Decentralized rate limiting method and apparatus for malicious cyber attacks

Abstract

The application discloses a kind of decentralized rate limiting methods and devices for malicious network attack, comprising: extracting the behavior characteristics of rate limiting node in decentralized distributed system;Using node clustering algorithm to obtain the distance of each rate limiting node to each cluster based on behavior characteristics, according to distance to select the nearest cluster to divide rate limiting node into normal cluster and malicious cluster;Initialize the distributed rate limiting parameter in each cluster, and dynamically adjust the rate limiting value of each rate limiting node based on distributed rate limiting parameter in each cluster using distributed rate limiting algorithm;Real-time monitoring is carried out to each cluster, and the size of cluster is dynamically adjusted according to the number of rate limiting node and the change of behavior characteristics, and malicious node identification and processing are carried out to malicious cluster.The application can improve the security, stability and resource allocation efficiency of distributed system, and is suitable for the optimization and promotion of overall service quality in large-scale distributed network environment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of distributed system security and resource management, and particularly relates to a decentralized rate limiting method and device for malicious network attacks. BACKGROUND

[0002] In a distributed system, rate limiting algorithm is an important technology to ensure fair allocation of resources and prevent system overload, especially in a decentralized environment, its design and implementation face higher complexity. Decentralized distributed system relies on the cooperation between nodes to complete the rate limiting task due to the absence of central control node. However, with the increase of the number of nodes, the dynamic changes of network environment and the diversification of malicious behaviors, the traditional distributed rate limiting method exposes significant limitations, especially in large-scale node scenarios, rate limiting performance decline and system instability become urgent problems to be solved. At the same time, the mixing of malicious nodes further aggravates these challenges, highlighting the necessity of cluster design.

[0003] Traditional decentralized rate limiting methods are mostly based on a single cluster running global request rate or static threshold strategy. For example, the global random drop (GRD) algorithm realizes rate limiting through packet drop probability, which is suitable for small-scale node environment. Its core mechanism is to randomly drop requests according to global traffic excess, which only needs simple exponential weighted moving average calculation. However, when the number of nodes in a cluster increases to more than 50, the performance of GRD decreases significantly, which is manifested as the decrease of rate limiting accuracy and the short-term fluctuation of packet drop rate. This is because the excessive number of nodes leads to the increase of communication overhead, the decrease of cooperation efficiency between nodes, and then affects the stability and fairness of rate limiting. Similarly, the flow proportion sharing (FPS) algorithm realizes fair allocation through token bucket and flow weight, supports up to 490 limiters, and reaches an ideal rate of 50 Mbps in PlanetLab test. Although FPS is superior to GRD in scalability, it still assumes that all nodes run in a single cluster, and as the number of nodes further increases, the communication budget becomes a bottleneck, resulting in unstable rate limiting performance. In addition, FPS has limited ability to distinguish malicious nodes, and cannot effectively deal with disguised traffic or resource abuse behaviors.

[0004] When using decentralized rate limiting algorithms in a cluster, the performance degradation and instability caused by excessive number of nodes are particularly prominent. First, the increase in the number of nodes leads to a non-linear increase in the computational and communication complexity of the algorithm. For example, GRD and FPS require frequent synchronization of global state in a single cluster, and when the number of nodes reaches hundreds or thousands, the synchronization delay and high packet loss rate cause the rate limiting effect to deviate from the expected. Second, a single cluster cannot effectively isolate malicious nodes. Malicious nodes can interfere with the rate limiting execution of normal nodes by making high-frequency requests or occupying too many resources (such as CPU or bandwidth), and existing methods lack fine-grained differentiation mechanisms, resulting in impaired rate limiting performance of the entire cluster. For example, in a DDoS attack, the high traffic of malicious nodes can cause the quotas of normal nodes to be squeezed out, and a single cluster design cannot quickly separate these abnormal behaviors. Third, a single cluster is fragile when a large number of nodes fail, and if more than 50% of the nodes exit, the rate limiting algorithm may fail due to resource shortage or cooperation failure. Therefore, dividing nodes into multiple clusters is a necessary means to solve the above problems, and the multi-cluster design not only limits the number of nodes in each cluster to maintain performance, but also improves system security by distinguishing malicious nodes.

[0005] The deficiencies of existing technologies in multi-cluster design further exacerbate the problem. Some distributed systems attempt to achieve multi-cluster operation through manual partitioning or static division, but these methods lack dynamicity and automation. For example, static division cannot adapt to scenarios of node failure or addition, and does not combine malicious node detection, resulting in abnormal traffic being mixed in normal clusters and affecting rate limiting fairness. In addition, existing methods do not fully utilize behavior characteristics, usually only focusing on a single indicator (such as request frequency), without comprehensive analysis of multiple characteristics such as resource utilization, request pattern randomness, and abnormal traffic proportion. This singularity limits the detection ability of disguised malicious behavior, especially when malicious nodes are mixed in normal clusters, traditional schemes have difficulty in quickly identifying and transferring to independent clusters.

