A network attack defense method and device based on PID

Abstract

The application relates to the technical field of network security, and discloses a PID-based network attack method and device. When a target network is attacked by DDoS, a PID-based network attack defense system corrects the control parameters of a PID controller through a PID neural network model based on the load characteristics, response characteristics and PID error characteristics of the edge server of the target network, outputs a control signal through the PID controller, and then enables the system to adjust the resource response proportion of the edge server (high protection VIP) according to the influence of the edge server under the DDoS attack, so that the attack flow is transferred. The final purpose is to ensure the service quality of the edge server, so that the acceleration effect of the domain name not attacked is not affected, and the acceleration ability and DDoS resistance of the attacked domain name are reserved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network attack method and device based on PID. BACKGROUND

[0002] PID control is a feedback control system used to control and adjust the operation of a system or process. PID stands for Proportional-Integral-Derivative, which corresponds to the three main components of a controller. These three components work together to adjust the output of the control system in order to make the controlled process as close as possible to the desired state. Network attacks that often occur in networks are Distributed Denial of Service Attacks (DDoS attacks), which are a type of network attack that aims to overload a target system or network by sending a large number of invalid requests or traffic to it, so that the target system cannot function normally or provide services.

[0003] (Content Delivery Network, CDN) is a distributed network service that stores content (such as web pages, images and other static or dynamic resources) on multiple servers located around the world, so that users can obtain the required content from the server closest to them, thereby reducing latency and improving performance. In CDN, DNS (Domain Name System) plays a crucial role. DNS is responsible for resolving the domain name entered by the user into the corresponding IP address, so that the user can access the desired website or content. CDN providers usually provide an accelerated domain suffix, and website administrators modify the canonical name record of their own domain name to point to this accelerated domain suffix to obtain acceleration effect. This accelerated domain suffix will eventually point to the entity that actually provides cache acceleration services, referred to as edge server. CDN providers usually use traffic cleaning, black and white lists, and firewall rules when facing DDoS attacks. In order to prevent important service domain names from being attacked by DDoS attacks and causing the quality of service of the entire system to decline, these service domain names are usually separately divided into edge servers with higher device level specifications, these servers appear in the form of virtual IP in the network, referred to as "high protection VIP", and general edge servers are referred to as "ordinary VIP".

[0004] The related art cannot simultaneously achieve "DDoS resistance, acceleration effect, and cost" under the deployment architecture of the above server. The reasons are as follows: the acceleration effect of the domain name requires that the edge server be widely distributed and as close to the user as possible; the DDoS resistance capability requires high-specification hardware and network bandwidth and as independent resources as possible; and the simultaneous satisfaction of the first two requirements will consume a large resource cost. Therefore, the idea of "DDoS switching" is used to solve the problem by manual attempts: when not attacked by DDoS, the global VIP is used to provide services for the domain name to meet the acceleration requirement; when attacked by DDoS, the high-defense VIP is used to meet the DDoS attack resistance requirement. As shown in FIG. Figure 1 The way of defending DDoS attacks by switching will not only have the delay of manual operation, but also the inaccuracy of manual estimation. In addition, the actual load and performance difference of the edge server are not considered. If the DDoS attack reaches the threshold, but the quality of service of the edge server is not affected, the DDoS switching is not needed to reduce the acceleration quality in this scenario. SUMMARY

[0005] Therefore, the present application provides a PID-based network attack method and device to solve the problem that the way of defending DDoS attacks by switching will not only have the delay of manual operation, but also cannot achieve accurate DDoS attack defense.

[0006] According to a first aspect, the present disclosure provides a PID-based network attack defense method, which comprises:

[0007] In response to the target network being attacked by DDoS, the load characteristics, response characteristics, and PID error characteristics of the edge server of the target network are obtained, and the PID controller generates the PID error characteristics when controlling the resource response ratio of the edge server based on the load characteristics.

