Flow scheduling method and system for defending distributed denial of service attack

Abstract

The invention provides a traffic scheduling method and system for defending distributed denial of service attack, and belongs to the technical field of network security, and the method comprises the steps: calculating traffic residual data based on a traffic monitoring mechanism, and marking the traffic data as preprocessed traffic data when the traffic residual data exceeds preset threshold data; performing malicious access verification on the preprocessed traffic data based on a protocol feature analysis model to obtain a traffic verification result; when it is judged that the preprocessed traffic data is normally accessed, the preprocessed traffic data is scheduled to a source station server through a public network; and when judging that the preprocessed traffic data is malicious access, generating to-be-cleaned traffic data, scheduling the to-be-cleaned traffic data to a high defense machine room through a traffic scheduling mechanism to perform traffic cleaning, filtering malicious access traffic, and forwarding normal traffic sub-data to a source station server through a port protocol. According to the technical scheme, the defending cost of the distributed denial of service attack is reduced, and meanwhile, rapid scheduling of the flow data is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a traffic scheduling method and system for defending against distributed denial of service attacks. Background Art

[0002] A Distributed Denial of Service Attack (DDoS) is a network attack that controls a large number of distributed hosts to send massive requests to the target server, causing the server to crash and be unable to respond to legitimate user requests normally.

[0003] Traditional technology defends against distributed denial of service attacks by permanently routing all traffic to a high-defense data center for malicious traffic filtering, requiring both service and protection bandwidth to be configured based on peak values. This technical solution underutilizes the high-defense data center's bandwidth resources during non-attack periods, yet users still pay high fees, resulting in high network service costs. Furthermore, when a distributed denial of service attack is detected, the operator's blackhole strategy is implemented, automatically blocking ingress traffic. This requires users to purchase additional vendor services to shorten the blackhole period and unblock traffic, further increasing costs. Furthermore, during the execution of the operator's blackhole strategy, hackers are highly likely to attack through other network entrances, causing prolonged service interruptions.

[0004] Therefore, a traffic scheduling method and system for defending against distributed denial of service attacks are proposed. Summary of the Invention

[0005] To solve the above technical problems, the present invention provides a traffic scheduling method and system for defending against distributed denial of service attacks, which is used to solve the problems of high cost of defending against distributed denial of service attacks and waste of bandwidth resources in high-defense computer rooms in traditional technologies.

[0006] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, including:

[0007] Based on the traffic monitoring mechanism, the bandwidth occupancy rate, number of protocol connections, and data packet rate of the traffic data are collected, and the traffic residual value data is calculated. When the traffic residual value data exceeds the preset threshold data, the traffic data is marked as pre-processed traffic data;

[0008] Perform malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result;

[0009] When it is determined, based on the traffic verification result, that the pre-processed traffic data is a normal access, the pre-processed traffic data is dispatched to the source server via the public network;

[0010] When it is determined based on the traffic verification result that the pre-processed traffic data is a malicious access, a cleaning flag is added to the pre-processed traffic data to generate traffic data to be cleaned;

[0011] The traffic data to be cleaned is dispatched to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, malicious access traffic is filtered, and the normal traffic sub-data in the traffic data to be cleaned is forwarded to the source server through the port protocol.

[0012] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the steps of: based on a traffic monitoring mechanism, collecting bandwidth occupancy, number of protocol connections, and packet rate of traffic data, calculating traffic residual value data, and marking the traffic data as pre-processed traffic data when the traffic residual value data exceeds a preset threshold value; comprising:

[0013] The traffic residual value data is calculated based on the bandwidth utilization rate, number of protocol connections, and packet rate of traffic data through a cubic polynomial regression model;

[0014] y=Obw*t 3 +N*t 2 +Pr*t+d

[0015] Where y is the traffic residual value data, Obw is the bandwidth occupancy rate, N is the number of protocol connections, Pr is the packet rate, t is the time parameter, and d is the constant term.

[0016] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, the steps of: performing malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result; comprising:

[0017] Detecting the non-standard protocol fields of the pre-processed traffic data for abnormal analysis and obtaining traffic verification results; including:

[0018] Obtaining the protocol address and sequence number package of the pre-processed traffic data;

[0019] Detecting a corresponding protocol geographic location based on the protocol address, detecting whether the location information of the user who sent the pre-processed traffic data is consistent with the protocol geographic location by obtaining the location information of the user who sent the pre-processed traffic data, and when the location information is inconsistent, obtaining the corresponding historical network behavior based on the protocol address, and determining that the protocol address is a pseudo-protocol address if there are high-frequency requests and unreasonable access paths at the protocol address;

[0020] Setting a virtual server to parse and process the sequence number packet, and if an error occurs in the virtual server during the parsing process, identifying the sequence number packet as a malformed data packet;

[0021] If it is determined that the protocol address of the pre-processed traffic data is a pseudo-protocol address and the sequence number packet is a malformed data packet, the pre-processed traffic data is verified to be a malicious access, and a corresponding traffic verification result is obtained;

[0022] After the virtual server completes parsing the serial number packet, it returns the serial number packet and character confirmation packet to the user terminal, establishes a communication connection between the virtual server and the user terminal, continuously monitors the access traffic data sent by the user terminal, and when it is detected that there is no abnormality in the access traffic data within a preset time period, forwards the access traffic data to the source server; when it is detected that the access traffic data causes the virtual server to crash or occupy a large amount of computing resources, the user terminal that sent the pre-processed traffic data is judged as a malicious access port, and the network access of the user terminal is denied.

[0023] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the steps of: performing malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result; and further comprising:

[0024] By building a generator and a discriminator, a protocol feature analysis model is obtained;

[0025] Obtain sample traffic data, perform one-hot encoding on sample non-numerical traffic sub-data in the sample traffic data, and construct sample training traffic data based on the one-hot encoded sample non-numerical traffic sub-data and the sample numerical traffic sub-data;

[0026] Obtain normal type sample traffic data and corresponding recognition results from the sample training traffic data to construct a normal type sample set; obtain malicious type sample traffic data and corresponding recognition results from the sample training traffic data to construct a malicious type sample set;

[0027] Obtain malicious type sample traffic data from the sample training traffic data, add random perturbations, obtain recognition results corresponding to malicious type adversarial sample data and the malicious type sample traffic data, and construct a malicious type adversarial sample set;

[0028] The protocol feature analysis model is trained by using the normal type sample set, the malicious type sample set, and the malicious type adversarial sample set to optimize the control parameters of the protocol feature analysis model;

[0029] The pre-processed traffic data is processed by the generator in the protocol feature analysis model, the adversarial sub-data in the pre-processed traffic data is reconstructed and restored, the original sub-data in the pre-processed traffic data is retained, the generated traffic data is obtained, and input into the discriminator for malicious access identification to obtain the traffic verification result.

