Malicious host detection method and device, equipment and medium

Abstract

The invention discloses a malicious host detection method and device, equipment and a medium. The method comprises the following steps: counting congestion participation times, access address change times and continuous participation times of each target host identifier based on a plurality of access address change events and a plurality of congestion events in a current time window so as to calculate an initial credibility of each target host identifier in the current time window; obtaining a historical trust degree corresponding to each target host identifier in the historical time window, and calculating a target trust degree of each target host identifier according to the initial trust degree of each target host identifier and the corresponding historical trust degree; obtaining a current state data set, and inputting the state data set into the target decision model to obtain a target credibility threshold; and malicious host identification is carried out according to the target credibility threshold and the target credibility of each target host identifier. Therefore, the identification accuracy of the malicious host is improved, and the attack of the malicious host on the network transmission link is blocked.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a malicious host detection method, apparatus, device and medium. Background Art

[0002] In computing network systems, the expansion of service types and service targets has led to an increasingly widespread and numerous distribution of computing nodes. Consequently, computing network services involve more network transmission links, increasing the risk of malicious attacks on these links. For example, attackers could compromise multiple authenticated hosts within the network and coordinate attacks against transmission links, maliciously occupying the network bandwidth resources of these links. This could cause congestion on previously healthy network transmission links, preventing users from accessing the computing services provided by the computing network system. Therefore, it is necessary to identify malicious hosts that cause network transmission link congestion.

[0003] Related technologies identify malicious hosts by monitoring malicious traffic. However, this method relies on mining relevant features of malicious traffic. In transmission link attacks, benign traffic and malicious traffic are similar. This method is more difficult to mine the traffic feature differences between benign traffic and malicious traffic, and thus it is difficult to distinguish between benign traffic and malicious traffic. Therefore, the accuracy of identifying malicious hosts is reduced. As a result, this method can only temporarily postpone the congestion of network transmission links and cannot completely block the attacks of malicious hosts. Summary of the Invention

[0004] The embodiments of the present application provide a malicious host detection method, apparatus, device, and medium, which can improve the accuracy of identifying malicious hosts and block malicious hosts from attacking network transmission links.

[0005] In a first aspect, an embodiment of the present application provides a malicious host detection method, comprising: Obtain multiple access address change events and multiple congestion events within the current time window, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier of the participating network link congestion; Based on the multiple access address change events and the multiple congestion events, counting the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier; Calculating an initial trust degree of each target host identifier in the current time window based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier in the current time window; Obtaining a historical trust degree corresponding to each target host identifier in a historical time window, and calculating a target trust degree for each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree; Obtaining a current state data set, inputting the state data set into a target decision model, and obtaining a target confidence threshold; Malicious host identifiers are identified based on the target trust threshold and the target trust of each target host identifier.

[0006] In a second aspect, an embodiment of the present application provides a malicious host detection device, comprising: an acquisition unit, configured to acquire multiple access address change events and multiple congestion events within a current time window, wherein each access address change event includes an identifier of a target host whose access address has been changed, and each congestion event includes an identifier of a target host that is involved in network link congestion; a statistics unit, configured to count the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier based on the multiple access address change events and the multiple congestion events; a first calculating unit, configured to calculate an initial trust degree of each target host identifier in the current time window based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier in the current time window; a second calculation unit, configured to obtain a historical trust degree corresponding to each target host identifier in a historical time window, and calculate a target trust degree of each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree; An input unit, configured to obtain a current state data set, input the state data set into a target decision model, and obtain a target confidence threshold; The identification unit is configured to identify malicious host identifiers according to the target trust threshold and the target trust of each target host identifier.

[0007] In some embodiments, the first computing unit is further configured to: Determining a direct participation score of each target host identifier based on the congestion participation count of each target host identifier within the current time window; Calculating a continuous participation score based on the number of continuous participations of each target host identifier within the current time window; Calculating an address change score based on the number of access address changes of each target host identifier within the current time window; A weighted calculation is performed on the direct participation score, the continuous participation score, and the address change score to obtain an initial trust degree of each target host identifier within the current time window.

[0008] In some embodiments, the first computing unit is further configured to: Determining a first weight of evidence factor for the direct participation scoring association, a second weight of evidence factor for the continuous participation scoring association, and a third weight of evidence factor for the address change scoring association; wherein the sum of the first weight of evidence factor, the second weight of evidence factor, and the third weight of evidence factor is 1; The direct participation score, the continuous participation score, and the address change score are weightedly calculated according to the first evidence weight factor, the second evidence weight factor, and the third evidence weight factor to obtain an initial trust level of each target host identifier within the current time window.

[0009] In some implementations, there are multiple historical time windows, and the second computing unit is further configured to: Determining a current trust weight factor corresponding to the current time window and a historical trust weight factor corresponding to each historical time window, wherein the historical trust weight factor decreases exponentially as the distance between the corresponding historical time window and the current time window increases; According to the current trust weight factor and each historical trust weight factor, weighted summing the initial trust degree of each target host identifier and the corresponding multiple historical trust degrees is performed to obtain a target total trust score corresponding to each target host identifier; A total trust weight coefficient is determined by combining the current trust weight factor and each historical trust weight factor, and a target trust degree of each target host identifier is determined based on a ratio between the target total trust score of each target host identifier and the total trust weight coefficient.

[0010] In some embodiments, the identification unit is further configured to: Comparing the target trust level of each target host identifier with the target trust level threshold to obtain a comparison result; Based on the comparison result, the target host identifier whose target trust degree is less than the target trust degree threshold is determined as a malicious host identifier.

[0011] In some embodiments, the malicious host detection apparatus further includes a penalty control unit configured to: Determining the number of consecutive penalties for each malicious host identifier in a plurality of the historical time windows, and determining a corresponding penalty parameter according to a difference between the number of the historical time windows and the number of consecutive penalties; Determining a target trust ratio between a target trust level of each malicious host identifier and the target trust level threshold, and determining a target trust loss ratio for each malicious host identifier based on the target trust ratio; Performing a power operation on the target trust loss ratio of each malicious host identifier by raising the corresponding penalty parameter to obtain a flow rate limit ratio for each malicious host identifier; The flow rate limit ratio of each malicious host identifier is sent to each network device, so that each network device limits the flow rate of each malicious host identifier according to the flow rate limit ratio of each malicious host identifier.

[0012] In some embodiments, the malicious host detection apparatus further includes a training unit configured to: Obtaining the sample target trust of each sample host identifier, the sample average trust among multiple sample host identifiers, the sample historical trust threshold, the number of sample malicious hosts, the change rate of the number of sample congestion events, and the sample average traffic rate limit ratio corresponding to the multiple sample host identifiers, the sample benign host identifiers and the sample malicious host identifiers among the multiple sample host identifiers; Constructing a sample state data set according to the sample average trust, the sample historical trust threshold, the sample number of malicious hosts, the change rate of the sample congestion event number, and the sample average traffic rate limit ratio, and determining a first number of samples of sample benign host identifiers and a second number of samples of sample malicious host identifiers among the multiple sample host identifiers; Inputting the sample status data set into a preset decision model to obtain a predicted trust threshold, and identifying a predicted malicious host identifier based on the predicted trust threshold and the sample target trust of each sample host identifier; Determining a balance score of detection precision and recall for the sample malicious host identifier, and a false positive rate for misjudging the sample benign host identifier as the predicted malicious host identifier, based on the predicted malicious host identifier, the sample benign host identifier, and the sample malicious host identifier; Determining a predicted average traffic rate limit ratio based on each predicted malicious host identifier and the sample target trust of each sample host identifier; Determining a target difference between the balance score and the false positive rate and the predicted average traffic rate limit ratio, and constructing a reward function based on the target difference as a variable, wherein the reward function takes maximizing the target difference as an optimization goal; In combination with the output value of the reward function and in accordance with the optimization objective, the model parameters of the preset decision model are adjusted to obtain the target decision model.

[0013] In addition, an embodiment of the present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the computer program, the above-mentioned malicious host detection method is implemented.

[0014] In addition, an embodiment of the present application also provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the above-mentioned malicious host detection method.

[0015] The embodiment of the present application obtains multiple access address change events and multiple congestion events within the current time window, each access address change event includes a target host identifier of a changed access address, and each congestion event includes a target host identifier participating in network link congestion; based on the multiple access address change events and the multiple congestion events, the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier are counted; based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier within the current time window, the initial trust of each target host identifier within the current time window is calculated; the historical trust corresponding to each target host identifier in the historical time window is obtained, and the target trust of each target host identifier is calculated based on the initial trust and the corresponding historical trust of each target host identifier; the current state data set is obtained, the state data set is input into a target decision model, and a target trust threshold is obtained; and malicious host identifiers are identified based on the target trust threshold and the target trust of each target host identifier.

[0016] From the above, we can first obtain multiple access address change events and multiple congestion events within the current time window, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier participating in the network link congestion. Then, based on the multiple access address change events and multiple congestion events, the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier are counted. In this way, multi-dimensional evidence data can be constructed as the basic data for calculating the trust of the target host identifier. Then, based on the multi-dimensional evidence data, the initial trust of each target host identifier in the current time window is calculated, and the initial trust of each target host identifier is calculated. The initial trust is combined with its historical trust in the historical time window to calculate the target trust of each target host identifier in the current time window. In this way, the historical trust in the historical time window and the initial trust of the current time window are combined to calculate the current target trust, so as to avoid the phenomenon that the malicious host participates in the network link congestion less times in the current time window and is misjudged as a benign host. Furthermore, the current state data set is obtained and input into the target decision model to determine the target trust threshold for the current time window. Finally, the target trust of each target host identifier is combined with the target trust threshold to identify the malicious host identifier. Therefore, compared with the related art that identifies malicious hosts through malicious traffic characteristics, which has a relatively low accuracy, the present application is directly based on the host trust mechanism, and calculates the initial trust through multiple dimensions such as the number of congestion participations, the number of access address changes, and the number of continuous congestion participations of each target host identifier corresponding to the network link congestion data. There is no need to detect malicious hosts by mining malicious traffic characteristics, and the trust situation of the historical time window is combined to calculate the final target trust of each target host identifier, so that the trust calculation of each host is more accurate, so that the malicious hosts can be punished for a long time, and the attacks of the malicious hosts on the network transmission links can be blocked subsequently, thereby improving the accuracy of identifying malicious hosts. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A schematic diagram of a malicious host detection system according to an embodiment of the present application; Figure 2 This is a diagram of the malicious host detection system architecture provided by an embodiment of the present application; Figure 3A schematic diagram of the steps of the malicious host detection method provided in an embodiment of the present application; Figure 4 This is an example diagram of a scenario in which host trust is updated based on a sliding window according to an embodiment of the present application; Figure 5 A schematic diagram of the structure of a malicious host detection device provided in an embodiment of the present application; Figure 6 A schematic diagram of the structure of a network device provided in an embodiment of the present application; Figure 7 A schematic diagram of the structure of the server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of this application.

[0020] It can be understood that in the specific implementation of the present application, network link congestion data, target host identification, access address, congestion participation times, access address change times, continuous participation times, historical trust, initial trust, target trust, and malicious host identification are involved. When the above embodiments of the present application are applied to specific products or technologies, it is necessary to obtain the object's permission or consent, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards.

