A defense method based on edge computing DDoS attack

Abstract

The application provides a DDoS attack defense method based on edge computing, and relates to the technical field of network security, which is based on the attributes of edge nodes in a network environment, assigns initial attack rules of attackers and initial defense rules of defenders, takes a Stackelberg game master model and a dynamic cooperative game sub-model as a basement, constructs a double-layer mixed game model, continuously and alternately updates attack solutions and defense solutions, and then achieves multi-stage dynamic interaction of the attack solutions and the defense solutions, the defenders generate traffic offloading strategies in real time based on the strategies of the attackers, and adjust traffic distribution through iterative optimization, which significantly improves the response speed and strategy adaptability of the edge network in a dynamic attack scene, balances the load of cooperative nodes by using a dynamic priority rule, and ensures the improvement of the resource utilization rate of the whole network, and improves the problem that edge node resources are limited and traditional cloud computing DDoS defense methods cannot be directly used in edge computing, so that DDoS attacks are easy to consume edge node resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a defense method for DDoS attacks based on edge computing. BACKGROUND

[0002] Edge computing significantly reduces service delay and improves real-time performance by sinking computing resources to edge nodes close to terminal devices. However, its distributed architecture and resource-constrained characteristics pose new security threats, especially edge distributed denial-of-service attacks. Such attacks exhaust edge server resources by coordinating a large number of Internet of Things devices or botnets with low bandwidth but high frequency of legitimate requests, resulting in a decline in service quality or even service interruption.

[0003] DDoS defense in traditional cloud environments mainly relies on centralized resource redundancy, traffic cleaning centers, and rule-based black and white list mechanisms. However, these methods have significant drawbacks in the edge computing scenario: edge servers are limited in physical size and cannot scale resources as much as the cloud, redirecting traffic to the cloud for processing violates the core goal of low latency in edge computing, and centralized defense is difficult to cover dispersed edge nodes, and dynamic attacks are difficult to detect in real time.

[0004] The problems of the prior art mainly involve two points:

[0005] First, existing dynamic defense schemes (such as resource competition models based on game theory) adjust resource allocation through optimization algorithms, but have three limitations: when facing large-scale edge DDoS attacks, global information collection and calculation take too long, and cannot meet the real-time requirements. Second, relying on a single control node is prone to single-point failures, and the collaborative defense mechanism across edge nodes is not perfect. Furthermore, dynamic defense resource allocation strategies based on machine learning can further exacerbate resource shortages at individual edge nodes.

[0006] The classic cooperative defense framework integrates multi-party resources, technologies, and strategies to establish a cross-organizational, cross-domain security collaboration mechanism, enabling real-time monitoring, information sharing, and joint response to complex threats, thereby improving overall defense effectiveness. Cooperative defense relies on cross-ISP collaboration or pre-installed security devices, but in the edge scenario, it will face a lack of trust and incentive mechanisms, and edge nodes usually belong to a single operator, making the traditional cross-domain collaboration mode unsuitable. Heuristic algorithms lack theoretical performance guarantees, and frequent resource scheduling can introduce additional delays.

[0007] Therefore, there is an urgent need to develop a solution to address the above problems. SUMMARY

[0008] The purpose of the present invention is to provide a defense method for DDoS attacks based on edge computing, which improves the problem that edge node resources are limited and traditional cloud computing DDoS defense methods cannot be directly used in edge computing, resulting in DDoS attacks easily consuming the resources of edge nodes.

[0009] The present invention provides a DDoS attack defense method based on edge computing, which adopts the following technical solutions:

[0010] A DDoS attack defense method based on edge computing includes the following steps:

[0011] Set the properties of edge nodes in the network environment;

[0012] In the initial attack-defense confrontation, the attacker obtains the initial attack rules, and the defender obtains the initial defense rules;

[0013] Construct the first-layer Stackelberg game main model and define the utility functions of the attacker and defender;

[0014] Construct a second-layer dynamic cooperative game sub-model to define participants, traffic types, and dynamic priority rules;

[0015] solving the initial defense solution of the dynamic cooperative game submodel;

[0016] Substituting the initial defense solution of the dynamic cooperative game sub-model into the Stackelberg game main model, and reversely solving the attack solution of the Stackelberg game main model;

[0017] Then, the attack solution of the Stackelberg game main model is substituted back into the dynamic cooperation game sub-model to obtain the defense solution of the dynamic cooperation model;

[0018] The attack solution and the defense solution are continuously and alternately updated, and when the attack solution and the defense solution reach a balanced state, the attack solution and the defense solution in the balanced state are output.

