Link flooding attack detection and defense method and system based on reputation and clustering algorithm

Abstract

The invention provides a link flooding attack detection and defense method and system based on reputation and a clustering algorithm, and the method comprises the steps: constructing an IP reputation model, detecting a newly-added route tracking behavior of an IP, and updating a reputation score value of the newly-added route tracking behavior according to the IP reputation model; detecting the access destination IP entropy of the IP in the untrusted IP set so as to judge the occurrence of an LFA attack and locate a victim link; sampling the flow of the switch at the inlet end of the victim link and performing flow feature extraction; training a first-stage self-organizing graph clustering model so as to carry out preliminary detection on the sampling flow; training a second-stage Gaussian hybrid clustering model so as to carry out secondary detection on the sampling flow; and issuing a flow table rule, and performing flow banning on the malicious IP identified by clustering. The method can improve the detection accuracy, and has better robustness.

Description

Technical Field

[0001] This application relates to the field of network security protection technologies, and in particular, to a method and system for detecting and defending against link flooding attacks based on reputation and clustering algorithms. Background Art

[0002] With the development of the Internet, DDoS attacks have become increasingly rampant, the scale of attacks has been continuously increasing, and various new types of DDoS attacks have emerged in an endless stream. Among them, a new type of DDoS attack called Link flooding attack has been discovered by the academic community and has occurred in the real network environment. The link flooding DDoS attack incident suffered by NetEase in 2015 is the most typical.

[0003] Different from traditional DDoS attack types, the link flooding attack (LFA) targets the backbone link of the target network domain. The attacker uses a large number of zombie hosts and public servers or decoy servers in the target network domain to make the zombie hosts communicate with the decoy servers at a low-speed normal traffic. By continuously superimposing these low-speed traffic, the target link bandwidth is exhausted. Since accessing the target area must pass through the attacked backbone link, normal users cannot access the target network domain, so the attacker achieves the purpose of denying service to the target.

[0004] The detection and defense of link flooding attacks have many difficulties. Firstly, the attacker's target is the key link of the target network domain, rather than the target host server. This makes the traditional intrusion detection system (IDS) and intrusion prevention (IDP) means using gateways ineffective against link flooding attacks (LFA) because the attack traffic does not reach the target host or gateway at all. The attack traffic leads to decoy servers, which are public servers or servers without any gateway firewalls and traffic detection and filtering means. Secondly, the zombie hosts used in the attack send low-speed normal network traffic, such as website browsing (HTTP) or TCP communication traffic. This makes it more difficult for traditional deep packet inspection (DPI) traffic filtering means to take effect. In addition, the attacker will also change the pattern of the attack traffic and the attack link to avoid detection, making the detection and defense of link flooding attacks face more severe challenges.

[0005] In order to detect and defend against link flooding attacks, many detection and defense solutions have been proposed in the academic community. Since an attacker must first conduct network mapping through the traceroute tool to learn the topology of the target network domain and find available public servers or decoy machines (Decoys) in the target network domain when launching a link flooding attack, some existing work has proposed methods for detecting link flooding attacks and discovering attacked links by monitoring the traceroute traffic behavior. One method is to identify the occurrence of link flooding attacks by monitoring the entropy anomaly of traceroute packets. Another method is to count the number of traceroute packets in a time window and judge the occurrence of attacks and identify the botnets used to launch attacks by detecting the outlier window. Both methods can only judge the abnormality of traceroute behavior in a short period. When an attacker adopts a long-term mapping strategy, that is, the attacker controls botnets to conduct network topology mapping at a traceroute mapping frequency close to that of normal users, the detection success rate of the short-term instantaneous anomaly detection method will decrease.

[0006] The (mitigation) defense means against link flooding attacks can be mainly divided into the following ideas and means. One is the re-routing technology based on SDN technology, which diverts the traffic of the victim link to a backup link or other non-critical links to share the traffic pressure on the victim target link. However, this means still retains malicious traffic, and the malicious traffic will still cause pressure on the network. Another is to adopt the means of traffic cleaning. However, since the traffic of link flooding attacks is very similar to normal traffic, the false alarm rate is very high when using deep packet inspection (DPI) to identify traffic characteristics. Therefore, there is little related work. Moreover, since link flooding attacks rarely occur in the real network environment and related events are extremely rare, there is currently no dataset for link flooding attacks (LFA). The method adopted by related work is to use the benign traffic of the botnet detection dataset and the malicious traffic generated in the simulation environment to train the model. Most of the existing work adopts supervised models, such as convolutional neural networks (CovNet), long short-term memory models (LSTM), etc. These models rely on a large amount of data for training, and there is always a deviation between the traffic generated in the simulation environment and the traffic in the real network environment. It is difficult to determine the true detection accuracy of the model. Summary of the Invention

[0007] The purpose of this application is to provide a method and system for detecting and defending link flooding attacks based on reputation and clustering algorithms, aiming to solve the problem of low detection accuracy in traditional detection and defense methods for link flooding attacks.

