High-speed network-oriented DRDoS attack detection method

Abstract

The invention discloses a DRDoS attack detection method oriented to a high-speed network. The method is divided into an offline training stage and an online detection stage. In the off-line training stage, high-speed network traffic and DRDoS attack traffic are mixed, and the traffic processing scale is greatly reduced while space-time correlation is reserved by adopting a window sampling technology based on a time interval. And then, deeply analyzing the difference between the DRDoS attack traffic and the legal traffic of the high-speed network, and constructing a one-way traffic feature set which has high characterization and is suitable for a real asymmetric routing scene based on three traffic modes of the DRDoS attack. In order to efficiently extract a traffic mode in a high-speed network, a DRD-Sketch data structure with fine-grained spatial-temporal feature perception capability is designed to realize multi-dimensional traffic feature extraction. And finally, training a lightweight machine learning model to realize DRDoS attack traffic discrimination. In the online detection stage, traffic is captured from key nodes of a backbone network, features are extracted by adopting a sampling method and a data structure which are the same as those in the offline training stage, and the features are sent into a trained detection model to realize DRDoS attack low-delay alarm in a high-speed network environment.

Description

Technical Field

[0001] This invention relates to a DRDoS attack detection method for high-speed networks, belonging to the field of cyberspace security technology. Background Technology

[0002] Currently, Distributed Reflection Denial of Service (DRDoS) attacks, as an evolved form of Distributed Denial of Service (DDoS) attacks, have become a significant threat in the field of network security. Unlike traditional DDoS attacks, DRDoS attacks exploit protocol vulnerabilities to send attack traffic to the victim through the responses of reflection nodes. Because reflection nodes are usually legitimate service nodes, the characteristics of their reflected traffic are extremely similar to legitimate traffic, making DRDoS attacks more covert and harder to detect than traditional DDoS attacks. More seriously, DRDoS attacks have a multiplier effect; attackers can send small-scale requests using only a few botnets, which can trigger a large amount of response traffic through reflection nodes, causing a large-scale denial of service effect.

[0003] In recent years, there has been work on DRDoS attack detection. Most existing methods collect traffic from edge network nodes and use statistical methods to construct correspondences between packets or artificial intelligence methods to discover inherent traffic patterns to distinguish DRDoS attack traffic from normal traffic. However, these detection methods are usually tested and verified in laboratory environments and often have certain limitations when facing detection scenarios in high-speed networks.

[0004] (1) Detection method based on the correspondence between request and response data packets

[0005] These methods utilize efficient data structures such as Sketch and Bloom Filter to record the correspondence between request and response packets one by one, detecting DRDoS attacks by detecting abnormal deviations in the correspondence. While these methods can achieve a low false positive rate, they incur significant storage and synchronization overhead because they require monitoring all traffic at network edge nodes to extract the correspondence and continuous synchronization during data recording. In high-speed network environments, the data volume surges, making it impractical to record the request-response relationship of the entire traffic. Once sampling methods are used to reduce the data volume, the correspondence between data packets may change or even become completely invalid. Therefore, these methods are difficult to apply to DRDoS attack detection in high-speed network environments.

[0006] (2) Detection methods based on artificial intelligence

[0007] These methods extract statistical features of traffic packets, such as packet length, quantity, protocol, and rate, and train machine learning or deep learning models to discover DRDoS attack traffic patterns from these statistical features, thereby achieving detection. Due to the superior performance of artificial intelligence algorithms, these methods typically achieve high recognition accuracy. However, the high computational complexity of artificial intelligence methods makes it difficult to guarantee processing speed in high-speed network environments, hindering real-time monitoring. Furthermore, existing research does not consider the asymmetric routing scenarios common in backbone networks, and the selected traffic statistical features usually require complete and continuous bidirectional traffic, further impacting the DRDoS attack detection capabilities of these methods deployed in high-speed network environments.

