Network attack method and device based on PID (Proportion Integration Differentiation)

Abstract

The invention relates to the technical field of network security, and discloses a PID (Proportion Integration Differentiation)-based network attack method and device. When a target network is attacked by DDoS (Distributed Denial of Service), a PID-based network attack defense system is used for defending the network attack on the basis of a load feature, a response feature and a PID error feature of an edge server of the target network; error correction is carried out on control parameters of a PID controller through a PID neural network model, and a control signal is output through the PID controller, so that a system can adjust the resource response proportion of an edge server (high-defense VIP) according to the influence condition of DDoS attack on the edge server, thereby transferring attack traffic. And finally, the service quality of the edge server is ensured, so that the acceleration effect of the domain names which are not attacked is not influenced, and meanwhile, the acceleration capability and the DDoS resistance of the attacked domain names are kept.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a PID-based network attack method and device. Background Art

[0002] PID control is a feedback control system used to control and adjust the operation of a system or process. PID stands for proportional-integral-derivative, corresponding to the three main components of the controller. These three components work together to adjust the output of the control system so that the controlled process is as close to the desired state as possible. A common network attack in the network is Distributed Denial of Service Attack (DDoS attack for short). DDoS attack is a network attack that aims to overload the target system or network by sending a large number of invalid requests or traffic to it, causing it to be unable to operate normally or provide services.

[0003] Content Delivery Network (CDN) is a distributed network service that reduces latency and improves performance by storing content (such as web pages, images, and other static or dynamic resources) on multiple servers located around the world so that users can get the content they need from servers that are closer. In CDN, DNS (Domain Name System) plays a vital role. DNS is responsible for resolving the domain name entered by the user into the corresponding IP address, so that the user can access the desired website or content. CDN manufacturers usually provide an acceleration domain name suffix. The website administrator modifies the canonical name record of their own domain name to point to this acceleration domain name suffix to obtain the acceleration effect. This acceleration domain name suffix will eventually point to the entity that actually provides cache acceleration services, which is called the edge server in this article. When facing DDoS attacks, CDN manufacturers usually use rules such as traffic cleaning, blacklists and whitelists, and firewalls. In order to prevent important service domain names from being attacked by DDoS and causing the service quality of the entire system to decline, edge servers with higher equipment level specifications are usually allocated for these service domain names. These servers appear in the form of virtual IPs in the network, which are called "high-defense VIP" in this article, while general edge servers are called "ordinary VIP".

[0004] Related technologies Under the deployment architecture of the above servers, the three elements of "anti-DDoS, acceleration effect, and cost" cannot be achieved at the same time. The reasons are as follows: the acceleration effect of the domain name requires the edge servers to be widely distributed, as close to the users as possible; and the anti-DDoS capability requires high-specification hardware and network bandwidth, and as independent resources as possible; and to meet the first two requirements at the same time will consume a huge amount of resource costs. Therefore, we manually try to solve the problem with the idea of ​​"DDoS switching": when not under DDoS attack, use global VIP to provide services for the domain name to meet the acceleration needs; when under DDoS attack, use high-defense VIP to meet the anti-DDoS attack needs. Figure 1 The method of defending against DDoS attacks by switching will not only cause hysteresis in human operation, but also inaccurate human estimation. In addition, since the load and performance differences of the actual edge servers are not taken into account, if the DDoS attack reaches the threshold, but the service quality of the edge server is not affected, there is no need to perform DDoS switching to reduce the acceleration quality in this scenario. Summary of the invention

[0005] In view of this, the present invention provides a PID-based network attack method and device to solve the problem that the method of defending against DDoS attacks by switching not only has the hysteresis of human operation, but also cannot achieve accurate defense against DDoS attacks.

[0006] According to a first aspect, an embodiment of the present disclosure provides a PID-based network attack defense method, the method comprising:

[0007] In response to a target network being attacked by DDoS, a load characteristic, a response characteristic, and a PID error characteristic of an edge server of the target network are obtained, and a PID controller generates a PID error characteristic when controlling a resource response ratio of the edge server based on the load characteristic;

[0008] The load characteristics, response characteristics and PID error characteristics are input into the PID neural network model to obtain the error correction result corresponding to the PID error characteristics, wherein the load characteristics and response characteristics are calculated in turn through the input layer, hidden layer and output layer of the PID neural network model to obtain the error correction result;

[0009] Based on the error correction result, the PID control signal output by the PID controller is calculated;

[0010] Based on the PID control signal, the resource response ratio of the edge server is controlled by the PID controller so that the attack traffic generated by the target network is dispatched to the edge server.