[0008] In the first aspect, this application provides a method for detecting and defending link flooding attacks based on reputation and clustering algorithms. The method includes: Build an IP reputation model, detect the route tracing behavior of newly added IPs, and update the reputation score value of the newly added route tracing behavior according to the IP reputation model; Detect the access destination IP entropy of IPs within the untrusted IP set to determine the occurrence of LFA attacks and locate the victim link; Sample the traffic of the switch at the ingress end of the victim link and extract flow features; Train the first-stage self-organizing map clustering model to perform preliminary detection on the sampled flows; Train the second-stage Gaussian mixture clustering model to perform secondary detection on the sampled flows; Issue flow table rules to block the traffic of malicious IPs identified by clustering.

[0009] Furthermore, the steps of building the IP reputation model include: Build an IP reputation model according to the following formula: , where, represents the density function, x represents the reputation score value, μ represents the average reputation score, and σ represents the variance of the reputation score; Calculate the average reputation score according to the following formula: , Calculate the variance of the reputation score according to the following formula: , where, represents the reputation score record table, represents the number of elements in the reputation score record table, represents the reputation score of the IP.

[0010] Furthermore, the steps of detecting the route tracing behavior of newly added IPs and updating the reputation score value of the newly added route tracing behavior according to the IP reputation model include: Collect the route tracing behavior traffic packets of the IP, and determine whether the source address IP in the route tracing behavior traffic packets is recorded in the IP reputation table. If not, record it as , if it has been recorded, record it as ; If the IP is , obtain its reputation value according to the following formula: , Obtain the average reputation score of all IPs according to the following formula: , where, represents the reputation value of the IP, Indicates the reputation score obtained by the IP from the external threat intelligence database, is the weight of the external reputation score in the initial reputation, is the average reputation score of all IPs, is the sum of the reputation scores of all IPs; If the IP is , then is added to the route tracing observation event set , and it is judged whether is credible according to the following formula: , If is a credible IP, its observation probability is obtained according to the following formula: , If is an uncredible IP, its observation probability is obtained according to the following formula: , The reputation value of is calculated according to the following formula: , Among them, indicates whether the IP is credible. If it is 1, it is credible. If it is 0, it is uncredible; indicates the observation probability of credible IPs, indicates the observation probability of uncredible IPs, indicates the route tracing event observation set, indicates the total number of observed route tracing behavior events, indicates the observed host The number of events for route tracing behavior, indicates the set of credible IPs, indicates the total number of route tracing behaviors performed in the set of credible IPs, indicates the set of uncredible IPs, indicates the total number of traceroute behaviors performed in the set of uncredible IPs, indicates the prior probability of credible IPs, indicates the prior probability of uncredible IPs.

[0011] Furthermore, the step of detecting the newly added route tracing behavior of the IP and updating the reputation score value of the newly added route tracing behavior according to the IP reputation model further includes: The updated reputation score value is obtained according to the following formula: , Among them, represents the updated credit score value, represents the record of the update period of the last behavior of the IP, and t represents the parameter value when the IP has a traceroute behavior in the current observation period.

[0012] Further, the steps of detecting the destination IP entropy of the IPs in the untrusted IP set to determine the occurrence of the LFA attack and locate the victim link include: Calculate the destination IP entropy of the untrusted IP set traffic according to the following formula: , Among them, represents the destination IP entropy of the untrusted IP set traffic, represents the destination IP address accessed, represents the destination address 's access quantity ratio; Locate the victim node according to the following formula: ), Among them, represents the set of victim nodes of the link flooding attack, represents the source address, represents the shortest path from the source address to the destination address.

[0013] Further, the steps of sampling the traffic at the ingress switch of the victim link and extracting flow features include: Obtain the set of victim nodes of the link flooding attack, and select at least some switches in the set of victim nodes for traffic sampling.

[0014] Further, the steps of training the first-stage self-organizing map clustering model to perform preliminary detection on the sampled flow include: Initialize the weight vector of the neuron nodes to random values; Input the sample features to each neuron; Calculate the distance between the weight of each neuron and the sample feature vector; Calculate the influence radius of the obtained neuron; Update the weights of all neurons according to the influence radius; Repeat the iteration until the maximum number of iterations is reached.

[0015] Further, the steps of training the second-stage Gaussian mixture clustering model to perform secondary detection on the sampled flow include: Select the number of Gaussian mixture components, initialize the Gaussian mixture coefficients, initialize the mean vectors, and initialize the covariance matrices; Calculate the posterior probability of each sample belonging to different Gaussian distributions; Update the model parameters; Repeat calculating the posterior probability and updating the model parameters until the model converges.

