Prediction method and device for distributed denial of service attack, equipment, storage medium and program product

Abstract

The invention relates to a distributed denial of service (DDoS) attack prediction method and device, equipment, a storage medium and a program product, relates to the technical field of artificial intelligence and big data, and can improve the DDoS attack prediction accuracy. The method comprises the following steps: inputting network flow time sequence data into a plurality of first bidirectional gating circulation units; each first bidirectional gating circulation unit is used for determining a gating unit output result according to the output of the first bidirectional gating circulation unit at the previous moment and the output of the first bidirectional gating circulation unit at the subsequent moment; feature extraction results are obtained according to the output result of the gating unit, and the multiple feature extraction results are input into multiple second bidirectional gating circulation units; each second bidirectional gating circulation unit is used for determining attack prediction information corresponding to the current feature extraction result according to the output of the second bidirectional gating circulation unit at the previous moment and the output of the second bidirectional gating circulation unit at the subsequent moment; and obtaining a prediction result according to each piece of attack prediction information.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and big data technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for predicting distributed denial-of-service attacks. Background Technology

[0002] With the development of computer and internet technologies, network security has become a key factor in ensuring the stable operation of the information society. Distributed Denial of Service (DDoS) attacks, as a major form of network attack, pose a significant threat to network infrastructure and online services.

[0003] While DDoS detection and defense methods in related technologies, such as threshold-based traffic analysis, firewall rule matching, and intrusion detection systems (IDS), have played a protective role to some extent, they have exposed obvious limitations when facing complex and ever-changing DDoS attacks. They cannot accurately and effectively predict potential attacks that have not yet occurred, and there is a problem of poor accuracy in DDoS attack identification and prediction. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for predicting distributed denial-of-service attacks, addressing the aforementioned technical problems.

[0005] Firstly, this application provides a method for predicting distributed denial-of-service attacks, including:

[0006] Obtain network flow time-series data; the network flow time-series data includes attribute information corresponding to each of multiple network flow data;

[0007] The network flow time-series data is input into multiple first bidirectional gated loop units of the feature extraction module in the attack prediction model; each first bidirectional gated loop unit is used to determine the gate unit output result based on the output of the first bidirectional gated loop unit at the preceding time and the output of the first bidirectional gated loop unit at the following time.

[0008] The feature extraction result is obtained based on the output of the gating unit, and the multiple feature extraction results are respectively input into multiple second bidirectional gating loop units of the prediction module in the attack prediction model; each second bidirectional gating loop unit is used to determine the attack prediction information corresponding to the current feature extraction result based on the output of the second bidirectional gating loop unit at the previous time step and the output of the second bidirectional gating loop unit at the subsequent time step.

[0009] Based on the attack prediction information provided, the prediction results for distributed denial-of-service attacks are obtained.

[0010] Secondly, this application also provides a device for predicting distributed denial-of-service attacks, comprising:

[0011] The timing data acquisition module is used to acquire network flow timing data of the network; the network flow timing data includes attribute information corresponding to each of multiple network flow data.

[0012] The first processing module is used to input the network flow time-series data into multiple first bidirectional gated loop units of the feature extraction module in the attack prediction model; each first bidirectional gated loop unit is used to determine the gate unit output result based on the output of the first bidirectional gated loop unit at the preceding time and the output of the first bidirectional gated loop unit at the following time.

[0013] The second processing module is used to obtain feature extraction results based on the output of the gating unit, and input the multiple feature extraction results into multiple second bidirectional gating loop units of the prediction module in the attack prediction model; each second bidirectional gating loop unit is used to determine attack prediction information corresponding to the current feature extraction result based on the output of the second bidirectional gating loop unit at the previous time step and the output of the second bidirectional gating loop unit at the subsequent time step.

[0014] The prediction result acquisition module is used to acquire the prediction result of distributed denial-of-service attacks based on the various attack prediction information.

[0015] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the distributed denial-of-service attack prediction method as described above.

[0016] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for predicting distributed denial-of-service attacks as described above.

[0017] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method for predicting distributed denial-of-service attacks as described above.