[0030] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, which obtains malicious type sample traffic data from the sample training traffic data, adds random perturbations, obtains recognition results corresponding to malicious type adversarial sample data and the malicious type sample traffic data, and constructs a malicious type adversarial sample set; comprising:

[0031] Obtaining the malicious type sample traffic data and corresponding identification results;

[0032] Constructing a classification plane based on the recognition results corresponding to the normal type sample traffic data and the recognition results corresponding to the malicious type sample traffic data, and obtaining a classification area corresponding to the recognition results of the malicious type sample traffic data;

[0033] Obtaining a distance value between the malicious type sample traffic data and the nearest boundary of the classification area;

[0034] Random disturbance is added to the malicious type sample traffic data based on the distance value to generate malicious type adversarial sample data, and the recognition results corresponding to the malicious type adversarial sample data and the malicious type sample traffic data are constructed into a malicious type adversarial sample set.

[0035] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, the steps of: training the protocol feature analysis model using the normal type sample set, the malicious type sample set, and the malicious type adversarial sample set, and optimizing the control parameters of the protocol feature analysis model; comprising:

[0036] Obtaining normal type sample flow data from the normal type sample set and inputting it into a generator for processing, generating model-processed normal sample data, respectively discriminating the normal type sample flow data and the model-processed normal sample data through a discriminator, and evaluating the estimation deviation and judgment deviation of the generator and the discriminator on the normal type sample set based on a first discriminator loss function and a first generator loss function, respectively;

[0037]

[0038] in, is the first discriminator loss function, (x1, f(x1)) is the normal type sample set, x1 is the normal type sample traffic data, f(x1) is the recognition result corresponding to the normal type sample traffic data, Px1 is the probability distribution of the normal type sample traffic data, E is the expectation of the true recognition result, D(G(x1)) is the discriminator's discrimination result on the model processing normal sample data, D(x1) is the discriminator's discrimination result on the normal type sample traffic data, is the first generator loss function;

[0039] Obtain malicious type sample traffic data from the malicious type sample set and input it into a generator for processing, generate a model to process malicious sample data, use a discriminator to discriminate the malicious type sample traffic data and the model-processed malicious sample data, and evaluate the estimation deviation and judgment deviation of the generator and the discriminator on the malicious type sample set based on a second discriminator loss function and a second generator loss function, respectively;

[0040]

[0041] in, is the loss function of the second discriminator, (x2, f(x2)) is the malicious type sample set, x2 is the malicious type sample traffic data, f(x2) is the recognition result corresponding to the malicious type sample traffic data, Px2 is the probability distribution of the malicious type sample traffic data, D(G(x2)) is the discriminator's discrimination result on the model processing malicious sample data, D(x2) is the discriminator's discrimination result on the malicious type sample traffic data, is the second generator loss function;

[0042] Obtain malicious type adversarial sample data from the malicious type adversarial sample set and input it into the generator for processing, generate a model to process malicious adversarial samples, use a discriminator to discriminate the malicious type adversarial sample data and the model-processed malicious adversarial samples, and evaluate the estimation deviation and judgment deviation of the generator and the discriminator on the malicious type adversarial sample set based on a third discriminator loss function and a third generator loss function, respectively;

[0043]

[0044] in, is the loss function of the third discriminator, (x3, f(x3)) is the malicious type adversarial sample set, x3 is the malicious type adversarial sample data, f(x3) is the recognition result corresponding to the malicious type adversarial sample data, Px3 is the probability distribution of the malicious type adversarial sample data, D(G(x3)) is the discriminator's discrimination result on the model processing of malicious adversarial samples, is the third generator loss function;

[0045] Constructing a discriminator comprehensive loss function according to the first discriminator loss function, the second discriminator loss function, and the third discriminator loss function, and optimizing the control parameters of the discriminator by minimizing the discriminator loss function value;

[0046]

[0047] Among them, L D is the discriminator comprehensive loss function, α1 is the first weight parameter, α2 is the second weight parameter, and α3 is the third weight parameter;

[0048] Constructing a generator comprehensive loss function according to the first generator loss function, the second generator loss function, and the third generator loss function, and optimizing the control parameters of the generator by minimizing the generator loss function values;

[0049]

[0050] Among them, L G is the comprehensive loss function of the generator.

[0051] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, the steps of: scheduling the traffic data to be cleaned to a high-defense computer room for traffic cleaning through a traffic scheduling mechanism, filtering malicious access traffic, and forwarding normal traffic sub-data in the traffic data to be cleaned to a source server through a port protocol; including:

[0052] Based on the traffic scheduling mechanism, the traffic data to be cleaned is encapsulated in a Hypertext Transfer Protocol command, encoded using a preset data exchange format, and transmitted to the network entrance of the high-defense computer room;

[0053] Evaluate the required cleaning and protection resources based on the volume of the traffic data to be cleaned, and apply for corresponding processing resources from the high-defense computer room for efficient processing of the traffic data to be cleaned;

[0054] When the high-defense computer room completes processing of the traffic data to be cleaned and there is no traffic data cleaning task at present, the communication connection with the network entrance of the high-defense computer room is disconnected based on the traffic scheduling mechanism.

[0055] Preferably, the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the steps of: scheduling the traffic data to be cleaned to a high-defense computer room for traffic cleaning through a traffic scheduling mechanism, filtering malicious access traffic, and forwarding normal traffic sub-data in the traffic data to be cleaned to a source server through a port protocol; and further comprising:

[0056] Detect malicious traffic sub-data in the traffic data to be cleaned, analyze the attack source that initiated the malicious traffic sub-data, obtain the attack event log and behavior characteristics of the attack source, and build an attack fingerprint library;

[0057] The attack fingerprint library is shared with the high-defense computer rooms of other service providers to obtain the processing status of the traffic data initiated by the attack source by the high-defense computer rooms of other service providers. When it is detected that the attack source continues to launch defensive distributed denial of service attacks, the network address of the attack source is actively blocked by cooperating with the high-defense computer rooms of other service providers.

[0058] The present invention provides a traffic scheduling system for defending against distributed denial of service attacks, comprising:

[0059] A traffic monitoring module is used to collect bandwidth occupancy, number of protocol connections, and data packet rate of traffic data based on a traffic monitoring mechanism, calculate traffic residual value data, and mark the traffic data as pre-processed traffic data when the traffic residual value data exceeds a preset threshold data;

[0060] A traffic verification module is used to perform malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result;

[0061] a data processing module configured to dispatch the pre-processed traffic data to an origin server via a public network when, based on the traffic verification result, it is determined that the pre-processed traffic data is a normal access; and further configured to add a cleaning flag to the pre-processed traffic data to generate traffic data to be cleaned when, based on the traffic verification result, it is determined that the pre-processed traffic data is a malicious access;

[0062] The traffic scheduling module is used to schedule the traffic data to be cleaned to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, filter malicious access traffic, and forward the normal traffic sub-data in the traffic data to be cleaned to the source server through the port protocol.

