Unmanned aerial vehicle Internet of Things DDoS attack detection method based on neural network

Abstract

The invention relates to the technical field of communication protection, and discloses an unmanned aerial vehicle Internet of Things DDoS attack detection method based on a neural network, the method is used for an unmanned aerial vehicle network, and the method comprises the steps: receiving a data stream with a DDoS attack uploaded by a rechargeable Internet of Things device, detecting the DDoS attack in the data stream based on a preset DDoS attack detection model, and filtering the DDoS attack; the DDoS attack detection model is obtained by training a neural network model. According to the method, the unmanned aerial vehicle is used as a filtering node, the DDoS attack in the data flow is detected and filtered based on the DDoS attack detection model, and the DDoS attack detection model is obtained by training the neural network model, so that the neural network model is continuously optimized and adjusted, the detection precision is improved, and the false alarm rate is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of communication protection technology, and in particular to a method for detecting DDoS attacks on an unmanned aerial vehicle (UAV) Internet of Things (IoT) based on a neural network. Background Art

[0002] With the rapid development of IoT technology, IoT devices have been widely used in many fields such as agriculture and medical treatment, playing an important role as data transmitters. However, since these devices are usually small in size and have limited power in their built-in batteries, they are difficult to meet the requirements of high speed, multi-modality, multi-connection and high energy consumption in future communications. Therefore, how to provide a continuous power supply for IoT devices has become a key issue. Based on existing energy harvesting technology, using solar energy to charge IoT devices has become a widely adopted solution.

[0003] However, with the increase in the number of IoT devices and the expansion of their applications, problems such as weak security, limited computing power, and insufficient standardization have been exposed in the process of wireless data transmission. These problems make IoT devices easily exploited by malicious attackers, thus becoming part of a botnet and launching DDoS (Distributed Denial of Service) attacks on devices in other IoT systems. This attack not only affects the normal function of the target device, but may also cause serious damage to the stable operation of the entire IoT system. Therefore, how to effectively detect and filter DDoS attacks in the IoT system and protect the security and reliability of the system has become a key issue that needs to be solved urgently.

[0004] At present, although there are many methods for detecting and filtering DDoS attacks in IoT systems, these methods still have some significant shortcomings. First, in terms of the deployment of filtering nodes, current methods usually ignore the problem of the scale change of IoT systems. In most cases, filtering nodes are fixedly deployed in specific locations, lacking flexibility and difficult to adapt to the challenges brought by the expansion or contraction of the system scale. Second, in terms of the setting of filtering programs, most existing methods use fixed filtering programs, which are pre-installed in filtering nodes. This method cannot dynamically adjust the filtering strategy according to different types of DDoS attacks, resulting in a significant reduction in the filtering effect of filtering nodes when facing diversified attacks. Finally, in terms of the working mode of filtering nodes, existing methods usually let each filtering node work independently. However, filtering nodes in IoT systems usually have limited computing resources. When facing large-scale DDoS attack traffic, filtering nodes working independently are difficult to cope with and cannot ensure the security of the entire system.

[0005] Therefore, there is an urgent need for a neural network-based drone IoT DDoS attack detection method. Summary of the invention

[0006] The purpose of the present invention is to overcome the deficiencies of the above-mentioned prior art and provide a method for detecting DDoS attacks on the Internet of Things of UAVs based on a neural network, so that the Internet of Things system is free from DDoS attacks.

[0007] To achieve the above object, the technical solution of the present invention is:

[0008] A neural network-based drone Internet of Things DDoS attack detection method for a drone network, the method comprising:

[0009] A data stream with a DDoS attack uploaded from a rechargeable IoT device is received, and the DDoS attack in the data stream is detected and filtered based on a preset DDoS attack detection model; the DDoS attack detection model is obtained by training a neural network model.

[0010] Preferably, the DDoS attack detection model is trained by a neural network model, including:

[0011] Generate several different sets of IoT system environment parameters;

[0012] The generated IoT system environment parameters are used to solve the linear programming model to obtain the DDoS attack detection strategy; the optimization goal of the linear programming model is to minimize the number of drone deployments;

[0013] Constructing a data set based on the generated IoT system environment parameters and according to the DDoS attack detection strategy;

[0014] The data set is used to train a neural network model to obtain a DDoS attack detection model.