[0008] The load characteristics, response characteristics, and PID error characteristics are input into a PID neural network model to obtain an error correction result corresponding to the PID error characteristics, wherein the load characteristics and the response characteristics are sequentially calculated through the input layer, the hidden layer, and the output layer of the PID neural network model to obtain the error correction result.

[0009] Based on the error correction result, a PID control signal output by the PID controller is calculated.

[0010] Based on the PID control signal, the resource response ratio of the edge server is controlled by the PID controller, so that the attack traffic generated by the target network is scheduled to the edge server.

[0011] The PID-based network attack defense method in the embodiments of the present disclosure can correct the control parameters of the PID controller through the PID neural network model based on the load characteristics, response characteristics and PID error characteristics of the edge server of the target network when the target network is attacked by DDoS, and output control signals through the PID controller, so that the system can adjust the resource response ratio of the edge server (high defense VIP) according to the influence of the edge server under DDoS attack, and then divert the attack traffic. The ultimate goal is to ensure the quality of service of the edge server, so that the acceleration effect of the domain name not attacked is not affected, and the acceleration ability and anti-DDoS ability of the attacked domain name are reserved.

[0012] In some optional embodiments, the load characteristics include CPU usage, real-time bandwidth, and the response characteristics include memory usage, communication request parameters and communication response parameters.

[0013] In some optional embodiments, the load characteristics and the response characteristics are sequentially calculated through the input layer, the hidden layer and the output layer of the PID neural network model to obtain the error correction result, which is expressed by the following formula:

[0014]

[0015]

[0016] wherein, is the input layer, x(j) is a characteristic parameter composed of the load characteristics, the response characteristics and the PID error characteristics, k is a preset period, is the input parameter of the hidden layer, is the weighting coefficient of the hidden layer, is the output parameter of the hidden layer, is the first activation function, is the output layer, is the weighting coefficient of the output layer, is the output parameter of the output layer, is the second activation function, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction.

[0017] In some optional embodiments, the load characteristics, the response characteristics and the PID error characteristics are input into the PID neural network model to obtain the error correction result corresponding to the PID error characteristics, and the method further comprises:

[0018] obtaining the error correction result corresponding to the PID error characteristics; ​

[0019] calculate a loss value between the error correction result and an expected true value label corresponding to the PID error feature, and update network parameters of the PID neural network model;

[0020] The PID neural network model is trained in an iterative loop until a preset number of training times is reached to end the training, and an error correction result corresponding to the PID error feature is obtained.

[0021] In some optional embodiments, a loss value between the error correction result and a true value label corresponding to the PID error feature is calculated by the following formula, and network parameters of the PID neural network model are updated:

[0022]

[0023] wherein Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is a preset period.

[0024] In some optional embodiments, the PID neural network model is trained in a loop by the following formula until a preset number of training times is reached to end the training, and an error correction result corresponding to the PID error feature is obtained:

[0025]

[0026] wherein is an iterative increment of the weighting coefficient of the output layer, k is a preset period, k-1 is a previous preset period adjacent to the preset period, Loss(k) is the loss value, η is a learning rate, and α is an additional inertia coefficient.

[0027] In some optional embodiments, a PID control signal output by a PID controller is calculated based on the error correction result by the following formula:

[0028]

[0029] wherein u(k) is the PID control signal output by the PID controller, K p is the first control parameter after error correction, K i is the second control parameter after error correction, K d is the third control parameter after error correction, e(k) is the PID error feature in a preset period, e(k) is the PID error feature accumulated in n preset periods, and e(k-1) is the PID error feature in a previous preset period adjacent to the preset period.

