Lfa passive defense method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of network attacks, in particular to an LFA passive defense method and device, electronic equipment and a storage medium, wherein the method comprises the following steps: obtaining network topology structure and traffic information of a website to be defended; determining a graph centrality index of each node in the website to be defended based on the network topology structure, so as to determine a key node of the website to be defended according to the graph centrality index of each node; inputting the traffic information, the network topology structure and the key node of the website to be defended into a preset defense model; identifying a network bottleneck in the key node; determining a first target defense action of the network bottleneck; and performing the first target defense action to passively defend. Therefore, the problem that it is time-consuming and labor-consuming to manually establish a backup link or node to defend the LFA is solved; the preset defense model is used to automatically identify a network bottleneck to establish a new node and a link after the LFA occurs, data flow is introduced into the new node and the link, and the risk that the network bottleneck is paralyzed after being attacked is reduced.

Description

Technical Field

[0001] This application relates to the field of network attack technology, and in particular to an LFA passive defense method, device, electronic device and storage medium. Background Technology

[0002] Link-flooding attack (LFA) is a new type of distributed denial-of-service (DDoS) attack. Unlike traditional DDoS attacks, LFA targets network links rather than the servers themselves. This attack causes congestion by attacking the main entry and exit links of a server cluster, preventing the servers from responding to requests from legitimate users. A key characteristic of LFA is that it uses low-rate traffic, which resembles legitimate traffic, making it difficult to defend against using traditional methods that detect fake addresses and specific signatures.

[0003] Network topology can lead to an over-concentration of data flow on certain nodes and links. These network bottlenecks are the primary targets of LFA attacks because once attacked, they can disrupt the normal transmission of large amounts of data. In short, LFA attacks achieve their objectives by exploiting weaknesses in the network topology, namely critical links and nodes. Once these critical points are compromised, they become potential problem areas for network transmission.

[0004] Related technologies for defending against LFA (Local Fatal Attacks) can be mainly divided into two types: passive defense and active defense. Passive defense focuses on detecting LFAs and addressing network bottlenecks that cause congestion. The primary method is to manually establish new temporary links. For example, temporarily adding links after network congestion can alleviate link congestion caused by LFAs; or suspicious links can be inferred from traffic information, and temporary links will be activated when traffic reaches a threshold. These models innovate in link detection but suffer from the drawbacks of passive defense: they have a certain degree of lag and require real-time detection and manual construction. Active defense focuses on hiding, predicting, and redirecting network bottlenecks. It first identifies the network bottleneck and then establishes a virtual topology to hide it, inducing false attacks. Its drawback is that active defense has limited complexity in hiding topologies, and a few deployed nodes can become new network bottlenecks. Summary of the Invention

[0005] This application provides a passive defense method, apparatus, electronic device, and storage medium for LFA (Local Fatal Attack) to solve the problem of time-consuming and labor-intensive manual establishment of backup links or nodes for LFA defense. This application can automatically identify network bottlenecks and establish new nodes and links after an LFA attack using a preset defense model, directing data flow to the new nodes and links to quickly resist attacks and reduce the risk of network paralysis after a bottleneck attack. A first aspect of this application provides an LFA passive defense method, including the following steps:

[0006] Obtain the network topology and traffic information of the website to be defended;

[0007] Based on the network topology, determine the graph centrality index of each node in the website to be defended, and determine the key nodes of the website to be defended based on the graph centrality index of each node.

[0008] The traffic information, network topology, and key nodes of the website to be defended are input into a preset defense model. The network bottlenecks in the key nodes are identified, and the first target defense action of the network bottleneck is determined. Passive defense is then carried out based on the first target defense action.

[0009] Optionally, in some embodiments, before inputting the traffic information, network topology, and key nodes into a preset defense model, the following steps are included:

[0010] Obtain the network topology and defense link information of at least one test website;

[0011] LFA simulated attacks were conducted on each test network to determine the network bottleneck of each test network. A state space was established based on the network topology and network bottleneck of each test network, and an action space was established based on the defense link information of each test network.

