Intelligent protection switching method, system and device for DDoS attack and medium

Abstract

The invention discloses an intelligent protection switching method, system and device for DDoS attacks and a medium, and the method specifically comprises the steps: obtaining DDoS attack alarm information through a multi-source data collection interface, and constructing a multi-dimensional attack knowledge graph based on a graph database; based on the multi-dimensional attack knowledge graph, verifying the causal relationship between protection actions and business indexes by adopting a double difference method, calculating the contribution degree of each protection measure to business recovery through a Bayesian network, and constructing a protection effect attribution model; generating a protection strategy set in a three-dimensional decision space by adopting a multi-objective optimization algorithm based on a confidence evaluation result of the protection effect attribution model; and based on the protection strategy set, docking a multi-cloud platform protection resource API interface, dynamically scheduling high-defense packet resources based on a Q-learning reinforcement learning algorithm, and executing cross-cloud traffic traction and cleaning service switching. According to the method, the timeliness and effectiveness of DDoS attack response are improved, the protection response speed is increased, and the influence of attacks on services is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an intelligent protection switching method, system, device and medium for DDoS attacks. Background Art

[0002] In today's rapidly developing digital age, business operations are highly dependent on network information systems, and networks have become the core infrastructure for normal business operations. However, distributed denial of service (DDoS) attacks, a highly destructive threat in the field of network security, are like time bombs hidden in the cyber world, posing severe challenges to business operations and data security.

[0003] DDoS attacks control a large number of infected hosts (botnets) and send massive amounts of traffic to target systems. This traffic, like a surging tide, instantly overwhelms the target system's network bandwidth and server resources, overwhelming them. When the target system is unable to handle this massive traffic, normal business requests will not be responded to in a timely manner, ultimately resulting in service unavailability. However, in current network security protection practices, enterprises face numerous technical challenges that need to be addressed.

[0004] First, traditional DDoS protection methods often rely on manual intervention. When a DDoS attack is detected, security operations personnel must manually analyze the attack characteristics, assess the business impact, and then develop and implement a protection strategy. This process is not only tedious and complex, but also slow to respond. Given the rapid pace and relentless onslaught of DDoS attacks, manual intervention often fails to make prompt decisions and switch protection strategies when an attack occurs. Attackers may launch multiple attacks in a short period of time, with varying intensity and methods. Manual analysis is time-consuming, and by the time a protection strategy is developed and implemented, the business may have already been under threat for the duration of the attack, making it impossible to restore service in a timely manner. This not only prolongs business disruption but also allows attackers ample time to breach protection, causing even more severe damage.

[0005] Secondly, DDoS attack methods are becoming increasingly sophisticated and diverse. Attack traffic can be disguised as normal business traffic, making it difficult to accurately identify attack traffic from massive amounts of network data. With the continuous advancement of network technology, attackers are constantly refining their attack methods, employing various techniques to conceal attack traffic and make it difficult to distinguish it from normal business traffic. For example, attackers may simulate the access patterns of normal users and control hosts in botnets to send requests at a low frequency, making the attack traffic difficult to detect within the overall traffic flow. Furthermore, different types and intensities of DDoS attacks have varying degrees of impact on business. Some attacks may only temporarily affect network performance, while others may completely paralyze the system.

[0006] Finally, due to the complexity of business systems, a simple network connectivity check alone cannot fully assess the health of the business. Business systems are typically composed of multiple components and modules, involving multiple layers such as networks, servers, databases, and applications. A simple network connectivity check can only confirm whether the network is unobstructed, but it cannot detect whether the internal processing logic of the business is operating normally. For example, the business may have restored network connectivity on the surface, but in fact, there are still problems with the internal processing logic, resulting in abnormal business indicators. For example, the database connection may be normal, but errors may occur in data query and write operations, resulting in inconsistent business data; the application may be able to respond to requests, but the processing results may be incorrect, affecting the user experience. Summary of the Invention

[0007] The present invention aims to provide a method, system, device, and medium for intelligent protection switching for DDoS attacks, which can automatically sense attacks, intelligently analyze protection effects, and quickly switch protection strategies. This improves the timeliness and effectiveness of DDoS attack response, increases protection response speed, and effectively reduces the impact of attacks on services, thereby resolving at least one of the above-mentioned problems in the prior art.

[0008] In a first aspect, the present invention provides a method for intelligent protection switching for DDoS attacks, the method specifically comprising:

[0009] Obtain DDoS attack alert information through a multi-source data collection interface and build a multi-dimensional attack knowledge graph based on a graph database. The multi-dimensional attack knowledge graph includes attack source behavior patterns, attack vector types, and target business attributes.

[0010] Based on a multi-dimensional attack knowledge graph, the double difference method is used to verify the causal relationship between protection actions and business indicators. The contribution of each protection measure to business recovery is calculated through a Bayesian network to build a protection effect attribution model.

[0011] Based on the confidence assessment results of the protection effectiveness attribution model, a multi-objective optimization algorithm is used to generate a protection strategy set in a three-dimensional decision space. The three-dimensional decision space includes service availability indicators, protection cost constraints, and attack severity levels.

[0012] Based on the protection policy set, it connects to the multi-cloud platform protection resource API interface, dynamically schedules high-defense package resources based on the Q-learning reinforcement learning algorithm, and performs cross-cloud traffic traction and cleaning service switching;

[0013] The protection effect of the protection strategy set is verified through a multi-level business health check mechanism, and the verification results of the multi-level business health check mechanism are fed back to the multi-dimensional attack knowledge graph for iterative update of feature weights.

[0014] In a second aspect, the present invention provides an intelligent protection switching system for DDoS attacks, the system specifically comprising:

[0015] A multi-source data acquisition module is used to obtain DDoS attack alarm information through a multi-source data acquisition interface and build a multi-dimensional attack knowledge graph based on a graph database. The multi-dimensional attack knowledge graph includes attack source behavior patterns, attack vector types, and target business attributes;

[0016] The protection effect attribution module is used to verify the causal relationship between protection actions and business indicators based on a multi-dimensional attack knowledge graph using a double difference method. It also calculates the contribution of each protection measure to business recovery through a Bayesian network and constructs a protection effect attribution model.

[0017] A protection strategy generation module, which uses a multi-objective optimization algorithm to generate a set of protection strategies in a three-dimensional decision space based on the confidence assessment results of the protection effectiveness attribution model. The three-dimensional decision space includes service availability indicators, protection cost constraints, and attack severity levels.

[0018] The protection policy execution module is used to connect to the multi-cloud platform protection resource API interface based on the protection policy set, dynamically schedule high-defense package resources based on the Q-learning reinforcement learning algorithm, and perform cross-cloud traffic traction and cleaning service switching;

[0019] The protection effect verification module is used to verify the protection effect of the protection policy set through a multi-level business health check mechanism, and feed back the verification results of the multi-level business health check mechanism to the multi-dimensional attack knowledge graph for iterative update of feature weights.

[0020] In a third aspect, the present invention provides a computer device comprising: a memory and a processor and a computer program stored in the memory. When the computer program is executed on the processor, it implements the intelligent protection switching method for DDoS attacks as described in any one of the above methods.

[0021] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for intelligent protection switching for DDoS attacks as described in any one of the above methods is implemented.

[0022] Compared with the prior art, the present invention has at least one of the following technical effects:

[0023] 1. It can automatically sense attacks, intelligently analyze protection effects, and quickly switch protection strategies, improving the timeliness and effectiveness of DDoS attack response, increasing protection response speed, and effectively reducing the impact of attacks on business.

[0024] 2. Use a graph database to build a multi-dimensional attack knowledge graph to comprehensively describe attack characteristics and business status, which can capture and judge DDoS attack behavior more accurately and timely, providing a reliable basis for subsequent protection decisions.

[0025] 3. Ability to accurately assess the actual business recovery after protection switching, provide timely and accurate feedback for subsequent protection strategy adjustments, and ensure the continuous and stable operation of the business.

[0026] 4. Construct a multi-dimensional attack knowledge graph and dynamically update edge weights, calculate the threat score of attack sources, and intuitively present the attack situation, which helps to formulate precise protection strategies.

[0027] 5. By verifying the causal relationship between protective actions and business indicators, quantifying the contribution of each protective measure, and building a precise protection effect attribution model, the basis for protection decision-making is optimized.

[0028] 6. Based on the confidence of the attribution model, a set of protection strategies that meet business needs and cost control are generated under multi-objective constraints, realizing intelligent optimization of protection strategies.

[0029] 7. Dynamically schedule high-defense package resources on multi-cloud platforms based on the Q-learning algorithm, realize intelligent cross-cloud traffic traction and cleaning service switching, and improve protection resource utilization and protection effect.

[0030] 8. Comprehensively evaluate the protection effect through multi-level business health checks, and iteratively update the knowledge graph feature weights based on the feedback results, thus achieving dynamic optimization of protection strategies and rapid response to abnormal situations. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0032] Figure 1 This is a flow chart of a method for intelligent protection switching for DDoS attacks provided by one embodiment of the present invention;

[0033] Figure 2 This is a structural diagram of an intelligent protection switching system for DDoS attacks provided by one embodiment of the present invention;

[0034] Figure 3 It is a structural diagram of a computer device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0035] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0036] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0037] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0038] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0039] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0040] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0041] In the embodiments of the present application, the execution subject of the process includes a terminal device, which includes but is not limited to: a server, a computer, a smart phone, a tablet computer, and other devices capable of executing the method disclosed in the present application. Figure 1 A flow chart of the intelligent protection switching method for DDoS attacks disclosed in the first embodiment of the present invention is shown, and is described in detail as follows:

[0042] S101, obtain DDoS attack alarm information through a multi-source data collection interface, and build a multi-dimensional attack knowledge graph based on a graph database. The multi-dimensional attack knowledge graph includes attack source behavior patterns, attack vector types, and target business attributes.

[0043] In this embodiment, DDoS attack alarm information is obtained through a multi-source data acquisition interface, and a multi-dimensional attack knowledge graph is constructed based on a graph database to achieve more accurate identification and analysis of DDoS attacks, providing strong support for subsequent intelligent protection switching.

