Defense method and device for coping with DDoS attack, equipment and medium

Abstract

The invention relates to the technical field of network security, in particular to a defense method and device for coping with DDoS attacks, equipment and a medium. According to the method, in response to an adjustment request of a defense strategy for the DDoS attack, a performance evaluation result of each node in the same block chain network is obtained, the performance evaluation result of any node is a performance score determined by the node based on network performance data of the node, and the performance score is used for evaluating the service capability of the node; the performance evaluation result of each node is input into a pre-constructed target function, and in combination with a preset constraint condition, optimal scheduling parameters in the target function are solved by taking maximization of the whole network service quality as an optimization target, and the scheduling parameters comprise priority weights of each node for processing various services and resource weights allocated by each node for various services; and sending the optimal scheduling parameter to the corresponding node, so that each node adjusts a defense strategy of the DDoS attack according to the optimal scheduling parameter to defend the DDoS attack.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a defense method, device, equipment and medium for coping with DDoS attacks. Background Art

[0002] In the field of network security technology, Distributed Denial of Service (DDoS) attack is a common network attack.

[0003] DDoS attacks usually paralyze the network or key nodes quickly in a short period of time through a large number of requests or flooding attack traffic.

[0004] In the prior art, blockchain is used to enhance the network's anti-attack capabilities due to its decentralized nature. However, since blockchain requires distributed network nodes to vote and make decisions during operation, when a network attack occurs, the application layer is prone to problems such as the quality of service (QoS) cannot be effectively guaranteed, and even leads to excessive consumption or uneven distribution of system resources. Summary of the invention

[0005] The embodiments of the present application provide a defense method, device, equipment and medium for coping with DDoS attacks, which are used to solve the problems in the prior art that, when a DDoS attack occurs, the quality of service (QoS) at the application layer cannot be effectively guaranteed, and even leads to excessive consumption or uneven distribution of system resources.

[0006] In a first aspect, the present application provides a defense method for dealing with DDoS attacks, the method comprising:

[0007] In response to a request to adjust a defense strategy against DDoS attacks, obtaining a performance evaluation result of each node in the same blockchain network, wherein the performance evaluation result of any node is a performance score determined by the node based on network performance data of the node, and the performance score is used to evaluate the service capability of the node;

[0008] Input the performance evaluation results of each node into a pre-constructed objective function, combine the pre-set constraints, and solve the optimal scheduling parameters in the objective function with maximizing the service quality of the entire network as the optimization goal, wherein the scheduling parameters include the priority weights of each node processing each type of service and the resource weights allocated by each node to each type of service;

[0009] The optimal scheduling parameters are sent to corresponding nodes, so that each node adjusts the DDoS attack defense strategy according to the optimal scheduling parameters to defend against the DDoS attack.

[0010] In some embodiments, each node determines the performance evaluation result of the node in the following manner:

[0011] Based on a preset acquisition period, obtain the network performance data of the node; the network performance data includes one or more of traffic load, communication delay, packet loss rate, and traffic mutation characteristics;

[0012] Based on the traffic load of the node and the historical maximum bandwidth value of the node, determine the resource utilization rate index of the node;

[0013] Based on the communication delay of the node and the historical maximum delay value of the node, determine the communication quality deviation index of the node;

[0014] Based on the packet loss rate of the node and the historical maximum packet loss rate of the node, determine the data transmission reliability index of the node;

[0015] Based on the traffic mutation characteristics of the node and the mutation time period corresponding to the traffic mutation characteristics, determine the behavior fluctuation index of the node;

[0016] Based on one or more of the resource utilization rate index, the communication quality deviation index, the data transmission reliability index, the behavior fluctuation index, etc. of the node and the weights corresponding to each index, determine the performance evaluation result of the node.

[0017] In some embodiments, after determining the performance evaluation result of the node, it further includes:

[0018] Generate a block based on the performance evaluation result of the node;

[0019] Add the block to the blockchain.

[0020] In some embodiments, a target function is pre-constructed in the following manner:

[0021] Based on the performance evaluation results of the nodes and the priority weight of each node for processing each service, determine the priority service quality item in the target function; the priority service quality item is used to characterize the influence of priority and node performance on service quality;

[0022] Based on the performance evaluation indexes of the nodes and the resource weights allocated by each node for each service, determine the resource service quality item in the target function; the resource service quality item is used to characterize the influence of resource allocation ratio and node performance on service quality;

[0023] Based on the priority service quality item and the resource service quality item and the weights corresponding to each item, with the optimization goal of maximizing the network-wide service quality, construct the target function.

[0024] In some embodiments, inputting the performance evaluation results of the respective nodes into a pre-constructed objective function, combining with pre-set constraint conditions, and taking maximizing the network-wide service quality as the optimization objective to solve for the optimal scheduling parameters in the objective function includes:

[0025] Taking the performance evaluation results of the respective nodes as input parameters and inputting them into the objective function;

[0026] According to the pre-set constraint conditions, using a preset iterative solution algorithm to perform iterative calculations on the initial scheduling parameters in the objective function, and updating the scheduling parameters according to the current gradient direction and learning rate during each iteration;

[0027] When a preset convergence condition is met, stop the iterative process and determine the currently obtained scheduling parameters as the optimal scheduling parameters, where the convergence conditions include that the gradient norm is less than a preset threshold and the number of iterations reaches a preset number.

