DDoS attack visual detection method based on multi-dimensional feature combination analysis

Abstract

The application discloses a DDoS attack visual detection method based on multi-dimensional feature combination analysis, multi-dimensional traffic feature extraction, a lightweight attack detection model, DDoS attack knowledge graph construction, a graph-constrained attack behavior interpretation large model, attack visual detection display and the like to realize visual detection of network attacks. The application improves the visualization level and reduces the false alarm rate. The multi-dimensional feature combination method and the lightweight security detection model provide rich information for subsequent network attack knowledge graph establishment and professional interpretation based on a large language model. The constructed knowledge graph about network attacks can enhance the rigorousness of the thinking deduction of the large model and reduce the occurrence of model hallucinations. The enhanced large model can make more professional explanations and analyses on existing network attacks, thereby reducing the huge workload of manual attack analysis, and striving for a valuable time window for timely and accurate response to network attacks and deployment of defense.

Description

Technical Field

[0001] This invention relates to the fields of network attack and defense and deep learning, specifically to a DDoS attack visualization detection method based on multi-dimensional feature combination analysis. Background Technology

[0002] With the accelerating pace of digitalization and networking, cybersecurity threats are becoming increasingly severe. Particularly in key industries such as the Internet of Things (IoT), Industrial Internet, and Fintech, DDoS (Distributed Denial of Service) attacks, port scanning, protocol abuse, and malicious botnet propagation are frequent occurrences, seriously impacting the normal operation of information infrastructure. To ensure the secure and stable operation of network systems, numerous network attack detection technologies based on traditional feature rules, statistical methods, machine learning, and even deep learning have been proposed and widely applied. These technologies primarily focus on identifying potential attack behaviors by analyzing features such as protocols, ports, packet lengths, and connection frequencies in network traffic data. However, despite some progress, existing methods still face the following key technical limitations:

[0003] 1. Insufficient visualization capabilities and low response efficiency of security personnel.

[0004] Currently, most attack detection systems only output binary labels of "attack / normal" or structured logs, lacking the ability to visualize and model the context, source path, and behavioral evolution of attack behavior. This makes it difficult for security analysts to understand the full picture, transmission path, and potential consequences of an attack in a short period of time, thus delaying response and handling. Especially when facing complex attack scenarios (such as multi-hop penetration and combined attacks), detection systems lacking graph support struggle to effectively identify attack chains and behavioral logic, leading to frequent false positives and false negatives.

[0005] 2. High false alarm rate; false alarms seriously interfere with safe operation.

[0006] Most current detection models are trained on historically collected traffic data, but real-world environments present complex factors such as data imbalance, data drift, and sudden changes in normal traffic. This often results in poor generalization ability of the trained models in real-world environments, easily misclassifying legitimate high-frequency communication (such as video streams and load fluctuations) as attack behavior. Furthermore, some models fail to properly handle sample imbalance (i.e., the number of normal samples far exceeds the number of attack samples), further causing the model to be biased towards "normal" behavior or mistakenly identify a few abnormal behaviors as attacks. Frequent false alarms not only increase the burden on security personnel but may also lead to "alarm fatigue," causing truly dangerous attacks to be overlooked.

[0007] 3. The test results have poor interpretability and lack supporting basis for decision-making.

[0008] Whether using traditional machine learning or deep learning methods, many models are essentially "black box classifiers," only returning attack result labels (such as "attack traffic" or "normal"), unable to explain their judgment logic or behavioral basis to users. This makes it difficult for security operations personnel to understand the model's decision-making process and to make reasonable judgments and source tracing analyses based on the detection results. In practical applications, the lack of interpretability in decision-making often hinders the implementation of models, especially in scenarios requiring high reliability and strong compliance, such as finance and industrial control. Summary of the Invention

[0009] Purpose of the Invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a DDoS attack visualization detection method based on multi-dimensional feature combination analysis. This invention proposes a comprehensive network attack visualization detection method that integrates data parsing, intelligent detection, graph enhancement, natural language interpretation, and graphical display. The goal is to improve detection accuracy, reduce false alarm rate, and enhance visualization interaction and automatic interpretation capabilities.

[0010] Technical solution: The present invention provides a DDoS attack visualization detection method based on multi-dimensional feature combination analysis, comprising the following steps:

[0011] Step 1: Extracting multidimensional flow features and data preprocessing

[0012] First, obtain the raw network traffic file and parse it to extract raw data packet features such as protocol fields and timestamps at the data packet level, and then aggregate all data packets into a network flow;

[0013] Then, the network flow is segmented according to a preset time window to generate flow segments containing several data packets within the time period; each flow segment is labeled based on built-in label rules or user-defined rules, and sample balancing is achieved through strategies such as downsampling.