[0044] Specifically, network traffic monitoring devices deployed at enterprise network boundaries and key nodes, such as traffic mirroring devices and intrusion detection systems (IDS), can collect real-time network traffic data. This data, including source IP address, destination IP address, port number, protocol type, packet size, and number of packets, is crucial for identifying DDoS attacks.

[0045] Integrate security event logs generated by various security devices within the enterprise (such as firewalls, intrusion prevention systems, and security information and event management systems). These logs record events such as abnormal access and attack attempts, which can provide clues about potential DDoS attacks.

[0046] Monitor the operational status of enterprise business systems, including indicators such as business response time, transaction volume, and error rate. Abnormal fluctuations in business systems may be related to DDoS attacks, so data from the business system monitoring platform is also an important source of data.

[0047] Design standardized data collection interfaces for different data sources. For example, for network traffic monitoring systems, use protocols such as SNMP (Simple Network Management Protocol) or NetFlow for data collection; for security event management systems, use the Syslog protocol to receive log data; and for business system monitoring platforms, obtain business indicator data through API interfaces.

[0048] During the data collection process, the collected raw data is preprocessed. This includes data cleaning to remove duplicate, erroneous, or incomplete data; data format conversion to convert data from different data sources into a format suitable for subsequent processing; and data aggregation to aggregate and count data of the same type to reduce the data volume.

[0049] To ensure the real-time and integrity of data, a cache mechanism is used to temporarily store the collected data. When the cache reaches a certain size or meets a certain time condition, the data is transmitted to the subsequent processing system through a secure and reliable transmission channel (such as VPN or encrypted dedicated line).

[0050] Choose a graph database suitable for processing large-scale, complex network data, such as Neo4j or JanusGraph. These graph databases offer efficient graph data storage and query capabilities, enabling rapid processing of relationships between entities such as attack sources, attack vectors, and targeted businesses. To ensure high availability and performance of the graph database, adopt a clustered deployment approach. Distributing the graph database across multiple server nodes, using data sharding and load balancing technologies, improves data processing capabilities and system stability.

[0051] The collected DDoS attack alert information is parsed to extract entity information such as the attack source, attack vector, and target business. Attack sources include IP addresses and botnet nodes that initiate DDoS attacks. Each attack source entity has attributes such as the source IP address, geographic location, and historical attack records. Attack vectors refer to the attack methods and approaches used by attackers, such as UDP Flood, TCP SYN Flood, and HTTP Flood. Each attack vector entity has attributes such as the attack type, attack frequency, and attack traffic volume. Target business refers to the enterprise business system affected by the DDoS attack. Each target business entity has attributes such as the business name, business type, business importance level, and business dependencies. For example, the source IP address is extracted from network traffic monitoring data as the attack source entity, the attack type is extracted from security event logs as the attack vector entity, and the business name is extracted from business system monitoring data as the target business entity.

[0052] Based on the extracted entity information and the contextual content in the attack alert information, relationships between entities are established. Relationships in the knowledge graph include: Attack source-attack vector relationships, which indicate which attack vector the attack source used to launch the attack. For example, a botnet node used the UDPFlood attack vector to attack the target business; Attack vector-target business relationships, which indicate which attack vector targeted which target business. For example, the TCPSYNFlood attack vector attacked the company's e-commerce business system; and Attack source-target business relationships, which indicate which target business the attack source directly attacked. This relationship can be derived from the Attack source-attack vector relationship and the Attack vector-target business relationship. For example, if an alert information shows that a source IP address used the UDPFlood attack vector to attack a business system, then relationships are established between the Attack source entity and the Attack vector entity, and between the Attack vector entity and the Target business entity.

[0053] By analyzing the attack source behavior patterns in the multi-dimensional attack knowledge graph, common attack patterns and patterns can be identified. For example, it can be found that certain attack sources frequently use specific attack vectors to attack specific target businesses during specific time periods, allowing preventive measures to be taken in advance.

[0054] When a DDoS attack occurs, the attack source-attack vector-target business relationship in the knowledge graph can be used to quickly trace the source of the attack, determine the attacker's identity and attack methods, and provide a basis for subsequent disposal.

[0055] Based on the results of actual attack incidents and business feedback, the feature weights of different entities and relationships in the multi-dimensional attack knowledge graph are adjusted. For example, if a certain attack vector is found to have a significant impact on a specific target business, the weight of the relationship between that attack vector and the target business is increased to improve the accuracy of subsequent attack identification.

[0056] Regularly obtain the latest DDoS attack information and trends from external security intelligence sources and integrate them into the multi-dimensional attack knowledge graph to achieve knowledge integration and expansion. For example, new attack source information, attack vector types, and target business attributes are introduced to enrich the content of the knowledge graph.

[0057] In this embodiment, DDoS attack alarm information is obtained through a multi-source data acquisition interface, and a multi-dimensional attack knowledge graph is constructed based on a graph database, providing strong data support and decision-making basis for subsequent DDoS attack intelligent protection switching.

[0058] S102, based on the multi-dimensional attack knowledge graph, uses the double difference method to verify the causal relationship between protection actions and business indicators, and calculates the contribution of each protection measure to business recovery through the Bayesian network to construct a protection effect attribution model.

[0059] In this embodiment, information on various protective actions taken in response to DDoS attacks is collected from the enterprise's network security protection system. These protective actions include but are not limited to enabling specific firewall rules, deploying traffic cleaning equipment, adjusting network bandwidth allocation, etc. Detailed information such as the implementation time, duration, network equipment involved, and scope of business systems for each protective action is recorded. At the same time, business indicator data related to the attacked business system is collected. Common business indicators include business response time, transaction success rate, system throughput, user access volume, etc. These data can be obtained from channels such as the enterprise's business monitoring system and logging system to ensure the accuracy and completeness of the data. Combined with a multi-dimensional attack knowledge graph, feature data related to DDoS attacks is obtained, such as attack source information (IP address, geographic location, etc.), attack vector type (UDPFlood, TCPSYNFlood, etc.), and attack intensity (traffic size, request frequency, etc.). These data help to more comprehensively analyze the relationship between protective actions and business indicators.

[0060] Difference-in-Differences (DID) is a commonly used policy evaluation method that estimates the causal effect of a policy by comparing the changes in the experimental and control groups before and after the policy is implemented. In this example, the business systems that implemented a specific protection action are considered the experimental group, while the business systems that did not implement the protection action but were subjected to similar DDoS attacks (or the business systems that did not implement the protection action during a similar period of time) are considered the control group.

[0061] First, divide the business systems into an experimental group and a control group. Collect business metric data for both groups of systems for a period of time before the implementation of the protective action as baseline data. For example, collect metrics such as business response time and transaction success rate in the week before the protective action is implemented.

[0062] Implement specific protective actions on the experimental group's business systems and continuously track changes in business indicators for both groups of business systems after the protective actions are implemented. Set reasonable time intervals (e.g., hourly or daily) to collect business indicator data and record changes in business indicators over time.

[0063] Calculate the average change in business metrics for both the experimental and control groups before and after the implementation of the protective action. For example, calculate the average change in business response time for the experimental group within one week after the protective action was implemented, and the average change in business response time for the control group over the same period. Then, calculate the difference between the changes in business metrics for the two groups, i.e., the double difference value.

[0064] The causal relationship between the protective action and the business indicator is determined based on the size and statistical significance of the double difference value. If the double difference value is significantly different from zero and the business indicator change in the experimental group is better than that in the control group, then the protective action can be considered to have a positive causal impact on the business indicator. Conversely, if the double difference value is not significant or the business indicator change in the experimental group is worse than that in the control group, then there may be no causal relationship between the protective action and the business indicator or it may have a negative impact.

[0065] Protective measures, business indicators, and attack characteristics serve as nodes in the Bayesian network. Protective measures nodes include various protective actions taken, such as enabling firewall rules and traffic cleaning; business indicator nodes include business response time, transaction success rate, etc.; and attack characteristic nodes include attack source, attack vector type, attack intensity, etc. Based on the multi-dimensional attack knowledge graph and actual business experience, the causal relationship between each node is determined, and edges between nodes are established. For example, if a certain attack vector type is found to often cause a decrease in a specific business indicator, an edge is established between the attack vector type node and the corresponding business indicator node. Then, through expert experience, historical data statistics, and other methods, a conditional probability table is determined for each node. The conditional probability table describes the probability of the node being in different states given the state of the parent node.

[0066] In a Bayesian network, an initial state is set—that is, the initial conditions at the time of the attack. For example, initial values ​​for the attack source, attack vector type, and attack intensity are determined, as well as the initial states of business metrics. Different protective measures are simulated and implemented sequentially, updating the states of corresponding nodes in the Bayesian network. For example, when a firewall rule is implemented to enable this protective measure, the states of relevant nodes in the network are adjusted based on the measure's effectiveness in intercepting attack traffic, such as a reduction in attack traffic and a potential improvement in business metrics. After each simulated implementation of a protective measure, the degree of business system recovery is evaluated. Business recovery can be measured by calculating the magnitude of change in business metrics relative to the initial state. For example, the percentage change in business response time from the peak value at the time of the attack to a stable value can be calculated. By comparing the changes in business recovery before and after the implementation of different protective measures, the contribution of each protective measure to business recovery is calculated. A relative contribution method can be used: the proportion of the improvement in business recovery after the implementation of a particular protective measure to the total improvement in business recovery after the implementation of all protective measures is calculated as the contribution of the protective measure.

[0067] The causal relationship between protective actions and business indicators verified by the difference-in-difference method and the contribution of each protective measure to business recovery calculated using a Bayesian network are integrated to establish a comprehensive protective effectiveness attribution model. This model uses protective measures as input and outputs changes in business indicators and the degree of business recovery. It also reflects the interrelationships between protective measures and their combined impact on business recovery.

[0068] Use new DDoS attack event data to validate the constructed protection effectiveness attribution model. Compare actual protection actions, changes in business indicators, and business recovery status with the model's predictions to assess the model's accuracy and reliability. For example, check whether the error between the model's predicted business recovery and the actual business recovery is within an acceptable range.

[0069] Based on the results of model validation, optimize the protection effectiveness attribution model. If the model's predictions are inaccurate in certain situations, adjust the Bayesian network's conditional probability table, optimize the double difference method's grouping and calculation methods, or introduce more relevant factors to improve the model. For example, if the impact of certain attack characteristics on business recovery is not fully reflected in the model, these attack characteristics can be incorporated into the model and the contribution of each protection measure recalculated.