[0011] The PID-based network attack defense method in the disclosed embodiment, when the target network is attacked by DDoS, the PID-based network attack defense system performs error correction on the control parameters of the PID controller through the PID neural network model based on the load characteristics, response characteristics and PID error characteristics of the edge server of the target network, and outputs a control signal through the PID controller, thereby enabling the system to adjust the resource response ratio of the edge server (high defense VIP) according to the impact of the DDoS attack on the edge server to divert the attack traffic. The ultimate goal is to ensure the service quality of the edge server, so that the acceleration effect of the unattacked domain name is not affected, while retaining the acceleration ability and anti-DDoS ability of the attacked domain name.

[0012] In some optional implementations, the load characteristics include: CPU usage, real-time bandwidth, and the response characteristics include: memory usage, communication request parameters, and communication response parameters.

[0013] In some optional implementations, the load characteristics and the response characteristics are calculated in turn through the input layer, the hidden layer, and the output layer of the PID neural network model to obtain an error correction result, which is expressed by the following formula:

[0014]

[0015] get

[0016] in, is the input layer, x(j) is the characteristic parameter composed of load characteristics, response characteristics and PID error characteristics, k is the preset period, is the input parameter of the hidden layer, is the weight coefficient of the hidden layer, is the output parameter of the hidden layer, is the first activation function, is the output layer, is the output layer weight coefficient, is the output parameter of the output layer, is the second activation function, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction.

[0017] In some optional implementations, the load characteristic, the response characteristic and the PID error characteristic are input into the PID neural network model to obtain an error correction result corresponding to the PID error characteristic, further comprising:

[0018] Obtain the error correction result corresponding to the PID error characteristic;

[0019] Calculate the loss value between the error correction result and the expected true value label corresponding to the PID error feature, and update the network parameters of the PID neural network model;

[0020] The PID neural network model is trained in an iterative cycle until the preset training times are reached and the training is terminated to obtain the error correction result corresponding to the PID error feature.

[0021] In some optional implementations, the loss value between the error correction result and the true value label corresponding to the PID error feature is calculated by the following formula, and the network parameters of the PID neural network model are updated;

[0022]

[0023] Among them, Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is the preset period.

[0024] In some optional implementations, the PID neural network model is trained cyclically by the following formula until a preset number of training times is reached and the training is terminated to obtain an error correction result corresponding to the PID error feature;

[0025]

[0026] in, is the iterative increment of the weighted coefficient of the output layer, k is the preset period, k-1 is the previous preset period adjacent to the preset period, Loss(k) is the loss value, η is the learning rate, and α is the additional inertia coefficient.

[0027] In some optional implementations, the PID control signal output by the PID controller is calculated based on the error correction result by the following formula:

[0028]

[0029] Among them, u(k) is the PID control signal output by the PID controller, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction, e(k) is the PID error characteristic within the preset period, e(k) is the accumulated PID error characteristic within n preset periods, and e(k-1) is the PID error characteristic of the previous preset period adjacent to the preset period.

[0030] According to a second aspect, an embodiment of the present disclosure provides a PID-based network attack defense device, the device comprising:

[0031] A feature acquisition module, used for acquiring a load feature, a response feature, and a PID error feature of an edge server of the target network in response to a DDoS attack on the target network, wherein the PID controller generates a PID error feature when controlling a resource response ratio of the edge server based on the load feature;

[0032] A model building module is used to input load characteristics, response characteristics and PID error characteristics into a PID neural network model to obtain an error correction result corresponding to the PID error characteristics, wherein the load characteristics and the response characteristics are calculated in turn through the input layer, the hidden layer and the output layer of the PID neural network model to obtain the error correction result;

[0033] A signal calculation module, used for calculating a PID control signal output by the PID controller based on an error correction result;

[0034] The traffic scheduling module is used to control the resource response ratio of the edge server through the PID controller based on the PID control signal, so that the attack traffic generated by the target network is scheduled to the edge server.

[0035] According to a third aspect, an embodiment of the present disclosure provides a computer device, including:

[0036] The memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the PID-based network attack defense method in the first aspect or any embodiment of the first aspect by executing the computer instructions.

