between the anti-DDoS attack mitigation strategy executed in the corresponding hierarchical network space and the target traffic fingerprint of the corresponding hierarchical network space is deleted in the anti-DDoS attack mitigation strategy knowledge graph.

[0017] Optionally, in the above anti-DDoS attack collaborative mitigation architecture, the feature extraction module is further used to:

[0018] Obtain historical traffic in hierarchical network space, which includes normal traffic and multiple attack traffic;

[0019] Obtain the attack type corresponding to each attack flow in multiple attack flows;

[0020] Determine the contribution of the feature value corresponding to each target feature to each attack type. The target feature is determined by feature engineering technology; the contribution is determined by a preset random forest model;

[0021] According to the corresponding contribution of each target feature, the feature fingerprint corresponding to the hierarchical network space is determined.

[0022] Optionally, in the above anti-DDoS attack collaborative mitigation architecture, the mitigation strategy generation module is further used to:

[0023] Obtaining the first relationship between the characteristic fingerprints of different layers of network space and the attack type, and the second relationship between the attack type and the anti-DDoS attack mitigation strategy of different layers of network space;

[0024] According to the first relationship and the second relationship, an initial anti-DDoS attack mitigation strategy knowledge graph is constructed;

[0025] Based on the initial anti-DDoS attack mitigation strategy knowledge graph, the third relationship between feature fingerprints and anti-DDoS attack mitigation strategies is determined through knowledge reasoning;

[0026] According to the third relationship, the initial anti-DDoS attack mitigation strategy knowledge graph is optimized to obtain the anti-DDoS attack mitigation strategy knowledge graph.

[0027] In a second aspect, the present application provides a collaborative mitigation method against DDoS attacks, comprising:

[0028] The feature extraction module detects a distributed denial of service DDoS attack, extracts a target traffic fingerprint of the corresponding layer network space based on a feature fingerprint corresponding to each layer network space in the multi-layer network space, and transmits the target traffic fingerprint to the mitigation strategy generation module. The multi-layer network space includes an access network, an intra-domain network, and an inter-domain network.

[0029] The mitigation strategy generation module responds to receiving the target traffic fingerprint, builds a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph according to the target traffic fingerprint, and transmits the global anti-DDoS attack mitigation strategy to the strategy distribution module. The anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies;

[0030] The policy distribution module is based on the global anti-DDoS attack mitigation strategy and transmits the anti-DDoS attack mitigation strategy to the corresponding level of network space through the collaborative instruction API.

[0031] Optionally, as in the above method, based on the constructed anti-DDoS attack mitigation strategy knowledge graph, a global anti-DDoS attack mitigation strategy is constructed according to the target traffic fingerprint, including:

[0032] Through link correlation search technology, the global anti-DDoS attack mitigation strategy corresponding to the traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

[0033] Optionally, the above method further comprises:

[0034] The collaborative control module collects and analyzes the traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and updates the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

[0035] In a third aspect, the present application provides an anti-DDOS attack collaborative mitigation device, comprising:

[0036] A first transmission module is used for the feature extraction module to respond to the detection of a distributed denial of service DDoS attack, extract the target traffic fingerprint of the corresponding hierarchical network space based on the feature fingerprint corresponding to each hierarchical network space in the multi-level network space, and transmit the target traffic fingerprint to the mitigation strategy generation module, the multi-level network space includes an access network, an intra-domain network and an inter-domain network;

[0037] The second transmission module is used for the mitigation strategy generation module to respond to receiving the target traffic fingerprint, build a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmit the global anti-DDoS attack mitigation strategy to the strategy distribution module, and the anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between the feature fingerprint, the attack type and the anti-DDoS attack mitigation strategy;

[0038] The third transmission module is used for the policy distribution module to transmit the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

[0039] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0040] Memory stores computer-executable instructions;

[0041] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0042] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0044] The anti-DDoS attack collaborative mitigation architecture and method provided by the present application include: a feature extraction module, a mitigation strategy generation module, and a strategy distribution module. The feature extraction module is used to respond to the detection of a distributed denial of service DDoS attack, based on the feature fingerprints corresponding to each level of network space in the multi-level network space, extract the target traffic fingerprint of the corresponding level network space, and transmit the target traffic fingerprint to the mitigation strategy generation module. The multi-level network space includes an access network, an intra-domain network, and an inter-domain network; by extracting the target traffic fingerprint of the corresponding level network space according to the feature fingerprints of the multiple-level network space, the traffic characteristics of the multiple layers can be utilized. The mitigation strategy generation module is used to respond to the target traffic fingerprint, build a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph according to the target traffic fingerprint, and transmit the global anti-DDoS attack mitigation strategy to the strategy distribution module. The anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies; by determining the global anti-DDoS attack mitigation strategy according to the target traffic fingerprint, it is possible to utilize multi-layer traffic features to generate multi-layer DDoS attack mitigation strategies, so as to better defend against DDoa attacks. The strategy distribution module is used to transmit the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy. Transmitting the anti-DDoS attack mitigation strategy to the corresponding level network space improves the defense effect by enabling each level of network space to carry out all-round defense against DDos attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0046] Figure 1 A schematic diagram of the structure of an anti-DDoS attack collaborative architecture provided in an embodiment of the present application;

