A multi-source flow perception-based DDoS attack defense method and system

Abstract

The application discloses a DDoS attack defense method and system based on multi-source flow perception, relates to the field of DDoS attack defense, and comprises the following steps: collecting target observation time series data, the target observation time series data being a statistical index sequence in a fixed time interval; constructing a causal relationship graph, the causal relationship graph being composed of nodes and edges, the nodes representing network flow characteristic indexes, and the edges representing the causal dependence relationship between the nodes; calculating a causal consistency score based on the target observation time series data and comparing the causal consistency score with a preset threshold value; when the causal consistency score is lower than the preset threshold value, generating a DDoS attack warning, generating a suspicious source set, and generating a traction rule based on the suspicious source set to perform attack defense. The application can effectively capture the stable dependence relationship between different flow characteristics of a network in a normal state, and quickly identify and defend when the dependence relationship deviates significantly due to an attack.

Description

Technical Field

[0001] This invention relates to the field of DDoS attack defense, and more specifically, to a DDoS attack defense method and system based on multi-source traffic awareness. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks are a type of attack that uses a large number of distributed nodes to simultaneously send network requests to a target that exceed its processing capacity, leading to resource exhaustion or service unavailability of the target system. With the continuous improvement of attack tools and network bandwidth, DDoS attacks are becoming increasingly diversified and intelligent. Attack traffic not only comes from various sources but also often exhibits suddenness, camouflage, and coordination. This makes it difficult for defense methods relying solely on single traffic characteristics or single detection points to identify and intercept attacks in a timely and accurate manner. Furthermore, the attack process often causes changes in the causal relationships between traffic characteristics at different levels. For example, when launching large-scale attacks directly through IP addresses, the temporal dependency between domain name resolution traffic and subsequent application layer accesses may be significantly weakened or distorted. These changes in causal relationships are difficult to effectively capture in traditional defense systems, especially in scenarios requiring rapid anomaly identification and upstream interception. Therefore, unified analysis of multi-source traffic characteristics and causal correlation detection have become urgent problems to be solved. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a DDoS attack defense method and system based on multi-source traffic awareness, so as to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] A DDoS attack defense method based on multi-source traffic awareness includes:

[0006] Collect target observation time series data, which is a sequence of statistical indicators within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series and application layer request rate time series;

[0007] Construct a causal relationship graph, which consists of nodes and edges. Nodes represent network traffic characteristic indicators, and edges represent causal dependencies between nodes, weighted by causal weights w. ij Identifier, the causal weight w ij The target was determined by performing Granger causality tests on the time-series observation data of the target during historical periods without attacks.

[0008] A causal consistency score is calculated based on the target observation time series data and compared with a preset threshold. When the causal consistency score is lower than the preset threshold, a DDoS attack warning is generated, a set of suspicious sources is generated, and a traction rule is generated based on the set of suspicious sources to defend against the attack.

[0009] In some embodiments, the domain name resolution request rate timing is a sequence of the number of resolution requests changing over time within a unit time interval, the transport layer connection establishment rate timing is a sequence of the number of newly established transport layer connections changing over time within a unit time interval, and the application layer request rate timing is a sequence of the number of application layer requests received changing over time within a unit time interval.

[0010] In some embodiments, the domain name resolution request rate timing includes at least one of the number of domain name resolution requests and the number of domain name resolution failures;

[0011] The transport layer connection establishment rate timing includes at least one of the following: the number of transport layer SYN packets, the number of newly established transport layer connections, and the number of UDP packets within a unit time interval.

[0012] The application layer request rate timing includes at least one of the following: the number of application layer requests per unit time interval and the number of application layer error responses.

[0013] In some embodiments, the causal consistency score satisfies the formula:

[0014]

[0015] Where E represents the set of edges in the causal relationship graph, w ij Let x represent the causal weight of edge (i,j). i (t) represents the time series of the i-th network traffic characteristic indicator in the target observation time series data, ρ(·) represents the Pearson correlation coefficient, and τ ij S represents the optimal lag that maximizes the Pearson correlation coefficient on edge (i,j). c This represents the causal consistency score.

