DDoS attack defense method and system based on multi-source flow perception

Abstract

The invention discloses a DDoS attack defense method and system based on multi-source flow perception, and relates to the field of DDoS attack defense, and the method comprises the steps: collecting target observation time sequence data which is a statistical index sequence in a fixed time interval; a causal relationship graph is constructed, the causal relationship graph is composed of nodes and edges, the nodes represent network flow characteristic indexes, and the edges represent the causal dependency relationship between the nodes; and calculating a causal consistency score based on the target observation time sequence data, comparing the score with a preset threshold, generating a DDoS attack warning when the causal consistency score is lower than the preset threshold, generating a suspicious source set, and generating a traction rule based on the suspicious source set to perform attack defense. According to the method, the stable dependency relationship among different flow characteristics of the network in a normal state can be effectively captured, and rapid identification and defense can be carried out when the dependency relationship is obviously deviated due to attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of DDoS attack defense, more particularly, to a DDoS attack defense method and system based on multi-source traffic perception. BACKGROUND

[0002] Distributed Denial of Service (DDoS) attack is a kind of attack mode that causes target system resources to be exhausted or service to be unavailable by sending a large number of distributed nodes to the target network request exceeding its processing capacity. With the continuous improvement of attack tools and network bandwidth, DDoS attack presents the trend of diversification and intelligentization in means. Attack traffic not only comes from various sources, but also often has burstiness, camouflage and synergy. This makes it difficult for defense means relying on a single traffic feature or a single detection point to identify and intercept attacks in a timely and accurate manner. In addition, the attack process often causes the causal relationship between different levels of traffic features to change, for example, when a large-scale attack is initiated directly through an IP address, the timing dependence between domain name resolution traffic and subsequent application layer access may be significantly weakened or distorted. This causal relationship change feature is difficult to be effectively captured in the traditional defense system, especially in the scene that needs to quickly identify abnormalities and intercept upstream, unified analysis and causal correlation detection of multi-source traffic features become a problem to be solved. SUMMARY

[0003] The technical problem to be solved by the present application is to provide a DDoS attack defense method and system based on multi-source traffic perception to solve the problems mentioned in the background.

[0004] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0005] A DDoS attack defense method based on multi-source traffic perception, comprising:

[0006] Collecting target observation time series data, the target observation time series data is a statistical index sequence in a fixed time interval, including domain name resolution request rate time series, transmission layer connection establishment rate time series and application layer request rate time series;

[0007] Constructing a causal relationship graph, the causal relationship graph is composed of nodes and edges, the node represents a network traffic feature index, and the edge represents the causal dependence relationship between the nodes, and the causal weight w ij is identified, the causal weight w ij is determined by performing Granger causality test on the target observation time series data in the history attack-free period;

[0008] The causal consistency score is calculated based on the target observation time series data and compared with a preset threshold, and when the causal consistency score is lower than the preset threshold, a DDoS attack warning is generated, a suspicious source set is generated, and a traction rule is generated based on the suspicious source set for attack defense.

[0009] In some embodiments, the domain name resolution request rate time series is a sequence of domain name resolution request numbers in a unit time interval changing over time, the transport layer connection establishment rate time series is a sequence of newly established transport layer connection numbers in a unit time interval changing over time, and the application layer request rate time series is a sequence of received application layer request numbers in a unit time interval changing over time.

[0010] In some embodiments, the domain name resolution request rate time series includes at least one of a domain name resolution request number and a domain name resolution failure number.

[0011] The transport layer connection establishment rate time series includes at least one of a transport layer SYN message number, a transport layer newly established connection number, and a UDP message number in a unit time interval.

[0012] The application layer request rate time series includes at least one of an application layer request number and an application layer error response number in a unit time interval.

[0013] In some embodiments, the causal consistency score satisfies the formula:

[0014]

[0015] wherein E represents a set of edges in the causal graph, w ij represents a causal weight of edge (i, j), x i (t) represents a time series of the i th network traffic feature indicator in the target observation time series data, p(·) represents a Pearson correlation coefficient, τ ij represents an optimal lag on edge (i, j) that maximizes the Pearson correlation coefficient, S c represents the causal consistency score.