[0006] In summary, existing decentralized rate limiting technologies suffer from performance degradation and instability when running in a single cluster due to excessive number of nodes, and cannot effectively distinguish and isolate malicious nodes, especially in scenarios of large-scale node failure or mixed malicious traffic. Multi-cluster design is the key to solving these problems, but existing solutions still lack dynamic clustering and dynamic adjustment mechanisms based on behavior characteristics, affecting the performance of the system in terms of scalability, security, and robustness. SUMMARY

[0007] In view of the above, the purpose of the present application is to provide a decentralized rate limiting method and device for malicious network attacks, by extracting the behavior characteristics of rate limiting nodes, using clustering algorithms to divide the nodes into normal clusters and malicious clusters, and dynamically adjusting the rate limiting parameters in a decentralized environment to deal with abnormal malicious traffic (such as distributed denial of service attacks or Sybil attacks), improve the security, stability and resource allocation efficiency of distributed systems, and provide an innovative solution for the field of distributed rate limiting.

[0008] To achieve the above-mentioned purpose of the application, the technical solutions provided by the present application are as follows:

[0009] In the first aspect, the present application provides a decentralized rate limiting method for malicious network attacks, comprising the following steps:

[0010] Extract the behavior characteristics of rate limiting nodes in a decentralized distributed system, including request frequency, request pattern entropy, abnormal traffic proportion and resource consumption rate;

[0011] Use node clustering algorithm to obtain the distance of each rate limiting node to each cluster based on behavior characteristics, and select the nearest cluster to divide the rate limiting nodes into normal clusters and malicious clusters;

[0012] Initialize the distributed rate limiting parameters in each cluster, and use the distributed rate limiting algorithm to dynamically adjust the rate limiting value of each rate limiting node based on the distributed rate limiting parameters in each cluster;

[0013] Real-time monitoring of each cluster, dynamic adjustment of cluster size according to the number and behavior characteristics of rate limiting nodes, and malicious node identification and processing for malicious clusters.

[0014] Preferably, the use of node clustering algorithm based on behavior characteristics to obtain the distance of each rate limiting node to each cluster, and the selection of the nearest cluster to divide the rate limiting nodes into normal clusters and malicious clusters, comprises:

[0015] Calculate the number K of initial normal clusters, and randomly select K rate limiting nodes as the first initial nodes of each initial normal cluster;

[0016] Add an initial malicious cluster, and generate a rate limiting node with non-zero request frequency, abnormal traffic proportion and resource consumption rate, and zero request pattern entropy as the initial node of the initial malicious cluster;

[0017] Calculate the distance of each rate limiting node in the system to the initial nodes in the initial normal clusters and the initial malicious cluster, and add each rate limiting node to the nearest cluster to obtain normal clusters and malicious clusters;

[0018] If the number of nodes in the normal cluster exceeds the preset cluster size threshold, no new speed-limited node is added to the cluster, and the new speed-limited node is added to other clusters according to distance sorting.

[0019] Preferably, the distributed speed-limiting parameter in each cluster comprises:

[0020] an initial total speed-limiting value B, an average degree speed-limiting value and a speed-limiting algorithm parameter value θ, wherein the average degree speed-limiting value is calculated according to the following formula:

[0021]

[0022] wherein, represents the average degree of the nodes in the network topology graph, and N represents the total number of nodes in the network topology graph.

[0023] Preferably, the dynamic adjustment of the speed-limiting value of each speed-limited node in each cluster based on the distributed speed-limiting parameter by using the distributed speed-limiting algorithm comprises:

[0024] determining the initial speed-limiting value of each speed-limited node i in the cluster according to the initial total speed-limiting value B in each cluster determining the node speed-limiting value of the speed-limited node i at the current time t wherein is the case when t = 0, the node speed-limiting value of the speed-limited node i at the next time t+1 is calculated and the calculation formula is:

[0025]

[0026] wherein, P i and P j respectively represent the packet loss rate of the speed-limited node i and the speed-limited node j in the same cluster E at the time t, r i and r j respectively represent the node receiving rate value of the speed-limited node i and the speed-limited node j in the same cluster E at the time t, and max{·} represents the maximum value function;

[0027] If, when calculating the node speed-limiting value at the next time, it is found that:

[0028]

[0029] the excess reduction amount ex is calculated:

[0030]

[0031] then the sum total of the node speed-limiting value of each speed-limited node j adjacent to the speed-limited node i at the time t is calculated.B for:

[0032]

[0033] Then, for each speed-limiting node j adjacent to speed-limiting node i, the speed limit value is adjusted, that is, the node speed limit value of speed-limiting node j at time t+1 is adjusted. Adjust according to the following formula:

[0034]

[0035] Where min{·} represents the minimum value function;

[0036] If, when calculating the node speed limit value for the next moment, it is found that:

[0037]

[0038] Then we have:

[0039]

[0040] That is, the speed limit node j remains unchanged from its original speed limit value.