[0015] Preferably, the linear programming model includes the following constraints:

[0016] Energy consumption upper limit constraint: The energy consumed by each IoT device in each time slot shall not exceed the sum of the energy collected in the time slot and the available energy at the beginning of the time slot;

[0017] Unique upload constraint: Each rechargeable IoT device can only upload data stream to one drone in each time slot;

[0018] Unique deployment constraint: Each drone can only be deployed at one location, and each location can only have one drone deployed;

[0019] Computing resource constraints: The computing resources consumed by each drone in each time slot must not exceed the maximum value of its available computing resources;

[0020] Traffic balancing constraint: For each type of DDoS attack traffic, the DDoS attack traffic input of each drone in each time slot must be equal to the DDoS attack traffic output.

[0021] Preferably, the DDoS attack detection model takes the IoT system environment parameters uploaded by the rechargeable IoT device as input and outputs a prediction detection strategy, wherein the prediction detection strategy includes a drone deployment strategy, a rechargeable IoT device upload strategy, a VNF configuration strategy, and a VNF execution strategy.

[0022] Preferably, the neural network-based drone IoT DDoS attack detection method further includes:

[0023] The DDoS attack detection model is adjusted, and the adjustment includes one adjustment, and the one adjustment includes:

[0024] Adjust the rechargeable IoT device upload strategy according to the drone deployment strategy:

[0025] If a rechargeable IoT device uploads a DDoS attack to one or more drone deployment locations, the following formula is used to adjust the location uploaded by the rechargeable IoT device:

[0026]

[0027] in, is the channel attenuation value between the rechargeable IoT device i and the location l; is a set of locations where drones are deployed; the rechargeable IoT device i selects the location l that maximizes the formula to upload the data stream.

[0028] Preferably, adjusting the rechargeable IoT device upload strategy according to the drone deployment strategy also includes:

[0029] If a rechargeable IoT device uploads a DDoS attack to multiple locations, and drones are deployed in some locations, the following formula is used to adjust the location where the rechargeable IoT device uploads:

[0030]

[0031] in, Select the upload location for the device in the predicted value; the rechargeable IoT device i selects the location l with the minimum channel attenuation to upload the data stream.

[0032] Preferably, the one-time adjustment further includes:

[0033] Adjusting the VNF execution strategy according to the VNF configuration strategy:

[0034] If the VNF to be executed in the VNF execution strategy is not pre-deployed on the drone, adjusting the VNF execution strategy so that the drone cannot execute the VNF;

[0035] If filtering the DDoS attack according to the VNF execution strategy will cause the upper limit of the drone computing resources to be exceeded, the VNF execution strategy is adjusted using an annealing algorithm.

[0036] Preferably, the adjustment further includes:

[0037] Check the adjusted drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy. If the adjusted drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy cannot meet the traffic balance constraint, deploy a new drone and readjust the drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy.

[0038] Preferably, the drone includes a data receiving antenna, a data storage unit, a data antenna and a processor; the data receiving antenna is responsible for receiving data streams from rechargeable IoT devices; the data storage unit is used to temporarily store DDoS attacks that cannot be immediately filtered locally and route them to other drones through the data antenna; the processor is responsible for deploying and executing VNFs to effectively detect and filter DDoS attacks.

[0039] Preferably, the rechargeable IoT device includes a solar panel, a rechargeable battery, a data acquisition gateway, a data storage unit, a data antenna and a processor; the solar panel is connected to the rechargeable battery and is responsible for providing continuous energy support for the device; the data acquisition gateway is responsible for collecting and generating data streams from the surrounding environment, and the generated data streams are temporarily stored in the data storage unit and sent out through the data antenna after processing; the processor is responsible for managing and allocating computing resources of the device, and calculating and adjusting the traffic of each DDoS attack in real time according to the wireless channel status.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] The present invention uses drones to check device data streams, minimizes the number of deployed unmanned aerial vehicles in multiple time periods to ensure that all DDoS attacks in the filtering system are filtered, optimizes the rechargeable IoT device upload strategy, drone deployment strategy, VNF deployment strategy, VNF execution strategy and drone routing strategy, so that the network can always be in an active defense state and provide lasting security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1The structure diagram of the UAV-assisted rechargeable IoT system;

[0043] Figure 2 Schematic diagram of the grid structure for drone deployment;

[0044] Figure 3 This is the training flow chart of the DDoS attack detection model;

[0045] Figure 4 Flowchart for adjusting the DDoS attack detection model. DETAILED DESCRIPTION

[0046] Example:

[0047] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0048] See also Figure 1 As shown in the figure, it is a structural diagram of the drone-assisted rechargeable IoT system, which mainly includes two parts: IoT devices and drones. The rechargeable IoT devices are responsible for collecting solar energy and sending data streams with DDoS attacks. Figure 2 In the grid shown, the neural network-based drone IoT DDoS attack detection method provided in this embodiment is mainly used in a drone network. The drone is responsible for receiving data streams with DDoS attacks uploaded from rechargeable IoT devices, and detecting and filtering DDoS attacks in the data stream based on a preset DDoS attack detection model; the DDoS attack detection model is obtained by training a neural network model.

