IPv6 network DDoS attack detection and defense system based on deep learning

Abstract

The invention relates to the technical field of network security, in particular to an IPv6 network DDoS attack detection and defense system based on deep learning, which comprises a flow monitoring and data acquisition module, a preprocessing and feature extraction module, a deep learning attack detection module, an attack response and decision module and a defense execution and feedback module, the method comprises the following specific steps: S1, monitoring traffic in an IPv6 network in real time through a traffic monitoring and data acquisition module, and capturing traffic characteristics; s2, cleaning and preprocessing the collected original traffic data by a preprocessing and feature extraction module, and extracting key features related to the DDoS attack; according to the IPv6 network DDoS attack detection and defense system based on deep learning, abnormal traffic can be rapidly identified through the deep learning model in the system, timely response can be ensured when a DDoS attack occurs, real-time performance is ensured, a defense strategy can be automatically adjusted through the defense execution and feedback module, manual intervention is not needed, and the intelligent degree of defense is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an IPv6 network DDoS attack detection and defense system based on deep learning. Background Art

[0002] DDoS attack detection and defense systems are an important component of ensuring network security. They can effectively respond to distributed denial of service (DDoS) attacks and ensure the normal operation of network services. DDoS attack detection is the primary link in the defense system. By monitoring network traffic and abnormal behavior in real time, potential DDoS attacks can be discovered and identified in a timely manner.

[0003] Existing network DDoS attack detection and defense systems lack the ability to automatically adjust defense strategies, making the defense mechanism lack flexibility and real-time performance. Summary of the Invention

[0004] The purpose of the present invention is to provide an IPv6 network DDoS attack detection and defense system based on deep learning, so as to address the problem mentioned in the above background technology that existing network DDoS attack detection and defense systems lack the ability to automatically adjust defense strategies, thereby making the defense mechanism lack flexibility and real-time performance. To achieve the above purpose, the present invention provides the following technical solution: an IPv6 network DDoS attack detection and defense system based on deep learning, including a traffic monitoring and data acquisition module, a preprocessing and feature extraction module, a deep learning attack detection module, an attack response and decision module, and a defense execution and feedback module. The specific steps are as follows:

[0005] S1: Through the traffic monitoring and data collection module, it monitors the traffic in the IPv6 network in real time and captures the traffic characteristics;

[0006] S2: The preprocessing and feature extraction module cleans and preprocesses the collected raw traffic data to extract key features related to DDoS attacks.

[0007] S3: The deep learning model in the deep learning attack detection module automatically detects attack behaviors in traffic. CNN is used to extract spatial features in traffic, and LSTM is used to capture the dependencies of traffic in the temporal dimension.

[0008] S4: The attack response and decision module triggers the corresponding attack response strategy based on the detection results of the deep learning model;

[0009] S5: The defense execution and feedback module executes the defense strategy, including traffic restriction and blocking of malicious traffic through SDN controllers or traditional network devices.

[0010] The traffic monitoring and data collection module collects the characteristics of DDoS attacks under the IPv6 protocol, especially all vulnerabilities and attack patterns in ICMPv6 and Neighbor Discovery Protocol (NDP) related protocols, and builds or expands the existing attack dataset to include various types of DDoS attack behaviors, thereby providing a reliable data foundation for deep learning model training.

[0011] The deep learning model is a hybrid model combining CNN and LSTM, which is used to detect DDoS attacks on IPv6 networks. The deep learning model is also used to capture complex nonlinear relationships between features.

[0012] The attack response and decision module is an automated defense system formed by combining a deep learning model with a software-defined network (SDN), and is used to dynamically adjust defense strategies.

[0013] Compared with the prior art, the present invention has the following beneficial effects:

[0014] In the present invention, the deep learning model in the system can quickly identify abnormal traffic, ensuring timely response and real-time performance when a DDoS attack occurs. The defense execution and feedback module can automatically adjust the defense strategy without manual intervention, thereby improving the intelligence of the defense.