[0021] In addition, when the embodiment of the present application needs to obtain relevant data, it will obtain separate permission or separate consent for relevant data such as network link congestion data, target host identification, access address, congestion participation times, access address change times, continuous participation times, historical trust, initial trust, target trust, and malicious host identification through pop-up windows or jumping to a confirmation page. After clearly obtaining separate permission or separate consent for relevant data such as network link congestion data, target host identification, access address, congestion participation times, access address change times, continuous participation times, historical trust, initial trust, target trust, and malicious host identification, the necessary data for enabling the embodiment of the present application to operate normally is obtained.

[0022] It should be noted that some processes described in the specification, claims, and figures above include multiple steps that appear in a specific order. However, it should be understood that these steps may be executed in a different order than the order in which they appear herein or in parallel. The step numbers are used solely to distinguish between the different steps and do not themselves represent any order of execution. Furthermore, terms such as "first," "second," or "target" are used herein to distinguish similar objects and are not necessarily used to describe a specific order or precedence.

[0023] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0024] The embodiments of the present application provide a malicious host detection method, apparatus, device, and medium. Specifically, the malicious host detection method of the embodiments of the present application can be implemented in a computer device, which can be a server or a network device. The server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The network device can be a network switch, router, firewall, bridge, hub, gateway, VPN server, wireless access point (WAP), modem, etc., but is not limited thereto.

[0025] A malicious host detection method provided in an embodiment of the present application can count the number of congestion participations, access address change times, and continuous participation times of each target host identifier based on multiple access address change events and multiple congestion events in the current time window, so as to construct multi-dimensional evidence data as basic data for trust calculation of the target host identifier, calculate the initial trust of each target host identifier in the current time window, and calculate the current target trust in combination with the historical trust in the historical time window and the initial trust in the current time window, so as to avoid the phenomenon that the malicious host is misjudged as a benign host due to the small number of times it participates in network link congestion in the current time window. Furthermore, the current state data set is obtained and the current state data set is input into the target decision model to determine the target trust threshold for the current time window. Finally, the target trust of each target host identifier is combined with the target trust threshold to identify the malicious host identifier. In this way, based on the host trust mechanism, the initial trust is calculated using multiple dimensions, including the number of congestion events, the number of access address changes, and the number of consecutive congestion events, for each target host ID corresponding to the network link congestion data. This eliminates the need to detect malicious hosts by mining malicious traffic characteristics. Furthermore, the trust situation over a historical time window is combined to calculate the final target trust for each target host ID, making the calculation of each host's trust more accurate. This allows for long-term punishment of malicious hosts and subsequent blocking of attacks on network transmission links by malicious hosts. For details, please refer to the following specific embodiments.

[0026] It should be noted that the malicious host detection method can be executed jointly by the network device and the server.

[0027] For example, taking the malicious host detection method performed by the network device and the server as an example, see Figure 1 , is a scenario diagram of a malicious host detection system provided in an embodiment of the present application, where the system includes multiple network devices 110 and a server 120.

[0028] Among them, the network device 110 can include two types of network devices located at the edge and intermediate network devices, depending on the actual scenario. For example, when accessing the local target host, the network device serves as an edge network device, and when serving as one of the transit points in the network transmission link, it can act as an intermediate network device. In addition, the network device can also directly act as a fixed type of role according to the transmission function. For example, some network devices always act as network devices at the access layer, while some network devices always act as intermediate network devices in the network transmission link. This is not limited here.

[0029] It should be noted that the network device 110 may be installed with a target application and may run corresponding application services through the target application. When acting as an edge network device at the access layer, the network device 110 may detect whether the access address of the target host within a target period has changed relative to the last historical access address. If a change is detected, an access address change event is generated and sent to the server 120. When the network device acts as an intermediate network device in a network transmission link, the network device may detect the length and transmission time efficiency of the data transmission queue. If the length of the data transmission queue is detected to be too large and the transmission delay is too long, it is determined that the current network transmission link is congested, and the target hosts involved in the network link congestion are identified to generate a congestion event, which is then sent to the server 120. The server 120 may be a single service node, a distributed system composed of multiple service nodes, or a single service node in a distributed system.

[0030] Among them, the server 120 executes the steps of the malicious host detection method, specifically, it can obtain multiple access address change events and multiple congestion events in the current time window, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier participating in the network link congestion; based on the multiple access address change events and multiple congestion events, the number of congestion participations, the number of access address changes and the number of consecutive participations of each target host identifier are counted; based on the number of congestion participations, the number of access address changes and the number of consecutive participations of each target host identifier in the current time window, the initial trust of each target host identifier in the current time window is calculated; the historical trust corresponding to each target host identifier in the historical time window is obtained, and the target trust of each target host identifier is calculated based on the initial trust and the corresponding historical trust of each target host identifier; the current state data set is obtained, and the state data set is input into the target decision model to obtain the target trust threshold; according to the target trust threshold and the target trust of each target host identifier, the malicious host identifier is identified. Thereafter, the server 120 may return the malicious host identifier to the network device 110 for punishment, so that the network device 110 limits the traffic rate of the malicious host and reduces the traffic of the malicious host, which is not limited here.

[0031] Figure 2 The malicious host detection system architecture diagram provided in the embodiment of the present application is combined with Figure 2 , the malicious host detection system architecture is introduced as follows: The malicious host detection system architecture includes host, access layer, core network, computing center, and server.

[0032] Among them, the host is a host that has passed the network authentication. The attacker mainly invades the host side to control the host to initiate low-speed traffic to the network transmission link, maliciously occupying the bandwidth and causing congestion of the network transmission link.

[0033] Among them, the access layer refers to the outermost layer of the host access network, which directly faces the host and can be understood as the edge network device, indicating the first layer of network devices directly facing the host. The access layer can include multiple first-layer network devices.

[0034] Among them, the core network refers to the network transmission link system composed of network equipment (such as switches).

[0035] Among them, the computing power center refers to the computing power service center, which can provide computing power support for the business services of any host or terminal device.

[0036] The server refers to a server for detecting malicious hosts, ie, the server 120 mentioned above.

[0037] Specifically, an attacker compromises a host and controls it to send low-speed traffic, causing congestion events on key network links in the core network's corresponding network transmission link system. Upon detecting each congestion event, the network device uploads network link congestion data, including the identifier of the target host involved in the congestion event, access address, and changed access destination address, to server 120 to update the observed variables. Based on the received network link congestion data (i.e., observed variables), server 120 constructs multidimensional trust evidence, which includes direct participation evidence (number of congestion participation events), behavioral consistency evidence (number of consecutive participation events), and direct change evidence (number of access address changes). Based on the multidimensional trust evidence, server 120 calculates the initial trustworthiness of each target host within the current time window. This is combined with the multiple historical trustworthinesses of each target host corresponding to multiple historical time windows within the sliding window, and weighted with the initial trustworthiness of each target host to obtain host trust, i.e., the target trustworthiness of each target host.

[0038] Furthermore, a dynamic target trust threshold is generated based on a deep reinforcement learning algorithm. Specifically, a state dataset can be constructed, including the average trust, the historical trust threshold for the previous historical time window, the rate of change in the number of congestion events, the number of malicious hosts in the previous historical time window, and the overall average penalty for the previous historical time window. This is used as input for deep reinforcement learning to obtain an action, namely the target trust threshold.

[0039] Finally, the target trust of each target host is compared with the target trust threshold to identify malicious hosts, e.g. Figure 2As shown, the target trust of host H1 and host H4 is lower than the target trust threshold, then host H1 and host H4 are determined to be malicious hosts. Finally, by punishing the malicious host H1 and malicious host H4, the traffic rate of the malicious host H1 and malicious host H4 is limited specifically at the access layer.

[0040] In this way, multiple access address change events and multiple congestion events within the current time window can be obtained first, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier participating in the network link congestion. Then, based on the multiple access address change events and multiple congestion events, the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier are counted. In this way, multi-dimensional evidence data can be constructed as the basic data for calculating the trust of the target host identifier. Then, the initial trust of each target host identifier in the current time window is calculated based on the multi-dimensional evidence data, and the initial trust of each target host identifier is calculated. The trust degree is combined with its historical trust degree in the historical time window to calculate the target trust degree of each target host identifier in the current time window. In this way, the historical trust degree in the historical time window and the initial trust degree of the current time window are combined to calculate the current target trust degree, thereby avoiding the phenomenon that a malicious host participates in network link congestion less times in the current time window and is misjudged as a benign host. Furthermore, the current state data set is obtained and input into the target decision model to determine the target trust degree threshold for the current time window. Finally, the target trust degree and the target trust threshold of each target host identifier are combined to identify the malicious host identifier. Therefore, compared with the related art that identifies malicious hosts through malicious traffic characteristics, which has a relatively low accuracy, the present application is directly based on the host trust mechanism, and calculates the initial trust through multiple dimensions such as the number of congestion participations, the number of access address changes, and the number of continuous congestion participations of each target host identifier corresponding to the network link congestion data. There is no need to detect malicious hosts by mining malicious traffic characteristics, and the trust situation of the historical time window is combined to calculate the final target trust of each target host identifier, so that the trust calculation of each host is more accurate, so that the malicious hosts can be punished for a long time, and the attacks of the malicious hosts on the network transmission links can be blocked subsequently, thereby improving the accuracy of identifying malicious hosts.

[0041] For ease of understanding, each step of the malicious host detection method will be described in detail below. It should be noted that the order of the following embodiments is not intended to limit the preferred order of the embodiments.

[0042] See also Figure 3 , Figure 3This is a flowchart of the steps of the malicious host detection method provided in an embodiment of the present application. In an embodiment of the present application, the malicious host detection method can be executed by a computer device, such as a server. The specific process is as follows: 101. Acquire multiple access address change events and multiple congestion events within a current time window.

[0043] In computing network systems, the expansion of service types and service targets has led to an increasingly widespread and numerous distribution of computing nodes. Consequently, computing network services involve more network transmission links, increasing the risk of malicious attacks on these links. For example, attackers could compromise multiple authenticated hosts within the network and coordinate attacks against transmission links, maliciously occupying the network bandwidth resources of these links. This could cause congestion on previously healthy network transmission links, preventing users from accessing the computing services provided by the computing network system. Therefore, it is necessary to identify malicious hosts that cause network transmission link congestion.

[0044] Related technologies generally identify malicious hosts by monitoring malicious traffic. However, this method relies on mining relevant features of malicious traffic. In transmission link attacks, benign traffic and malicious traffic are similar. This method is more difficult to mine the traffic feature differences between benign traffic and malicious traffic, and thus it is difficult to distinguish between benign traffic and malicious traffic. Therefore, the accuracy of identifying malicious hosts is reduced. As a result, this method can only temporarily postpone the congestion of network transmission links and cannot completely block the attacks of malicious hosts.

[0045] It should be noted that when attackers attack network transmission links, they generally use link flooding attacks. Link flooding attacks are a typical dynamic and covert attack. They select key network links (i.e., a specific network transmission link) in a rolling manner, selecting a different key network link each time to continuously switch between different key network links. For each key network link, different malicious hosts can be controlled to initiate low-speed traffic to block the link to achieve the attack purpose. For example, in a malicious host attack scenario, the attacker controls some low-security terminals in the network (i.e., hosts, which act as malicious hosts) and initiates low-speed traffic to the surrounding servers surrounding the computing center. Because the route from the host to the surrounding servers passes through the key network link, the traffic sent by the attacker through the malicious host is aggregated on the key network link, causing congestion on the key network link.

