Variable speed distributed denial of service attack detection method and device based on dynamic threshold

Abstract

The invention discloses a variable-speed distributed denial of service attack detection method and device based on a dynamic threshold value, and the method comprises the steps: 1) constructing a plurality of common DDoS attack models and tools, and enabling the models and tools to have a variable-speed attack function; 2) establishing a switch system environment, and connecting an attack host, a victim server and a normal user host together through a switch; 3) configuring a message capture program in the switch system, and specifically adopting a phcp tool to carry out flow collection and analysis; 4) setting a flow sliding window, and dividing the flow according to a specific algorithm; 5) calculating an initial threshold value corresponding to each piece of data in the divided data region; (6) relevant parameters are obtained, and the threshold value is corrected according to a specific process; 7) comparing the calculated correction threshold value with the initial threshold value to obtain features, and transmitting the feature data to another detection program through Socket; (8) inputting the real flow, the threshold value and the difference value of the real flow and the threshold value into a machine learning model so as to judge whether the variable-speed DDoS attack occurs or not; and according to an attack detection result, correcting a threshold coefficient, and transmitting a related signal to a defense system, so that the system keeps a dynamic defense state.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a variable speed distributed denial of service attack detection method and device based on a dynamic threshold. Background Art

[0002] In the field of network security, distributed denial of service (DDoS) attacks continue to pose a major threat that is difficult to completely eliminate. With the rapid development of Internet of Things (IoT) technology, hundreds of millions of low-cost IoT devices are connected to the Internet. This trend has not reduced the threat of DDoS attacks, but has provided them with unprecedented attack potential and frequency. Business giants, government agencies, and official websites at the national level have not been spared and have frequently become targets of DDoS attacks, making network security face even more severe challenges.

[0003] In recent years, the scale and complexity of DDoS attacks have increased dramatically, and some extreme cases have attracted widespread attention from the global public opinion. Against this background, variable-speed DDoS attacks have gradually emerged as a more cunning attack method. The core feature of variable-speed DDoS attacks is that their attack speed is not constant, but is dynamically adjusted according to preset strategies or algorithms. This feature greatly increases the difficulty of defense.

[0004] Specifically, variable-speed DDoS attacks can be divided into two main forms: pulse attacks and gradual attacks. In a pulse attack, the attacker sends attack traffic in the form of short pulses, with different intervals and durations between each pulse. This sudden attack mode can quickly consume the resources of the target system and cause service interruptions. Gradual attacks are more covert, with the attack speed gradually increasing, simulating the natural growth trend of normal traffic, attempting to bypass the detection mechanism based on sudden increases in traffic, thereby gradually weakening the defense capabilities of the target system without being noticed.

[0005] As the speed of variable-speed DDoS attacks is constantly changing, traditional defense mechanisms based on constant traffic thresholds are unable to cope with the situation. These mechanisms often have difficulty accurately distinguishing normal traffic from attack traffic, resulting in frequent false positives or false negatives. In order to effectively deal with variable-speed DDoS attacks, defense systems have to frequently adjust and optimize strategies, which undoubtedly increases the complexity and cost of defense. Summary of the invention

[0006] In order to overcome the variable speed DDoS attacks that are difficult to detect with existing static thresholds or fixed behavior strategies, the present invention proposes a locally executed, efficient and dynamic threshold-based variable speed distributed denial of service attack detection method and device.

[0007] The core of the present invention lies in its dynamic adaptability and automated analysis capabilities, which can monitor network traffic in real time and dynamically adjust the detection threshold according to the actual changes in traffic, thereby achieving accurate identification and rapid response to variable-speed DDoS attacks.