[0016] In some embodiments, the generation of the suspicious source set includes:

[0017] In a preset time window, for each source identifier, a time series segment corresponding to the source identifier is extracted from the target observation time series data; for at least one edge (i, j) in the causal graph, the optimal lag of the edge is The index sequences corresponding to nodes i and j in the time segment are down-aligned and the current Pearson correlation coefficient is calculated; the current Pearson correlation coefficient is compared with the baseline Pearson correlation coefficient of the edge during the historical normal attack-free period to obtain the time consistency difference; when the time consistency difference of any edge is greater than the preset difference threshold, the source identifier is included in the suspicious source set.

[0018] In some embodiments, the timing consistency difference is defined as:

[0019]

[0020] in, and Let represent the time series of the i-th and j-th network traffic characteristic indicators corresponding to the source identifier s, respectively, and ρ(·) represent the Pearson correlation coefficient. Let be the optimal hysteresis of the edge (i,j). Let be the baseline Pearson correlation coefficient of the edge during the historical period without attacks.

[0021] In some embodiments, the method further includes: targeting N source identifiers {s1,…,s} within a suspicious source set. N Generate the collaborative source set as follows:

[0022] For each source identifier s k Obtain the corresponding target observation time series data, and within a fixed-length time window, compare it with the other source identifiers s. m The peak value of the cross-correlation function of the target observation time series data (m≠k) is calculated, and a set of phase delay values ​​{τ} is obtained. k,m};

[0023] Set a preset delay range [-T, T] and divide it into M equal delay intervals {I1, ..., I... M}, for each τ obtained k,m The counts are accumulated according to the intervals they fall into, forming a counting vector of length M;

[0024] The counting vector is normalized according to the number of sources (N-1) to obtain the result with respect to the source identifier s. k One-to-one corresponding phase delay histogram vector H k ;

[0025] The phase delay histogram vectors {H1,…,H} corresponding to all source identifiers within the suspected source set are used to... N The input density clustering algorithm aggregates the data based on vector similarity to obtain multiple co-source sets. Each co-source set consists of source identifiers with similar phase delay histogram vectors and belongs to a subset of the suspected source set.

[0026] The source identifiers in the cooperative source set are subjected to a priority defense process.

[0027] In some embodiments, the traction rules are traffic control rules that can be directly issued to upstream network devices; each traction rule is subjected to a simulation evaluation based on traffic records within a preset time window, the proportion of source identifiers in the suspicious source set hit by the traction rule is counted, and the top A traction rules in terms of the proportion are selected as candidate traction rules.

[0028] In some embodiments, the traffic control rules include at least one of a network address prefix matching rule, a port matching rule, and a protocol matching rule.

[0029] The application further discloses a DDoS attack defense system based on multi-source traffic perception, comprising:

[0030] A data acquisition module is configured to acquire target observation time series data, which is a statistical index sequence within a fixed time interval, including domain name resolution request rate time series, transmission layer connection establishment rate time series, and application layer request rate time series.

[0031] A causal relationship graph construction module is configured to construct a causal relationship graph based on the target observation time series data, wherein the causal relationship graph is composed of nodes and edges, the nodes represent network traffic feature indicators, and the edges represent causal dependency relationships between the nodes, and the causal dependency relationships are represented by causal weights w ij . The causal weights w ij are determined by performing Granger causality test on the target observation time series data in a historical attack-free period.

[0032] A causal consistency analysis module is configured to calculate a causal consistency score based on the target observation time series data and compare the causal consistency score with a preset threshold.

[0033] An attack detection module is configured to generate a DDoS attack warning when the causal consistency score is lower than the preset threshold, and call a suspicious source identification module to generate a suspicious source set.

[0034] A suspicious source identification module is configured to identify and output a suspicious source set based on the target observation time series data and the causal relationship graph.