[0046] In order to address the above problems, an embodiment of the present application counts the number of congestion participations, access address changes and continuous participations of each target host identifier based on the target host identifier participating in the network link congestion corresponding to each congestion event in the current time window and the target host identifier of the changed access address corresponding to each access address change event, so as to construct multi-dimensional evidence data as the basic data for calculating the trust of the target host identifier, so as to calculate the initial trust of each target host identifier in the current time window, and calculate the current target trust in combination with the historical trust in the historical time window and the initial trust in the current time window, so as to avoid the phenomenon that a malicious host is misjudged as a benign host due to the small number of times it participates in the network link congestion in the current time window. Furthermore, the current state data set is obtained, and the current state data set is input into the target decision model to determine the target trust threshold for the current time window. Finally, the target trust of each target host identifier and the target trust threshold are combined to identify the malicious host identifier. In this way, based on the host trust mechanism, the initial trust is calculated through multiple dimensions such as the number of congestion participations, the number of access address changes, and the number of continuous congestion participations of each target host identifier in the current time window. There is no need to detect malicious hosts by mining malicious traffic characteristics, and the trust situation of the historical time window is combined to calculate the final target trust of each target host identifier, making the calculation of the trust of each host more accurate, so that malicious hosts can be punished for a long time, and subsequently blocking malicious hosts from attacking network transmission links.

[0047] Specifically, in order to identify malicious hosts with low security and controlled by attackers from multiple hosts that have passed authentication, the embodiment of the present application obtains multiple access address change events and multiple congestion events within the current time window, so as to subsequently identify malicious hosts based on the host trust mechanism. For example, the target host identifier participating in the network link congestion corresponding to each congestion event within the current time window and the target host identifier of the changed access address corresponding to each access address change event can be combined to construct multi-dimensional host trust evidence for each target host, so as to calculate the trust of each target host, and thus identify malicious hosts based on the trust.

[0048] The time window can be a window used to represent the number of attack events. The time window limits the number of attack events, that is, the size of each time window represents the number of attack events it accommodates. For example, assuming that a time window is based on 10 attack events, then since the end of the previous historical time window, a cumulative total of 10 attack events represents a time window. Based on the 10 access address change events corresponding to the 10 attack events within the time window, the host participation information regarding the number of access address changes within the time window is counted. It should be noted that an attack event refers to an event when a network device detects that a target host has changed its access address, that is, there are one or more at a certain moment. It should be noted that each attack event can be uploaded to the server by the first network device that directly connects to the corresponding target host, and the congestion event can be uploaded to the server by one of the intermediate network devices that constitute the network transmission link. Each attack event does not necessarily cause a congestion event in the network transmission link. In order to associate the congestion event with the time window, it can be determined that when the number of attack events in the current time window reaches the event length specified by the current time window, the first time information of the first attack event in the current time window and the second time information of the last attack event in the current time window are determined. The target time range corresponding to the current time window is determined in combination with the first time information and the second event information, and a mapping relationship is established between the received congestion events within the target time range and the current time window, so as to subsequently construct multi-dimensional host trust evidence in combination with multiple attack events in the current time window and the congestion events mapped by the current time window.

[0049] In addition, the time window can also be a window used to limit a time range. For example, the time window is 1 minute in length, which can specifically correspond to a time range. For example, the time range from xx:00 to xx:01 is limited. Through this time window, the attack events uploaded by each network device within the corresponding time range and the congestion events uploaded by each network device are collected and counted, so as to combine one or more attack events and one or more congestion events within the current time window to construct multi-dimensional host trust evidence.

[0050] It should be noted that each access address change event is uploaded by one of the network devices in the network link system, and each congestion event is uploaded by one of the network devices in the network link system. The network device can be a switch, router, firewall, bridge, hub, gateway, VPN server, wireless access point (WAP), or modem, without limitation.

[0051] In some implementations, step 101 may include: obtaining multiple event information uploaded by multiple network devices, the multiple event information including multiple access address change events and multiple congestion events; and determining multiple target event information within the current time window based on the multiple event information.

[0052] Each access address change event and each congestion event can be understood as host participation information. Each access address change event contains the target host identifier of the changed access address, and each congestion event contains the target host identifier of the network link congestion. In addition, the access time information of each target host identifier can also be recorded. In addition, the access time information can be specific to the time information of "xx year xx month xx day xx hour xx minute xx second".

[0053] Among them, the target host identifier can be the unique identifier of the target host, the Internet Protocol address (IP), the physical address of the target host (such as world coordinates, longitude and latitude, street number, etc.), etc., which is not limited here and is used to identify the identity of the target host to distinguish different hosts.

[0054] It should be noted that a congestion event represents a congestion in a network transmission link. Specifically, when a network device is transmitting traffic data, it can manage the traffic data of each host using a data transmission queue to ensure that the traffic data of each host is transmitted in order to ensure fairness. Based on this, the network device can detect the length of the data transmission queue in real time, that is, detect the amount of traffic data waiting to be transmitted, and detect the transmission delay of each traffic data in the data transmission queue. When the length of the data transmission queue is greater than the preset length threshold or the transmission delay is greater than the preset delay threshold, it is determined that the network transmission link corresponding to the network device is in a congested state. At this time, the identifiers, access times, etc. of each target host that causes the network transmission link to be in a congested state are obtained to generate a congestion event. Therefore, the congestion event is triggered based on the length and transmission delay of the data transmission queue corresponding to the network device.

[0055] It should be noted that the network device can detect whether the access address of each target host within the target time period has changed compared with the last historical access address. If a change is detected, the target host identifier of the target host that changed the access address within the target time period (for example, 10 seconds) is obtained, and an access address change event is generated. Therefore, each access address change event is generated based on the target host identifier that participated in the access address change within the target time period.

[0056] In addition, the network device can also directly send the access address of each target host identifier within the target time period to the server. The server detects whether the access address of each target host within the target time period has changed relative to the previous historical access address. If a change is detected, the target host identifier of the target host whose access address has been changed within the target time period is obtained, and an access address change event is generated. Specifically, the server determines the access timing relationship of the multiple access addresses corresponding to each target host identifier according to the reception time sequence between the multiple access addresses of each target host identifier, and for each target host identifier, compares any two adjacent access addresses according to the access timing relationship to obtain a comparison result, and determines the number of access address changes corresponding to each target host identifier based on the comparison result. The access address can be the address of the business service that the corresponding target host wants to access when the network transmission link is congested. For example, the access address can specifically be the Internet Protocol address (IP) of the business service.

[0057] Through the above method, multiple access address change events and multiple congestion events within the current time window can be obtained, so that the multiple access address change events and multiple congestion events within a specific time window can be combined to construct multi-dimensional host trust evidence data, calculate the trust of each target host, and identify malicious hosts based on the host trust mechanism.

[0058] 102. Based on the multiple access address change events and the multiple congestion events, count the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier.

[0059] In an embodiment of the present application, after obtaining multiple access address change events and multiple congestion events within the current time window, multi-dimensional host trust evidence is constructed based on the current time window, in combination with the target host identifier participating in the network link congestion corresponding to each congestion event within the current time window and the target host identifier of the changed access address corresponding to each access address change event. For example, the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier are counted. In this way, multi-dimensional host trust evidence representing the host's participation in the network transmission link congestion is obtained, so that the initial trust degree corresponding to each target host identifier can be calculated based on the multi-dimensional host trust evidence. In this way, malicious hosts can be identified without mining the traffic characteristics of each host, thereby improving the accuracy of subsequent identification of malicious hosts.

[0060] The congestion participation count may be the number of times the corresponding target host participates in multiple congestion events within the current time window. For example, in a congestion event, if the target host requests to access the corresponding service address through the corresponding network transmission link, it indicates participation in the congestion event. At this time, the congestion participation count of the target host identifier is accumulated by 1. If the target host has no access request in this congestion event, it indicates non-participation in this congestion event. At this time, the congestion non-participation count of the target host identifier is accumulated by 1. Since the current time window includes the target number of congestion events, if a target host accesses the corresponding service address through the corresponding network transmission link in a congestion event, the congestion participation count is accumulated by 1. The congestion participation count corresponding to each target host identifier is then counted based on multiple congestion events.

[0061] It should be noted that in a link flooding attack, the attacker launches rolling attacks on different key network links by controlling the host. Although a network transmission link is selected for attack during each congestion event, and the network transmission link involves some benign hosts, the number of congestion events in which benign hosts participate is relatively small compared to malicious hosts. Therefore, the number of times a host participates in a congestion event can be used as one of the trust evidences to evaluate the host's trustworthiness.

[0062] Among them, the number of access address changes can be the number of times the corresponding target host changes the access address in multiple access address change events within the current time window. The access address change can be understood as the target host's current destination address for accessing the service being different from the historical destination address of the last access. For example, if the target host accessed the A service destination address in the last access address change event and accessed the B service destination address in this access address change event, it means that there is an action of changing the access address. At this time, the number of access address changes is cumulatively added by 1. Since the current time window contains the target number of access address change events, if the access address of a target host in this access address change event is different from the access address of the last access address change event, the number of access address changes is cumulatively added by 1. In this way, the number of access address changes corresponding to each target host identifier is counted based on multiple access address change events in the current time window.

[0063] It's important to note that in a link flooding attack, attackers manipulate hosts to launch rolling attacks on different critical network links. Therefore, it's generally necessary for the controlled hosts to frequently change the destination address of the target server to ensure that the attack traffic reaches the desired network transmission link. Unlike malicious hosts, benign hosts generally don't easily change their destination servers to ensure service continuity. Therefore, if a target host frequently changes its destination address when sending traffic, it's likely malicious. Therefore, the number of address changes serves as one piece of evidence in assessing a host's trustworthiness.

[0064] The number of consecutive participations may be the number of consecutive participations of the corresponding target host in congestion events within the current time window. For example, assuming that a time window is a unit of 10 congestion events, and a target host continuously participates in congestion events from the 1st to the 4th, and continuously participates in congestion events from the 6th to the 8th, then the number of consecutive parameters is 2, the length of the first consecutive participation is 4 congestion events, and the length of the second consecutive participation is 3 congestion events.

[0065] It should be noted that the number of hosts an attacker can control is limited, and some hosts may be reused as malicious hosts to launch low-traffic attacks on network transmission links. Therefore, if a target host has participated in a high number of consecutive congestion events, it is likely a malicious host. Therefore, the number of consecutive participations serves as one of the trust evidences used to assess the host's trustworthiness. Each congestion event corresponds to the target host ID that participated in the network link congestion, and each access address change event corresponds to the target host ID that changed the access address.

[0066] In some embodiments, a multi-dimensional trust evidence is constructed for multiple access address change events and multiple congestion events within the current time window. For example, statistics are performed based on the target host identifiers participating in the network link congestion contained in each congestion event and the target host identifiers of the changed access addresses corresponding to each access address change event. Specifically, first, based on the target host identifiers participating in the network link congestion contained in each congestion event, the number of congestion participations of each target host identifier is counted; at the same time, based on the target host identifiers participating in the network link congestion contained in each congestion event within the current time window, the number of consecutive participations of each target host identifier in the congestion event within the current time window is counted; in addition, based on the target host identifiers of the changed access addresses corresponding to each access address change event within the current time window, the number of access address changes of each target host identifier within the current time window is counted. In this way, a multi-dimensional host trust evidence for evaluating the trustworthiness of the target host is constructed based on the participation information of each host in the current time window, so that the initial trustworthiness of the target host can be calculated based on the multi-dimensional host trust evidence.