[0012] The preset defense model is obtained by training the initial neural network model based on the state space and the action space.

[0013] Optionally, in some embodiments, after training the initial neural network model based on the state space and the action space to obtain the preset defense model, the method further includes:

[0014] The preset defense model is updated using a preset reward function, wherein the preset reward function is:

[0015]

[0016] ;

[0017] ;

[0018] in, To improve resilience after updating the link Resistance to updates to the link The difference, To improve resilience after updating the link Resistance to the target The relative difference The preset difference threshold, This is a redundant item. It is a link-guided system.

[0019] Optionally, in some embodiments, after training the initial neural network model based on the state space and the action space to obtain the preset defense model, the method further includes:

[0020] The LFA is simulated to attack the network bottleneck of each test network, and a second target defense action is obtained using a preset defense model. Passive defense is then performed based on the second target defense action to obtain the resistance result.

[0021] Based on the resistance results, determine whether the preset defense model has successfully resisted;

[0022] If the preset defense model fails to resist, the network bottleneck of the test network is re-determined, and a new state space and a new action space are established. The preset defense model is then trained based on the new state space and the new action space until the preset defense model successfully resists.

[0023] Optionally, in some embodiments, the state space is:

[0024] ;

[0025] in, For state space, Indicates the state.

[0026] Optionally, in some embodiments, the action space is:

[0027]

[0028] in, For the action space, For action.

[0029] A second aspect of this application provides an LFA passive defense device, comprising:

[0030] The acquisition module is used to obtain the network topology and traffic information of the website to be defended.

[0031] The determination module is used to determine the graph centrality index of each node in the website to be defended based on the network topology, and to determine the key nodes of the website to be defended based on the graph centrality index of each node.

[0032] The defense module is used to input the traffic information, network topology and key nodes of the website to be defended into a preset defense model, identify network bottlenecks in the key nodes, determine the first target defense action of the network bottleneck, and perform passive defense according to the first target defense action.

[0033] Optionally, in some embodiments, before inputting the traffic information, network topology, and key nodes into a preset defense model, the acquisition module includes:

[0034] The acquisition unit is used to acquire the network topology and defense link information of at least one test website.

[0035] The testing unit is used to conduct LFA simulated attacks on each test network to determine the network bottleneck of each test network, establish a state space based on the network topology of each test network and the network bottleneck of each test network, and establish an action space based on the defense link information of each test network.

[0036] A unit is established to train an initial neural network model based on the state space and the action space to obtain the preset defense model.

[0037] Optionally, in some embodiments, after training the initial neural network model based on the state space and the action space to obtain the preset defense model, the establishment module further includes:

[0038] An update unit is used to update the preset defense model using a preset reward function, wherein the preset reward function is:

[0039]

[0040] ;

[0041] ;

[0042] in, To improve resilience after updating the link Resistance to updates to the link The difference, To improve resilience after updating the link Resistance to the target The relative difference The preset difference threshold, This is a redundant item. It is a link-guided system.

[0043] Optionally, in some embodiments, after training the initial neural network model based on the state space and the action space to obtain the preset defense model, the establishment unit further includes:

[0044] The simulation subunit is used to simulate LFA attacking the network bottleneck of each test network, and to obtain the second target defense action using a preset defense model, and to perform passive defense based on the second target defense action to obtain the resistance result.

[0045] The judgment subunit is used to determine whether the preset defense model has successfully resisted based on the resistance result;

[0046] The training subunit is used to redetermine the network bottleneck of the test network when the preset defense model fails to resist, and to establish a new state space and a new action space. The preset defense model is then trained based on the new state space and the new action space until the preset defense model successfully resists.

[0047] Optionally, in some embodiments, the state space is:

[0048] ;

[0049] in, For state space, Indicates the state.

[0050] Optionally, in some embodiments, the action space is:

[0051]

[0052] in, For the action space, For action.

[0053] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the LFA passive defense method as described in the above embodiments.

[0054] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the LFA passive defense method as described in the above embodiments.