[0037] According to the fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, on which computer instructions are stored, and the computer instructions are used to enable a computer to execute the PID-based network attack defense method in the first aspect or any implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 is a schematic diagram of DDoS attack switching according to an embodiment of the present invention;

[0040] Figure 2 is a flow chart of a PID-based network attack defense method according to an embodiment of the present invention;

[0041] Figure 3 is a schematic diagram of a PID control diagram of a BP neural network model according to an embodiment of the present invention;

[0042] Figure 4 is a structural block diagram of a BP neural network model according to an embodiment of the present invention;

[0043] Figure 5 It is a schematic diagram of the overall overview of the PID-based network attack defense method according to an embodiment of the present invention;

[0044] Figure 6 is a structural block diagram of a PID-based network attack defense device according to an embodiment of the present invention;

[0045] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0047] According to an embodiment of the present invention, an embodiment of a network attack defense method based on PID is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0048] In this embodiment, a PID-based network attack defense method is provided, such as a mobile phone, a tablet computer, a desktop computer, a portable notebook, a server, etc. Figure 2 is a flow chart of a network attack defense method based on PID according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0049] Step S201, in response to a target network being attacked by DDoS, the load characteristics, response characteristics and PID error characteristics of the edge server of the target network are obtained, and the PID controller generates a PID error characteristic when controlling the resource response ratio of the edge server based on the load characteristics.

[0050] In a specific example, the load characteristics include: CPU usage, real-time bandwidth, and the response characteristics include: memory usage, communication request parameters, and communication response parameters.

[0051] Specifically, the load characteristics of the edge server of the target network include: CPU usage and bandwidth value. The response characteristics include: communication request parameters (SYN packet bps), communication response parameters (ACK packet bps) and memory usage. The PID error characteristics are the characteristics generated when the resource response ratio of the edge server is controlled based on the load characteristics. The edge server is pre-configured with the high-defense VIP of the corresponding domain name according to the business rules, and the edge server identifies anti-DDoS attack events through DPDK.

[0052] Furthermore, the target network is a website or IP address that is being attacked by DDoS. When the target network is overloaded by a large number of invalid requests or traffic, which causes the target network to operate normally or provide services, an edge server (high-defense VIP) is needed to meet the needs of anti-DDoS attacks. In this anti-DDoS attack scenario, the load characteristics, response characteristics and PID error characteristics of the edge server of the target network are obtained. Before the edge server resists DDoS attacks, the expected values ​​of the load characteristics and response characteristics of the edge server are pre-configured.

[0053] Step S202, input the load characteristics, response characteristics and PID error characteristics into the PID neural network model to obtain the error correction result corresponding to the PID error characteristics, wherein the load characteristics and response characteristics are calculated in turn through the input layer, hidden layer and output layer of the PID neural network model to obtain the error correction result.

[0054] Specifically, Figure 3 As shown, the load characteristic is represented by x, the response characteristic is represented by c, and the PID error characteristic is represented by e. The load characteristic x, the response characteristic c and the PID error characteristic e are simultaneously input into the PID neural network model to obtain the error correction result corresponding to the PID error characteristic. The error correction result includes: the first control parameter K of the PID controller p , the second control parameter K after error correction i , the third control parameter K after error correction d .

[0055] Furthermore, the PID neural network model in the embodiment of the present disclosure is a fully connected neural network model, which is also called a back propagation neural network model, i.e., a Backpropagation neural network model, or BP neural network model for short. Figure 4 As shown in Figure 1, the BP neural network model includes an input layer, a hidden layer, and an output layer. Figure 4The BP neural network model in can adopt a 5-5-3 structure, in which the number of nodes in the input layer is 5, the number of nodes in the hidden layer is 5, and the number of nodes in the output layer is 3.

[0056] Specifically, the PID neural network model corrects the PID controller parameters in real time, that is, during the adjustment of the PID controller, the PID parameter K is adjusted in real time. p ,K i ,K d Make corrections.

[0057] Step S203, calculating a PID control signal output by the PID controller based on the error correction result.

[0058] In a specific example, the PID control signal output by the PID controller is calculated based on the error correction result by the following formula;

[0059]

[0060] Among them, u(k) is the PID control signal output by the PID controller, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction, e(k) is the PID error characteristic within the preset period, e(k) is the accumulated PID error characteristic within n preset periods, and e(k-1) is the PID error characteristic of the previous preset period adjacent to the preset period. The PID error characteristic is the error value obtained by subtracting the actual characteristic value from the expected characteristic value of the edge server.