[0067] Through the above method, the target host identifier participating in the network link congestion corresponding to each congestion event in the current time window and the target host identifier of the changed access address corresponding to each access address change event can be combined to construct multi-dimensional host trust evidence. For example, the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier are counted. In this way, multi-dimensional host trust evidence representing the host's participation in the network transmission link congestion is obtained, so that the initial trust degree corresponding to each target host identifier can be calculated based on the multi-dimensional host trust evidence. In this way, malicious hosts can be identified without mining the traffic characteristics of each host, thereby improving the accuracy of subsequent identification of malicious hosts.

[0068] 103. Calculate the initial trust of each target host identifier in the current time window based on the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier in the current time window.

[0069] In an embodiment of the present application, after constructing the three-dimensional host trust evidence of the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier, the initial trust of each target host identifier in the current time window can be calculated by combining the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier in the current time window. Specifically, the direct participation score of the corresponding target host can be calculated based on the number of congestion participations, the continuous participation score of the corresponding target host can be calculated based on the number of continuous participations, and the address change score of the corresponding target host can be calculated based on the number of access address changes. Then, the initial trust of each target host can be determined by combining the direct participation score, the continuous participation score, and the address change score. In this way, the initial trust corresponding to each target host identifier is calculated by constructing the multi-dimensional host trust evidence, so that malicious hosts can be identified based on the trust. In this way, malicious hosts can be identified without mining the traffic characteristics of each host, thereby improving the accuracy of subsequent identification of malicious hosts.

[0070] Among them, the initial trust degree can be a host trust value reflecting the corresponding target host in the current time window, which is determined according to the situation of the corresponding target host participating in the congestion event in the current time window. For example, it is comprehensively determined based on the number of congestion participations, the number of access address changes, and the number of continuous participations of the target host in the congestion event in the current time window, that is, the trust degree of the target host is evaluated based on the situation of the target host participating in the congestion event in the current time window. The initial trust degree can be understood as a trust value indicating that the corresponding target host belongs to the benign host category.

[0071] In some implementations, a direct participation score can be calculated based on the number of congestion participations of each target host identifier, a continuous participation score can be calculated based on the number of continuous participations of each target host identifier, and an address change score can be calculated based on the number of access address changes of each target host identifier. The direct participation score, continuous participation score, and address change score are weighted to obtain the initial trust level corresponding to each target host identifier in the current time window. For example, step 103 can include: (103.1) determining a direct participation score for each target host identifier based on the number of congestion participations of each target host identifier within the current time window; (103.2) Calculating a continuous participation score based on the number of continuous participations of each target host identifier within the current time window; (103.3) Calculate an address change score based on the number of access address changes for each target host identifier within the current time window; (103.4) Perform weighted calculation on the direct participation score, continuous participation score, and address change score to obtain the initial trust level of each target host identifier within the current time window.

[0072] Among them, the direct participation score can be a sub-trust score that represents the number of congestion participations of the corresponding target host identifier in the congestion event within the current time window. If a target host participates in the congestion event more times within the current time window, the smaller the direct participation score is, the greater the probability of being judged as a malicious host, and the less likely it is to be trusted. Exemplarily, the Beta distribution is used to calculate the number of direct participations of the target host in the congestion event to calculate the direct participation score as one of the direct participation evidences in the multi-dimensional host trust evidence. Since it is impossible to confirm whether the host is a malicious host at the initial moment, the uniform distribution is used as the initial distribution of the direct participation evidence. The calculation process of the direct participation score of each target host identifier in the current time window is as follows:

[0073] in, Indicates the corresponding target host In the current time window Direct participation in scoring, Represents the target host The number of times not participating in congestion events in the current time window, Represents the host The number of times a device participates in a congestion event in the current time window, that is, the number of congestion participations.

[0074] The continuous participation score can be a sub-trust score representing the number of consecutive participations of the corresponding target host identifier in congestion events within the current time window. The more times a target host continuously participates in congestion events within the current time window, the smaller the continuous participation score, the greater the probability of being judged as a malicious host, and the lower the possibility of being trusted, that is, the trustworthiness of the target host is relatively low. For example, the calculation process of the continuous participation score of each target host identifier in the current time window is as follows:

[0075] in, Indicates the corresponding target host In the current time window Continuous participation rating within Indicates the target host The number of consecutive sequences of participation in congestion events within the current time window, i.e., the number of consecutive participations, Indicates the target host The length of the continuous sequence of congestion events in the current time window, that is, how many congestion events have been participated in continuously without interruption.

[0076] Among them, the address change score can be a sub-trust score representing the number of address changes of the corresponding target host identifier in the current time window for the access address change event. If a target host changes its access address more times in the current time window, the address change score will be smaller, and the probability of being judged as a malicious host will be greater, indicating that the possibility of being trusted is smaller, that is, the trustworthiness of the target host is relatively low.

[0077] The statistics of the number of access address changes for each target host ID within the current time window are as follows:

[0078] in, Indicates the corresponding target host The number of access address changes within the current time window, Indicates the number of access address change events contained in the current time window. Can be a two-dimensional array, Indicates the Target host in access address change event Whether the user participated in the current visit address change event. If the user participated in the current visit address change event, the value is 1; otherwise, the value is 0.

[0079] Furthermore, the address change score is calculated as follows:

[0080] in, Indicates the corresponding target host In the current time window Address change score within Indicates the corresponding target host The number of access address changes within the current time window.

[0081] Finally, a weighted calculation is performed on the direct participation score, continuous participation score, and address change score to obtain the initial trust level of each target host identifier within the current time window. This initial trust level is calculated for each target host identifier using the constructed multi-dimensional host trust evidence, allowing for subsequent malicious host identification based on trust level. This eliminates the need to mine each host's traffic characteristics to identify malicious hosts, improving the accuracy of subsequent malicious host identification.

[0082] In some embodiments, different evidence weighting factors may be assigned to the direct participation score, the continuous participation score, and the address change score, respectively, and weighted calculations may be performed on the direct participation score, the continuous participation score, and the address change score according to the different evidence weighting factors to obtain the initial trust level of each target host identifier within the current time window. For example, step (103.4) may include: determining a first evidence weighting factor associated with the direct participation score, a second evidence weighting factor associated with the continuous participation score, and a third evidence weighting factor associated with the address change score; wherein the sum of the first evidence weighting factor, the second evidence weighting factor, and the third evidence weighting factor is 1; and performing a weighted calculation on the direct participation score, the continuous participation score, and the address change score according to the first evidence weighting factor, the second evidence weighting factor, and the third evidence weighting factor to obtain the initial trust level of each target host identifier within the current time window.

[0083] Among them, the first evidence weight factor is used to measure the importance of the direct participation score in the process of identifying malicious hosts. The larger the first evidence weight factor, the greater the proportion of the direct participation score in calculating the initial trust of the corresponding target host identifier, indicating that in the process of identifying malicious hosts, the number of times the host participates in congestion events, as evidence of host trust, needs to be considered more.

[0084] Among them, the second evidence weight factor is used to measure the importance of the continuous participation score in the process of identifying malicious hosts. The larger the second evidence weight factor, the greater the proportion of the continuous participation score in calculating the initial trust of the corresponding target host identifier, indicating that in the process of identifying malicious hosts, the number of consecutive participations in congestion events, as host trust evidence, needs to be considered more.

[0085] Among them, the third evidence weight factor is used to measure the importance of the address change score in the process of identifying malicious hosts. The larger the third evidence weight factor, the greater the proportion of the address change score in calculating the initial trust of the corresponding target host identifier, indicating that in the process of identifying malicious hosts, it is necessary to consider the number of access address changes in congestion events as host trust evidence more.

[0086] Specifically, first determine the first evidence weighting factor associated with the direct participation score, the second evidence weighting factor associated with the continuous participation score, and the third evidence weighting factor associated with the address change score. For example, if the number of direct participations in congestion events is considered more important when identifying malicious hosts, the first evidence weighting factor can be increased. If it is necessary to balance short-term participation in congestion events with long-term participation in congestion events, the first evidence weighting factor can be set to a corresponding value to ensure that the impact of the number of direct participations is moderate. Secondly, if malicious hosts in link flooding attacks are more likely to participate repeatedly, the second evidence weighting factor can be increased to make continuous participation have a greater impact on trust. Thirdly, if the attack relies on frequently changing access destinations to hide its identity, the third evidence weighting factor can be increased to highlight the role of the address change score. In this way, the first, second, and third evidence weighting factors are set respectively, and the sum of the first, second, and third evidence weighting factors is 1. This ensures that the subsequent weighted calculation of the multi-dimensional score is standardized, explainable, and practical. Furthermore, the direct participation score is multiplied by the first evidence weighting factor to obtain a first sub-score, the continuous participation score is multiplied by the second evidence weighting factor to obtain a second sub-score, and the address change score is multiplied by the third evidence weighting factor to obtain a third sub-score. The first, second, and third sub-scores are then added together to obtain the initial trust level for each target host identifier within the current time window. In this way, the initial trust level corresponding to each target host identifier is calculated using the constructed multi-dimensional host trust evidence, allowing for subsequent malicious host identification based on trust level. This eliminates the need to mine each host's traffic characteristics to identify malicious hosts, improving the accuracy of subsequent malicious host identification.

[0087] For example, the initial trust of each target host in the current time window is calculated by combining the three dimensions of direct participation score, continuous participation score, and address change score. The calculation process of the initial trust of each target host in the current time window is as follows:

[0088] in, Indicates the corresponding target host In the current time window Initial trust within represents the first evidence weight factor, represents the second evidence weight factor, In this way, the initial trust of each target host in the current time window is obtained.

[0089] Through the above method, the congestion participation times, access address change times and continuous participation times of each target host identifier in the current time window can be combined to calculate the initial trust of each target host identifier in the current time window, so as to calculate the initial trust corresponding to each target host identifier based on the constructed multi-dimensional host trust evidence, so as to subsequently identify malicious hosts based on the trust. In this way, malicious hosts can be identified without mining the traffic characteristics of each host, thereby improving the accuracy of subsequent identification of malicious hosts.

[0090] 104. Obtain the historical trust degree corresponding to each target host identifier in the historical time window, and calculate the target trust degree of each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree.

[0091] In the embodiment of the present application, since the initial trust is only used to evaluate the participation of each target host in the congestion event within the current time window, when the number of times a malicious host participates in the congestion event within the current time window is small, if only the participation of each host within the current time window is considered to identify the malicious host, the original malicious host will be misjudged as a benign host, thereby increasing the risk of the malicious host attacking the network transmission link again in large numbers, which is not conducive to the security and stability of the subsequent network transmission link. Therefore, after obtaining the initial trust corresponding to each target host identifier, the historical trust corresponding to each target host identifier in the historical time window can be obtained, and the target trust of each target host identifier can be calculated by combining the initial trust of each target host identifier with the corresponding historical trust. In this way, the final target trust of each target host identifier is determined by combining the initial trust of each target host identifier in the current time window and the historical trust of each target host in the historical time window, avoiding the phenomenon that malicious hosts are misjudged as benign hosts due to the number of times they participate in congestion events in the current time window, improving the subsequent accuracy of identifying malicious hosts, thereby avoiding the risk of malicious hosts attacking network transmission links in large numbers again, and improving the security and stability of subsequent network transmission links.

[0092] The historical time window may be a historical time window preceding the current time window. Specifically, the historical time window may be a target historical time window within a sliding window preceding the current time window. The sliding window may accommodate multiple target historical time windows. A weighted calculation is then performed based on the initial trustworthiness of each target host identifier and the multiple historical trustworthinesses corresponding to the multiple historical time windows within the sliding window. For an explanation of the historical time window, please refer to the previous description of the "current time window" and will not be repeated here.