[0018] The aforementioned methods, apparatus, computer devices, computer-readable storage media, and computer program products for predicting distributed denial-of-service (DDoS) attacks, by acquiring network flow time-series data containing attribute information, can obtain information reflecting changes in network data traffic, providing sufficient basis for subsequent model analysis. Subsequently, this application fully captures the temporal dependencies of the data through bidirectional gated loop units. On the one hand, by employing multiple first bidirectional gated loop units for feature extraction, it utilizes bidirectional information processing capabilities to capture the sequential correlation features of the time-series data, avoiding the one-sidedness of data from a single moment and improving the accuracy of feature extraction. On the other hand, by employing multiple second bidirectional gated loop units for attack prediction based on the feature extraction results, it further utilizes temporal correlation information to ensure the reliability of the attack prediction information. Finally, by comprehensively analyzing the attack prediction information, a prediction result is obtained, achieving early and accurate prediction of DDoS attacks, which helps to accurately predict network characteristics and DDoS attack behavior. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating a method for predicting distributed denial-of-service attacks in one embodiment.

[0021] Figure 2a This is a schematic diagram of the structure of a gated loop unit in one embodiment;

[0022] Figure 2b This is a schematic diagram of the structure of a bidirectional gated loop unit in one embodiment;

[0023] Figure 3 This is a schematic diagram of the structure of an attack prediction model in one embodiment;

[0024] Figure 4 This is a schematic diagram of a multi-head attention structure in one embodiment;

[0025] Figure 5 This is a schematic diagram of the framework of a method for predicting distributed denial-of-service attacks in one embodiment;

[0026] Figure 6 This is a flowchart illustrating a method for predicting distributed denial-of-service attacks in another embodiment;

[0027] Figure 7This is a structural block diagram of a distributed denial-of-service attack prediction device in one embodiment;

[0028] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various objects, but these objects are not limited by these terms. These terms are only used to distinguish the first object from the second object. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the solutions, or any combination of multiple solutions.

[0031] With the development of computer and internet technologies, network security has become a key factor in ensuring the stable operation of the information society. DDoS attacks, a major form of network attack, utilize a large number of infected devices (i.e., botnets) to send requests beyond the processing capacity of a target server, preventing legitimate users from accessing services and posing a significant threat to network infrastructure and online services. While existing DDoS detection and defense technologies, such as threshold-based traffic analysis, firewall rule matching, and intrusion detection systems, offer some protection, they exhibit significant limitations when facing complex and ever-changing DDoS attacks and cannot predict future scenarios.

[0032] Specifically, threshold-based traffic analysis involves monitoring network traffic and comparing it to a set threshold to determine if anomalies exist. However, this method is susceptible to normal traffic fluctuations, leading to a high false positive rate. Furthermore, it may fail to detect low-bandwidth-consuming DDoS attacks, such as application-layer attacks, in a timely manner. Firewall rule matching relies on pre-defined rule sets to filter incoming and outgoing network traffic, blocking traffic that does not conform to the rules. However, maintaining and updating rule sets is costly, and firewall rules may not be effective in identifying unknown DDoS attack patterns. Intrusion prediction systems predict potential attacks by analyzing abnormal behavior patterns in network traffic. While they can predict unknown attacks to some extent, they rely on high-quality training data and the model's generalization ability; otherwise, the prediction accuracy will be significantly reduced. Therefore, these technologies suffer from poor accuracy in DDoS attack identification and prediction.

[0033] This application provides a method, apparatus, computer device, computer-readable storage medium, and computer program product for predicting distributed denial-of-service attacks. It can more efficiently and accurately predict DDoS attacks, help improve the accuracy and real-time performance of DDoS attack prediction, reduce false alarm rate and false negative rate, effectively cope with complex and ever-changing DDoS attacks, and ensure the security and stability of the network environment.

[0034] In one embodiment, such as Figure 1 As shown, a method for predicting distributed denial-of-service attacks is provided. This embodiment illustrates the method by applying it to a server. It is understood that this method can also be applied to terminals, and to systems including terminals and servers, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0035] S101, Obtain network flow time series data; the network flow time series data includes attribute information corresponding to each of the multiple network flow data.

[0036] Network flow time-series data can be time-series data organized from the attribute information corresponding to each of multiple network flow data. Network flow time-series data can be understood as a collection of network data organized according to the order in which the network flow data is generated or transmitted, using time as the dimension. It contains the attribute information corresponding to network flow data at different times and reflects the changing patterns of network traffic over time. The attribute information corresponding to network flow data refers to the characteristic data inherent in each network flow data or that can be parsed, such as one or more of the following: source IP address, destination IP address, packet size, transmission protocol, packet arrival timestamp, and port number.

[0037] In practice, network data acquisition devices or software can be used to monitor network flow data transmitted over the network. As shown in Table 1 below, one example of 10 network flow data points is provided.