[0016] In some embodiments, the generation of the suspicious source set includes:

[0017] Within a preset time window, for each source identifier, extract the time series segment corresponding to the source identifier from the target observation time series data; for at least one edge (i, j) in the causal relationship graph, determine the optimal lag amount for that edge. The index sequences corresponding to nodes i and j in the time segment are down-aligned and the current Pearson correlation coefficient is calculated; the current Pearson correlation coefficient is compared with the baseline Pearson correlation coefficient of the edge during the historical normal attack-free period to obtain the time consistency difference; when the time consistency difference of any edge is greater than the preset difference threshold, the source identifier is included in the suspicious source set.

[0018] In some embodiments, the timing consistency difference is defined as:

[0019]

[0020] in, and Let represent the time series of the i-th and j-th network traffic characteristic indicators corresponding to the source identifier s, respectively, and ρ(·) represent the Pearson correlation coefficient. Let be the optimal hysteresis of the edge (i,j). Let be the baseline Pearson correlation coefficient of the edge during the historical period without attacks.

[0021] In some embodiments, the method further includes: targeting N source identifiers {s1,…,s} within a suspicious source set. N Generate the collaborative source set as follows:

[0022] For each source identifier s k Obtain the corresponding target observation time series data, and within a fixed-length time window, compare it with the other source identifiers s. m The peak value of the cross-correlation function of the target observation time series data (m≠k) is calculated, and a set of phase delay values ​​{τ} is obtained. k,m};

[0023] Set a preset delay range [-T, T] and divide it into M equal delay intervals {I1, ..., I... M}, for each τ obtained k,m The counts are accumulated according to the intervals they fall into, forming a counting vector of length M;

[0024] The counting vector is normalized according to the number of sources (N-1) to obtain the result with respect to the source identifier s. k One-to-one corresponding phase delay histogram vector H k ;

[0025] The phase delay histogram vectors {H1,…,H} corresponding to all source identifiers within the suspected source set are used to... N The input density clustering algorithm aggregates the data based on vector similarity to obtain multiple co-source sets. Each co-source set consists of source identifiers with similar phase delay histogram vectors and belongs to a subset of the suspected source set.

[0026] Prioritize the defense of source identifiers within the collaborative source set.

[0027] In some embodiments, the towing rule is a traffic control rule that can be directly issued to the upstream network device; within a preset time window, each towing rule is simulated and evaluated based on traffic records, the proportion of the towing rule hitting the source identifier of the suspicious source set is counted, and the towing rule with the highest proportion of the A rules is selected as the candidate towing rule.

[0028] In some embodiments, the flow control rules include at least one of network address prefix matching rules, port matching rules, and protocol matching rules.

[0029] This invention also discloses a DDoS attack defense system based on multi-source traffic awareness, comprising:

[0030] The data acquisition module is used to collect target observation time series data, which is a statistical index sequence within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series and application layer request rate time series.

[0031] The causal relationship graph construction module is used to construct a causal relationship graph based on the target observation time series data. The causal relationship graph consists of nodes and edges. Nodes represent network traffic characteristic indicators, and edges represent causal dependencies between nodes. The causal dependencies are determined by causal weights w. ij This indicates that the causal weight w ij The target was determined by performing Granger causality tests on the time-series observation data of the target during historical periods without attacks.

[0032] The causal consistency analysis module is used to calculate the causal consistency score based on the target observation time series data and compare the causal consistency score with a preset threshold.

[0033] The attack detection module is used to generate a DDoS attack warning when the causal consistency score is lower than the preset threshold, and to call the suspicious source identification module to generate a suspicious source set.

[0034] The suspicious source identification module is used to identify and output a set of suspicious sources based on the target observation time series data and the causal relationship map;

[0035] The traction rule generation module is used to generate traction rules based on the set of suspicious sources to perform attack defense.