[0035] A traction rule generation module is configured to generate traction rules based on the suspicious source set to perform attack defense.

[0036] The advantages of the present application over the prior art are that the present application effectively captures the stable dependency relationship between different traffic characteristics under normal state of the network by constructing a causal relationship graph based on multi-source traffic characteristics and introducing a calculation method of causal consistency score, and quickly identifies when the dependency relationship deviates significantly due to an attack. This method can use multi-dimensional time series characteristics to jointly judge at the early stage of the attack, improving the accuracy and real-time performance of detection. Further, the present application generates a suspicious source set and combines asynchronous cooperative time series signatures to identify cooperative sources, so that the defense strategy can not only target a single suspicious source, but also cover attack source groups that cooperate with each other, thereby improving the coverage range and defense effect of the traction strategy. At the same time, the present application considers minimizing the impact on normal business while intercepting malicious traffic when generating the traction rules, achieving a balance between attack interception and business continuity. In summary, the present application can complete the defense action with high accuracy and low business interference in a complex and variable DDoS attack environment, and is suitable for real-time protection needs of operators and large platforms. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is the overall flowchart of the present application;

[0038] Figure 2 is the flowchart of the suspicious source set generation of the present application;

[0039] Figure 3 is the flowchart of the cooperative source set generation of the present application. DETAILED DESCRIPTION

[0040] The specific embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0041] As Figure 1 shown is the overall flowchart of the present application, including the following steps:

[0042] Collect target observation time series data, which is a statistical index sequence within a fixed time interval, including domain name resolution request rate time series, transmission layer connection establishment rate time series and application layer request rate time series;

[0043] Construct a causal relationship graph, which is composed of nodes and edges, where the nodes represent network traffic characteristic indicators, and the edges represent the causal dependency relationship between the nodes, determined by the causal weight w ij identified, the causal weight w ij is determined by performing Granger causality test on the target observation time series data in the history attack-free period;

[0044] The causal consistency score is calculated based on the target observation time series data and compared with a preset threshold. When the causal consistency score is lower than the preset threshold, a DDoS attack warning is generated, a suspicious source set is generated, and a traction rule is generated based on the suspicious source set for attack defense.

[0045] More specifically, the application first collects target observation time series data from network devices, specifically including network traffic indicator sequences counted within fixed time intervals. These indicator sequences are divided into three categories: domain name resolution request rate time series, transport layer connection establishment rate time series, and application layer request rate time series. The collection time interval of each type of time series data can be set to 1 second to capture the dynamic changes of network traffic while ensuring that the data granularity is sufficient to reflect potential attack behavior.

[0046] Domain name resolution request rate time series reflects the dynamic changes of domain name system resolution requests per unit time. In specific implementation, by monitoring the DNS server log, the number of resolution requests and the number of failed resolution requests in each time interval are extracted. For example, in a 1-second time window, the total number of DNS queries received and the number of failed queries due to timeout or error are recorded. The inclusion of the number of failed resolution requests helps to identify abnormal DNS amplification attack patterns.

[0047] Transport layer connection establishment rate time series mainly focuses on the connection establishment behavior of transport layer protocols, specifically including the number of SYN messages, the number of new connections, and the number of UDP messages in the TCP protocol. In implementation, by deploying traffic sniffing tools such as libpcap-based traffic analysis modules on network border devices, these indicators are captured and counted in real time. For example, an abnormal surge in the number of SYN messages may indicate a SYN flood attack, while an abnormal pattern in the number of UDP messages may be related to a UDP reflection attack.

[0048] Application layer request rate time series records the number of application layer requests received per unit time and the number of error responses, such as the total number of HTTP requests and the number of error responses with return status codes 4xx or 5xx. In implementation, these data are extracted through web server logs or application layer gateway traffic statistics modules. For example, in high-frequency HTTP requests, a significant increase in the proportion of error responses may indicate an application layer DDoS attack.