[0063] Compared with traditional technologies, the beneficial effects of the present invention are: a traffic scheduling method and system for defending against distributed denial of service attacks, which realizes the judgment of the occurrence of distributed denial of service attack behavior in traffic data based on the traffic monitoring mechanism, and performs malicious access verification based on the protocol feature analysis model, effectively reducing the misjudgment rate of attack behavior, and scheduling the pre-processed traffic data based on the traffic scheduling mechanism according to the obtained traffic verification results. When the pre-processed traffic data is a malicious access, the traffic data to be cleaned is obtained and scheduled to a high-defense computer room for traffic cleaning to filter out malicious access traffic; compared with traditional technologies, the technical solution of the present invention only performs cleaning processing through a high-defense computer room when the pre-processed traffic data is a malicious access, effectively avoiding the problem of processing all traffic data and wasting bandwidth resources, thereby effectively reducing network service costs, and based on the traffic scheduling mechanism, when the pre-processed traffic data is a normal access, the pre-processed traffic data is scheduled through the public network, avoiding the problem of long-term blocking by the operator's black hole strategy, resulting in business interruption, avoiding further cost increase, and achieving rapid scheduling of traffic data while ensuring network security operation.

[0064] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purposes and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0065] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A flow chart of a traffic scheduling method for defending against distributed denial of service attacks provided by the present invention;

[0067] Figure 2 This is a structural diagram of a traffic scheduling system for defending against distributed denial of service attacks provided by the present invention. DETAILED DESCRIPTION

[0068] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0069] Example 1:

[0070] The embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks. Figure 1 ,include:

[0071] Based on the traffic monitoring mechanism, the bandwidth occupancy rate, number of protocol connections, and packet rate of traffic data are collected, and the traffic residual value data is calculated. When the traffic residual value data exceeds the preset threshold data, the traffic data is marked as pre-processed traffic data;

[0072] Perform malicious access verification on pre-processed traffic data based on the protocol feature analysis model to obtain traffic verification results;

[0073] If the pre-processed traffic data is judged to be normal access based on the traffic verification results, the pre-processed traffic data is dispatched to the origin server via the public network.

[0074] When the pre-processed traffic data is judged as malicious access according to the traffic verification result, a cleaning mark is added to the pre-processed traffic data to generate traffic data to be cleaned;

[0075] Through the traffic scheduling mechanism, the traffic data to be cleaned is dispatched to the high-defense computer room for traffic cleaning, malicious access traffic is filtered, and the normal traffic sub-data in the traffic data to be cleaned is forwarded to the source server through the port protocol.

[0076] In the above embodiment, based on the traffic monitoring mechanism, the bandwidth occupancy rate, number of protocol connections, and packet rate of traffic data are collected, and the traffic residual value data is calculated. When the traffic residual value data exceeds the preset threshold data, the traffic data is marked as pre-processed traffic data, and malicious access verification is performed on the pre-processed traffic data based on the protocol feature analysis model to obtain the traffic verification result;

[0077] When the pre-processed traffic data is judged to be normal access based on the traffic verification results, the pre-processed traffic data is dispatched to the origin server via the public network;

[0078] When the pre-processed traffic data is judged to be malicious access based on the traffic verification results, a cleaning mark is added to the pre-processed traffic data to generate traffic data to be cleaned; the traffic data to be cleaned is dispatched to the high-defense computer room through the traffic scheduling mechanism for traffic cleaning, malicious access traffic is filtered, and the normal traffic sub-data in the traffic data to be cleaned is forwarded to the source server through the port protocol.

[0079] In the above embodiments, the traffic scheduling mechanism schedules the pre-processed traffic data to the source server through the public network when the pre-processed traffic data is a normal access; when the pre-processed traffic data is a malicious access, it is scheduled to the high-defense computer room for rapid cleaning. After the attack is over, the pre-processed traffic data is transmitted through the public network.

[0080] In one embodiment, through traffic monitoring mechanism monitoring, protocol feature analysis model verification and traffic scheduling mechanism scheduling, the bandwidth utilization of the high-defense computer room is effectively improved, from the industry average of 5% to 92%, and the defense cost is reduced to 1 / 100 of the traditional solution.

[0081] The beneficial effects of the above technology are: based on the traffic monitoring mechanism, it realizes the judgment of the distributed denial of service attack behavior of the traffic data, and performs malicious access verification based on the protocol feature analysis model, effectively reducing the misjudgment rate of the attack behavior, and scheduling the pre-processed traffic data based on the traffic scheduling mechanism according to the obtained traffic verification results. When the pre-processed traffic data is a malicious access, the traffic data to be cleaned is obtained and scheduled to the high-defense computer room for traffic cleaning to filter out malicious access traffic; compared with traditional technologies, the traffic scheduling method for defending against distributed denial of service attacks only performs cleaning processing through the high-defense computer room when the pre-processed traffic data is a malicious access, effectively avoiding the problem of processing all traffic data and wasting bandwidth resources, effectively reducing network service costs, and based on the traffic scheduling mechanism, when the pre-processed traffic data is a normal access, the pre-processed traffic data is scheduled through the public network, avoiding the problem of long-term blocking caused by the operator's black hole strategy, resulting in business interruption, avoiding further cost increase, and realizing rapid scheduling of traffic data while ensuring network security operation.

[0082] Example 2:

[0083] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the following steps: based on a traffic monitoring mechanism, collecting bandwidth occupancy, number of protocol connections, and packet rate of traffic data, calculating traffic residual value data, and marking the traffic data as pre-processed traffic data when the traffic residual value data exceeds a preset threshold value; and comprising:

[0084] The traffic residual value data is calculated based on the bandwidth utilization rate, number of protocol connections, and packet rate of traffic data through a cubic polynomial regression model;

[0085] y=Obw*t 3 +N*t 2 +Pr*t+d

[0086] Where y is the traffic residual value data, Obw is the bandwidth occupancy rate, N is the number of protocol connections, Pr is the packet rate, t is the time parameter, and d is the constant term.

[0087] In the above embodiment, a cubic polynomial regression model is used to calculate the traffic residual value data based on the bandwidth occupancy rate, number of protocol connections, and packet rate of the traffic data. When the traffic residual value data exceeds the preset threshold data, the traffic data is identified as a defense against a distributed denial of service attack and marked.

[0088] In one embodiment, if the bandwidth Obw of the traffic residual value data is ≥95% and the packet rate Pr is ≥300% for 60 consecutive seconds, it is determined to be defending against a distributed denial of service attack.

[0089] The beneficial effect of the above technology is that: based on the cubic polynomial regression model, the calculation of traffic residual value data is realized, and then through the preset threshold data, the detection of traffic data defense against distributed denial of service attacks is realized.

[0090] Example 3:

[0091] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the steps of performing malicious access verification on pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result; and comprising:

[0092] Detect non-standard protocol fields in pre-processed traffic data for anomaly analysis and obtain traffic verification results; including:

[0093] Obtain the protocol address and sequence number packet of pre-processed traffic data;

[0094] Detect the corresponding protocol geographic location based on the protocol address. By obtaining the location information of the user who sent the pre-processed traffic data, detect whether it is consistent with the protocol geographic location. If the detection is inconsistent, obtain its corresponding historical network behavior based on the protocol address. If the protocol address has high-frequency requests and unreasonable access paths, the protocol address is judged to be a pseudo-protocol address.