[0028] In a second aspect, the present application provides a defense device for coping with DDoS attacks, and the device includes:

[0029] An acquisition module, configured to obtain the performance evaluation results of each node located in the same blockchain network in response to an adjustment request for a defense strategy against DDoS attacks, where the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service ability of the node;

[0030] A calculation module, configured to input the performance evaluation results of the respective nodes into a pre-constructed objective function, combine with pre-set constraint conditions, and take maximizing the network-wide service quality as the optimization objective to solve for the optimal scheduling parameters in the objective function, where the scheduling parameters include the priority weights for each node to process various services and the resource weights allocated by each node for the various services;

[0031] An adjustment module, configured to send the optimal scheduling parameters to the corresponding nodes, so that each node adjusts the defense strategy against DDoS attacks according to the optimal scheduling parameters to defend against the DDoS attacks.

[0032] In some embodiments, each node determines the performance evaluation result of the node in the following manner:

[0033] Based on a preset collection period, obtain the network performance data of the node; the network performance data includes one or more of traffic load, communication delay, packet loss rate, and traffic mutation characteristics;

[0034] Determine the resource utilization rate index of the node based on the traffic load of the node and the historical maximum bandwidth value of the node;

[0035] Determine the communication quality deviation index of the node based on the communication delay of the node and the historical maximum delay value of the node;

[0036] Determine the data transmission reliability index of the node based on the packet loss rate of the node and the historical maximum packet loss rate of the node;

[0037] Determine the behavior fluctuation index of the node based on the traffic mutation characteristics of the node and the mutation time period corresponding to the traffic mutation characteristics;

[0038] Determine the performance evaluation result of the node based on one or more of the resource utilization rate index, the communication quality deviation index, the data transmission reliability index, the behavior fluctuation index, and the weights corresponding to each index.

[0039] In some embodiments, after determining the performance evaluation result of the node, each node is further configured to:

[0040] Generate a block based on the performance evaluation result of the node;

[0041] Add the block to the blockchain.

[0042] In some embodiments, the objective function is pre-constructed in the following manner:

[0043] Determine the priority service quality item in the objective function based on the performance evaluation results of the nodes and the priority weight of each node for processing each service; the priority service quality item is used to characterize the influence of priority and node performance on service quality;

[0044] Determine the resource service quality item in the objective function based on the performance evaluation metrics of the nodes and the resource weights assigned by each node for each service; the resource service quality item is used to characterize the influence of resource allocation ratio and node performance on service quality;

[0045] Construct the objective function with the goal of maximizing the network-wide service quality based on the priority service quality item, the resource service quality item, and the weights corresponding to each item.

[0046] In some embodiments, the calculation module is specifically configured to:

[0047] Input the performance evaluation results of the nodes as input parameters into the objective function;

[0048] According to the preset constraint conditions, an initial scheduling parameter in the objective function is iteratively calculated by using a preset iterative solution algorithm, and the scheduling parameter is updated according to the current gradient direction and learning rate in each iteration process;

[0049] When a preset convergence condition is satisfied, the iterative process is stopped, and the currently obtained scheduling parameter is determined as the optimal scheduling parameter, where the convergence condition includes that the gradient norm is less than a preset threshold and the number of iterations reaches a preset number.

[0050] In a third aspect, the present application provides an electronic device, including: at least one processor, and a memory communicatively connected to the at least one processor, where:

[0051] The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor is enabled to execute any of the above methods for defending against DDoS attacks.

[0052] In a fourth aspect, an embodiment of the present application provides a storage medium, and when a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute any of the above methods for defending against DDoS attacks.

[0053] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, any of the above methods for defending against DDoS attacks is implemented.

[0054] In an embodiment of the present application, in response to a request for adjusting a defense strategy against a DDoS attack, performance evaluation results of each node in the same blockchain network are obtained, where the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service capability of the node; the performance evaluation results of each node are input into a pre-constructed objective function, combined with preset constraint conditions, and with maximizing the overall network service quality as the optimization objective, the optimal scheduling parameters in the objective function are solved, and the scheduling parameters include the priority weights of each node for processing various services and the resource weights allocated by each node for various services; the optimal scheduling parameters are sent to the corresponding nodes, so that each node adjusts the defense strategy against the DDoS attack according to the optimal scheduling parameters to defend against the DDoS attack. In this way, in response to a request for adjusting a defense strategy against a DDoS attack, by combining the performance evaluation results of each node, the priority weights and resource allocation weights of application services are dynamically adjusted, which can effectively improve the anti-attack ability of the system and the stability of the service, so that when a DDoS attack occurs, the quality of service (QoS) of the application layer can be effectively guaranteed, and the problems of excessive consumption or unbalanced allocation of system resources are effectively avoided.

[0055] Other features and advantages of the present invention will be set forth in the following description, and in part will be obvious from the description, or may be learned by practice of the present invention. The objectives and other advantages of the present invention may be realized and attained by the structure particularly pointed out in the written description, claims, as well as the drawings. Description of the Drawings

[0056] The drawings described herein are provided to further understand the present application and form a part of the present application. The schematic embodiments and descriptions thereof of the present application are used to explain the present application and do not constitute an improper limitation to the present application. In the drawings:

[0057] Figure 1 A schematic diagram of a DDoS attack provided by an embodiment of the present application;

[0058] Figure 2 A flowchart of a defense method for coping with DDoS attacks provided by an embodiment of the present application;

[0059] Figure 3 A schematic diagram of a network topology provided by an embodiment of the present application;

[0060] Figure 4 A structural diagram of a defense device for coping with DDoS attacks provided by an embodiment of the present application;

[0061] Figure 5 A schematic diagram of the hardware structure of an electronic device for implementing a defense method for coping with DDoS attacks provided by an embodiment of the present application. Detailed Embodiments

[0062] To make the objectives, technical solutions and advantages of the present application more clear and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Apparently, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the scope of protection of the present application. Without conflict, the embodiments in the present application and the features in the embodiments may be arbitrarily combined with each other. And although the logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than here.