[0055] Therefore, by acquiring the network topology and traffic information of the website to be defended, the graph centrality index of each node in the website is determined based on the network topology. This index is then used to identify critical nodes within the website. The traffic information, network topology, and critical nodes are then input into a pre-defined defense model to identify network bottlenecks within these critical nodes and determine the first-target defense action for these bottlenecks. This passive defense action is then executed. This solves the problem of the time-consuming and labor-intensive process of manually establishing backup links or nodes to defend against LFA (Local Fatal Attack). This application can automatically identify network bottlenecks and establish new nodes and links after an LFA occurs through a pre-defined defense model, directing data flow to these new nodes and links to quickly resist attacks and reduce the risk of network paralysis after a bottleneck attack.

[0056] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0057] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0058] Figure 1 This is a flowchart of the LFA passive defense method provided according to an embodiment of this application;

[0059] Figure 2 This is a schematic diagram illustrating the principle of an LFA passive defense method according to an embodiment of this application;

[0060] Figure 3 This is a block diagram of an LFA passive defense device provided according to an embodiment of this application;

[0061] Figure 4 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0062] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0063] The following describes, with reference to the accompanying drawings, an LFA passive defense method, apparatus, electronic device, and storage medium according to embodiments of this application. Addressing the time-consuming and labor-intensive problem of manually establishing backup links or nodes to defend against LFA, as mentioned in the background art, this application provides an LFA passive defense method. In this method, the network topology and traffic information of the website to be defended are obtained. Based on the network topology, the graph centrality index of each node in the website to be defended is determined. Based on the graph centrality index of each node, key nodes of the website to be defended are identified. The traffic information, network topology, and key nodes of the website to be defended are input into a preset defense model to identify network bottlenecks in the key nodes and determine the first target defense action for the network bottleneck. The first target defense action is then executed for passive defense. This solves the problem of the time-consuming and labor-intensive problem of manually establishing backup links or nodes to defend against LFA. This application can automatically identify network bottlenecks and establish new nodes and links after an LFA occurs through a preset defense model, introducing data flow into the new nodes and links to quickly resist attacks and reduce the risk of network paralysis after a bottleneck attack.

[0064] Specifically, Figure 1 This is a flowchart illustrating an LFA passive defense method provided in an embodiment of this application.

[0065] like Figure 1 As shown, the LFA passive defense method includes the following steps:

[0066] In step S101, the network topology and traffic information of the website to be defended are obtained.

[0067] Specifically, embodiments of this application can obtain information about the website to be defended, including the network topology and traffic information of the website to be defended, so as to determine the number and location of alternative paths based on the network topology and traffic information, and allocate the optimal forwarding path for data packets.

[0068] In step S102, the graph centrality index of each node in the website to be defended is determined according to the network topology, and the key nodes of the website to be defended are determined according to the graph centrality index of each node.

[0069] Graph centrality is a concept used in social network analysis to measure how close a node or person is to the center of the network.

[0070] It is understood that by understanding the centrality of a node, the embodiments of this application can determine the importance of the central node (person) in the network, thereby better understanding the network structure and node behavior. Similar to social networks, network topology is also composed of nodes and edges; therefore, the concept of graph centrality in social networks is equally applicable to the analysis of node importance in network topology. The embodiments of this application can rank nodes by importance by analyzing the graph centrality indices of different nodes in the network topology, thus identifying important nodes, i.e., key nodes.

[0071] It is understood that the embodiments of this application can identify key nodes in the network by analyzing the graph centrality index of each node in the website to be defended. The high graph centrality index of these key nodes indicates that they play an important role in the network, and these key nodes are often potential network bottlenecks. In step S103, the traffic information, network topology, and key nodes of the website to be defended are input into a preset defense model to identify network bottlenecks among the key nodes, determine the first target defense action for the network bottleneck, and perform passive defense based on the first target defense action.

[0072] The preset defense model is a neural network trained using deep reinforcement learning. The preset defense model can identify network bottlenecks in key nodes based on the input data and determine the best defense action for the network bottlenecks.