[0008] In summary, existing DRDoS attack detection methods face numerous challenges: 1) High-speed network environments contain a large amount of legitimate traffic traveling at extremely high speeds. This traffic often shares similar characteristics with DRDoS attacks. Without in-depth analysis and accurate feature extraction, legitimate traffic may be misclassified as attack traffic, leading to false positives; 2) Most existing research methods employ bidirectional feature analysis for attack detection. However, asymmetric routing is prevalent in current high-speed network environments, making it difficult to obtain complete bidirectional flow data on a single node. This makes existing detection methods unsuitable for asymmetric routing scenarios in high-speed networks; 3) Many traditional detection methods rely on numerous complex features and models, requiring significant computational and storage resources for DRDoS attack detection. In high-speed network environments, the large network bandwidth and high data transmission rates result in severe resource bottlenecks for traditional detection methods in terms of data storage, processing, and real-time detection. Summary of the Invention

[0009] To address the aforementioned issues, this invention discloses a DRDoS attack detection method for high-speed networks, comprising an offline training phase and an online detection phase. In the offline training phase, the method mixes high-speed network traffic with DRDoS attack traffic, employing a time-interval-based window sampling technique to significantly reduce traffic processing scale while preserving spatiotemporal correlation. Subsequently, it deeply analyzes the differences between DRDoS attack traffic and legitimate high-speed network traffic, constructing a highly representative unidirectional traffic feature set applicable to real-world asymmetric routing scenarios based on three DRDoS attack traffic patterns. To efficiently extract traffic patterns in high-speed networks, a DRD-Sketch data structure with fine-grained spatiotemporal feature perception capabilities is designed to achieve multi-dimensional traffic feature extraction. Finally, a lightweight machine learning model is trained to discriminate DRDoS attack traffic. In the online detection phase, the method captures traffic from key nodes in the backbone network, extracts features using the same sampling method and data structure as in the offline training phase, and feeds the extracted features into the trained detection model to achieve low-latency DRDoS attack alerts in high-speed network environments.

[0010] To achieve the objectives of this invention, the specific technical steps of this solution are as follows: A DRDoS attack detection method for high-speed networks, the method comprising the following steps:

[0011] Step (1) Obtain a public dataset containing DRDoS attack traffic and use an authoritative DRDoS attack implementation tool to obtain attack traffic in a real and controllable network environment; mix these two types of attack traffic with the backbone network traffic of the public dataset to obtain a hybrid dataset for offline training.

[0012] Step (2) performs time-interval-based window sampling on the mixed dataset in step (1). This sampling method combines the characteristics of time-interval sampling and sliding window sampling, effectively reducing the amount of data to be processed, while preserving the spatiotemporal correlation of the data to a great extent.

[0013] Step (3) comprehensively analyze the differences between normal traffic and DRDoS attack traffic in high-speed network environment at the statistical feature level. For the three traffic patterns unique to DRDoS attacks, construct highly representative DRDoS attack traffic features at the three levels of address distribution, packet length, and packet rate. In order to ensure the effectiveness of the features in real networks, the final feature set only retains unidirectional traffic features that can cope with asymmetric routing scenarios.

[0014] Step (4) Based on the unidirectional feature set of DRDoS attack traffic obtained in step (3), design a DRD-Sketch data structure with fine-grained temporal feature perception capability. Use this structure to quickly and efficiently process the data packets sampled in step (2), extract and store multi-dimensional traffic features. This data structure does not require grouping and can store a large number of features in a small amount of space, which greatly reduces the required storage and computing resources.

[0015] Step (5) Extract multi-dimensional traffic features from the DRD-Sketch defined in step (4) and feed them into a lightweight machine learning model for training to obtain a model that can be used for online DRDoS attack detection, and deploy it on key nodes of the backbone network.

[0016] Step (6) capture traffic at key nodes of the backbone network, extract traffic features in the high-speed network according to steps (2) and (4), and send them into the detection model; the model can detect DRDoS attacks with high accuracy and low latency, and managers can handle traffic based on the model detection results.

[0017] Furthermore, in step (1), the step of constructing the traffic dataset for training is as follows:

[0018] (1.1) Obtain the dataset CICDDoS2019 containing DRDoS attack traffic data, preprocess the original dataset, filter out irrelevant data types, unify the data format, and add corresponding labels to some unlabeled original traffic data in combination with the dataset description information to facilitate subsequent processing steps.