[0016] Furthermore, the steps of the flow table rule distribution for traffic blocking of malicious IPs identified by clustering include: Calculate the sum of the reputation scores of the source IPs of the samples in each clustering cluster; Sort the reputation scores of each cluster to obtain the cluster with the lowest reputation score according to the sorting result.

[0017] In a second aspect, the present application provides a link flooding attack detection and defense system based on reputation and clustering algorithms, and the system includes: A model construction module for constructing an IP reputation model, detecting newly added route tracking behaviors of IPs, and updating the reputation score values of the newly added route tracking behaviors according to the IP reputation model; An IP entropy detection module for detecting the access destination IP entropy of IPs in the untrusted IP set to determine the occurrence of LFA attacks and locate the victim link; A flow feature extraction module for sampling the traffic of the switch at the entrance end of the victim link and performing flow feature extraction; A first training module for training a self-organizing map clustering model in the first stage to perform preliminary detection on the sampled flow; A second training module for training a Gaussian mixture clustering model in the second stage to perform secondary detection on the sampled flow; A clustering identification module for distributing flow table rules to block the traffic of malicious IPs identified by clustering.

[0018] In a third aspect, the present application provides a readable storage medium, and the readable storage medium stores one or more programs, and when the program is executed by a processor, the above-mentioned link flooding attack detection and defense method based on reputation and clustering algorithms is implemented.

[0019] In a fourth aspect, the present application provides a computer device, and the computer device includes a memory and a processor, wherein: The memory is used to store a computer program; When the processor executes the computer program stored on the memory, the above-mentioned link flooding attack detection and defense method based on reputation and clustering algorithms is implemented.

[0020] Compared with the prior art, the present application has the following advantages: 1. The embodiments of the present application propose a reputation model based on IP historical routing tracking behavior and a detection method for link flooding attacks with IP source address entropy anomalies. Compared with the existing detection methods based on behavior statistics and entropy anomalies, the method used in the embodiments of the present application has a higher detection accuracy and better robustness when the attacker adopts a long-term mapping strategy.

[0021] 2. The embodiments of the present application design a link flooding attack traffic detection scheme based on a two-stage clustering algorithm. In the first stage, self-organizing map (SOM) clustering is used, and the main goal is to eliminate benign traffic as much as possible. In the second stage, Gaussian mixture (GMM) clustering is adopted, and the main goal is to improve the detection accuracy as much as possible. Different flow features are designed for the two stages. The designed traffic detection scheme has high detection efficiency and detection accuracy, and can effectively detect link flooding attack traffic and identify zombie host IPs.

[0022] 3. The present application uses a two-stage clustering algorithm to perform anomaly detection on link flooding attack traffic. The training model can use existing public data sets or benign traffic in the actual network environment, and has no requirements for attack traffic, effectively solving the problem of lack of link flooding attack traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flowchart of a link flooding attack detection and defense method based on reputation and clustering algorithm proposed in an embodiment of the present application; Figure 2 It is an overall architecture diagram of a link flooding attack detection and defense method based on reputation and clustering algorithm proposed in an embodiment of the present application; Figure 3 It is a schematic structural diagram of a link flooding attack detection and defense system based on reputation and clustering algorithm proposed in an embodiment of the present application.

[0024] The following specific embodiments will further illustrate the present application in conjunction with the above-mentioned drawings. SPECIFIC EMBODIMENTS

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below. Apparently, the described embodiments are some but not all of the embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without creative efforts shall fall within the scope of protection of this application. Unless otherwise defined, the technical terms or scientific terms used herein shall have the ordinary meanings understood by those of ordinary skill in the art to which this application belongs. The words such as "including" used herein are intended to mean that the elements or items appearing before this word cover the elements or items listed after this word and their equivalents, without excluding other elements or items.

[0026] Please refer to Figure 1 , which shows a link flooding attack detection and defense method based on reputation and clustering algorithms provided by an embodiment of this application. This method includes steps S101 to S105, where: Step S101: Construct an IP reputation model, detect the newly added route tracing behavior of an IP, and update the reputation score value of the newly added route tracing behavior according to the IP reputation model; It should be noted that the constructed IP reputation model is a Bayesian IP reputation model. This Bayesian IP reputation model calculates the reputation score of an IP by monitoring and statistically analyzing the traceroute behavior (route tracing behavior). In the IP reputation model, the IP can be classified into two categories, namely trustworthy ( ) and untrustworthy ( ). A trustworthy IP is the IP of a normal host within a network domain (AS), and an untrustworthy IP is the IP of a zombie host (bot) that may be exploited by an attacker to initiate a link flooding attack. Distinguishing between trustworthy ( ) and untrustworthy ( ) IPs is mainly determined according to the reputation score of the IP.