[0041] Preferably, the real-time monitoring of each cluster includes:

[0042] Each cluster is continuously monitored to determine whether the conditions for rate limiting adjustment are triggered. The conditions include a large-scale node failure that results in too few nodes in a cluster, and / or the appearance of malicious nodes in a normal cluster. If the conditions are triggered, the cluster size is dynamically adjusted.

[0043] Preferably, the criterion for determining whether a large-scale node failure leads to a shortage of nodes in a cluster is set as follows: if the total number of nodes in a single cluster decreases by more than 50%, it is considered a large-scale failure, and a significant decrease in the number of nodes will lead to a decline in rate limiting capability. The criterion for determining the presence of malicious nodes in a normal cluster is set as follows: if the resource consumption U of the i-th rate-limiting node in a single cluster... i >3.0 and lasting for more than 10 seconds, or the request frequency R of the i-th rate-limiting node. i If the value exceeds 5 times the cluster average, it is considered a malicious node.

[0044] Preferably, the step of dynamically adjusting the cluster size based on changes in the number and behavioral characteristics of rate-limiting nodes includes:

[0045] Based on the change in the number of rate-limiting nodes, for clusters experiencing large-scale failures, the rate-limiting nodes are merged into the normal cluster with the shortest distance.

[0046] According to the behavior characteristic change of the speed limiting node, for the newly discovered malicious node, the newly discovered malicious node is added to the malicious cluster with the least number of nodes, and if there is no malicious cluster at present, a new malicious cluster is created, and the newly discovered malicious node is used as the initial node of the new malicious cluster.

[0047] Preferably, the malicious node identification and processing for the malicious cluster comprises:

[0048] The secondary judgment based on the malicious traffic identification is performed on the malicious node in the malicious cluster, if the malicious node is confirmed, the speed limiting value is lowered, and a warning is issued in the system, and the operator is requested to judge whether to retain or add the node to the blacklist;

[0049] When the operator adds the malicious node identified by the secondary judgment to the blacklist, the malicious node is deleted from the malicious cluster, and then the real-time monitoring and dynamic adjustment of the cluster are continuously performed

[0050] In the second aspect, to achieve the above-mentioned object, the embodiment of the present application further provides a decentralized speed limiting device for malicious network attacks, which is realized by using the above-mentioned decentralized speed limiting method for malicious network attacks, comprising: a node feature extraction module, a cluster clustering processing module, a node speed limiting adjustment module, a cluster dynamic adjustment module, and a malicious traffic identification module.

[0051] The node feature extraction module is used to extract the behavior characteristics of the speed limiting nodes in the decentralized distributed system, and the behavior characteristics include the request frequency, the request mode entropy, the abnormal traffic proportion and the resource consumption rate.

[0052] The cluster clustering processing module is used to obtain the distance of each speed limiting node to each cluster based on the behavior characteristics by using the node clustering algorithm, and the nearest cluster is selected according to the distance to divide the speed limiting nodes into normal clusters and malicious clusters.

[0053] The node speed limiting adjustment module is used to initialize the distributed speed limiting parameters in each cluster, and the speed limiting value of each speed limiting node is dynamically adjusted based on the distributed speed limiting parameters by using the distributed speed limiting algorithm in each cluster.

[0054] The cluster dynamic adjustment module is used to monitor each cluster in real time, and dynamically adjust the cluster size according to the number and behavior characteristic change of the speed limiting nodes.

[0055] The malicious traffic identification module is used to identify and process the malicious nodes for the malicious cluster.

[0056] In a third aspect, to achieve the above object, the embodiments of the present application further provide an electronic device comprising a memory for storing a computer program and one or more processors for implementing the above-mentioned decentralized rate limiting method against malicious network attacks when executing the computer program.

[0057] Compared with the prior art, the present application has at least the following beneficial effects:

[0058] (1) The present application proposes a novel and efficient decentralized rate limiting method against malicious network attacks, which can accurately divide nodes into normal clusters and malicious clusters by extracting multi-dimensional behavior characteristics of rate limiting nodes (including request frequency, request pattern entropy, abnormal traffic proportion and resource utilization), thereby effectively distinguishing normal nodes from malicious nodes, significantly improving the identification ability of abnormal malicious traffic in decentralized distributed systems, and enhancing the ability of the system to resist network attacks.