[0063] In the description and claims of this application and the above-mentioned drawings, the terms "first" and "second" are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally further include steps or units not listed, or may optionally further include other steps or units inherent to these processes, methods, products, or devices. "Multiple" in this application may mean at least two, for example, it may be two, three, or more, and the embodiments of this application do not make any restrictions.

[0064] The following describes exemplary embodiments of the present application with reference to the accompanying drawings. Various details of the embodiments of the present application are included to facilitate understanding, and they should be considered merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the disclosure of the present application. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of the present application, some industry-existing solutions such as certain software, components, models, etc. may be mentioned, and they should be considered exemplary. Their purpose is only to illustrate the feasibility in the implementation of the technical solutions of the present application, but it does not mean that the applicant has already or necessarily used this solution.

[0065] In the technical solutions of this application, the acquisition, transmission, storage, use, etc. of data all comply with the requirements of relevant national laws and regulations.

[0066] Before introducing the defense method for coping with DDoS attacks provided by the embodiments of the present application, for the convenience of understanding, some terms in the embodiments of the present application are explained below.

[0067] 1. DDoS attack: It refers to multiple attackers in different locations simultaneously launching attacks on one or several targets, or one attacker controlling multiple machines in different locations and using these machines to simultaneously attack the victim.

[0068] 2. Blockchain: It is a block-chain storage, immutable, secure and trustworthy decentralized distributed ledger. It combines technologies such as distributed storage, peer-to-peer transmission, consensus mechanism, and cryptography, and records transactions and information through an ever-growing data block chain to ensure the security and transparency of data.

[0069] 3. Convex optimization: It is a subfield of mathematical optimization that studies the problem of minimizing convex functions defined in convex sets. Convex optimization is applied in many disciplines, such as automatic control systems, signal processing, communications and networks, electronic circuit design, data analysis and modeling, statistics (optimal design), and finance.

[0070] 4. Quality of Service (QoS): refers to the ability of a network to use various basic technologies to provide better service capabilities for specified network communications.

[0071] The following is a brief introduction to the design concept of the embodiment of the present application:

[0072] In the field of network security technology, Distributed Denial of Service (DDoS) attack is a common network attack.

[0073] See also Figure 1 , Figure 1 A schematic diagram of a DDoS attack provided in an embodiment of the present application shows that, for attackers, IoT devices can be easily implanted with malicious programs remotely and then controlled to become a botnet that launches attacks. In addition to the damage to the IoT devices themselves, what is even more terrifying is that attackers manipulate these IoT devices to attack some servers, which allows DDoS attacks to quickly paralyze the network or key nodes in a short period of time. Therefore, defensive measures to deal with DDoS attacks are imminent.

[0074] In the prior art, blockchain is used to enhance the network's anti-attack capabilities due to its decentralized nature. However, since blockchain requires distributed network nodes to vote and make decisions during operation, when a network attack occurs, the application layer is prone to problems such as the quality of service (QoS) cannot be effectively guaranteed, and even leads to excessive consumption or uneven distribution of system resources.

[0075] In view of this, the embodiments of the present application provide a defense method, apparatus, device and medium for dealing with DDoS attacks, the method comprising: in response to a request for adjusting a defense strategy for DDoS attacks, obtaining performance evaluation results of each node in the same blockchain network, wherein the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service capability of the node; inputting the performance evaluation results of each node into a pre-constructed objective function, combining with pre-set constraints, and solving the optimal scheduling parameters in the objective function with maximizing the service quality of the entire network as the optimization goal, the scheduling parameters including the priority weights of each node for processing each type of service and the resource weights allocated by each node for each type of service; sending the optimal scheduling parameters to the corresponding nodes, so that each node adjusts the defense strategy for DDoS attacks according to the optimal scheduling parameters to defend against DDoS attacks.

[0076] In an embodiment of the present application, in response to a request for adjusting the defense strategy against DDoS attacks, by combining the performance evaluation results of each node, the priority weight and resource allocation weight of the application service are dynamically adjusted, which can effectively improve the anti-attack ability of the system and the stability of the service, so that when a DDoS attack occurs, the quality of service (QoS) of the application layer can be effectively guaranteed, and the problems of excessive consumption or unbalanced allocation of system resources are effectively avoided.

[0077] The preferred embodiments of the present application will be described below with reference to the accompanying drawings of the specification. It should be understood that the preferred embodiments described herein are only for the purpose of illustrating and explaining the present application, and are not used to limit the present application. And without conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0078] See Figure 2 , Figure 2 which is a flowchart of a defense method for coping with DDoS attacks provided by an embodiment of the present application. The method includes the following steps.

[0079] In step 201, in response to a request for adjusting the defense strategy against DDoS attacks, the performance evaluation results of each node located in the same blockchain network are obtained. Among them, the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service ability of the node.

[0080] Specifically, the request for adjusting the defense strategy against DDoS attacks can be triggered in various ways. For example, it can be set that when the system detects abnormal network traffic or receives an external security event alert, a request for adjusting the defense strategy will be triggered. For example, through traffic monitoring tools (such as firewalls, intrusion detection systems IDS / intrusion prevention systems IPS) deployed at the network edge or nodes, the traffic characteristics entering the network are monitored in real time. For example, if the traffic in a certain period significantly exceeds the historical average value or the preset threshold, it may indicate that a DDoS attack is in progress. Another example is that a large number of requests from the same IP address range, or the abnormal increase in the access volume of a specific port, etc. Once the above abnormal situations are detected, the system will automatically initiate a request for adjusting the defense strategy against DDoS attacks.

[0081] Specifically, it can also be set that each node can jointly decide whether to adjust the defense strategy through a consensus protocol. When most nodes detect similar abnormal traffic or behavior patterns, they can vote or reach a consensus to decide to take action.