[0019] A defense method for DDoS attacks based on edge computing assigns initial attack rules to attackers and initial defense rules to defenders based on the attributes of edge nodes in the network environment. A two-layer hybrid game model is constructed based on the Stackelberg game main model and the dynamic cooperation game sub-model. The attack solution and defense solution are continuously and alternately updated, thereby achieving a multi-stage dynamic interaction between the attack solution and the defense solution. The defender generates a traffic offloading strategy in real time based on the attacker's strategy and adjusts the traffic distribution through iterative optimization, significantly improving the response speed and policy adaptability of the edge network in dynamic attack scenarios. Dynamic priority rules are used to balance the load of collaborative nodes, ensuring improved resource utilization across the entire network and avoiding local overload.

[0020] Optionally, the setting of the attribute of the edge node in the network environment is further represented as:

[0021] The edge network topology is defined as an undirected graph G, which contains a set of edge host nodes N in the network, a communication link E between nodes, and a weight The weight is the number of hops between nodes, which is used for network topology modeling;

[0022] The node attribute in the undirected graph G is initialized, and the attack and defense parameters are configured.

[0023] Optionally, the initial attack and defense confrontation, the attacker obtains the initial attack rule, and the defender obtains the initial defense rule, is further represented as:

[0024] The attacker randomly selects a set of target nodes , and assigns an initial attack parameter to each target node to generate an initial attack rule;

[0025] The defender uses a dynamic priority allocation rule to allocate overflow traffic according to the node resource state and traffic load , and generates an initial defense rule according to the priority proportion.

[0026] Optionally, the first layer Stackelberg game master model is constructed, and the utility functions of the attacker and the defender are defined, which is further represented as:

[0027] The attack and defense confrontation is modeled, the attacker is the leader, aiming to maximize the overflow traffic revenue and minimize the attack cost;

[0028] The defender is the follower, aiming to minimize the overflow traffic that is not processed and maximize the total traffic processed, thereby constructing the first layer Stackelberg game master model;

[0029] The utility function of the defender is defined as , the utility function of the attacker is defined as , and the constraint condition of the utility function of the attacker is defined.

[0030] Optionally, the constraint condition of the definition of the utility function of the attacker includes that the total of the attack traffic allocated to the nodes in the set is less than the total resources of the attacker; and each allocated attack traffic is greater than the total of the remaining resources of the attacked node and the traffic forwarded by the defense assistance.

[0031] Optionally, the definition of the participant, the traffic type and the dynamic priority rule is further represented as:

[0032] Define the participants as request node R and collaboration node H, and define the traffic types as attack traffic, traffic and overflow traffic;

[0033] Based on a multi-factor weighted correction mechanism, the real-time resource status, physical distance, and node capability of each node are integrated into the traffic allocation decision, thereby defining dynamic priority rules.

[0034] Based on load balancing, the set of collaborative nodes and traffic distribution are selected through policy constraints;

[0035] Globally coordinate multi-node attacks.

[0036] Optionally, the policy constraint method includes resource constraint conditions and overflow flow integrity constraint conditions;

[0037] The resource constraint condition is that the traffic processed by the collaboration node is less than the remaining resources of the collaboration node itself;

[0038] The overflow flow integrity constraint condition is that the flow allocated to all cooperative nodes for processing is less than the total overflow flow.

[0039] Optionally, the initial defense solution of the dynamic cooperative game sub-model is further expressed as:

[0040] The set of cooperative nodes is greedily initialized using a greedy algorithm to generate an initial solution for traffic distribution;

[0041] Combined with mathematical programming, nonlinear programming is used to adjust flow distribution through gradient information;

[0042] The initial solution is used as the starting point, local optimization is performed, and the final initial defense solution is output.

[0043] Optionally, the reverse solving of the attack solution of the Stackelberg game main model includes: using the reverse induction method to build a solution framework of the Stackelberg game main model; using a genetic algorithm and an integer programming algorithm to screen and optimize to obtain the attack solution of the Stackelberg game main model.

[0044] Optionally, the condition for the attack solution and the defense solution to reach an equilibrium state is that, based on the total resource constraint, the attack benefit of the marginal attacker is equal to the marginal cost, and the defender ensures that the attacker cannot further reduce the defense utility through strategy.

[0045] The beneficial effects of the application are: a defense method for DDoS attack based on edge computing, which distributes initial attack rules of attackers and initial defense rules of defenders based on the attributes of edge nodes in a network environment, uses a Stackelberg game main model and a dynamic cooperative game sub-model as a basement to construct a double-layer mixed game model, continuously and alternately updates attack solutions and defense solutions, and then achieves multi-stage dynamic interaction of attack solutions and defense solutions, and the defenders generate traffic offloading strategies in real time based on the strategies of the attackers, and adjust traffic distribution through iterative optimization, which significantly improves the response speed and strategy adaptability of the edge network in a dynamic attack scenario, balances the load of cooperative nodes by using a dynamic priority rule, ensures the improvement of network resource utilization, and avoids local overload.