[0047] Figure 2 A schematic diagram of the structure of an anti-DDoS attack mitigation strategy knowledge graph provided in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of a multi-layer network space provided for this application;

[0049] Figure 4 A flowchart of a collaborative mitigation method for resisting DDoS attacks provided in an embodiment of the present application;

[0050] Figure 5 A flowchart of another anti-DDoS attack collaborative mitigation method provided in an embodiment of the present application;

[0051] Figure 6 A schematic diagram of the structure of the anti-DDoS attack collaborative mitigation device provided in an embodiment of the present application;

[0052] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0053] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0055] At present, with the development of the Internet, DDoS attacks have become a normal threat in the field of network security, and they frequently attack various websites, servers and infrastructure. The current situation of DDoS attacks shows the characteristics of high attack frequency, large scale and diversified means, which brings huge challenges to network security. At present, the enterprise-side attack defense strategy cannot solve the congestion of upstream links; however, although operators have the advantage of link pipelines, due to factors such as the difficulty in coordinating network requirements at different levels and the difficulty in balancing detection costs, the detection and disposal are not sophisticated enough, and the ability to detect new attacks is weak. It is difficult to effectively resist emerging and complex DDoS attack modes by relying solely on unilateral defense technology. There is an urgent need to explore available collaborative defense architectures.

[0056] The present application provides an anti-DDoS attack collaborative mitigation architecture and method. Through the collaboration between modules, a feature extraction module is set up to extract feature fingerprints of network spaces at different levels. A mitigation strategy generation module is set up to determine a global anti-DDoS attack mitigation strategy based on the fingerprint features of the corresponding level of space and the anti-DDoS attack mitigation strategy knowledge graph. The global anti-DDoS attack mitigation strategy can defend against traffic attacks at different levels of network spaces. Finally, a strategy distribution module is set up, and the anti-DDoS attack mitigation strategy can be accurately and timely transmitted to the corresponding level of network space through a collaborative instruction API. Thus, through the feature extraction module, the mitigation strategy generation module, and the strategy distribution module, the traffic features (i.e., feature fingerprints) of each layer of network space can be effectively utilized to achieve global traffic scheduling and disposal, thereby enhancing the defense effect against DDoS attacks.

[0057] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0058] Figure 1 A schematic diagram of a DDoS attack collaborative mitigation architecture provided in an embodiment of the present application. The execution subject can be implemented by software and / or hardware, such as Figure 1 As shown, including:

[0059] The feature extraction module is used to respond to the detection of a distributed denial of service DDoS attack. Based on the feature fingerprints corresponding to each level of the multi-level network space, the module extracts the target traffic fingerprint of the corresponding level of the network space and transmits the target traffic fingerprint to the mitigation strategy generation module. The multi-level network space includes an access network, an intra-domain network, and an inter-domain network.

[0060] A distributed denial of service (DDoS) attack is a malicious attempt to overwhelm a target server, service or network with a large amount of network traffic, making it unable to operate normally. A DDoS attack usually involves the coordinated work of multiple computer systems, which are usually part of a "botnet" infected with malware and remotely controlled by the attacker.

[0061] Access networks represent edge networks or nodes, such as enterprise networks, cloud vendors, etc. Intra-domain networks represent networks with the same jurisdiction, such as backbone networks, metropolitan area networks, etc. Inter-domain networks represent network boundaries and interconnection areas with other networks, such as operator interconnection layers.

[0062] Feature fingerprint: traffic characteristics, including data packet size, transmission time interval, protocol type, traffic pattern, etc.

[0063] The target traffic fingerprints of different levels of network space are different. The target traffic fingerprints include high-order features, medium-order features, and low-order features. Specifically, the inter-domain network corresponds to high-order features, the intra-domain network corresponds to medium-order features, and the access network corresponds to low-order features. See Table 1 for high-order features, Table 2 for medium-order features, and Table 3 for low-order features.