[0036] The advantages of this invention over existing technologies lie in its ability to effectively capture stable dependencies between different traffic characteristics under normal network conditions by constructing a causal relationship graph based on multi-source traffic characteristics and introducing a causal consistency score calculation method. This allows for rapid identification when attacks cause significant deviations in these dependencies. The method leverages multi-dimensional temporal features for joint judgment in the early stages of an attack, improving detection accuracy and real-time performance. Furthermore, by generating a set of suspicious sources and combining asynchronous collaborative temporal signatures to identify cooperating sources, the invention enables defense strategies to target not only individual suspicious sources but also coordinated attack source groups, thereby enhancing the coverage and effectiveness of the redirection strategy. Simultaneously, the invention considers minimizing the impact on normal services while intercepting malicious traffic when generating redirection rules, achieving a balance between attack interception and service continuity. In summary, this invention can perform defense actions with high accuracy and low service interference in complex and ever-changing DDoS attack environments, making it suitable for the real-time protection needs of operators and large platforms. Attached Figure Description

[0037] Figure 1 This is the overall flowchart of the present invention;

[0038] Figure 2 This is a flowchart illustrating the generation of the suspected source set in this invention;

[0039] Figure 3 This is a flowchart of the collaborative source set generation process of the present invention. Detailed Implementation

[0040] The specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0041] like Figure 1 The above is a general flowchart of the present invention, which includes the following steps:

[0042] Collect target observation time series data, which is a sequence of statistical indicators within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series and application layer request rate time series;

[0043] Construct a causal relationship graph, which consists of nodes and edges. Nodes represent network traffic characteristic indicators, and edges represent causal dependencies between nodes, weighted by causal weights w. ij Identifier, the causal weight w ij The target was determined by performing Granger causality tests on the time-series observation data of the target during historical periods without attacks.

[0044] A causal consistency score is calculated based on the target observation time series data and compared with a preset threshold. When the causal consistency score is lower than the preset threshold, a DDoS attack warning is generated, a set of suspicious sources is generated, and a traction rule is generated based on the set of suspicious sources to defend against the attack.

[0045] More specifically, this invention first collects target observation time-series data from network devices, specifically including sequences of network traffic indicators statistically analyzed at fixed time intervals. These indicator sequences are divided into three categories: domain name resolution request rate time-series, transport layer connection establishment rate time-series, and application layer request rate time-series. The collection time interval for each type of time-series data can be set to 1 second to capture dynamic changes in network traffic while ensuring that the data granularity is sufficient to reflect potential attack behaviors.

[0046] Domain name resolution request rate timing reflects the dynamic changes in DNS resolution requests per unit of time. In practice, this is achieved by monitoring DNS server logs and extracting the number of resolution requests and failures within each time interval. For example, within a one-second time window, the total number of received DNS queries and the number of queries that failed due to timeouts or errors are recorded. Including the number of resolution failures helps identify anomalous DNS amplification attack patterns.

[0047] The transport layer connection establishment rate timing primarily focuses on the connection establishment behavior of transport layer protocols, specifically the number of SYN packets, the number of newly established connections, and the number of UDP packets in the TCP protocol. In implementation, these metrics are captured and statistically analyzed in real time using traffic sniffing tools deployed on network boundary devices, such as a libpcap-based traffic analysis module. For example, an abnormal surge in the number of SYN packets may indicate a SYN flood attack, while an abnormal pattern in the number of UDP packets may be related to a UDP reflection attack.

[0048] The application layer request rate time series records the number of application layer requests received per unit of time and the number of their error responses, such as the total number of HTTP requests and the number of error responses returning status codes 4xx or 5xx. In implementation, this data is extracted from web server logs or the traffic statistics module of the application layer gateway. For example, a significant increase in the proportion of error responses in high-frequency HTTP requests may indicate an application layer DDoS attack.

[0049] To ensure data quality, the collected time-series data needs to be preprocessed, including missing value imputation and outlier removal. Missing values ​​are imputed using linear interpolation, while outliers are removed using statistical methods based on the 3σ principle. Furthermore, data normalization employs min-max normalization, mapping each indicator sequence to a range of 0 to 1, facilitating subsequent causal analysis and comparison.