[0093] Among them, the historical trust can be the historical target trust of the corresponding target host in the corresponding historical time window, that is, the final trust. Each historical time window corresponds to a historical trust, and the historical trust is calculated by combining the historical initial trust calculated by the congestion event participation of the corresponding historical time window and the historical trust of the previous earlier historical time window. For example, starting from the current time window, the historical time window closest to and adjacent to the current time window is defined as the first historical time window, and then the second historical event window, the third historical time window, and the fourth historical time window are defined, and so on. After calculating the historical initial trust of each target host identifier based on the historical host participation information in the first historical time window, the historical trust of the corresponding target host identifier in the second historical event window, the historical trust of the corresponding target host identifier in the third historical time window, and the historical trust of the corresponding target host identifier in the fourth historical time window can be combined with the historical initial trust to calculate the historical trust of each target host identifier in the first historical time window. It should be noted that the calculation method of the historical trust degree of the second historical event window, the historical trust degree of the third historical time window, and the historical trust degree of the fourth historical time window can refer to the calculation process of the historical trust degree of each target host identifier in the first historical time window, and they are not listed one by one here.

[0094] In the embodiment of the present application, since the malicious hosts used in each congestion event may be different, some malicious hosts participate less in congestion events in certain time windows, resulting in an increase in their trust evaluation and misjudgment as benign hosts. Therefore, to avoid blindly increasing host trust, a sliding window mechanism is introduced, taking into account historical evaluation conditions, and a trust weight for the historical time window is designed. By combining the weight of the historical time window and the weight of the current event window, the initial trust of each target host identifier and the corresponding historical trust are calculated to obtain the target trust of each target host identifier. This improves the accuracy of identifying malicious hosts.

[0095] In some embodiments, a current trust weight factor corresponding to the current time window and a historical trust weight factor corresponding to the historical time window can be determined respectively, and the initial trust of each target host identifier and the corresponding historical trust can be weightedly calculated in combination with the current trust weight factor and each historical trust weight factor to obtain a target trust for each target host identifier. For example, if there are multiple historical time windows, the "calculating the target trust for each target host identifier based on the initial trust of each target host identifier and the corresponding historical trust" in step 104 can include: determining the current trust weight factor corresponding to the current time window and the historical trust weight factor corresponding to each historical time window, the historical trust weight factor decreasing exponentially as the distance between the corresponding historical time window and the current time window increases; performing a weighted summation of the initial trust of each target host identifier and the corresponding multiple historical trusts according to the current trust weight factor and each historical trust weight factor to obtain a target total trust score corresponding to each target host identifier; determining a total trust weight coefficient in combination with the current trust weight factor and each historical trust weight factor, and determining the target trust for each target host identifier based on the ratio between the target total trust score of each target host identifier and the total trust weight coefficient.

[0096] The current trust weight factor can be used to perform a weighted calculation with the target trust of the corresponding target host identifier to participate in the calculation of the target trust of each target host within the current time window. The larger the current trust weight factor, the more importance is placed on the initial trust expressed by each target host in the current time window. It should be noted that the current time window corresponds to the most recent behavioral data of each target host participating in the congestion event. Since the current behavior best reflects the real-time status of the target host, the current time window can be assigned the highest trust weight factor.

[0097] The historical trust weight factor can be a weight factor for a corresponding historical time window, which is used to perform a weighted calculation with the historical trust of the corresponding target host in the corresponding historical time window to participate in the calculation of the target trust of each target host in the current time window. It should be noted that, starting from the current time window, the historical trust weight factor of each historical time window decreases exponentially as the distance between windows increases. This means that the "historical trust" of historical time windows with longer distances has less impact on the calculation of the "target trust" of the current time window, which conforms to the logic of "recent behavior is more critical."

[0098] Specifically, to determine the current trust weight factor corresponding to the current time window, the current trust weight factor can be set to 1, and the historical trust weight factor corresponding to each historical time window is calculated as follows:

[0099] in, Indicates the corresponding target host The i-th historical time window in the sliding window The historical trust weight factor within Represents the historical time window before the current time window in the sliding window, Represents the current time window, Represents the historical time window within the sliding window The historical trustworthiness of the host, Indicates the first The historical trust threshold under the historical time window, It indicates the recovery parameters. It should be noted that On the one hand, if in the historical time window The historical trust of a host under the condition is lower than the corresponding historical trust threshold, and the recovery parameter is , so that The historical trust weight factor of the historical time window is relatively large to avoid the host's final target trust level from blindly increasing. On the other hand, if The historical trust of a host in a historical time window is higher than the corresponding historical trust threshold, and the recovery parameter is , so that The historical trust weight factors of the historical time window are normal.

[0100] Furthermore, after determining the current trust weight factor corresponding to the current time window and the historical trust weight factor corresponding to each historical time window, the initial trust of each target host identifier and the corresponding multiple historical trusts are weighted and summed according to the current trust weight factor and each historical trust weight factor to obtain the target total trust score corresponding to each target host identifier; finally, the current trust weight factor and each historical trust weight factor are added together to obtain the total trust weight coefficient, and the target total trust score of each target host identifier is divided by the total trust weight coefficient to obtain the target trust of each target host identifier. Exemplarily, the calculation process of the target trust of each target host identifier in the current time window is as follows:

[0101] in, Indicates the corresponding target host The i-th historical time window in the sliding window Internal target trust, Represents the size of the sliding window, that is, the number of historical time windows included. Represents the i-th historical time window in the sliding window. Represents a historical time window The historical trust weight factor of Represents a historical time window The historical trustworthiness of the host. Represents the corresponding target host of the current time window initial trust.

[0102] Figure 4 This is an example diagram of a scenario in which the host trust is updated based on a sliding window according to an embodiment of the present application. Figure 4 As shown in the figure, the scenario of changing the host trust in the sliding window is introduced as follows: In the current time window, multiple network devices simultaneously report destination address changes M times, indicating that M destination address change events have occurred in the current time window. Multiple network devices upload N congestion events, indicating that n network transmission link congestions have occurred in the current time window. Each congestion event contains the target host identifier involved in the network link congestion, and each access address change event contains the target host identifier of the changed access address. For example, taking the first congestion event as an example, the sequence of target host identifiers involved in the congestion event is: Figure 4 In the example of "IE1", for example, taking the first access address change event as an example, the sequence of the target host identifier of the changed access address is included, namely Figure 4 In the example, "CE1" indicates that host 2 (IP2) and host 4 (IP4) participated in the first congestion event, and "CE1" indicates that host 2 (IP2) participated in a change in the access destination address. It should be noted that the network device can also directly upload each host's access address to the server, allowing the server to determine whether an access address change event has occurred for each host based on the access address. Based on this data, multi-dimensional trust evidence is constructed for host 1, host 2, host 3, ..., host n, namely the number of congestion events, the number of consecutive events, and the number of access address changes, to calculate the initial trust level of each host.

[0103] Furthermore, through the sliding window, four historical time windows before the current time window are selected, namely Ti, Ti-1, Ti-2, and Ti-3, and the historical trust of each host in each historical time window is determined. Finally, for each host, a weighted calculation is performed based on the weight factor corresponding to each historical time window and the corresponding historical trust to obtain the final target trust of each host in the current time window.

[0104] Through the above method, the final target trust of each target host identifier can be determined by combining the initial trust of each target host identifier in the current time window and the historical trust of each target host in the historical time window, thereby avoiding the phenomenon that malicious hosts are misjudged as benign hosts due to the number of times they participate in congestion events in the current time window, improving the subsequent identification accuracy of malicious hosts, thereby avoiding the risk of malicious hosts attacking network transmission links in large numbers again, and improving the security and stability of subsequent network transmission links.

[0105] 105. Obtain a current state data set, input the state data set into a target decision model, and obtain a target confidence threshold.

[0106] In this embodiment of the present application, after obtaining the target trust level corresponding to each target host identifier within the current time window, a reinforcement learning algorithm can be used to calculate a current target trust level threshold in order to identify malicious hosts. This target trust level threshold is then used for comparison and identification of malicious hosts. This allows for a subsequent implementation based on a host trust level mechanism, where malicious hosts are identified based on the target trust level of each target host identifier within the current time window, thereby improving the accuracy of subsequent malicious host identification.

[0107] The target trust threshold is used to determine malicious hosts within the current time window. Specifically, it is used to compare with the target trust of the corresponding target host identifier to identify malicious hosts. It should be noted that different time windows correspond to different trust thresholds, and each historical time window corresponds to a historical trust threshold.

[0108] The current state data set may be state data describing the current network environment characteristics and the target host's participation behavior characteristics within the current time window, which may include the average trust of all target hosts within the current time window. , the historical target trust threshold of the previous historical time window , the number of malicious hosts detected in the previous historical time window , the degree of change between the congestion events in the current time window and the congestion events in the previous time window , and the average penalty level of all target hosts in the previous time window .

[0109] Specifically, the process of obtaining the current state data set is as follows: First, the average trust is calculated based on the target trust of each target host identifier. ; Get the number of historical congestion events in the previous historical time window , and get the current number of congestion events in the current time window , determine the ratio between the number of historical congestion events and the number of current congestion events, and subtract the constant value 1 to obtain the degree of change , specifically expressed as follows:

[0110] Then, the penalty level for each target host is determined. This penalty level can be understood as the traffic rate limit ratio for the malicious host. The specific calculation process is as follows:

[0111] in, Indicates the target hosts in the current time window degree of punishment. is the target confidence threshold within the current time window. Represents the size of the sliding window, that is, the number of historical time windows included. Represents the The number of consecutive penalties a target host receives within the sliding window. Indicates the target hosts in the current time window target trust.

[0112] The average penalty level corresponding to multiple target hosts is The calculation process is as follows:

[0113] in, Indicates the average penalty level of multiple target hosts in the current window. Represents the number of all target hosts, that is, the number of historical time windows included. Indicates the target hosts in the current time window degree of punishment.

[0114] According to the above average penalty calculation method, determine the average penalty level of all target hosts in the previous time window .

[0115] Next, directly obtain the historical target trust threshold of the previous historical time window , and the number of malicious hosts detected in the previous historical time window .

[0116] Finally, based on the average trust of all target hosts in the current time window above , the historical target trust threshold of the previous historical time window , the number of malicious hosts detected in the previous historical time window , the degree of change between the congestion events in the current time window and the congestion events in the previous time window , and the average penalty level of all target hosts in the previous time window , construct the current state dataset, which is expressed as follows:

[0117] It should be noted that the status data set can be time-sensitive and can be obtained through " " represents the time step of the state data set. Assuming the current time step is 3, then The state dataset is represented as .

[0118] In an embodiment of the present application, after obtaining the current state data set, the current state data set is input into the trained target decision model, so that the target decision model outputs a target trust threshold based on the current state data set for comparison and identification of malicious hosts.

[0119] The trained target decision model is mainly obtained by training the preset decision model based on the sample state data set to output a predicted trust threshold, with the reward value corresponding to the reward function being maximized as the optimization goal. The reward value corresponding to the reward function reaches its maximum value when the target difference between the balance score and the false positive rate and the predicted average penalty is maximized. The reward function is constructed based on the balance score, false positive rate, and predicted average penalty; the balance score and false positive rate are determined by combining the sample benign host identifiers and the sample malicious host identifiers in the sample host identifiers after detecting the predicted malicious host identifiers and the predicted benign host identifiers by comparing the predicted trust threshold with the sample target trust of each sample host identifier; the predicted average penalty (i.e., the predicted traffic rate limit ratio) is determined based on the difference ratio between the predicted trust threshold and the sample target trust of each sample host identifier.