[0082] In specific implementation, smart contracts can also be combined so that the entire system can trigger adjustment requests for DDoS attack defense strategies according to a preset period. The preset period can be half an hour, one hour, etc. In this way, instead of relying on traditional attack detection methods, it is directly optimized based on traffic characteristics, reducing the risks brought by misjudgment or missed judgment. This not only improves the automation level of the system but also enhances its adaptability to complex environmental changes, providing strong support for ensuring high-quality services.

[0083] In specific implementation, once an adjustment request for the DDoS attack defense strategy is triggered, the system can select one or more target nodes to be responsible for obtaining the performance evaluation results of other nodes in the same blockchain network. Among them, the target nodes can be statically specified. For example, several high-performance nodes are preset as target nodes, and these nodes automatically undertake the task of data collection each time the defense strategy adjustment request is triggered. The target nodes can also be dynamically generated. For example, according to the current network state and node performance scores, target nodes are dynamically selected through a consensus protocol or other election algorithms. For example, the node with the lowest current load and the highest performance score is selected as the target node. The target nodes can also be determined through a polling mechanism. For example, different nodes are alternately specified as target nodes in a polling manner to balance the workload of each node.

[0084] In specific implementation, the performance evaluation result of any node is the performance score determined by the node based on the network performance data of the node. The performance score is used to evaluate the service ability of the node, such as the overall health status and performance level. A higher score indicates that the node is in a good working state, while a lower score indicates that there may be performance bottlenecks or potential problems. Especially in a blockchain network, a higher node performance score means better data transmission efficiency and service availability, which is of great significance for ensuring transaction processing speed and reducing transaction confirmation time, etc.

[0085] In specific implementation, the network performance data includes one or more of traffic load, communication delay, packet loss rate, and traffic mutation characteristics. Among them, the traffic load refers to the amount of data processed by a network node, usually measured by the amount of data transmitted per second. The communication delay, also known as latency, refers to the time required for data to be sent from one node to another node. The packet loss rate represents the proportion of lost data packets in the total sent data packets during network transmission and is an important indicator for evaluating network reliability. The traffic mutation characteristic refers to the change situation of network traffic within a specific time period Δt.

[0086] In specific implementation, each node determines the performance evaluation result of the node through the following method:

[0087] Based on a preset acquisition period, obtain the network performance data of the node; based on the traffic load of the node and the historical maximum bandwidth value of the node, determine the resource utilization rate index of the node; based on the communication delay of the node and the historical maximum delay value of the node, determine the communication quality deviation index of the node; based on the packet loss rate of the node and the historical maximum packet loss rate of the node, determine the data transmission reliability index of the node; based on the traffic mutation characteristics of the node and the mutation time period corresponding to the traffic mutation characteristics, determine the behavior fluctuation index of the node; finally, based on one or more of the resource utilization rate index, communication quality deviation index, data transmission reliability index, and behavior fluctuation index, as well as the weights corresponding to each index, determine the performance evaluation result of the node.

[0088] For example, determine the performance score of the node through the following formula.

[0089]

[0090] Among them, S i represents the performance score of node i, B i is the traffic load, and its ratio to the historical maximum bandwidth value B max ,i is defined as the bandwidth occupancy rate of the node, that is, the resource utilization rate index in this application; D i is the communication delay of the node, and its ratio to the historical maximum delay value D max ,i is defined as the delay abnormality rate of the node, that is, the communication quality deviation index in this application; L i is the packet loss rate of the node, and its ratio to the historical maximum packet loss rate L max ,i is defined as the packet loss abnormality rate of the node, that is, the data transmission reliability index in this application; ΔT i is the traffic mutation characteristic of node i within the time period Δt, and their ratio represents the traffic change, that is, the behavior fluctuation index of the node in this application, and γ1, γ2, γ3, γ4 represent the weights corresponding to each index.

[0091] In specific implementation, based on the blockchain platform, after each node determines the performance evaluation result of the node, it can also periodically record its own performance score in the form of a block, add the block to the blockchain network to ensure the integrity and transparency of the data, and can also attach some additional information. For example, the block of node i is as follows:

[0092] Block i =(Timestamp i , Node i , S i , Transaction Hash i );

[0093] Among them, Timestamp i is the timestamp, Node i is the number of node i, S i represents the performance score of node i, Transaction Hash i is the unique identifier of the blockchain transaction.

[0094] Through this step, the system can dynamically perceive the performance evaluation results of each node in the network, providing a reliable basis for subsequent resource scheduling and defense strategy adjustment.

[0095] In step 202, the performance evaluation results of each node are input into the pre-constructed objective function, combined with the pre-set constraint conditions, with the optimization goal of maximizing the network-wide service quality, and the optimal scheduling parameters in the objective function are solved. The scheduling parameters include the priority weights of each node for processing various services and the resource weights allocated by each node for various services.

[0096] Specifically, when implementing, the performance evaluation results of each node can be used as key indicators to construct a convex optimization model, establish an objective function, and maximize the network-wide service quality QoS. Among them, the objective function can be constructed in the following way: Based on the performance evaluation results of each node and the priority weights of each node for processing each service, determine the priority service quality term in the objective function; the priority service quality term is used to characterize the influence of priority and node performance on service quality; based on the performance evaluation indicators of each node and the resource weights allocated by each node for each service, determine the resource service quality term in the objective function; the resource service quality term is used to characterize the influence of resource allocation ratio and node performance on service quality; based on the priority service quality term, the resource service quality term and the corresponding weights of each item, with the optimization goal of maximizing the network-wide service quality, construct the objective function.