[0030] According to a second aspect, the embodiments of the present disclosure provide a PID-based network attack defense device, which comprises:

[0031] characteristics of the edge server of the target network in response to the target network being attacked by a DDoS attack, the PID error characteristics generated when the PID controller controls the resource response ratio of the edge server based on the load characteristics, and the response characteristics;

[0032] a model construction module configured to input the load characteristics, the response characteristics, and the PID error characteristics into a PID neural network model to obtain an error correction result corresponding to the PID error characteristics, wherein the load characteristics and the response characteristics are sequentially calculated through an input layer, a hidden layer, and an output layer of the PID neural network model to obtain the error correction result;

[0033] a signal calculation module configured to calculate a PID control signal output by the PID controller based on the error correction result;

[0034] a flow scheduling module configured to control the resource response ratio of the edge server by the PID controller based on the PID control signal, so that the attack flow generated by the target network is scheduled to the edge server.

[0035] According to a third aspect, an embodiment of the present disclosure provides a computer device, comprising:

[0036] a memory and a processor, which are communicatively connected to each other, and the memory stores computer instructions, and the processor executes the computer instructions to perform the PID-based network attack defense method in the first aspect or any of the implementation manners of the first aspect.

[0037] According to a fourth aspect, an embodiment of the present disclosure provides a computer readable storage medium, which stores computer instructions, and the computer instructions are used to make a computer execute the PID-based network attack defense method in the first aspect or any of the implementation manners of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0039] Figure 1 is a DDoS attack switching schematic diagram according to an embodiment of the present application;

[0040] Figure 2 is a flow schematic diagram of the PID-based network attack defense method according to an embodiment of the present application;

[0041] Figure 3 This is a schematic diagram of the PID control of the BP neural network model according to an embodiment of the present invention;

[0042] Figure 4 This is a structural block diagram of a BP neural network model according to an embodiment of the present invention;

[0043] Figure 5 This is a schematic diagram outlining the overall process of the PID-based network attack defense method according to an embodiment of the present invention;

[0044] Figure 6 This is a structural block diagram of a PID-based network attack defense device according to an embodiment of the present invention;

[0045] Figure 7 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] According to an embodiment of the present invention, a network attack defense method based on PID is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0048] This embodiment provides a PID-based network attack defense method, applicable to devices such as mobile phones, tablets, desktop computers, laptops, and servers. Figure 2 This is a flowchart of a PID-based network attack defense method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0049] Step S201: In response to a DDoS attack on the target network, the load characteristics, response characteristics, and PID error characteristics of the edge servers of the target network are obtained. The PID controller generates PID error characteristics when controlling the resource response ratio of the edge servers based on the load characteristics.

[0050] In a specific example, load characteristics include CPU utilization and real-time bandwidth, while response characteristics include memory utilization, communication request parameters, and communication response parameters.

[0051] Specifically, the load characteristics of the target network's edge servers include CPU utilization and bandwidth. Response characteristics include communication request parameters (SYN packet bps), communication response parameters (ACK packet bps), and memory utilization. PID error characteristics are generated when controlling the resource response ratio of the edge servers based on load characteristics. The edge servers are pre-configured with high-defense VIPs for corresponding domain names according to business rules, and the edge servers identify DDoS attack events through DPDK.

[0052] Furthermore, the target network is a website or IP address currently under DDoS attack. When the target network is overloaded by a large number of invalid requests or traffic, thus hindering its normal operation or service provision, edge servers (VIP protection) are needed to meet the DDoS attack protection requirements. In this DDoS attack protection scenario, the load characteristics, response characteristics, and PID error characteristics of the target network's edge servers are obtained. Specifically, before implementing DDoS attack protection on the edge servers, the expected values ​​for the edge server's load and response characteristics are pre-configured.

[0053] Step S202: Input the load characteristics, response characteristics and PID error characteristics into the PID neural network model to obtain the error correction result corresponding to the PID error characteristics. The load characteristics and response characteristics are calculated sequentially through the input layer, hidden layer and output layer of the PID neural network model to obtain the error correction result.

[0054] Specifically, such as Figure 3 As shown, the load characteristic is represented by x, the response characteristic by c, and the PID error characteristic by e. By simultaneously inputting the load characteristic x, the response characteristic c, and the PID error characteristic e into the PID neural network model, the error correction result corresponding to the PID error characteristic is obtained. This error correction result includes: the first control parameter K of the PID controller. p The second control parameter K after error correction i The third control parameter K after error correction d .