[0064] Table 1

[0065]

[0066] Table 2

[0067]

[0068]

[0069] Table 3

[0070]

[0071] Through traffic fingerprint technology, the distributed denial of service DDoS attack is detected, and then the high-order features corresponding to the inter-domain network, the medium-order features corresponding to the intra-domain network, and the low-order features corresponding to the access network in the traffic attack are identified. The high-order features, low-order features, and medium-order features are then sent to the mitigation strategy generation module.

[0072] The mitigation strategy generation module is used to respond to the receipt of the target traffic fingerprint, build a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmit the global anti-DDoS attack mitigation strategy to the strategy distribution module. The anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies.

[0073] in, Figure 2A structural diagram of an anti-DDoS attack mitigation strategy knowledge graph provided for an embodiment of the present application, wherein SYN Flood characterizes the attack type, and (SYN flood) is a common Denial of Service (DoS) attack, especially an attack on the Transmission Control Protocol (TCP (Transmission Control Protocol)). Its purpose is to consume the resources of the server so that it cannot process legitimate requests. Enabling source authentication policy and abnormal session check is an anti-DDoS attack mitigation strategy. The source authentication policy refers to the cleaning device replying a reset message based on the syn (Synchronize) packet to verify the authenticity of the access source, thereby cleaning abnormal traffic. Abnormal session check refers to: checking the number of messages or connections sent within a certain time period. If it exceeds a certain frequency, it is determined to be abnormal, and the corresponding traffic is cleaned. The feature fingerprint is the traffic size feature, time distribution feature, network boundary feature, routing path feature, and packet feature. Traffic size characteristics and time distribution characteristics belong to high-level characteristics, network boundary characteristics and routing path characteristics belong to medium-level characteristics, packet characteristics belong to low-level characteristics, and attack type, feature fingerprint, and anti-DDoS attack mitigation strategy are connected through edges.

[0074] After receiving the target traffic fingerprint (including high-order features (i.e., traffic size features, time distribution features), mid-order features (network boundary features, routing path features), and low-order features (i.e., packet features)), based on the constructed anti-DDoS attack mitigation strategy knowledge graph, the attack type is determined to be SYN Flood, and then the global anti-DDoS attack mitigation strategy is determined to be to enable source authentication strategy and abnormal session check, and then the global anti-DDoS attack mitigation strategy is transmitted to the policy distribution module.

[0075] In the embodiment of the present application, based on the constructed anti-DDoS attack mitigation strategy knowledge graph, the mitigation strategy generation module is specifically used to:

[0076] Through link correlation search technology, the global anti-DDoS attack mitigation strategy corresponding to the target traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

[0077] Among them, link key search technology usually involves identifying and analyzing key links or nodes in the network to ensure the reliability, performance and security of the network. This technology is of great significance in network design, optimization and troubleshooting.

[0078] After receiving the target traffic fingerprint, the link correlation search technology is started to retrieve the corresponding mitigation strategies of different layers. The target traffic fingerprint corresponding to the traffic characteristics is determined. In this application, the mitigation strategies of different layers are added to the anti-DDoS attack mitigation strategy knowledge graph through the link correlation search technology. The anti-DDoS attack mitigation strategy can be determined through the target traffic fingerprint and the anti-DDoS attack mitigation strategy knowledge graph.

[0079] Specifically, Figure 3 A schematic diagram of a multi-layer network space provided for this application, such as Figure 3 As shown, the inter-domain network is at a high position, the intra-domain network is at a middle position, and the access network is at a low position.

[0080] The inter-domain network is at a high level, and high-level mitigation strategies are implemented at a high level. The high-level mitigation strategies include: ACL (Access Control List), traffic scheduling, etc.

[0081] The intra-domain network is at the median level, and the median mitigation strategy is implemented at the median level. The median mitigation strategy includes: UDP (User Datagram Protocol) current limiting, UDF FLOOD defense strategy, etc. FLOOD usually refers to a denial of service attack (DoS (Denial of Service)), in which the attacker floods the target system or network by sending a large number of requests, making it unable to provide normal services.

[0082] The access network is at a low level, and a low-level mitigation strategy is implemented at a low level. The low-level mitigation strategy includes: more application layer defense strategies are included on the basis of the middle level, such as CNAME (Canonical Name) source authentication strategy, HTTP (Hypertext Transfer Protocol) defense strategy, etc.