[0070] In this embodiment, based on the multi-dimensional attack knowledge graph, the double difference method is used to verify the causal relationship between protection actions and business indicators, and the contribution of each protection measure to business recovery is calculated through the Bayesian network, constructing an accurate and reliable protection effect attribution model, providing strong support for the company's DDoS attack intelligent protection switching.

[0071] S103, based on the confidence evaluation result of the protection effect attribution model, a multi-objective optimization algorithm is used to generate a protection strategy set in a three-dimensional decision space, wherein the three-dimensional decision space includes a service availability indicator, a protection cost constraint, and an attack severity level.

[0072] In this example, historical DDoS attack event data is collected, including actual protection actions, changes in service metrics, and service recovery status. This actual data is compared with the predictions of the protection effectiveness attribution model. The proportion of accurate model predictions to the total number of predictions is calculated, which serves as the model's accuracy evaluation metric.

[0073] The model was tested multiple times using the same DDoS attack data in different time periods and business scenarios. The model's output fluctuations were observed, and the model's stability was evaluated by calculating the variance of these multiple test results. This variance serves as a stability metric. The smaller the variance, the more stable the model's output under different conditions, and the higher the confidence level.

[0074] Based on the accuracy and stability evaluation indicators, assign a corresponding weight to each indicator. For example, the accuracy indicator weight is set to 0.5, the stability indicator weight is set to 0.3, and the interpretability indicator weight is set to 0.2. The evaluation results of each indicator are weighted and summed to obtain the overall confidence level of the protection effectiveness attribution model. For example, if the accuracy evaluation result is 80%, the stability evaluation result is 75%, and the interpretability evaluation result is 85%, then the overall confidence level = 80% × 0.5 + 75% × 0.3 + 85% × 0.2 = 80.5%.

[0075] Count the proportion of time that the business system can provide normal services within a period of time (such as a day or a week) to the total time, and form the service availability time ratio; record the average response time of the business system to user requests, collect the response time data of the business system in real time through the monitoring system, and calculate the average value within a certain period of time to form the business response time; measure the number of business requests that the business system can handle per unit time, and form the business throughput; use the service availability time ratio, business response time and business throughput as business availability indicators.

[0076] Calculate the procurement cost, installation cost, and subsequent maintenance cost of deploying protection equipment (such as firewalls and traffic cleaning devices) to form the hardware cost. Calculate the cost of purchasing protection software licenses and software upgrade fees to form the software cost. Calculate the cost corresponding to the time and energy invested by security operations personnel in responding to DDoS attacks to form the labor cost. Use hardware cost, software cost, and labor cost as protection cost constraints.

[0077] Attack traffic is classified into different levels based on its size, forming the traffic size. The frequency of attack requests, such as requests per second (RPS), is counted to form the request frequency. The duration of the attack is recorded to form the attack duration. The traffic size, request frequency, and attack duration are used as the attack severity level. For example, attack traffic less than 100Mbps is classified as low-severity, 100Mbps-500Mbps as medium-severity, and greater than 500Mbps as high-severity. RPS less than 1000 is classified as low-severity, 1000-5000 as medium-severity, and greater than 5000 as high-severity. Attack durations of less than one hour are classified as low-severity, 1-5 hours as medium-severity, and greater than five hours as high-severity.

[0078] Then, with maximizing business availability and minimizing protection costs as optimization goals, we dynamically adjust protection strategies based on the attack severity level to ensure effective responses to attacks of varying severity. For example, for high-intensity attacks, protection strategies must be able to quickly and effectively mitigate the impact on business; for low-intensity attacks, relatively lightweight protection measures can be used to reduce costs.

[0079] Based on the protection effectiveness attribution model, combined with historical protection experience and industry best practices, a series of candidate protection strategies are generated. For example, for different types and intensities of DDoS attacks, a variety of protection measures are proposed, such as enabling specific firewall rules, deploying traffic cleaning devices, and adjusting network bandwidth allocation.

[0080] Each candidate protection strategy is evaluated within a three-dimensional decision space (service availability metrics, protection cost constraints, and attack severity levels). Based on the set optimization goals, the performance of each strategy in each dimension is calculated. For example, for a candidate strategy, its improvement in service availability and its impact on protection costs under different attack intensities are evaluated. Then, based on the evaluation results, protection strategies that meet the optimization goals are selected to form a protection strategy set.

[0081] In this embodiment, based on the confidence evaluation results of the protection effect attribution model, a multi-objective optimization algorithm is used in the three-dimensional decision space to generate a scientific and reasonable set of protection strategies, which effectively responds to DDoS attacks of different types and intensities and ensures the normal operation of the enterprise business system and data security.

[0082] S104, based on the protection policy set, connects to the multi-cloud platform protection resource API interface, dynamically schedules high-defense package resources based on the Q-learning reinforcement learning algorithm, and performs cross-cloud traffic traction and cleaning service switching.

[0083] In this example, we communicate with the selected multi-cloud platform (such as Alibaba Cloud, Tencent Cloud, Huawei Cloud, etc.) to obtain the documentation and access guide for its protection resource API interface. According to the guide requirements, the corresponding interface parameters, such as API keys and access addresses, are configured in the enterprise's security protection system to achieve integration with the multi-cloud platform's protection resource API interface.

[0084] Through the multi-cloud platform API, information about available high-defense package resources on each cloud platform is obtained, including bandwidth capacity, protection capabilities, usage status (idle, occupied), and remaining availability. This information is stored in the enterprise's security protection system database for subsequent scheduling and use. Initial allocation of high-defense package resources across the multi-cloud platform is performed based on the enterprise's business distribution and historical DDoS attack patterns. For example, more high-defense package bandwidth resources are allocated to business areas with high traffic volume and greater vulnerability to attacks. Initial protection policy parameters, such as traffic scrubbing rules and access control lists, are also set for each high-defense package resource.

[0085] A state space is set, where the state space includes an attack state, a resource state, and a service state.

[0086] Attack status is defined by the characteristics of a DDoS attack. For example, it can be categorized by attack traffic size (e.g., small-volume attack, medium-volume attack, large-volume attack), attack type (e.g., UDP Flood, TCP SYN Flood, HTTP Flood), and attack duration (e.g., short-term attack, long-term attack).

[0087] Resource status refers to the status of the high-defense package resources on the multi-cloud platform, including the bandwidth usage, remaining protection capacity, and remaining available time of each high-defense package.

[0088] The business status is defined by combining business availability indicators to define the state of the business system, such as business response time (normal, slight delay, severe delay), business throughput (normal, reduced, interrupted), etc.

[0089] Set the action space, which includes resource scheduling actions and service switching actions.

[0090] Resource scheduling refers to the scheduling of high-defense package resources, such as allocating high-defense package resources on a cloud platform to another business area, or switching idle high-defense package resources to a business system that is under attack.

[0091] Service switching refers to the action of switching cross-cloud traffic traction and cleaning services, such as switching business traffic from the cleaning service of the current cloud platform to the cleaning service of another cloud platform, or enabling a backup cleaning service node.

[0092] Set up a reward function, which includes business recovery rewards, cost saving rewards, attack defense rewards, and penalty mechanisms.

[0093] Business recovery rewards are given when resource scheduling and service switching restore business system response times to normal and throughput reaches normal levels. Reward values ​​can be quantified based on the degree of business recovery. For example, each percentage reduction in business response time will result in a corresponding reward point.

[0094] Cost-saving rewards are given if protection costs are reduced during resource scheduling and service switching (e.g., reduced usage of high-defense package resources, shortened high-defense package usage time, etc.). The reward value can be calculated based on the amount of cost savings.

[0095] Attack Defense Rewards are high positive rewards given for successfully defending against DDoS attacks and ensuring that business systems remain available during the attack. The reward value can be adjusted appropriately based on the intensity and duration of the attack.

[0096] The penalty mechanism applies if resource scheduling and service switching result in extended service interruption, increased protection costs, or ineffective attack defense. The penalty value can be quantified based on the severity of the issue.

[0097] DDoS attacks are continuously monitored through multi-source data collection interfaces, capturing real-time information such as attack traffic volume, attack type, and attack source, and updating the attack status. High-defense package resource usage, including bandwidth utilization and remaining protection capacity, is regularly queried through the multi-cloud platform API to update resource status. A multi-layered business health check mechanism monitors business system response time, throughput, and other metrics in real time and updates business status. The real-time monitored attack status, resource status, and business status are fed into a Q-learning algorithm. Based on the current state and a set of preset actions, the Q-learning algorithm calculates the Q value for each action. The Q value reflects the expected long-term reward from taking the action in the current state. Based on the Q value, the action with the highest Q value is selected as the optimal action. For example, if a resource scheduling action can accelerate business system recovery and reduce costs, the action will have a relatively high Q value and be selected.

[0098] Based on the optimal resource scheduling action selected by the Q-learning algorithm, high-defense package resources are scheduled through the multi-cloud platform API interface. For example, idle high-defense package resources can be allocated to business systems under attack, or the bandwidth allocation ratio of high-defense packages can be adjusted.

[0099] Based on the optimal service switching action, cross-cloud traffic pulling and cleaning service switching is executed. For example, traffic can be switched from the current cloud platform's cleaning service to another cloud platform's cleaning service, or a backup cleaning service node can be activated. During the service switching process, a smooth transition must be ensured to avoid additional disruption to the business.

[0100] S105, verify the protection effect of the protection strategy set through a multi-level business health check mechanism, and feed back the verification results of the multi-level business health check mechanism to the multi-dimensional attack knowledge graph for iterative update of feature weights.

[0101] In this embodiment, different types of DDoS attack scenarios are simulated in a test environment, such as UDPFlood, TCPSYNFlood, HTTPFlood, etc., with different attack intensities and durations. Attack traffic is sent to the target business system through professional attack simulation tools (such as LOIC, HULK, etc.) to simulate a real attack situation. While simulating the attack, the generated protection policy set is applied to the security protection equipment of the target business system (such as firewalls, intrusion detection systems, DDoS cleaning equipment, etc.). Ensure that the various policies in the protection policy set (such as traffic cleaning rules, access control policies, resource allocation policies, etc.) can take effect correctly.