[0015] In the present invention, combined with the control function of SDN, the network configuration can be dynamically updated to resist different types of DDoS attacks. The system covers the complete process from data collection to defense execution, ensuring timely and automated detection and defense when DDoS attacks occur, which is suitable for the security needs in IPv6 networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the system framework structure of the present invention. DETAILED DESCRIPTION

[0017] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0018] See also Figure 1 The present invention provides a technical solution: including a traffic monitoring and data acquisition module, a preprocessing and feature extraction module, a deep learning attack detection module, an attack response and decision module, and a defense execution and feedback module. The specific steps are as follows:

[0019] S1: Through the traffic monitoring and data collection module, it monitors the traffic in the IPv6 network in real time and captures the traffic characteristics;

[0020] S2: The preprocessing and feature extraction module cleans and preprocesses the collected raw traffic data to extract key features related to DDoS attacks.

[0021] S3: The deep learning model in the deep learning attack detection module automatically detects attack behaviors in traffic. CNN is used to extract spatial features in traffic, and LSTM is used to capture the dependencies of traffic in the temporal dimension.

[0022] S4: The attack response and decision module triggers the corresponding attack response strategy based on the detection results of the deep learning model;

[0023] S5: The defense execution and feedback module executes the defense strategy, including traffic restriction and blocking of malicious traffic through SDN controllers or traditional network devices.

[0024] The traffic monitoring and data collection module collects the characteristics of DDoS attacks under the IPv6 protocol, especially all the vulnerabilities and attack modes in ICMPv6 and Neighbor Discovery Protocol (NDP) related protocols, builds or expands the existing attack data set to include various types of DDoS attack behaviors, thereby providing a reliable data foundation for deep learning model training. The traffic collected by the traffic monitoring and data collection module can be five-tuple information (source IP, destination IP, protocol, source port, destination port) and other important protocol data (such as ICMPv6, NDP information); the features extracted by the preprocessing and feature extraction module include the packet header information of the traffic, the flow Traffic rate, protocol type, ICMPv6 message, and Neighbor Discovery Protocol (NDP); the deep learning attack detection module uses PyTorch for model training and real-time inference, and processes current traffic by deploying pre-trained models; if the attack response and decision module detects attack traffic, the system will dynamically adjust defense measures based on the intensity and type of the attack, such as limiting traffic, blocking malicious IP addresses, and adjusting routing policies. It combines adaptive policies and threshold settings to adjust defense policies based on network load and attack intensity; the defense execution and feedback module combines the SDN controller to issue flow table update commands in real time, or use firewalls and network devices to implement traffic restrictions and malicious IP blocking.