[0059] (2) The present application adopts a dynamic cluster architecture design, which on the one hand realizes adaptive rate adjustment of nodes within the cluster based on a distributed rate limiting algorithm, and on the other hand dynamically adjusts the number of nodes in each cluster through an intelligent cluster size control mechanism. This dual optimization strategy overcomes the performance degradation and instability problems caused by excessive number of nodes in a single cluster, improves the overall computing efficiency of the system and reduces the management complexity, providing an efficient rate limiting solution for large-scale distributed network environments.

[0060] (3) The dynamic adjustment and malicious traffic identification method proposed by the present application has significant advantages compared to traditional static threshold or fixed period adjustment methods, which can adaptively adjust rate limiting parameters according to node resource utilization and cluster state, dynamically balance the resource allocation fairness of each node while ensuring system stability, effectively reduce the occupation of system resources by malicious nodes, and further optimize the overall service quality of decentralized networks. BRIEF DESCRIPTION OF DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0062] Figure 1 is a flowchart of the decentralized rate limiting method against malicious network attacks provided by the embodiments of the present application;

[0063] Figure 2is a structural schematic diagram of a decentralized rate limiting device for malicious network attacks provided by an embodiment of the present application.

[0064] Figure 3 is a distributed network system architecture design schematic diagram of deploying a decentralized rate limiting device for malicious network attacks under a cloud network provided by an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the protection scope of the present application.

[0066] The inventive concept of the present application is that, in order to solve the problems of performance decline and instability caused by excessive number of nodes in a single cluster and lack of dynamic and automation in a multi-cluster design in the prior art, an embodiment of the present application provides a decentralized rate limiting method and device for malicious network attacks, based on the behavior characteristics of rate limiting nodes, using a node clustering algorithm to divide the nodes into normal clusters and malicious clusters, on the basis of which a distributed rate limiting algorithm is used to dynamically adjust the rate limiting values of the nodes, and further, the cluster size is dynamically adjusted according to the number and behavior characteristics of the rate limiting nodes, and combined with malicious node identification and processing, the security, stability and resource allocation efficiency of the distributed system are improved, the fairness of resource allocation of the rate limiting cluster is ensured, and the performance of the cloud network cluster is improved.

[0067] Figure 1 is a flow schematic diagram of a decentralized rate limiting method for malicious network attacks provided by an embodiment of the present application. As shown in Figure 1 , the embodiment provides a decentralized rate limiting method for malicious network attacks, comprising the following steps:

[0068] S1, extracting the behavior characteristics of rate limiting nodes in a decentralized distributed system, the behavior characteristics including request frequency, request pattern entropy, abnormal traffic proportion and resource consumption rate.

[0069] S1.1, extracting the request frequency R i .

[0070] (i) setting a request counter on the rate limiting node i for recording the number of received requests;

[0071] (ii) defining a fixed time window t slide as a statistical period;

[0072] (iii) clearing the counter at the beginning of each time window, and reading the value num request of the counter as the number of requests at the end of the window;

[0073] (iv) Request frequency R i The calculation formula is:

[0074]

[0075] S1.2, extract request pattern entropy E i .

[0076] (i) Record the arrival time stamps of the last n requests on the speed limit node i in milliseconds, forming a time stamp sequence {t1, t2, t3,..., tn}; n-2 n-1 n ;

[0077] (ii) Calculate the time interval between adjacent requests, and the interval calculation formula is:

[0078] Δt k = t k+1 - t k

[0079] Where k is from 1 to n-1;

[0080] (iii) Divide the time interval sequence into multiple time buckets, and count the number of intervals in each bucket;

[0081] (iv) Calculate the probability according to the distribution of the bucket and calculate the entropy, the request pattern entropy E i The calculation formula is:

[0082]

[0083] Where P(Δt k ) represents the probability of a certain time interval bucket, which is calculated as the number of intervals in the bucket divided by the total number of intervals.

[0084] S1.3, extract abnormal traffic proportion A i .

[0085] (i) Define the abnormal request judgment rule on the speed limit node i;

[0086] (ii) Define a fixed time window t slide as the statistical period;

[0087] (iii) Clear the counter at the beginning of each time window, and read the number of abnormal requests num error_request and the total number of requests num request as the request number at the end of the window;

[0088] (iv) Abnormal traffic proportion A i ​​​The calculation formula of the resource consumption rate U is:

[0089]

[0090] S1.4, extract the resource consumption rate U i .