[0102] Before the simulated attack begins, record various business health indicators of the business system under normal conditions, including network connectivity and bandwidth utilization of the basic network layer, resource usage and process status of the server layer, connection status and operational performance of the database layer, and response time and business logic execution results of the application layer.

[0103] During the simulated attack, continuously monitor various business health indicators of the business system and compare and analyze them with pre-attack records. Observe changes in various indicators after the attack, such as whether network bandwidth is heavily occupied, whether server resources are severely insufficient, whether database operations are abnormal, and whether application response time is significantly prolonged.

[0104] After applying the protection policy set for a period of time (e.g., after the attack persists for a period of time or after the protection policy has fully taken effect), record the various business health indicators of the business system again. Evaluate whether the protection policy set can effectively reduce the impact of the attack on the business system and restore the business health indicators to a level close to normal before the attack.

[0105] The data on various business health indicators obtained from the multi-level business health check mechanism is organized and stored categorized by attack scenario, protection policy application time, and other dimensions. Features related to DDoS attacks and protection effectiveness are extracted from this organized business health indicator data. These features may include attack type, attack intensity, the magnitude of changes in business health indicators (such as changes in bandwidth utilization and CPU usage), and the effectiveness of the protection policy set (such as service recovery time and reduction in service interruption time).

[0106] Based on the verification results, the weights of various features in the multidimensional attack knowledge graph (such as attack source behavior patterns, attack vector types, and target business attributes) are evaluated. This analysis analyzes which features have a greater impact on business health during the current DDoS attack and protection process, and which features have a lesser impact. Based on the results of the feature weight evaluation, the multidimensional attack knowledge graph is iteratively updated. The connections and weights between various nodes (such as attack sources, attack vectors, and target businesses) are adjusted to ensure that the knowledge graph more accurately reflects the current DDoS attack landscape and protection needs.

[0107] In some embodiments, in step S101 above, obtaining DDoS attack alarm information through a multi-source data acquisition interface specifically includes:

[0108] Obtain a collection of DDoS attack events in real time through the cloud platform alarm interface. The DDoS attack event collection includes the target IP address, attack traffic peak, and timestamp.

[0109] Acquire attack source fingerprint data through a threat intelligence interface, wherein the attack source fingerprint data includes the geographic location code and historical attack frequency characteristics of the attack source node;

[0110] The target system business indicators are obtained through the business monitoring interface, and the target system business indicators include QPS, average delay and error rate.

[0111] In this embodiment, apply to the cloud service provider for permission to use the alarm interface, and complete the relevant authentication and authorization processes in accordance with its requirements. It is usually necessary to provide materials such as the company's basic information, business requirements description, and security compliance commitments to obtain the key or token required for the interface call. Obtain the detailed interface documentation provided by the cloud platform, and carefully read the interface's request parameters, response format, error code description, etc. Clarify the query conditions supported by the interface (such as time range, target IP range, etc.) and the specific fields of the returned DDoS attack event set (such as target IP, attack traffic peak, timestamp, etc.). Construct the interface call request parameters according to the requirements of the interface document. For example, set the query time range to a period of time before the current time (such as the past hour) to obtain the DDoS attack event set within that time period. At the same time, ensure that the request contains correct authentication information (such as keys or tokens) to ensure the legitimacy of the interface call.

[0112] Negotiate the interface protocol with the selected threat intelligence vendor to determine the interface call method (e.g., RESTful API, SOAP), data format (e.g., JSON, XML), and authentication method (e.g., API key, OAuth). Based on the negotiation results, develop and configure the corresponding interface within the enterprise's internal systems. When the enterprise detects signs of a DDoS attack, promptly request attack source fingerprint data through the threat intelligence interface. Based on the target IP address or other relevant information of the attack event, query the threat intelligence vendor to obtain fingerprint data related to the attack source.

[0113] Based on the architecture and characteristics of your target enterprise system, select appropriate business monitoring tools, such as Prometheus and Zabbix. These tools can provide a rich set of monitoring metrics and flexible interfaces, facilitating integration with internal enterprise systems. Set the data collection frequency for business metrics based on the importance of the business and the frequency of change. For critical businesses, a higher collection frequency (e.g., once per second) can be used to promptly detect subtle business fluctuations; for non-critical businesses, a lower collection frequency (e.g., once per minute) can be used. Set reasonable alarm thresholds in the business monitoring tool, triggering alarm notifications when business metrics exceed or fall below the thresholds. Alarm notifications can be sent to relevant personnel via email, text message, instant messaging, and other means, allowing them to take timely action.

[0114] In this embodiment, DDoS attack alarm information can be effectively obtained through a multi-source data collection interface, including DDoS attack event collection, attack source fingerprint data and target system business indicators, providing comprehensive and accurate data support for the enterprise's DDoS attack protection.

[0115] In some embodiments, in step S101 above, constructing a multi-dimensional attack knowledge graph based on a graph database specifically includes:

[0116] Based on the DDoS attack event set, attack source fingerprint data, and target system business indicators, a multidimensional attack knowledge graph is constructed using a graph database. The node set of the multidimensional attack knowledge graph includes attack source nodes, target business nodes, and attack vector types. The weighted directed edges of the multidimensional attack knowledge graph represent the attack initiation relationship and business impact relationship.

[0117] Combining traffic ratios and error rate changes, a time decay model is used to dynamically update the edge weights of the multi-dimensional attack knowledge graph to determine the edge weights of attack initiation relationships and business impact relationships.

[0118] Based on the structural characteristics and geographic spatial relationships of the nodes in the multidimensional attack knowledge graph, the comprehensive threat score of the attack source is calculated.

[0119] In this embodiment, attack source nodes are defined based on the attack source node's geographic location code and historical attack frequency characteristics in the attack source fingerprint data. Each attack source node represents a potential attack source, and its attributes include geographic location information (such as country or city) and historical attack frequency (such as the number of attacks in the past week). Corresponding nodes are created in the graph database and these attribute information is stored.

[0120] Define target business nodes based on the business systems corresponding to the target system's business indicators. Target business nodes represent the company's key business systems. Attributes include business name, business type (e.g., e-commerce, finance), and business importance level (e.g., high, medium, low). Create target business nodes in the graph database and populate relevant attributes.

[0121] Classify the attack methods in the DDoS attack event collection and define attack vector type nodes. Common attack vector types include UDP flood attacks, TCP SYN flood attacks, and HTTP flood attacks. Each attack vector type node represents a specific attack method, and its attributes include attack method description and attack characteristics. Create these nodes in the graph database.

[0122] Based on a collection of DDoS attack events, determine the attack initiation relationship between the attack source node and the attack vector type node. If an attack source uses a specific attack vector type to attack the target service, a weighted directed edge is created between the corresponding attack source node and the attack vector type node, representing the attack initiation relationship. The direction of the edge is from the attack source node to the attack vector type node. The initial weight can be preliminarily set based on the severity of the attack event (such as the peak attack traffic volume).

[0123] Based on changes in the target system's business indicators, determine the business impact relationship between the attack vector type node and the target business node. When a certain attack vector type impacts the target business (e.g., causing a decrease in QPS, an increase in average latency, or an increase in error rate), a weighted directed edge is created between the corresponding attack vector type node and the target business node, representing the business impact relationship. The edge runs from the attack vector type node to the target business node, and the initial weight can be preliminarily set based on the magnitude of the change in the business indicator.

[0124] During an attack, traffic and error rate data from the target system is continuously collected. Traffic ratios (e.g., the ratio of attack traffic to normal traffic) and error rate changes (e.g., the difference between the attack error rate and the normal error rate) are calculated for different time periods. This data can be obtained in real time through the service monitoring interface and stored and analyzed.

[0125] A time decay model is introduced to consider the impact of the time of attack events on edge weights. Attack events closer to the current time have a greater impact on edge weights; attack events farther from the current time have a smaller impact on edge weights. An appropriate time decay factor can be determined based on business needs and attack characteristics. For example, an exponential decay function can be used, with a set decay coefficient, to gradually reduce edge weights over time.

[0126] The weights of attack initiation edges are dynamically updated based on the traffic ratio and time decay factor. If an attack source has recently frequently used a certain attack vector type to launch attacks, and the attack traffic is high, the weight of the corresponding edge will increase. Conversely, if the attack source has not used that attack vector type for a long time, or the attack traffic is low, the weight of the edge will decrease as time decay occurs.

[0127] The weights of edges associated with business impact are updated based on the change in error rate and the time decay factor. If a certain attack vector has recently caused a significant increase in the error rate of the target business, the edge weight will increase. If the error rate change is small or if the attack has occurred a long time ago, the edge weight will decrease. Dynamically updating edge weights more accurately reflects the real-time status of attack initiation relationships and business impact relationships.

[0128] Calculate the degree centrality of the attack source node, which is the number of edges connected to it. A higher degree centrality indicates that the attack source is associated with more attack vector types and target services, and thus poses a greater potential threat. For example, if an attack source node is connected to nodes with multiple attack vector types, and these attack vector types affect multiple target service nodes, then the degree centrality of the attack source is high.

[0129] Analyze the betweenness centrality of the attack source node, which measures the number of times the node acts as a bridge for the shortest paths between other nodes in the network. A higher betweenness centrality indicates a more critical role for the attack source in the attack propagation process and potentially a higher threat level. For example, some attack source nodes may be at the intersection of multiple attack paths, potentially affecting the attack propagation of more targeted services.

[0130] Consider the geographic location of the attack source node and assess its impact on the threat level. For example, attack sources in certain regions may possess higher attack capabilities and pose a greater threat due to factors such as network infrastructure and attack technology. Attack sources in different locations can be classified into different threat levels based on historical attack data and security intelligence.

[0131] Analyze the geographic distance between the attack source node and the target business node and the correlation between the attack and the attack. While geographic distance does not directly determine the likelihood of an attack, in some cases, a close attack source may be more likely to obtain relevant information about the target business, thereby increasing the success rate of the attack. Geographic Information System (GIS) technology can be combined to visualize and analyze the geographic locations of the attack source and the target business.