[0049] To ensure data quality, the collected time series data needs to be preprocessed, including missing value filling and outlier removal. Missing values are filled by linear interpolation method, and outliers are removed by statistical method based on 3σ principle. In addition, data normalization processing uses minimum-maximum normalization to map each indicator sequence to the range of 0 to 1, facilitating subsequent causal analysis and comparison.

[0050] The causal graph is used to capture the causal dependency between network traffic feature indicators. The nodes in the graph represent network traffic feature indicators, such as domain name resolution request rate, SYN packet number, etc.; the edges represent the causal relationship between the nodes, represented by the causal weight w ij Quantization. The weight w ij is calculated by Granger causality test on the target observation time series data in the historical non-attack period.

[0051] In some embodiments, the historical non-attack period can be selected as the latest 30 days of normal operation of the system, excluding known attack events. Granger causality test is based on lag analysis of time series to determine whether a certain indicator sequence x i has predictive ability for another indicator sequence x j . The test process includes the following steps:

[0052] 1. For each indicator sequence pair (x i , x j ), select the maximum lag order L (recommended range is 1 to 10, specific value is determined according to the autocorrelation of the time series, usually L = 5).

[0053] 2. Build a vector autoregressive model and compare the prediction errors with and without the lagged term x i . i

[0054] 3. Calculate the p-value by F-test, if the p-value is less than the significance level a (usually 0.05), it is confirmed that x i has a causal relationship with x j .

[0055] 4. The causal weight w ij is defined as 1-p-value, representing the strength of the causal relationship, ranging from 0 to 1, the larger the value, the more significant the causal relationship.

[0056] For example, if the increase in DNS resolution request rate significantly leads to the increase in SYN packet number 2 seconds later, the edge weight w i of the (x j , x ij ) pair is high. The final generated causal graph is stored in the form of an adjacency matrix, with matrix elements w ij , and the edge weight of non-causal relationship is set to 0.

[0057] Based on the target observation time series data, the system calculates the causal consistency score for detecting DDoS attacks. The score formula is:

[0058]

[0059] ​where E denotes the set of edges in the causal graph, w ij denotes the causal weight of edge (i, j), x i (t) denotes the time series of the i-th network traffic feature in the target observation time series data, p(·) denotes the Pearson correlation coefficient, τ ij denotes the optimal lag that maximizes the Pearson correlation coefficient on edge (i, j), S c denotes the causal consistency score.

[0060] The core of the formula design is to measure whether the correlation between current network traffic features is consistent with the historical causal relationship in normal periods. The Pearson correlation coefficient p(x i (t), x j (t-τ ij )) quantifies the correlation between the index sequences of nodes i and j under the optimal lag τ ij , ranging from -1 to 1. The weight w ij ensures that edges with stronger causal relationships contribute more to the score. The denominator Σ (i，j)∈E w ij normalizes the score, making S c range between -1 and 1, facilitating comparison with the preset threshold.

[0061] The optimal lag τ ij is determined by searching for the τ value that maximizes the Pearson correlation coefficient p within the lag range [-10, 10] seconds. The choice of the lag range is based on the typical response time of network traffic, such as the delay from DNS query to SYN packet, which is usually within a few seconds. The weighted average design in the formula takes into account the relative importance of different causal relationships, avoiding the excessive influence of a single indicator on the score.

[0062] In some embodiments, the real-time collected time series data is processed in a sliding window form, with a window length of 60 seconds and a step size of 1 second. For each edge (i, j), the Pearson correlation coefficient of x i (t) and x j (t-τ ij ) is calculated within the current window. The preset threshold range of S c can be selected as 0.6 to 0.8, and the specific value is adjusted according to the volatility of the normal traffic baseline. If S c is below the threshold, for example, S c <0.7, it is considered that the network traffic pattern deviates from normal, triggering a DDoS attack warning.

[0063] For example, under normal circumstances, the DNS resolution request rate and the number of SYN packets have a correlation coefficient of 0.9 under a 2-second lag, while during an attack, it may drop to 0.3, causing S c to drop significantly, triggering a warning.