[0050] Causal graphs are used to capture the causal dependencies between network traffic characteristic indicators. Nodes in the graph represent network traffic characteristic indicators, such as DNS resolution request rate and SYN packet count; edges represent the causal relationships between nodes, determined by causal weights w. ij Quantification. Weight w ij Granger causality tests were performed on the target observation time series data during historical periods without attacks.

[0051] In some embodiments, the historical attack-free period can be selected as the most recent 30 days of data during which the system operated normally, excluding known attack events. The Granger causality test, based on lag analysis of time series, determines the causality of a certain indicator sequence x. i Is it for another index sequence x j It has predictive power. The verification process includes the following steps:

[0052] 1. For each index sequence pair (x i ,x j Choose the maximum lag order L (the recommended range is 1 to 10, and the specific value is determined based on the autocorrelation of the time series, usually L = 5).

[0053] 2. Construct a vector autoregressive model and compare models containing x. i Lag terms and terms not containing x i Prediction error of the lagged term.

[0054] 3. Calculate the p-value using the F-test. If the p-value is less than the significance level α (usually taken as 0.05), then x is considered normal. i For x j A causal relationship exists.

[0055] 4. Causal weight w ij Defined as a 1-p value, it represents the strength of a causal relationship, ranging from 0 to 1. The larger the value, the more significant the causal relationship.

[0056] For example, if an increase in the DNS resolution request rate significantly causes an increase in the number of SYN packets after 2 seconds, then (x i ,x j The corresponding edge weight w ij The final causal relationship graph is stored in the form of an adjacency matrix, with matrix elements w. ij The weight of edges that are not causal are set to 0.

[0057] Based on the target observation time-series data, the system calculates a causal consistency score to detect DDoS attacks. The scoring formula is:

[0058]

[0059] Where E represents the set of edges in the causal relationship graph, w ij Let x represent the causal weight of edge (i,j). i (t) represents the time series of the i-th network traffic characteristic indicator in the target observation time series data, ρ(·) represents the Pearson correlation coefficient, and τ ij S represents the optimal lag that maximizes the Pearson correlation coefficient on edge (i,j). c This represents the causal consistency score.

[0060] The core of this formula is to measure whether the correlation between current network traffic characteristics is consistent with the causal relationship during historical normal periods. The Pearson correlation coefficient ρ(x) i (t),x j (t-τ ij The index sequences of nodes i and j were quantified at the optimal lag τ. ij The correlation is between -1 and 1. Weight w ij Ensure that edge pairs with stronger causal relationships contribute more to the score. Denominator ∑ (i，j)∈E w ij Normalize the score so that S c The range is between -1 and 1, which facilitates comparison with preset thresholds.

[0061] Optimal hysteresis τ ij The τ value is determined by searching for the maximum Pearson correlation coefficient ρ within a lag range of [-10, 10] seconds. The lag range is chosen based on typical network traffic response times; for example, the delay for a DNS query to a SYN packet is typically within several seconds. The weighted average design in the formula considers the relative importance of different causal relationships, avoiding the excessive influence of a single indicator on the score.

[0062] In some embodiments, the real-time acquired time-series data is processed in the form of a sliding window, with a window length of 60 seconds and a step size of 1 second. For each edge (i, j), the x value within the current window is calculated. i (t) and x j (t-τ ij The Pearson correlation coefficient of S. c The preset threshold range can be selected from 0.6 to 0.8, and the specific value should be adjusted according to the fluctuation of the normal flow baseline. If S c Below a threshold, for example, S c If the value is less than 0.7, the network traffic pattern is considered to be abnormal, triggering a DDoS attack warning.

[0063] For example, under normal circumstances, the correlation coefficient between the DNS resolution request rate and the number of SYN packets with a 2-second lag is 0.9, but during an attack, it may drop to 0.3, causing the S... c A significant decrease has triggered a warning.