[0014] Next, combined features are constructed based on the original data packet features. That is, two or more significant features in the feature vector of each data packet are combined and calculated to form new combined features. The combination methods include feature product, difference or concatenation to form an expanded high-dimensional feature representation.

[0015] Finally, the original data packet features and combined features are concatenated into a high-dimensional input matrix in a unified format, and the sample data is normalized, dimension aligned and format standardized to generate tensor samples with a unified structure for subsequent training and inference of neural network models.

[0016] Step S2: Construct a lightweight attack detection model based on a sequential convolutional neural network. Input the tensor samples from Step 1 into the lightweight attack detection model, extract key temporal features using one-dimensional convolution, and combine activation functions and pooling operations to complete attack classification and judgment, and output the attack detection results.

[0017] Step 3: Construct a DDoS attack knowledge graph

[0018] The DDoS attack-related entities and relationships are extracted from trusted and secure data sources, core elements are identified, and similar entities from different data sources are normalized. Semantic triples are then constructed, and all triples are imported into a graph database to form a basic network attack knowledge graph. Reasoning rules and path indexes are injected into the basic network attack knowledge graph to complete the construction of the DDoS attack knowledge graph, which supports the rapid retrieval of potential attack chains and attack evolution paths in the DDoS attack knowledge graph.

[0019] Step 4: Construct a large-scale model to explain attack behavior under graph constraints.

[0020] A fine-tuning dataset is constructed based on a DDoS attack knowledge graph, covering structured information such as entities, relationships, and attack chains. The dataset is used to supervise and fine-tune a pre-trained large language model, improving its professionalism and causal reasoning ability in attack explanation tasks. In the reasoning stage, the knowledge graph is introduced as an external constraint to exert structural guidance on the generation process of the large language model, suppressing hallucination output, reducing false alarm rate, and generating explanatory text that conforms to security logic.

[0021] Step 5: The attack visualization detection module is used to visualize the above attack detection results. Specifically, it dynamically draws the attack graph based on the DDoS attack knowledge graph, supporting interactive features such as node highlighting, path expansion, and relationship query. It reconstructs the attack timeline by combining data packet timestamp information to show the evolution process of the attack stages. Combined with the natural language interface of the large language model, the attack chain explanation can be displayed by input (such as "display the attack path of a certain IP").

[0022] Furthermore, the specific process of step 1 is as follows:

[0023] Step 1.1: Use the pyshark library to parse the .pcap file packet by packet, removing features that are not conducive to model generalization. The extracted packet features include timestamp, total IP packet length, highest protocol layer name, source / destination port, TCP flags, TTL value, UDP length, ICMP type code, etc., which are uniformly encoded into a fixed-length n-dimensional vector (e.g., 11-dimensional). Fields that do not appear are padded with 0, and redundant fields are removed. All packets are aggregated into network flows in the form of a five-tuple (source IP, source port, destination IP, destination port, and protocol).

[0024] Step 1.2: Divide the data into multiple stream segments according to the sliding time window (e.g., 10 seconds). Each stream segment is treated as an independent sample to improve the temporal awareness and data richness of attack identification.

[0025] The methods for generating labels for stream segments include the following two: (1) Built-in dataset labeling rules: automatically generate attack labels based on known attack / victim IP segments; (2) User-defined configuration: dynamically label the attacker and victim IP network segments by inputting the attacker and victim IP network segments through command line parameters;

[0026] Step 1.3: Combine and calculate the significant features reflecting attack behavior in the feature vector of each original data packet, and select significant features to form new combined features;

[0027] The original features and combined features are concatenated into a high-dimensional input matrix with a unified format. The sample data is then normalized (features are normalized to the [0,1] interval), dimension aligned, and format standardized to generate a model input tensor with a unified structure (format (N, T, F)), which is used for subsequent training and inference of the neural network model.

[0028] In the feature combination construction stage of step 1, any two dimensions of the original data packet features are combined. Perform combined operations ,structure And based on the mutual information between it and the attack tag y As a significance score, the importance of the combined features is evaluated, and the top k significant combined features are selected to construct the final high-dimensional input vector.

[0029] The formula for calculating the above mutual information is as follows: ;

[0030] middle Joint eigenvalues The probability of it appearing simultaneously with label y;

[0031] The method for determining the significance score is as described in the formula: The salient features are selected from the first k combinations: .

[0032] Furthermore, the lightweight attack detection model obtained in step 2 includes an input layer, a convolutional layer, an activation function, a max pooling layer, a dropout layer, a fully connected layer, and a softmax output layer, as detailed below:

[0033] The input layer is used to receive two-dimensional matrix samples composed of streaming segments;

[0034] The convolutional layer adopts a 1D convolutional design, with the convolutional kernel designed to be h in height and F in width, so that it focuses on the temporal features of the packet sequence and uses the convolutional kernel with height h and width F to extract local temporal features;

[0035] The ReLU nonlinear activation function is used to enhance the model's expressive power.