[0064] like Figure 2 As shown, after detecting a DDoS attack, the system generates a set of suspicious sources by analyzing source identifiers. Source identifiers are typically IP addresses or network address prefixes.

[0065] In a specific embodiment, the generation process is as follows:

[0066] 1. Within a preset time window of 60 seconds, extract the corresponding time sequence segments for each source identifier s, including the sequence of indicators such as DNS resolution request rate and SYN packet count.

[0067] 2. For each edge (i,j) in the causal relationship graph, at the optimal lag... Align the index sequences of nodes i and j below and calculate the current Pearson correlation coefficient.

[0068] 3. Compare the current correlation coefficient with the baseline correlation coefficient during historical periods without attacks. Compare and calculate the temporal consistency difference:

[0069]

[0070] in, and For the index sequence of source s, To be the optimal lag, This represents the baseline correlation coefficient.

[0071] 4. If the difference between any side (i, j) is greater than the preset difference threshold (for example, in some embodiments the range can be set to 0.2 to 0.4, and the typical value is 0.3), then the source s is included in the suspicious source set.

[0072] Temporal consistency variance measures the deviation of the traffic pattern from the normal baseline in source S. Baseline correlation coefficient Calculations are performed using long-term data from historical attack-free periods to reflect stable relationships under normal traffic conditions. A difference greater than a threshold indicates abnormal traffic behavior from source s, potentially indicating involvement in an attack. For example, if the correlation between a given IP's DNS resolution requests and SYN packets deviates significantly from the baseline, it may indicate abnormal traffic originating from that IP.

[0073] like Figure 3 As shown, to further identify coordinated attack behavior, the system identifies N sources {s1, ..., s2} in the suspicious source set. N Perform collaborative analysis to generate a set of collaborative sources. The specific steps are as follows:

[0074] For N source identifiers {s1, ..., s2} within the suspicious source set N}, the cooperative source set is generated according to the following steps:

[0075] For each source identifier s k , the corresponding target observation time series data is obtained, and the peak lag of the cross-correlation function is calculated with the target observation time series data of the remaining source identifiers s m (m≠k) in a fixed-length time window, to obtain a set of phase delay values {τ k，m}; wherein the peak lag of the cross-correlation function refers to the τ that obtains the maximum value after calculating the cross-correlation function C xy (τ) of two time series at different time offsets, which reflects the average delay size and direction of the changes in one sequence appearing in another sequence. Since the target observation time series data may contain multiple indicators, one indicator can be selected for calculation, or the mean of τ can be taken after multiple indicator calculations.

[0076] A preset delay range [-T, T] is set and equally divided into M delay intervals {I1, …, I M}, and each τ k，m is counted and accumulated according to the interval it falls into, to form a count vector with a length of M;

[0077] The count vector is normalized according to the number of source pairs (N-1) to obtain a phase delay histogram vector H k corresponding to the source identifier s k ;

[0078] The phase delay histogram vectors {H1, …, H N} corresponding to all source identifiers in the suspicious source set are input into a density clustering algorithm, and are aggregated according to vector similarity to obtain multiple cooperative source sets, each cooperative source set being composed of source identifiers with similar phase delay histogram vectors and belonging to a subset of the suspicious source set;

[0079] The source identifiers in the cooperative source set are subjected to priority defense processing.

[0080] In some embodiments, assuming that the suspicious source set contains IP1, IP2 and IP3, the phase delay histogram vectors show that the delay patterns of IP1 and IP2 are highly similar, and the clustering algorithm classifies them into the same cooperative source set, which may indicate that they may belong to the same attack group. The priority defense processing is performed on the cooperative source set, and a more stringent traffic restriction is adopted.

[0081] Based on the suspicious source set (or the collaborative source set), the system generates traffic traction rules for issuing to upstream network devices, such as routers or firewalls. The traction rules include network address prefix matching rules, port matching rules, and protocol matching rules. For example, for the suspicious IP prefix 10.0.0.0 / 24, a rule is generated to limit the traffic of its TCP 80 port.