[0120] For ease of understanding, the following describes the training process of the target decision model. The training process of the target decision model is as follows: Obtain the sample target trust of each sample host identifier, the sample average trust among multiple sample host identifiers, the sample historical trust threshold, the number of sample malicious hosts, the change rate of the number of sample congestion events, the sample average traffic rate limit ratio corresponding to multiple sample host identifiers, the sample benign host identifiers and the sample malicious host identifiers among the multiple sample host identifiers; construct a sample state data set based on the sample average trust, the sample historical trust threshold, the number of sample malicious hosts, the change rate of the number of sample congestion events, and the sample average traffic rate limit ratio; input the sample state data set into the preset decision model to obtain the predicted trust threshold, and identify the predicted malicious host according to the predicted trust threshold and the sample target trust of each sample host identifier. The invention discloses a method for detecting malicious host identifiers; combining the predicted malicious host identifiers, the sample benign host identifiers, and the sample malicious host identifiers to determine the balance score of the detection precision and recall rate for the sample malicious host identifiers, as well as the misjudgment rate for misjudging the sample benign host identifiers as predicted malicious host identifiers; based on the sample target trust of each predicted malicious host identifier and each sample host identifier, determine the predicted average traffic rate limit ratio; determine the target difference between the balance score and the misjudgment rate and the predicted average traffic rate limit ratio, and construct a reward function based on the target difference as a variable, and the reward function takes maximizing the target difference as the optimization target; combining the output value of the reward function and adjusting the model parameters of the preset decision model according to the optimization target to obtain the target decision model.

[0121] Specifically, the sample target trust of each sample host identifier is obtained, and the sample average trust between multiple sample host identifiers is calculated based on the multiple sample target trusts corresponding to the multiple sample host identifiers. ; and obtain the sample history confidence threshold , Number of sample malicious hosts , the change rate of the number of sample congestion events , and the sample average traffic rate limit ratio corresponding to multiple sample host identifiers Based on the above state data, a sample state data set is constructed, which is represented as .

[0122] Then, the sample state data set is input into the preset decision model to obtain the predicted confidence threshold, which can be understood as an action in the range of [0, 1], expressed as .

[0123] Then, the sample target trust of each sample host identifier is compared with the predicted trust threshold to identify the predicted malicious host identifier and the predicted benign host identifier to determine the penalty level corresponding to each sample host identifier, that is, the predicted traffic rate limit ratio corresponding to each sample host identifier. The calculation process of the predicted traffic rate limit ratio corresponding to each sample host identifier is as follows:

[0124] Furthermore, the predicted traffic rate limit ratio corresponding to each sample host identifier is combined to calculate the predicted average traffic rate limit ratio. The calculation process of the predicted average traffic rate limit ratio is as follows:

[0125] Next, the predicted malicious host identifier and the predicted benign host identifier are identified according to the predicted trust threshold and the sample target trust of each sample host identifier, and the predicted first number of predicted benign hosts and the predicted second number of predicted malicious hosts are calculated; the predicted malicious host identifier, the predicted benign host identifier, the sample benign host identifier, and the sample malicious host identifier are compared to count the correctly detected number of correctly detected predicted malicious host identifiers , the number of false detections where the sample benign host identifier is misjudged as a predicted malicious host identifier , and the number of missed detections of malicious host identifiers of missed samples Then, determine the balance score between detection precision and recall for the sample malicious host identification. For example, F1-Score is used to measure the detection precision and recall rate of the sample malicious host identification. The specific calculation process is as follows:

[0126] And, determine the misjudgment rate of misjudging the sample benign host identifier as a predicted malicious host identifier , the specific calculation process is as follows:

[0127] Among them, U represents the number of all sample host identifiers, that is, the number of sample hosts, and Z represents the number of all sample malicious host identifiers, that is, the number of sample malicious hosts.

[0128] Furthermore, the target difference between the balance score and the false positive rate and the predicted average traffic rate limit ratio is determined. The target difference is expressed as “ ”. Furthermore, a reward function can be constructed based on the target difference as a variable.

[0129] It should be noted that the correct prediction trust threshold can effectively detect malicious hosts and prevent congestion events in network transmission links, making congestion events show a decreasing trend. Therefore, the number of congestion events in the next time window is required to be Should be greater than the number of congestion events in the previous time window To be less, expressed as " ”.

[0130] Based on the above, a constrained optimization problem is constructed to train the preset decision model through the constrained optimization problem. The constrained optimization problem is expressed as follows: , , .

[0131] For ease of understanding, the above constrained optimization problem is converted into a reward function. The rate of change of the number of congestion events between the previous and next time windows can be expressed as “ In addition, the number of malicious host identifiers can be combined to predict The number of malicious host identifiers relative to the sample The proportion of "Thus, a reward function is constructed by combining the target difference, the change rate of the number of congestion events between the previous and next time windows, and the ratio between the predicted malicious host identifier and the sample malicious host identifier. It is expressed as follows:

[0132] It should be noted that the optimization goal of the reward function is to improve the accuracy of identifying sample malicious host identifiers, while reducing the false positive rate of misidentifying sample benign host identifiers as predicted malicious host identifiers, and reducing the number of congestion events and the average traffic rate limit ratio (i.e., the average penalty level). Specifically, the optimization goal is to maximize the target difference between the balance score, the false positive rate, and the predicted average penalty level. The reward value corresponding to the reward function is maximized when the target difference between the balance score, the false positive rate, and the predicted average penalty level is maximized.

[0133] Finally, combined with the output value of the reward function, according to the optimization goal, the model parameters of the preset decision model are adjusted until the output value of the reward function reaches the maximum value, then the training is stopped to obtain the trained target decision model.

[0134] Through the above method, the current target trust threshold can be calculated in combination with the reinforcement learning algorithm, so that malicious hosts can be identified based on the target trust threshold in the future. In this way, a host trust mechanism can be implemented in the future to identify malicious hosts according to the size of the target trust of each target host identifier in the current time window, thereby improving the accuracy of subsequent identification of malicious hosts.

[0135] 106. Identify malicious host identifiers based on the target trust threshold and the target trust of each target host identifier.

[0136] In the embodiment of the present application, after obtaining the target trust threshold, the target trust threshold and the target trust of each target host identifier can be combined to identify malicious host identifiers from multiple target host identifiers. In this way, a host trust mechanism is implemented to identify malicious hosts according to the size of the target trust of each target host identifier in the current time window, thereby improving the accuracy of identifying malicious hosts so that malicious hosts can be accurately punished in the future and prevent malicious hosts from continuing to launch traffic attacks to the network transmission link. In this way, the occurrence of subsequent congestion events in the network transmission link is reduced, and the security and stability of the network transmission link are improved.

[0137] Among them, the malicious host identifier is one of the multiple target host identifiers. It should be noted that through the target trust threshold, one or more malicious host identifiers can be identified from multiple target host identifiers. The specific number depends on the actual situation and is not limited here.

[0138] In some embodiments, the target trust level of each target host identifier may be compared with a target trust level threshold to identify malicious host identifiers whose target trust level is less than the target trust level threshold. For example, step 106 may include: comparing the target trust level of each target host identifier with the target trust level threshold to obtain a comparison result; and based on the comparison result, determining the target host identifier whose target trust level is less than the target trust level threshold as a malicious host identifier.

[0139] Specifically, after obtaining the target trust threshold corresponding to the current time window, the target trust of each target host identifier in the current time window can be compared with the target trust threshold to obtain a comparison result. Further, the malicious host identifiers and benign host identifiers among the multiple target host identifiers are determined based on the comparison results. On the one hand, if the comparison result shows that the target trust is greater than or equal to the target trust threshold, the corresponding target host identifier is determined as a benign host identifier; on the other hand, if the comparison result shows that the target trust is less than the target trust threshold, the corresponding target host identifier is determined as a malicious host identifier. In this way, the malicious host identifier is identified by comparing the target trust of each target host identifier with the target trust threshold. In this way, a host trust mechanism is implemented to identify malicious hosts according to the size of the target trust of each target host identifier in the current time window, thereby improving the accuracy of subsequent identification of malicious hosts.

[0140] In some embodiments, for example, step 106 may include: comparing the target trust of each target host identifier with a target trust threshold to obtain a comparison result, and obtaining each historical comparison result corresponding to each historical time window in the sliding window, combining the current comparison result and each historical comparison result to identify malicious host identifiers from multiple target host identifiers.

[0141] Specifically, the target trust of each target host identifier is compared with the target trust threshold to obtain the current comparison result; each historical comparison result corresponding to each historical time window in the sliding window is obtained, and each historical comparison result includes the size relationship between the historical trust of multiple target host identifiers in the corresponding historical time window and the corresponding historical trust threshold; when a set of candidate host identifiers with a target trust less than the target trust threshold is determined from multiple target host identifiers based on the comparison result, a set of historical candidate host identifiers with a historical trust less than the historical trust threshold is determined based on each comparison result, the intersection information between the candidate host identifier set and the multiple candidate host identifier sets is determined, and the target host identifier in the intersection information is determined as a malicious identifier. In this way, the target host identifier whose target trust in the current time window is less than the target trust threshold is used as the malicious host identifier to be confirmed. Furthermore, for the malicious host identifier to be confirmed, the relationship between its historical trust in each historical time window contained in the sliding window and the corresponding historical trust threshold is queried. If the target trust of a target host identifier in the current time window is lower than the target trust threshold, and the historical trust of multiple consecutive historical time windows in the sliding window is lower than the corresponding historical trust threshold, then the target host identifier whose trust is continuously lower than the trust threshold is determined to be a malicious host identifier. In this way, the accuracy of identifying malicious hosts can be improved, and the risk of misjudging benign hosts as malicious hosts can be reduced, so that malicious hosts can be punished accurately in the future, which is conducive to maintaining the security and stability of network links.

[0142] In an embodiment of the present application, after identifying the malicious host identifier, in order to prevent the malicious host from continuing to launch traffic attacks on the network transmission link, it is necessary to accurately punish the malicious host, for example, limit the network transmission rate, traffic, etc. of the malicious host, thereby reducing the occurrence of subsequent congestion events in the network transmission link and improving the security and stability of the network transmission link.

[0143] In some embodiments, the traffic rate limit ratio of each malicious host identifier can be determined based on the trust difference ratio between the target trust of each malicious host identifier and the target trust threshold. For example, after step 106, the method may further include: determining the number of consecutive penalties for each malicious host identifier in multiple historical time windows, and determining a corresponding penalty parameter based on the difference between the number of historical time windows and the number of consecutive penalties; determining a target trust ratio between the target trust of each malicious host identifier and the target trust threshold, and determining a target trust loss ratio for each malicious host identifier based on the target trust ratio; performing a power operation on the corresponding penalty parameter for the target trust loss ratio of each malicious host identifier to obtain a traffic rate limit ratio for each malicious host identifier; and sending the traffic rate limit ratio of each malicious host identifier to each network device, so that each network device limits the traffic rate of each malicious host identifier according to the traffic rate limit ratio of each malicious host identifier.

[0144] The number of consecutive penalties refers to the number of penalties (limited network transmission rate) received by the corresponding malicious host in multiple historical time windows.