[0019] (1.2) Use the authoritative DRDoS attack implementation tool Saddam to generate and collect attack traffic. Conduct DRDoS attack experiments on real network hosts using custom parameters. At the same time, collect attack traffic as a supplement to the dataset. The test process ensures that the experimental environment is controllable and will not affect other hosts on the Internet.

[0020] (1.3) Mix these two types of attack traffic with the backbone traffic of the public dataset MAWI to obtain a mixed dataset for offline training. The backbone traffic, as the background traffic, should be much larger than the attack traffic to simulate the real situation faced by DRDoS attack detection in high-speed network scenarios.

[0021] Furthermore, in step (2), the step of performing window sampling based on time intervals is as follows:

[0022] (2.1) Based on the traffic characteristics of high-speed networks, set the hash function Hash for the sampling method and define the constants required for the hash function;

[0023] (2.2) For the mixed dataset in step (1), the sampling starting point needs to be calculated. The random number t is input into the hash function, and t is multiplied and confused, shifted left in a loop, multiplied and confused twice, and mixed by XOR to obtain a hash value. This hash value is the sampling starting point.

[0024] (2.3) Based on the traffic volume of the collection point, set the time interval P and the time window X. Starting from the sampling starting point in (2.2), all data packets in the time window X will be sampled every P seconds. This sampling method can effectively reduce the amount of data to be processed while ensuring that the time clusters of the attack traffic are not cut off, thus preserving the spatiotemporal correlation of the sampled data to a great extent.

[0025] Furthermore, in step (3), the steps for constructing the statistical characteristics of DRDoS attack traffic are as follows:

[0026] (3.1) Based on the many-to-one pattern of DRDoS attack traffic, compare and analyze the differences in end address distribution between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract source port divergence and destination port divergence as features to distinguish DRDoS attack traffic.

[0027] (3.2) Based on the reflection amplification mode of DRDoS attack traffic, compare and analyze the differences in packet length between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract the packet length variance as a feature to distinguish DRDoS attack traffic.

[0028] (3.3) Based on the high byte rate pattern of DRDoS attack traffic, compare and analyze the difference in rate between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract the average byte rate and the average time interval of packet arrival as features to distinguish DRDoS attack traffic.

[0029] (3.4) Combine the features from steps (3.1), (3.2), and (3.3) to obtain the final unidirectional feature set.

[0030] Furthermore, in step (4), the steps for extracting and saving DRDoS attack traffic characteristics are as follows:

[0031] (4.1) Construct the DRD-Sketch data structure, which is based on Count-Min Sketch. The original design expands the single counter contained in the counting bucket into multiple counters, enriching the feature statistics dimensions. A Bitmap structure is added to the counting bucket to record port divergence and perceive the fine-grained spatial characteristics of traffic. At the same time, a timestamp structure is added to record the packet arrival time and perceive the fine-grained temporal characteristics of traffic. Each counting bucket records the statistical features related to the unidirectional feature set of DRDoS attack traffic in step (3). In addition, in order to ensure feature extraction efficiency and reduce hash collisions, DRD-Sketch uses MurMurHash as the hash function.

[0032] (4.2) Feature extraction is performed at the packet level rather than the flow level. DRD-Sketch treats the source IP and destination IP of a packet as a key-value pair and inputs the key-value pair into a hash function to find the corresponding position of the packet in the Sketch. For each packet, its timestamp, port number, and packet size features are extracted, and the corresponding counting bucket is updated using these features. Each counting bucket records the statistical features of the same key-value pair, including the number of packets, start time, end time, sum of squares of packet bytes, total number of packets, source port divergence, and destination port divergence.