[0061] exist Figure 3 In the figure, the PID-based network attack defense system continuously collects the load characteristic values ​​of the edge server and reports them to the PID controller. Since the actual load characteristics are closer to the expected values ​​after adjustment, the error e begins to approach 0, the control signal u(k) tends to be stable, and the PID-based network attack defense system begins to be in a dynamic equilibrium state.

[0062] Step S204, based on the PID control signal, the resource response ratio of the edge server is controlled by the PID controller, so that the attack traffic generated by the target network is dispatched to the edge server.

[0063] Specifically, the PID-based network attack defense system modifies the response ratio of the edge server (high-defense VIP) of the accelerated domain name through the DNS domain name resolution system according to the specific size of the control signal u(k) value output by the PID controller. The larger the u(k) value, the greater the weight of the high-defense VIP that responds, until only the high-defense VIP is responded. As the response ratio of the high-defense VIP increases, the attack traffic is dispatched to the high-defense VIP, reducing the load consumption of ordinary VIPs.

[0064] like Figure 5 As shown, it is a schematic diagram of the overall overview of the PID-based network attack defense method. The PID-based network attack defense method in the embodiment of the present disclosure is applicable to the domain name using the global VIP service under normal conditions, and ensures that the domain name can resist attacks when the target network is attacked by DDoS, which can reduce the possibility of the edge server being unable to respond or even crashing. The PID-based network attack defense method in the embodiment of the present disclosure is also applicable to scenarios where other types of attacks cause the server load to increase and require traffic scheduling and load balancing.

[0065] Therefore, in the network attack defense method based on PID in the embodiment of the present disclosure, when the target network is attacked by DDoS, the network attack defense system based on PID performs error correction on the control parameters of the PID controller through the PID neural network model based on the load characteristics, response characteristics and PID error characteristics of the edge server of the target network, and outputs a control signal through the PID controller, thereby enabling the system to adjust the resource response ratio of the edge server (high defense VIP) according to the impact of the DDoS attack on the edge server, so as to divert the attack traffic. The ultimate goal is to ensure the service quality of the edge server, so that the acceleration effect of the unattacked domain name is not affected, while retaining the acceleration ability and anti-DDoS ability of the attacked domain name.

[0066] In some optional implementations, the load characteristics and the response characteristics are calculated in turn through the input layer, the hidden layer, and the output layer of the PID neural network model to obtain an error correction result, which is expressed by the following formula:

[0067]

[0068] get

[0069] in, is the input layer, x(j) is the characteristic parameter composed of load characteristics, response characteristics and PID error characteristics, k is the preset period, is the input parameter of the hidden layer, is the weight coefficient of the hidden layer, is the output parameter of the hidden layer, is the first activation function, is the output layer, is the output layer weight coefficient, is the output parameter of the output layer, is the second activation function, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction.

[0070] In the above formula, the first activation function takes the variant of Sigmoid tanh as the activation function, and the first activation function is the hidden layer activation function. The parameter value of x is the input parameter of the hidden layer Since the control parameters of the PID controller cannot be negative, when the control parameters of the PID controller are negative, Sigmoid is used as the activation function. The second activation function is the output layer activation function.

[0071] The PID-based network attack defense method in the embodiment of the present disclosure adopts a composite structure of a PID control algorithm and a BP neural network, uses tanh as a hidden layer activation function, and sigmoid as an output layer activation function, and uses a gradient descent method to train and adjust PID control parameters to obtain a more accurate PID neural network model for resisting DDoS attacks.

[0072] In some optional implementations, the above step S203, inputting the load characteristic, the response characteristic and the PID error characteristic into the PID neural network model to obtain the error correction result corresponding to the PID error characteristic, also includes:

[0073] Step a1, obtaining the error correction result corresponding to the PID error characteristic.

[0074] Specifically, the error correction result corresponding to the PID error feature includes the first control parameter K of the PID controller: p , the second control parameter K i and the third control parameter K d .

[0075] Step a2, calculate the loss value between the error correction result and the expected true value label corresponding to the PID error feature, and update the network parameters of the PID neural network model.

[0076] In a specific example, the loss value between the error correction result and the true value label corresponding to the PID error feature is calculated by the following formula, and the network parameters of the PID neural network model are updated;

[0077]

[0078] Among them, Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is the preset period.

[0079] Step a3, iteratively train the PID neural network model until a preset number of training times is reached and the training is terminated to obtain an error correction result corresponding to the PID error feature.