[0036] Max pooling layers are used to compress feature dimensions and enhance perturbation tolerance;

[0037] Dropout layer (optional) randomly masks neurons with corresponding probabilities;

[0038] The fully connected layer and the Softmax output layer are ultimately used to classify whether an attack has occurred.

[0039] Furthermore, the specific process of step 3 is as follows:

[0040] S3.1 Extract attack-related entities and relationships from multiple trusted security data sources (such as the MITRE ATT&CK framework, CVE vulnerability database, security reports, etc.), identify core elements such as attackers, targets, attack methods, stages, and tools, and construct a DDoS attack knowledge graph; construct semantic triples to organize the above elements and their relationships into a graph structure, and introduce a unified ontology specification to form a graph database that can be retrieved and reasoned by machines; normalize similar entities from different data sources, and use entity alignment and redundancy elimination techniques to construct a unified attack knowledge graph;

[0041] S3.2. Inject reasoning rules and semantic path indexes for logical chain reasoning of attack behavior into the DDoS attack knowledge graph. The reasoning rules include path rules (such as typical DDoS attack chains: scanning → reflection → amplification → denial of service) and stage dependencies (such as information gathering stage → vulnerability exploitation stage → privilege maintenance stage). Support for quick retrieval of potential attack chains and attack evolution paths in the graph.

[0042] S3.3. Deploy a graph database locally and provide a standardized graph query interface for attack detection models and attack behavior interpretation language models to access and call when interpreting attack behavior.

[0043] Furthermore, the detailed method of step 4 is as follows:

[0044] S4.1 Based on the entity-relationship path in the knowledge graph, construct natural language samples containing attack background, features, causes, harms and defense suggestions, etc., in the form of question-answer pairs, causal reasoning pairs and event descriptions, to form a fine-tuning dataset for language model supervision and fine-tuning.

[0045] S4.2. The pre-trained large language model uses a large language model with an open interface (such as GPT, DeepSeek, InternLM, etc.) as the base model; the pre-trained large language model is then fine-tuned using the fine-tuning dataset to obtain a language model with the ability to trace the source of network attacks.

[0046] S4.3 When generating attack explanation text using the large language model, the path structure in the knowledge graph of step S3 is used as the reasoning chain to impose structural constraints on the logical chain output by the large language model, ensuring that the explanation text is consistent with the entity relationships in the graph.

[0047] S4.4 The final interpretation results generated by the large language model include an overview of the attack behavior, inferred motivations, behavior phase divisions, possible vulnerability exploitation paths, etc., and can be presented in various forms such as structured reports, summary conclusions, and visual descriptions.

[0048] Furthermore, the attack visualization detection module in step 5 includes a dynamic graph display module, an attack time sequence reconstruction display module, and an LLM interpretation result panel:

[0049] The dynamic graph display module automatically visualizes the knowledge graph built based on attack samples, supporting operations such as floating node information, highlighting edge weights, and filtering subgraphs.

[0050] The attack timing reconstruction and display module combines the timestamp information of each data packet or stream segment in the network traffic data to reconstruct the time evolution trajectory of the attack behavior according to the attack chain path, presenting multiple stages such as the initiation, propagation, and termination of the attack.

[0051] The LLM interpretation results panel displays the attack behavior explanations and defense suggestions generated by the language model, and supports feedback and correction; it can update the detection model results, graph changes and LLM responses in the visualization interface in real time, and supports closed-loop iteration of attack analysis.

[0052] Beneficial effects: This invention combines deep learning models, knowledge graph construction, and large language model (LLMs) fine-tuning techniques to propose a comprehensive network attack visualization detection method that integrates data parsing, intelligent detection, graph enhancement, natural language interpretation, and graphical display. The goal is to improve detection accuracy, reduce false alarm rate, enhance visualization interaction and automatic interpretation capabilities, and help build a new generation of intelligent network security response systems. Attached Figure Description

[0053] Figure 1 This is a diagram of the overall system framework of the present invention.

[0054] Figure 2 This is a flowchart of the traffic feature extraction and data preprocessing module in the embodiment.

[0055] Figure 3 This is a flowchart illustrating the attack knowledge graph reasoning assistance process in this embodiment. Detailed Implementation

[0056] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0057] like Figure 1 As shown, the present invention provides a DDoS attack visualization detection method based on multi-dimensional feature combination analysis, comprising the following steps:

[0058] Step 1: Extracting multidimensional flow features and data preprocessing

[0059] First, obtain the raw network traffic file and parse it to extract raw data packet features such as protocol fields and timestamps at the data packet level, and then aggregate all data packets into a network flow;

[0060] Then, the network flow is segmented according to a preset time window to generate flow segments containing several data packets within the time period; each flow segment is labeled based on built-in label rules or user-defined rules, and sample balancing is achieved through strategies such as downsampling.