[0038] Table 1

[0039]

[0040] After collecting multiple network flow data, the attribute information corresponding to each network flow data can be extracted. Then, these attribute information can be organized according to the temporal relationship of the network flow data to finally obtain network flow time series data, which provides input data for subsequent attack prediction models.

[0041] S102, inputting network flow time-series data into multiple first bidirectional gated loop units of the feature extraction module in the attack prediction model; each first bidirectional gated loop unit is used to determine the output result of the gated unit based on the output of the first bidirectional gated loop unit at the preceding time and the output of the first bidirectional gated loop unit at the following time.

[0042] In practical implementation, an attack prediction model can be pre-built and trained. This model is a machine learning model used to predict whether a distributed denial-of-service (DDoS) attack will occur in a network. It can include a feature extraction module and a prediction module. The feature extraction module extracts key features from the input data. It is a functional module that can mine and extract representative and discriminative features from the raw input data (such as network flow time-series data). These features can effectively reflect the network state behind the data, providing a basis for subsequent attack prediction. In some examples, the feature extraction module can be used to normalize the input feature information (i.e., network flow time-series data), thereby improving network convergence speed and accuracy and preventing model gradient explosion.

[0043] The attack prediction model may include bidirectional gated recurrent units (BiGRUs). For ease of distinction, the BiGRU in the feature extraction module is referred to as the first BiGRU, and the BiGRU in the prediction module is referred to as the second BiGRU. The BiGRU is an improvement on the Gate Recurrent Unit (GRU). A GRU is a time-series prediction network consisting of reset and update gates. It outputs predicted values ​​after inputting time-series data. For example... Figure 2a A GRU unit is provided. BiGRU consists of forward-facing GRUs and reverse-facing GRUs, such as... Figure 2bAs shown, the output of each time step in BiGRU is obtained by superimposing the forward and backward outputs. This allows for the learning of the temporal relationships between previous and subsequent time steps and the current state, uncovering potential temporal representation patterns in network flows, and effectively improving the learning ability of the neural network. Regarding previous and subsequent time steps, relative to the currently processed bidirectional gated recurrent unit (i.e., the current time step), the previous time step can be understood as the time point before the current time step, and the subsequent time step refers to the time point after the current time step.

[0044] In specific implementation, this step utilizes multiple first bidirectional gated recurrent units (BRNs) within the attack prediction model's feature extraction module to perform preliminary feature learning and processing on the input network stream temporal data. Since network stream temporal data is temporally correlated, ordinary unidirectional recurrent neural networks can only utilize preceding time-series data. However, the first bidirectional gated recurrent units can simultaneously combine preceding and subsequent time-series data. The setup of multiple first bidirectional gated recurrent units can further cover features across different dimensions or time periods of the data. Each first bidirectional gated recurrent unit calculates its output based on the outputs of preceding and subsequent time-series units, preparing for subsequent acquisition of accurate feature extraction results. For example, the gated unit output can refer to the intermediate data containing bidirectional temporal features output by each first bidirectional gated recurrent unit after processing the preceding and subsequent time-series output information and the current time-series network stream data through reset and update gates.

[0045] In one embodiment, after obtaining the network stream time series data, the attribute information of each of the multiple network stream data contained in the network stream time series data can be input into multiple bidirectional gated recurrent units (i.e., the first bidirectional gated recurrent unit) of the feature prediction module in the model, such as... Figure 3In the model structure diagram shown, the same layer of the feature extraction module can include n first bidirectional gated loop units. The attribute information of each of the n network stream data points in the network stream time series data can be input to the corresponding first bidirectional gated loop unit. For a single first bidirectional gated loop unit, it can obtain the input information from the previous layer. For example, for the first-layer first bidirectional gated loop unit, its input information can be the network stream data processed by the input layer; for the next-layer first bidirectional gated loop unit, its input information can be the gate unit output of the previous layer's first bidirectional gated loop unit. Simultaneously, the first bidirectional gated loop unit can obtain the output of the first bidirectional gated loop unit based on the output of the first bidirectional gated loop unit at the previous time step and the output of the first bidirectional gated loop unit at the next time step, and then obtain the gate unit output result of the single first bidirectional gated loop unit based on these two outputs. In some examples, the number of layers in the module can be set according to the model depth, so that the first bidirectional gated loop unit can input the obtained gate unit output result to the next layer in the same module, or to the first layer of the next module (i.e., the prediction module).

[0046] S103, obtain the feature extraction result according to the output of the gating unit, and input the multiple feature extraction results into the multiple second bidirectional gating loop units of the prediction module in the attack prediction model respectively; each second bidirectional gating loop unit is used to determine the attack prediction information corresponding to the current feature extraction result according to the output of the second bidirectional gating loop unit at the previous time step and the output of the second bidirectional gating loop unit at the subsequent time step.