[0091] (i) define a fixed time window t as a statistical period; slide

[0092] (ii) record the local resource usage, CPU usage (percentage) U CPU and bandwidth usage (MB / s) U Bandwidth on the speed-limited node i;

[0093] (iii) collect the CPU usage average U slide and bandwidth usage average U avg_CPU of all nodes in the cluster within the statistical period t avg_Bandwidth ;

[0094] (iv) the calculation formula of the resource consumption rate U is: i

[0095]

[0096] wherein m1, m2>0, m1+m2=1, the weight parameters m1, m2 provide a default value of 0.5, which can also be modified according to the actual network.

[0097] Finally, the above extracted behavior features are constructed into a behavior feature quadruple {R i ,E i ,A i ,U i}.

[0098] S2, use the node clustering algorithm to obtain the distance from each speed-limited node to each cluster based on the behavior features, and select the nearest cluster according to the distance to divide the speed-limited node into a normal cluster and a malicious cluster.

[0099] S2.1, set the initialization parameters of the node clustering algorithm.

[0100] (i) set the number of all speed-limited nodes in the system N;

[0101] (ii) set the cluster size threshold CST.

[0102] S2.2, normalize the behavior feature quadruple.

[0103] (i) in the behavior feature quadruple {R i ,E i ,A i ,U​​i}max, where max and min represent the maximum and minimum value of each behavior feature, respectively.

[0104] (ii) Min-max normalization is performed on each dimension, and the calculation formula is:

[0105]

[0106] where {R i ′ ,E i ′ ,A ′ i ,U i ′} represents the normalized behavior feature quadruple, and the subscripts min and max represent the minimum and maximum values of each behavior feature, respectively.

[0107] S2.3, select the first initial node of each cluster.

[0108] (i) Calculate the number of initial normal clusters K, and the calculation formula is:

[0109]

[0110] (ii) Randomly select K speed-limited nodes as the first initial nodes of each initial normal cluster, and generate {C1, C2, C3, …, C K-2 C K-1 C K};

[0111] (iii) Add an initial malicious cluster, and generate a speed-limited node to join the initial malicious cluster, and set the value of the normalized behavior feature quadruple to {1, 0, 1, 1}.

[0112] S2.4, calculate the distance from each speed-limited node to each initial speed-limited node, and select the cluster with the shortest distance and join.

[0113] (i) Calculate the weighted Euclidean distance from each speed-limited node to the cluster nodes (including the initial nodes in the initial normal clusters and the initial malicious cluster), and the calculation formula is:

[0114]

[0115] where R ′ c , E c ′ , A ′ c , U c ′respectively represent the request frequency, request mode entropy, abnormal traffic ratio and resource consumption rate of each initial speed limit node c, m3, m4, m5, m6>0, m3+m4+m5+m6=1, the weight parameters m3, m4, m5, m6provide a default value of 0.25, which can also be modified according to the actual network;

[0116] (ii) Each speed limit node in turn selects the nearest cluster to join according to the weighted Euclidean distance, and obtains the normal cluster and the malicious cluster. If the number of nodes in the normal cluster exceeds the preset cluster size threshold CST, no new speed limit node is added to the cluster, and the new speed limit node is added to other clusters according to the distance sorting, so that the number of nodes in each cluster is relatively balanced.

[0117] S3, initialize the distributed speed limit parameters in each cluster, and use the distributed speed limit algorithm based on the distributed speed limit parameters to dynamically adjust the speed limit value of each speed limit node in each cluster.

[0118] S3.1, initialize the distributed speed limit parameters in each cluster.

[0119] (i) Initialize the initial total speed limit value B in each cluster;

[0120] (ii) Initialize the average degree speed limit value in each cluster The calculation formula is:

[0121]

[0122] Wherein, The average degree of the network topology graph is represented by N, and N represents the total number of nodes of the network topology graph.

[0123] (iii) Initialize the speed limit algorithm parameter value θ in each cluster.

[0124] S3.2, use the distributed speed limit algorithm to dynamically adjust the speed limit value of each speed limit node.

[0125] (i) Each node in the cluster obtains the same initial speed limit value (the initial total speed limit value B divided by the number of nodes), denoted as

[0126] (ii) Obtain the packet loss rate P of each speed limit node at time t, and the node receiving rate value r;

[0127] (iii) In the running process of the cluster, different machine nodes have different bandwidth demands. In order to ensure the fairness of bandwidth allocation, the node bandwidth value needs to be adjusted in real time according to the packet loss rate of each node. According to the node speed limit value of the speed limit node i at the current time t Wherein For the case of t = 0, the node speed limit value of the speed limit node i at the next time t + 1 is calculated The calculation formula is:

[0128]