[0055] Furthermore, the PID neural network model in this embodiment is a fully connected neural network model, also known as a backpropagation neural network model, or simply a BP neural network model. Figure 4 As shown, the BP neural network model includes an input layer, hidden layers, and an output layer. Figure 4The BP neural network model in the example can adopt a 5-5-3 structure, where the number of nodes in the input layer is 5, the number of nodes in the hidden layer is 5, and the number of nodes in the output layer is 3.

[0056] Specifically, the PID neural network model corrects the PID controller parameters in real time; that is, during the adjustment process of the PID controller, the PID parameter K is adjusted in real time. p ,K i ,K d Make corrections.

[0057] Step S203: Based on the error correction results, calculate the PID control signal output by the PID controller.

[0058] In a specific example, the PID control signal output by the PID controller is calculated based on the error correction result using the following formula;

[0059]

[0060] Where u(k) is the PID control signal output by the PID controller, and K p K is the first control parameter after error correction. i K is the second control parameter after error correction. d Here, e(k) is the third control parameter after error correction, e(k) is the PID error characteristic within a preset period, e(k) is the accumulated PID error characteristic within n preset periods, and e(k-1) is the PID error characteristic of the previous preset period adjacent to the preset period. The PID error characteristic is the error value obtained by subtracting the actual characteristic value from the expected characteristic value of the edge server.

[0061] exist Figure 3 In the process, the PID-based network attack defense system continuously collects the load characteristic values ​​of the edge server and reports them to the PID controller. As the actual load characteristics are adjusted to be closer to the expected values, the error e begins to approach 0, the control signal u(k) tends to stabilize, and the PID-based network attack defense system begins to be in a dynamic equilibrium state.

[0062] Step S204: Based on the PID control signal, the resource response ratio of the edge server is controlled by the PID controller so that the attack traffic generated by the target network is scheduled to the edge server.

[0063] Specifically, the PID-based network attack defense system modifies the response ratio of the edge servers (high-defense VIPs) for accelerated domain names through the DNS domain name resolution system based on the specific value of the control signal u(k) output by the PID controller. The larger the u(k) value, the greater the weight of the high-defense VIP in responding, until only the high-defense VIP responds. As the response ratio of the high-defense VIP increases, attack traffic is diverted to the high-defense VIP, reducing the load consumption of ordinary VIPs.

[0064] like Figure 5 The diagram shown is a general overview of the PID-based network attack defense method. The PID-based network attack defense method in this embodiment is applicable to domains using global VIP services under normal conditions. When the target network suffers a DDoS attack, it ensures the domain has attack resistance capabilities, reducing the possibility of edge servers becoming unresponsive or even crashing. The PID-based network attack defense method in this embodiment is also applicable to scenarios where other types of attacks cause increased server load, requiring traffic scheduling and load balancing.

[0065] Therefore, the PID-based network attack defense method in this embodiment, when the target network is under DDoS attack, uses the load characteristics, response characteristics, and PID error characteristics of the target network's edge servers. It then uses a PID neural network model to correct the control parameters of the PID controller and outputs a control signal through the PID controller. This allows the system to adjust the resource response ratio of the edge servers (VIP protection) according to the impact of the DDoS attack, thereby diverting attack traffic. The ultimate goal is to ensure the service quality of the edge servers, so that the acceleration effect of unattacked domains is not affected, while preserving the acceleration and DDoS protection capabilities of attacked domains.

[0066] In some optional implementations, the load characteristics and response characteristics are sequentially calculated through the input layer, hidden layer, and output layer of the PID neural network model to obtain the error correction result, which is expressed by the following formula:

[0067]

[0068] get

[0069] in, For the input layer, x(j) represents the feature parameters composed of load characteristics, response characteristics, and PID error characteristics, and k is the preset period. These are the input parameters for the hidden layer. These are the weighting coefficients for the hidden layers. These are the output parameters of the hidden layer. As the first activation function, For output layer, These are the weighting coefficients for the output layer. For the output parameters of the output layer, K is the second activation function. p K is the first control parameter after error correction. i K is the second control parameter after error correction. d This is the third control parameter after error correction.