[0095] Set the virtual server to parse and process the sequence number packet. If an error occurs in the virtual server during the parsing process, the sequence number packet will be identified as a malformed data packet.

[0096] When it is determined that the protocol address of the pre-processed traffic data is a pseudo-protocol address and the sequence number packet is a malformed data packet, the pre-processed traffic data is verified to be a malicious access, and a corresponding traffic verification result is obtained;

[0097] After the virtual server completes parsing the serial number packet, it returns the serial number packet and character confirmation packet to the user end, establishes a communication connection between the virtual server and the user end, and continuously monitors the access traffic data sent by the user end. When it is detected that there is no abnormality in the access traffic data within the preset time period, the access traffic data is forwarded to the source server; when it is detected that the access traffic data causes the virtual server to crash or occupy a large amount of computing resources, the user end sending the pre-processed traffic data will be judged as a malicious access port, and the user end’s network access will be denied.

[0098] In the above embodiment, the non-standard protocol field of the pre-processed traffic data is detected to perform abnormality analysis and obtain the traffic verification result.

[0099] In the above embodiments, the protocol address of the pre-processed traffic data is obtained, and the corresponding protocol geographic location is detected based on the protocol address. By obtaining the location information of the user who sends the pre-processed traffic data, it is detected whether it is consistent with the protocol geographic location. When the detection is inconsistent, its corresponding historical network behavior is obtained based on the protocol address. When there are high-frequency requests and unreasonable access paths in the protocol address, the protocol address is judged to be a pseudo-protocol address.

[0100] In the above embodiment, a sequence number packet of pre-processed traffic data is obtained, and a virtual server is set to parse and process the sequence number packet. If an error occurs in the virtual server during the parsing process, the sequence number packet is identified as a malformed data packet.

[0101] In the above embodiment, when the protocol address of the acquired pre-processed traffic data is a pseudo-protocol address and the sequence number packet is a malformed data packet, the pre-processed traffic data is verified to be a malicious access, and a corresponding traffic verification result is obtained.

[0102] In the above embodiments, after the virtual server completes parsing the serial number packet, it returns the serial number packet and character confirmation packet to the user terminal, establishes a communication connection between the virtual server and the user terminal, continuously monitors the access traffic data sent by the user terminal, and when it is detected that there is no abnormality in the access traffic data within a preset time period, the access traffic data is forwarded to the source server; when it is detected that the access traffic data causes the virtual server to crash or occupy a large amount of computing resources, the user terminal sending the pre-processed traffic data is judged as a malicious access port, and the user terminal's network access is denied.

[0103] The beneficial effects of the above technology are: by obtaining the non-standard protocol fields of the pre-processed traffic data for abnormal analysis, specifically by obtaining the protocol address and serial number packet of the pre-processed traffic data, performing pseudo-protocol address detection and deformed datagram detection, realizing the detection of malicious access to the pre-processed traffic data, obtaining the traffic verification result, and setting the virtual server to establish a communication connection with the user end through the serial number packet, continuously monitoring the access traffic data sent by the user end, so as to improve the security of traffic data processing.

[0104] Example 4:

[0105] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the steps of: performing malicious access verification on pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result; and further comprising:

[0106] By building a generator and a discriminator, a protocol feature analysis model is obtained;

[0107] Obtain sample traffic data, perform one-hot encoding on sample non-numerical traffic sub-data in the sample traffic data, and construct sample training traffic data based on the one-hot encoded sample non-numerical traffic sub-data and the sample numerical traffic sub-data;

[0108] Obtain normal type sample traffic data and corresponding recognition results from the sample training traffic data to construct a normal type sample set; obtain malicious type sample traffic data and corresponding recognition results from the sample training traffic data to construct a malicious type sample set;

[0109] Obtain malicious type sample traffic data from the sample training traffic data, add random perturbations, obtain the recognition results corresponding to the malicious type adversarial sample data and the malicious type sample traffic data, and construct a malicious type adversarial sample set;

[0110] The protocol feature analysis model is trained using normal sample sets, malicious sample sets, and malicious adversarial sample sets to optimize the control parameters of the protocol feature analysis model.

[0111] The pre-processed traffic data is processed by the generator in the protocol feature analysis model, the adversarial sub-data in the pre-processed traffic data is reconstructed and restored, the original sub-data in the pre-processed traffic data is retained, the generated traffic data is obtained, and input into the discriminator for malicious access identification to obtain the traffic verification result.

[0112] In the above embodiments, a generator and a discriminator are constructed based on a generative adversarial network to obtain a protocol feature analysis model.

[0113] In the above embodiment, sample flow data is obtained, sample non-numerical flow sub-data in the sample flow data are one-hot encoded, and sample training flow data is constructed based on the one-hot encoded sample non-numerical flow sub-data and sample numerical flow sub-data.

[0114] In the above embodiments, normal type sample traffic data and corresponding recognition results are obtained from the sample training traffic data to construct a normal type sample set; malicious type sample traffic data and corresponding recognition results are obtained from the sample training traffic data to construct a malicious type sample set; malicious type sample traffic data is obtained from the sample training traffic data, random perturbations are added, malicious type adversarial sample data and recognition results corresponding to the malicious type sample traffic data are obtained, and a malicious type adversarial sample set is constructed.

[0115] In the above embodiments, the protocol feature analysis model is trained using a normal type sample set, a malicious type sample set, and a malicious type adversarial sample set, the control parameters of the protocol feature analysis model are optimized, and the trained protocol feature analysis model is used to pre-process malicious access verification of traffic data.

[0116] In the above embodiments, the pre-processed traffic data is processed by the generator in the protocol feature analysis model, the adversarial sub-data in the pre-processed traffic data is reconstructed and restored, the original sub-data in the pre-processed traffic data is retained, the generated traffic data is obtained, and input into the discriminator for malicious access identification to obtain the traffic verification result.

[0117] The beneficial effects of the above technology are: by performing one-hot encoding on the sample non-numerical traffic sub-data in the sample traffic data, the encoding processing of the sample traffic data is realized, and the sample training traffic data is obtained, which is convenient for training the protocol feature analysis model. Based on the sample training traffic data, a normal type sample set, a malicious type sample set, and a malicious type adversarial sample set are constructed for training, which can effectively improve the performance of the generator reconstruction and recovery in the protocol feature analysis model, improve the recognition accuracy of the discriminator, and then realize the malicious access verification of the pre-processed traffic data and obtain the traffic verification results.

[0118] Example 5:

[0119] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks. The method obtains malicious sample traffic data from sample training traffic data, adds random perturbations, obtains recognition results corresponding to malicious adversarial sample data and malicious sample traffic data, and constructs a malicious adversarial sample set. The method comprises:

[0120] Obtain malicious sample traffic data and corresponding identification results;

[0121] Construct a classification plane based on the recognition results corresponding to the normal type sample traffic data and the recognition results corresponding to the malicious type sample traffic data, and obtain the classification area corresponding to the recognition results of the malicious type sample traffic data;

[0122] Obtain the distance between the malicious sample traffic data and the nearest boundary of the classification area;

[0123] Random perturbations are added to malicious type sample traffic data based on the distance value to generate malicious type adversarial sample data. The recognition results corresponding to the malicious type adversarial sample data and the malicious type sample traffic data are constructed into a malicious type adversarial sample set.