[0008] The technical solution adopted by the present invention to solve its technical problem is:

[0009] The present invention relates to a variable speed distributed denial of service attack detection method based on a dynamic threshold, the method comprising the following steps:

[0010] (1) Build a variety of common DDoS attack models and tools, and enable them to carry out variable-speed attacks;

[0011] (2) Build a switch system environment and connect the attack host, victim server, and normal user host through the switch;

[0012] (3) Configure the packet capture program in the switch system, specifically using the phcp tool to collect and analyze traffic;

[0013] (4) Set a traffic sliding window and divide the traffic according to a specific algorithm;

[0014] (5) Calculate the initial threshold value corresponding to each data in the divided data area;

[0015] (6) Obtain relevant parameters and modify the thresholds according to a specific process;

[0016] (7) Compare the calculated modified threshold with the initial threshold to obtain features, and transmit the feature data to another detection program through Socket;

[0017] (8) In the detection program, the real traffic, threshold and their difference are input into the machine learning model to determine whether a variable-speed DDoS attack occurs. According to the attack detection results, the threshold coefficient is corrected and the relevant signal is transmitted to the defense system to keep the system in a dynamic defense state.

[0018] Further, step 1 specifically includes:

[0019] In the Linux system environment, by elevating system permissions, using tools such as hping, iperf, SlowHTTPTest, LOIC, and HOIC to simulate DDoS attacks, and writing corresponding scripts to achieve variable-speed sending, thereby simulating the behavior of variable-speed DDoS attacks.

[0020] Further, the process of arranging the detection environment described in step 2 is as follows:

[0021] like Figure 2As shown in the figure, the attacker uses a high-performance laptop to carry out the attack. The laptop is equipped with an AMD Ryzen 75800H processor, 16GB of memory, a 1.5TB hard disk, and runs an operating system based on Kali Linux 2022.3. In terms of normal users, this experiment simulates three users, using three Raspberry Pi 4Bs respectively. Each Raspberry Pi 4B is equipped with an ARM Cortex-A72 processor, 1GB of memory, and a 32GB hard disk. The router in the network topology uses an ordinary gigabit router, while the victim server and other servers are ordinary host simulations, running Windows 10 and CentOS 7 operating systems respectively, equipped with an Intel(R) i5-6400 processor, 8GB of memory, and a 500GB hard disk. The switch is a key component. The message capture system, message parsing system, and detection system are all deployed on the switch. Its configuration parameters directly affect the computing performance of the entire system. The processor uses a relatively old model and the memory capacity is limited to 4GB.

[0022] Further, the setting of the flow sliding window in step 3 specifically includes:

[0023] After using phcp to capture traffic data, especially in DDoS attack scenarios, hundreds of thousands of packets may be generated per second. Therefore, multi-threading technology must be used for efficient packet capture, such as Figure 3 As shown. In order to effectively process this large amount of data, it is necessary to use a two-way queue, one end of which is responsible for capturing messages, and the other end is responsible for processing messages. Multithreading is also used at the end of processing messages (message parsing) to ensure that the system can run efficiently under low latency. Considering that the CPU used in the present invention is a quad-core processor, in order to maximize the use of processor resources, the present invention uses three threads in the message capture stage and the same number of threads in the message processing stage. Such a design is intended to improve the utilization of the CPU so that the system can capture and process messages more effectively. At the same time, the present invention reserves redundant thread performance for real-time detection to ensure the stability and performance of the system. The setting of the specific number of threads can be adjusted according to the actual environment and processor performance to achieve optimal system performance and resource utilization.

[0024] Further, the sliding window setting in step 4 specifically includes:

[0025] Sliding window is one of the key steps in generating time series features. The selection of its window size greatly affects the accuracy of time series features. The formula is shown in (1). In the formula, V is the current traffic rate, and the "Maximum Transmission Unit" refers to the maximum amount of data that each data packet can carry in network communication. Finally, the window size is rounded. Since the maximum transmission unit is generally 1500, some corrections are made to the formula, subtracting one item, so that the sliding window can obtain a relatively stable value in different situations.

[0026]

[0027] Furthermore, the calculation of the threshold corresponding to each data in step 5 specifically includes:

[0028] When the sliding window slides forward (the sliding window is set to 1 second), the above time series features (Table 1) will be continuously generated. Then, the present invention calculates the mean and variance of a series of time series features according to formulas (2) and (3). k,j represents the kth feature at the jth second, μ k,n represents the mean of the kth feature at the nth second, σ k,n Represents the variance of the kth feature at the nth second. The sum of the calculated mean and variance is set as the initial threshold.