[0083] The high, middle and low positions are attack types. The attack traffic scale corresponding to each layer varies from TB (Terabyte) to GB (Gigabyte) to MB (Megabyte) according to the network bandwidth. Secondly, the low position can obtain the corresponding packet information and can handle application layer attacks, personification attacks, and sweep attacks. For large-scale personification or sweep attacks, the high and middle positions are difficult to monitor, and the low position can be monitored but cannot be defended due to limited defense performance. Therefore, according to the target traffic fingerprints of the high, middle and low layers, the anti-DDoS attack mitigation strategy is issued at the high, middle and low positions respectively, and fine handling is carried out layer by layer.

[0084] The advantage of this setting is that it can mitigate attacks at all levels through anti-DDoS attack mitigation strategies, thereby improving the defense effect.

[0085] The policy distribution module is used to transmit the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

[0086] Among them, a collaborative command API (Collaborative Command API) generally refers to an interface that allows collaborative operations between multiple systems, applications or services.

[0087] Through the collaborative command API, a fast and stable communication channel can be established between high, middle and low levels (i.e. different network layers or management levels). Through this channel, the system can quickly distribute the anti-DDoS attack mitigation strategy to the relevant nodes at each level and instruct them to perform corresponding defense operations according to the requirements of the anti-DDoS attack mitigation strategy.

[0088] An anti-DDoS attack collaborative mitigation architecture provided in an embodiment of the present application includes a feature extraction module for extracting target traffic fingerprints of corresponding hierarchical network spaces according to feature fingerprints corresponding to each hierarchical network space in the multi-level network space, a mitigation strategy generation module for generating a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph according to the target traffic fingerprint of the corresponding hierarchical network space, and a strategy distribution module for transmitting the anti-DDoS attack mitigation strategy to the corresponding hierarchical network space through a collaborative instruction API, which can improve the defense capability against new complex network attacks with high intensity and strong confrontation characteristics.

[0089] In the above embodiment of the present application, it also includes:

[0090] The collaborative control module is used to collect and analyze the traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and update the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

[0091] The traffic data information refers to the traffic changes before and after the anti-DDoS attack mitigation strategy is implemented.

[0092] By comparing the traffic changes before and after the implementation of the anti-DDoS attack mitigation strategy, the anti-DDoS attack effect of the corresponding level network space implementing the anti-DDoS attack mitigation strategy is evaluated, and based on the anti-DDoS attack effect, the feature fingerprints and / or anti-DDoS attack mitigation strategy of the corresponding level network space in the anti-DDoS attack mitigation strategy knowledge graph are updated.

[0093] The benefit of this setting is that the collaborative control module can provide a comprehensive and flexible anti-DDoS solution by combining real-time monitoring, dynamic policy adjustment and knowledge updating, which can adapt to the complex and changing network attack environment.

[0094] In the above embodiments of the present application, the collaborative control module is specifically used for:

[0095] Analyze the traffic data information of the hierarchical network space and obtain the traffic curve after the hierarchical network space implements the anti-DDoS attack mitigation strategy. The traffic curve reflects the anti-DDoS attack effect;

[0096] The anti-DDoS attack mitigation strategy knowledge graph is updated according to the anti-DDoS attack effect, including: if the traffic curve contains traffic greater than the traffic threshold, then the correspondence between the anti-DDoS attack mitigation strategy executed in the corresponding hierarchical network space and the target traffic fingerprint of the corresponding hierarchical network space is deleted in the anti-DDoS attack mitigation strategy knowledge graph.

[0097] Among them, the corresponding relationship is Figure 2 For example, the line between the traffic size feature and the SYN Flood.

[0098] According to the traffic data information of the hierarchical network space, the traffic curve of the hierarchical network space is obtained. The traffic curve indicates that when a DDoS attack comes, the traffic will be higher than the normal traffic condition, causing the system to be unusable, and the anti-DDoS attack mitigation strategy is executed. If the anti-DDoS attack mitigation strategy of the hierarchical network space is executed, the traffic of this layer drops below the threshold of the preset value, proving that the anti-DDoS attack mitigation strategy of the hierarchical network space has a certain effect. On the contrary, the anti-DDoS attack mitigation strategy of the hierarchical network space is not effective, and the corresponding relationship between the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space and the target traffic fingerprint of the corresponding hierarchical network space is deleted in the anti-DDoS attack mitigation strategy knowledge graph.

[0099] The benefit of this setup is that through detailed analysis of traffic data, the system can generate a traffic curve that reflects the traffic changes after the implementation of the anti-DDoS strategy. This curve can help identify the effectiveness of the strategy, such as whether it has successfully reduced the attack traffic, and dynamic updates ensure that the knowledge graph always reflects the latest attack patterns and protection measures.