[0132] Weights are assigned to different analysis indicators based on the importance of node structure characteristics and geospatial relationships to attack threats. For example, node structure characteristics such as degree centrality and betweenness centrality can be considered to have a greater impact on threat scores and thus be assigned higher weights. Geospatial relationship indicators such as geographic location threat assessment and geographic distance-attack correlation analysis can be assigned relatively lower weights.

[0133] The scores of each analysis indicator are multiplied by their corresponding weights, and the sum is calculated to obtain the attack source's comprehensive threat score. A higher comprehensive threat score indicates a greater threat level, requiring greater attention and more stringent protective measures.

[0134] In this embodiment, a multi-dimensional attack knowledge graph is constructed based on multi-source data, edge weights are dynamically updated, and a comprehensive threat score of the attack source is calculated, providing a powerful decision-making basis for the enterprise's network security protection.

[0135] In some embodiments, in step S102, based on the multi-dimensional attack knowledge graph, the double difference method is used to verify the causal relationship between the protection action and the business indicator, and the contribution of each protection measure to business recovery is calculated through the Bayesian network to construct a protection effect attribution model, which specifically includes:

[0136] Based on the protection strategy recommendation results output by the multi-dimensional attack knowledge graph, the protected business units are divided into an experimental group and a control group. The control group is a mirror system without implementing the protection strategy;

[0137] The net effect value of the protective action was calculated using a double difference model. The net effect value was the difference between the change in the business indicators of the experimental group before and after protection and the change in the control group during the same period.

[0138] When the net effect value passes the statistical significance test, a protection effect attribution model including protection measures, network indicators and business indicators is constructed through the Bayesian network;

[0139] The conditional probability parameters of the Bayesian network are trained based on historical attack data, and the contribution weight of each protection measure to business recovery is quantified through intervention causal calculation.

[0140] The contribution weight is fed back to the Bayesian network, and the protection effect attribution model is optimized by dynamically adjusting the conditional probability parameters.

[0141] In this embodiment, a multi-dimensional attack knowledge graph that has been constructed is used to comprehensively analyze the attack situation, attack source characteristics, target business system vulnerabilities, etc. in the current network environment. The information contained in the nodes (such as attack source nodes, target business nodes, attack vector type nodes) and edges (attack initiation relationships, business impact relationships) in the knowledge graph can provide rich context for the formulation of protection strategies. Based on the analysis results of the knowledge graph, combined with preset protection rules and expert experience, protection strategy recommendation results are generated for the protected business units. These recommendations may include deploying firewall rules, enabling intrusion detection systems, adjusting network traffic monitoring strategies, etc.

[0142] Select a subset of protected business units and implement the corresponding protection actions based on the protection policy recommendations. This subset of business units will serve as the experimental group. For example, if the recommendation is to deploy a specific DDoS protection device on e-commerce servers, then the e-commerce servers equipped with that device will be included in the experimental group.

[0143] A control group should be established for the experimental group. This control group consists of a mirrored system without any protection measures implemented. The mirrored system should be as consistent as possible with the experimental group in terms of business type, system architecture, and network environment to ensure comparability between the two groups. Virtualization technology can be used to create a replica of the business system identical to the experimental group, but without any protection measures implemented.

[0144] Determine the business indicators that need to be collected based on the characteristics of the protected business and the protection objectives. Common business indicators include QPS (queries per second), average response time, business success rate, etc. These indicators can reflect the operating status and performance of the business. In the experimental group and the control group, business indicator data is continuously collected in different time periods before and after the implementation of the protection action. For example, within one week before the implementation of the protection action, business indicator data is collected regularly every day; within two weeks after the implementation of the protection action, data is also collected regularly every day. At the same time, the business indicator data of the control group during the same period is recorded.

[0145] Calculate the change in the experimental group's business metrics before and after the implementation of the protective action. For example, calculate the difference between the average QPS in the week after the protective action was implemented and the average QPS in the week before implementation to obtain the change in QPS.

[0146] Calculate the change in the control group's business indicators over the same period. Using QPS as an example, calculate the difference between the control group's average QPS one week after the experimental group's protective actions were implemented and the average QPS one week before the implementation.

[0147] The net effect of the protective measures was calculated by subtracting the change in the experimental group's business indicators before and after the intervention from the change in the control group during the same period. This reflects the net impact of the protective measures on the business indicators, excluding other factors that may affect the indicators (such as seasonal fluctuations in the business itself and changes in the market environment).

[0148] Select an appropriate statistical significance test method, such as a t-test or Wilcoxon rank-sum test, to test the net effect value. The purpose of this test is to determine whether the net effect value is statistically significant, that is, to determine whether the protective action has a significant impact on the business indicator. Based on the selected test method, calculate the corresponding statistic and compare it with the critical value. If the statistic is greater than the critical value, the net effect value is considered to pass the statistical significance test, indicating that the protective action has a significant impact on the business indicator. Otherwise, the net effect value is considered insignificant, and the protective strategy needs to be reassessed or the data quality needs to be checked.

[0149] Once the net effect value passes the statistical significance test, a Bayesian network is constructed that includes protective measures, network metrics, and business metrics. Protective measure nodes represent various implemented protective actions, such as firewall rules and intrusion detection systems; network metric nodes include network traffic, bandwidth utilization, and packet loss rate; and business metric nodes represent previously determined metrics such as QPS, average response time, and business success rate. Edges between nodes are determined based on business logic and actual data relationships. For example, the implementation of protective measures may affect network metrics, while changes in network metrics may affect business metrics. Therefore, corresponding edges can be established to represent these relationships. The direction of the edge indicates the direction of the causal relationship.

[0150] Collect historical attack data from the past, including information such as attack type, attack time, attack source, and affected business systems. Also collect protective measures implemented during the attack period, as well as network and business indicator data. Organize the collected historical attack data and convert it into a format suitable for Bayesian network training. For example, encode discrete protective measures, network and business indicators, and discretize continuous data.

[0151] Use compiled historical attack data to train the conditional probability parameters of the Bayesian network. Statistical methods can be used to calculate the probability of a child node taking different values ​​given the state of a parent node. For example, the probability of a service success rate taking different values ​​can be calculated when certain protection measures are implemented and network traffic is at a specific value. During training, the conditional probability parameters are adjusted based on the actual data and the model's fit. Cross-validation and other methods can be used to evaluate the model's accuracy and generalization ability to ensure the rationality of parameter training.

[0152] Using the trained Bayesian network, we perform intervention causal calculations. Specifically, by setting different intervention states for protective measures and calculating changes in business indicators before and after the intervention, we quantify the causal impact of each protective measure on business recovery. Based on the results of the intervention causal calculations, we calculate the contribution weight of each protective measure to business recovery. The contribution weight reflects the relative importance of a protective measure in the business recovery process. For example, if a protective measure significantly improves the business success rate after intervention, its contribution weight is higher.

[0153] The calculated contribution weights for each protective measure are fed back into the Bayesian network. Within the Bayesian network, these weights can be used to adjust the conditional probabilities between nodes, enabling the model to more accurately reflect the causal relationship between protective measures and business recovery. Based on the feedback, the Bayesian network structure and parameters are updated. Conditional probabilities between nodes can be recalculated, and edge connections can be optimized to improve model accuracy and reliability.

[0154] In some embodiments, in the above step S103, the confidence evaluation result based on the protection effect attribution model is used to generate a protection strategy set in a three-dimensional decision space using a multi-objective optimization algorithm, specifically including:

[0155] Based on the confidence evaluation results output by the protection effectiveness attribution model, the target weight coefficients of business availability, protection cost, and attack intensity are dynamically adjusted to generate a weighted multi-objective optimization function.

[0156] The Anti-DDoS packet activation status, traffic traction ratio, and cloud resource allocation parameters are set as individual codes. Based on the individual codes, an improved NSGA-II algorithm is used to search for the Pareto optimal solution set in the three-dimensional decision space.

[0157] The hard constraint condition is that the service availability is greater than or equal to the minimum availability threshold, and the soft constraint condition is that the protection cost is less than or equal to the budget upper limit.

[0158] Combining hard and soft constraints, a set of protection strategies that meet the service level agreement is selected from the Pareto optimal solution set.

[0159] In this embodiment, the constructed protection effect attribution model is used to evaluate the effectiveness of different protection measures in various attack scenarios, and obtain corresponding confidence evaluation results. This result reflects the reliability of the model's judgment on the effectiveness of protection measures. For example, for the evaluation of the effectiveness of a specific protection measure under a specific attack type, a higher confidence level indicates that the model has a higher degree of trust in the evaluation result; a lower confidence level means that there may be greater uncertainty in the evaluation result. The confidence evaluation results are analyzed in depth to determine the performance differences of different protection measures at different confidence levels. For example, it is analyzed which protection measures have a higher confidence level in most cases, and which protection measures have a greater confidence level affected by the attack scenario or business environment.

[0160] Based on the confidence assessment results, if certain protection measures are found to have a high degree of confidence in improving business availability, the objective weight coefficient for business availability in the multi-objective optimization process will be appropriately increased. For example, if a certain protection strategy is proven to significantly and stably improve business system availability, and the model has a high degree of confidence in this effect, the business availability weight coefficient will be increased by a certain percentage to highlight the importance of business availability in the optimization process.

[0161] If certain protective measures show a high degree of confidence in controlling costs, that is, they can reduce costs while achieving effective protection, then the target weight coefficient of the protection cost should be appropriately reduced; conversely, if certain protective measures have high costs and greater uncertainty in their effects, then the protection cost weight coefficient should be increased to guide the optimization process to be more inclined to find more cost-effective protection strategies.

[0162] Combining historical attack data with current network environment monitoring information, the confidence level of the protection effectiveness attribution model is analyzed under different attack intensities. If the model's confidence level in the effectiveness of protective measures is high under a specific attack intensity, the attack intensity target weighting coefficient is dynamically adjusted based on the impact of that attack intensity on the business. For example, when facing a high-intensity attack, if the model has a high confidence level in the effectiveness of certain protective measures against high-intensity attacks, the attack intensity weighting coefficient is appropriately increased to emphasize the effectiveness of the protection strategy in high-intensity attack scenarios.