[0029] Table 1 Timing characteristics

[0030]

[0031]

[0032] Furthermore, the correction threshold in step 6 specifically includes:

[0033] On the basis of obtaining the initial threshold, this step needs to obtain the parameters λ and θ, the initial values ​​of λ and θ are 1 and 0.5, and the new values ​​will be obtained after the system runs once. The threshold calculation method is T = (μ + σ) α. If the mean of the current interval is more than 2λ times that of the previous interval (previous sliding window), the α value increases by θ; otherwise, the α value decreases by θ, but is not less than 1. This process is performed in all sliding windows, and this algorithm is executed for all initial thresholds.

[0034] Further, step 7 specifically includes:

[0035] In order to achieve low-latency, high-efficiency data transmission and ensure the consistency of features in different language environments, the present invention uses Socket to transmit the data processed by the C language framework to the Python environment. Taking the features of each sliding window as a unit, the 7 initial thresholds, the modified thresholds and their differences are transmitted as features to the machine learning detection program.

[0036] Further, step 8 specifically includes:

[0037] Step 81: Input the features extracted in the previous step into a pre-trained machine learning model for detection, and the model outputs correction parameters λ and θ. The correction parameters λ and θ also represent the degree of variable speed DDoS.

[0038] Step 82, transmitting the modified parameters λ and θ to a defense system (such as a firewall or a traditional threshold defense program) so as to dynamically adjust the threshold for defense according to the attack severity.

[0039] The second aspect of the present invention relates to a variable speed distributed denial of service attack detection device based on a dynamic threshold, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the variable speed distributed denial of service attack detection method based on a dynamic threshold of the present invention.

[0040] The working principle of the present invention is: in the Linux system of the switch, the present invention uses Phcp library files and multi-threaded queues to capture and process network traffic data. Subsequently, based on a specific time sliding window mechanism, the present invention extracts time series features from the captured traffic data. When the sliding window generates a series of time series features, their mean and variance are further obtained and used as the initial threshold. Then, the present invention compares the mean of the current cycle with the mean of the previous cycle, combines the correction parameters and the preset algorithm, and iteratively corrects the initial threshold to obtain the corrected threshold. Finally, the initial threshold, the corrected threshold and their difference are used as input features and fed into the machine learning model to evaluate the degree to which the network is attacked by DDoS. This degree indicator can not only serve as a reference for correcting the threshold, but also assist the defense system in adjusting and optimizing the dynamic defense strategy.

[0041] The advantages of the present invention are as follows: since the attack traffic of variable-speed DDoS attacks presents dynamic changing characteristics, traditional detection methods based on fixed thresholds are difficult to effectively deal with. The present invention calculates various characteristic indicators within the window through a carefully designed time sliding window mechanism. The detection threshold is dynamically adjusted according to the changing trend of the feature mean and variance between different windows. At the same time, machine learning technology is introduced to iteratively optimize the correction parameters. This method can not only dynamically update the threshold according to the data of the new window, but also fine-tune the correction parameters through a machine learning algorithm, thereby effectively resisting variable-speed DDoS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flow chart of the method of the present invention.

[0043] Figure 2 It is a schematic diagram of the system environment network topology of the present invention.

[0044] Figure 3 It is a schematic diagram of the process capture and processing process of the present invention.

[0045] Figure 4 It is a schematic diagram of the device of the present invention. DETAILED DESCRIPTION

[0046] The present invention will be further described below in conjunction with the accompanying drawings.