[0033] Furthermore, in step (5), the steps of extracting features and training the DRDoS detection model are as follows:

[0034] (5.1) When the cumulative number of updates of the corresponding keyword cell in DRD-Sketch reaches the extraction threshold T, the statistical features contained in the corresponding counting bucket are extracted, and the feature set defined in step (3.4) is further constructed. Among them, the source port divergence and destination port divergence can be directly obtained through the statistical features of DRD-Sketch, while the average time interval of message arrival, message byte rate and message length variance need to be calculated and generated through other features in the counting bucket. Among them, the calculation formula of the average time interval of message arrival pkt_interval_avg is shown in Formula 5-1.

[0035]

[0036] The formula for calculating the message byte rate pkt_byte_spd is shown in Formula 5-2.

[0037]

[0038] The formula for calculating the message length variance pkt_variance_len is shown in Formula 5-3.

[0039]

[0040] (5.2) Select a lightweight machine learning model and initialize its parameters;

[0041] (5.3) The statistical features obtained in (5.1) are fed into the machine learning model for training to obtain a model that can be used for online DRDoS attack detection;

[0042] (5.4) Identify the key nodes in the backbone network that are at risk of DRDoS attacks and deploy the detection model on those nodes.

[0043] Furthermore, in step (6), the steps for deploying the model to perform online DRDoS attack detection are as follows:

[0044] (6.1) Capture traffic at key nodes of the backbone network, perform window sampling based on time intervals according to step (2), extract and store features according to step (4), and finally store the high-speed network traffic features in DRD-Sketch.

[0045] (6.2) Extract traffic features from DRD-Sketch and feed them into the detection model. The model can detect DRDoS attacks with high accuracy and low latency. Administrators issue alarms for attack flows predicted by the model and allow legitimate flows predicted by the model.

[0046] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned DRDoS attack detection method for high-speed networks.

[0047] A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the aforementioned DRDoS attack detection method for high-speed networks.

[0048] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects.

[0049] (1) This invention proposes a DRDoS attack detection method for high-speed networks, which can accurately identify DRDoS attacks in high-speed networks without decrypting traffic. This provides strong technical support for maintaining network security while protecting the privacy of internet users.

[0050] (2) This invention addresses the characteristics of DRDoS attack traffic in high-speed networks by extracting highly representative, sampleable, and unidirectional features, enabling it to better handle DRDoS attack detection scenarios in real backbone networks. Existing methods fail to deeply analyze the differences between DRDoS attack traffic and regular traffic in backbone networks, and are prone to false positives when faced with massive traffic samples in open worlds. The highly representative features extracted in this invention can accurately identify DRDoS attack traffic, ensuring a low false positive rate. Existing methods fail to consider the difficulty of performing full traffic analysis in high-speed network scenarios, and the selected features are usually not sampleable. The sampleable features extracted in this invention can guarantee effectiveness under sampling conditions, making them more valuable for practical deployment. Existing methods fail to consider the common asymmetric routing scenarios in backbone networks, and features usually need to be extracted from bidirectional flows, placing high demands on the traffic collection environment. The features extracted in this invention are all unidirectional, effectively addressing various traffic collection environments and offering greater adaptability.

[0051] (3) This invention employs a time-interval-based window sampling method to handle the massive traffic in high-speed networks, and designs a DRD-Sketch data structure to further improve feature retrieval efficiency. The sampling algorithm of this invention combines the characteristics of time-interval sampling and sliding window sampling, effectively reducing the amount of data to be processed while preserving the spatiotemporal correlation of the data to a great extent. Based on the Count-Min Sketch data structure, this invention expands the single counter contained in the counting bucket in the original design into multiple counters, enriching the feature statistics dimension; and adds Bitmap and timestamp structures to enable it to have fine-grained spatiotemporal feature perception capabilities; finally forming the DRD-Sketch data structure, which significantly reduces storage overhead while ensuring feature extraction efficiency. Attached Figure Description

[0052] Figure 1 A system framework diagram for DRDoS attack detection methods for high-speed networks;

[0053] Figure 2 This is a schematic diagram of window sampling based on time intervals;

[0054] Figure 3 This is a schematic diagram of the specific structure and feature storage method of DRD-Sketch. Detailed Implementation

[0055] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0056] Example: The present invention provides a DRDoS attack detection method for high-speed networks, the overall system structure of which is as follows: Figure 1 As shown, it includes the following steps:

[0057] Step (1) Obtain a public dataset containing DRDoS attack traffic and use an authoritative DRDoS attack implementation tool to obtain attack traffic in a real and controllable network environment; mix these two types of attack traffic with the backbone network traffic of the public dataset to obtain a hybrid dataset for offline training.