[0124] In the above embodiments, a classification plane is constructed based on the recognition results corresponding to normal type sample traffic data and the recognition results corresponding to malicious type sample traffic data, the distance value of the malicious type sample traffic data from the nearest boundary of the classification area is obtained, and random perturbations are added to the malicious type sample traffic data based on the distance value to generate malicious type adversarial sample data, and a malicious type adversarial sample set is constructed together with the corresponding classification results.

[0125] The beneficial effects of the above technology are: according to the distance value between the malicious type sample traffic data and the nearest boundary of the classification area, the minimum disturbance is obtained, the malicious type sample traffic data is modified, and malicious type adversarial sample data is generated to cause the discriminator to make misjudgments. While realizing the construction of the malicious type adversarial sample set, the training effect of the protocol feature analysis model is improved.

[0126] Example 6:

[0127] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the steps of: training a protocol feature analysis model using a normal sample set, a malicious sample set, and a malicious adversarial sample set, and optimizing control parameters of the protocol feature analysis model; and comprising:

[0128] Obtain normal type sample flow data from the normal type sample set and input it into the generator for processing, generate a model to process the normal sample data, use the discriminator to discriminate the normal type sample flow data and the model-processed normal sample data, and evaluate the estimation deviation and judgment deviation of the generator and discriminator on the normal type sample set based on the first discriminator loss function and the first generator loss function respectively;

[0129]

[0130] in, is the first discriminator loss function, (x1, f(x1)) is the normal type sample set, x1 is the normal type sample traffic data, f(x1) is the recognition result corresponding to the normal type sample traffic data, Px1 is the probability distribution of the normal type sample traffic data, E is the expectation of the true recognition result, D(G(x1)) is the discriminator's discrimination result on the model processing normal sample data, D(x1) is the discriminator's discrimination result on the normal type sample traffic data, is the first generator loss function;

[0131] Obtain malicious sample traffic data from the malicious sample set and input it into the generator for processing, generate a model to process the malicious sample data, use the discriminator to discriminate the malicious sample traffic data and the model-processed malicious sample data, and evaluate the estimation deviation and judgment deviation of the generator and discriminator on the malicious sample set based on the second discriminator loss function and the second generator loss function respectively;

[0132]

[0133] in, is the loss function of the second discriminator, (x2, f(x2)) is the malicious type sample set, x2 is the malicious type sample traffic data, f(x2) is the recognition result corresponding to the malicious type sample traffic data, Px2 is the probability distribution of the malicious type sample traffic data, D(G(x2)) is the discriminator's discrimination result on the model processing malicious sample data, D(x2) is the discriminator's discrimination result on the malicious type sample traffic data, is the second generator loss function;

[0134] Obtain malicious adversarial sample data from the malicious adversarial sample set and input it into the generator for processing, generate a model to process the malicious adversarial sample, use the discriminator to discriminate the malicious adversarial sample data and the model-processed malicious adversarial sample, and evaluate the estimation bias and judgment bias of the generator and discriminator on the malicious adversarial sample set based on the third discriminator loss function and the third generator loss function respectively;

[0135]

[0136]

[0137] in, is the loss function of the third discriminator, (x3, f(x3)) is the malicious type adversarial sample set, x3 is the malicious type adversarial sample data, f(x3) is the recognition result corresponding to the malicious type adversarial sample data, Px3 is the probability distribution of the malicious type adversarial sample data, D(G(x3)) is the discriminator's discrimination result on the model processing of malicious adversarial samples, is the third generator loss function;

[0138] According to the first discriminator loss function, the second discriminator loss function, and the third discriminator loss function, a discriminator comprehensive loss function is constructed, and the control parameters of the discriminator are optimized by minimizing the discriminator loss function value;

[0139]

[0140] Among them, L D is the discriminator comprehensive loss function, α1 is the first weight parameter, α2 is the second weight parameter, and α3 is the third weight parameter;

[0141] According to the first generator loss function, the second generator loss function, and the third generator loss function, a generator comprehensive loss function is constructed, and the control parameters of the generator are optimized by minimizing the generator loss function value;

[0142]

[0143] Among them, L G is the comprehensive loss function of the generator.

[0144] In the above embodiments, the protocol feature analysis model is trained using a normal type sample set, a malicious type sample set, and a malicious type adversarial sample set to optimize the control parameters of the protocol feature analysis model.

[0145] In the above embodiments, after using a certain sample example in the normal type sample set to train the protocol feature analysis model, another sample example in the malicious type sample set or the malicious type adversarial sample set is used for training, so as to avoid using all the sample examples in the normal type sample set to train the protocol feature analysis model, and then using all the sample examples in another sample set for training, which causes the trained model to fall into a local optimum.

[0146] In the above embodiments, the generator and the discriminator are trained using a normal type sample set, and based on the first discriminator loss function, the discriminator's discrimination results for normal type sample flow data and model-processed normal sample data are made as close as possible, and based on the first generator loss function, the model-processed normal sample data generated by the generator is made close to the probability distribution of normal type sample flow data.

[0147] In the above embodiments, the generator and the discriminator are trained using a malicious type sample set, and based on the second discriminator loss function, the discriminator's discrimination results for malicious type sample traffic data and the model-processed malicious sample data are made as close as possible, and based on the second generator loss function, the model-processed malicious sample data generated by the generator is made close to the probability distribution of the malicious type sample traffic data.

[0148] In the above embodiments, both the normal type sample set and the malicious type sample set are benign samples, and the corresponding loss functions are constructed in the same way, but the protocol feature analysis model is trained separately. The reason is that the data distribution of the normal type sample set and the malicious type sample set is inconsistent. It also helps to balance the learning intensity of the protocol feature analysis model for the normal type sample set and the malicious type sample set.

[0149] In the above embodiments, the generator and the discriminator are trained using a set of malicious type adversarial samples, and based on the third discriminator loss function, the discriminator correctly discriminates whether the model processes malicious adversarial samples and malicious type sample traffic data. The discriminator learns adversarially with the generator to make the model process malicious adversarial samples and malicious type sample traffic data continuously close, that is, after the generator reconstructs the malicious type adversarial sample data, it continuously approaches the malicious type sample traffic data to eliminate disturbances.

[0150] In the above embodiments, by adjusting the weight parameters and calculating the comprehensive loss function of the discriminator and the comprehensive loss function of the generator, the performance of the obtained generator is optimized, and the malicious type sample traffic data can be mapped back to the recognition result corresponding to the malicious type sample traffic data, thereby achieving the effect of defending against adversarial samples and keeping the distribution of normal type sample sets and malicious type sample sets unaffected.