[0061] Next, combined features are constructed based on the original data packet features. That is, two or more significant features in the feature vector of each data packet are combined and calculated to form new combined features. The combination methods include feature product, difference or concatenation to form an expanded high-dimensional feature representation.

[0062] Finally, the original data packet features and combined features are concatenated into a high-dimensional input matrix in a unified format, and the sample data is normalized, dimension aligned and format standardized to generate tensor samples with a unified structure for subsequent training and inference of neural network models.

[0063] Step S2: Construct a lightweight attack detection model based on a sequential convolutional neural network. Input the tensor samples from Step 1 into the lightweight attack detection model, extract key temporal features using one-dimensional convolution, and combine activation functions and pooling operations to complete attack classification and judgment, and output the attack detection results.

[0064] Step 3: Construct a DDoS attack knowledge graph

[0065] The DDoS attack-related entities and relationships are extracted from trusted and secure data sources, core elements are identified, and similar entities from different data sources are normalized. Semantic triples are then constructed, and all triples are imported into a graph database to form a basic network attack knowledge graph. Reasoning rules and path indexes are injected into the basic network attack knowledge graph to complete the construction of the DDoS attack knowledge graph, which supports the rapid retrieval of potential attack chains and attack evolution paths in the DDoS attack knowledge graph.

[0066] Step 4: Construct a large-scale model to explain attack behavior under graph constraints.

[0067] A fine-tuning dataset is constructed based on a DDoS attack knowledge graph, covering structured information such as entities, relationships, and attack chains. The dataset is used to supervise and fine-tune a pre-trained large language model, improving its professionalism and causal reasoning ability in attack explanation tasks. In the reasoning stage, the knowledge graph is introduced as an external constraint to exert structural guidance on the generation process of the large language model, suppressing hallucination output, reducing false alarm rate, and generating explanatory text that conforms to security logic.

[0068] Step 5: The attack visualization detection module is used to visualize the above attack detection results. Specifically, it dynamically draws the attack graph based on the DDoS attack knowledge graph, supporting interactive features such as node highlighting, path expansion, and relationship query. It reconstructs the attack timeline by combining data packet timestamp information to show the evolution process of the attack stages. Combined with the natural language interface of the large language model, the attack chain explanation can be displayed by input (such as "display the attack path of a certain IP").

[0069] like Figure 2 The specific process of step 1 shown is as follows:

[0070] Step 1.1: Use the pyshark library to parse the .pcap file packet by packet, removing features that are not conducive to model generalization. The extracted packet features include timestamp, total IP packet length, highest protocol layer name, source / destination port, TCP flags, TTL value, UDP length, ICMP type code, etc., which are uniformly encoded into a fixed-length n-dimensional vector, with missing fields padded with 0; all packets are aggregated into network flows in the form of a 5-tuple (source IP, source port, destination IP, destination port, and protocol);

[0071] Step 1.2: Divide the data into multiple stream segments according to the sliding time window (e.g., 10 seconds). Each stream segment is treated as an independent sample to improve the temporal awareness and data richness of attack identification.

[0072] The methods for generating labels for stream segments include the following two: (1) Built-in dataset labeling rules: automatically generate attack labels based on known attack / victim IP segments; (2) User-defined configuration: dynamically label the attacker and victim IP network segments by inputting the attacker and victim IP network segments through command line parameters;

[0073] Step 1.3: Combine and calculate the significant features reflecting attack behavior in the feature vector of each original data packet, and select significant features to form new combined features;

[0074] The original features and combined features are concatenated into a high-dimensional input matrix with a unified format. The sample data is then normalized, dimension aligned, and format standardized to generate a model input tensor with a unified structure, which is used for the training and inference of the subsequent neural network model.

[0075] In the above feature combination construction stage, any two dimensions of the original data packet features are combined. Perform combined operations ,structure And based on the mutual information between it and the attack tag y As a significance score, the importance of the combined features is evaluated, and the top k significant combined features are selected to construct the final high-dimensional input vector.

[0076] The formula for calculating the above mutual information is as follows: ;

[0077] Joint eigenvalues The probability of it appearing simultaneously with label y;

[0078] The method for determining the significance score is as described in the formula: The salient features are selected from the first k combinations: .

[0079] In this embodiment, all combined features are concatenated with the original features to form an expanded feature vector, thus expanding the input dimension of each data packet from the original number of features f to... All numerical fields are normalized and scaled to the [0,1] interval to ensure the stability and convergence speed of gradient propagation. Secondly, to address the issue of unequal data packet counts in stream segments, the system employs a zero-padding strategy, padding segments shorter than the maximum length with zero vectors. Finally, each sample is organized as a three-dimensional tensor (N, T, F), where N represents the number of samples, T is the number of data packets (of uniform length) in each segment, and F is the feature dimension of each data packet, including the original features and the constructed binary combination features.