[0073] Specifically, by analyzing the network topology and traffic data of the website to be defended, this application embodiment can identify key nodes in the network. These nodes have high graph centrality indices, indicating that they play an important role in the network. These key nodes are often potential network bottlenecks. This information is input into a preset defense model. After the preset defense model detects an attack, it automatically identifies network bottlenecks in the key nodes and establishes new nodes and links, introducing data flow into the new nodes and links to quickly resist the attack and reduce the risk of network bottlenecks being paralyzed after being attacked.

[0074] Optionally, in some embodiments, before inputting traffic information, network topology, and network bottlenecks into a preset defense model, the process includes: acquiring the network topology and defense link information of at least one test website; conducting LFA simulated attacks on each test network to determine the network bottleneck of each test network; establishing a state space based on the network topology and network bottleneck of each test website; and establishing an action space based on the defense link information of each test website; and training an initial neural network model based on the state space and action space to obtain a preset defense model.

[0075] It is understood that the embodiments of this application can establish a preset defense model to determine the defense action through the preset defense model, without the need to manually establish new links, thus achieving high defense efficiency.

[0076] Specifically, the network topology and defense link information of at least one test website are obtained. The defense link information consists of known links artificially established to counter LFA attacks. Then, an LFA attack is performed on the test website to obtain the traffic information of nodes and links. This information is analyzed, and network bottlenecks are determined based on graph centrality indicators. After this, the embodiments of this application can deploy new links around these network bottlenecks. If the determination cannot be accurate, it may be due to insufficient data volume. In this case, an LFA attack can be performed again to increase the data volume and then the determination can be made again.

[0077] Then, in this embodiment of the application, the topological characteristics of the test network and the analyzed bottleneck information are regarded as states, and all states form a state space. The state space S is represented as:

[0078]

[0079] in, Indicates the number of input state parameters. It indicates a specific state (such as topology information).

[0080] Analyze known manually established links to counter LFA attacks, extract the link establishment methods, and set all establishment methods as the action space. The agent selects actions based on the generated classification probability vectors. Action Space It is expressed as follows:

[0081]

[0082] in, Indicates the number of actions, Indicates a specific action.

[0083] Optionally, in some embodiments, after training the initial neural network model according to the state space and action space to obtain the preset defense model, the method further includes: updating the preset defense model using a preset reward function, wherein the preset reward function is:

[0084] ;

[0085] in, To improve resilience after updating the link Resistance to updates to the link The difference, To improve resilience after updating the link Resistance to the target The relative difference This is a redundant item. It is a link-guided system.

[0086] Understandably, for a network bottleneck, the agent needs to quickly establish new links while effectively avoiding the significant waste caused by redundancy. Therefore, the reward function in this embodiment is divided into two parts:

[0087] Redundancy terms: Redundancy terms are established based on the Gaussian distribution, taking into account the resilience after establishing a new link. and previous resistance The difference in resistance between the two , A smaller value indicates a higher degree of link redundancy, resulting in greater penalties or rewards. Redundancy is determined by a function. The formula is described below:

[0088]

[0089] Link guidance term: To enable agents to quickly establish new links while minimizing redundancy, the formula for the link guidance term is as follows:

[0090]

[0091] The symbol represents when When the value inside is greater than 0, the function outputs the normal value; otherwise, the output is 0. Indicates current resistance Resistance to the target The relative difference, and The preset difference threshold, The value needs to be adjusted according to the actual working environment.

[0092] The reward function formula, which combines redundancy terms and link guidance terms, is as follows:

[0093]

[0094] When an agent takes action, it selects an action from the action space to execute. The environment state provides feedback on the agent's actions based on the reward function. The agent's actions also change the state space, leading to state transitions.

[0095] After setting the parameters above, perform deep learning to train the initial neural network model. Once the model is stable, attack the network bottlenecks. If it can resist, proceed to the next step; if it cannot resist, reset the state space to the initial state, adjust the reward function parameters appropriately, and perform deep learning again.