[0027] First, during the process of constructing the IP reputation model, it is set that the distribution of the reputation score follows a normal distribution , and the IP reputation model is constructed according to the following formula: , where, represents the density function, x represents the reputation score value, μ represents the average reputation score, and σ represents the variance of the reputation score.

[0028] Among them, the average reputation score is calculated according to the following formula: , The variance of the reputation score is calculated according to the following formula: , Among them, represents the reputation score record table, represents the number of elements in the reputation score record table, represents the reputation score of the IP. In addition, for the average reputation score and the variance of the reputation score , they need to be updated after each observation period to fit the new distribution.

[0029] In some embodiments, the reputation calculation steps of the IP reputation model are as follows: (1) The traceroute behavior traffic data packet of the IP (usually an ICMP timeout data packet) is collected through a network traffic collector, and it is judged whether the source address IP in the route tracing behavior traffic data packet is recorded in the IP reputation table. If the source address IP of this data packet is not recorded in the IP reputation table then this IP is a newly emerged IP, denoted as , and the recorded IP will not be collected repeatedly. If this IP is already recorded in the reputation table then the traceroute behavior event record of this IP increases, denoted as ; (2) If this IP is , calculate the reputation value of this IP and add it to the reputation table The reputation value calculation formula of this IP is: , represents the reputation score obtained by the IP from the external threat intelligence library, which is used to improve the recognition speed of malicious IPs, is normalized to between 0 and 1, is the weight of the external reputation score in the initial reputation, α∈ [0,1] , is the average reputation score of all IPs, and its calculation formula is as follows: , is the sum of all IP reputation scores.

[0030] (3) If this IP is , add this IP to the traceroute observation event set , and judge whether this IP is a trusted IP. If this IP is a trusted IP, then update the observation probability , otherwise, update the observation probability , specifically as follows: Set the reputation score to be less than the lower quartile The IPs are untrusted IPs (only a relative determination of IP untrustworthiness, not necessarily indicating that the IP is a zombie host IP). The lower quartile The calculation formula is as follows: , where, is the lower quartile of the standard normal distribution, .

[0031] Specifically, the discrimination formula for setting whether an IP is trusted is as follows: , That is to say, indicates whether the IP is trusted. If it is 1, it is trusted; if it is 0, it is untrusted.

[0032] In addition, the IP reputation score can be obtained by observing and statistically analyzing the traceroute behavior of the IP and updating and calculating the posterior probability through Bayes' formula. Specifically, for a normal host, the probability of performing a traceroute behavior is relatively low because only network administrators may use the traceroute tool for network connectivity detection during network maintenance or fault checking, and usually the frequency is not particularly high. Therefore, in the case of a trusted IP ( ), the probability of observing a traceroute behavior is: , where, represents the set of observed traceroute events, that is, the number of events of observing the host performing a traceroute behavior, represents the set of trusted IPs. The numerator part of the above formula represents the total number of traceroute behaviors performed in the set of trusted IPs, and the denominator represents the total number of observed traceroute behavior events. This probability will be dynamically updated according to the current network state and is usually a relatively small value because the probability of a normal trusted IP having a traceroute behavior is relatively low. However, during special periods, such as large-scale network failures, network administrators need to use the traceroute tool for fault checking, and this probability will increase, indicating an increase in the number of events of trusted IPs performing traceroute behaviors.

[0033] In the case of an untrusted IP ( ) In the case of, the probability of observing a traceroute behavior event is as follows: , where, represents the set of observed traceroute event observations, that is, the number of events where the host performs a traceroute behavior, represents the set of untrusted IPs, represents the total number of traceroute behaviors performed in the set of untrusted IPs, and the denominator represents the total number of observed traceroute behavior events. This prior probability is between 0 and 1. Although in this model, the reduction in reputation is due to frequent traceroute behaviors of IPs, there may also be cases of false detection (frequent operations by network administrators). In addition, the initially identified untrusted IPs (the initial IP reputation calculation in this model combines external CIT intelligence) are not necessarily the zombie host IPs controlled by link flooding attackers, and may also be the host IPs performing other malicious behaviors, such as worms, trojans, conventional DDoS, spam, etc. But if the IP is untrusted ( ), then the probability of observing it performing a traceroute behavior is usually much higher than that of a trusted IP performing a traceroute behavior. Therefore, this observation probability is usually relatively high, and the specific probability will be dynamically updated and adjusted according to the observation results of network traceroute events.

[0034] (4) Calculate the reputation score of the IP , and update the reputation score value of this IP in the reputation table .