[0058] In one embodiment of the present invention, the steps for constructing the traffic dataset for training are as follows:

[0059] (1.1) Obtain the dataset CICDDoS2019 containing DRDoS attack traffic data. This dataset includes six types of DRDoS attacks: NTP, SNMP, SSDP, LDAP, MSSQL, and NetBIOS. Preprocess the raw dataset to remove irrelevant data types, unify the data format, and add corresponding labels to some unlabeled raw traffic data based on the dataset description information to facilitate subsequent processing steps.

[0060] (1.2) Attack traffic was generated and collected using the authoritative DRDoS attack implementation tool Saddam. DRDoS attack experiments were conducted on real network hosts using custom parameters. Four self-built DNS servers were selected, with response packet lengths set to 300, 800, 1300, and 1400 bytes respectively. The simulated attack program made concurrent requests to each DNS server using three threads, and all response packets were sent to the locally built victim server. Attack traffic was collected from the victim server as supplementary DRDoS attack traffic data. The testing process ensured that the experimental environment was controllable and would not affect other hosts on the Internet.

[0061] (1.3) The two types of attack traffic were mixed with the backbone network traffic of the publicly available MAWI dataset to obtain a hybrid dataset for offline training. First, MAWI packets were mixed as background traffic with self-collected DRDoS attack traffic, where the number of background packets was much greater than the number of attack packets, forming hybrid dataset A. The specific information of this dataset is shown in Table 1. Then, no more than one percent of the attack traffic in the original dataset was added to hybrid dataset A, namely DRDoS attack traffic from CICDDoS2019, to obtain hybrid dataset B. The specific information of this dataset is shown in Table 2.

[0062] Table 1. Detailed information about the hybrid dataset A

[0063]

[0064] Table 2. Detailed information about the mixed dataset B

[0065]

[0066]

[0067] Step (2) performs time-interval-based window sampling on the mixed dataset from step (1). This sampling method combines the characteristics of time-interval sampling and sliding window sampling, effectively reducing the amount of data to be processed while preserving the spatiotemporal correlation of the data to a great extent. The specific sampling process is as follows: Figure 2 As shown;

[0068] In one embodiment of the present invention, the step of performing time-interval-based window sampling is as follows:

[0069] (2.1) Based on the traffic characteristics of high-speed networks, the hash function of the sampling method is set to Farm hash, and the constants required for the hash function are defined;

[0070] (2.2) For the mixed dataset in step (1), the sampling starting point needs to be calculated. The random number t is input into the hash function, and t is multiplied and confused, shifted left in a loop, multiplied and confused twice, and mixed by XOR to obtain a hash value. This hash value is the sampling starting point.

[0071] (2.3) Based on the traffic volume of the collection point, the time interval P is set to 4 and the time window X is set to 2. Starting from the sampling starting point in (2.2), all data packets in the following 2 seconds are sampled every 4 seconds. This sampling method can effectively reduce the amount of data to be processed while ensuring that the time clusters of attack traffic are not cut off, thus preserving the spatiotemporal correlation of the sampled data to a great extent.

[0072] Step (3) comprehensively analyze the differences in statistical characteristics between normal traffic and DRDoS attack traffic in a high-speed network environment. For the three traffic patterns unique to DRDoS attacks, construct highly representative DRDoS attack traffic features at the three levels of address distribution, packet length, and packet rate. In order to ensure the effectiveness of the features in the real network, the final feature set only retains unidirectional traffic features that can cope with asymmetric routing scenarios. The calculation formula for the average packet arrival time interval pkt_interval_avg is shown in Formula 5-1.