[0049] It can be seen that this method uses drones as filtering nodes, and detects and filters DDoS attacks in data streams based on the DDoS attack detection model. Since the DDoS attack detection model is trained by the neural network model, the neural network model not only improves the detection accuracy, but also effectively reduces the false alarm rate through continuous optimization and adjustment. This efficient detection capability enables reliable DDoS attack defense even on edge devices with limited resources, ensuring that resources are fully utilized. In addition, neural networks have strong learning capabilities and can adaptively identify various types of DDoS attacks. Over time, by continuously learning and updating new attack patterns, neural networks can maintain the effectiveness and accuracy of the detection mechanism. This is particularly important for dealing with complex and changing attack methods, so that the network can always be in an active defense state and provide lasting security protection.

[0050] In a specific embodiment, if Figure 3 As shown, the DDoS attack detection model is obtained by training a neural network model, and includes the following steps:

[0051] 310. Generate 10,000 different sets of IoT system environmental parameters;

[0052] 320. Solve a linear programming model using the IoT system environment parameters generated in step 310 to obtain a DDoS attack detection strategy; the optimization goal of the linear programming model is to minimize the number of deployed drones;

[0053] Specifically, the optimization objective of the linear programming model is to minimize the number of drone deployments. The linear programming model contains the following main constraints: energy consumption upper limit constraint, that is, the energy consumed by each IoT device in each time slot shall not exceed the sum of the energy collected in the time slot and the available energy at the beginning of the time slot. Unique upload constraint, that is, each rechargeable IoT device can only upload data flow to one drone in each time slot; unique deployment constraint, that is, each drone can only be deployed in one location, and only one drone can be deployed in each location. Computing resource constraint, that is, the computing resources consumed by each drone in each time slot shall not exceed the maximum value of its available computing resources; traffic balance constraint, that is, for each DDoS attack traffic, the DDoS attack traffic input of each drone in each time slot must be equal to the DDoS attack traffic output to ensure traffic balance.

[0054] 330. Construct a data set based on the generated IoT system environment parameters and according to the DDoS attack detection strategy;

[0055] 340. Use the data set to train a neural network model to obtain a DDoS attack detection model.

[0056] In other words, the DDoS attack detection model is based on the existing environmental parameters and the detection strategy determined by the linear programming model to construct a data set, and then the neural network model is trained using the data set, so that the obtained DDoS attack detection model can accurately reflect the detection strategies in various environments.

[0057] After the DDoS attack detection model is trained, the IoT system environment parameters uploaded by the rechargeable IoT device are used as the input of the DDoS attack detection model. In this embodiment, the IoT system environment parameters uploaded by the rechargeable IoT device are as follows:

[0058] (1) The network working time is 5 time slots. The channel state in each time slot remains unchanged, and the channel state changes between time slots. The path loss parameter is 2, and the attenuation coefficients of the LoS channel and NLoS channel are 1 and 20;

[0059] (2) The carrier frequency is 2.4 GHz, the channel bandwidth is 20 MHz, and the noise power is -90 dBm;

[0060] (3) Solar energy modeling based on hidden Markov model;

[0061] (4) The solar panel area of ​​the rechargeable IoT device is 30×30 square centimeters;

[0062] (5) The rechargeable battery capacity of the rechargeable IoT device is 20J;

[0063] (6) The transmit power of a rechargeable IoT device is 43dBm;

[0064] (7) The transmission power of the drone is 30dBm;

[0065] (8) It takes 120 clock cycles for the drone to process 1 bit of data stream.

[0066] The DDoS attack detection model outputs a prediction detection strategy based on the IoT system environment parameters uploaded by the input rechargeable IoT device. The prediction detection strategy includes a drone deployment strategy, an IoT device upload strategy, a VNF (Virtual Network Function) configuration strategy, and a VNF execution strategy.

[0067] Since the prediction detection strategy output by the DDoS attack detection model may not meet the constraints of the linear programming model, it needs to be adjusted, such as Figure 4 As shown, the adjustment includes one adjustment:

[0068] Adjust the rechargeable IoT device upload strategy based on the drone deployment strategy:

[0069] If a rechargeable IoT device uploads a DDoS attack to one or more drone deployment locations, the following formula is used to adjust the location l uploaded by the rechargeable IoT device * :

[0070]

[0071] in, is the channel attenuation value between the rechargeable IoT device i and the location l; is a set of locations where drones are deployed; the rechargeable IoT device i selects the location l that maximizes the formula to upload the data stream.