[0046] The application realizes multi-stage dynamic interaction of attack and defense strategies through a double-layer mixed game model. The defenders generate traffic offloading schemes in real time based on the strategies of the attackers, and adjust resource allocation through iterative optimization, which significantly improves the response speed and strategy adaptability of the edge network in a dynamic attack scenario. The dynamic priority allocation mechanism can preferentially allocate high-sensitivity traffic to low-delay nodes and balance the load of cooperative nodes. Combined with traffic integrity constraints and resource upper limit restrictions, the network resource utilization is improved, and local overload is avoided.

[0047] The application quickly generates a feasible solution and fine-tunes traffic distribution through a hybrid algorithm of greedy initialization and nonlinear programming correction. The scheme approaches the global optimal solution within a millisecond response time, reduces the proportion of unprocessed overflow traffic, and strictly guarantees the priority of resource constraints and delay-sensitive tasks.

[0048] The application realizes decentralized traffic offloading and cross-node collaborative defense based on dynamic cooperative games between edge nodes. Through the principle of processing nearby and the mechanism of matching node capacity, transmission delay is reduced, trust and scheduling cost of cross-domain cooperation are avoided, and the system's ability to resist single-point faults is improved. Strictly following the traffic type marking and resource constraints, high-sensitivity tasks are preferentially allocated to efficient nodes to reduce the response delay of critical business. The traffic distribution strategy synchronously guarantees the integrity to avoid the detection model failure problem caused by traffic segmentation, and ensures the stability of service quality. BRIEF DESCRIPTION OF DRAWINGS

[0049] Figure 1 It is a flowchart of the defense method for DDoS attack based on edge computing of the application;

[0050] Figure 2 It is a resource scheduling flowchart of the defense method for DDoS attack based on edge computing of the application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0052] like Figure 1 As shown in the figure, a DDoS attack defense method based on edge computing includes the following steps:

[0053] S1. Set the attributes of edge nodes in the network environment;

[0054] S2, initial attack and defense confrontation, the attacker obtains the initial attack rules, and the defender obtains the initial defense rules;

[0055] S3. Construct the first-layer Stackelberg game main model and define the utility functions of the attacker and defender;

[0056] S4. Construct the second-layer dynamic cooperative game sub-model to define participants, traffic types, and dynamic priority rules;

[0057] S5. solving the initial defense solution of the dynamic cooperative game sub-model;

[0058] S6. Substituting the initial defense solution of the dynamic cooperative game sub-model into the Stackelberg game main model, and reversely solving the attack solution of the Stackelberg game main model;

[0059] S7, back-substituting the attack solution of the Stackelberg game main model into the dynamic cooperation game sub-model to obtain a defense solution of the dynamic cooperation model;

[0060] S8. Continuously and alternately update the attack solution and the defense solution, and when the attack solution and the defense solution reach a balanced state, output the attack solution and the defense solution in the balanced state.

[0061] A defense method for DDoS attacks based on edge computing assigns initial attack rules to attackers and initial defense rules to defenders based on the attributes of edge nodes in the network environment. A two-layer hybrid game model is constructed based on the Stackelberg game main model and the dynamic cooperation game sub-model. The attack solution and defense solution are continuously and alternately updated, thereby achieving a multi-stage dynamic interaction between the attack solution and the defense solution. The defender generates a traffic offloading strategy in real time based on the attacker's strategy and adjusts the traffic distribution through iterative optimization, significantly improving the response speed and policy adaptability of the edge network in dynamic attack scenarios. Dynamic priority rules are used to balance the load of collaborative nodes, ensuring improved resource utilization across the entire network and avoiding local overload.

[0062] Specifically, in some embodiments, the setting of the attributes of the edge node in the network environment in step S1 is further expressed as:

[0063] The edge network topology is defined as an undirected graph G, which contains the set of edge host nodes N in the network, the communication links E between the nodes and the weights , the weight The number of hops between nodes, used for network topology modeling;

[0064] Initialize the node attributes in the undirected graph G and configure the attack and defense parameters.

[0065] Furthermore, through network topology modeling, the edge network topology structure is defined as an undirected graph G. Undirected graph G = (N, E). At the same time, the node attributes in the undirected graph G are initialized by defining parameters for each node i∈N. The defined parameters include the total computing resources of the node and initialize the remaining resources for dynamic updates Node capability weight and traffic type tags Among them, the attack parameters are: attack intensity , Attack cost coefficient (unit cost of attack traffic and the fixed cost of attacking the node ), attack resource limit Defender Parameters: Dynamic Pricing Coefficients , resource consumption cost , delay penalty coefficient γ.