[0100] In the above embodiment of the present application, the feature extraction module is also used for:

[0101] Obtain historical traffic in hierarchical network space, which includes normal traffic and multiple attack traffic;

[0102] Obtain the attack type corresponding to each attack flow in multiple attack flows;

[0103] Determine the contribution of the feature value corresponding to each target feature to each attack type. The target feature is determined by feature engineering technology; the contribution is determined by a preset random forest model;

[0104] According to the corresponding contribution of each target feature, the feature fingerprint corresponding to the hierarchical network space is determined.

[0105] Among them, the contribution represents the importance, that is, which feature values ​​in the target features can better determine the judgment of the attack type.

[0106] The method for obtaining the preset random forest model is as follows: construct a more comprehensive combined feature set, use the initial random forest classifier to train the model, obtain the importance of each feature, select important features of appropriate proportion according to the importance of the features, reduce the feature dimension, and use the selected important features to retrain the initial random forest model to obtain the preset random forest model.

[0107] Feature engineering is a critical step in data science and machine learning that involves extracting, selecting, and transforming features from raw data in order to improve the performance and predictive power of the model.

[0108] By obtaining the historical traffic of the hierarchical network space, the attack type of the attack traffic is manually labeled. Then the attack traffic and normal traffic are clustered, the attack type of the cluster is continuously adjusted, and the contribution of different features in the cluster to the attack type is calculated. The contribution is sorted and processed, and the features with larger contribution are selected as the feature fingerprints corresponding to the hierarchical network space. Among them. Clustering is an unsupervised learning method in data mining and machine learning. Its goal is to divide a set of data objects into multiple groups or clusters, so that objects in the same cluster are more similar in a sense, while objects in different clusters are relatively dissimilar. Cluster analysis is widely used in various fields, such as marketing, image processing, bioinformatics, and social network analysis.

[0109] The benefit of this setting is that by analyzing historical traffic data and obtaining the attack type corresponding to each attack traffic, the system can more accurately identify and classify different attacks. This provides a basis for subsequent defense strategies. The contribution of each target feature to different attack types is evaluated through the preset random forest model. The feature importance evaluation of the random forest model can reveal which features are most important in distinguishing normal traffic from attack traffic.

[0110] In the above embodiment of the present application, the mitigation strategy generation module is also used to:

[0111] Obtaining the first relationship between the characteristic fingerprints of different layers of network space and the attack type, and the second relationship between the attack type and the anti-DDoS attack mitigation strategy of different layers of network space;

[0112] According to the first relationship and the second relationship, an initial anti-DDoS attack mitigation strategy knowledge graph is constructed;

[0113] Based on the initial anti-DDoS attack mitigation strategy knowledge graph, the third relationship between feature fingerprints and anti-DDoS attack mitigation strategies is determined through knowledge reasoning;

[0114] According to the third relationship, the initial anti-DDoS attack mitigation strategy knowledge graph is optimized to obtain the anti-DDoS attack mitigation strategy knowledge graph.

[0115] Among them, knowledge reasoning methods are an important field in artificial intelligence and computer science, involving the derivation of new information or conclusions from known information. Knowledge reasoning methods are widely used in expert systems, natural language processing, semantic web, and intelligent decision support systems.

[0116] The first relationship between the existing feature fingerprints of network spaces at different levels and the attack type, and the second relationship between the attack type and the anti-DDoS attack mitigation strategy of network spaces at different levels are used to construct an initial anti-DDoS attack mitigation strategy knowledge graph. The third relationship between more feature fingerprints and anti-DDoS attack mitigation strategies is discovered through knowledge reasoning methods. The initial anti-DDoS attack mitigation strategy knowledge graph is updated through the third relationship to obtain the anti-DDoS attack mitigation strategy knowledge graph.

[0117] The advantage of this setting is that by combining knowledge graphs and knowledge reasoning technology, it provides an intelligent and dynamic solution for resisting DDoS attacks, which can effectively improve the overall capability of network security protection.

[0118] An anti-DDoS attack collaborative mitigation architecture provided in an embodiment of the present application includes: a feature extraction module, a mitigation strategy generation module, and a strategy distribution module. The feature extraction module can be set to extract the target traffic fingerprint of the corresponding hierarchical network space according to the feature fingerprint corresponding to each hierarchical network space in the multi-level network space, and the mitigation strategy generation module can be set to generate a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph according to the target traffic fingerprint of the corresponding hierarchical network space. The strategy distribution module is set to transmit the anti-DDoS attack mitigation strategy to the corresponding hierarchical network space through a collaborative instruction API. Therefore, the anti-DDoS attack collaborative mitigation architecture can improve the defense capability against new complex network attacks with high intensity and strong confrontation characteristics.