[0082] Within a 60-second time window, the system performs a simulation evaluation on each traction rule based on the traffic records, and calculates the proportion of traffic hitting the suspicious sources. The top A rules (A is recommended to be 5 to 10) in the hit proportion are selected as candidate rules. The evaluation uses a traffic log analysis tool to calculate the percentage of traffic hitting the source identifiers in the suspicious source set, to ensure the effectiveness of the rules.

[0083] The setting of the traction rules can provide early defense for future suspicious traffic, not only for the source identifiers identified in the suspicious source set, but also for future attacks.

[0084] The application also includes a DDoS attack defense system, comprising:

[0085] A data collection module for collecting target observation time series data, the target observation time series data being a statistical index sequence within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series, and application layer request rate time series;

[0086] A causal relationship graph construction module for constructing a causal relationship graph based on the target observation time series data, the causal relationship graph being composed of nodes and edges, the nodes representing network traffic feature indicators, and the edges representing causal dependency relationships between the nodes, the causal dependency relationships being represented by causal weights w ij ; The causal weights w ij are determined by Granger causality test on the target observation time series data in a historical non-attack period;

[0087] A causal consistency analysis module for calculating a causal consistency score based on the target observation time series data, and comparing the causal consistency score with a preset threshold;

[0088] An attack detection module for generating a DDoS attack warning when the causal consistency score is lower than the preset threshold, and calling a suspicious source identification module to generate a suspicious source set;

[0089] A suspicious source identification module for identifying and outputting a suspicious source set based on the target observation time series data and the causal relationship graph;

[0090] A traction rule generation module is configured to generate a traction rule based on the suspicious source set to perform attack defense.

[0091] Through the above embodiments, the system of the present application can monitor network traffic in real time, accurately identify DDoS attacks, locate suspicious sources, and effectively defend against attacks through coordinated analysis and precise traction rules to ensure network security.

[0092] The above is only a preferred embodiment of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art within the technical scope disclosed by the present application, according to the technical solution and inventive concept of the present application, can make equivalent replacement or change, which should be covered within the protection scope of the present application.

Claims

1. A multi-source traffic-aware based DDoS attack defense method, characterized in that, The method comprises the following steps: Collect target observation time series data, which is a statistical index sequence in a fixed time interval, including domain name resolution request rate time series, transmission layer connection establishment rate time series and application layer request rate time series; A causal relationship graph is constructed, the causal relationship graph is composed of nodes and edges, the nodes represent network traffic feature indicators, and the edges represent causal dependency relationships between the nodes, and the causal weights w ij The causal weights w ij are determined by performing Granger causality test on the target observation time series data in a historical non-attack period. Based on the target observation time series data, calculate the causal consistency score and compare it with the preset threshold value, when the causal consistency score is lower than the preset threshold value, generate a DDoS attack warning, and generate a suspicious source set, and generate a traction rule based on the suspicious source set for attack defense.

2. The method of claim 1, wherein the method further comprises: The domain name resolution request rate time series is a sequence of the number of resolution requests per unit time interval changing over time, the transmission layer connection establishment rate time series is a sequence of the number of new transmission layer connections per unit time interval changing over time, and the application layer request rate time series is a sequence of the number of application layer requests received per unit time interval changing over time.

3. The method of claim 2, wherein the method further comprises: The domain name resolution request rate time series includes at least one of the number of domain name resolution requests and the number of domain name resolution failures; The transmission layer connection establishment rate time series includes at least one of the number of transmission layer SYN messages per unit time interval, the number of new transmission layer connections per unit time interval, and the number of UDP messages per unit time interval; The application layer request rate time series includes at least one of the number of application layer requests per unit time interval and the number of application layer error responses per unit time interval.

4. The method of claim 1, wherein the method further comprises: The causal consistency score satisfies the formula: where E denotes a set of edges in the causal graph, w ij denotes a causal weight of edge (i,j), x i (t) denotes a time series of the i-th network traffic feature indicator in the target observation time series data, p(·) denotes a Pearson correlation coefficient, t ij denotes an optimal lag quantity that maximizes the Pearson correlation coefficient on edge (i,j), S c denotes the causal consistency score.