[0072] In an optional embodiment, adjusting the rechargeable IoT device upload strategy according to the drone deployment strategy also includes:

[0073] If a rechargeable IoT device uploads a DDoS attack to multiple locations, and some locations have drones deployed, the following formula is used to adjust the location l where the rechargeable IoT device uploads *:

[0074]

[0075] in, Select the upload location for the device in the predicted value; the rechargeable IoT device i selects the location l with the minimum channel attenuation to upload the data stream.

[0076] In this way, by adjusting the upload strategy of rechargeable IoT devices, the number of deployed UAVs can be minimized in multiple time periods to ensure that all DDoS attacks in the system are filtered.

[0077] In an optional embodiment, the one-time adjustment further includes:

[0078] Adjust the VNF execution strategy according to the VNF configuration strategy:

[0079] If the k-type VNF to be executed in the VNF execution strategy is not pre-deployed on the drone, the VNF execution strategy is adjusted so that the drone cannot execute the k-type VNF;

[0080] If filtering DDoS attacks according to the VNF execution strategy will cause the upper limit of the drone computing resources to be exceeded, the annealing algorithm is used to adjust the VNF execution strategy.

[0081] In an optional embodiment, the adjustment also includes: checking the adjusted drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy. If the adjusted drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy cannot meet the traffic balance constraint, a new drone is deployed and the drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy are readjusted.

[0082] In a specific embodiment, the rechargeable IoT device includes the following key modules: a solar panel, a rechargeable battery, a data acquisition gateway, a data storage unit, a data antenna, and a processor. The solar panel is connected to the rechargeable battery and is responsible for providing continuous energy support for the device. The data acquisition gateway is responsible for collecting and generating data streams from the surrounding environment. These data streams may contain data packets of DDoS attacks. The generated data streams will be temporarily stored in the data storage unit and sent out through the data antenna after processing; the processor is the core module, connecting and coordinating the work of all other modules. It is not only responsible for managing and allocating the computing resources of the device, but also calculating and adjusting the traffic of each DDoS attack in real time according to the wireless channel status to optimize the sending strategy.

[0083] In a specific embodiment, the key modules of the drone include a data receiving antenna, a data storage unit, a data antenna, and a processor. The data receiving antenna is responsible for receiving data streams from rechargeable IoT devices, which may contain data related to DDoS attacks; the data storage unit is used to temporarily store those DDoS attacks that cannot be immediately filtered locally for further processing; for DDoS attacks that cannot be immediately filtered, the drone will route these data to other drones through the data antenna, and use their computing resources for collaborative filtering; the processor is the core module of the drone, connecting all other modules, and is responsible for deploying and executing VNFs to effectively detect and filter DDoS attacks and ensure the security and stability of the system.

[0084] In summary, the present invention is based on network virtualization technology, deploys multiple IoT devices with solar charging functions in the wild for wireless data transmission, among which some IoT devices send DDoS attacks, uses drones as filtering nodes, and minimizes the number of deployed unmanned aerial vehicles in multiple time periods to ensure that all DDoS attacks in the filtering system are filtered. In a time-varying environment, a method for detecting and filtering DDoS attacks is proposed by comprehensively considering factors such as the data and energy status of IoT devices, the status of wireless channels, the upload strategy of IoT devices, the location deployment strategy of drones and the VNF (Virtual Network Function) deployment strategy, and the routing strategy between drones, so that the IoT system is free from DDoS attacks.

[0085] The above embodiments are only for illustrating the technical concept and features of the present invention, and their purpose is to enable ordinary technicians in the field to understand the content of the present invention and implement it accordingly, and they cannot be used to limit the protection scope of the present invention. Any equivalent changes or modifications made based on the essence of the content of the present invention should be included in the protection scope of the present invention.

Claims

1. A neural network-based drone IoT DDoS attack detection method for drone networks, characterized in that: The method comprises: A data stream with a DDoS attack uploaded from a rechargeable IoT device is received, and the DDoS attack in the data stream is detected and filtered based on a preset DDoS attack detection model; the DDoS attack detection model is obtained by training a neural network model.