[0047] The prediction module outputs attack prediction results based on the extracted features. The feature extraction results refer to the results obtained by further filtering and integrating the output of the first bidirectional gated loop unit. These results accurately reflect the key features of the network flow time-series data and can be understood as a refinement of the first bidirectional gated loop unit's output, better meeting the needs of subsequent attack prediction. The second bidirectional gated loop unit is the unit in the prediction module used to predict attack risks based on the feature extraction results. Multiple second bidirectional gated loop units can correspond one-to-one with multiple feature extraction results output by the feature extraction module. Each second bidirectional gated loop unit is also calculated in conjunction with the outputs of the preceding and following time-series second bidirectional gated loop units. The attack prediction information can be the attack risk assessment data output by each second bidirectional gated loop unit, corresponding to the current feature extraction result.

[0048] In practical applications, after obtaining the gating unit outputs of all first bidirectional gated recurrent units, the feature extraction module can further process these results to obtain the feature extraction results. For example, it can perform residual processing, temporal concatenation / fusion, pooling, or one or more other processing on the gating unit outputs. Subsequently, multiple feature extraction results can be input into multiple second bidirectional gated recurrent units of the prediction module, with each second bidirectional gated recurrent unit processing one feature extraction result. For example, the processed feature extraction results can be input into the prediction module, with each feature extraction result input into a corresponding BiGRU unit to predict individual features sequentially. Simultaneously, the step size in the BiGRU structure can be modified to predict the attack situation at different time points, where the default state is the next attack state.

[0049] For example, such as Figure 3 In the model structure diagram shown, the same layer of the prediction module can include n second bidirectional gated loop units. For example, the feature extraction result generated for a network flow from a specific source IP is input into the first second bidirectional gated loop unit of the prediction module. During calculation, this second bidirectional gated loop unit receives the outputs of the second bidirectional gated loop unit at the previous time step (e.g., processing the feature extraction result of the previous source IP) and the outputs of the second bidirectional gated loop unit at the subsequent time step (e.g., processing the feature extraction result of the next source IP). Combining the current feature extraction result, it analyzes abnormal patterns in the features (such as sudden increases in packet transmission rate, abnormally high TCP connection frequency, and other DDoS attack characteristics) through the gating mechanism, and outputs attack prediction information.

[0050] In one embodiment, such as Figure 3 As shown, the structure of the bidirectional gated loop unit in the DDoS behavior prediction module (i.e., the prediction module) can be the same as that in the feature extraction module (also known as the feature prediction module), the difference being the size of the input data.

[0051] S104. Based on the various attack prediction information, obtain the prediction results of distributed denial-of-service attacks.

[0052] The prediction result of distributed denial-of-service attacks is the final conclusive information on whether a DDoS attack will occur in the future, obtained by fusing the attack prediction information output by multiple second bidirectional gating loop units.

[0053] In practical applications, after obtaining attack prediction information corresponding to each feature extraction result, the various attack prediction information can be combined for further analysis and processing to obtain the prediction result of distributed denial-of-service attacks. In this embodiment, by obtaining network flow time-series data containing attribute information, information reflecting changes in network data traffic can be obtained, providing sufficient basis for subsequent model analysis. Subsequently, this application fully captures the temporal dependencies of the data through bidirectional gated loop units. On the one hand, by using multiple first bidirectional gated loop units for feature extraction, the bidirectional information processing capability is used to capture the sequential correlation features of the time-series data, avoiding the one-sidedness of data at a single moment and improving the accuracy of feature extraction. On the other hand, by using multiple second bidirectional gated loop units for attack prediction based on the feature extraction results, the temporal correlation information is further utilized to ensure the reliability of the attack prediction information. Finally, by comprehensively analyzing the attack prediction information, the prediction result is obtained, realizing the early and accurate prediction of DDoS attacks, which helps to accurately predict network characteristics and DDoS attack behavior.

[0054] In one embodiment, step S104, obtaining the prediction result of a distributed denial-of-service attack based on each attack prediction information, may include the following steps: inputting each attack prediction information into an attention layer; the attention layer includes multiple attention heads, each attention head being used to perform attention calculation on each input attack prediction information from the feature dimension corresponding to the attention head, to obtain the attention calculation result corresponding to the attention head; the feature dimensions corresponding to each of the multiple attention heads are different; inputting the attention layer processing result of the attention layer into a fully connected layer, and the fully connected layer determining the distributed denial-of-service attack prediction result of the network based on the attention layer processing result; the attention layer processing result is determined based on each attention calculation result.