5. The method of claim 1, wherein the method further comprises: The generation of the suspicious source set comprises: In a preset time window, for each source identifier, a time sequence segment corresponding to the source identifier is extracted from the target observation time sequence data; for at least one edge (i, j) in the causal relationship graph, the optimal lag quantity of the edge is determined The index sequences corresponding to the node i and the node j in the time sequence segment are aligned and a current Pearson correlation coefficient is calculated; the current Pearson correlation coefficient is compared with a baseline Pearson correlation coefficient of the edge in a historical normal non-attack period to obtain a time sequence consistency difference degree; when the time sequence consistency difference degree of any edge is greater than a preset difference threshold, the source identifier is included in the suspicious source set.

6. The method of claim 5, wherein the method further comprises: The time series consistency difference degree is defined as: wherein, denote the time series of the i-th and j-th network traffic feature indicators corresponding to the source identifier s, respectively, and denote the time series of the i-th and j-th network traffic feature indicators corresponding to the source identifier s, respectively, and is the optimal lag quantity for the edge (i,j), is the baseline Pearson correlation coefficient of the edge in the history attack-free period.

7. The method of claim 1 or 6, wherein the method further comprises: The method further includes: targeting N source identifiers {s1,…,s} within the suspicious source set. N Generate the collaborative source set as follows: For each source identifier s k , its corresponding target observation time series data is obtained, and within a fixed length time window, the peak lag of the cross-correlation function is calculated with the target observation time series data of the remaining source identifiers s m (m≠k), to obtain a set of phase delay values {τ k,m}. A preset delay range [-T, T] is set and equally divided into M delay intervals {I1,..., IM}, and each τ M is obtained k，m The counting is accumulated according to the interval into which it falls, forming a count vector of length M; normalizing the count vector by the number of sources N-1, resulting in a source identification s k one-to-one phase delay histogram vector H k ; identify the corresponding phase delay histogram vector {H1,..., H N} input density clustering algorithm, aggregate by vector similarity, obtain multiple collaborative source sets, each collaborative source set is composed of source identifiers with similar phase delay histogram vectors, and belongs to a subset of the suspicious source set; The source identifiers in the cooperative source set are subjected to priority defense processing.

8. The method of claim 1, wherein the method further comprises: The traction rule is a traffic control rule that can be directly issued to an upstream network device; each traction rule is simulated and evaluated based on traffic records within a preset time window, the proportion of source identifiers in the suspicious source set hit by the traction rule is counted, and the top A traction rules with the highest proportion are selected as candidate traction rules.

9. The method of claim 8, wherein, The traffic control rule includes at least one of a network address prefix matching rule, a port matching rule, and a protocol matching rule.

10. A system for implementing the multi-source traffic-aware based DDoS attack defense system of claim 1, characterized in that, The method comprises the following steps: A data collection module is configured to collect target observation time series data, which is a statistical index sequence in a fixed time interval, including domain name resolution request rate time series, transmission layer connection establishment rate time series and application layer request rate time series; a causal relationship graph construction module configured to construct a causal relationship graph based on the target observation time series data, the causal relationship graph being composed of nodes and edges, a node representing a network traffic feature indicator, and an edge representing a causal dependency relationship between nodes, the causal dependency relationship being represented by a causal weight w ij , the causal weight w ij is determined by performing Granger causality test on the target observation time series data in a historical non-attack period. A causal consistency analysis module is configured to calculate a causal consistency score based on the target observation time series data, and compare the causal consistency score with a preset threshold value; An attack detection module is configured to generate a DDoS attack warning when the causal consistency score is lower than the preset threshold value, and call a suspicious source identification module to generate a suspicious source set; A suspicious source identification module is configured to identify and output a suspicious source set based on the target observation time series data and the causal relationship graph; A traction rule generation module is configured to generate a traction rule based on the suspicious source set for attack defense.

Images