[0070] In the above formula, the first activation function is a variant of Sigmoid called tanh, which is also the activation function of the hidden layer. The parameter value of x is the input parameter of the hidden layer. Since the control parameters of a PID controller cannot be negative, when the control parameters of a PID controller are negative, the sigmoid function is used as the activation function. The second activation function is the output layer activation function.

[0071] The PID-based network attack defense method in this embodiment adopts a composite structure of PID control algorithm and BP neural network, using tanh as the hidden layer activation function and sigmoid as the output layer activation function. Gradient descent method is used to train and tune the PID control parameters to obtain a more accurate PID neural network model for resisting DDoS attacks.

[0072] In some optional implementations, step S203 above, which involves inputting load characteristics, response characteristics, and PID error characteristics into the PID neural network model to obtain the error correction result corresponding to the PID error characteristics, further includes:

[0073] Step a1: Obtain the error correction results corresponding to the PID error characteristics.

[0074] Specifically, the error correction result corresponding to the PID error characteristics includes the first control parameter K of the PID controller. p Second control parameter K i and the third control parameter K d .

[0075] Step a2: Calculate the loss value between the error correction result and the expected true value label corresponding to the PID error feature, and update the network parameters of the PID neural network model.

[0076] In a specific example, the loss value between the error correction result and the true value label corresponding to the PID error feature is calculated using the following formula, and the network parameters of the PID neural network model are updated.

[0077]

[0078] Where Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is the preset period.

[0079] Step a3: Iteratively train the PID neural network model until the preset number of training iterations is reached, and then the training ends to obtain the error correction results corresponding to the PID error characteristics.

[0080] In a specific example, the PID neural network model is trained iteratively using the following formula until the preset number of training iterations is reached, and the error correction result corresponding to the PID error characteristics is obtained.

[0081]

[0082] in, η is the iterative increment of the weighting coefficients of the output layer, k is the preset period, k-1 is the previous preset period adjacent to the preset period, Loss(k) is the loss value, η is the learning rate, and α is the additional inertia coefficient.

[0083] We derive that:

[0084]

[0085] Based on the incremental digital PID control algorithm:

[0086] u(k) = u(k-1) + Δu(k)

[0087] Δu(k)=K p (e(k)-e(k-1))+K i e(k)+K d (e(k)-2e(k-1)+e(k-2))

[0088] have to:

[0089]

[0090] and,

[0091]

[0092] The learning algorithm for the weighting coefficients of the output layer can be derived as follows:

[0093]

[0094]

[0095] In the formula, g'(·)=g(x)(1-g(x))

[0096] Similarly, the learning algorithm for calculating the weighting coefficients of the hidden layers is as follows:

[0097]

[0098]

[0099] In the formula, f'(·) = 1 - f(x) 2 Δu(k) is the incremental signal of the PID control signal output by the PID controller, u(k-1) is the PID control signal output by the PID controller in the previous preset period adjacent to the preset period, η is the learning rate, α is the inertia coefficient and 0<α<1, and the explanations of other parameters have been explained above and will not be repeated here.

[0100] This embodiment also provides a PID-based network attack defense device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0101] This embodiment provides a network attack defense device based on PID, such as Figure 6 As shown, it includes:

[0102] The feature acquisition module 61 is used to acquire the load characteristics, response characteristics and PID error characteristics of the edge server of the target network in response to a DDoS attack on the target network. The PID controller generates PID error characteristics when controlling the resource response ratio of the edge server based on the load characteristics.

[0103] The model building module 62 is used to input load characteristics, response characteristics and PID error characteristics into the PID neural network model to obtain the error correction results corresponding to the PID error characteristics. The load characteristics and response characteristics are calculated sequentially through the input layer, hidden layer and output layer of the PID neural network model to obtain the error correction results.