[0163] Business availability, protection cost, and attack intensity are considered as the three objectives of multi-objective optimization. Business availability can be measured through indicators such as business system uptime and service response time; protection cost includes hardware equipment procurement costs, software licensing fees, and operation and maintenance costs; and attack intensity can be comprehensively assessed based on attack traffic volume, attack frequency, and attack type. Based on the dynamically adjusted objective weight coefficients, a weighted multi-objective optimization function is constructed. This function comprehensively considers the importance of the three objectives, integrating the optimization requirements of different objectives and providing optimization direction for subsequent optimization algorithms. For example, during the optimization process, the algorithm will use the weighted multi-objective optimization function to find the optimal combination of protection strategies that achieves the three objectives while satisfying certain constraints.

[0164] Set the enabled state of the high-defense package to a binary-coded variable. For example, "1" indicates that the high-defense package is enabled, and "0" indicates that it is not enabled. The high-defense package is a common network protection device that can provide protection against network attacks such as DDoS attacks. Its enabled state directly affects the protection effect and cost.

[0165] Discretely encode the traffic diversion ratio. Based on actual business needs and the network environment, the traffic diversion ratio is divided into several discrete levels, such as 0%, 25%, 50%, 75%, and 100%, and each level is assigned a unique code value. The traffic diversion ratio determines how much network traffic is directed to the protection device for processing. Different ratios have different impacts on business availability and protection effectiveness.

[0166] Encode cloud resource allocation parameters, such as the number of cloud servers, number of CPU cores, and memory size, and set different value ranges and encoding methods for each dimension. Cloud resource allocation affects the processing power and cost of the protection system. Reasonable resource allocation can improve protection effectiveness and control costs.

[0167] The codes for the Anti-DDoS packet activation status, traffic traction ratio, and cloud resource allocation parameters are combined to form an individual code. Each individual code represents a specific combination of defense strategies, which are used for search and optimization in the three-dimensional decision space.

[0168] A certain number of individual codes are randomly generated within the three-dimensional decision space to form the initial population. These individual codes represent different combinations of protection strategies and serve as the starting point for algorithm optimization. A fast non-dominated sort is performed on the individuals in the initial population, dividing them into different non-dominated levels. Individuals with lower non-dominated levels perform better on multiple objectives. For example, an individual in the first non-dominated level is not dominated by any other individual in terms of service availability, protection cost, and attack severity. This means that no other individual outperforms it in all three objectives.

[0169] Calculate the crowding degree of individuals in each non-dominated level. Crowding reflects the distribution of individuals in the target space. Individuals with greater crowding have a lower density of surrounding individuals in the target space, indicating greater diversity. This crowding calculation prevents the algorithm from falling into local optimal solutions and ensures a diverse solution set.

[0170] Based on the results of fast non-dominated sorting and crowding calculation, methods such as tournament selection are used to select outstanding individuals from the current population as parents. Crossover and mutation operations are then performed on the parent individuals to generate new offspring individuals. The crossover operation swaps some of the codes of two parent individuals, producing offspring individuals with new characteristics; the mutation operation randomly changes certain codes of the offspring individuals to increase population diversity.

[0171] The offspring individuals are merged with the parent individuals to form a new population. The algorithm then repeats operations such as fast non-dominated sorting, congestion calculation, selection, crossover, and mutation for continuous iterative optimization. During this iterative process, the algorithm gradually approaches the Pareto optimal frontier, ultimately obtaining a set of Pareto optimal solutions. Each solution in the Pareto optimal solution set represents a relatively optimal combination of protection strategies for the three objectives of service availability, protection cost, and attack severity. No other solution can improve at least one objective without sacrificing the others.

[0172] Determine the minimum availability threshold for business availability based on the business's service level agreement (SLA) and actual business needs. For example, for financial business systems with extremely high business continuity requirements, the business availability requirement may be no less than 99.99%. For non-critical business systems, the minimum availability threshold can be relatively low, such as 99%.

[0173] The hard constraint condition is that service availability must be greater than or equal to the minimum availability threshold. When screening the protection strategies in the Pareto optimal solution set, the first step is to check whether the service availability corresponding to each protection strategy meets this hard constraint condition. If not, the protection strategy is directly removed from the solution set and is not considered in subsequent evaluation and selection.

[0174] Determine a budget cap for protection costs based on the company's financial situation and cybersecurity protection budget. This cap should take into account expenses for hardware procurement, software licensing, operations and maintenance, and other aspects to ensure that cybersecurity protection is affordable. A soft constraint is established where the protection cost is less than or equal to the budget cap. For protection strategies that meet the hard constraints, further checks are performed to determine whether their protection costs meet the soft constraints. If the protection cost exceeds the budget cap, the strategy will be flagged or penalized based on the actual situation. However, the strategy will not be directly eliminated; instead, other factors will be considered in the subsequent decision-making process.

[0175] A comprehensive evaluation of the protection strategies in the Pareto-optimal solution set is conducted, combining both hard and soft constraints. In addition to service availability and protection cost, other factors such as attack severity targets, the difficulty of implementing protection strategies, and the impact on service performance can also be considered. A set of protection strategies that meet the service level agreement (SLA) is selected from the Pareto-optimal solution set. This set includes a variety of protection strategy combinations that achieve a relatively balanced balance between service availability, protection cost, and attack severity, providing network security managers with diverse options and flexible deployment based on actual needs and circumstances.

[0176] In this embodiment, based on the confidence evaluation results of the protection effect attribution model, a multi-objective optimization algorithm is used to generate a protection strategy set in a three-dimensional decision space, which effectively solves the problem of multi-objective optimization in network security protection and improves the scientificity and rationality of the protection strategy.

[0177] In some embodiments, in step S104 above, based on the protection policy set, connecting to the multi-cloud platform protection resource API interface, dynamically scheduling high-defense package resources based on the Q-learning reinforcement learning algorithm, and performing cross-cloud traffic traction and cleaning service switching specifically include:

[0178] Obtain resource status data of each cleaning node in real time through the multi-cloud platform API interface, and construct a status feature vector based on the resource status data, including the available bandwidth ratio, network delay normalization value, and attack traffic intensity;

[0179] The state feature vector is input into the pre-trained Q-learning model, and the target cleaning node and traffic distribution ratio are selected based on the ε-greedy strategy to generate protection scheduling instructions.

[0180] Call the traffic traction API provided by the cloud service provider to execute protection scheduling instructions, and achieve cross-cloud traffic distribution through BGP routing policy modification and GRE tunnel encapsulation;

[0181] Monitor changes in business indicators after the execution of protection scheduling instructions, and calculate instant reward values ​​based on resource utilization, network latency, and SLA compliance rate;

[0182] Based on the instantaneous reward value, the temporal difference learning algorithm is used to update the Q value table.

[0183] In this embodiment, a mechanism is established to connect to the API interfaces of multi-cloud platform protection resources. Different cloud service providers typically provide their own API interfaces for obtaining information about protection resources. By integrating with these API interfaces, it is possible to obtain real-time resource status data for each cleaning node. For example, by connecting to the protection API interfaces of mainstream cloud service providers such as Alibaba Cloud, Tencent Cloud, and Huawei Cloud, data such as available bandwidth, network latency, and attack traffic of their high-defense cleaning nodes can be obtained.

[0184] Based on the dynamics of cyberattacks and business needs, set a reasonable data collection frequency. For example, collect resource status data for each cleaning node every minute to ensure timely understanding of resource changes and provide an accurate basis for subsequent decision-making.

[0185] For each scrubbing node, calculate the ratio of its available bandwidth to its total bandwidth. Available bandwidth refers to the bandwidth currently available for processing network traffic at the scrubbing node, while total bandwidth is the scrubbing node's maximum bandwidth capacity. By calculating the available bandwidth ratio, you can intuitively understand the scrubbing node's bandwidth resource usage.

[0186] Collect network latency data from each cleaning node. Since network latency at different cleaning nodes may have different dimensions and ranges, normalization is necessary. For example, you can use the Z-score normalization method to convert network latency data into standard normal distribution data with a mean of 0 and a standard deviation of 1 to facilitate subsequent analysis and comparison.

[0187] The attack traffic volume received by each cleaning node is counted as an indicator of attack traffic intensity. The attack traffic intensity can reflect the attack pressure currently faced by the cleaning node.

[0188] The three metrics, available bandwidth percentage, normalized network latency, and attack traffic intensity, are combined to construct a state feature vector. This vector comprehensively describes the current state of the scrubbing node and provides a basis for decision-making in the Q-learning algorithm.

[0189] Build a Q-learning model and initialize the Q-value table. The Q-value table is a two-dimensional table where rows represent different state feature vectors and columns represent different actions (i.e., combinations of target cleaning nodes and traffic distribution ratios). Initially, all values ​​in the Q-value table can be set to 0 or a small random value.

[0190] Collect historical network attack data and protection scheduling records, including cleaning node selection and traffic distribution under different states, as well as corresponding business indicator changes. Use this historical data to train the Q-learning model. By continuously updating the Q value table, the model gradually learns the strategy for selecting the optimal action under different states.

[0191] The ε-greedy strategy is a commonly used exploration and exploitation strategy. At each decision, a random action is selected with a certain probability ε (exploration), and the action with the highest Q value in the current Q-value table is selected with a probability of (1-ε) (exploitation). By setting an appropriate ε value, a balance can be achieved between exploring new possible actions and exploiting the known optimal action. The constructed state feature vector is input into a pre-trained Q-learning model, and the target cleaning node and traffic distribution ratio are selected according to the ε-greedy strategy. For example, if the current ε value is 0.2, there is a 20% probability of randomly selecting a cleaning node and traffic distribution ratio combination, and an 80% probability of selecting the combination with the highest Q value in the Q-value table corresponding to the current state feature vector.

[0192] Generate specific protection scheduling instructions based on the selected target cleaning nodes and traffic allocation ratios. These instructions should include key information such as the cleaning node's identification, traffic allocation ratio, and execution time. Format the protection scheduling instructions according to the cloud service provider's API interface requirements to ensure they can be correctly parsed and executed.

[0193] Call the traffic traction API provided by the cloud service provider and send the generated protection scheduling instructions to the corresponding cloud platform. Different cloud service providers may have different calling methods and parameter requirements for traffic traction APIs. You must follow their documentation to call them correctly. When calling the API, set relevant parameters such as the source IP address, the target cleaning node IP address, and the traffic allocation ratio. Ensure that traffic is accurately pulled from the source network to the target cleaning node according to the scheduling instructions.