[0129] Wherein, P i and P j respectively represent the packet loss rate of the speed limit node i and the speed limit node j belonging to the same cluster E at the time t, r i and r j respectively represent the node receiving rate value of the speed limit node i and the speed limit node j belonging to the same cluster E at the time t, max{·} represents the maximum value function, and θ takes the value of 0 to

[0130] If, when calculating the node speed limit value at the next time, it is found that:

[0131]

[0132] The excess reduction amount ex is calculated:

[0133]

[0134] The sum total of the node speed limit values of all speed limit nodes j adjacent to the speed limit node i at the time t is: B

[0135]

[0136] The speed limit value of each speed limit node j adjacent to the speed limit node i is adjusted, that is, the node speed limit value of the speed limit node j at the time t + 1 is: Adjusted according to the following formula:

[0137]

[0138] Wherein, min{·} represents the minimum value function.

[0139] If, when calculating the node speed limit value at the next time, it is found that:

[0140]

[0141] Then:

[0142]

[0143] That is, the speed limit node j keeps the original set speed limit value unchanged.

[0144] ​​The final goal of the distributed rate limiting algorithm in each cluster is to make the packet loss rate of each rate limiting node in the cluster consistent, and to achieve fair allocation of bandwidth.

[0145] S4. Real-time monitoring of each cluster, dynamic adjustment of the cluster size according to the number and behavior characteristics of the rate limiting nodes, and identification and processing of malicious nodes for malicious clusters.

[0146] S4.1, real-time monitoring of the cluster.

[0147] In the cloud network, there is malicious traffic, which will weaken the rate limiting capability of the cluster and increase the resource overhead of the system, so it is necessary to discover and process malicious nodes in time. Each cluster is continuously monitored to determine whether the judgment condition for triggering rate limiting adjustment is met. The judgment condition has two:

[0148] First, a large-scale failure of nodes results in too few nodes in a cluster: specifically, if the total number of nodes in a single cluster decreases by more than 50%, it is considered a large-scale failure, and a significant decrease in the number of nodes will result in a decrease in rate limiting capability;

[0149] Second, malicious nodes appear in a normal cluster: specifically, if the resource consumption U i of the i-th rate limiting node in a single cluster is greater than 3.0 and lasts for more than 10 seconds, or the request frequency R i of the i-th rate limiting node is more than 5 times the average value of the cluster, it is considered a malicious node;

[0150] If at least one of the above judgment conditions is triggered, dynamic adjustment of the cluster size is performed.

[0151] S4.2, dynamic adjustment of the cluster size.

[0152] Node failures also exist in the cluster, which will destroy the stability of the original cluster, so dynamic adjustment is needed to adjust the existing normal and malicious clusters, including:

[0153] (i) According to the number of rate limiting nodes, for clusters that have experienced a large-scale failure, the rate limiting nodes are merged into the nearest normal cluster;

[0154] (ii) According to the behavior characteristics of the rate limiting nodes, for newly discovered malicious nodes, they are added to the malicious cluster with the fewest nodes. If there is no malicious cluster at present, a new malicious cluster will be created, and the newly discovered malicious node will be the initial node of the new malicious cluster.

[0155] S4.3, malicious traffic node identification.

[0156] (i) In the whole system, a malicious traffic identification module is constructed by a machine learning method to make a secondary judgment on the malicious nodes, which can judge whether a node is malicious by the malicious traffic, and accurately identify the malicious nodes in the malicious traffic cluster;

[0157] (ii) When the malicious traffic identification module judges that a speed limiting node is a malicious node, the speed limiting value is lowered, and a warning is sent in the system, asking the operator to judge whether to keep or add the node to the blacklist;

[0158] (iii) When the operator adds the malicious node identified by the secondary judgment to the blacklist, the malicious node will be deleted from the malicious cluster, and real-time monitoring and dynamic adjustment of the cluster will be continued to balance the size of each cluster.

[0159] Finally, the above steps S3-S4 are repeated until a command to stop speed limiting is received.

[0160] In summary, the decentralized speed limiting method for malicious network attacks provided by the embodiment of the application can accurately divide normal clusters and malicious clusters based on node behavior characteristics, significantly improve the identification ability of abnormal malicious traffic in a decentralized distributed system, and enhance the ability of the system to resist network attacks; based on the cluster size dynamic adjustment strategy of the distributed speed limiting algorithm, the overall computing efficiency of the system can be improved, the management complexity can be reduced, and the security, stability and resource allocation efficiency of the distributed system can be improved; further combined with the malicious node judgment and processing of the malicious traffic identification, the resource allocation fairness of each node is dynamically balanced while the stability of the system is ensured, the occupation of system resources by malicious nodes is effectively reduced, and the overall service quality of the decentralized network is further optimized.