[0047] Example 1

[0048] Reference Figure 1 to Figure 3 This embodiment relates to a variable speed distributed denial of service attack detection method based on a dynamic threshold, comprising the following steps:

[0049] (1) Build a variety of common DDoS attack models and tools, and enable them to carry out variable-speed attacks;

[0050] (2) Build a switch system environment and connect the attack host, victim server, and normal user host through the switch;

[0051] (3) Configure the packet capture program in the switch system, specifically using the phcp tool to collect and analyze traffic;

[0052] (4) Set a traffic sliding window and divide the traffic according to a specific algorithm;

[0053] (5) Calculate the initial threshold value corresponding to each data in the divided data area;

[0054] (6) Obtain relevant parameters and modify the thresholds according to a specific process;

[0055] (7) Compare the calculated modified threshold with the initial threshold to obtain features, and transmit the feature data to another detection program through Socket;

[0056] (8) In the detection program, the real traffic, threshold and their difference are input into the machine learning model to determine whether a variable-speed DDoS attack occurs. According to the attack detection results, the threshold coefficient is corrected and the relevant signal is transmitted to the defense system to keep the system in a dynamic defense state.

[0057] Step 1 specifically includes: in a Linux system environment, by improving system permissions, using tools such as hping, iperf, SlowHTTPTest, LOIC, and HOIC to simulate DDoS attacks, and writing corresponding scripts to achieve variable-speed sending, thereby simulating the behavior of variable-speed DDoS attacks.

[0058] The process of setting up the detection environment described in step 2 is as follows: Figure 2 As shown in the figure, the attacker uses a high-performance laptop to attack. The laptop is equipped with an AMD Ryzen 7 5800H processor, 16GB of memory, a 1.5TB hard disk, and runs an operating system based on Kali Linux 2022.3. In terms of normal users, this experiment simulates three users, using three Raspberry Pi 4Bs respectively. Each Raspberry Pi 4B is equipped with an ARM Cortex-A72 processor, 1GB of memory, and a 32GB hard disk. The router in the network topology uses an ordinary gigabit router, while the victim server and other servers are ordinary host simulations, running Windows 10 and CentOS 7 operating systems respectively, equipped with an Intel (R) i5-6400 processor, 8GB of memory, and a 500GB hard disk. The switch is a key component. The message capture system, message parsing system, and detection system are all deployed on the switch. Its configuration parameters directly affect the computing performance of the entire system. The processor uses a relatively old model and the memory capacity is limited to 4GB.

[0059] The flow sliding window setting described in step 3 specifically includes: After using Phcp to capture flow data, especially in the DDoS attack scenario, hundreds of thousands of data packets may be generated per second. Therefore, multi-threading technology must be used for efficient packet capture, such as Figure 3As shown. In order to effectively process this large amount of data, it is necessary to use a two-way queue, one end of which is responsible for capturing messages, and the other end is responsible for processing messages. Multithreading is also used at the end of processing messages (message parsing) to ensure that the system can run efficiently under low latency. Considering that the CPU used in the present invention is a quad-core processor, in order to maximize the use of processor resources, the present invention uses three threads in the message capture stage and the same number of threads in the message processing stage. Such a design is intended to improve the utilization of the CPU so that the system can capture and process messages more effectively. At the same time, the present invention reserves redundant thread performance for real-time detection to ensure the stability and performance of the system. The setting of the specific number of threads can be adjusted according to the actual environment and processor performance to achieve optimal system performance and resource utilization.

[0060] The sliding window setting described in step 4 specifically includes: the sliding window is one of the key steps in generating the timing features, and the selection of its window size greatly affects the accuracy of the timing features, as shown in formula (1). Wherein V is the current traffic rate, and the "maximum transmission unit" (Maximum Transmission Unit) refers to the maximum amount of data that each data packet can carry in network communication, and the final window size is rounded. Since the maximum transmission unit is generally 1500, the present invention makes some corrections to the formula, subtracting one item, so that the sliding window can obtain a relatively stable value under different conditions.

[0061]

[0062] The calculation of the threshold corresponding to each data in step 5 specifically includes: when the sliding window slides forward (the sliding window is set to 1 second), the above time series features (Table 1) will be continuously generated, and then the present invention calculates the mean and variance of a series of time series features according to formulas (2) and (3). Where F k,j represents the kth feature at the jth second, μ k,n represents the mean of the kth feature at the nth second, σ k,n Represents the variance of the kth feature at the nth second. The sum of the calculated mean and variance is set as the initial threshold.