[0119] Figure 4 A flowchart of a collaborative mitigation method for resisting DDOS attacks provided in an embodiment of the present application. Figure 4 As shown, the method includes:

[0120] S401, in response to detecting a distributed denial of service DDoS attack, the feature extraction module extracts a target traffic fingerprint of the corresponding hierarchical network space based on feature fingerprints corresponding to each hierarchical network space in the multi-level network space, and transmits the target traffic fingerprint to the mitigation strategy generation module, wherein the multi-level network space includes an access network, an intra-domain network, and an inter-domain network;

[0121] S402. In response to receiving the target traffic fingerprint, the mitigation strategy generation module constructs a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmits the global anti-DDoS attack mitigation strategy to the strategy distribution module. The anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies.

[0122] In the embodiment of the present application, based on the constructed anti-DDoS attack mitigation strategy knowledge graph, a global anti-DDoS attack mitigation strategy is constructed according to the target traffic fingerprint, including:

[0123] Through link correlation search technology, the global anti-DDoS attack mitigation strategy corresponding to the target traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

[0124] S403, the policy distribution module transmits the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

[0125] In the above embodiment of the present application, it also includes:

[0126] The collaborative control module collects and analyzes the traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and updates the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

[0127] An anti-DDoS attack collaborative mitigation method provided in an embodiment of the present application can extract the target traffic fingerprint of the corresponding hierarchical network space according to the feature fingerprint corresponding to each hierarchical network space in the multi-level network space through a feature extraction module, and the mitigation strategy generation module generates a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph according to the target traffic fingerprint of the corresponding hierarchical network space. The strategy distribution module transmits the anti-DDoS attack mitigation strategy to the corresponding hierarchical network space through a collaborative instruction API, which can improve the defense capability against new complex network attacks with high intensity and strong confrontation characteristics.

[0128] Figure 5 A flowchart of another method for collaboratively mitigating DDoS attacks provided in an embodiment of the present application. Figure 5 As shown, the method includes:

[0129] When the network is attacked, the traffic fingerprint of the attack traffic is accurately extracted from the traffic of each domain. After the extraction is completed, the system will transmit these traffic fingerprints to the multi-layer strategy generation module for the multi-layer network space. The traffic fingerprint of the attack traffic includes: high-order traffic fingerprint features, medium-order traffic fingerprint features, and low-order traffic fingerprint features.

[0130] After receiving traffic fingerprints from various domains, the multi-layer mitigation strategy generation module will start the link association search technology. The corresponding mitigation strategies of different layers are retrieved. Through the mitigation strategy knowledge graph, the corresponding mitigation strategy is searched. Among them, the features, attack categories and mitigation strategies in the mitigation strategy knowledge graph are connected by edges as entities. When we receive the feature vector of the network space, the corresponding mitigation strategy is searched. The mitigation strategy includes the median mitigation strategy, the low-order mitigation strategy and the high-order mitigation strategy. The high-order mitigation strategy corresponds to the high-order mitigation strategy, which specifically includes traffic scheduling and traffic cleaning. The median corresponds to the median mitigation strategy, which specifically includes intelligent filtering and traffic cleaning. The low-order corresponds to the low-order mitigation strategy, which specifically corresponds to traffic blackhole and traffic cleaning.

[0131] The multi-layer mitigation strategy is implemented through the collaborative instruction API (i.e. Figure 4 The collaborative interface in the Kubernetes cluster can establish a fast and stable communication channel between high, medium and low levels (i.e. different network layers or management levels). Through this channel, the system can quickly distribute mitigation strategies to relevant nodes at each level and instruct them to perform corresponding defense operations according to the strategy requirements.

[0132] The evaluation module in the collaborative control center collects and analyzes traffic logs to evaluate the actual effectiveness of the layered strategy. Specifically, if the attack traffic does not reach below the threshold after the traffic log characterization strategy is executed, the knowledge update module in the collaborative control center automatically and dynamically removes its corresponding relationship in the knowledge graph (including the corresponding mitigation strategy and fingerprint of the attack traffic), and allows users to manually update the knowledge graph to ensure the effectiveness and accuracy of the strategy.