[0096] Optionally, in some embodiments, after training the initial neural network model according to the state space and action space to obtain the preset defense model, the method further includes: simulating LFA to attack the network bottleneck of each test network, obtaining a second target defense action using the preset defense model, and performing passive defense according to the second target defense action to obtain a resistance result; determining whether the preset defense model has successfully resisted based on the resistance result; if the preset defense model fails to resist successfully, then redetermining the network bottleneck of the test network, establishing a new state space and a new action space, and training the preset defense model according to the new state space and the new action space until the preset defense model successfully resists.

[0097] Specifically, in combination Figure 2 As shown, with the preset defense model derived from deep learning, this embodiment of the application can repeat the LFA attack to observe whether it can resist the attack. If it can, it means that the model against the LFA attack has been established and perfected, and the next step can be carried out. If it cannot resist, it means that the judgment of the network bottleneck is incorrect or not comprehensive enough. The LFA attack will be repeated, and the traffic of each node and link in the network topology structure during the LFA attack will be collected. Combined with historical attack data, the network bottleneck will be judged again based on the graph centrality index.

[0098] It should be noted that the method used in this application embodiment to detect whether the preset defense model has successfully resisted the attack is to perform a certain amount of user input before the attack and to perform user input again after the attack. If the result remains basically unchanged, it indicates successful resistance; if there is significant user congestion, it indicates resistance failure. Here, the LFA attacks selected are all historical attacks, and the network topology is the structure of the website that needs to be protected. Therefore, the link designed based on this to resist LFA attacks has strong practical applicability.

[0099] Next, this application embodiment will input more types of LFA attacks to observe whether the model can resist them. If it can, the model will be put into practical application; if not, the LFA attack will be repeated mechanically in the previous operation to update the model.

[0100] In summary, this application adopts a passive defense approach. When a website is attacked, this application can automatically identify network bottlenecks and establish new nodes and links to form backup links through a preset defense model. Data flow is then appropriately redirected to these backup links, reducing the risk of network paralysis after a bottleneck attack and preventing unexpected disruptions to the website's normal operation. Many related technologies involve manually establishing backup links and nodes, which is time-consuming and labor-intensive. In contrast, this application can introduce deep reinforcement learning to train a neural network model to obtain a preset defense model. This model determines the number and location of alternative paths based on the current topology's traffic conditions, allocating the optimal forwarding path for data packets.

[0101] Therefore, the embodiments of this application have the following beneficial effects:

[0102] (1) Low economic cost: The pre-set defense model can be used continuously after training, saving costs.

[0103] (2) Low labor cost: Only the known alternative paths need to be manually input for machine learning, and the subsequent work can be completed by the preset defense model.

[0104] (3) 24 / 7 detection coverage: The machine learning model can operate 24 / 7 to defend against attacks at any time.

[0105] The passive LFA defense method proposed in this application obtains the network topology and traffic information of the website to be defended, determines the graph centrality index of each node in the website based on the network topology, identifies key nodes in the website based on the graph centrality index of each node, and inputs the traffic information, network topology, and key nodes of the website to be defended into a preset defense model to identify network bottlenecks in the key nodes and determine the first target defense action for the network bottleneck, and executes the first target defense action for passive defense. This solves the problem of the time-consuming and labor-intensive nature of manually establishing backup links or nodes to defend against LFA. This application can automatically identify network bottlenecks and establish new nodes and links after an LFA occurs through a preset defense model, introduce data flow into the new nodes and links, quickly resist attacks, and reduce the risk of network paralysis after a bottleneck attack.

[0106] Next, the LFA passive defense device proposed according to the embodiments of this application is described with reference to the accompanying drawings.

[0107] Figure 3 This is a block diagram of the LFA passive defense device according to an embodiment of this application.

[0108] like Figure 3 As shown, the LFA passive defense device 10 includes: an acquisition module 100, a determination module 200, and a defense module 300.

[0109] The acquisition module 100 is used to acquire the network topology and traffic information of the website to be defended.

[0110] The determination module 200 is used to determine the graph centrality index of each node in the website to be defended based on the network topology, and to determine the key nodes of the website to be defended based on the graph centrality index of each node.