[0073]

[0074] The formula for calculating the message byte rate pkt_byte_spd is shown in Formula 5-2.

[0075]

[0076] The formula for calculating the message length variance pkt_variance_len is shown in Formula 5-3.

[0077]

[0078] In one embodiment of the present invention, the steps for constructing DRDoS attack traffic statistical characteristics are as follows:

[0079] (3.1) Based on the many-to-one pattern of DRDoS attack traffic, compare and analyze the differences in end address distribution between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract source port divergence and destination port divergence as features to distinguish DRDoS attack traffic.

[0080] (3.2) Based on the reflection amplification mode of DRDoS attack traffic, compare and analyze the differences in packet length between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract the packet length variance as a feature to distinguish DRDoS attack traffic.

[0081] (3.3) Based on the high byte rate pattern of DRDoS attack traffic, compare and analyze the difference in rate between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract the average byte rate and the average time interval of packet arrival as features to distinguish DRDoS attack traffic.

[0082] (3.4) Combine the features from steps (3.1), (3.2), and (3.3) to obtain the final unidirectional feature set; Table 3 gives the final selected feature set and its specific meaning.

[0083] Table 3. DRDoS attack detection feature set and its specific meaning.

[0084]

[0085] Step (4) Based on the unidirectional feature set of DRDoS attack traffic obtained in step (3), design a DRD-Sketch data structure with fine-grained temporal feature perception capability. Use this structure to quickly and efficiently process the data packets sampled in step (2), extract and store multi-dimensional traffic features. This data structure does not require grouping and can store a large number of features in a small amount of space, which greatly reduces the required storage and computing resources.

[0086] In one embodiment of the present invention, the steps for extracting and saving DRDoS attack traffic characteristics are as follows:

[0087] (4.1) Construct the DRD-Sketch data structure, which is based on Count-Min Sketch. The original design expands the single counter contained in the counting bucket into multiple counters, enriching the feature statistics dimensions. A Bitmap structure is added to the counting bucket to record port divergence and perceive the fine-grained spatial characteristics of traffic. At the same time, a timestamp structure is added to record the packet arrival time and perceive the fine-grained temporal characteristics of traffic. Each counting bucket records the statistical features related to the unidirectional feature set of DRDoS attack traffic in step (3). In addition, in order to ensure feature extraction efficiency and reduce hash collisions, DRD-Sketch uses MurMurHash as the hash function.

[0088] (4.2) Feature extraction is performed at the packet level rather than the flow level. DRD-Sketch treats the source IP and destination IP of a packet as a key-value pair, inputs the key-value pair into a hash function to find the corresponding position of the packet in the Sketch; for each packet, its timestamp, port number, and packet size features are extracted, and these features are used to update the corresponding counting bucket; each counting bucket records the statistical features of the same key-value pair, including the number of packets, start time, end time, sum of squares of packet bytes, total number of packets, source port divergence, and destination port divergence. The storage units contained in DRD-Sketch are shown in Table 4;

[0089] Table 4 shows the storage units included in DRD-Sketch.

[0090]

[0091] Step (5) Extract multi-dimensional traffic features from the DRD-Sketch defined in step (4) and feed them into a lightweight machine learning model for training to obtain a model that can be used for online DRDoS attack detection, and deploy it on key nodes of the backbone network.

[0092] In one embodiment of the present invention, the steps of extracting features and training a DRDoS detection model are as follows:

[0093] (5.1) Set the extraction threshold T to 80. When the cumulative update count of the corresponding keyword cell in DRD-Sketch reaches 80, extract the statistical features contained in the corresponding counting bucket and further construct the feature set defined in step (3.4). Among them, the source port divergence and destination port divergence can be directly obtained through the statistical features of DRD-Sketch, while the average time interval of message arrival, message byte rate and message length variance need to be calculated and generated through other features in the counting bucket.

[0094] (5.2) Random forest was selected as the model for DRDoS attack detection, and Gini impurity was selected as the basis for node partitioning;

[0095] (5.3) The statistical features obtained in (5.1) are fed into the random forest model for training to obtain a model that can be used for online DRDoS attack detection;

[0096] (5.4) Identify the key nodes in the backbone network that are at risk of DRDoS attacks and deploy the detection model on those nodes.