[0080] Step 2 of this embodiment yields a lightweight attack detection model comprising an input layer, convolutional layers, activation functions, max pooling layers, dropout layers, fully connected layers, and a softmax output layer, detailed below:

[0081] The input layer is used to receive two-dimensional matrix samples composed of streaming segments;

[0082] The convolutional layer adopts a 1D convolutional design, with the convolutional kernel designed to be h in height and F in width, so that it focuses on the temporal features of the packet sequence and uses the convolutional kernel with height h and width F to extract local temporal features;

[0083] The ReLU non-linear activation function is used to enhance the model's expressive power.

[0084] Max pooling layers are used to compress feature dimensions and enhance perturbation tolerance;

[0085] The Dropout layer (optional) randomly masks neurons with corresponding probabilities, which can also prevent overfitting.

[0086] The fully connected layer and the Softmax output layer are ultimately used to classify whether an attack has occurred.

[0087] The weighted cross-entropy loss function is used during training. , Label The predicted probability is , The system automatically assigns higher weights to minority class attack samples, thereby significantly improving the false alarm rate in the detection results.

[0088] like Figure 3 As shown, the specific process of step 3 in this embodiment is as follows:

[0089] S3.1 Extract attack-related entities and relationships from multiple trusted security data sources (such as the MITRE ATT&CK framework, CVE vulnerability database, security reports, etc.), identify core elements such as attackers, targets, attack methods, stages, and tools, and construct a DDoS attack knowledge graph; construct semantic triples to organize the above elements and their relationships into a graph structure, and introduce a unified ontology specification to form a graph database that can be retrieved and reasoned by machines; normalize similar entities from different data sources, and use entity alignment and redundancy elimination techniques to construct a unified attack knowledge graph;

[0090] S3.2. Inject reasoning rules and semantic path indexes for logical chain reasoning of attack behavior into the DDoS attack knowledge graph. The reasoning rules include path rules (such as typical DDoS attack chains: scanning → reflection → amplification → denial of service) and stage dependencies (such as information gathering stage → vulnerability exploitation stage → privilege maintenance stage). Support for quick retrieval of potential attack chains and attack evolution paths in the graph.

[0091] S3.3. Deploy a graph database locally and provide a standardized graph query interface for the attack detection model and the attack behavior interpretation language model to access and call when interpreting attack behavior. The detailed method of step 4 in this embodiment is as follows:

[0092] S4.1 Based on the entity-relationship path in the knowledge graph, construct natural language samples containing attack background, features, causes, harms and defense suggestions, etc., in the form of question-answer pairs, causal reasoning pairs and event descriptions, to form a fine-tuning dataset for language model supervision and fine-tuning.

[0093] S4.2. The pre-trained large language model uses a large language model with an open interface (such as GPT, DeepSeek, InternLM, etc.) as the base model; the pre-trained large language model is then fine-tuned using the fine-tuning dataset to obtain a language model with the ability to trace the source of network attacks.

[0094] S4.3 When generating attack explanation text using the large language model, the path structure in the knowledge graph of step S3 is used as the reasoning chain to impose structural constraints on the logical chain output by the large language model, ensuring that the explanation text is consistent with the entity relationships in the graph.

[0095] S4.4 The final interpretation results generated by the large language model include an overview of the attack behavior, inferred motivations, behavior phase divisions, possible vulnerability exploitation paths, etc., and can be presented in various forms such as structured reports, summary conclusions, and visual descriptions.

[0096] Step 5 of this embodiment, the attack visualization detection module, includes a dynamic graph display module, an attack time-series reconstruction display module, and an LLM interpretation result panel. The dynamic graph display module automatically visualizes the knowledge graph constructed based on attack samples, supporting operations such as floating node information, highlighting edge weights, and subgraph filtering. The attack time-series reconstruction display module combines the timestamp information of each data packet or flow segment in the network traffic data to reconstruct the temporal evolution trajectory of the attack behavior according to the attack chain path, presenting multiple stages such as the initiation, propagation, and termination of the attack. The LLM interpretation result panel displays the attack behavior explanation and defense suggestions generated by the language model, and supports feedback correction. It can update the detection model results, graph changes, and LLM responses in the visualization interface in real time, supporting closed-loop iteration of attack analysis. The specific visualization method is as follows:

[0097] S5.1 Attack Graph Visualization: In this implementation, the system dynamically draws a network attack entity graph based on the aforementioned network attack knowledge graph. Specifically, the system extracts the core entities involved in each detected attack event (including the attack source IP, target IP, protocol used, attack method, attack time period, etc.) and constructs a graph structure through the relationships between entities (such as "initiating a connection", "scanning ports", "applying DDoS", etc.). At the front-end display layer, a graphics visualization engine (such as D3.js, Cytoscape.js, etc.) is used to render the knowledge graph in the form of nodes and edges, supporting node highlighting (e.g., when a certain attacker IP node is clicked or hovered over, all its relation edges and target entities are visually highlighted), enabling rapid location of the attacking entity. Simultaneously, the system also supports path display and relationship query functions. Users can select any two entity nodes to query all reachable paths between them and the relationship types that the paths depend on, thereby helping users understand the potential logical paths or multi-hop relationships in the attack chain.