[0066] Specifically, in some embodiments, in the initial attack-defense confrontation in step S2, the attacker obtains initial attack rules, and the defender obtains initial defense rules, which can be further expressed as:

[0067] The attacker randomly selects a set of target nodes , and assign initial attack parameters to each target node to generate initial attack rules;

[0068] The defender determines the node resource status and traffic load ,Using dynamic priority allocation rules, overflow traffic is allocated according to the priority ratio and the initial defense rules are generated.

[0069] Furthermore, step S2 may specifically include:

[0070] S2.1. Generate the attacker's initial attack rules. The attacker randomly selects a set of target nodes. ∈N, and assign attack strength to each target node , attack strategy .

[0071] S2.2, Generate the defender's initial defense rules. The defender generates the defender's initial defense rules according to the resource status of the idle nodes j except the attacking node i. and traffic load , triggering the dynamic priority allocation rule, the dynamic priority allocation rule formula is specifically:

[0072] ,

[0073] Then, we can obtain a strategy for allocating overflow traffic according to the priority ratio. The formula for allocating overflow traffic is as follows:

[0074] ,

[0075] The overflow traffic allocation strategy obtained above is also the defense strategy adopted by the defender.

[0076] Specifically, in some embodiments, the first-layer Stackelberg game main model is constructed in step S3, and the utility functions of the attacker and the defender are defined, which are further expressed as:

[0077] Model the attack-defense confrontation, where the attacker acts as the leader, aiming to maximize the overflow traffic revenue and minimize the attack cost;

[0078] As a follower, the defender aims to minimize the unprocessed overflow traffic and maximize the total processed traffic, thereby building the first-layer Stackelberg game main model;

[0079] Define the defender's utility function as , define the attacker's utility function as , define the attacker utility function constraints.

[0080] Furthermore, in some embodiments, Figure 2 As shown, step S3 can be expressed as constructing the first-layer Stackelberg game main model, defining the utility functions, constraints, and strategy space of the attacker and defender, specifically including:

[0081] S3.1. Model the attack-defense confrontation. Take the attacker as the leader and select the target node set to attack. and attack strength ,maximizing the benefits of overflow traffic and minimizing the cost of attack.,As a follower, the defender triggers the second-layer cooperative game to distribute traffic,when the current load of the node exceeds a certain safety threshold (such as 80% of the total,node resources), minimizing the unprocessed overflow traffic.

[0082] S3.2. Construct a defender model. The defender's goal is to maximize total traffic processing, minimize response latency, and resolve load imbalance. By collaborating and avoiding the purchase of new resources, the entire edge network saves resource costs. The defender's utility function can then be defined as:

[0083] ,

[0084] Among them, the income items are:

[0085] ,

[0086] in, is a dynamic pricing coefficient, , k represents the resource tension sensitivity coefficient, Indicates the utilization rate of the entire network resources. When the utilization rate of the entire network resources is tight, the higher the weight of the collaborative benefit, that is, the more valuable the node is in assisting in handling overflow traffic. Indicates the new resources that need to be purchased to handle overflow traffic. represents the policy space, i.e., the traffic forwarded from overloaded node i to cooperative node j.

[0087] At the same time, the resource consumption cost is:

[0088] ,

[0089] in, Indicates the remaining resources of the node and processes traffic The marginal cost of Decrease and increase. Represents the marginal cost consumed when processing traffic and the remaining resources of the node Inversely proportional.

[0090] The delay penalty is:

[0091] ,

[0092] The delay penalty represents the impact of the delay caused by forwarding traffic on the quality of service.

[0093] S3.3. Construct an attacker model. The attacker consumes target node resources, causing legitimate traffic to overflow, thereby increasing user response latency while minimizing the cost of the attack. For the attacker, the attack strategy involves considering which edge nodes to attack, which can be one or multiple. Regardless of the attack strategy, if the attack is effective, the traffic overflowing the attacked nodes will primarily be legitimate traffic, while more attack traffic will be processed locally at the attacking node, occupying more node resources. Therefore, if a particularly high amount of legitimate traffic overflows, user response latency will be prolonged, reflecting the actual destructive effect of the attack.