[0097] Step (6) capture traffic at key nodes of the backbone network, extract traffic features in the high-speed network according to steps (2) and (4), and send them into the detection model; the model can detect DRDoS attacks with high accuracy and low latency, and managers can handle traffic based on the model detection results.

[0098] In one embodiment of the present invention, the steps for deploying the model to perform online DRDoS attack detection are as follows:

[0099] (6.1) Capture traffic at key nodes of the backbone network, perform window sampling based on time intervals according to step (2), extract and store features according to step (4), and finally store the high-speed network traffic features in DRD-Sketch.

[0100] (6.2) Extract traffic features from DRD-Sketch and feed them into the detection model. The model can detect DRDoS attacks with high accuracy and low latency. Administrators issue alarms for attack flows predicted by the model and allow legitimate flows predicted by the model.

[0101] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. A DRDoS attack detection method for high-speed networks, characterized in that, The method includes the following steps: Step (1) Obtain a public dataset containing DRDoS attack traffic and use an authoritative DRDoS attack implementation tool to obtain attack traffic in a real and controllable network environment; mix these two types of attack traffic with the backbone network traffic of the public dataset to obtain a hybrid dataset for offline training. Step (2) Perform time-time-based window sampling on the mixed dataset from step (1); Step (3) Analyze the differences between normal traffic and DRDoS attack traffic in the high-speed network environment at the statistical feature level. For the three traffic patterns unique to DRDoS attacks, construct highly representative DRDoS attack traffic features at the three levels of address distribution, packet length, and packet rate. Step (4) Based on the unidirectional feature set of DRDoS attack traffic obtained in step (3), design a DRD-Sketch data structure with fine-grained temporal feature perception capability. Use this structure to process the data packets sampled in step (2) quickly and efficiently, and extract and store multi-dimensional traffic features. Step (5) Extract multi-dimensional traffic features from the DRD-Sketch defined in step (4) and feed them into a lightweight machine learning model for training to obtain a model that can be used for online DRDoS attack detection, and deploy it on key nodes of the backbone network. Step (6) captures traffic at key nodes of the backbone network, extracts traffic features in the high-speed network according to steps (2) and (4), and sends them into the detection model.

2. The DRDoS attack detection method for high-speed networks according to claim 1, characterized in that, Step (1) specifically includes the following sub-steps: (1.1) Obtain the dataset CICDDoS2019 containing DRDoS attack traffic data, preprocess the original dataset, filter out irrelevant data types, unify the data format, and add corresponding labels to some unlabeled original traffic data in combination with the dataset description information to facilitate subsequent processing steps. (1.2) Use the authoritative DRDoS attack implementation tool Saddam to generate and collect attack traffic. Conduct DRDoS attack experiments on real network hosts using custom parameters. At the same time, collect attack traffic as a supplement to the dataset. The test process ensures that the experimental environment is controllable and will not affect other hosts on the Internet. (1.3) Mix these two types of attack traffic with the backbone traffic of the public dataset MAWI to obtain a mixed dataset for offline training. The backbone traffic, as the background traffic, should be much larger than the attack traffic to simulate the real situation faced by DRDoS attack detection in high-speed network scenarios.

3. The DRDoS attack detection method for high-speed networks according to claim 1, characterized in that, Step (2) specifically includes the following sub-steps: (2.1) Based on the traffic characteristics of high-speed networks, set the hash function Hash for the sampling method and define the constants required for the hash function; (2.2) For the mixed dataset in step (1), the sampling starting point needs to be calculated. The random number t is input into the hash function, and t is multiplied and confused, shifted left in a loop, multiplied and confused twice, and mixed by XOR to obtain a hash value. This hash value is the sampling starting point. (2.3) Based on the traffic volume of the collection point, set the time interval P and the time window X. Starting from the sampling starting point in (2.2), all data packets in the time window X will be extracted every P seconds.