[0097] For example, the formula of the objective function is as follows:

[0098] minf(x)=∑ i ∑ j (-λ1P ij S i -λ2W ij S i );

[0099] Among them, S i represents the performance score of node i, P ij represents the priority weight of node i for processing service j, W ij represents the resource weight allocated by node i for service j, λ1 and λ2 are weight coefficients used to adjust the importance between priority and resources. For example, λ1 = 0.7 and λ2 = 0.3, indicating that the influence of priority is greater, P ij S iCharacterize the impact of priority and node performance on quality of service. For services with higher priority and better node performance, the QoS is higher, W ij S i Characterize the impact of resource allocation ratio and node performance on quality of service. The higher the resource ratio and the better the node performance, the higher the QoS. In this objective function, P ij and W ij are decision variables, i.e., the scheduling parameters in this application.

[0100] Specifically, after determining the objective function, the performance evaluation results of each node can be used as input parameters and input into the objective function. According to the preset constraint conditions, a preset iterative solution algorithm is used to iteratively calculate the initial scheduling parameters in the objective function, and the scheduling parameters are updated according to the current gradient direction and learning rate during each iteration. When the preset convergence conditions are met, the iterative process is stopped, and the currently obtained scheduling parameters are determined as the optimal scheduling parameters, where the convergence conditions include that the gradient norm is less than a preset threshold and the number of iterations reaches a preset number.

[0101] Specifically, the preset constraint conditions can be set as follows:

[0102] ①:

[0103] ②: 0 ≤ P ij ≤ 1;

[0104] ③: ∑ j P ij = 1;

[0105] Among them, the above constraint conditions require that the bandwidth allocated to each service j on node i cannot exceed the maximum bandwidth value B max ,i of this node, to ensure that the sum of the bandwidths obtained by each service does not exceed the bandwidth capacity of the node, and P ij is between 0 and 1. 0 means that the node does not provide this service, 1 means that the node only provides this service, and the sum of the priority weight allocations of a node for various services it processes is 1.

[0106] Specifically, taking the gradient descent method as an example of the preset iterative solution algorithm, the optimal scheduling parameters are found through gradual iteration:

[0107] Among them, the update rule of the scheduling parameters for gradient descent is as follows:

[0108] P ij (t+1) = P ij (t) + η·λ1S i ;

[0109] Wij (t+1) = W ij (t) + η·λ2S i ;

[0110] Then perform gradient calculation. Among them, the partial derivatives of the objective function with respect to the scheduling parameters are respectively:

[0111]

[0112] Among them, t represents the number of iterations, η represents the step size (learning rate). By controlling the amplitude of each new time, the iteration interval is set. By continuously updating P along the gradient direction ij and W ij , so that the value of the objective function gradually approaches the maximum value. When the preset convergence condition is satisfied, the iteration process stops. For example, when the gradient norm is less than the preset threshold, it means that the gradient change is very small and it is meaningless to continue the iteration. Or, when the number of iterations reaches the preset number of times. For example, the maximum number of iterations is set to 100 times to prevent infinite loops or waste of computing resources. Once it is determined that the iteration stops, the current P ij and W ij are determined as the optimal scheduling parameters.

[0113] In step 203, send the optimal scheduling parameters to the corresponding nodes so that each node can adjust the DDoS attack defense strategy according to the optimal scheduling parameters to defend against DDoS attacks.

[0114] Specifically, when implementing, after obtaining the optimal scheduling parameters, these parameters can be classified and sorted according to the node identifier to ensure that each node can receive all the scheduling parameters related to it. Then, each node needs to perform corresponding defense strategy adjustment operations according to its own role and service type. Specifically, the node will make corresponding adjustments to its internal service scheduling strategy according to the assigned priority weight and resource weight. For example, increase the priority of a certain type of service and allocate more resources to a certain type of service, etc.

[0115] In this way, in response to the adjustment request of the DDoS attack defense strategy, combined with the performance evaluation results of each node, dynamically adjusting the priority weight and resource allocation weight of the application service can effectively improve the anti-attack ability of the system and the stability of the service, so that when a DDoS attack occurs, the quality of service (QoS) of the application layer can be effectively guaranteed, and the problem of excessive consumption or unbalanced allocation of system resources can be effectively avoided.

[0116] The above process will be introduced below with specific examples.

[0117] See Figure 3 , Figure 3A schematic diagram of a network topology provided by an embodiment of the present application, including a total of 8 nodes numbered from node 1 to node 8. Among them, node 1 is connected to node 2 and node 3, node 4 is connected to node 2, node 3, node 5, node 6, and node 7, and node 8 is connected to node 5, node 6, and node 7.

[0118] During specific implementation, the defense against DDoS attacks can be implemented according to the following steps.

[0119] First step: Each node obtains the network performance data of the node based on a preset collection period. Among them, taking network traffic data as an example, the communication delay, traffic load, and traffic mutation characteristics are used.

[0120] Assume that the network performance data of each node obtained is shown in Table 1.

[0121] Table 1

[0122]

[0123]

[0124] As shown in Table 1, the performance score of each node can be calculated through the following formula.

[0125]

[0126] For example, assume that γ1 = 0.3, γ2 = 0.3, γ3 = 0.4, B max ,i = 0.8 for all nodes, and the maximum delay value D max ,i = 15ms for all nodes. Then, the performance score of node 1 can be calculated in sequence as The performance score of node 2 is S2 = 0.61, the performance score of node 3 is S3 = 0.6325, the performance score of node 4 is S4 = 0.523, the performance score of node 5 is S5 = 0.769, the performance score of node 6 is S6 = 0.7623, the performance score of node 7 is S7 = 0.6768, and the performance score of node 8 is S8 = 0.6945. From the above results, it can be seen that due to high traffic load and large delay, the performance score of node 4 is the lowest, and the performance score of node 5 is the highest because all indicators are balanced and the traffic change is small.