[0104] The signal calculation module 63 is used to calculate the PID control signal output by the PID controller based on the error correction result.

[0105] The traffic scheduling module 64 is used to control the resource response ratio of the edge server based on the PID control signal through the PID controller, so that the attack traffic generated by the target network is scheduled to the edge server.

[0106] In some optional implementations, load characteristics include CPU utilization and real-time bandwidth, and response characteristics include memory utilization, communication request parameters, and communication response parameters.

[0107] In some optional implementations, the load characteristics and response characteristics are sequentially calculated through the input layer, hidden layer, and output layer of the PID neural network model to obtain the error correction result, which is expressed by the following formula:

[0108]

[0109]

[0110]

[0111] get

[0112] in, For the input layer, x(j) represents the feature parameters composed of load characteristics, response characteristics, and PID error characteristics, and k is the preset period. These are the input parameters for the hidden layer. These are the weighting coefficients for the hidden layers. These are the output parameters of the hidden layer. As the first activation function, For output layer, These are the weighting coefficients for the output layer. For the output parameters of the output layer, K is the second activation function. p K is the first control parameter after error correction. i K is the second control parameter after error correction. d This is the third control parameter after error correction.

[0113] In some alternative implementations, model building module 62 further includes:

[0114] The acquisition submodule is used to obtain the error correction results corresponding to the PID error characteristics;

[0115] The calculation submodule is used to calculate the loss value between the error correction result and the expected true value label corresponding to the PID error characteristics, and to update the network parameters of the PID neural network model.

[0116] The iterative submodule is used to iteratively train the PID neural network model until the preset number of training iterations is reached, and then the error correction results corresponding to the PID error characteristics are obtained.

[0117] In some optional implementations, the loss value between the error correction result and the true value label corresponding to the PID error feature is calculated using the following formula, and the network parameters of the PID neural network model are updated.

[0118]

[0119] Where Loss(k) is the loss value, r(k) is the expected true value label corresponding to the PID error feature, y(k) is the output result corresponding to the PID neural network model, and k is the preset period.

[0120] In some optional implementations, the PID neural network model is trained iteratively using the following formula until a preset number of training iterations are reached, thereby obtaining the error correction results corresponding to the PID error characteristics.

[0121]

[0122] in, η is the iterative increment of the weighting coefficients of the output layer, k is the preset period, k-1 is the previous preset period adjacent to the preset period, Loss(k) is the loss value, η is the learning rate, and α is the additional inertia coefficient.

[0123] In some alternative implementations, the PID control signal output by the PID controller is calculated based on the error correction result using the following formula;

[0124]

[0125] Where u(k) is the PID control signal output by the PID controller, and K p K is the first control parameter after error correction. i K is the second control parameter after error correction. d The third control parameter after error correction is e(k), which is the PID error characteristic within the preset period, e(k) is the cumulative PID error characteristic within n preset periods, and e(k-1) is the PID error characteristic of the previous preset period adjacent to the preset period.

[0126] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0127] In this embodiment, the PID-based network attack defense device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0128] This invention also provides a computer device having the PID-based network attack defense device described above.

[0129] Please see Figure 7 , Figure 7This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 7 Take a processor 10 as an example.

[0130] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0131] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0132] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0133] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0135] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0136] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A network attack defense method based on PID, characterized in that, The method includes: In response to a DDoS attack on a target network, the system acquires the load characteristics, response characteristics, and PID error characteristics of the edge servers of the target network. The PID controller generates the PID error characteristics when controlling the resource response ratio of the edge servers based on the load characteristics. The edge servers are high-defense virtual IPs with corresponding domain names pre-configured according to business rules. The load characteristics, response characteristics, and PID error characteristics are input into a PID neural network model to obtain the error correction result corresponding to the PID error characteristics. The load characteristics and response characteristics are calculated sequentially through the input layer, hidden layer, and output layer of the PID neural network model to obtain the error correction result. Based on the error correction result, the PID control signal output by the PID controller is calculated; Based on the PID control signal, the resource response ratio of the edge server is controlled by the PID controller so that the attack traffic generated by the target network is scheduled to the edge server.