[0151] The beneficial effects of the above technology are: through normal type sample sets and malicious type sample sets, the protocol feature analysis model is trained based on benign samples, and the generator and discriminator are trained through malicious type adversarial sample sets, so that the trained generator can eliminate the jitter in the malicious type adversarial sample data, and the discriminator correctly obtains the discrimination result, realizing the function of the protocol feature analysis model to restore the adversarial sample to benign sample, and keeping the benign sample unchanged, so as to keep the trained protocol feature analysis model from being affected by the adversarial sample attack, and can achieve accurate access verification of the pre-processed traffic data.

[0152] Example 7:

[0153] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the following steps: dispatching traffic data to be cleaned to a high-defense computer room for traffic cleaning through a traffic scheduling mechanism, filtering malicious access traffic, and forwarding normal traffic sub-data in the traffic data to be cleaned to a source server through a port protocol; including:

[0154] Based on the traffic scheduling mechanism, the traffic data to be cleaned is encapsulated in a Hypertext Transfer Protocol command, encoded using a preset data exchange format, and transmitted to the network entrance of the high-defense computer room;

[0155] Evaluate the required cleaning and protection resources based on the volume of traffic data to be cleaned, and apply for corresponding processing resources from the high-defense data center to efficiently process the traffic data to be cleaned.

[0156] When the high-defense computer room completes the processing of the traffic data to be cleaned and there is no traffic data cleaning task at present, the communication connection with the high-defense computer room network entrance is disconnected based on the traffic scheduling mechanism.

[0157] In the above embodiments, the traffic scheduling mechanism may be implemented as the DOH (DNS over HTTPS) protocol.

[0158] In one embodiment, the traffic scheduling mechanism encapsulates the traffic data to be cleaned transmitted by the DNS protocol in the GET command of the HTTPS protocol, and sends it to the network entrance of the high-defense computer room in JSON encoding to ensure the security and accuracy of traffic scheduling.

[0159] In one embodiment, DNS scheduling relies on traditional DNS protocols (such as UDP), which suffer from long delays (typically >10 minutes) and large scheduling errors (approximately 5%-10%), making it unable to meet the rapid switching requirements in attack scenarios. Static traffic allocation strategies cannot dynamically respond to attack characteristics, resulting in low utilization of scrubbing resources. The DOH protocol enables rapid scheduling of traffic data, breaking through the latency bottleneck of traditional DNS scheduling.

[0160] In one embodiment, the HTTPS tunnel feature of the DOH protocol (which is 8 times faster than traditional DNS scheduling) is utilized to achieve millisecond-level traffic switching when attacked, accurately directing attack traffic to high-defense computer room nodes, forcing attackers to pay more than 10 times the traffic cost to maintain the attack effect.

[0161] In the above embodiments, the required cleaning and protection resources are evaluated based on the data volume of the traffic data to be cleaned, and the corresponding processing resources are applied to the high-defense computer room so that the high-defense computer room can call the corresponding processing resources for processing, avoiding slow processing due to insufficient resources or waste of processing resources, and realizing dynamic on-demand matching of high-defense resources.

[0162] In the above embodiments, based on the traffic scheduling mechanism, the processing of the traffic data to be cleaned is completed in the high-defense computer room, and when there is no traffic data cleaning task, the traffic data is processed through the public network.

[0163] The beneficial effects of the above technology are: based on the traffic scheduling mechanism, the traffic data to be cleaned is scheduled to the high-defense computer room for data processing, and after the processing is completed, the communication connection with the network entrance of the high-defense computer room is disconnected, and the traffic data is processed by the public network, realizing rapid switching and scheduling of traffic data.

[0164] Example 8:

[0165] An embodiment of the present invention provides a traffic scheduling method for defending against distributed denial of service attacks, comprising the following steps: dispatching traffic data to be cleaned to a high-defense computer room for traffic cleaning through a traffic scheduling mechanism, filtering malicious access traffic, and forwarding normal traffic sub-data in the traffic data to be cleaned to a source server through a port protocol; and further comprising:

[0166] Detect malicious traffic sub-data in the traffic data to be cleaned, analyze the attack source that initiated the malicious traffic sub-data, obtain the attack event log and behavior characteristics of the attack source, and build an attack fingerprint library;

[0167] Share the attack fingerprint library with the high-defense computer rooms of other service providers to obtain the processing status of the traffic data initiated by the attack source by the high-defense computer rooms of other service providers. When it is detected that the attack source continues to launch defensive distributed denial of service attacks, the network address of the attack source is actively blocked by cooperating with the high-defense computer rooms of other service providers.

[0168] In the above embodiments, by detecting malicious traffic sub-data in the traffic data to be cleaned, the attack source that initiates the malicious traffic sub-data is obtained, and its attack event log and behavior characteristics are recorded to build an attack fingerprint library, which stores the attack source and corresponding key information.

[0169] In the above embodiment, the constructed attack fingerprint library is shared with the high-defense computer rooms of other service providers, realizing data sharing based on the attack fingerprint library in the high-defense computer rooms, and recording the processing of traffic data initiated by the attack source in the attack fingerprint library by other high-risk rooms. When it is detected that the attack source continues to launch defensive distributed denial of service attacks, the network address of the attack source is actively blocked by cooperating with the high-defense computer rooms of other service providers.

[0170] The beneficial effects of the above technology are: in the process of processing the cleaned traffic data in the high-defense computer room, the attack source of the malicious traffic sub-data is obtained, and its behavioral characteristics are analyzed, an attack fingerprint library is built and shared with the high-defense computer rooms of other service providers, thereby marking the attack source, and then realizing the active defense of the traffic data initiated by the high-defense computer room against the attack source. Moreover, through data sharing between high-defense computer rooms, the attack source that continuously launches defense distributed denial of service attacks is jointly and actively banned, so as to reduce the probability of secondary attacks by the attack source and improve the network environment.

[0171] Example 9:

[0172] The embodiment of the present invention provides a traffic scheduling system for defending against distributed denial of service attacks. Figure 2 ,include:

[0173] The traffic monitoring module is used to collect the bandwidth occupancy rate, number of protocol connections, and packet rate of traffic data based on the traffic monitoring mechanism, calculate the traffic residual value data, and mark the traffic data as pre-processed traffic data when the traffic residual value data exceeds the preset threshold data;

[0174] A traffic verification module is used to verify malicious access to pre-processed traffic data based on a protocol feature analysis model and obtain traffic verification results;

[0175] The data processing module is used to dispatch the pre-processed traffic data to the origin server via the public network when the pre-processed traffic data is judged to be normal access based on the traffic verification result; and is also used to add a cleaning mark to the pre-processed traffic data when the pre-processed traffic data is judged to be malicious access based on the traffic verification result, thereby generating traffic data to be cleaned;

[0176] The traffic scheduling module is used to dispatch the traffic data to be cleaned to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, filter malicious access traffic, and forward the normal traffic sub-data in the traffic data to be cleaned to the source server through the port protocol.