[0063] Table 1 Timing characteristics

[0064]

[0065]

[0066] The modified threshold in step 6 specifically includes: based on the initial threshold, this step needs to obtain the parameters λ and θ, the initial values ​​of λ and θ are 1 and 0.5, and the new values ​​will be obtained after the system runs once. The threshold calculation method is T = (μ + σ) α, if the mean of the current interval is more than 2λ times that of the previous interval (previous sliding window), the α value increases by θ; otherwise, the α value decreases by θ, but is not less than 1. This process is performed in all sliding windows, and this algorithm is executed for all initial thresholds.

[0067] Step 7 specifically includes: In order to achieve low-latency, high-efficiency data transmission and ensure the consistency of features in different language environments, the present invention uses Socket to transmit the data processed by the C language framework to the Python environment. Taking the features of each sliding window as a unit, the 7 initial thresholds, the modified thresholds and their differences are transmitted as features to the machine learning detection program.

[0068] Step 8 specifically includes: Step 81, inputting the features extracted in the previous step into a pre-trained machine learning model for detection, and the model outputs correction parameters λ and θ. The correction parameters λ and θ also represent the degree of variable speed DDoS.

[0069] Step 82, transmitting the modified parameters λ and θ to a defense system (such as a firewall or a traditional threshold defense program) so as to dynamically adjust the threshold for defense according to the attack severity.

[0070] Example 2

[0071] Reference Figure 4 This embodiment relates to a variable speed distributed denial of service attack detection device based on a dynamic threshold, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the variable speed distributed denial of service attack detection method based on a dynamic threshold of embodiment 1.

[0072] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A variable speed distributed denial of service attack detection method based on dynamic threshold, comprising the following steps: (1) Build a variety of common DDoS attack models and tools, and enable them to perform variable-speed attacks; (2) Build a switch system environment and connect the attack host, victim server, and normal user host through the switch; (3) Configure the packet capture program in the switch system, specifically using the phcp tool to collect and analyze traffic; (4) Set a traffic sliding window and divide the traffic according to a specific algorithm; (5) Calculate the initial threshold value corresponding to each data in the divided data area; (6) Obtain relevant parameters and modify the thresholds according to a specific process; (7) Compare the calculated modified threshold with the initial threshold to obtain features, and transmit the feature data to another detection program through Socket; (8) In the detection program, the real traffic, threshold value and their difference are input into the machine learning model to determine whether a variable speed DDoS attack occurs; According to the attack detection results, the threshold coefficient is corrected and the relevant signal is transmitted to the defense system to keep the system in a dynamic defense state.

2. The dynamic threshold-based variable speed distributed denial of service attack detection method according to claim 1, characterized in that: Step 1 specifically includes: In the Linux system environment, by elevating system permissions, using tools such as hping, iperf, SlowHTTPTest, LOIC, and HOIC to simulate DDoS attacks, and writing corresponding scripts to achieve variable-speed sending, thereby simulating the behavior of variable-speed DDoS attacks.

3. The variable speed distributed denial of service attack detection method based on dynamic threshold as claimed in claim 1, characterized in that: The process of setting up the detection environment described in step 2 is as follows: The attacker used a high-performance laptop to carry out the attack; the laptop is equipped with an AMD Ryzen 7 5800H processor, 16GB of memory, a 1.5TB hard drive, and runs an operating system based on Kali Linux 2022.3; in terms of normal users, three users are simulated, using three Raspberry Pi 4Bs respectively; each Raspberry Pi 4B is equipped with an ARM Cortex-A72 processor, 1GB of memory, and a 32GB hard drive; the router in the network topology uses an ordinary gigabit router, while the victim server and other servers are simulated as ordinary hosts, running Windows 10 and CentOS 7 operating systems respectively, equipped with an Intel(R) i5-6400 processor, 8GB of memory, and a 500GB hard drive; the switch is a key component, and the message capture system, message parsing system, and detection system are all deployed on the switch. Its configuration parameters directly affect the computing performance of the entire system. The processor uses an older model and the memory capacity is limited to 4GB.