[0094] Design a delay penalty , which is used to measure the attacker's attack revenue, and the net benefit of an attack strategy is calculated by subtracting the attack cost. This is reasonable in edge computing scenarios, because many edge services are highly sensitive to delay, such as autonomous driving, industrial control and other real-time critical services. This reflects the actual destructiveness of the attack. The attacker's profit mainly comes from the legitimate traffic that the attacked host cannot process, that is, the overflow of legitimate traffic, which increases the user's response delay. The attacker's utility function can then be defined as:

[0095] ,

[0096] The attacker's utility function Indicates that the attacker is attacking the target node set Select the attack node and the attack strength is Rewards received. Among them, It represents the penalty coefficient of user delay caused by unit overflow of legitimate traffic. It represents the attack intensity of the attacker on node i, and its unit cost is , represents the number of nodes attacked, and the fixed cost of attacking each single node is , represents the coordination cost of the attack. This cost is taken into account because when attacking a single node, fixed costs may include one-time expenses such as target detection and deployment of attack tools. These costs do not change with the attack traffic volume and still exist even when the attack traffic intensity is low.

[0097] Based on this, we can consider the case where the attack simultaneously attacks multiple edge nodes. Then, we can obtain the overflow flow in node i that is not handled by the node itself and the defense strategy as follows:

[0098] ,

[0099] in, is the remaining resource of node i, that is, the remaining capacity to process traffic at this time. The overflow traffic in node i that is not processed by the node itself and the defense strategy is equal to the attack traffic Subtract the traffic that the node itself can handle at this time Traffic processed by collaborative nodes .

[0100] Specifically, in some embodiments, the attacker utility function is defined as The constraints include: the sum of the attack traffic allocated to the nodes in the set is less than the total resources of the attacker; each allocated attack traffic must be greater than the sum of the remaining resources of the attacked node and the traffic forwarded by the defense assistance.

[0101] Resource-limited constraint: Given an attack set, the nodes in this set must also satisfy the constraint that the total attack resources are limited. Represents the total resources of the attacker, namely:

[0102] ,

[0103] The minimum attack traffic value constraint requires that each allocated attack traffic be greater than the sum of the remaining resources of the attacked node and the traffic that the defense can assist in forwarding. Otherwise, such traffic allocation is invalid and cannot cause the node to generate overflow traffic. In other words:

[0104] ,

[0105] This constraint ensures that the attack will cause the node to generate overflow traffic. .

[0106] Specifically, in some embodiments, the definition of participants, traffic types, and dynamic priority rules in step S4 is further expressed as follows:

[0107] Define the participants as request node R and collaboration node H, and define the traffic types as attack traffic, traffic and overflow traffic;

[0108] Based on a multi-factor weighted correction mechanism, the real-time resource status, physical distance, and node capability of each node are integrated into the traffic allocation decision, thereby defining dynamic priority rules.

[0109] Based on load balancing, the set of collaborative nodes and traffic distribution are selected through policy constraints;

[0110] Globally coordinate multi-node attacks.

[0111] Further, in some embodiments, as shown in FIG. 4, step S4 can be represented as: Figure 2

[0112] S4.1, Participants and traffic classification. Within the edge network, when a single or multiple nodes are resource-constrained due to DDoS attacks or traffic overload, the goals of traffic offloading, load balancing, and cost optimization are achieved through dynamic cooperative game. The participants of dynamic cooperation are divided into request nodes R (R N), representing the attacked nodes that need to forward overflow traffic; and cooperation nodes H (H N\R), representing nodes that are not attacked and meet the resource and distance constraints, which can assist in processing traffic.

[0113] S4.2, Constructing the basic idea framework of the game. The overflow traffic is forwarded, but the total resources remain unchanged during this process, so the defense strategy can only forward as much overflow traffic as possible for processing. Therefore, three points are mainly considered when distributing traffic: real-time resource status, only when a node has sufficient resources can it assist in defense, and letting nodes with less resources assist in defense will only put these nodes at risk of being attacked, and also considering the balance of distribution. Physical distance considers the distance between the allocated node and the attacked node in terms of hop count. Obviously, the priority of the node allocated to is lower, because the delay of the response is too long. Node capability, because the hardware devices of each node are not the same, such as for some complex calculations that can be accelerated by hardware, and can quickly respond to these complex traffic. Because part of the complex traffic may be delay-sensitive tasks, such as traffic for unmanned vehicles. Therefore, the stronger the ability, the more complex traffic should be processed. In fact, this is also a consideration of the heterogeneity of nodes. High-load traffic is preferentially allocated to nodes with higher processing efficiency (such as GPU servers) to reduce resource consumption and delay.