[0055] The attention layer is a neural network module based on the attention mechanism. It can be used to differentiate the importance of different features in the input data, thereby increasing the contribution of key information to the final prediction result. The attention mechanism is a signal processing mechanism that mimics human visual cognition and can be used in deep learning models to automatically calculate the contribution of input data.

[0056] In this embodiment, as Figure 3As shown, the attack prediction model can also include an attention layer, which may contain multiple attention heads. Subsequent data processing can be based on a multi-head attention mechanism (Multi-Attention). This multi-head attention mechanism can run multiple independent attention mechanisms in parallel to obtain the attention distribution of different subspaces of the input sequence. Specifically, after obtaining the various attack prediction information in step S103, this information can be input into the attention layer for further processing. This attention layer is specifically configured as a multi-head attention structure. The multi-head attention design allows the attack prediction model to simultaneously focus on all input feature data, avoiding the problem of insufficient attention to some feature data under a single attention mechanism. Furthermore, this multi-head attention structure can automatically identify and acquire key features that have a critical impact on the attack prediction results through the model's autonomous learning process, thereby improving the accuracy and reliability of subsequent attack prediction results.

[0057] In some embodiments, the specific implementation of the above-mentioned multi-attention mechanism can be referred to Figure 4 The structure shown depicts data input to the attention layer mapped into three parts: Query (query vector), Key (a set of related vectors, also known as the construction vector), and Value (a set of vectors to be focused on, also known as the value vector). Specifically, Query refers to the vector used to initiate the query operation, retrieving information related to the current attack prediction task from the Key; Key refers to the set of vectors associated with Query, providing matching criteria for the Query's query process; and Value refers to the set of vectors that the model needs to focus on and extract effective information from, serving as the core data source for generating the attention layer's output. In one embodiment, the specific definitions of Query (Q), Key (K), and Value (V) can be determined as follows:

[0058]

[0059]

[0060]

[0061] Where X is the input feature vector / matrix, which can be understood as the encoded representation of the key or the original input, and W is the learnable parameter matrix. The superscript of W indicates the parameter matrix used to distinguish between Query, Key, and Value. Let the feature vector dimension be... The number of attention heads is Then, Query, Key and Value are obtained from the input attack prediction information based on the corresponding transformation matrix, and each attention head independently executes the above mapping process of Query, Key and Value to achieve parallel capture of different dimensions of information of input feature data.

[0062] After obtaining the outputs of each attention head, i.e., the attention calculation results, these results can be input into a fully connected layer for final prediction generation. In this embodiment, the fully connected layer can be constructed using a linear connection method, where each neuron in the fully connected layer is connected to all output nodes of the previous layer (i.e., the attention layer), and the feature information output by the attention layer is integrated through linear transformation. Finally, the output of the fully connected layer is hard-coded as 0 or 1. Encoding 0 indicates that the network has not suffered a DDoS attack at the target time, while encoding 1 indicates that the network will suffer a DDoS attack at the target time. In one embodiment, a DDoS attack prediction module can be provided. This module can map the prediction results based on the hard-coded values; a hard-coded value of 0 indicates a prediction that no DDoS attack will occur, while a hard-coded value of 1 indicates a prediction that a DDoS attack may occur, thus completing the entire attack prediction process.

[0063] In one embodiment, obtaining feature extraction results based on the output of the gating unit may include the following steps: for each gating unit output, inputting the gating unit output into a residual block cascaded with the first bidirectional gating loop unit, and obtaining the feature extraction results based on the output of the residual block.

[0064] In specific implementation, for the output of each gating unit, the output can first be input into a residual block cascaded with the first bidirectional gating loop unit, and then the final feature extraction result can be obtained based on the output of the residual block. Specifically, to avoid gradient loss during data feature information transmission, a residual block (also called a residual unit, ResUnit) can be added to the attack prediction model network structure in this embodiment to process the data feature information. For example, ... Figure 3As shown, a residual block can be cascaded after each first bidirectional gated recurrent unit in the last layer of the feature extraction module. In one embodiment, the residual structure used in the residual block can be a bottleneck residual block. Specifically, the shallow information obtained from the attack prediction model can be obtained in the residual block, and the output of the gated unit can be used as the deep information. For the shallow information in the network, it can first be input into a 1×1 convolutional layer for dimensionality reduction; after dimensionality reduction, the dimensionality-reduced information is input into a 3×3 convolutional layer to extract data features; after feature extraction, the extracted feature information is input into another 1×1 convolutional layer for dimensionality increase, so that the size of the dimensionality-increased information is restored to the original size of the shallow information; finally, the dimensionality-increased information is added to the information output of the deep layer of the network, i.e., the output of the gated unit, to complete the data feature information processing process based on the bottleneck residual structure.