[0080] In a specific example, the PID neural network model is trained cyclically by the following formula until the preset training times are reached and the training is terminated to obtain the error correction result corresponding to the PID error feature;

[0081]

[0082] in, is the iterative increment of the weighted coefficient of the output layer, k is the preset period, k-1 is the previous preset period adjacent to the preset period, Loss(k) is the loss value, η is the learning rate, and α is the additional inertia coefficient.

[0083] It is deduced that:

[0084]

[0085] According to the incremental digital PID control algorithm:

[0086] u(k)=u(k-1)+Δu(k)

[0087] Δu(k)=K p (e(k)-e(k-1))+K i e(k)+K d (e(k)-2e(k-1)+e(k-2))

[0088] have to:

[0089]

[0090] and,

[0091]

[0092] The learning algorithm for the weighted coefficients of the output layer can be derived as:

[0093]

[0094]

[0095] Where g'(·)=g(x)(1-g(x))

[0096] Similarly, the learning algorithm for finding the weighted coefficients of the hidden layer is:

[0097]

[0098]

[0099] Where f'(·)=1-f(x) 2 Δu(k) is the incremental signal of the PID control signal output by the PID controller, u(k-1) is the PID control signal output by the PID controller in the previous preset cycle adjacent to the preset cycle, η is the learning rate, α is the inertia coefficient and 0<α<1, and the meanings of other parameters have been explained above and will not be repeated here.

[0100] In this embodiment, a PID-based network attack defense device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0101] This embodiment provides a network attack defense device based on PID, such as Figure 6 As shown, including:

[0102] A feature acquisition module 61 is used to acquire a load feature, a response feature, and a PID error feature of an edge server of the target network in response to a DDoS attack on the target network, and a PID error feature is generated when a PID controller controls a resource response ratio of the edge server based on the load feature;

[0103] A model building module 62 is used to input the load characteristics, response characteristics and PID error characteristics into the PID neural network model to obtain an error correction result corresponding to the PID error characteristics, wherein the load characteristics and the response characteristics are calculated in turn through the input layer, the hidden layer and the output layer of the PID neural network model to obtain the error correction result;

[0104] A signal calculation module 63, used for calculating a PID control signal output by the PID controller based on the error correction result;

[0105] The traffic scheduling module 64 is used to control the resource response ratio of the edge server through the PID controller based on the PID control signal, so that the attack traffic generated by the target network is scheduled to the edge server.

[0106] In some optional implementations, the load characteristics include: CPU usage, real-time bandwidth, and the response characteristics include: memory usage, communication request parameters, and communication response parameters.

[0107] In some optional implementations, the load characteristics and the response characteristics are calculated in turn through the input layer, the hidden layer, and the output layer of the PID neural network model to obtain an error correction result, which is expressed by the following formula:

[0108]

[0109]

[0110]

[0111] get

[0112] in, is the input layer, x(j) is the characteristic parameter composed of load characteristics, response characteristics and PID error characteristics, k is the preset period, is the input parameter of the hidden layer, is the weight coefficient of the hidden layer, is the output parameter of the hidden layer, is the first activation function, is the output layer, is the output layer weight coefficient, is the output parameter of the output layer, is the second activation function, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction.

[0113] In some optional implementations, the model building module 62 further includes:

[0114] An acquisition submodule is used to obtain an error correction result corresponding to a PID error characteristic;

[0115] A calculation submodule is used to calculate the loss value between the error correction result and the expected true value label corresponding to the PID error feature, and update the network parameters of the PID neural network model;

[0116] The iterative submodule is used to iteratively train the PID neural network model until the training is terminated after reaching a preset number of training times, and obtain the error correction result corresponding to the PID error feature.

[0117] In some optional implementations, the loss value between the error correction result and the true value label corresponding to the PID error feature is calculated by the following formula, and the network parameters of the PID neural network model are updated;

[0118]

[0119] Among them, Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is the preset period.

[0120] In some optional implementations, the PID neural network model is trained cyclically by the following formula until a preset number of training times is reached and the training is terminated to obtain an error correction result corresponding to the PID error feature;

[0121]

[0122] in, is the iterative increment of the weighted coefficient of the output layer, k is the preset period, k-1 is the previous preset period adjacent to the preset period, Loss(k) is the loss value, η is the learning rate, and α is the additional inertia coefficient.

[0123] In some optional implementations, the PID control signal output by the PID controller is calculated based on the error correction result by the following formula:

[0124]

[0125] Among them, u(k) is the PID control signal output by the PID controller, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction, e(k) is the PID error characteristic within the preset period, e(k) is the accumulated PID error characteristic within n preset periods, and e(k-1) is the PID error characteristic of the previous preset period adjacent to the preset period.