[0161] Based on the same inventive concept, as shown in Figure 2 The embodiment of the application also provides a decentralized speed limiting device 200 for malicious network attacks, which comprises a node feature extraction module 210, a cluster clustering processing module 220, a node speed limiting adjustment module 230, a cluster dynamic adjustment module 240 and a malicious traffic identification module 250.

[0162] The node feature extraction module 210 is used to extract the behavior characteristics of the speed limiting nodes in the decentralized distributed system, and the behavior characteristics include the request frequency, the request mode entropy, the abnormal traffic proportion and the resource consumption rate.

[0163] The cluster clustering processing module 220 is used to obtain the distance of each speed limiting node to each cluster based on the behavior characteristics by using a node clustering algorithm, and divide the speed limiting nodes into normal clusters and malicious clusters according to the distance.

[0164] The node speed-limiting adjustment module 230 is configured to initialize distributed speed-limiting parameters in each cluster, and to dynamically adjust the speed-limiting values of each speed-limiting node based on the distributed speed-limiting parameters by using a distributed speed-limiting algorithm in each cluster.

[0165] The cluster dynamic adjustment module 240 is configured to monitor each cluster in real time, and to dynamically adjust the cluster size according to the number and behavior characteristics of the speed-limiting nodes.

[0166] The malicious traffic identification module 250 is configured to identify and process malicious nodes for malicious clusters.

[0167] As shown in Figure 3 The decentralized speed-limiting device 200 provided by the embodiment of the present application is deployed in a cloud network environment, and can support global data interaction, distributed storage and real-time processing, and includes gateway, controller, switch, machine and other cloud network components, and each machine is regarded as a speed-limiting node.

[0168] Based on the same inventive concept, the embodiment of the present application further provides an electronic device including a memory and one or more processors, the memory is configured to store a computer program, and the processor is configured to implement the above-mentioned decentralized speed-limiting method for malicious network attacks when executing the computer program.

[0169] It should be noted that the decentralized speed-limiting device for malicious network attacks and the electronic device provided by the above-mentioned embodiments, and the decentralized speed-limiting method for malicious network attacks belong to the same inventive concept, and the specific implementation process is described in the embodiment of the decentralized speed-limiting method for malicious network attacks, which will not be repeated here.

[0170] The specific implementation process of the above-mentioned embodiments has been described in detail, and it should be understood that the above-mentioned embodiments are only the most preferred embodiments of the present application, and are not used to limit the present application, and any modification, supplement and equivalent replacement within the principle range of the present application should be included in the protection range of the present application.

Claims

1. A decentralized rate limiting method against malicious cyber attacks, characterized in that, The method comprises the following steps: extracting behavior characteristics of the speed-limiting nodes in the decentralized distributed system, the behavior characteristics including request frequency, request mode entropy, abnormal traffic proportion, and resource consumption rate; using a node clustering algorithm to obtain distances of each speed-limiting node to each cluster based on the behavior characteristics, and selecting the nearest cluster to divide the speed-limiting nodes into normal clusters and malicious clusters according to the distances; Initialize distributed rate limiting parameters within each cluster. Within each cluster, use a distributed rate limiting algorithm to dynamically adjust the rate limiting value of each rate limiting node based on these parameters. This includes: adjusting the initial total rate limiting value within each cluster. Determine the rate-limiting nodes within the cluster. Initial speed limit According to the speed limit node At the present moment Node speed limit ,in for Given the current situation, calculate the next time step. Speed ​​limit nodes Node speed limit The calculation formula is: ， wherein, and respectively denote a speed-limited node belonging to the same cluster and a speed-limited node respectively denote a speed-limited node belonging to the same cluster and a speed-limited node respectively denote the packet loss rate at time and respectively denote a speed-limited node belonging to the same cluster and a speed-limited node respectively denote a speed-limited node belonging to the same cluster and a speed-limited node respectively denote the node reception rate value at time denotes the max function; if, when calculating the node speed-limiting value at the next moment, it is found that: ， then calculate the excess reduction amount : ， then all nodes with speed limit adjacent to the node with speed limit at time the sum of the node speed limit values of the nodes adjacent to the node with speed limit is: ， then for the speed limited node adjacent to the speed limited node the speed limit value is adjusted, i.e. the speed limited node at the node speed limit value at the time instant is adjusted according to the following formula: ， wherein denotes the min function; if, when calculating the node speed-limiting value at the next moment, it is found that: ， then: ， Speed limit node The original set speed limit value is kept unchanged; monitoring each cluster in real time, dynamically adjusting the cluster size according to the number of speed-limiting nodes and the change of the behavior characteristics, and identifying and processing malicious nodes in the malicious clusters.