[0127] Based on the blockchain platform, after each node determines the performance score of the node, it can also periodically record its own performance score in the form of a block and attach some additional information to ensure the integrity and transparency of the data, and add the block to the blockchain network. Among them, the attached additional information includes a timestamp, a node number, and a unique identifier of the blockchain transaction.

[0128] Step 2: Embed the defense method against DDoS attacks into the smart contract so that the entire system can automatically trigger an adjustment request for the defense strategy against DDoS attacks according to a preset cycle. Moreover, assume that Node 5 is the target node responsible for obtaining the performance evaluation results of other nodes in the same blockchain network and executing the subsequent solution process.

[0129] In response to the adjustment request for the defense strategy against DDoS attacks, Node 5 obtains the performance scores of other nodes.

[0130] Step 3: Node 5 inputs the performance evaluation results of all nodes into the pre-constructed objective function, combines the pre-set constraint conditions, and takes maximizing the quality of service of the entire network as the optimization goal to solve the optimal scheduling parameters in the objective function.

[0131] Among them, the pre-constructed objective function is:

[0132] minf(x)=∑ i ∑ j (-λ1P ij S i -λ2W ij S i );

[0133] Among them, S i represents the performance score of Node i, P ij represents the priority weight of Node i for processing Service j, W ij represents the resource weight assigned by Node i for Service j. λ1 and λ2 are weight coefficients used to adjust the importance between priority and resources. For example, λ1 = 0.7 and λ2 = 0.3, indicating that the influence of priority is greater. P ij S i characterizes the influence of priority and node performance on the quality of service. The better the performance of the node and the higher the priority of the service, the higher the QoS. W ij S i characterizes the influence of resource allocation ratio and node performance on the quality of service. The higher the resource ratio and the better the performance of the node, the higher the QoS. In this objective function, P ij and W ij are decision variables, that is, the scheduling parameters in this application.

[0134] And, the pre-set constraint conditions can be set as:

[0135] ①:

[0136] ②: 0≤P ij ≤1;

[0137] ③: ∑ j P ij= 1;

[0138] Among them, the above constraint requires that the bandwidth allocated to each service j on node i cannot exceed the maximum bandwidth value B max ,i, to ensure that the sum of the bandwidths obtained by each service does not exceed the bandwidth capacity of the node, while P ij is between 0 and 1. 0 means that the node does not provide this service, 1 means that the node only provides this service, and the sum of the priority weight allocations of a node for various services it processes is 1.

[0139] In specific implementation, the gradient descent method can be used to find the optimal scheduling parameters through gradual iteration:

[0140] Among them, the update rules of the scheduling parameters for gradient descent are as follows:

[0141] P ij (t+1) = P ij (t) + η·λ1S i ;

[0142] W ij (t+1) = W ij (t) + η·λ2S i ;

[0143] Then perform gradient calculation. Among them, the partial derivatives of the objective function with respect to the scheduling parameters are respectively:

[0144]

[0145] Among them, t represents the number of iterations, η represents the step size (learning rate), and by controlling the amplitude of each new time, the iteration interval is set. By continuously updating P ij and W ij along the gradient direction, the value of the objective function gradually approaches the maximum value. When the preset convergence condition is met, the iteration process stops. For example, when the gradient norm is less than the preset threshold, it means that the gradient change is already very small, and it is meaningless to continue the iteration. Or, when the number of iterations reaches the preset number, for example, the maximum number of iterations is set to 100 times, to prevent infinite loops or waste of computing resources. Once it is determined that the iteration stops, the current P ij and W ij are determined as the optimal scheduling parameters.

[0146] Fourth step: Node 5 sends the optimal scheduling parameters to the corresponding nodes so that each node can adjust the DDoS attack defense strategy according to the optimal scheduling parameters to defend against DDoS attacks.

[0147] In specific implementation, after the defense mechanisms at other levels become effective, the QoS differences between the current defense strategy and the previous one can also be evaluated for feedback adjustment. Based on the historical records of multiple rounds of defense, the system further adjusts the service optimization strategy to ensure automatic adaptation and optimization of the next service resource allocation and priority setting in future attacks or traffic fluctuations.

[0148] In the embodiments of the present application, based on traffic monitoring and real-time data collection technologies, using blockchain data records, the traffic characteristics of all network nodes are collected, and QoS indicators such as bandwidth, latency, and packet loss rate are monitored in real time to improve the accuracy and real-time performance of attack recognition, providing basic data support for subsequent QoS optimization; based on convex optimization theory and indicators such as traffic characteristics, latency, and bandwidth information, a multi-objective optimization function with traffic priority, latency minimization, and service stability as objectives is constructed using a multi-objective optimization model, effectively improving the service capacity and guarantee ability of the network; based on smart contract and blockchain technologies, the QoS guarantee strategy is automatically executed using the smart contract trigger mechanism to ensure the rapid response and execution of various QoS strategies, improving the defense efficiency; based on the feedback mechanism and real-time optimization, using attack feedback information and defense records, the QoS guarantee strategy is dynamically adjusted to improve the adaptive ability and long-term stability of the defense system, ensuring the continuous and efficient operation of the system under different attack intensities.

[0149] Based on the same inventive concept, the embodiments of the present application provide a defense device against DDoS attacks. The principle of the defense device against DDoS attacks to solve problems is similar to that of the above-mentioned defense method against DDoS attacks. Therefore, the implementation of the defense device against DDoS attacks can refer to the implementation of the defense method against DDoS attacks, and the repeated parts will not be described again.