[0114] S4.3, Dynamic priority rules. Based on the analysis of the above steps, the dynamic priority rules for distribution are constructed based on the idea of Shapely value, which guarantees the load balancing of nodes during the distribution process. The core is to unify the real-time resource status, physical distance, and node capability factors of each node into the traffic distribution decision through multi-factor weighted correction. Through dynamic adjustment of the weight factor, the model can meet the efficiency, load balancing, and real-time requirements simultaneously. The dynamic priority formula is:

[0115] ,

[0116] where the allocation rule is:

[0117] ,

[0118] where, ​Indicates resource weight. The more remaining resources there are, the higher the allocated weight. Represents the distance weight, which penalizes distant nodes to reduce latency. represents the capacity weight, measuring node j's supply capacity. Based on the above priorities, the defender can dynamically select nodes with higher priorities in real time. Once the collaborative nodes are selected, the defender must also design a reasonable traffic distribution mechanism to ensure that the load on each node does not exceed its processing capacity. Furthermore, to avoid over-reliance on a few key nodes, the defender should ensure that the load on the collaborative nodes is balanced when distributing overflow traffic.

[0119] S4.4 Global Coordination of Multi-Node Attacks. If collaborative node resources are insufficient, node conflicts need to be resolved. Traffic allocation is primarily based on the following order: to ensure the real-time performance of critical tasks, prioritize processing more complex traffic; to reduce transmission delays, prioritize allocating traffic to closer collaborative nodes; to avoid node overload, prioritize allocating traffic to collaborative nodes with more sufficient resources.

[0120] Furthermore, in some embodiments, the policy constraint method includes resource constraint conditions and overflow traffic integrity constraint conditions;

[0121] The resource constraint condition is that the traffic processed by the collaboration node is less than the remaining resources of the collaboration node itself;

[0122] The overflow flow integrity constraint condition is that the flow allocated to all cooperative nodes for processing is less than the total overflow flow.

[0123] Specifically, the resource constraint is that the traffic processed by the cooperating node does not exceed its remaining resources. Because node j may receive traffic from multiple attacking nodes, the total resources consumed to process them cannot exceed the remaining resources of the node itself at that time.

[0124] ,

[0125] The overflow flow integrity constraint is that the overflow flow must be distributed as much as possible, but it does not mean that it can be fully forwarded (especially when the resources in the entire network are insufficient). That is, the flow allocated to all j nodes cannot exceed the total overflow flow. .

[0126] ,

[0127] Specifically, in some embodiments, the initial defense solution of the dynamic cooperative game sub-model in step S5 is further expressed as:

[0128] The set of cooperative nodes is greedily initialized using a greedy algorithm to generate an initial solution for traffic distribution;

[0129] Combined with mathematical programming, nonlinear programming is used to adjust flow distribution through gradient information;

[0130] The initial solution is used as the starting point, local optimization is performed, and the final initial defense solution is output.

[0131] Furthermore, step S5 can be expressed as:

[0132] S5.1. Greedy Initialization. Attacking nodes cannot serve as collaborative nodes. Therefore, the entire edge network is divided into two types: one is the set of attacking nodes, and the other is the set of collaborative nodes. First, node priorities are calculated in real time and traffic is allocated according to priority. After allocation, the remaining node resources are immediately updated to avoid overload. If resources are insufficient, unprocessed traffic is marked and an alarm is issued. Overflow traffic is allocated to collaborative nodes in proportion to their priority:

[0133] ,

[0134] The goal is to quickly generate an initial solution that satisfies flow integrity constraints, but may not fully optimize resource utilization and utility.

[0135] S5.2, Nonlinear Programming Correction. The purpose of mathematical correction is to adjust traffic distribution through gradient information, directing more traffic to nodes with higher marginal utility, and improving overall utility. Using the greedy solution as the starting point, construct a local optimization problem:

[0136] ,

[0137] Use gradient ascent to quickly solve the fine-tuning amount , approaching the global optimal solution.

[0138] S5.3. Output the final initial defense solution, where: .

[0139] Specifically, in some embodiments, the reverse solving of the attack solution of the Stackelberg game main model in step S6 includes using the reverse induction method to build a solution framework of the Stackelberg game main model; using a genetic algorithm and an integer programming algorithm to screen and optimize to obtain the attack solution of the Stackelberg game main model.

[0140] Furthermore, step S6 can be expressed as:

[0141] S6.1. Backward Induction Framework. Based on the characteristics of the Stackelberg game, we first solve the optimal response function of the defender and then embed it into the attacker's optimization problem. The optimal traffic allocation of the defender In the previous step, we find the overflow flow The attacker uses the overflow traffic ,choose and To maximize one's own utility , satisfying the total attack resource constraint.

[0142] S6.2, mixed integer programming and heuristic algorithm. The choice of is a combinatorial optimization problem, which requires a combination of integer programming and continuous optimization, with a mixed strategy in stages.

[0143] S6.3, attack node selection phase. Use genetic algorithm to select high-value attack nodes, and use binary code to indicate whether the node is attacked. Calculating the Net Benefit of an Attack The constraint on attack is the penalty function that limits the total attack resources. .