[0035] Specifically, based on the above two observation probabilities, when observing a traceroute event of an IP, the credible probability of the IP can be updated by calculating the Bayesian posterior probability, that is, the reputation value , and the specific formula is as follows: , where, is the prior probability that the current IP is credible, is the observation probability of the event, and the denominator is the total probability. And the untrusted probability of the IP is: , where, represents the observation probability of a trusted IP, represents the observation probability of an untrusted IP, represents the set of routing trace event observations, represents the total number of observed route tracing behavior events, represents the observed host The number of events for route tracing behavior, represents the set of trusted IPs, represents the total number of route tracing behaviors performed in the set of trusted IPs, represents the set of untrusted IPs, represents the total number of traceroute behaviors performed in the set of untrusted IPs, represents the prior probability of a trusted IP, represents the prior probability of an untrusted IP.

[0036] In addition, it should be noted that the higher the trust probability of an IP, the higher the reputation value. The reputation value range of the IP R IP ∈ [0,1] .

[0037] In addition, it should also be explained that the reputation value of a normal IP should gradually recover after a long time without traceroute behavior, and a malicious IP can also be considered to have returned to normal after a long time of inactivity. To ensure that the reputation system correctly evaluates the trust probability of an IP, when an observation period ends, it is necessary to restore the reputation scores of those IPs that have not performed any traceroute behavior. Usually, this observation period is relatively long to prevent link flood attackers from using long-period detection strategies to evade the reputation system detection. This update period is recommended to be associated with the network topology update period (the old topology detected by the attacker using long-period detection cannot be used to launch link flood attacks). The reputation score recovery formula is as follows: , where, represents the updated reputation score value, represents the record of the last behavior update period of the IP. When this IP has a traceroute behavior in the current observation period, this parameter value is updated to , and the recovery weight function of the second term of this formula is a Sigmoid function, which can make the reputation value recover relatively slowly at the beginning and accelerate the recovery as the observation period grows, making it more difficult for the attacker's long-period detection strategy to evade the reputation system detection.

[0038] Step S102: Detect the access destination IP entropy of the IPs in the set of untrusted IPs to determine the occurrence of the LFA attack and locate the victim link; It should be noted that in this step, when a link flooding attack occurs, the botnets controlled by the attacker will access the decoy with a low-speed normal traffic, superimpose the normal traffic and block the critical link. Since the resources of the decoy available for blocking the critical link are limited, the destination IP addresses of the access of the botnets (IPs) are highly similar, while the destination IP addresses of the access of normal host IPs are always uniformly random. Therefore, when a link flooding attack occurs, the entropy of the traffic destination IP of the botnets will be abnormal.

[0039] In the IP reputation record table of the aforementioned Bayesian IP reputation model it can be considered that the IPs with low reputation values are more likely to be the botnet IPs participating in the link flooding attack. Therefore, only by calculating the entropy of the access destination IP addresses of the low-reputation IPs in the reputation table and monitoring the anomalies can the occurrence of the link flooding attack be effectively judged. Through the global characteristics of the SDN, the attack traffic path (usually the shortest path) can be calculated, and the overlapping nodes of the attack traffic path can be calculated to locate the ingress end node (switch) of the victim link. The relevant calculation formulas are as follows: , where, represents the entropy of the access destination IP of the traffic of the untrusted IP set, represents the access destination IP address, represents the destination address the access quantity ratio; The formula for locating the victim node (the ingress end switch of the victim link) is as follows: ), where, represents the set of victim nodes of the link flooding attack, represents the source address, represents the shortest path from the source address to the destination address, and there may be multiple victim nodes.

[0040] Step S103: Sample the traffic of the ingress end switch of the victim link and perform flow feature extraction; In this step, specifically according to the set of victim nodes of the link flooding attack obtained in step S102 , and select all or part of the switches in the set for traffic sampling.

[0041] Step S104: Train the first-stage self-organizing map clustering model to perform a preliminary detection on the sampled flows; It should be noted that in the first stage of this step, the self-organizing map (SOM) clustering algorithm is used to make the first distinction between attack flows and benign flows. The purpose is to eliminate the benign flows as much as possible in order to improve the detection efficiency.

[0042] In addition, the main features of the self-organizing map (SOM) clustering algorithm adopted in the first stage are strong model dynamic learning ability and high training efficiency. The main task of the model in this stage is to learn the characteristics of benign flows, which can be the data collected from public data sets or real network environments. The model in this stage is trained only with benign traffic. In order to improve the efficiency of detection and feature extraction, each network flow is marked with a tuple (src_ip, dst_ip). The flow features used for training the model in this stage are: dst_ip_speed: the access speed of different destination IPs (counted every 10s); dst_ip_novelty_speed: the number of new destination IPs compared to the previous time window; flow_duration: the duration of the flow (link attack flows usually have a longer duration); pkt_rate: the rate at which the source IP sends packets (botnets always send packets at a low rate); pkt_size: the average size of the packets sent by the source IP (there are significant differences between normal sources and malicious sources).