[0064] like Figure 2 As shown, after detecting a DDoS attack, the system generates a set of suspicious sources by analyzing source identifiers. Source identifiers are typically IP addresses or network address prefixes.

[0065] In a specific embodiment, the generation process is as follows:

[0066] 1. Within a preset time window of 60 seconds, extract the corresponding time sequence segments for each source identifier s, including the sequence of indicators such as DNS resolution request rate and SYN packet count.

[0067] 2. For each edge (i,j) in the causal relationship graph, at the optimal lag... Align the index sequences of nodes i and j below and calculate the current Pearson correlation coefficient.

[0068] 3. Compare the current correlation coefficient with the baseline correlation coefficient during historical periods without attacks. Compare and calculate the temporal consistency difference:

[0069]

[0070] in, and For the index sequence of source s, To be the optimal lag, This represents the baseline correlation coefficient.

[0071] 4. If the difference between any side (i, j) is greater than a preset difference threshold (e.g., in some embodiments the range can be set to 0.2 to 0.4, with a typical value of 0.3), then the source s is included in the suspicious source set.

[0072] Temporal consistency variance measures the deviation of the traffic pattern from the normal baseline in source S. Baseline correlation coefficient. Calculations are performed using long-term data from historical attack-free periods to reflect stable relationships under normal traffic conditions. A difference greater than a threshold indicates abnormal traffic behavior from source s, potentially indicating involvement in an attack. For example, if the correlation between a given IP's DNS resolution requests and SYN packets deviates significantly from the baseline, it may indicate abnormal traffic originating from that IP.

[0073] like Figure 3 As shown, to further identify coordinated attack behavior, the system identifies N sources {s1, ..., s2} in the suspicious source set. N Perform collaborative analysis to generate a set of collaborative sources. The specific steps are as follows:

[0074] For N source identifiers {s1, ..., s2} within the suspicious source set NGenerate the collaborative source set as follows:

[0075] For each source identifier s k Obtain the corresponding target observation time series data, and within a fixed-length time window, compare it with the other source identifiers s. m The peak value of the cross-correlation function of the target observation time series data (m≠k) is calculated, and a set of phase delay values ​​{τ} is obtained. k，m}; where the lag at which the peak of the cross-correlation function is located refers to the lag at which the cross-correlation function C is calculated for two time series at different time offsets. xy The τ that reaches its maximum value after (τ) reflects the average magnitude and direction of the delay in the occurrence of changes in one sequence in another sequence. Since the target observation time series data may contain multiple indicators, one indicator can be selected for calculation, or the average of τ can be taken after calculating multiple indicators.

[0076] Set a preset delay range [-T, T] and divide it into M equal delay intervals {I1, ..., I...} M}, for each τ obtained k，m The counts are accumulated according to the intervals they fall into, forming a counting vector of length M;

[0077] The counting vector is normalized according to the number of sources (N-1) to obtain the result with respect to the source identifier s. k One-to-one corresponding phase delay histogram vector H k ;

[0078] The phase delay histogram vectors {H1, ..., H1} corresponding to all source identifiers within the suspected source set are used to... N The input density clustering algorithm aggregates the data based on vector similarity to obtain multiple co-source sets. Each co-source set consists of source identifiers with similar phase delay histogram vectors and belongs to a subset of the suspected source set.

[0079] Prioritize the defense of source identifiers within the collaborative source set.

[0080] In some embodiments, it is assumed that the suspicious source set includes IP1, IP2, and IP3. Their phase delay histogram vectors show that IP1 and IP2 have highly similar delay patterns. Clustering algorithms group them into the same cooperating source set, potentially indicating that they belong to the same attack group. Priority defense processing targets the cooperating source set, employing stricter traffic restrictions.

[0081] Based on a set of suspicious sources (or a set of cooperating sources), the system generates traffic redirection rules to be sent to upstream network devices, such as routers or firewalls. These redirection rules include network address prefix matching rules, port matching rules, and protocol matching rules. For example, for a suspicious IP prefix of 10.0.0.0 / 24, a rule is generated to restrict traffic on its TCP port 80.