[0133] Another collaborative mitigation method against DDoS attacks provided in the embodiment of the present application can cover the end-to-end life cycle of traffic through traffic fingerprints in multi-layer network space, extract feature fingerprints that conform to the network traffic characteristics of the access network, intra-domain, and inter-domain multi-dimensional and multi-level network domains, and improve the precision of network traffic detection. Make up for the problem of single features of traditional detection solutions; based on knowledge graph link retrieval technology, search for targeted mitigation strategies at each layer. Make full use of the advantageous defense means at each layer to conduct full-view defense.

[0134] Figure 6 This is a structural example diagram of the anti-DDoS attack collaborative mitigation device provided in the embodiment of the present application. Figure 6 As shown, the anti-DDoS attack collaborative mitigation device 60 includes: a first transmission module 601, a second transmission module 602, and a third transmission module 603. Among them:

[0135] The first transmission module 601 is used for the feature extraction module to detect a distributed denial of service DDoS attack in response to extracting a target traffic fingerprint of the corresponding hierarchical network space based on the feature fingerprint corresponding to each hierarchical network space in the multi-level network space, and transmitting the target traffic fingerprint to the mitigation strategy generation module, wherein the multi-level network space includes an access network, an intra-domain network, and an inter-domain network;

[0136] The second transmission module 602 is used for the mitigation strategy generation module to respond to receiving the target traffic fingerprint, build a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmit the global anti-DDoS attack mitigation strategy to the strategy distribution module, where the anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between the feature fingerprint, the attack type and the anti-DDoS attack mitigation strategy;

[0137] The third transmission module 603 is used for the policy distribution module to transmit the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

[0138] In the embodiment of the present application, the second transmission module 602 is specifically used for:

[0139] Through link correlation search technology, the global anti-DDoS attack mitigation strategy corresponding to the target traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

[0140] In the embodiment of the present application, the second transmission module 602 is further specifically used for:

[0141] The collaborative control module collects and analyzes the traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and updates the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

[0142] The device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0143] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the processing module can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0144] For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more microprocessors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a module above is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0145] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrations. Available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, Digital Video Discs (DVD)), or semiconductor media (eg, solid state disks (SSD)).

[0146] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 70 includes:

[0147] The electronic device 70 may include a processor 701 with one or more processing cores, a memory 702 with one or more computer-readable storage media, a communication component 703 and other components. The processor 701 , the memory 702 and the communication component 703 are connected via a bus 704 .

[0148] In a specific implementation process, at least one processor 701 executes computer execution instructions stored in the memory 702, so that at least one processor 701 executes the above-mentioned anti-DDoS attack collaborative mitigation method.

[0149] The specific implementation process of the processor 701 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0150] In the above Figure 7In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0151] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk storage.

[0152] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0153] In some embodiments, a computer program product is also proposed, including a computer program or instructions, which, when executed by a processor, implements the steps in any of the above-mentioned anti-DDoS attack collaborative mitigation methods.

[0154] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0155] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0156] To this end, an embodiment of the present application provides a computer-readable storage medium, in which multiple instructions are stored, and the instructions can be loaded by a processor to execute the steps in any one of the anti-DDoS attack collaborative mitigation methods provided in the embodiments of the present application.

[0157] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0158] According to one aspect of the present application, a computer program product or a computer program is provided. The computer program product or the computer program comprises computer instructions stored in a computer-readable storage medium.

[0159] Since the instructions stored in the storage medium can execute the steps in any one of the anti-DDoS attack collaborative mitigation methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any one of the anti-DDoS attack collaborative mitigation methods provided in the embodiments of the present application can be achieved. For details, please refer to the previous embodiments and will not be repeated here.

[0160] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0161] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A collaborative mitigation architecture against DDoS attacks, characterized in that: include: Feature extraction module, mitigation strategy generation module and strategy distribution module, where: The feature extraction module is used to extract the target traffic fingerprint of the corresponding hierarchical network space based on the feature fingerprint corresponding to each hierarchical network space in the multi-level network space in response to detecting a distributed denial of service DDoS attack, and transmit the target traffic fingerprint to the mitigation strategy generation module, wherein the multi-level network space includes an access network, an intra-domain network, and an inter-domain network; The mitigation strategy generation module is used to respond to receiving the target traffic fingerprint, build a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmit the global anti-DDoS attack mitigation strategy to the strategy distribution module, wherein the anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies; The policy distribution module is used to transmit the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

2. The anti-DDoS attack collaborative mitigation architecture according to claim 1, characterized in that: The mitigation strategy generation module is specifically used for: Through the link association search technology, the global anti-DDoS attack mitigation strategy corresponding to the target traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