[0043] In some embodiments, the first training stage specifically includes the following steps: Step1 (Initialization): The weight vector ( - ) of the neuron node ( ) is initialized to a random value.

[0044] Step2 (Input): Input the sample features into each neuron ( - ).

[0045] Step3 (Competition): Calculate the distance between the weight of each neuron and the sample feature vector , and the calculation formula is as follows: = , where D is the feature dimension, is the feature value, is the neuron weight, and select the winning neuron C with the shortest distance from the sample feature vector, denoted as .

[0046] Step4 (Learning): Calculate the influence radius of the winning neuron , and the calculation formula is as follows: , wherein, is the current iteration number, is a constant related to the maximum iteration number and the initial radius and the calculation formula is as follows: , Update all neuron weights according to the influence radius and the formula is as follows: , wherein, is the weight of the corresponding neuron at the t-th round of the current iteration and is a weight function with the calculation formula as follows: , wherein, is the Euclidean distance between the updated neuron and the winning neuron ( ), is the learning rate, which decreases as the iteration number increases, and the calculation formula is: , Step 5 (Iteration): Repeat Step 2 to Step 4 until the maximum iteration number is reached.

[0047] Step S105: Train the Gaussian mixture clustering model in the second stage to perform secondary detection on the sampling flow; It should be noted that the Gaussian mixture (GMM) clustering algorithm is used in the second stage to further distinguish the flow detection results in the first stage, aiming to improve the detection accuracy of malicious flows as much as possible.

[0048] In addition, the main feature of the Gaussian Mixture Model (GMM) adopted in the second stage is its strong learning ability for the complex feature distribution of sample data. The purpose of the model in this stage is to detect malicious flows of link flooding attacks as accurately as possible. To more precisely detect attack flows, considering that the link flooding attack flows have characteristics significantly different from those of benign flows on the traffic behavior graph, five features on the traffic graph are added in this stage to more precisely distinguish attack flows. The newly added features are described as follows: ID: In-degree of the node, the number of destination IPs accessed by the node (IP). The number of accesses from zombie hosts (Bots) to decoys is valid and generally lower than that of benign IP nodes; OD: Out-degree of the node, the number of source IPs accessed by the node (IP); IDW: Weight of the in-degree of the node, the number of received flow packets of the node (IP); ODW: Weight of the out-degree of the node, the number of sent flow packets of the node (IP); LLC: Local clustering coefficient. Since the number of available decoys for zombie hosts (Bots) is limited and the overlap is high, malicious IP nodes will have a relatively high local clustering coefficient (LLC).

[0049] In some embodiments, the specific process of the second training stage is as follows: Step1 (Initialization): Select the number of Gaussian mixture components , initialize the Gaussian mixture coefficients , initialize the mean vector , initialize the covariance matrix .

[0050] Step2 (Calculate posterior probability): Calculate the posterior probability of each sample belonging to different Gaussian distributions: ( ) = , where, ( is the posterior probability that the sample belongs to the th Gaussian component, represents the mean vector of the jth distribution, represents the covariance matrix of the jth distribution, is the Gaussian function, and the formula is as follows: , where, is the sample feature vector, with a dimension of , is the mean vector, is the covariance matrix, is the determinant of the covariance matrix.

[0051] Step 3 (Update model parameters): Calculate the posterior probability ( After that, the model parameters to be updated are as follows: , where is the total probability of the sample in the k-th distribution.

[0052] , where is the Gaussian mixture coefficient.

[0053] , where is the mean vector of the k-th distribution.

[0054] , where is the covariance matrix of the k-th distribution.

[0055] Step 4 (Iteration): Repeat Steps 2 to 3 until the model converges.

[0056] Step S106: Issue a flow table rule to block the traffic of the malicious IPs identified by clustering.

[0057] In this step, after extracting the features of the flow by sampling the network flow and clustering the flow, the method for judging the category of the clustering cluster is as follows: First, calculate the sum of the reputation scores of the source IPs of the samples in each clustering cluster (if the IP exists in the reputation table ), and the formula is as follows: , is the i-th clustering cluster, is the reputation score of the IP.

[0058] Then, sort the reputation scores of each cluster: , Finally, according to the above sorting results, select the cluster with the lowest reputation score, which is the classification cluster of the zombie host IPs that may be used for link flooding attacks.

[0059] In addition, it should be noted that the above method for judging the clustering cluster is applicable to the clustering algorithms in both training stages. After detecting the zombie host IPs that may be used for link flooding attacks, the SDN controller module can issue a flow table rule, as Figure 2 shown, to block the traffic of the corresponding zombie host IPs.