[0082] Within a 60-second time window, the system simulates and evaluates each torrent rule based on traffic records, calculating the percentage of traffic that hits a suspicious source. The top A rules (recommended A is 5 to 10) with the highest hit rates are selected as candidate rules. The evaluation uses traffic log analysis tools to calculate the percentage of traffic hitting the identified sources within the suspicious source set, ensuring the rule's effectiveness.

[0083] The setting of this traffic redirection rule can provide early defense against suspicious traffic, not only against source identifiers already identified in the suspicious source set, but also against potential future attacks.

[0084] The present invention also includes a DDoS attack defense system for implementing the above, comprising:

[0085] The data acquisition module is used to collect target observation time series data, which is a statistical index sequence within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series and application layer request rate time series.

[0086] The causal relationship graph construction module is used to construct a causal relationship graph based on the target observation time series data. The causal relationship graph consists of nodes and edges. Nodes represent network traffic characteristic indicators, and edges represent causal dependencies between nodes. The causal dependencies are determined by causal weights w. ij This indicates that the causal weight w ij The target was determined by performing Granger causality tests on the time-series observation data of the target during historical periods without attacks.

[0087] The causal consistency analysis module is used to calculate the causal consistency score based on the target observation time series data and compare the causal consistency score with a preset threshold.

[0088] The attack detection module is used to generate a DDoS attack warning when the causal consistency score is lower than the preset threshold, and to call the suspicious source identification module to generate a suspicious source set.

[0089] The suspicious source identification module is used to identify and output a set of suspicious sources based on the target observation time series data and the causal relationship map;

[0090] The traction rule generation module is used to generate traction rules based on the set of suspicious sources to perform attack defense.

[0091] Through the above implementation methods, the system of the present invention can monitor network traffic in real time, accurately identify DDoS attacks, locate suspicious sources, and effectively defend against attacks through collaborative analysis and precise traffic redirection rules, thereby ensuring network security.

[0092] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A DDoS attack defense method based on multi-source traffic awareness, characterized in that, include: Collect target observation time series data, which is a sequence of statistical indicators within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series and application layer request rate time series; Construct a causal relationship graph, which consists of nodes and edges. Nodes represent network traffic characteristic indicators, and edges represent causal dependencies between nodes, weighted by causal factors. Identifier, the causal weight The target was determined by performing Granger causality tests on the time-series observation data of the target during historical periods without attacks. A causal consistency score is calculated based on the target observation time series data and compared with a preset threshold. When the causal consistency score is lower than the preset threshold, a DDoS attack warning is generated, a set of suspicious sources is generated, and a traction rule is generated based on the set of suspicious sources to defend against the attack. The causal consistency score satisfies the formula: ； in E This represents the set of edges in the causal relationship graph. Representing an edge Causal weights Indicating the target observation time series data, the first... i Time series of network traffic characteristic indicators This represents the Pearson correlation coefficient. Indicates on the edge The optimal lag that maximizes the Pearson correlation coefficient. This represents the causal consistency score.

2. The DDoS attack defense method based on multi-source traffic awareness according to claim 1, characterized in that, The domain name resolution request rate timing sequence is a sequence of the number of resolution requests changing over time within a unit time interval; the transport layer connection establishment rate timing sequence is a sequence of the number of newly established transport layer connections changing over time within a unit time interval; and the application layer request rate timing sequence is a sequence of the number of application layer requests received changing over time within a unit time interval.

3. The DDoS attack defense method based on multi-source traffic awareness according to claim 2, characterized in that, The domain name resolution request rate timing includes at least one of the number of domain name resolution requests and the number of domain name resolution failures; The transport layer connection establishment rate timing includes at least one of the following: the number of transport layer SYN packets, the number of newly established transport layer connections, and the number of UDP packets within a unit time interval. The application layer request rate timing includes at least one of the following: the number of application layer requests per unit time interval and the number of application layer error responses.