[0177] In the above embodiment, the traffic monitoring module collects the bandwidth occupancy rate, number of protocol connections, and packet rate of traffic data based on the traffic monitoring mechanism, calculates the traffic residual value data, and marks the traffic data as pre-processed traffic data when the traffic residual value data exceeds the preset threshold data. The traffic verification module performs malicious access verification on the pre-processed traffic data based on the protocol feature analysis model to obtain the traffic verification result;

[0178] When the data processing module determines that the pre-processed traffic data is normal access based on the traffic verification results, it dispatches the pre-processed traffic data to the source server through the public network; when the data processing module determines that the pre-processed traffic data is malicious access based on the traffic verification results, it adds a cleaning mark to the pre-processed traffic data and generates traffic data to be cleaned;

[0179] The traffic scheduling module dispatches the traffic data to be cleaned to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, filters malicious access traffic, and forwards the normal traffic sub-data in the traffic data to be cleaned to the source server through the port protocol.

[0180] In the above embodiments, the traffic scheduling mechanism schedules the pre-processed traffic data to the source server through the public network when the pre-processed traffic data is a normal access; when the pre-processed traffic data is a malicious access, it is scheduled to the high-defense computer room for rapid cleaning. After the attack is over, the pre-processed traffic data is transmitted through the public network.

[0181] The beneficial effects of the above technology are: based on the traffic monitoring mechanism, it realizes the judgment of the distributed denial of service attack behavior of the traffic data, and performs malicious access verification based on the protocol feature analysis model, effectively reducing the misjudgment rate of the attack behavior, and scheduling the pre-processed traffic data based on the traffic scheduling mechanism according to the obtained traffic verification results. When the pre-processed traffic data is a malicious access, the traffic data to be cleaned is obtained and scheduled to the high-defense computer room for traffic cleaning to filter out malicious access traffic; compared with traditional technologies, the traffic scheduling system for defending against distributed denial of service attacks only performs cleaning processing through the high-defense computer room when the pre-processed traffic data is a malicious access, effectively avoiding the problem of processing all traffic data and wasting bandwidth resources, effectively reducing network service costs, and based on the traffic scheduling mechanism, when the pre-processed traffic data is a normal access, the pre-processed traffic data is scheduled through the public network, avoiding the problem of long-term blocking caused by the operator's black hole strategy, resulting in business interruption, avoiding further cost increase, and realizing rapid scheduling of traffic data while ensuring network security operation.

[0182] In one embodiment, a traffic scheduling system for defending against distributed denial-of-service attacks shifts the defense model from continuous, high-cost preparedness to dynamic, on-demand defense, achieving a paradigm shift in the cost-to-attack game. Actual data shows that in a high-traffic business scenario with 10 million users, annual defense costs can be reduced from approximately 30 million yuan to around 300,000 yuan, while simultaneously improving service availability from 89.7% to 99.995%.

[0183] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A traffic scheduling method for defending against distributed denial of service attacks, characterized in that: include: Based on the traffic monitoring mechanism, the bandwidth occupancy rate, number of protocol connections, and data packet rate of the traffic data are collected, and the traffic residual value data is calculated. When the traffic residual value data exceeds the preset threshold data, the traffic data is marked as pre-processed traffic data; Perform malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result; When it is determined, based on the traffic verification result, that the pre-processed traffic data is a normal access, the pre-processed traffic data is dispatched to the source server via the public network; When it is determined based on the traffic verification result that the pre-processed traffic data is a malicious access, a cleaning flag is added to the pre-processed traffic data to generate traffic data to be cleaned; The traffic data to be cleaned is dispatched to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, malicious access traffic is filtered, and the normal traffic sub-data in the traffic data to be cleaned is forwarded to the source server through the port protocol.

2. A traffic scheduling method for defending against distributed denial of service attacks according to claim 1, characterized in that: The steps include: collecting bandwidth occupancy, number of protocol connections, and data packet rate of traffic data based on a traffic monitoring mechanism, calculating traffic residual value data, and marking the traffic data as pre-processed traffic data when the traffic residual value data exceeds a preset threshold value; including: The traffic residual value data is calculated based on the bandwidth utilization rate, number of protocol connections, and packet rate of traffic data through a cubic polynomial regression model; y=Obw*t 3 +N*t 2 +Pr*t+d Where y is the traffic residual value data, Obw is the bandwidth occupancy rate, N is the number of protocol connections, Pr is the packet rate, t is the time parameter, and d is the constant term.

3. A traffic scheduling method for defending against distributed denial of service attacks according to claim 1, characterized in that: The step of performing malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result includes: Detecting the non-standard protocol fields of the pre-processed traffic data for abnormal analysis and obtaining traffic verification results; including: Obtaining the protocol address and sequence number package of the pre-processed traffic data; Detecting a corresponding protocol geographic location based on the protocol address, detecting whether the location information of the user who sent the pre-processed traffic data is consistent with the protocol geographic location by obtaining the location information of the user who sent the pre-processed traffic data, and when the location information is inconsistent, obtaining the corresponding historical network behavior based on the protocol address, and determining that the protocol address is a pseudo-protocol address if there are high-frequency requests and unreasonable access paths at the protocol address; Setting a virtual server to parse and process the sequence number packet, and if an error occurs in the virtual server during the parsing process, identifying the sequence number packet as a malformed data packet; If it is determined that the protocol address of the pre-processed traffic data is a pseudo-protocol address and the sequence number packet is a malformed data packet, the pre-processed traffic data is verified to be a malicious access, and a corresponding traffic verification result is obtained; After the virtual server completes parsing the serial number packet, it returns the serial number packet and character confirmation packet to the user terminal, establishes a communication connection between the virtual server and the user terminal, continuously monitors the access traffic data sent by the user terminal, and when it is detected that there is no abnormality in the access traffic data within a preset time period, forwards the access traffic data to the source server; when it is detected that the access traffic data causes the virtual server to crash or occupy a large amount of computing resources, the user terminal that sent the pre-processed traffic data is judged as a malicious access port, and the network access of the user terminal is denied.

4. A traffic scheduling method for defending against distributed denial of service attacks according to claim 1, characterized in that: The step of performing malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result also includes: By building a generator and a discriminator, a protocol feature analysis model is obtained; Obtain sample traffic data, perform one-hot encoding on sample non-numerical traffic sub-data in the sample traffic data, and construct sample training traffic data based on the one-hot encoded sample non-numerical traffic sub-data and the sample numerical traffic sub-data; Obtain normal type sample traffic data and corresponding recognition results from the sample training traffic data to construct a normal type sample set; obtain malicious type sample traffic data and corresponding recognition results from the sample training traffic data to construct a malicious type sample set; Obtain malicious type sample traffic data from the sample training traffic data, add random perturbations, obtain recognition results corresponding to malicious type adversarial sample data and the malicious type sample traffic data, and construct a malicious type adversarial sample set; The protocol feature analysis model is trained by using the normal type sample set, the malicious type sample set, and the malicious type adversarial sample set to optimize the control parameters of the protocol feature analysis model; The pre-processed traffic data is processed by the generator in the protocol feature analysis model, the adversarial sub-data in the pre-processed traffic data is reconstructed and restored, the original sub-data in the pre-processed traffic data is retained, the generated traffic data is obtained, and input into the discriminator for malicious access identification to obtain the traffic verification result.