[0098] S5.2 Attack Timing Reconstruction: To enhance the system's ability to perceive the temporal dimension of attack behavior, an attack timing reconstruction function is introduced. Specifically, in the traffic preprocessing module, each network flow segment carries precise timestamp information; during the knowledge graph construction process, each graph edge (such as an attacker applying a certain type of attack to a target) can be mapped to a specific time range. The system parses these timestamps, clusters and sorts the attack behaviors, and then constructs an attack phase reconstruction graph based on a timeline. The graph shows multiple phase nodes of the attack, including initiation, scanning, exploitation, control, and backhaul, and is sorted chronologically to form a complete attack event evolution process.

[0099] S5.3 Natural Language Linked Query: To enhance system usability and intelligent interaction capabilities, this invention introduces a natural language interface based on large language models (such as ChatGPT and DeepSeek) to implement a linked query mechanism between the attack graph and user semantic intent. The system deploys a text parsing and graph retrieval linkage middleware layer, capable of converting user-inputted natural language requests (e.g., "Enter the attack IP to view the attack chain" or "Describe the attack path") into graph query instructions. Specifically, after the user inputs natural language, the large language model parses the entities (such as IP addresses, attack types, etc.) and operational intents (such as query path, display details, etc.). Based on this, the system locates the target node in the knowledge graph and executes the corresponding operation, automatically displaying the attack chain path, the contextual information of the target entity, and a visual graphic. Simultaneously, this module supports generating explanatory text based on model inference results, describing the complex graph structure in plain language, making it easier for non-professional users to understand attack patterns.

[0100] To further verify the technical effectiveness of this invention, a visualization strategy for DDoS attacks on a specific dataset is presented, including the following steps:

[0101] Step 1: Multidimensional traffic feature extraction and data preprocessing

[0102] Dataset source: A subset of “DDoS LOIC HTTP Flood” from CIC-IDS2018, containing approximately 200,000 normal traffic and 200,000 attack traffic entries.

[0103] Traffic analysis: The pyshark tool is used to parse the .pcap file and extract 11 features, including timestamp, protocol, source / destination IP, source / destination port, packet length, TCP flags, TTL, and UDP length.

[0104] Flow construction and segmentation: Aggregate traffic in five-tuples and divide it into segments with a 10-second sliding window, each segment containing 200–500 packets.

[0105] Combined feature generation: Based on feature mutual information, the top 20 significant combined features (such as "source port difference × packet length") are selected and concatenated with the original features. Finally, each segment forms a tensor (N = number of samples, T = number of packets in the window, F = original + combined feature dimension).

[0106] Step 2, Attack Detection Model Training: The model adopts the aforementioned 1D-CNN structure. The input layer takes a two-dimensional matrix (T × F), and the convolutional layers use a kernel size (h × F) to extract temporal patterns. ReLU is used as the activation function. MaxPooling is selected for the pooling layer. Dropout is set to 0.3. Overfitting is prevented by using Adam (lr=0.001) and EarlyStopping.

[0107] Step 3: Knowledge Graph Construction and Reasoning

[0108] In this embodiment, the system first extracts entities and relationships related to DDoS attacks from multiple security data sources (such as the MITRE ATT&CK framework, CVE vulnerability database, and CIC-IDS2018 tag set), including attackers, attack tools, attack methods, victims, attack stages, and attack results.

[0109] Entities and relationships are organized into triple structures, such as (attacker IP, initiated, HTTP Flood), (HTTP Flood, caused, service unavailability), and (LOIC tool, belongs to, application-layer DDoS). All triples are imported into a local graph database and, through entity alignment and semantic normalization methods, form a unified attack knowledge representation space.

[0110] The system further incorporates typical attack evolution rules (such as "scan → amplify → flood → denial of service") and establishes a path index to enable rapid retrieval and source tracing of potential attack chains.

[0111] Step 4: Construct a large-scale explanatory model for graph constraints.