[0060] In summary, according to the above-mentioned link flooding attack detection and defense method based on reputation and clustering algorithms, it has the following advantages: 1. The embodiment of the present application proposes a reputation model based on IP historical routing tracking behavior and a link flooding attack detection method for IP source address entropy anomaly. Compared with the existing detection methods based on behavior statistics and entropy anomaly, the method used in the embodiment of the present application has higher detection accuracy and better robustness when the attacker adopts a long-cycle mapping strategy.

[0061] 2. The embodiment of the present application designs a link flooding attack traffic detection scheme based on a two-stage clustering algorithm. In the first stage, self-organizing map (SOM) clustering is used, and the main goal is to eliminate benign traffic as much as possible. In the second stage, Gaussian mixture (GMM) clustering is adopted, and the main goal is to improve the detection accuracy as much as possible. Different flow features are designed for the two stages. The designed traffic detection scheme has high detection efficiency and detection accuracy, and can effectively detect link flooding attack traffic and identify zombie host IPs.

[0062] 3. The present application uses a two-stage clustering algorithm to perform anomaly detection on link flooding attack traffic. The training model can use existing public data sets or benign traffic in the real network environment, and has no requirements for attack traffic, effectively solving the problem of lack of link flooding attack traffic data.

[0063] Please refer to Figure 3 , which shows a schematic structural diagram of a link flooding attack detection and defense system based on reputation and clustering algorithms in an embodiment of the present application. The system includes: A model construction module 10, configured to construct an IP reputation model, detect newly added routing tracking behaviors of IPs, and update the reputation score values of the newly added routing tracking behaviors according to the IP reputation model; An IP entropy detection module 20, configured to detect the access destination IP entropy of IPs in the untrusted IP set to determine the occurrence of LFA attacks and locate the victim link; A flow feature extraction module 30, configured to sample the traffic of the switch at the entrance end of the victim link and perform flow feature extraction; A first training module 40, configured to train a self-organizing map clustering model in the first stage to perform preliminary detection on the sampled flow; A second training module 50, configured to train a Gaussian mixture clustering model in the second stage to perform secondary detection on the sampled flow; A clustering recognition module 60, configured to issue flow table rules to block the traffic of the malicious IPs identified by clustering.

[0064] On the other hand, the present application also provides a readable storage medium, on which one or more programs are stored, and when the program is executed by a processor, the above-mentioned method for detecting and defending link flooding attacks based on reputation and clustering algorithms is implemented.

[0065] On the other hand, the present application also provides a computer device, including a memory and a processor, where the memory is used to store a computer program, and the processor is used to execute the computer program stored on the memory to implement the above-mentioned method for detecting and defending link flooding attacks based on reputation and clustering algorithms.

[0066] Those skilled in the art can understand that the logic and / or steps represented in the flowchart or described in other ways herein, for example, can be considered as a definite sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch instructions from the instruction execution system, apparatus, or device and execute the instructions), or in combination with these instruction execution systems, apparatus, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0067] More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection part with one or more wirings (electronic device), a portable computer disk cartridge (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or other suitable processing as necessary, and then stored in a computer memory.

[0068] It should be understood that each part of the present application can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits with logic gate circuits for implementing logical functions on data signals, application-specific integrated circuits with appropriate combinational logic gate circuits, programmable gate arrays (PGA), field programmable gate arrays (FPGA), etc.

[0069] Although the embodiments of the present application have been described in detail above, it is obvious to those skilled in the art that various modifications and changes can be made to these embodiments. However, it should be understood that such modifications and changes are all within the scope and spirit of the present application described in the claims. Moreover, the present application described herein may have other embodiments and can be implemented or realized in various ways.

Claims

1. A link flooding attack detection and defense method based on reputation and clustering algorithm, characterized in that: The method comprises: Constructing an IP reputation model, detecting newly added route tracking behaviors of an IP, and updating the reputation score value of the newly added route tracking behaviors according to the IP reputation model; Detect the access destination IP entropy of the IP in the untrusted IP set to determine the occurrence of LFA attacks and locate the victim link; Sample the traffic of the switch at the ingress end of the victim link and extract flow features; The first stage self-organizing map clustering model is trained to perform preliminary detection on the sampled streams; The second-stage Gaussian mixture clustering model is trained to perform secondary detection on the sampled streams; Send flow table rules to block traffic from malicious IP addresses identified by clustering.

2. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 1 is characterized in that: The steps of constructing the IP reputation model include: The IP reputation model is constructed according to the following formula: ， in, represents the density function, x represents the reputation score value, μ represents the mean value of the reputation score, and σ represents the variance of the reputation score; The average credit score is calculated using the following formula: ， The variance of the reputation score is calculated according to the following formula: ， in, Represents the credit score record table, Represents the number of elements in the reputation score record table, Indicates the reputation score of the IP.

3. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 2 is characterized in that: The step of detecting the newly added route tracking behavior of the IP and updating the reputation score value of the newly added route tracking behavior according to the IP reputation model includes: Collect IP routing tracking behavior traffic data packets and determine whether the source address IP in the routing tracking behavior traffic data packets is recorded in the IP reputation table. If not, it is recorded as , if it has been recorded, it is recorded as ; If the IP is , then its reputation value is obtained according to the following formula: ， Get the average reputation score of all IPs according to the following formula: ， in, Indicates the reputation value of the IP. Indicates the reputation score of the IP obtained from the external threat intelligence library. is the weight of the external reputation score in the initial reputation, is the average reputation score of all IPs, It is the sum of all IP reputation scores; If the IP is , then Add to the traceroute observation event collection , and judge according to the following formula Is it credible? ， like If it is a trusted IP, its observation probability is obtained according to the following formula: ， like If it is an untrusted IP, its observation probability is obtained according to the following formula: ， Calculated according to the following formula Reputation value: ， in, Indicates whether the IP is trustworthy. If it is 1, it is trustworthy; if it is 0, it is not trustworthy. represents the observation probability of a trusted IP, represents the observation probability of untrusted IP, Represents a set of route tracking event observations, Represents the total number of observed route tracking behavior events, Indicates that the host is observed The number of events that performed route tracing behavior, Represents a collection of trusted IPs. Indicates the total number of routing tracebacks performed in the trusted IP set. Represents a collection of untrusted IPs. Indicates the total number of traceroute actions performed in the untrusted IP set. represents the prior probability of a trusted IP, Represents the prior probability of an untrusted IP.

4. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 3 is characterized in that: The step of detecting the newly added route tracking behavior of the IP and updating the reputation score value of the newly added route tracking behavior according to the IP reputation model also includes: Get the updated credit score value according to the following formula: ， in, Indicates the updated reputation score value. It indicates the record of the last behavior update cycle of IP, and t indicates the parameter value when IP has performed route tracking behavior in the current observation period.

5. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 4 is characterized in that: The step of detecting the access destination IP entropy of the IP in the untrusted IP set to determine the occurrence of the LFA attack and locate the victim link includes: The access destination IP entropy of the untrusted IP set traffic is calculated according to the following formula: ， in, Indicates the access destination IP entropy of the untrusted IP set traffic. express The destination IP address of the access. Indicates the destination address The proportion of visits; Locate the victim node according to the following formula: )， in, represents the set of victim nodes of link flooding attack, Indicates the source address, Indicates the shortest path from the source address to the destination address.

6. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 1 is characterized in that: The steps of sampling the traffic of the switch at the inlet end of the victim link and extracting the flow features include: A set of victim nodes of the link flooding attack is obtained, and at least some switches in the set of victim nodes are selected for traffic sampling.

7. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 1 is characterized in that: The step of training the first-stage self-organizing map clustering model to perform preliminary detection on the sample flow includes: The weight vector of the neuron node is initialized to a random value; Input sample features to each neuron; Calculate the distance between the weight of each neuron and the sample feature vector; Calculate the influence radius of the neuron; Update all neuron weights according to the influence radius; Repeat the iteration until the maximum number of iterations is reached.

8. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 7 is characterized in that: The step of training the second-stage Gaussian mixture clustering model to perform secondary detection on the sample flow includes: Select the number of mixed Gaussian components, initialize the Gaussian mixture coefficients, initialize the mean vector, and initialize the covariance matrix; Calculate the posterior probability that each sample belongs to different Gaussian distributions; Update model parameters; The posterior probability is calculated repeatedly and the model parameters are updated until the model converges.

9. The link flooding attack detection and defense method based on reputation and clustering algorithm according to claim 8 is characterized in that: The step of issuing flow table rules to block traffic of malicious IPs identified by clustering includes: Calculate the reputation score and source IP address of each sample in each cluster; The reputation scores of each cluster are sorted to obtain the cluster with the lowest reputation score according to the sorting result.

10. A link flooding attack detection and defense system based on reputation and clustering algorithm, characterized in that: The system comprises: A model building module, used to build an IP reputation model, detect newly added route tracking behaviors of IP, and update the reputation score value of the newly added route tracking behaviors according to the IP reputation model; The IP entropy detection module is used to detect the access destination IP entropy of the IP in the untrusted IP set to determine the occurrence of LFA attacks and locate the victim link; A flow feature extraction module is used to sample the traffic of the switch at the inlet end of the victim link and extract flow features; A first training module is used to train a first-stage self-organizing map clustering model to perform preliminary detection on the sampled stream; The second training module is used to train the second-stage Gaussian mixture clustering model to perform secondary detection on the sampled stream; The cluster identification module is used to issue flow table rules and block traffic for malicious IP addresses identified by clustering.

Images