[0126] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0127] The PID-based network attack defense device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0128] An embodiment of the present invention also provides a computer device having the above-mentioned PID-based network attack defense device.

[0129] See also Figure 7 , Figure 7is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0130] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0131] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0132] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0135] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0136] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A PID-based network attack defense method, characterized in that: The method comprises: In response to a target network being attacked by DDoS, a load characteristic, a response characteristic, and a PID error characteristic of an edge server of the target network are obtained, and the PID error characteristic is generated when a PID controller controls a resource response ratio of the edge server based on the load characteristic; Inputting the load characteristic, the response characteristic and the PID error characteristic into a PID neural network model to obtain an error correction result corresponding to the PID error characteristic, wherein the load characteristic and the response characteristic are calculated in sequence through an input layer, a hidden layer and an output layer of the PID neural network model to obtain the error correction result; Based on the error correction result, calculating a PID control signal output by the PID controller; Based on the PID control signal, the resource response ratio of the edge server is controlled by the PID controller so that the attack traffic generated by the target network is dispatched to the edge server.

2. The method according to claim 1, characterized in that The load characteristics include: CPU usage rate and real-time bandwidth, and the response characteristics include: memory usage rate, communication request parameters and communication response parameters.

3. The method according to claim 1, characterized in that The load characteristics and the response characteristics are calculated in turn through the input layer, hidden layer and output layer of the PID neural network model to obtain the error correction result, which is expressed by the following formula: get in, is the input layer, x(j) is the characteristic parameter composed of load characteristics, response characteristics and PID error characteristics, k is the preset period, is the input parameter of the hidden layer, is the weight coefficient of the hidden layer, is the output parameter of the hidden layer, is the first activation function, is the output layer, is the output layer weight coefficient, is the output parameter of the output layer, is the second activation function, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction.

4. The method according to claim 1, characterized in that: Inputting the load characteristic, the response characteristic and the PID error characteristic into a PID neural network model to obtain an error correction result corresponding to the PID error characteristic, further comprising: Obtaining an error correction result corresponding to the PID error characteristic; Calculating the loss value between the error correction result and the expected true value label corresponding to the PID error feature, and updating the network parameters of the PID neural network model; The PID neural network model is trained in an iterative cycle until a preset number of training times is reached and the training is terminated to obtain an error correction result corresponding to the PID error feature.

5. The method according to claim 4, characterized in that The loss value between the error correction result and the true value label corresponding to the PID error feature is calculated by the following formula, and the network parameters of the PID neural network model are updated; Among them, Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is the preset period.

6. The method according to claim 4, characterized in that The PID neural network model is trained cyclically by the following formula until the preset training times are reached and the training is terminated to obtain the error correction result corresponding to the PID error feature; in, is the iterative increment of the weighted coefficient of the output layer, k is the preset period, k-1 is the previous preset period adjacent to the preset period, Loss(k) is the loss value, η is the learning rate, and α is the additional inertia coefficient.

7. The method according to claim 1, characterized in that The PID control signal output by the PID controller is calculated based on the error correction result by the following formula; Wherein, u(k) is the PID control signal output by the PID controller, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction, e(k) is the PID error characteristic within a preset period, e(k) is the PID error characteristic accumulated within n preset periods, and e(k-1) is the PID error characteristic of the previous preset period adjacent to the preset period.

8. A network attack defense device based on PID, characterized in that: The device comprises: A feature acquisition module, configured to acquire a load feature, a response feature, and a PID error feature of an edge server of the target network in response to a DDoS attack on the target network, wherein the PID error feature is generated when a PID controller controls a resource response ratio of the edge server based on the load feature; A model building module, used for inputting the load characteristic, the response characteristic and the PID error characteristic into a PID neural network model to obtain an error correction result corresponding to the PID error characteristic, wherein the load characteristic and the response characteristic are calculated in sequence through an input layer, a hidden layer and an output layer of the PID neural network model to obtain the error correction result; A signal calculation module, used for calculating a PID control signal output by the PID controller based on the error correction result; The traffic scheduling module is used to control the resource response ratio of the edge server through the PID controller based on the PID control signal, so that the attack traffic generated by the target network is scheduled to the edge server.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the PID-based network attack defense method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the PID-based network attack defense method according to any one of claims 1 to 7.

Images