[0194] By modifying the Border Gateway Protocol (BGP) routing policy, traffic originally destined for the source network can be directed to the target scrubbing node. BGP is a protocol used to exchange routing information between autonomous systems (AS). By modifying the BGP routing policy, the direction of traffic can be dynamically adjusted. For situations where traffic transmission across cloud platforms is required, Generic Routing Encapsulation (GRE) tunneling technology can be used. GRE tunnels create a virtual point-to-point connection between different networks, encapsulating the original traffic in the GRE tunnel for transmission, thereby achieving cross-cloud traffic distribution.

[0195] Identify the business metrics that require monitoring, such as resource utilization, network latency, and SLA compliance. Resource utilization reflects the efficiency of scrubbing node resources; network latency affects service response speed and user experience; and SLA compliance measures whether the protection service meets the service level agreement requirements. After the protection scheduling instructions are executed, continuously monitor changes in these business metrics. Real-time business metric data can be obtained by deploying monitoring tools or using monitoring services provided by cloud service providers.

[0196] Design a reasonable reward function based on business needs and optimization objectives. For example, when resource utilization is high, network latency is low, and SLA compliance is high, a higher reward value is given; conversely, a lower or negative reward value is given. Based on monitored business metric data, an immediate reward value is calculated according to the reward function. This immediate reward value reflects the execution effect of the current protection scheduling instruction and provides a basis for subsequent Q-value table updates.

[0197] The temporal difference learning algorithm is a commonly used reinforcement learning algorithm that combines the advantages of Monte Carlo and dynamic programming methods. After each action is executed, the Q-value of the current state is updated based on the immediate reward value and the estimated value of the subsequent state. Based on the calculated immediate reward value, the temporal difference learning algorithm is used to update the Q-value table. Specifically, for the current state feature vector and the selected action, the current Q-value is updated according to a certain learning rate based on the maximum Q-value corresponding to the immediate reward value and the next state feature vector. By continuously updating the Q-value table, the model can gradually learn a more optimal protection scheduling strategy.

[0198] This process is repeated repeatedly, continuously acquiring new resource status data, selecting actions, executing protection scheduling instructions, calculating immediate rewards, and updating the Q-value table. Through continuous optimization and iteration, the Q-learning model can adapt to changing network environments and attack scenarios, improving the effectiveness of dynamic scheduling of cross-cloud traffic traction and scrubbing services.

[0199] In this embodiment, based on the protection policy set, it connects to the multi-cloud platform protection resource API interface, uses the Q-learning reinforcement learning algorithm to dynamically schedule high-defense package resources, realizes cross-cloud traffic traction and cleaning service switching, and effectively improves the intelligence level of network security protection and resource utilization efficiency.

[0200] In some embodiments, in the above step S105, the protection effect of the protection policy set is verified by the multi-level business health check mechanism, and the verification result of the multi-level business health check mechanism is fed back to the multi-dimensional attack knowledge graph for iterative update of feature weights, specifically including:

[0201] Perform ICMP detection at the network layer, port scanning at the transport layer, and service request simulation at the application layer to generate a comprehensive health index.

[0202] Compare the changes in the comprehensive health index before and after the implementation of the protection strategy set, and calculate the feature weight adjustment factor based on the strategy effectiveness indicator;

[0203] Based on the feature weight adjustment factor, the edge weights associated with active attack features in the multi-dimensional attack knowledge graph are exponentially updated;

[0204] When the comprehensive health index is detected to be lower than the preset health index threshold, the protection strategy rollback mechanism is triggered and the abnormal features of the graph are marked.

[0205] In this embodiment, in the network layer, the EchoRequest and EchoReply messages of the Internet Control Message Protocol (ICMP) are used to detect network connectivity. An ICMPEchoRequest message is sent to the key node in the network where the business system is located. If the corresponding EchoReply message is received, it indicates that the network of the node is reachable; if it is not received, there may be a network failure or it may be blocked by an attack. A reasonable detection cycle is set, for example, an ICMP detection is performed on the main network equipment (such as routers, switches, etc.) and servers involved in the business system every 5 minutes. The detection results of each node are recorded, including indicators such as the number of successful detections, the number of failures, and the average response time. These indicators can reflect the connectivity and stability of the network layer.

[0206] In the transport layer, check the port open status and availability of business system-related services. Different business services usually run on specific ports. Port scanning can help you understand whether these services are running normally and whether there are any abnormal port openings. Use common port scanning techniques, such as TCPSYN scanning. Scan the port range that may be used by the business system (such as common ports 1-1024), and record the open status (open, closed, filtered) and response time of each port. For example, if a port that should have been open for a business service is found to be closed, it may mean that the service has failed or is under attack.

[0207] At the application layer, typical application-layer business requests are constructed based on the actual functions and usage scenarios of the business system. For example, for an e-commerce business system, user login, product browsing, and ordering operations can be simulated. Simulated business requests are sent to the business system at a set frequency and concurrency, and the system response is recorded, including metrics such as request success rate, average response time, and error code distribution. These metrics can reflect the operational status of the business system at the application layer and the user experience.

[0208] Quantify the network layer detection results, transport layer port scan results, and application layer business request simulation results. For example, convert indicators such as the network layer detection success rate, transport layer port availability, and application layer request success rate into numerical values ​​between 0 and 100. Assign appropriate weights to each indicator based on the degree of impact of each layer on the health of the business system. For example, network layer connectivity is crucial to the normal operation of the business system and can be given a higher weight; the weight of the application layer response time can be adjusted based on the business's real-time requirements. The quantified indicators are weighted and summed according to their weights to generate a comprehensive health index. This index comprehensively reflects the overall health of the business system at the network, transport, and application layers, and typically ranges from 0 to 100, with higher values ​​indicating a healthier business system.

[0209] Before implementing the protection policy set, record the initial comprehensive health index of the business system. After a period of time (e.g., 24 hours) following the implementation of the protection policy set, record the comprehensive health index of the business system again. Calculate the change in the comprehensive health index before and after the implementation of the protection policy set. A positive change indicates that the health of the business system has improved after the implementation of the protection policy set; a negative change indicates that the health of the business system may have been negatively impacted.

[0210] Based on the security requirements and expected goals of the business system, set the effectiveness indicator of the protection policy. For example, if the key business indicators of the business system (such as transaction success rate and user visits) do not show a significant decline after the implementation of the protection policy set, and the overall health index improves, the policy will be marked as effective. Conversely, if the key business indicators decline or the overall health index decreases, the policy will be marked as ineffective.

[0211] Analyze the relationship between the set of protection strategies and the active attack features in the multi-dimensional attack knowledge graph. For example, some protection strategies may be formulated for specific attack types (such as DDoS attacks and SQL injection attacks), and these attack types have corresponding features in the multi-dimensional attack knowledge graph.

[0212] The feature weight adjustment factor is calculated by combining the change in the comprehensive health index and the policy effectiveness indicator. If the protection policy is effective and the comprehensive health index increases, a positive adjustment factor can be assigned to active attack features associated with that policy, indicating that the impact of these features on the business system may decrease under the current protection environment. If the protection policy is ineffective and the comprehensive health index decreases, a negative adjustment factor is assigned, indicating that the impact of these features may increase.

[0213] Based on the feature weight adjustment factor, determine the edges associated with active attack features in the multi-dimensional attack knowledge graph. For example, if a certain attack type is the currently active attack feature, find all edges related to that attack type.

[0214] Based on the feature weight adjustment factor, the weights of these edges are exponentially updated. If the adjustment factor is positive, the edge weight can be appropriately reduced, indicating that the threat level of the attack feature in the current protection environment has decreased. If the adjustment factor is negative, the edge weight is increased, indicating that the threat level of the attack feature has increased. The updated edge weights can more accurately reflect the relationship and importance of various attack features in the current network attack situation.

[0215] A preset health index threshold is set based on the security requirements and actual operating conditions of the business system. This threshold is an important basis for determining whether there are serious problems with the health of the business system. For example, for a financial business system with extremely high business continuity requirements, the health index threshold can be set to 80. When the comprehensive health index is lower than 80, it is considered that the business system may have a large security risk. The comprehensive health index of the business system is continuously monitored. When it is detected that the comprehensive health index is lower than the preset health index threshold, the protection policy rollback mechanism is triggered. Roll back to the state before the current protection policy set was implemented, and restore the original protection configuration of the business system. At the same time, record relevant information about the rollback operation, including the rollback time and the rolled-back protection policy.

[0216] When triggering the rollback mechanism for the protection policy, the system analyzes the features in the multi-dimensional attack knowledge graph to identify and flag abnormal features that could cause a decline in the business system's health index. For example, the weight of certain attack features may increase abnormally over a short period of time, or new attack features may be associated with key business nodes. The flagging information may include the name of the abnormal feature, the time of appearance, and the weight change.

[0217] In this embodiment, the protection effect of the protection strategy set is verified through a multi-level business health check mechanism, and the verification results are fed back to the multi-dimensional attack knowledge graph for iterative update of feature weights, thereby achieving dynamic optimization of network security protection strategies and accurate identification of attack features, thereby improving the security and stability of the business system.

[0218] Reference Figure 2 An embodiment of the present invention provides an intelligent protection switching system 2 for DDoS attacks, wherein the system 2 specifically includes:

[0219] Multi-source data acquisition module 201, used to obtain DDoS attack alarm information through a multi-source data acquisition interface and build a multi-dimensional attack knowledge graph based on a graph database. The multi-dimensional attack knowledge graph includes attack source behavior patterns, attack vector types, and target business attributes;

[0220] The protection effect attribution module 202 is used to verify the causal relationship between protection actions and business indicators based on the multi-dimensional attack knowledge graph using the double difference method, and calculate the contribution of each protection measure to business recovery through the Bayesian network to build a protection effect attribution model;

[0221] A protection strategy generation module 203 is configured to generate a protection strategy set in a three-dimensional decision space based on the confidence evaluation results of the protection effectiveness attribution model using a multi-objective optimization algorithm. The three-dimensional decision space includes service availability indicators, protection cost constraints, and attack severity levels.