[0144] S6.4, attack strength distribution stage. , using convex optimization (such as gradient descent) to distribute attack intensity and maximize By initializing the attack strategy (random or based on historical data) in phase 1, the defender will be triggered to respond: trigger the greedy + mathematical correction algorithm to distribute traffic (defense strategy), calculate To this end, the attacker needs to update: If the node selection is fixed, use the gradient method to optimize If adjustments are required , trigger the genetic algorithm to reselect the attack node and repeat until convergence or the maximum number of iterations is reached.

[0145] S6.5, iterative alternating optimization. By alternatingly updating the strategies of the attacker and defender to approach equilibrium, first initialize the attack strategy. and In the second step, the defender solves and calculate Step 3: The attacker is fixed , through optimization and adjustment and , if the total attack cost If the attack exceeds the profit, reduce the attack nodes or intensity; if the defender has a high coverage rate, prioritize attacking hub nodes or increase the proportion of high-complexity traffic. Repeat steps 2 and 3, and the attacker and defender update their strategies according to the fixed time slot T until and convergence.

[0146] Specifically, in some embodiments, the condition for the attack solution and the defense solution in step S8 to reach an equilibrium state is that, based on the total resource constraint, the marginal attacker's attack benefit is equal to the marginal cost, and the defender ensures that the attacker cannot further reduce the defense utility through strategy.

[0147] Furthermore, step S8 can also be expressed as: the attack and defense sides output an equilibrium state, so that the attacker's marginal attack benefit is equal to the marginal cost, and the defender ensures that the attacker cannot further reduce the defense utility by adjusting the strategy.

[0148] Specifically, step S8 may include:

[0149] S8.1. Output of equilibrium state between attacker and defender. In the Stackelberg game, defender and attacker continuously adjust their strategies. When both parties reach their optimal strategies, the optimal strategies of attacker and defender correspond to Nash equilibrium. At this equilibrium point: under the total resource constraint, the marginal attack benefit equals the marginal cost. The defender dynamically prioritizes resource allocation, preventing the attacker from further reducing the effectiveness of the attack by adjusting the strategy. In this case, the defense system reaches a stable equilibrium state - Nash equilibrium. The equilibrium solution satisfies , and simultaneously attack the node set to make the defender's overflow traffic maximize.

[0150] S8.2. Optimal Strategy Execution. Based on the optimal defense resource allocation strategy, the defender rationally allocates forwarding traffic and guides the edge network to properly handle attack traffic, achieving the best defense effect with minimal resource consumption, communication latency, and the economic cost of collaborative allocation.

[0151] A defense method for DDoS attacks based on edge computing assigns initial attack rules to attackers and initial defense rules to defenders based on the attributes of edge nodes in the network environment. A two-layer hybrid game model is constructed based on the Stackelberg game main model and the dynamic cooperation game sub-model. The attack solution and defense solution are continuously and alternately updated, thereby achieving a multi-stage dynamic interaction between the attack solution and the defense solution. The defender generates a traffic offloading strategy in real time based on the attacker's strategy and adjusts the traffic distribution through iterative optimization, significantly improving the response speed and policy adaptability of the edge network in dynamic attack scenarios. Dynamic priority rules are used to balance the load of collaborative nodes, ensuring improved resource utilization across the entire network and avoiding local overload.

[0152] This invention utilizes a two-layer hybrid game model to achieve multi-stage dynamic interaction between attack and defense strategies. The defender generates traffic offloading solutions in real time based on the attacker's strategy and adjusts resource allocation through iterative optimization, significantly improving the edge network's responsiveness and policy adaptability in dynamic attack scenarios. The dynamic priority allocation mechanism prioritizes high-sensitivity traffic to low-latency nodes and balances the load on collaborative nodes. Combining traffic integrity constraints with resource caps ensures improved resource utilization across the entire network and avoids local overloads.

[0153] This approach uses a hybrid algorithm combining greedy initialization and nonlinear programming correction to rapidly generate feasible solutions and then fine-tune traffic allocation. This approach approaches the global optimal solution within millisecond response times, reduces the proportion of unprocessed overflow traffic, and strictly ensures resource constraints and the priority of latency-sensitive tasks.

[0154] This invention leverages dynamic cooperative game play between edge nodes to achieve decentralized traffic offloading and cross-node collaborative defense. By leveraging the principle of proximity processing and a node capability matching mechanism, transmission latency is reduced, avoiding the trust and scheduling costs of cross-domain collaboration while enhancing the system's resilience to single points of failure. By strictly adhering to traffic type labeling and resource constraints, highly sensitive tasks are prioritized to high-efficiency nodes, reducing critical service response delays. Traffic distribution strategies simultaneously safeguard integrity, avoiding detection model failures caused by traffic segmentation and ensuring stable service quality.