4. The DDoS attack defense method based on multi-source traffic awareness according to claim 1, characterized in that, The generation of the suspicious source set includes: Within a preset time window, for each source identifier, extract the time series segment corresponding to the source identifier from the target observation time series data; for at least one edge (i, j) in the causal relationship graph, determine the optimal lag amount for that edge. The timing segment corresponding to the node is aligned below. i With nodes j The index sequence is calculated and the current Pearson correlation coefficient is obtained; the current Pearson correlation coefficient is compared with the baseline Pearson correlation coefficient of the edge during the historical normal attack-free period to obtain the temporal consistency difference; when the temporal consistency difference of any edge is greater than the preset difference threshold, the source identifier is included in the suspicious source set.

5. The DDoS attack defense method based on multi-source traffic awareness according to claim 4, characterized in that, The temporal consistency difference is defined as follows: ； in, and Representing the source identifier s The corresponding number i With the j Time series of network traffic characteristic indicators This represents the Pearson correlation coefficient. For the edge The optimal lag. Let be the baseline Pearson correlation coefficient of the edge during the historical period without attacks.

6. The DDoS attack defense method based on multi-source traffic awareness according to claim 1 or 5, characterized in that, The method further includes: targeting N source identifiers within the suspicious source set. Generate the collaborative source set by following these steps: For each source identifier Obtain the corresponding target observation time series data, and within a fixed-length time window, compare it with the data from other source identifiers. , The peak value of the cross-correlation function of the target observation time series data is calculated by the lag, resulting in a set of phase delay values. ; Set a preset delay range [-T, T] and divide it into equal parts. delay intervals For each obtained Count and accumulate the intervals that fall into the range to form a length of... The counting vector; Normalize the count vector according to the number of sources (N-1) to obtain the result with respect to the source identifier. One-to-one corresponding phase delay histogram vector ; The phase delay histogram vectors corresponding to all source identifiers within the suspected source set. The input density clustering algorithm aggregates the data based on vector similarity to obtain multiple co-source sets. Each co-source set consists of source identifiers with similar phase delay histogram vectors and belongs to a subset of the suspected source set. Prioritize the defense of source identifiers within the collaborative source set.

7. The DDoS attack defense method based on multi-source traffic awareness according to claim 1, characterized in that, The traction rule is a traffic control rule that can be directly issued to upstream network devices. Within a preset time window, each traction rule is simulated and evaluated based on traffic records. The proportion of the traction rule that hits the source identifier of the suspicious source set is counted, and the top A traction rules with the highest proportion are selected as candidate traction rules.

8. The DDoS attack defense method based on multi-source traffic awareness according to claim 7, characterized in that, The traffic control rules include at least one of network address prefix matching rules, port matching rules, and protocol matching rules.

9. A system for implementing the DDoS attack defense method based on multi-source traffic awareness as described in claim 1, characterized in that, include: The data acquisition module is used to collect target observation time series data, which is a statistical index sequence within a fixed time interval, including domain name resolution request rate time series, transport layer connection establishment rate time series and application layer request rate time series. The causal relationship graph construction module is used to construct a causal relationship graph based on the target observation time series data. The causal relationship graph consists of nodes and edges. Nodes represent network traffic characteristic indicators, and edges represent causal dependencies between nodes. The causal dependencies are determined by causal weights. This indicates that the causal weights The target was determined by performing Granger causality tests on the time-series observation data of the target during historical periods without attacks. The causal consistency analysis module is used to calculate the causal consistency score based on the target observation time series data and compare the causal consistency score with a preset threshold. The attack detection module is used to generate a DDoS attack warning when the causal consistency score is lower than the preset threshold, and to call the suspicious source identification module to generate a suspicious source set. The suspicious source identification module is used to identify and output a set of suspicious sources based on the target observation time series data and the causal relationship map; The traction rule generation module is used to generate traction rules based on the set of suspicious sources to perform attack defense.

Images