[0065] Employing the aforementioned bottleneck residual structure for data feature processing enables efficient feature extraction. Specifically, the 1×1 convolutional layer effectively compresses and expands the channel dimension of data features, reducing the overall computational load of the network while accurately extracting important feature information. The 3×3 convolutional layer captures local spatial relationships within the data features, further enhancing the network's ability to express these features. Therefore, the combination of 1×1 and 3×3 convolutional layers effectively improves the overall performance of the model without significantly increasing the network's computational burden, providing reliable support for subsequent processing based on the feature extraction results. Furthermore, in this embodiment, by combining bidirectional gated recurrent units, residual blocks, and an attention mechanism, the bidirectional gated recurrent units capture the temporal dependencies of the data, while the residual units and attention mechanism enhance the model's sensitivity and understanding of complex features. Compared to traditional prediction models, this embodiment can more accurately predict attack patterns and reduce the false positive rate. Simultaneously, using a temporal prediction network allows for the prediction of network states at different points in time, providing better early warning capabilities.

[0066] In one embodiment, obtaining network flow time-series data in step S101 may include the following steps:

[0067] The process involves acquiring multiple raw network flow data points; adjusting the raw network flow data according to the target network flow length to obtain adjusted network flow data; extracting attribute information from the adjusted network flow data to obtain the final network flow data; the target network flow length is selected from multiple candidate network flow lengths based on the performance information of the attack prediction model under multiple candidate network flow lengths; and generating network flow time-series data based on the multiple network flow data points and their temporal relationships.

[0068] The raw network flow data can refer to unprocessed network flow data collected directly from the network. It can include data packet sequences and network flow attributes transmitted between network nodes, such as source IP address, destination IP address, transport protocol, data packet size, and data packet sending timestamp. It reflects the actual communication process and data interaction status in the network. For example, the network flow data shown in Table 1 can be referenced. The candidate network flow length can refer to various pre-determined network flow data length specifications used to test the performance of the attack prediction model, such as 10 packets / flow or 20 packets / flow based on the number of data packets, or 1024 bytes / flow or 2048 bytes / flow based on the number of data bytes. The performance information of the attack prediction model can refer to the model's performance indicators when predicting DDoS attacks under a specific candidate network flow length. For example, it can include accuracy, recall, and false positive rate. The target network flow length refers to the network flow length selected from multiple candidate network flow lengths that optimizes the performance of the attack prediction model, and it serves as the basis for subsequent adjustments to the raw network flow data.

[0069] In practical implementation, a candidate network flow length set can be set first. Then, network flow data corresponding to different candidate lengths can be input into the attack prediction model. The performance information of the model under each candidate length can be tested and recorded. Finally, the target network flow length can be selected through performance comparison to ensure that the subsequently adjusted network flow data can adapt to the attack prediction model and improve the reliability of the model's subsequent applications. Furthermore, after obtaining the original network flow data, it can be uniformly standardized according to the target network flow length to obtain adjusted network flow data. The length of the adjusted network flow data can be the same as the target network flow length. During the adjustment stage, data standardization can be achieved by truncation or padding based on the difference between the original network flow data and the target length. Then, attribute information can be extracted from the adjusted network flow data to obtain network flow data. Multiple network flow data can be sorted according to their temporal relationship. The structured data sequence formed by integrating the attribute information of each data point yields network flow time-series data, which can intuitively reflect the changing trend of network flow over time, providing time-dimensional feature support for subsequent attack prediction and network state analysis.

[0070] In this embodiment, the target network flow length is determined based on the performance of the attack prediction model, so that the adjusted network flow data can accurately match the model input requirements and improve the prediction accuracy. Furthermore, by integrating the attribute information and temporal relationship of the network flow data, the generated network flow time-series data not only contains the characteristics of a single network flow, but also reflects the temporal correlation of multiple network flows, which can intuitively reflect the temporal distribution pattern of network communication and provide key time dimension support for DDoS attack prediction.

[0071] In one embodiment, adjusting the original network flow data according to the target network flow length to obtain adjusted network flow data may include the following steps: obtaining the number of data packets contained in the original network flow data; if the number of data packets is greater than the target network flow length, deleting excess data packets exceeding the target network flow length from the tail according to the order of multiple data packets in the original network flow to obtain adjusted network flow data; if the number of data packets is less than the target network flow length, performing data padding at the tail of the original network flow data until the number of data packets reaches the target network flow length to obtain adjusted network flow data.