[0150] Please refer to Figure 4 , Figure 4 FIG. is a structural diagram of a defense device against DDoS attacks provided by the embodiments of the present application. The device includes:

[0151] An acquisition module 401, configured to obtain the performance evaluation results of each node in the same blockchain network in response to an adjustment request for a defense strategy against DDoS attacks, where the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service ability of the node;

[0152] A calculation module 402, configured to input the performance evaluation results of the nodes into a pre-constructed objective function, and combine pre-set constraint conditions to solve the optimal scheduling parameters in the objective function with the maximization of the overall network service quality as the optimization objective, where the scheduling parameters include the priority weights of each node for processing various services and the resource weights allocated by each node for the various services;

[0153] An adjustment module 403, configured to send the optimal scheduling parameters to corresponding nodes, so that each node adjusts the defense strategy against the DDoS attack according to the optimal scheduling parameters to defend against the DDoS attack.

[0154] In some embodiments, each node determines the performance evaluation result of the node in the following manner:

[0155] Based on a preset collection period, obtain the network performance data of the node; the network performance data includes one or more of traffic load, communication delay, packet loss rate, and traffic mutation characteristics;

[0156] Based on the traffic load of the node and the historical maximum bandwidth value of the node, determine the resource utilization rate index of the node;

[0157] Based on the communication delay of the node and the historical maximum delay value of the node, determine the communication quality deviation index of the node;

[0158] Based on the packet loss rate of the node and the historical maximum packet loss rate of the node, determine the data transmission reliability index of the node;

[0159] Based on the traffic mutation characteristic of the node and the mutation time period corresponding to the traffic mutation characteristic, determine the behavior fluctuation index of the node;

[0160] Based on one or more of the resource utilization rate index, the communication quality deviation index, the data transmission reliability index, and the behavior fluctuation index, and the weights corresponding to each index, determine the performance evaluation result of the node.

[0161] In some embodiments, after determining the performance evaluation result of the node, each node is further configured to:

[0162] Generate a block based on the performance evaluation result of the node;

[0163] Add the block to the blockchain.

[0164] In some embodiments, a target function is pre-constructed in the following manner:

[0165] Based on the performance evaluation results of the nodes and the priority weight of each node for processing each service, determine the priority service quality item in the target function; the priority service quality item is used to characterize the influence of priority and node performance on service quality;

[0166] Determine the resource service quality item in the objective function based on the performance evaluation metrics of each node and the resource weights assigned by each node to each service; the resource service quality item is used to characterize the impact of the resource allocation ratio and node performance on the service quality.

[0167] Based on the priority service quality item, the resource service quality item, and the corresponding weights of each item, with maximizing the network-wide service quality as the optimization objective, construct the objective function.

[0168] In some embodiments, the calculation module 402 is specifically configured to:

[0169] Take the performance evaluation results of each node as input parameters and input them into the objective function.

[0170] According to the preset constraint conditions, use a preset iterative solution algorithm to iteratively calculate the initial scheduling parameters in the objective function, and update the scheduling parameters according to the current gradient direction and learning rate during each iteration.

[0171] When the preset convergence conditions are met, stop the iterative process, and determine the currently obtained scheduling parameters as the optimal scheduling parameters, where the convergence conditions include that the gradient norm is less than a preset threshold and the number of iterations reaches a preset number.

[0172] The division of modules in the embodiments of the present application is illustrative. It is only a logical function division. In actual implementation, there may be other division methods. In addition, each functional module in the embodiments of the present application can be integrated in one processor, or can exist separately physically, or two or more modules can be integrated in one module. The coupling between each module can be realized through some interfaces, and these interfaces are usually electrical communication interfaces, but it does not exclude the possibility of being mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and can be located in one place or distributed to different positions of the same or different devices. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0173] After introducing the defense method and device for coping with DDoS attacks in the exemplary embodiments of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0174] Next, refer to Figure 5 to describe the electronic device 130 implemented according to this embodiment of the present application. Figure 5 The displayed electronic device 130 is only an example and should not bring any restrictions to the functions and usage ranges of the embodiments of the present application.

[0175] As shown Figure 5 As shown, the electronic device 130 is presented in the form of a general electronic device. The components of the electronic device 130 may include, but are not limited to: the at least one processor 131 described above, the at least one memory 132 described above, and a bus 133 that connects different system components (including the memory 132 and the processor 131).

[0176] The bus 133 represents one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a processor, or a local bus using any bus structure in a variety of bus structures.

[0177] The memory 132 may include a readable medium in the form of volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322, and may further include a read-only memory (ROM) 1323.

[0178] The memory 132 may also include a program / utilities 1325 having a set (at least one) of program modules 1324. Such program modules 1324 include, but are not limited to: an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment.

[0179] The electronic device 130 may also communicate with one or more external devices 134 (such as a keyboard, a pointing device, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or may communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (such as a router, a modem, etc.). Such communication may be performed through an input / output (I / O) interface 135. And, the electronic device 130 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 136. As shown in the figure, the network adapter 136 communicates with other modules for the electronic device 130 through the bus 133. It should be understood that although not shown in the figure, other hardware and / or software modules may be used in combination with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0180] In an exemplary embodiment, the electronic device of the present application may at least include at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, it can cause the at least one processor to execute the steps of any defense method for coping with DDoS attacks provided by the embodiments of the present application.

[0181] In an exemplary embodiment, a storage medium is further provided. When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the above-mentioned defense method for coping with DDoS attacks. Optionally, the storage medium may be a non-transitory computer-readable storage medium. For example, the non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0182] In an exemplary embodiment, a computer program product is further provided. When the computer program product is executed by an electronic device, the electronic device can implement any one of the defense methods for coping with DDoS attacks provided by the present application.

[0183] It should be noted that although several modules or sub-modules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more of the above-described modules may be embodied in one module. Conversely, the features and functions of one module described above may be further divided and embodied by multiple modules.