[0112] Based on the constructed graph, the system further generates structured corpora for instruction fine-tuning: entity relationship paths, attack chains, event timestamps, and context logs are templated into various natural language samples (including question-answer pairs, path descriptions, etc.), and negative sample construction (such as shuffling paths or replacing entities) forms comparative training samples to constrain the model from generating inconsistent or fictitious inferences. The system uses these corpora to fine-tune the pre-trained large model. Fine-tuning can employ supervised fine-tuning or parameter-efficient strategies (such as LoRA / Adapter / Prefix-tuning) to reduce computational power and deployment costs. The training objective is mainly cross-entropy, supplemented by alignment / factual loss terms (such as constraint loss on evidence citations). At the same time, positive / negative samples, local path consistency checks, and evidence-statement alignment are incorporated into the training process to reduce illusions. After fine-tuning, the model must use the retrieved graph paths as the optional solution space during inference, that is, only generate causal chains on graph-reachable paths or explicitly mark "outside the known graph range".

[0113] Once the attack detection module identifies that traffic from a specific source IP exhibits an HTTP Flood pattern, the system inputs the detection result into a finely tuned attack interpretation language model and embeds the pre-constructed attack knowledge graph as an external constraint into the reasoning process. During reasoning, the language model generates causal chains based on entities and relationships in the knowledge graph, avoiding fabricated or unreasonable interpretations.

[0114] The attack interpretation model can generate a detection conclusion that "the source IP initiated a large number of HTTP requests within a specific time period." It can also combine knowledge graphs to output a complete logical chain, such as "scanning → large-scale requests → server response timeout → service denial," and further infer potential attack tools, possible attack motives, and corresponding defense suggestions. For example, when the detection module identifies a certain IP's traffic as an "HTTP Flood" attack, the interpretation model generates the following result:

[0115] Attack behavior: A large number of HTTP requests were detected from source IP 192.168.1.45 between 12:01:30 and 12:01:40, characterized by stable packet length and abnormally high request frequency.

[0116] Attack speculation: This traffic pattern matches the characteristics of an application-layer flood initiated by the LOIC tool.

[0117] Attack chain: Scanning → Massive requests → Target server response timeout → Service denial.

[0118] Defense Recommendations: It is recommended to block the source IP address and enable application-layer rate limiting policies.

[0119] In summary, this invention combines deep learning models, knowledge graph construction, and large language model (LLMs) fine-tuning techniques to propose a comprehensive network attack visualization detection method that integrates data parsing, intelligent detection, graph enhancement, natural language interpretation, and graphical display. The goal is to improve detection accuracy, reduce false alarm rate, enhance visualization interaction and automatic interpretation capabilities, and help build a new generation of intelligent network security response systems.

Claims

1. A DDoS attack visualization detection method based on multi-dimensional feature combination analysis, characterized in that, Includes the following steps: Step 1: Extract multidimensional traffic features and perform data preprocessing; The process involves acquiring raw network traffic files, extracting raw data packet features, aggregating all data packets into a network flow, segmenting the network flow to generate several data packet stream segments, labeling each stream segment, constructing combined features based on the raw data packet features, concatenating the raw data packet features and combined features into a high-dimensional input matrix in a unified format, and normalizing, aligning, and standardizing the sample data to generate tensor samples with a unified structure. Step S2: Construct a lightweight attack detection model based on a sequential convolutional neural network. Input the tensor samples from Step 1 into the lightweight attack detection model, extract key temporal features using one-dimensional convolution, and combine activation functions and pooling operations to complete attack classification and judgment, and output the attack detection results. Step 3: Construct a DDoS attack knowledge graph; extract DDoS attack-related entities and relationships, identify core elements, and then construct semantic triples. Import all triples into the graph database to form a basic network attack knowledge graph; inject inference rules and path indexes into the basic network attack knowledge graph to complete the construction of the DDoS attack knowledge graph, which supports the rapid retrieval of potential attack chains and attack evolution paths in the DDoS attack knowledge graph. Step 4: Graph-constrained attack behavior explanation model; construct fine-tuning dataset based on DDoS attack knowledge graph; use dataset to perform supervised fine-tuning of pre-trained large language model; In the reasoning stage, knowledge graphs are introduced as external constraints to exert structural guidance on the generation process of large language models and generate explanatory texts that conform to security logic. Step 5: Use the attack visualization detection module to visualize the above attack detection results.

2. The DDoS attack visualization detection method based on multi-dimensional feature combination analysis according to claim 1, characterized in that, The specific process of step 1 is as follows: Step 1.1: Use the pyshark library to parse the .pcap file packet by packet, remove features that are not conducive to model generalization, and extract packet features including timestamp, total IP packet length, highest protocol layer name, source / destination port, TCP flag, TTL value, UDP length and ICMP type code, uniformly encoded into a fixed-length n-dimensional vector, and padding with 0 for fields that do not appear. All data packets are aggregated into a network flow in the form of a 5-tuple; the 5-tuple includes the source IP, source port, destination IP, destination port, and protocol; Step 1.2: Divide the stream into multiple segments based on the sliding time window, treating each segment as an independent sample; label the stream segments to generate labels; Step 1.3: Combine and calculate the significant features reflecting attack behavior in the feature vector of each original data packet, and select significant features to form new combined features; The original features and combined features are concatenated into a high-dimensional input matrix with a unified format. The sample data is then normalized, dimension aligned, and format standardized to generate model input tensor samples with a unified structure.