2. The neural network-based drone Internet of Things DDoS attack detection method according to claim 1, characterized in that: The DDoS attack detection model is trained by a neural network model and includes: Generate several different sets of IoT system environment parameters; The generated IoT system environment parameters are used to solve the linear programming model to obtain the DDoS attack detection strategy; the optimization goal of the linear programming model is to minimize the number of drone deployments; Constructing a data set based on the generated IoT system environment parameters and according to the DDoS attack detection strategy; The data set is used to train a neural network model to obtain a DDoS attack detection model.

3. The neural network-based drone Internet of Things DDoS attack detection method as claimed in claim 2, characterized in that: The linear programming model includes the following constraints: Energy consumption upper limit constraint: The energy consumed by each IoT device in each time slot shall not exceed the sum of the energy collected in the time slot and the available energy at the beginning of the time slot; Unique upload constraint: Each rechargeable IoT device can only upload data stream to one drone in each time slot; Unique deployment constraint: Each drone can only be deployed at one location, and each location can only have one drone deployed; Computing resource constraints: The computing resources consumed by each drone in each time slot must not exceed the maximum value of its available computing resources; Traffic balancing constraint: For each type of DDoS attack traffic, the DDoS attack traffic input of each drone in each time slot must be equal to the DDoS attack traffic output.

4. The neural network-based drone Internet of Things DDoS attack detection method according to any one of claims 1 to 3, characterized in that: The DDoS attack detection model takes the IoT system environment parameters uploaded by the rechargeable IoT device as input and outputs a prediction detection strategy, which includes a drone deployment strategy, a rechargeable IoT device upload strategy, a VNF configuration strategy, and a VNF execution strategy.

5. The neural network-based drone Internet of Things DDoS attack detection method as claimed in claim 4, characterized in that: Also includes: The DDoS attack detection model is adjusted, and the adjustment includes one adjustment, and the one adjustment includes: Adjusting the rechargeable IoT device upload strategy according to the drone deployment strategy includes: If a rechargeable IoT device uploads a DDoS attack to one or more drone deployment locations, the following formula is used to adjust the location l uploaded by the rechargeable IoT device * : in, is the channel attenuation value between the rechargeable IoT device i and the location l; is a set of locations where drones are deployed; the rechargeable IoT device i selects the location l that maximizes the formula to upload the data stream.

6. The neural network-based drone Internet of Things DDoS attack detection method as claimed in claim 5, characterized in that: The adjusting the rechargeable IoT device upload strategy according to the drone deployment strategy also includes: If a rechargeable IoT device uploads a DDoS attack to multiple locations, and some locations have drones deployed, the following formula is used to adjust the location l where the rechargeable IoT device uploads * : in, Select the upload location for the device in the predicted value; the rechargeable IoT device i selects the location l with the minimum channel attenuation to upload the data stream.

7. The neural network-based drone Internet of Things DDoS attack detection method as claimed in claim 5, characterized in that: The one-time adjustment also includes: Adjusting the VNF execution strategy according to the VNF configuration strategy includes: If the VNF to be executed in the VNF execution strategy is not pre-deployed on the drone, adjusting the VNF execution strategy so that the drone cannot execute the VNF; If filtering the DDoS attack according to the VNF execution strategy will cause the upper limit of the drone computing resources to be exceeded, the VNF execution strategy is adjusted using an annealing algorithm.

8. The neural network-based drone Internet of Things DDoS attack detection method according to claim 7, characterized in that: The adjustments also include: Check the adjusted drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy. If the adjusted drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy cannot meet the traffic balance constraint, deploy a new drone and readjust the drone deployment strategy, rechargeable IoT device upload strategy, VNF deployment strategy and VNF execution strategy.

9. The neural network-based drone Internet of Things DDoS attack detection method as claimed in claim 1, characterized in that: The drone includes a data receiving antenna, a data storage unit, a data antenna and a processor; the data receiving antenna is responsible for receiving a data stream with a DDoS attack from a rechargeable IoT device; The data storage unit is used to temporarily store DDoS attacks that cannot be immediately filtered locally and route them to other drones via the data antenna; The processor is responsible for deploying and executing VNF.

10. The neural network-based drone IoT DDoS attack detection method according to claim 1, characterized in that: The rechargeable IoT device includes a solar panel, a rechargeable battery, a data acquisition gateway, a data storage unit, a data antenna and a processor; the solar panel is connected to the rechargeable battery and is responsible for providing continuous energy support for the device; the data acquisition gateway is responsible for collecting and generating data streams with DDoS attacks from the surrounding environment, and the generated data streams are temporarily stored in the data storage unit and sent out through the data antenna after being processed; The processor is responsible for managing and allocating computing resources of the device, and calculating and adjusting the traffic of each DDoS attack in real time according to the wireless channel status.

Images