[0111] The defense module 300 is used to input the traffic information, network topology and key nodes of the website to be defended into the preset defense model, identify the network bottlenecks in the key nodes, determine the first target defense action of the network bottleneck, and perform passive defense according to the first target defense action.

[0112] Optionally, in some embodiments, before inputting traffic information, network topology and key nodes into a preset defense model, the acquisition module 100 includes: an acquisition unit, a testing unit and an establishment unit.

[0113] The acquisition unit is used to acquire the network topology and defense link information of at least one test website.

[0114] The testing unit is used to conduct LFA simulated attacks on each test network to determine the network bottleneck of each test network, establish a state space based on the network topology and network bottleneck of each test network, and establish an action space based on the defense link information of each test network.

[0115] Establish a unit to train the initial neural network model based on the state space and action space to obtain a preset defense model.

[0116] Optionally, in some embodiments, after training the initial neural network model according to the state space and action space to obtain a preset defense model, the establishment module 300 further includes an update unit.

[0117] The update unit is used to update the preset defense model using a preset reward function, wherein the preset reward function is:

[0118]

[0119] ;

[0120] ;

[0121] in, To improve resilience after updating the link Resistance to updates to the link The difference, To improve resilience after updating the link Resistance to the target The relative difference The preset difference threshold, This is a redundant item. It is a link-guided system.

[0122] Optionally, in some embodiments, after training the initial neural network model according to the state space and action space to obtain a preset defense model, the unit is established, which further includes: a simulation subunit, a judgment subunit, and a training subunit.

[0123] The simulation subunit is used to simulate LFA attacking the network bottleneck of each test network, and to obtain the second target defense action using a preset defense model, and to obtain the resistance result by performing passive defense based on the second target defense action.

[0124] The judgment sub-unit is used to determine whether the preset defense model has successfully resisted based on the resistance result.

[0125] The training subunit is used to redetermine the network bottleneck of the test network when the preset defense model fails to resist, and to establish a new state space and a new action space. The preset defense model is then trained based on the new state space and the new action space until the preset defense model successfully resists.

[0126] Optionally, in some embodiments, the state space is:

[0127] ;

[0128] in, For state space, Indicates the state.

[0129] Optionally, in some embodiments, the action space is:

[0130]

[0131] in, For the action space, For action.

[0132] It should be noted that the foregoing explanation of the LFA passive defense method embodiment also applies to the LFA passive defense device of this embodiment, and will not be repeated here.

[0133] The passive LFA defense device proposed in this application obtains the network topology and traffic information of the website to be defended, determines the graph centrality index of each node in the website based on the network topology, identifies key nodes in the website based on the graph centrality index of each node, and inputs the traffic information, network topology, and key nodes of the website to be defended into a preset defense model to identify network bottlenecks in the key nodes and determine the first target defense action for the network bottleneck, and executes the first target defense action for passive defense. This solves the problem of the time-consuming and labor-intensive nature of manually establishing backup links or nodes to defend against LFA. This application can automatically identify network bottlenecks and establish new nodes and links after an LFA occurs through a preset defense model, introduce data flow into the new nodes and links, quickly resist attacks, and reduce the risk of network paralysis after a bottleneck attack.

[0134] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0135] The memory 401, the processor 402, and the computer program stored on the memory 401 and capable of running on the processor 402.

[0136] When processor 402 executes the program, it implements the LFA passive defense method provided in the above embodiments.

[0137] Furthermore, electronic devices also include:

[0138] Communication interface 403 is used for communication between memory 401 and processor 402.

[0139] The memory 401 is used to store computer programs that can run on the processor 402.

[0140] The memory 401 may include high-speed RAM (Random Access Memory) memory, and may also include non-volatile memory, such as at least one disk storage.

[0141] If the memory 401, processor 402, and communication interface 403 are implemented independently, then the communication interface 403, memory 401, and processor 402 can be interconnected via a bus to complete communication between them. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0142] Optionally, in a specific implementation, if the memory 401, processor 402, and communication interface 403 are integrated on a single chip, then the memory 401, processor 402, and communication interface 403 can communicate with each other through an internal interface.