[0072] The number of data packets refers to the total number of independent data units contained in the original network flow data. After acquiring the original network flow data, the relationship between the number of data packets contained in the original network flow data and the target network flow length can be determined first. Based on the determination result, corresponding adjustment operations are performed to ensure that the adjusted network flow data length meets the requirements.

[0073] In one embodiment, after acquiring the original network flow data, the total number of data packets contained in the original network flow data is first counted, and then this total number of data packets is compared with a predetermined target network flow length. If the counted number of data packets in the original network flow data exceeds the target network flow length, the original network flow data is truncated. Specifically, the truncation process can be performed from the end according to the original order of the data packets in the original network flow data, gradually removing excess data packets that exceed the target network flow length until the number of remaining data packets in the network flow equals the target network flow length, thereby completing the adaptation and adjustment of the network flow with a number of data packets exceeding the target network flow length.

[0074] In some alternative embodiments, if the number of data packets in the original network flow data is less than the target network flow length, data padding is performed on the original network flow data to make the network flow length reach the target network flow length. For example, this data padding can be performed using zero-padding. Specifically, zero-value data packets are added sequentially to the end of the original network flow data, and the total number of network flow data packets after adding zero-value data packets is counted in real time during the addition process. When the total number of data packets reaches the target network flow length, the addition of zero-value data packets stops, thereby achieving adaptation and adjustment for network flows with insufficient data packets to the test length. Table 2 provides an example of padding (i.e., network flow 2).

[0075] Table 2

[0076]

[0077] In one embodiment, the target network flow length can be determined based on the following steps: obtaining a test length range for the network flow length; dividing the test length range according to a preset step size to obtain multiple candidate network flow lengths; for each candidate network flow length, obtaining sample network flow data for the candidate network flow length, and performing performance testing on the attack prediction model based on the sample network flow data to obtain performance information under the candidate network flow length; and determining the target network flow length from the multiple candidate network flow lengths based on the performance information under each candidate network flow length.

[0078] The test length range is a value interval used to filter candidate network flow lengths. It can be set based on the common normal and attack traffic length ranges in real-world network scenarios to avoid missing optimal values ​​due to an overly narrow range or increasing testing costs due to an overly wide range. The preset step size is the interval value for dividing the test length range; a smaller step size results in a higher density of candidate network flow lengths and higher testing accuracy. Sample network flow data refers to the network flow data used to test the attack prediction model; its acquisition method can refer to the method for acquiring original network flow data. Performance testing involves inputting the sample network flow data, truncated or padded according to the candidate network flow lengths, into the attack prediction model and statistically analyzing the model's recognition performance metrics.

[0079] In practical applications, to achieve accurate prediction of real network flows, the optimal network flow length, i.e., the target network flow length, is first obtained through variable-length traversal. When determining the target network flow length, a test length range (also known as a multi-length test range) with a preset step size (also known as a preset scale, such as 10) can be determined to verify and select the network flow length parameters that are suitable for subsequent prediction requirements through multiple sets of experiments.

[0080] In one example, the test length range can be set starting from 20 data packets. During the traversal, to ensure the validity of the experimental data and avoid a large number of empty data packets due to excessively long data packet lengths, the preset step size can be controlled to not exceed a threshold. For example, the data packet length can be increased by 10 units each time until 120 data packet lengths are reached. The resulting test length sequence is, for example, [20, 30, 40, 50, 60, 70, 80, 90, 100, 110, 120]. By traversing the different data packet lengths in this sequence one by one, the optimal solution that meets the accuracy requirements of subsequent real network flow prediction can be selected. This optimal solution will be used as a key parameter in the subsequent prediction process.

[0081] In some embodiments, the method for obtaining sample network flow data of candidate network flow lengths can refer to the method for obtaining adjusted network flow data of target network flow lengths in the foregoing embodiments. By processing different data packet counts, it can be ensured that the length of each sample network flow data accurately matches the current test length before entering the test phase, providing a foundation for the stable conduct of subsequent tests. In practical applications, the above-mentioned truncation and zero-padding processing of network flows can be flexibly executed according to the needs of the actual test scenario, and there is no need to change the original order and data information of other data packets in the network flow except for the part that needs to be adjusted, so as to ensure the effectiveness and integrity of the network flow itself. In this embodiment, the optimal network flow length is determined by variable-length traversal, which effectively reduces data redundancy and improves data processing efficiency.