4. The DRDoS attack detection method for high-speed networks according to claim 1, characterized in that, Step (3) specifically includes the following sub-steps: (3.1) Based on the many-to-one pattern of DRDoS attack traffic, compare and analyze the differences in end address distribution between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract source port divergence and destination port divergence as features to distinguish DRDoS attack traffic. (3.2) Based on the reflection amplification mode of DRDoS attack traffic, compare and analyze the differences in packet length between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract the packet length variance as a feature to distinguish DRDoS attack traffic. (3.3) Based on the high byte rate pattern of DRDoS attack traffic, compare and analyze the difference in rate between normal traffic and DRDoS attack traffic in high-speed network environment. At the same time, considering the robustness of features in asymmetric routing scenarios, extract the average byte rate and the average time interval of packet arrival as features to distinguish DRDoS attack traffic. (3.4) Combine the features from steps (3.1), (3.2), and (3.3) to obtain the final unidirectional feature set.

5. A DRDoS attack detection method for high-speed networks according to claim 1, characterized in that, Step (4) specifically includes the following sub-steps: (4.1) Construct the DRD-Sketch data structure, which is based on Count-Min Sketch. The original design expands the single counter contained in the counting bucket into multiple counters to enrich the feature statistics dimensions. Add a Bitmap structure to the counting bucket to record port divergence and perceive the fine-grained spatial characteristics of traffic. At the same time, a timestamp structure is added to record the arrival time of the message and perceive the fine-grained temporal characteristics of the traffic. Each counting bucket records the statistical characteristics related to the unidirectional feature set of DRDoS attack traffic in step (3). DRD-Sketch uses MurMurHash as the hash function. (4.2) Feature extraction is performed at the packet level rather than the flow level. DRD-Sketch treats the source IP and destination IP of a packet as a key-value pair and inputs the key-value pair into a hash function to find the corresponding position of the packet in the Sketch. For each packet, its timestamp, port number, and packet size features are extracted, and the corresponding counting bucket is updated using these features. Each counting bucket records the statistical features of the same key-value pair, including the number of packets, start time, end time, sum of squares of packet bytes, total number of packets, source port divergence, and destination port divergence.

6. A DRDoS attack detection method for high-speed networks according to claim 5, characterized in that, Step (5) specifically includes the following sub-steps: (5.1) When the cumulative number of updates of the corresponding keyword cell in DRD-Sketch reaches the extraction threshold T, the statistical features contained in the corresponding counting bucket are extracted, and the feature set defined in step (3.4) is further constructed. Among them, the source port divergence and destination port divergence can be directly obtained through the statistical features of DRD-Sketch, while the average time interval of message arrival, message byte rate and message length variance need to be calculated and generated through other features in the counting bucket. Among them, the calculation formula of the average time interval of message arrival pkt_interval_avg is shown in Formula 5-1. The formula for calculating the message byte rate pkt_byte_spd is shown in Formula 5-2. The formula for calculating the message length variance pkt_variance_len is shown in Formula 5-3. (5.2) Select a lightweight machine learning model and initialize its parameters; (5.3) The statistical features obtained in (5.1) are fed into the machine learning model for training to obtain a model that can be used for online DRDoS attack detection; (5.4) Identify the key nodes in the backbone network that are at risk of DRDoS attacks and deploy the detection model on those nodes.

7. A DRDoS attack detection method for high-speed networks according to claim 1, characterized in that, Step (6) specifically includes the following sub-steps: (6.1) Capture traffic at key nodes of the backbone network, perform window sampling based on time intervals according to step (2), extract and store features according to step (4), and finally store the high-speed network traffic features in DRD-Sketch. (6.2) Extract traffic features from DRD-Sketch and feed them into the detection model. The model can detect DRDoS attacks with high accuracy and low latency. Administrators issue alarms for attack flows predicted by the model and allow legitimate flows predicted by the model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements a DRDoS attack detection method for high-speed networks as described in any one of claims 1 to 7.

9. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, the computer instruction implements a DRDoS attack detection method for high-speed networks as described in any one of claims 1-7.

Images