[0155] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A defense method for DDoS attacks based on edge computing, characterized in that: include: Set the properties of edge nodes in the network environment; In the initial attack-defense confrontation, the attacker obtains the initial attack rules, and the defender obtains the initial defense rules; Construct the first-layer Stackelberg game main model and define the utility functions of the attacker and defender; Construct a second-layer dynamic cooperative game sub-model to define participants, traffic types, and dynamic priority rules; solving the initial defense solution of the dynamic cooperative game submodel; Substituting the initial defense solution of the dynamic cooperative game sub-model into the Stackelberg game main model, and reversely solving the attack solution of the Stackelberg game main model; Then, the attack solution of the Stackelberg game main model is substituted back into the dynamic cooperation game sub-model to obtain the defense solution of the dynamic cooperation model; Continuously and alternately updating the attack solution and the defense solution, and when the attack solution and the defense solution reach a balanced state, outputting the attack solution and the defense solution in the balanced state; The definition of participants, traffic types and dynamic priority rules is further expressed as: Define the participants as request node R and collaboration node H, and define the traffic types as attack traffic, traffic and overflow traffic; Based on a multi-factor weighted correction mechanism, the real-time resource status, physical distance, and node capability of each node are integrated into the traffic allocation decision, thereby defining dynamic priority rules. Based on load balancing, the set of collaborative nodes and traffic distribution are selected through policy constraints; Globally coordinate multi-node attacks.

2. A DDoS attack defense method based on edge computing according to claim 1, characterized in that: The properties of the edge nodes in the network environment are further set as follows: The edge network topology is defined as an undirected graph G, which contains the edge host node set N in the network, the communication links E between the nodes and the weights , the weight The number of hops between nodes, used for network topology modeling; Initialize the node attributes in the undirected graph G and configure the attack and defense parameters.

3. The method for defending against DDoS attacks based on edge computing according to claim 1, characterized in that: In the initial attack-defense confrontation, the attacker obtains the initial attack rules, and the defender obtains the initial defense rules, which can be further expressed as: The attacker randomly selects a set of target nodes , and assign initial attack parameters to each target node to generate initial attack rules; The defender determines the node resource status and traffic load ,Using dynamic priority allocation rules, overflow traffic is allocated according to the priority ratio and the initial defense rules are generated.

4. The method for defending against DDoS attacks based on edge computing according to claim 1, characterized in that: The first-layer Stackelberg game main model is constructed to define the utility functions of the attacker and the defender, which can be further expressed as: Model the attack-defense confrontation, where the attacker acts as the leader, aiming to maximize the overflow traffic revenue and minimize the attack cost; As a follower, the defender aims to minimize the unprocessed overflow traffic and maximize the total processed traffic, thereby building the first-layer Stackelberg game main model; Define the defender's utility function as , define the attacker's utility function as , define the attacker utility function constraints.

5. A DDoS attack defense method based on edge computing according to claim 4, characterized in that: The attacker utility function is defined as The constraints include that the sum of attack traffic allocated to nodes in the set is less than the total resources of the attacker; each allocated attack traffic must be greater than the sum of the remaining resources of the attacked node and the traffic forwarded by the defense assistance.

6. A DDoS attack defense method based on edge computing according to claim 1, characterized in that: The policy constraint method includes resource constraint conditions and overflow flow integrity constraint conditions; The resource constraint condition is that the traffic processed by the collaboration node is less than the remaining resources of the collaboration node itself; The overflow flow integrity constraint condition is that the flow allocated to all cooperative nodes for processing is less than the total overflow flow.

7. The method for defending against DDoS attacks based on edge computing according to claim 1, characterized in that: The initial defense solution for solving the dynamic cooperative game sub-model is further expressed as: The set of cooperative nodes is greedily initialized using a greedy algorithm to generate an initial solution for traffic distribution; Combined with mathematical programming, nonlinear programming is used to adjust flow distribution through gradient information; The initial solution is used as the starting point, local optimization is performed, and the final initial defense solution is output.

8. The method for defending against DDoS attacks based on edge computing according to claim 1, characterized in that: The reverse solution of the attack solution of the Stackelberg game main model includes: using the reverse induction method to build a solution framework of the Stackelberg game main model; using a genetic algorithm and an integer programming algorithm to screen and optimize to obtain the attack solution of the Stackelberg game main model.

9. The method for defending against DDoS attacks based on edge computing according to claim 1, characterized in that: The conditions for the attack solution and the defense solution to reach an equilibrium state are that, based on the total resource constraint, the marginal attacker's attack benefit is equal to the marginal cost, and the defender ensures that the attacker cannot further reduce the defense utility through strategy.

Images