[0143] Processor 402 may be a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of this application.

[0144] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the LFA passive defense method described above.

[0145] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0146] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0147] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0148] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (FPGAs), field-programmable gate arrays (FPGAs), etc.

[0149] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0150] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method of LFA passive defense, characterized in that, The method comprises the following steps: obtaining network topology and traffic information of a website to be defended; determining graph centrality indexes of each node in the website to be defended according to the network topology, and determining a key node of the website to be defended according to the graph centrality indexes of each node; inputting the traffic information, network topology and key node of the website to be defended into a preset defense model, identifying a network bottleneck in the key node, determining a first target defense action of the network bottleneck, and passively defending according to the first target defense action, before the traffic information, network topology and key node are inputted into the preset defense model, the method comprises the following steps: obtaining network topology and defense link information of at least one test website; respectively launching LFA simulation attacks on each test network to determine network bottlenecks of the test networks; establishing a state space based on the network topology of each test website and the network bottlenecks of the test networks; and establishing an action space based on the defense link information of each test website; training an initial neural network model according to the state space and the action space to obtain the preset defense model; after the initial neural network model is trained according to the state space and the action space to obtain the preset defense model, the method further comprises the following steps: updating the preset defense model by using a preset reward function, wherein the preset reward function is: ； ； ； wherein, the resistance capability after updating the link and the resistance capability before updating the link a difference value, the resistance capability after updating the link a relative difference value, the target resistance a preset difference threshold value, a redundancy term, link-oriented.

2. The method of claim 1, wherein, after the initial neural network model is trained according to the state space and the action space to obtain the preset defense model, the method further comprises the following steps: simulating LFA attacks on the network bottlenecks of each test network, obtaining a second target defense action by using the preset defense model, and passively defending according to the second target defense action to obtain a resistance result; judging whether the preset defense model successfully resists according to the resistance result; if the preset defense model fails to successfully resist, the network bottlenecks of the test networks are re-determined, a new state space and a new action space are established, and the preset defense model is trained according to the new state space and the new action space until the preset defense model successfully resists.

3. The method of claim 1, wherein, The state space is: ； wherein is the state space, denotes the state.

4. The method of claim 1, wherein, The action space is: wherein, is an action space, is an action.

5. A LFA passive defense device characterized by, comprising: an obtaining module, configured to obtain network topology and traffic information of a website to be defended; a determining module, configured to determine graph centrality indexes of each node in the website to be defended according to the network topology, and determine a key node of the website to be defended according to the graph centrality indexes of each node; a defense module, configured to input the traffic information, network topology and key node of the website to be defended into a preset defense model, identify a network bottleneck in the key node, determine a first target defense action of the network bottleneck, and passively defend according to the first target defense action, before the traffic information, network topology and key node are inputted into the preset defense model, the defense module comprises: an obtaining unit, configured to obtain network topology and defense link information of at least one test website; an obtaining unit, configured to obtain network topology and defense link information of at least one test website; a test unit configured to determine a network bottleneck of each test network by respectively launching a LFA simulation attack on the test network, to establish a state space based on a network topology of the test network and the network bottleneck of the test network, and to establish an action space based on defense link information of the test network; a building unit configured to train an initial neural network model based on the state space and the action space to obtain the preset defense model; after the initial neural network model is trained based on the state space and the action space to obtain the preset defense model, the defense module further comprises an updating unit configured to update the preset defense model by using a preset reward function, wherein the preset reward function is: ； ； wherein, the resistance capability after updating the link the difference between the resistance capability after updating the link and the resistance capability before updating the link, the resistance capability after updating the link the relative difference between the resistance capability after updating the link and the target resistance, a preset difference threshold value, a redundancy term, link-oriented.

6. An electronic device, comprising: comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement the LFA passive defense method according to any one of claims 1-4.

7. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the LFA passive defense method according to any one of claims 1-4.

Images