2. The method of claim 1, wherein, The step of using a node clustering algorithm to obtain distances of each speed-limiting node to each cluster based on the behavior characteristics, and selecting the nearest cluster to divide the speed-limiting nodes into normal clusters and malicious clusters according to the distances comprises: calculating the number of initial normal clusters and randomly selecting speed-limited nodes as the first initial nodes of the initial normal clusters, respectively; adding an initial malicious cluster, and generating a speed-limiting node with non-zero request frequency, abnormal traffic proportion, and resource consumption rate and zero request mode entropy as an initial node of the initial malicious cluster; calculating distances of each speed-limiting node to initial nodes in the initial normal cluster and the initial malicious cluster, and adding each speed-limiting node to the nearest cluster to obtain the normal clusters and the malicious clusters; if the number of nodes in the normal cluster exceeds a preset cluster size threshold, no new speed-limiting node is added to the cluster, and the new speed-limiting node is added to other clusters in distance order.

3. The method of claim 1, wherein, The distributed speed-limiting parameters in each cluster comprise: initial total speed limit value , average degree speed limit value , and speed limit algorithm parameter value , wherein the average degree speed limit value is calculated according to the following formula: ， wherein, denotes the average degree of the nodes of the network topology graph, denotes the total number of nodes of the network topology graph.

4. The method of claim 1, wherein, The step of monitoring each cluster in real time comprises: continuously monitoring each cluster and judging whether a judgment condition for speed-limiting adjustment is triggered, the judgment condition including that a large-area node failure causes a node number in a cluster to be too small, and / or a malicious node appears in a normal cluster, and if the judgment condition is triggered, performing a dynamic adjustment operation on the cluster size; wherein, for the judgment condition that a large-area node failure causes a node number in a cluster to be too small, if the total number of nodes in a single cluster is reduced by more than 50%, it is determined that a large-area failure occurs, and a significant decrease in the number of nodes will cause a decrease in speed-limiting capability.

5. The method of claim 4, wherein, The condition for determining the presence of a malicious node in a normal cluster is set as follows: if the first malicious node in a single cluster... Resource consumption of each rate-limited node And lasting longer than 10 seconds, or the first Request frequency of rate-limited nodes If the value exceeds 5 times the cluster average, it is considered a malicious node.

6. The method of claim 1 or 4, wherein, The step of dynamically adjusting the cluster size according to the number of speed-limiting nodes and the change of the behavior characteristics comprises: according to the change of the number of speed-limiting nodes, merging the speed-limiting nodes in a cluster where a large-area failure occurs to the nearest normal cluster; according to the change of the behavior characteristics of the speed-limiting nodes, adding a newly found malicious node to a malicious cluster with the least number of nodes, and if there is no malicious cluster, creating a new malicious cluster, and taking the newly found malicious node as an initial node of the new malicious cluster.

7. The method of claim 1 or 4, wherein, The step of identifying and processing malicious nodes in the malicious clusters comprises: performing a secondary judgment on the malicious nodes in the malicious clusters based on malicious traffic identification, and if the malicious nodes are confirmed, reducing the speed-limiting value, and issuing a warning in the system to ask an operator to judge whether to keep or add the nodes to a blacklist; when the operator adds the malicious nodes identified by the secondary judgment to the blacklist, the malicious nodes are deleted from the malicious clusters, and then the real-time monitoring and dynamic adjustment of the clusters are continuously performed.

8. A decentralized rate limiting device against malicious cyber attacks, implemented by using the method of any one of claims 1-7. The method comprises the following steps: The node feature extraction module, the cluster clustering processing module, the node speed limit adjustment module, the cluster dynamic adjustment module, and the malicious traffic identification module; The node feature extraction module is configured to extract behavior features of the speed limit nodes in the decentralized distributed system, the behavior features including request frequency, request mode entropy, abnormal traffic proportion, and resource consumption rate; The cluster clustering processing module is configured to obtain distances from each speed limit node to each cluster based on the behavior features by using a node clustering algorithm, and divide the speed limit nodes into normal clusters and malicious clusters according to the distances; The node speed limit adjustment module is configured to initialize distributed speed limit parameters in each cluster, and dynamically adjust speed limit values of the speed limit nodes in each cluster based on the distributed speed limit parameters by using a distributed speed limit algorithm; The cluster dynamic adjustment module is configured to monitor each cluster in real time, and dynamically adjust a cluster size according to a number of the speed limit nodes and changes in the behavior features; The malicious traffic identification module is configured to identify and process malicious nodes in the malicious clusters.

9. An electronic device comprising a memory and one or more processors, the memory to store a computer program, wherein, The processor is configured to implement the malicious network attack-oriented decentralized speed limiting method according to any one of claims 1 to 7 when executing the computer program.

Images