[0145] The number of historical time windows may be the length of the sliding time window, that is, the number of historical time windows accommodated by the sliding time window.

[0146] For example, the traffic rate limit ratio for each malicious host identification The calculation process is as follows:

[0147] Here, Indicates the target hosts in the current time window The degree of penalty, that is, the traffic rate limit ratio. is the target confidence threshold within the current time window. Represents the size of the sliding window, that is, the number of historical time windows included. Represents the The number of times a target host is punished consecutively within the sliding window. Indicates the target hosts in the current time window target trust.

[0148] Afterwards, the traffic rate limit ratio of each malicious host identifier is sent to each network device, so that each network device limits the traffic rate of each malicious host identifier according to the traffic rate limit ratio of each malicious host identifier, for example, limiting the network transmission rate, traffic, etc. of the malicious host, thereby reducing the occurrence of subsequent congestion events in the network transmission link and improving the security and stability of the network transmission link.

[0149] In some embodiments, after determining the traffic rate limit ratio for each malicious host identifier, in order to prevent the malicious host from hijacking or tampering with the traffic rate limit ratio, the traffic rate limit ratio of each malicious host identifier can be encrypted through blockchain technology and uploaded to the blockchain to be shared with each network device through the blockchain. The local service node (server) belongs to one of the service nodes in the blockchain system. For example, the step of "sending the traffic rate limit ratio of each malicious host identifier to each network device" may include: obtaining the target node private key in the public-private key pair of the local node (server), signing the traffic rate limit ratio of each malicious host identifier according to the target node private key, and obtaining the target hash value of the traffic rate limit ratio for each malicious host identifier, and then, based on the traffic rate limit ratio of each malicious host identifier and each target hash value, packaging and generating a target block, broadcasting the target block to other service nodes in the blockchain system for consensus verification, and obtaining a consensus verification result; when the consensus verification result is that the consensus verification is passed, adding the target block to the blockchain, so that each network device obtains the traffic rate limit ratio of each malicious host identifier from the target block on the blockchain, so as to limit the traffic rate of each malicious host identifier according to the traffic rate limit ratio of each malicious host identifier. In this way, not only can malicious hosts be prevented from hijacking and tampering with the traffic rate limit ratio, but a decentralized approach can also be used to prevent a single server (for example, the server is also hacked by an attacker) from deliberately sheltering a malicious host. For example, a "traffic rate limit ratio" is forged for a malicious host in an attempt to reduce the impact of the malicious host on the traffic rate. Therefore, through blockchain technology, the above problems can be effectively eliminated, the occurrence of subsequent congestion events in the network transmission link can be reduced, and the security and stability of the network transmission link can be improved.

[0150] Through the above method, the target trust threshold and the target trust of each target host identifier can be combined to identify malicious host identifiers from multiple target host identifiers. In this way, a host trust mechanism is implemented to identify malicious hosts according to the size of the target trust of each target host identifier in the current time window, thereby improving the accuracy of identifying malicious hosts. Furthermore, malicious hosts are accurately punished to prevent malicious hosts from continuing to launch traffic attacks on network transmission links. In this way, the occurrence of subsequent congestion events in network transmission links is reduced, and the security and stability of network transmission links are improved.

[0151] From the above, it can be seen that the malicious host detection method of the embodiment of the present application obtains multiple access address change events and multiple congestion events within the current time window, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier participating in the network link congestion; based on the multiple access address change events and multiple congestion events, the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier are counted; based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier in the current time window, the initial trust of each target host identifier in the current time window is calculated; the historical trust corresponding to each target host identifier in the historical time window is obtained, and the target trust of each target host identifier is calculated based on the initial trust and the corresponding historical trust of each target host identifier; the current state data set is obtained, and the state data set is input into the target decision model to obtain the target trust threshold; based on the target trust threshold and the target trust of each target host identifier, the malicious host identifier is identified.

[0152] Based on this, we can first obtain multiple access address change events and multiple congestion events within the current time window, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier participating in the network link congestion. Then, based on multiple access address change events and multiple congestion events, we can count the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier. In this way, we can construct multi-dimensional evidence data as the basic data for calculating the trust of the target host identifier. Then, we can calculate the initial trust of each target host identifier in the current time window based on the multi-dimensional evidence data, and use the initial trust of each target host identifier as the basis for calculating the trust of the target host identifier. The initial trust is combined with its historical trust in the historical time window to calculate the target trust of each target host identifier in the current time window. In this way, the historical trust in the historical time window and the initial trust of the current time window are combined to calculate the current target trust, so as to avoid the phenomenon that the malicious host participates in the network link congestion less times in the current time window and is misjudged as a benign host. Furthermore, the current state data set is obtained and input into the target decision model to determine the target trust threshold for the current time window. Finally, the target trust of each target host identifier is combined with the target trust threshold to identify the malicious host identifier. Therefore, compared with the related art that identifies malicious hosts through malicious traffic characteristics, which has relatively low accuracy, the present application is directly based on the host trust mechanism, and calculates the initial trust through multiple dimensions such as the number of congestion participation, the number of access address changes, and the number of continuous congestion participation of each target host identification corresponding to the current time window. There is no need to detect malicious hosts by mining malicious traffic characteristics, and the trust situation of the historical time window is combined to calculate the final target trust of each target host identification, so that the calculation of the trust of each host is more accurate, so that the malicious host can be punished for a long time, and the malicious host's attack on the network transmission link can be blocked subsequently, thereby improving the accuracy of identifying malicious hosts.

[0153] The specific implementation of the above steps can be found in the previous embodiments and will not be repeated here.

[0154] To facilitate better implementation of the malicious host detection method provided in the embodiment of the present application, the embodiment of the present application also provides a malicious host detection device based on the above-mentioned malicious host detection method. The meanings of the terms are the same as those in the above-mentioned malicious host detection method, and the specific implementation details can be referred to the description in the method embodiment.

[0155] See also Figure 5 , Figure 5A structural diagram of a malicious host detection device provided in an embodiment of the present application, wherein the malicious host detection device is integrated into the computer device of the present application, wherein the malicious host detection device may include an acquisition unit 401, a statistical unit 402, a first calculation unit 403, a second calculation unit 404, an input unit 405, and an identification unit 406.

[0156] An acquisition unit 401 is configured to acquire multiple access address change events and multiple congestion events within a current time window, wherein each access address change event includes an identifier of a target host whose access address has been changed, and each congestion event includes an identifier of a target host that is involved in network link congestion. A counting unit 402 is configured to count the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier based on the multiple access address change events and the multiple congestion events; The first calculation unit 403 is configured to calculate the initial trust level of each target host identifier in the current time window based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier in the current time window; The second calculation unit 404 is configured to obtain a historical trust degree corresponding to each target host identifier in a historical time window, and calculate a target trust degree for each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree; An input unit 405 is used to obtain a current state data set, input the state data set into a target decision model, and obtain a target confidence threshold; The identification unit 406 is configured to identify malicious host identifiers according to a target trust threshold and a target trust of each target host identifier.

[0157] In some implementations, the first computing unit 403 is further configured to: Based on the number of congestion participations of each target host ID in the current time window, the direct participation score of each target host ID is determined; based on the number of continuous participations of each target host ID in the current time window, the continuous participation score is calculated; based on the number of access address changes of each target host ID in the current time window, the address change score is calculated; the direct participation score, continuous participation score and address change score are weighted to obtain the initial trust of each target host ID in the current time window.

[0158] In some implementations, the first computing unit 403 is further configured to: Determine a first evidence weight factor associated with the direct participation score, a second evidence weight factor associated with the continuous participation score, and a third evidence weight factor associated with the address change score; wherein the sum of the first evidence weight factor, the second evidence weight factor, and the third evidence weight factor is 1; perform weighted calculation on the direct participation score, the continuous participation score, and the address change score according to the first evidence weight factor, the second evidence weight factor, and the third evidence weight factor to obtain an initial trust level of each target host identifier within the current time window.

[0159] In some implementations, there are multiple historical time windows, and the second calculation unit 404 is further configured to: Determine the current trust weight factor corresponding to the current time window and the historical trust weight factor corresponding to each historical time window, where the historical trust weight factor decreases exponentially as the distance between the corresponding historical time window and the current time window increases; according to the current trust weight factor and each historical trust weight factor, perform weighted summation on the initial trust of each target host identifier and the corresponding multiple historical trusts to obtain the target total trust score corresponding to each target host identifier; determine the total trust weight coefficient in combination with the current trust weight factor and each historical trust weight factor, and determine the target trust of each target host identifier based on the ratio between the target total trust score of each target host identifier and the total trust weight coefficient.

[0160] In some implementations, the identification unit 406 is further configured to: The target trust of each target host identifier is compared with the target trust threshold to obtain a comparison result; based on the comparison result, the target host identifier with a target trust less than the target trust threshold is determined as a malicious host identifier.

[0161] In some embodiments, the malicious host detection apparatus further includes a penalty control unit configured to: Determine the number of consecutive penalties for each malicious host identifier in multiple historical time windows, and determine the corresponding penalty parameter based on the difference between the number of historical time windows and the number of consecutive penalties; determine the target trust ratio between the target trust of each malicious host identifier and the target trust threshold, and determine the target trust loss ratio of each malicious host identifier based on the target trust ratio; perform a power operation on the corresponding penalty parameter for the target trust loss ratio of each malicious host identifier to obtain the traffic rate limit ratio of each malicious host identifier; send the traffic rate limit ratio of each malicious host identifier to each network device, so that each network device limits the traffic rate of each malicious host identifier according to the traffic rate limit ratio of each malicious host identifier.

[0162] In some embodiments, the malicious host detection apparatus further includes a training unit configured to: Obtain the sample target trust of each sample host identifier, the sample average trust among multiple sample host identifiers, the sample historical trust threshold, the number of sample malicious hosts, the change rate of the number of sample congestion events, and the sample average traffic rate limit ratio corresponding to multiple sample host identifiers, the sample benign host identifiers and the sample malicious host identifiers in the multiple sample host identifiers; construct a sample state data set based on the sample average trust, the sample historical trust threshold, the number of sample malicious hosts, the change rate of the number of sample congestion events, and the sample average traffic rate limit ratio, and determine the first number of samples of the sample benign host identifiers and the second number of samples of the sample malicious host identifiers in the multiple sample host identifiers; input the sample state data set into the preset decision model to obtain the predicted trust threshold, and The predicted malicious host identifier is identified by combining the predicted malicious host identifier, the sample benign host identifier, and the sample malicious host identifier; the balance score of the detection precision and recall rate for the sample malicious host identifier, as well as the misjudgment rate for misjudging the sample benign host identifier as the predicted malicious host identifier are determined by combining the predicted malicious host identifier, the sample benign host identifier, and the sample malicious host identifier; the predicted average traffic rate limit ratio is determined based on each predicted malicious host identifier and the sample target trust of each sample host identifier; the target difference between the balance score and the misjudgment rate and the predicted average traffic rate limit ratio is determined, and a reward function is constructed based on the target difference as a variable, and the reward function takes maximizing the target difference as the optimization target; combined with the output value of the reward function, the model parameters of the preset decision model are adjusted according to the optimization target to obtain the target decision model.