[0184] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the illustrated operations must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution.

[0185] Those skilled in the art should understand that the embodiments of the present application may be provided as a method, a system, or a computer program product. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0186] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications once they learn the basic creative concept. Therefore, the appended claims are intended to be construed as including the preferred embodiments as well as all changes and modifications that fall within the scope of the present application.

[0187] Obviously, those skilled in the art can make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application also includes these modifications and variations.

Claims

1. A defense method against DDoS attacks, characterized in that, Including: In response to an adjustment request for a defense strategy against DDoS attacks, obtain the performance evaluation results of each node in the same blockchain network, where the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service ability of the node; Input the performance evaluation results of the nodes into a pre-constructed objective function, and combine the pre-set constraint conditions. With the goal of maximizing the overall network service quality, solve for the optimal scheduling parameters in the objective function. The scheduling parameters include the priority weights for each node to process various services and the resource weights allocated by each node for the various services; Send the optimal scheduling parameters to the corresponding nodes, so that each node adjusts the defense strategy against DDoS attacks according to the optimal scheduling parameters to defend against the DDoS attacks.

2. The method according to claim 1, characterized in that, Each node determines the performance evaluation result of the node in the following manner: Based on a preset collection period, obtain the network performance data of the node; the network performance data includes one or more of traffic load, communication delay, packet loss rate, and traffic mutation characteristics; Based on the traffic load of the node and the historical maximum bandwidth value of the node, determine the resource utilization rate index of the node; Based on the communication delay of the node and the historical maximum delay value of the node, determine the communication quality deviation index of the node; Based on the packet loss rate of the node and the historical maximum packet loss rate of the node, determine the data transmission reliability index of the node; Based on the traffic mutation characteristics of the node and the mutation time period corresponding to the traffic mutation characteristics, determine the behavior fluctuation index of the node; Based on one or more of the resource utilization rate index, the communication quality deviation index, the data transmission reliability index, the behavior fluctuation index, and the weights corresponding to each index, determine the performance evaluation result of the node.

3. The method according to claim 2, characterized in that After determining the performance evaluation result of the node, it further includes: Generate a block based on the performance evaluation result of the node; Add the block to the blockchain.

4. The method according to claim 1, wherein The objective function is pre-constructed in the following manner: Based on the performance evaluation results of the nodes and the priority weights for each node to process each service, determine the priority service quality term in the objective function; The priority service quality term is used to characterize the influence of priority and node performance on service quality; Based on the performance evaluation metrics of the nodes and the resource weights allocated by each node for each service, determine the resource service quality term in the objective function; the resource service quality term is used to characterize the influence of resource allocation ratio and node performance on service quality; Based on the priority service quality term and the resource service quality term and the corresponding weights of each term, with the goal of maximizing the overall network service quality, construct the objective function.

5. The method according to claim 1, wherein The step of inputting the performance evaluation results of the nodes into a pre-constructed objective function, combining the pre-set constraint conditions, and solving for the optimal scheduling parameters in the objective function with the goal of maximizing the overall network service quality includes: Use the performance evaluation results of each node as input parameters and input them into the objective function; According to the preset constraint conditions, use a preset iterative solution algorithm to perform iterative calculations on the initial scheduling parameters in the objective function, and update the scheduling parameters according to the current gradient direction and learning rate in each iteration process; When the preset convergence conditions are met, stop the iterative process and determine the currently obtained scheduling parameters as the optimal scheduling parameters, where the convergence conditions include that the gradient norm is less than a preset threshold and the number of iterations reaches a preset number of times.

6. A defense device against DDoS attacks, characterized in that, Includes: An acquisition module, configured to obtain the performance evaluation results of each node in the same blockchain network in response to an adjustment request for a defense strategy against a DDoS attack, where the performance evaluation result of any node is a performance score determined by the node based on the network performance data of the node, and the performance score is used to evaluate the service ability of the node; A calculation module, configured to input the performance evaluation results of each node into a pre-constructed objective function, combine preset constraint conditions, and solve for the optimal scheduling parameters in the objective function with maximizing the overall network service quality as the optimization goal, where the scheduling parameters include the priority weights of each node for processing various services and the resource weights allocated by each node for the various services; An adjustment module, configured to send the optimal scheduling parameters to the corresponding nodes, so that each node adjusts the defense strategy against the DDoS attack according to the optimal scheduling parameters to defend against the DDoS attack.

7. The device according to claim 6, wherein Each node determines the performance evaluation result of the node in the following manner: Based on a preset acquisition period, obtain the network performance data of the node; the network performance data includes one or more of traffic load, communication delay, packet loss rate, and traffic mutation characteristics; Based on the traffic load of the node and the historical maximum bandwidth value of the node, determine the resource utilization rate index of the node; Based on the communication delay of the node and the historical maximum delay value of the node, determine the communication quality deviation index of the node; Based on the packet loss rate of the node and the historical maximum packet loss rate of the node, determine the data transmission reliability index of the node; Based on the traffic mutation characteristics of the node and the mutation time period corresponding to the traffic mutation characteristics, determine the behavior fluctuation index of the node; Based on one or more of the resource utilization rate index, the communication quality deviation index, the data transmission reliability index, the behavior fluctuation index, and the weights corresponding to each index, determine the performance evaluation result of the node.

8. An electronic device, characterized in that, Includes: At least one processor, and a memory communicatively connected to the at least one processor, where: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor, so that the at least one processor can execute the method according to any one of claims 1-5.

9. A storage medium, characterized in that, When the computer program in the storage medium is executed by the processor of the electronic device, the electronic device can execute the method according to any one of claims 1-5.

10. A computer program product, characterized in that, Comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images