[0025] The deep learning model is a hybrid model combining CNN and LSTM, which is used to detect DDoS attacks on IPv6 networks. The deep learning model is also used to capture the complex nonlinear relationship between features. The model will automatically extract time series and spatial features from large-scale network traffic to accurately distinguish normal traffic from attack traffic and ensure high detection efficiency and low false alarm rate. The advantages of deep learning automatic feature selection are: automated feature extraction: the deep learning model can automatically learn representative features from the input data through a multi-layer neural network structure, which reduces the dependence on manual feature engineering; high-dimensional data processing capabilities: the deep learning model can effectively process high-dimensional data and learn different levels of features at different levels, from low-level features to high-level features. Level features; nonlinear relationship capture: Compared with traditional linear methods, deep learning can capture complex nonlinear relationships between features, which is particularly important for processing complex network traffic data (such as DDoS attack traffic). The data dimension reduction and feature extraction are performed through the automatic encoder. Its basic structure includes an encoder and a decoder. The encoder is responsible for compressing high-dimensional input data into low-dimensional representations, and the decoder restores the low-dimensional representations to the original data. By minimizing the restoration error, the automatic encoder can automatically learn the most representative features. In DDoS attack detection, the automatic encoder can learn low-dimensional representations from high-dimensional network traffic data while retaining key attack-related features in the traffic. For example, the encoder can be used to partially extract Low-dimensional features are extracted and used as input to the classifier to reduce feature dimensions and improve detection efficiency; Convolutional Neural Networks (CNNs) are used for feature extraction: CNNs are mainly used to process data with spatial structures and are good at automatically extracting local features of input data. Through operations such as convolutional layers, pooling layers, and fully connected layers, CNNs can extract high-level features of input data. The convolution kernel of CNN captures local features through a sliding window mechanism, enabling it to discover attack patterns in large-scale network traffic data. In DDoS attack detection, CNNs can process feature maps of traffic and automatically extract spatial features of traffic. For example, packet header information, source IP address, destination port, etc. in the traffic can be extracted through convolution operations and used for further The ability to automatically extract features greatly reduces the reliance on manual feature engineering for classification or detection. Long Short-Term Memory (LSTM) networks are used for time series feature selection: LSTM is a variant of Recurrent Neural Network (RNN) for processing sequence data. It can capture the temporal dependencies in input data. Through memory cells and gating mechanisms, LSTM can extract useful long-term and short-term dependency information from time series data. In DDoS attack detection, LSTM can be used to process the time series features of network traffic (such as the arrival time and sending frequency of traffic packets) and capture the temporal variation patterns of traffic. LSTM automatically selects time-dependent features related to attack behavior, such as traffic burstiness and session duration.The attention mechanism of recurrent neural networks enables the model to "focus" on important features or time steps when processing sequential data. By assigning different weights to each input, the model automatically selects the most critical features, rather than treating all input data equally. In DDoS attack detection, the attention mechanism can help models such as LSTM and GRU automatically focus on key parts of attack traffic, such as abnormal traffic changes at certain time points. By weighting different input features, the attention mechanism can improve detection efficiency while reducing unnecessary computation.

[0026] The attack response and decision-making module is an automated defense system formed by combining deep learning models with software-defined networks (SDN) to dynamically adjust defense strategies.

[0027] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely preferred examples of the present invention and are not intended to limit the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention, and such changes and modifications fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A deep learning-based IPv6 network DDoS attack detection and defense system, characterized by: It includes traffic monitoring and data acquisition module, preprocessing and feature extraction module, deep learning attack detection module, attack response and decision module, and defense execution and feedback module. The specific steps are as follows: S1: Through the traffic monitoring and data collection module, it monitors the traffic in the IPv6 network in real time and captures the traffic characteristics; S2: The preprocessing and feature extraction module cleans and preprocesses the collected raw traffic data to extract key features related to DDoS attacks. S3: The deep learning model in the deep learning attack detection module automatically detects attack behaviors in traffic. CNN is used to extract spatial features in traffic, and LSTM is used to capture the dependencies of traffic in the temporal dimension. S4: The attack response and decision module triggers the corresponding attack response strategy based on the detection results of the deep learning model; S5: The defense execution and feedback module executes the defense strategy, including traffic restriction and blocking of malicious traffic through SDN controllers or traditional network devices.

2. The IPv6 network DDoS attack detection and defense system based on deep learning according to claim 1 is characterized by: The traffic monitoring and data collection module collects the characteristics of DDoS attacks under the IPv6 protocol, especially all vulnerabilities and attack patterns in ICMPv6 and Neighbor Discovery Protocol (NDP) related protocols, and builds or expands the existing attack dataset to include various types of DDoS attack behaviors, thereby providing a reliable data foundation for deep learning model training.

3. The IPv6 network DDoS attack detection and defense system based on deep learning according to claim 1, characterized in that: The deep learning model is a hybrid model combining CNN and LSTM, which is used to detect DDoS attacks on IPv6 networks. The deep learning model is also used to capture complex nonlinear relationships between features.

4. The IPv6 network DDoS attack detection and defense system based on deep learning according to claim 3 is characterized by: The attack response and decision module is an automated defense system formed by combining a deep learning model with a software-defined network (SDN), which is used to dynamically adjust defense strategies.

Images