5. A traffic scheduling method for defending against distributed denial of service attacks according to claim 4, characterized in that: Obtain malicious type sample traffic data from the sample training traffic data, add random perturbations, obtain recognition results corresponding to malicious type adversarial sample data and the malicious type sample traffic data, and construct a malicious type adversarial sample set; including: Obtaining the malicious type sample traffic data and corresponding identification results; Constructing a classification plane based on the recognition results corresponding to the normal type sample traffic data and the recognition results corresponding to the malicious type sample traffic data, and obtaining a classification area corresponding to the recognition results of the malicious type sample traffic data; Obtaining a distance value between the malicious type sample traffic data and the nearest boundary of the classification area; Random disturbance is added to the malicious type sample traffic data based on the distance value to generate malicious type adversarial sample data, and the recognition results corresponding to the malicious type adversarial sample data and the malicious type sample traffic data are constructed into a malicious type adversarial sample set.

6. A traffic scheduling method for defending against distributed denial of service attacks according to claim 4, characterized in that: The step of training the protocol feature analysis model using the normal sample set, the malicious sample set, and the malicious adversarial sample set to optimize the control parameters of the protocol feature analysis model includes: Obtaining normal type sample flow data from the normal type sample set and inputting it into a generator for processing, generating model-processed normal sample data, respectively discriminating the normal type sample flow data and the model-processed normal sample data through a discriminator, and evaluating the estimation deviation and judgment deviation of the generator and the discriminator on the normal type sample set based on a first discriminator loss function and a first generator loss function, respectively; in, is the first discriminator loss function, (x1, f(x1)) is the normal type sample set, x1 is the normal type sample traffic data, f(x1) is the recognition result corresponding to the normal type sample traffic data, Px1 is the probability distribution of the normal type sample traffic data, E is the expectation of the true recognition result, D(G(x1)) is the discriminator's discrimination result on the model processing normal sample data, D(x1) is the discriminator's discrimination result on the normal type sample traffic data, is the first generator loss function; Obtain malicious type sample traffic data from the malicious type sample set and input it into a generator for processing, generate a model to process malicious sample data, use a discriminator to discriminate the malicious type sample traffic data and the model-processed malicious sample data, and evaluate the estimation deviation and judgment deviation of the generator and the discriminator on the malicious type sample set based on a second discriminator loss function and a second generator loss function, respectively; in, is the loss function of the second discriminator, (x2, f(x2)) is the malicious type sample set, x2 is the malicious type sample traffic data, f(x2) is the recognition result corresponding to the malicious type sample traffic data, Px2 is the probability distribution of the malicious type sample traffic data, D(G(x2)) is the discriminator's discrimination result on the model processing malicious sample data, D(x2) is the discriminator's discrimination result on the malicious type sample traffic data, is the second generator loss function; Obtain malicious type adversarial sample data from the malicious type adversarial sample set and input it into the generator for processing, generate a model to process malicious adversarial samples, use a discriminator to discriminate the malicious type adversarial sample data and the model-processed malicious adversarial samples, and evaluate the estimation deviation and judgment deviation of the generator and the discriminator on the malicious type adversarial sample set based on a third discriminator loss function and a third generator loss function, respectively; in, is the loss function of the third discriminator, (x3, f(x3)) is the malicious type adversarial sample set, x3 is the malicious type adversarial sample data, f(x3) is the recognition result corresponding to the malicious type adversarial sample data, Px3 is the probability distribution of the malicious type adversarial sample data, D(G(x3)) is the discriminator's discrimination result on the model processing of malicious adversarial samples, is the third generator loss function; Constructing a discriminator comprehensive loss function according to the first discriminator loss function, the second discriminator loss function, and the third discriminator loss function, and optimizing the control parameters of the discriminator by minimizing the discriminator loss function value; Among them, L D is the discriminator comprehensive loss function, α1 is the first weight parameter, α2 is the second weight parameter, and α3 is the third weight parameter; Constructing a generator comprehensive loss function according to the first generator loss function, the second generator loss function, and the third generator loss function, and optimizing the control parameters of the generator by minimizing the generator loss function values; Among them, L G is the comprehensive loss function of the generator.

7. The traffic scheduling method for defending against distributed denial of service attacks according to claim 1, characterized in that: The step of dispatching the traffic data to be cleaned to the high-defense computer room for traffic cleaning through a traffic dispatching mechanism, filtering malicious access traffic, and forwarding normal traffic sub-data in the traffic data to be cleaned to the source server through a port protocol includes: Based on the traffic scheduling mechanism, the traffic data to be cleaned is encapsulated in a Hypertext Transfer Protocol command, encoded using a preset data exchange format, and transmitted to the network entrance of the high-defense computer room; Evaluate the required cleaning and protection resources based on the volume of the traffic data to be cleaned, and apply for corresponding processing resources from the high-defense computer room for efficient processing of the traffic data to be cleaned; When the high-defense computer room completes processing of the traffic data to be cleaned and there is no traffic data cleaning task at present, the communication connection with the network entrance of the high-defense computer room is disconnected based on the traffic scheduling mechanism.

8. A traffic scheduling method for defending against distributed denial of service attacks according to claim 7, characterized in that: The steps include: dispatching the traffic data to be cleaned to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, filtering malicious access traffic, and forwarding normal traffic sub-data in the traffic data to be cleaned to the source server through the port protocol; and also include: Detect malicious traffic sub-data in the traffic data to be cleaned, analyze the attack source that initiated the malicious traffic sub-data, obtain the attack event log and behavior characteristics of the attack source, and build an attack fingerprint library; The attack fingerprint library is shared with the high-defense computer rooms of other service providers to obtain the processing status of the traffic data initiated by the attack source by the high-defense computer rooms of other service providers. When it is detected that the attack source continues to launch defensive distributed denial of service attacks, the network address of the attack source is actively blocked by cooperating with the high-defense computer rooms of other service providers.

9. A traffic scheduling system for defending against distributed denial of service attacks, characterized in that: include: A traffic monitoring module is used to collect bandwidth occupancy, number of protocol connections, and data packet rate of traffic data based on a traffic monitoring mechanism, calculate traffic residual value data, and mark the traffic data as pre-processed traffic data when the traffic residual value data exceeds a preset threshold data; A traffic verification module is used to perform malicious access verification on the pre-processed traffic data based on a protocol feature analysis model to obtain a traffic verification result; a data processing module configured to dispatch the pre-processed traffic data to an origin server via a public network when, based on the traffic verification result, it is determined that the pre-processed traffic data is a normal access; and further configured to add a cleaning flag to the pre-processed traffic data to generate traffic data to be cleaned when, based on the traffic verification result, it is determined that the pre-processed traffic data is a malicious access; The traffic scheduling module is used to schedule the traffic data to be cleaned to the high-defense computer room for traffic cleaning through the traffic scheduling mechanism, filter malicious access traffic, and forward the normal traffic sub-data in the traffic data to be cleaned to the source server through the port protocol.

Images