[0163] As can be seen from the above, in the embodiment of the present application, multiple access address change events and multiple congestion events within the current time window can be obtained first, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier participating in the network link congestion. Then, based on the multiple access address change events and the multiple congestion events, the number of congestion participations, the number of access address changes, and the number of continuous participations of each target host identifier are counted. In this way, multi-dimensional evidence data can be constructed as the basic data for calculating the trust of the target host identifier. Then, based on the multi-dimensional evidence data, the initial trust of each target host identifier in the current time window is calculated, and each target host identifier is The initial trust of the host identifier is combined with its historical trust in the historical time window to calculate the target trust of each target host identifier in the current time window. In this way, the current target trust is calculated by combining the historical trust in the historical time window and the initial trust in the current time window, avoiding the phenomenon that the malicious host participates in the network link congestion less times in the current time window and is misjudged as a benign host. Furthermore, the current state data set is obtained and input into the target decision model to determine the target trust threshold for the current time window. Finally, the target trust of each target host identifier is combined with the target trust threshold to identify the malicious host identifier. Therefore, compared with the related art that identifies malicious hosts through malicious traffic characteristics, which has relatively low accuracy, the present application is directly based on the host trust mechanism, and calculates the initial trust through multiple dimensions such as the number of congestion participation, the number of access address changes, and the number of continuous congestion participation of each target host identification corresponding to the current time window. There is no need to detect malicious hosts by mining malicious traffic characteristics, and the trust situation of the historical time window is combined to calculate the final target trust of each target host identification, so that the calculation of the trust of each host is more accurate, so that the malicious host can be punished for a long time, and the malicious host's attack on the network transmission link can be blocked subsequently, thereby improving the accuracy of identifying malicious hosts.

[0164] The specific implementation of each of the above units can be found in the previous embodiments and will not be described again here.

[0165] Figure 6The following is a block diagram of a portion of a network device 110 for implementing an embodiment of the present disclosure. The network device 110 includes components such as a radio frequency (RF) circuit 510, a memory 515, an input unit 530, a display unit 540, a sensor 550, an audio circuit 560, a wireless fidelity (WiFi) module 570, a processor 580, and a power supply 590. Those skilled in the art will appreciate that the structure of the network device 110 shown in the figure does not limit the structure of a mobile phone or a computer, and may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0166] The RF circuit 510 may be used for receiving and sending signals during information transmission or calls. In particular, after receiving downlink information from the base station, it is sent to the processor 580 for processing. In addition, the uplink data is sent to the base station.

[0167] The memory 515 may be used to store software programs and modules. The processor 580 executes various functional applications and data processing of the terminal by running the software programs and modules stored in the memory 515 .

[0168] The input unit 530 may be configured to receive input digital or character information and generate key signal input related to terminal settings and function control. Specifically, the input unit 530 may include a touch panel 531 and other input devices 532 .

[0169] The display unit 540 may be configured to display input information or provided information and various menus of the terminal. The display unit 540 may include a display panel 541 .

[0170] The audio circuit 560 , the speaker 561 , and the microphone 562 may provide an audio interface.

[0171] In this embodiment, the processor 580 included in the network device 110 can execute the malicious host detection method of the previous embodiment.

[0172] The network devices 110 of the embodiments of the present disclosure include, but are not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc. The embodiments of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc.

[0173] Figure 7This is a block diagram of the structure of a portion of the server 120 for implementing an embodiment of the present disclosure. The server 120 may vary greatly due to different configurations or performance, and may include one or more central processing units (CPUs) 622 (for example, one or more processors) and memories 632, and one or more storage media 620 (for example, one or more mass storage devices) for storing application programs 642 or data 644. Among them, the memories 632 and the storage media 620 may be temporary storage or permanent storage. The program stored in the storage medium 620 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server 120. Furthermore, the central processing unit 622 may be configured to communicate with the storage medium 620 to execute a series of instruction operations in the storage medium 620 on the server 120.

[0174] The server 120 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input and output interfaces 658, and / or one or more operating systems 641, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0175] The central processor 622 in the server 120 can be used to execute the malicious host detection method of the embodiment of the present disclosure.

[0176] The embodiments of the present disclosure further provide a computer-readable storage medium, which is used to store program code, and the program code is used to execute the malicious host detection method of each of the aforementioned embodiments.

[0177] The present disclosure also provides a computer program product, which includes a computer program. A processor of a computer device reads and executes the computer program, so that the computer device implements the above-mentioned malicious host detection method.

[0178] In addition, the terms "comprises" and "comprising" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, apparatus, product or apparatus that comprises a series of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, product or apparatus.

[0179] It should be understood that in the present disclosure, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0180] It should be understood that in the description of the embodiments of the present disclosure, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood to exclude the number itself, and above, below, within, etc. are understood to include the number itself.

[0181] In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0182] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0183] In addition, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0184] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program code.

[0185] It should also be understood that the various implementations provided in the embodiments of the present disclosure can be combined arbitrarily to achieve different technical effects.

[0186] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or portion of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal. It can be implemented in whole or in part using software, hardware (such as processing circuits or memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the functionality of the module or unit.

[0187] The above is a specific description of the implementation methods of the present disclosure, but the present disclosure is not limited to the above implementation methods. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present disclosure. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present disclosure.

Claims

1. A malicious host detection method, characterized in that: include: Obtain multiple access address change events and multiple congestion events within the current time window, each access address change event includes the target host identifier of the changed access address, and each congestion event includes the target host identifier of the participating network link congestion; Based on the multiple access address change events and the multiple congestion events, counting the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier; Calculating an initial trust degree of each target host identifier in the current time window based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier in the current time window; Obtaining a historical trust degree corresponding to each target host identifier in a historical time window, and calculating a target trust degree for each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree; Obtaining a current state data set, inputting the state data set into a target decision model, and obtaining a target confidence threshold; Malicious host identifiers are identified based on the target trust threshold and the target trust of each target host identifier.

2. The malicious host detection method according to claim 1, characterized in that: The calculating, based on the congestion participation count, the access address change count, and the continuous participation count of each target host identifier in the current time window, the initial trust degree of each target host identifier in the current time window includes: Determining a direct participation score of each target host identifier based on the congestion participation count of each target host identifier within the current time window; Calculating a continuous participation score based on the number of continuous participations of each target host identifier within the current time window; Calculating an address change score based on the number of access address changes of each target host identifier within the current time window; A weighted calculation is performed on the direct participation score, the continuous participation score, and the address change score to obtain an initial trust degree of each target host identifier within the current time window.

3. The malicious host detection method according to claim 2, characterized in that: The weighted calculation of the direct participation score, the continuous participation score, and the address change score to obtain the initial trust level of each target host identifier within the current time window includes: Determining a first weight of evidence factor for the direct participation scoring association, a second weight of evidence factor for the continuous participation scoring association, and a third weight of evidence factor for the address change scoring association; wherein the sum of the first weight of evidence factor, the second weight of evidence factor, and the third weight of evidence factor is 1; The direct participation score, the continuous participation score, and the address change score are weightedly calculated according to the first evidence weight factor, the second evidence weight factor, and the third evidence weight factor to obtain an initial trust level of each target host identifier within the current time window.

4. The malicious host detection method according to any one of claims 1 to 3, characterized in that: There are multiple historical time windows, and calculating the target trust degree of each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree includes: Determining a current trust weight factor corresponding to the current time window and a historical trust weight factor corresponding to each historical time window, wherein the historical trust weight factor decreases exponentially as the distance between the corresponding historical time window and the current time window increases; According to the current trust weight factor and each historical trust weight factor, weighted summing the initial trust degree of each target host identifier and the corresponding multiple historical trust degrees is performed to obtain a target total trust score corresponding to each target host identifier; A total trust weight coefficient is determined by combining the current trust weight factor and each historical trust weight factor, and a target trust degree of each target host identifier is determined based on a ratio between the target total trust score of each target host identifier and the total trust weight coefficient.

5. The malicious host detection method according to claim 1, wherein: The identifying a malicious host identifier according to the target trust threshold and the target trust of each target host identifier includes: Comparing the target trust level of each target host identifier with the target trust level threshold to obtain a comparison result; Based on the comparison result, the target host identifier whose target trust degree is less than the target trust degree threshold is determined as a malicious host identifier.

6. The malicious host detection method according to claim 1 or 5, characterized in that: After identifying a malicious host identifier based on the target trust threshold and the target trust of each target host identifier, the method further includes: Determining the number of consecutive penalties for each malicious host identifier in a plurality of the historical time windows, and determining a corresponding penalty parameter according to a difference between the number of the historical time windows and the number of consecutive penalties; Determining a target trust ratio between a target trust level of each malicious host identifier and the target trust level threshold, and determining a target trust loss ratio for each malicious host identifier based on the target trust ratio; Performing a power operation on the target trust loss ratio of each malicious host identifier by raising the corresponding penalty parameter to obtain a flow rate limit ratio for each malicious host identifier; The flow rate limit ratio of each malicious host identifier is sent to each network device, so that each network device limits the flow rate of each malicious host identifier according to the flow rate limit ratio of each malicious host identifier.

7. The malicious host detection method according to claim 1, characterized in that: Before inputting the state data set into the target decision model to obtain the target confidence threshold, the method further includes: Obtaining the sample target trust of each sample host identifier, the sample average trust among multiple sample host identifiers, the sample historical trust threshold, the number of sample malicious hosts, the change rate of the number of sample congestion events, and the sample average traffic rate limit ratio corresponding to the multiple sample host identifiers, the sample benign host identifiers and the sample malicious host identifiers among the multiple sample host identifiers; Constructing a sample state data set according to the sample average trust, the sample historical trust threshold, the sample number of malicious hosts, the change rate of the sample congestion event number, and the sample average traffic rate limit ratio, and determining a first number of samples of sample benign host identifiers and a second number of samples of sample malicious host identifiers among the multiple sample host identifiers; Inputting the sample status data set into a preset decision model to obtain a predicted trust threshold, and identifying a predicted malicious host identifier based on the predicted trust threshold and the sample target trust of each sample host identifier; Determining a balance score of detection precision and recall for the sample malicious host identifier, and a false positive rate for misjudging the sample benign host identifier as the predicted malicious host identifier, based on the predicted malicious host identifier, the sample benign host identifier, and the sample malicious host identifier; Determining a predicted average traffic rate limit ratio based on each predicted malicious host identifier and the sample target trust of each sample host identifier; Determining a target difference between the balance score and the false positive rate and the predicted average traffic rate limit ratio, and constructing a reward function based on the target difference as a variable, wherein the reward function takes maximizing the target difference as an optimization goal; In combination with the output value of the reward function and in accordance with the optimization objective, the model parameters of the preset decision model are adjusted to obtain the target decision model.

8. A malicious host detection device, characterized in that: include: an acquisition unit, configured to acquire multiple access address change events and multiple congestion events within a current time window, wherein each access address change event includes an identifier of a target host whose access address has been changed, and each congestion event includes an identifier of a target host that is involved in network link congestion; a statistics unit, configured to count the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier based on the multiple access address change events and the multiple congestion events; a first calculating unit, configured to calculate an initial trust degree of each target host identifier in the current time window based on the number of congestion participations, the number of access address changes, and the number of consecutive participations of each target host identifier in the current time window; a second calculation unit, configured to obtain a historical trust degree corresponding to each target host identifier in a historical time window, and calculate a target trust degree of each target host identifier based on the initial trust degree of each target host identifier and the corresponding historical trust degree; An input unit, configured to obtain a current state data set, input the state data set into a target decision model, and obtain a target confidence threshold; The identification unit is configured to identify malicious host identifiers according to the target trust threshold and the target trust of each target host identifier.

9. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the computer program, the malicious host detection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the malicious host detection method according to any one of claims 1 to 7.

Images