4. The dynamic threshold-based variable speed distributed denial of service attack detection method according to claim 1, characterized in that: The flow sliding window setting described in step 3 specifically includes: Multi-threading technology is used for efficient message capture. A two-way queue is used, with one end responsible for message capture and the other end responsible for message processing. Multi-threading is also used at the end of message processing to ensure that the system can run efficiently with low latency. Three threads are used in the message capture stage, and the same number of threads are used in the message processing stage. Excess thread performance is reserved for real-time detection to ensure system stability and performance.

5. The variable speed distributed denial of service attack detection method based on dynamic threshold as claimed in claim 1, characterized in that: The sliding window setting described in step 4 specifically includes: Sliding window is one of the key steps in generating time series features. The selection of window size greatly affects the accuracy of time series features. The formula is shown in (1); Where V is the current traffic rate, and "maximum transmission unit" refers to the maximum amount of data that each data packet can carry in network communication. Finally, the window size is rounded.

6. The dynamic threshold-based variable speed distributed denial of service attack detection method according to claim 1, characterized in that: The calculation of the threshold corresponding to each data in step 5 specifically includes: Step 51, when the sliding window slides forward, time series features are continuously generated, including F 1,i : The number of packets in the sliding window at the i-th second; F 2,i : The number of unique source IP addresses in the sliding window at the i-th second; F 3,i : The ratio of the number of packets to the number of protocols in the sliding window of the i-th second; F 4,i : The ratio of the number of packets to the number of protocols in the sliding window of the i-th second; F 5,i : The number of unique source ports in the sliding window at the i-th second; F 6,i : The ratio of the number of data packets in the sliding window of the i-th second to the transmission rate; F 7,i : The data transmission rate of the sliding window in the i-th second; Step 52, calculating the mean and variance of a series of time series features according to formula (2) and formula (3); Among them, F k,j represents the kth feature at the jth second, μ k,n represents the mean of the kth feature at the nth second, σ k,n Represents the variance of the kth feature at the nth second; the sum of the calculated mean and variance is set as the initial threshold.

7. The variable speed distributed denial of service attack detection method based on dynamic threshold as claimed in claim 1, characterized in that: The correction threshold described in step 6 specifically includes: On the basis of obtaining the initial threshold, obtain the correction parameters λ and θ, the initial values ​​of λ and θ are 1 and 0.5, and the new values ​​will be obtained after the system runs once; the threshold calculation method is T = (μ + σ) α, if the mean of the current interval is more than 2λ times that of the previous interval, the α value increases by θ; otherwise, the α value decreases by θ, but is not less than 1; this process is performed in all sliding windows, and this algorithm is executed for all initial thresholds.

8. The variable speed distributed denial of service attack detection method based on dynamic threshold as claimed in claim 1, characterized in that: Step 7 specifically includes: Socket is used to transmit the data processed by the C language framework to the Python environment; taking the features of each sliding window as the unit, the 7 initial thresholds, the modified thresholds and their differences are transmitted as features to the machine learning detection program.

9. The variable speed distributed denial of service attack detection method based on dynamic threshold as claimed in claim 1, characterized in that: Step 8 specifically includes: Step 81, input the features extracted in the previous step into a pre-trained machine learning model for detection, and the model outputs correction parameters λ and θ; the correction parameters λ and θ also represent the degree of variable speed DDoS; Step 82, transmitting the modified parameters λ and θ to a defense system (such as a firewall or a traditional threshold defense program) so as to dynamically adjust the threshold for defense according to the attack severity.

10. A variable speed distributed denial of service attack detection device based on dynamic threshold, characterized in that: It comprises a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used to implement the variable speed distributed denial of service attack detection method based on dynamic threshold as described in any one of claims 1-9.

Images