[0222] The protection policy execution module 204 is used to connect to the multi-cloud platform protection resource API interface based on the protection policy set, dynamically schedule high-defense package resources based on the Q-learning reinforcement learning algorithm, and perform cross-cloud traffic pulling and cleaning service switching;

[0223] The protection effect verification module 205 is used to verify the protection effect of the protection policy set through a multi-level business health check mechanism, and feed back the verification results of the multi-level business health check mechanism to the multi-dimensional attack knowledge graph for iterative update of feature weights.

[0224] It is understandable that if Figure 1 The contents of the embodiment of the intelligent protection switching method for DDoS attacks shown in the figure are applicable to the embodiment of the intelligent protection switching system for DDoS attacks. The functions specifically implemented by the embodiment of the intelligent protection switching system for DDoS attacks are the same as those in the embodiment of the figure. Figure 1 The embodiment of the intelligent protection switching method for DDoS attacks shown in FIG. 1 is the same as that shown in FIG. 1 , and the beneficial effects achieved are the same as those of FIG. Figure 1 The beneficial effects achieved by the embodiment of the intelligent protection switching method for DDoS attacks shown are also the same.

[0225] It should be noted that the information interaction, execution process and other contents between the above-mentioned systems are based on the same concept as the embodiment of the method of the present invention. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0226] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0227] Reference Figure 3 An embodiment of the present invention further provides a computer device 3, comprising: a memory 302, a processor 301, and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, the intelligent protection switching method for DDoS attacks as described in any one of the above methods is implemented.

[0228] The computer device 3 may be a desktop computer, a notebook computer, a PDA, a cloud server or other computing devices. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that Figure 3 This is merely an example of the computer device 3 and does not constitute a limitation on the computer device 3 . The computer device 3 may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the computer device 3 may also include input and output devices, network access devices, etc.

[0229] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0230] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. equipped on the computer device 3. Furthermore, the memory 302 may include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, application programs, a boot loader, data, and other programs, such as the program code of the computer program. The memory 302 may also be used to temporarily store data that has been output or is about to be output.

[0231] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for intelligent protection switching for DDoS attacks as described in any one of the above methods is implemented.

[0232] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the process of the above-mentioned method embodiment by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium can at least include: any entity or device capable of carrying computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. For example, a USB flash drive, mobile hard drive, magnetic disk, or optical disk. In some jurisdictions, based on legislation and patent practice, computer-readable media cannot be electric carrier signals or telecommunication signals.

[0233] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0234] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0235] In the embodiments disclosed in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely schematic. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0236] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. A smart protection switching method for DDoS attacks, characterized in that: The method specifically includes: Obtain DDoS attack alert information through a multi-source data collection interface and build a multi-dimensional attack knowledge graph based on a graph database. The multi-dimensional attack knowledge graph includes attack source behavior patterns, attack vector types, and target business attributes. Based on a multi-dimensional attack knowledge graph, the double difference method is used to verify the causal relationship between protection actions and business indicators. The contribution of each protection measure to business recovery is calculated through a Bayesian network to build a protection effect attribution model. Based on the confidence assessment results of the protection effectiveness attribution model, a multi-objective optimization algorithm is used to generate a protection strategy set in a three-dimensional decision space. The three-dimensional decision space includes service availability indicators, protection cost constraints, and attack severity levels. Based on the protection policy set, it connects to the multi-cloud platform protection resource API interface, dynamically schedules high-defense package resources based on the Q-learning reinforcement learning algorithm, and performs cross-cloud traffic traction and cleaning service switching; The protection effect of the protection strategy set is verified through a multi-level business health check mechanism, and the verification results of the multi-level business health check mechanism are fed back to the multi-dimensional attack knowledge graph for iterative update of feature weights.

2. The method according to claim 1, characterized in that The DDoS attack alarm information is obtained through the multi-source data collection interface, specifically including: Obtain a collection of DDoS attack events in real time through the cloud platform alarm interface. The DDoS attack event collection includes the target IP address, attack traffic peak, and timestamp. Acquire attack source fingerprint data through a threat intelligence interface, wherein the attack source fingerprint data includes the geographic location code and historical attack frequency characteristics of the attack source node; The target system business indicators are obtained through the business monitoring interface, and the target system business indicators include QPS, average delay and error rate.

3. The method according to claim 2, characterized in that The multi-dimensional attack knowledge graph based on the graph database is constructed, specifically including: Based on the DDoS attack event set, attack source fingerprint data, and target system business indicators, a multidimensional attack knowledge graph is constructed using a graph database. The node set of the multidimensional attack knowledge graph includes attack source nodes, target business nodes, and attack vector types. The weighted directed edges of the multidimensional attack knowledge graph represent the attack initiation relationship and business impact relationship. Combining traffic ratios and error rate changes, a time decay model is used to dynamically update the edge weights of the multi-dimensional attack knowledge graph to determine the edge weights of attack initiation relationships and business impact relationships. Based on the structural characteristics and geographic spatial relationships of the nodes in the multidimensional attack knowledge graph, the comprehensive threat score of the attack source is calculated.

4. The method according to claim 1, wherein Based on the multi-dimensional attack knowledge graph, the double difference method is used to verify the causal relationship between protection actions and business indicators. The contribution of each protection measure to business recovery is calculated through the Bayesian network, and a protection effect attribution model is constructed. Specifically, it includes: Based on the protection strategy recommendation results output by the multi-dimensional attack knowledge graph, the protected business units are divided into an experimental group and a control group. The control group is a mirror system without implementing the protection strategy; The net effect value of the protective action was calculated using a double difference model. The net effect value was the difference between the change in the business indicators of the experimental group before and after protection and the change in the control group during the same period. When the net effect value passes the statistical significance test, a protection effect attribution model including protection measures, network indicators and business indicators is constructed through the Bayesian network; The conditional probability parameters of the Bayesian network are trained based on historical attack data, and the contribution weight of each protection measure to business recovery is quantified through intervention causal calculation. The contribution weight is fed back to the Bayesian network, and the protection effect attribution model is optimized by dynamically adjusting the conditional probability parameters.

5. The method according to claim 1, wherein Based on the confidence evaluation results of the protection effect attribution model, a multi-objective optimization algorithm is used to generate a protection strategy set in the three-dimensional decision space, specifically including: Based on the confidence evaluation results output by the protection effectiveness attribution model, the target weight coefficients of business availability, protection cost, and attack intensity are dynamically adjusted to generate a weighted multi-objective optimization function. The Anti-DDoS packet activation status, traffic traction ratio, and cloud resource allocation parameters are set as individual codes. Based on the individual codes, an improved NSGA-II algorithm is used to search for the Pareto optimal solution set in the three-dimensional decision space. The hard constraint condition is that the service availability is greater than or equal to the minimum availability threshold, and the soft constraint condition is that the protection cost is less than or equal to the budget upper limit. Combining hard and soft constraints, a set of protection strategies that meet the service level agreement is selected from the Pareto optimal solution set.

6. The method according to claim 1, wherein Based on the protection policy set, the system connects to the multi-cloud platform protection resource API interface, dynamically schedules high-defense package resources based on the Q-learning reinforcement learning algorithm, and performs cross-cloud traffic traction and cleaning service switching, specifically including: Obtain resource status data of each cleaning node in real time through the multi-cloud platform API interface, and construct a status feature vector based on the resource status data, including the available bandwidth ratio, network delay normalization value, and attack traffic intensity; The state feature vector is input into the pre-trained Q-learning model, and the target cleaning node and traffic distribution ratio are selected based on the ε-greedy strategy to generate protection scheduling instructions. Call the traffic traction API provided by the cloud service provider to execute protection scheduling instructions, and achieve cross-cloud traffic distribution through BGP routing policy modification and GRE tunnel encapsulation; Monitor changes in business indicators after the execution of protection scheduling instructions, and calculate instant reward values ​​based on resource utilization, network latency, and SLA compliance rate; Based on the instantaneous reward value, the temporal difference learning algorithm is used to update the Q value table.

7. The method according to any one of claims 1 to 6, characterized in that The multi-level business health check mechanism verifies the protection effect of the protection strategy set, and feeds the verification results of the multi-level business health check mechanism back to the multi-dimensional attack knowledge graph for iterative update of feature weights, specifically including: Perform ICMP detection at the network layer, port scanning at the transport layer, and service request simulation at the application layer to generate a comprehensive health index. Compare the changes in the comprehensive health index before and after the implementation of the protection strategy set, and calculate the feature weight adjustment factor based on the strategy effectiveness indicator; Based on the feature weight adjustment factor, the edge weights associated with active attack features in the multi-dimensional attack knowledge graph are exponentially updated; When the comprehensive health index is detected to be lower than the preset health index threshold, the protection strategy rollback mechanism is triggered and the abnormal features of the graph are marked.

8. An intelligent protection switching system for DDoS attacks, characterized in that: The system specifically includes: A multi-source data acquisition module is used to obtain DDoS attack alarm information through a multi-source data acquisition interface and build a multi-dimensional attack knowledge graph based on a graph database. The multi-dimensional attack knowledge graph includes attack source behavior patterns, attack vector types, and target business attributes; The protection effect attribution module is used to verify the causal relationship between protection actions and business indicators based on a multi-dimensional attack knowledge graph using a double difference method. It also calculates the contribution of each protection measure to business recovery through a Bayesian network and constructs a protection effect attribution model. A protection strategy generation module, which uses a multi-objective optimization algorithm to generate a set of protection strategies in a three-dimensional decision space based on the confidence assessment results of the protection effectiveness attribution model. The three-dimensional decision space includes service availability indicators, protection cost constraints, and attack severity levels. The protection policy execution module is used to connect to the multi-cloud platform protection resource API interface based on the protection policy set, dynamically schedule high-defense package resources based on the Q-learning reinforcement learning algorithm, and perform cross-cloud traffic traction and cleaning service switching; The protection effect verification module is used to verify the protection effect of the protection policy set through a multi-level business health check mechanism, and feed back the verification results of the multi-level business health check mechanism to the multi-dimensional attack knowledge graph for iterative update of feature weights.

9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory, which, when executed on the processor, implements the intelligent protection switching method for DDoS attacks according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the intelligent protection switching method for DDoS attacks according to any one of claims 1 to 7 is implemented.

Images