2. The method according to claim 1, characterized in that, The load characteristics include: CPU utilization and real-time bandwidth; the response characteristics include: memory utilization, communication request parameters, and communication response parameters.

3. The method according to claim 1, characterized in that, The load characteristics and the response characteristics are sequentially processed through the input layer, hidden layer, and output layer of the PID neural network model to obtain the error correction result, which is expressed by the following formula: get , , in, For the input layer, The characteristic parameters are composed of load characteristics, response characteristics, and PID error characteristics. For the preset period, These are the input parameters for the hidden layer. The weighting coefficients of the hidden layer are... The output parameters of the hidden layer are... As the first activation function, For output layer, These are the weighting coefficients for the output layer. The output parameters of the output layer, For the second activation function, This is the first control parameter after error correction. This is the second control parameter after error correction. This is the third control parameter after error correction.

4. The method according to claim 1, characterized in that, The process further includes inputting the load characteristics, the response characteristics, and the PID error characteristics into a PID neural network model to obtain the error correction result corresponding to the PID error characteristics, and also includes: Obtain the error correction results corresponding to the PID error characteristics; Calculate the loss value between the error correction result and the expected true value label corresponding to the PID error feature, and update the network parameters of the PID neural network model; The PID neural network model is trained iteratively until a preset number of training iterations are reached, at which point the training ends and the error correction result corresponding to the PID error feature is obtained.

5. The method according to claim 4, characterized in that, The loss value between the error correction result and the true value label corresponding to the PID error feature is calculated using the following formula, and the network parameters of the PID neural network model are updated accordingly. in, The loss value is... The expected truth label corresponding to the PID error feature. This refers to the output result corresponding to the PID neural network model. This is the preset cycle.

6. The method according to claim 4, characterized in that, The PID neural network model is trained iteratively using the following formula until a preset number of training iterations are reached, thereby obtaining the error correction result corresponding to the PID error feature. in, The iterative increment of the weighting coefficients of the output layer. For the preset period, The previous preset cycle adjacent to the preset cycle. This is the loss value. For learning rate, This is to add an inertia coefficient.

7. The method according to claim 1, characterized in that, The PID control signal output by the PID controller is calculated based on the error correction result using the following formula; in, The PID control signal output by the PID controller. This is the first control parameter after error correction. This is the second control parameter after error correction. This is the third control parameter after error correction. The PID error characteristics within a preset period. for The accumulated PID error characteristics within a preset period, The PID error characteristics are those of the previous preset period adjacent to the preset period.

8. A network attack defense device based on PID, characterized in that, The device includes: The feature acquisition module is used to acquire the load characteristics, response characteristics, and PID error characteristics of the edge server of the target network in response to a DDoS attack on the target network. The PID controller generates the PID error characteristics when controlling the resource response ratio of the edge server based on the load characteristics. The edge server is a high-defense virtual IP with a corresponding domain name pre-configured according to business rules. The model building module is used to input the load characteristics, the response characteristics, and the PID error characteristics into the PID neural network model to obtain the error correction result corresponding to the PID error characteristics. The load characteristics and the response characteristics are calculated sequentially through the input layer, hidden layer, and output layer of the PID neural network model to obtain the error correction result. The signal calculation module is used to calculate the PID control signal output by the PID controller based on the error correction result. The traffic scheduling module is used to control the resource response ratio of the edge server through the PID controller based on the PID control signal, so that the attack traffic generated by the target network is scheduled to the edge server.

9. A computer device, characterized in that, include: A memory and a processor are interconnected, the memory stores computer instructions, and the processor executes the PID-based network attack defense method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the PID-based network attack defense method according to any one of claims 1 to 7.

Images