3. The DDoS attack visualization detection method based on multi-dimensional feature combination analysis according to claim 2, characterized in that, The method for selecting the saliency feature is as follows: For any two dimensions in the original data packet features Perform combined operations Construct joint eigenvalues To form a new binary combination feature set ; And based on the mutual information between it and the attack tag y As a significance score, the importance of the combined features is evaluated; then the top k significant combined features are selected to construct the final high-dimensional input vector. The formula for calculating the above mutual information is as follows: ； Joint eigenvalues The probability of it appearing simultaneously with label y; The method for determining the significance score is as follows: ； Ultimately, the first k combinations were selected as the salient features: .

4. The DDoS attack visualization detection method based on multi-dimensional feature combination analysis according to claim 1, characterized in that, Step 2 yields a lightweight attack detection model comprising an input layer, convolutional layers, activation functions, max pooling layers, dropout layers, fully connected layers, and a softmax output layer, detailed below: The input layer is used to receive two-dimensional matrix samples composed of streaming segments; The convolutional layer adopts a 1D convolutional design, with the convolutional kernel designed to be h in height and F in width, so that it focuses on the temporal features of the packet sequence and uses the convolutional kernel with height h and width F to extract local temporal features; The ReLU non-linear activation function is used to enhance the model's expressive power. Max pooling layers are used to compress feature dimensions and enhance perturbation tolerance; The Dropout layer randomly masks neurons with corresponding probabilities; The fully connected layer and the Softmax output layer are ultimately used to classify whether an attack has occurred.

5. The DDoS attack visualization detection method based on multi-dimensional feature combination analysis according to claim 1, characterized in that, The specific process of step 3 is as follows: S3.1 Extract attack-related entities and relationships from multiple trusted and secure data sources. The core elements identified include attackers, targets, attack methods, stages, and tools. Construct semantic triples to organize the above elements and their relationships into a graph structure and introduce a unified ontology specification to form a graph database that can be retrieved and reasoned by machines. It also normalizes similar entities from different data sources and uses entity alignment and redundancy elimination techniques to construct a basic network attack knowledge graph. S3.

2. Inject reasoning rules and semantic path indexes for logical chain reasoning of attack behavior into the basic network attack knowledge graph. The reasoning rules include path rules and stage dependencies; support fast retrieval of potential attack chains and attack evolution paths in the graph. S3.

3. Deploy a graph database locally and provide a standardized graph query interface for attack detection models and attack behavior interpretation language models to access and call when interpreting attack behavior.

6. The DDoS attack visualization detection method based on multi-dimensional feature combination analysis according to claim 1, characterized in that, The detailed method for step 4 is as follows: S4.1 Based on the entity-relationship path in the DDoS attack knowledge graph, construct natural language samples containing attack background, characteristics, causes, harms and defense suggestions. The forms include question-answer pairs, causal reasoning pairs and event descriptions, which in turn form a fine-tuning dataset for language model supervision and fine-tuning. S4.2 Training a large language model with an open interface, and fine-tuning the pre-trained large language model using a fine-tuning dataset to obtain a large language model with the ability to trace the source of network attacks. S4.3 When the large language model is used to interpret the text, the path structure in the knowledge graph is used as the reasoning chain to impose structural constraints on the logical chain output by the large language model, so as to ensure that the interpreted text is consistent with the entity relationship in the graph. S4.4 The final interpretation results generated by the large language model include an overview of the attack behavior, inferred motivations, behavioral phase divisions, and possible vulnerability exploitation paths.

7. The DDoS attack visualization detection method based on multi-dimensional feature combination analysis according to claim 1, characterized in that, The attack visualization detection module in step 5 includes a dynamic graph display module, an attack time sequence reconstruction display module, and an LLM interpretation result panel: The dynamic graph display module automatically visualizes the knowledge graph built based on attack samples, supporting floating node information, highlighted edge weights, and subgraph filtering. The attack timing reconstruction and display module combines the timestamp information of each data packet or stream segment in the network traffic data to reconstruct the temporal evolution trajectory of the attack behavior based on the attack chain path. The LLM interpretation results panel displays the attack behavior explanations and defense suggestions generated by the language model, and supports feedback and correction; it can update the detection model results, graph changes and LLM responses in the visualization interface in real time, and supports closed-loop iteration of attack analysis.

Images