3. The anti-DDoS attack collaborative mitigation architecture according to claim 1 or 2, characterized in that: Also includes: A collaborative control module is used to collect and analyze traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and update the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

4. The anti-DDoS attack collaborative mitigation architecture according to claim 3, characterized in that: The collaborative control module is specifically used for: Analyze the traffic data information of the hierarchical network space to obtain the traffic curve after the hierarchical network space executes the anti-DDoS attack mitigation strategy, wherein the traffic curve reflects the anti-DDoS attack effect; The updating of the anti-DDoS attack mitigation strategy knowledge graph according to the anti-DDoS attack effect includes: if the traffic curve contains traffic greater than a traffic threshold, deleting the correspondence between the anti-DDoS attack mitigation strategy executed in the corresponding hierarchical network space and the target traffic fingerprint of the corresponding hierarchical network space in the anti-DDoS attack mitigation strategy knowledge graph.

5. The anti-DDoS attack collaborative mitigation architecture according to claim 1 or 2, characterized in that: The feature extraction module is also used for: Acquire historical traffic of a hierarchical network space, where the historical traffic includes normal traffic and multiple attack traffics; Obtaining the attack type corresponding to each attack flow in the multiple attack flows; Determine the contribution of the feature value corresponding to each target feature to each attack type, wherein the target feature is determined by feature engineering technology; and the contribution is determined by a preset random forest model; According to the contribution degree corresponding to each target feature, a feature fingerprint corresponding to the hierarchical network space is determined.

6. The anti-DDoS attack collaborative mitigation architecture according to claim 1 or 2, characterized in that: The mitigation strategy generation module is also used for: Obtaining the first relationship between the characteristic fingerprints of different layers of network space and the attack type, and the second relationship between the attack type and the anti-DDoS attack mitigation strategy of different layers of network space; According to the first relationship and the second relationship, construct an initial anti-DDoS attack mitigation strategy knowledge graph; Based on the initial anti-DDoS attack mitigation strategy knowledge graph, determining a third relationship between the feature fingerprint and the anti-DDoS attack mitigation strategy through knowledge reasoning; According to the third relationship, the initial anti-DDoS attack mitigation strategy knowledge graph is optimized to obtain the anti-DDoS attack mitigation strategy knowledge graph.

7. A collaborative mitigation method against DDoS attacks, characterized in that: Applied to the anti-DDoS attack collaborative mitigation architecture according to any one of claims 1 to 6, the anti-DDoS attack collaborative mitigation method comprises: The feature extraction module, in response to detecting a distributed denial of service DDoS attack, extracts a target traffic fingerprint of the corresponding hierarchical network space based on a feature fingerprint corresponding to each hierarchical network space in the multi-level network space, and transmits the target traffic fingerprint to the mitigation strategy generation module, wherein the multi-level network space includes an access network, an intra-domain network, and an inter-domain network; The mitigation strategy generation module, in response to receiving the target traffic fingerprint, constructs a global anti-DDoS attack mitigation strategy according to the target traffic fingerprint based on the constructed anti-DDoS attack mitigation strategy knowledge graph, and transmits the global anti-DDoS attack mitigation strategy to the strategy distribution module, wherein the anti-DDoS attack mitigation strategy knowledge graph reflects the correspondence between feature fingerprints, attack types and anti-DDoS attack mitigation strategies; The policy distribution module transmits the anti-DDoS attack mitigation strategy to the corresponding level network space through the collaborative instruction API based on the global anti-DDoS attack mitigation strategy.

8. The anti-DDoS attack collaborative mitigation method according to claim 7, characterized in that: The method of constructing a global anti-DDoS attack mitigation strategy based on the constructed anti-DDoS attack mitigation strategy knowledge graph and according to the target traffic fingerprint includes: Through the link association search technology, the global anti-DDoS attack mitigation strategy corresponding to the target traffic fingerprint is searched in the constructed anti-DDoS attack mitigation strategy knowledge graph.

9. The anti-DDoS attack collaborative mitigation method according to claim 7 or 8, characterized in that: Also includes: The collaborative control module collects and analyzes traffic data information of the hierarchical network space to evaluate the anti-DDoS attack effect of the anti-DDoS attack mitigation strategy executed by the corresponding hierarchical network space, and updates the anti-DDoS attack mitigation strategy knowledge graph and / or the feature fingerprint of the corresponding hierarchical network space according to the anti-DDoS attack effect.

10. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 7 to 9.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed, are used to implement the method as described in any one of claims 7 to 9.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed, the method according to any one of claims 7 to 9 is implemented.

Images