[0082] In one embodiment, obtaining raw network flow data may include: determining the source IP address and destination IP address of data packets transmitted in the network; grouping each data packet into multiple data packet groups based on the source IP address and destination IP address of each data packet; wherein data packets in the same data packet group have the same source IP address and destination IP address; and for each data packet group, obtaining the raw network flow data corresponding to the data packet group based on each data packet in the data packet group.

[0083] The source IP address can be a unique network address used to identify the network device (such as a computer, server, router, etc.) that sent the data packet, thus determining the sender of the data. The destination IP address can be a unique network address used to identify the network device that received the data packet, thus determining the receiver of the data.

[0084] In practical applications, data packets transmitted from the network can be captured, and the source IP address and destination IP address used to identify the data transmission direction can be extracted from each data packet. Then, data packets can be grouped according to the source IP address and destination IP address. Data packet grouping refers to the process of grouping multiple data packets into different sets according to preset rules. In this embodiment, the preset rule is that the source IP address and destination IP address are the same, and each set is a data packet. Data packets within the same packet represent data transmitted from the same initiating device to the same receiving device. Furthermore, for each data packet, the data packets within the same packet can be integrated into a single original network flow data.

[0085] In this embodiment, on the one hand, by extracting the source IP address and destination IP address, the transmission direction of each data packet is clarified, providing an accurate basis for data classification; on the other hand, by grouping and combining data packets according to the source IP address and destination IP address, data packets of the same transmission link are aggregated, avoiding cross-interference of data from different links. Thus, the original network flow data obtained based on this ensures the accurate correspondence between the network flow data and the specific transmission link, and preserves the original characteristics of the data.

[0086] In one embodiment, extracting attribute information from the adjusted network flow data to obtain network flow data may include: determining the attribute values ​​of the adjusted network flow data under multiple network flow attributes; standardizing the attribute values ​​for numerical attribute values ​​to obtain standardized attribute information; encoding the attribute values ​​for non-numerical attribute values ​​to obtain encoded attribute information; and obtaining network flow data based on the standardized attribute information and the encoded attribute information.

[0087] In an exemplary embodiment, to achieve effective preprocessing of network traffic-related data and provide a more adaptable data foundation for subsequent model training and actual prediction, differentiated processing strategies can be adopted for different types of input data. For numerical data such as network traffic volume, number of data packets, and connection duration, Z-score normalization can be used in one embodiment. This Z-score normalization method transforms the aforementioned numerical data into a standard distribution with a mean of 0 and a standard deviation of 1. This processing method eliminates the influence of differences in the units of measurement of different numerical data, ensuring that all types of numerical data are on the same order of magnitude. This is more conducive to the subsequent model's learning and analysis of data features, improving the efficiency of model training and the accuracy of analysis results.

[0088] For non-numerical data in network stream data, the appropriate encoding method can be selected based on the data type characteristics during processing. For protocol types, a non-numerical data type, one-hot encoding is used as an example. Specifically, one-hot encoding converts different protocol types into corresponding vectors, where only the position corresponding to the current protocol type is set to 1, while all other positions are set to 0. This encoding method transforms the discrete non-numerical feature of protocol types into a numerical form that the model can recognize and process, while avoiding feature weight bias problems that may arise from simple numerical mapping of protocol types.

[0089] For non-numerical data such as source and destination IP addresses in network flow data, hash encoding can be used in some optional embodiments. A hash function maps the source and destination IP addresses to corresponding numerical values, thus converting non-numerical data into numerical form. Furthermore, to enrich the data feature dimensions and improve the model's understanding of network flow data, source and destination IP addresses can be grouped according to network segments. The grouping results are then used as new features input into the subsequent model, providing more comprehensive network flow data information. In this embodiment, by standardizing numerical attribute values ​​and encoding non-numerical attribute values, the consistency and high quality of the model input are ensured. Compared to directly using the raw data, these preprocessing steps significantly improve the model's training performance and prediction accuracy.

[0090] In one embodiment, obtaining network flow time-series data may include: determining network data filtering conditions based on pre-obtained source IP address ranges, destination IP address ranges, and protocol types; configuring a traffic monitoring tool corresponding to the network according to the network data filtering conditions, so as to obtain raw network flow data matching the network data filtering conditions through the traffic monitoring tool; and obtaining network flow time-series data based on the raw network flow data.

[0091] The source IP address range refers to the range of IP addresses of the network data initiating device, used to limit the range of devices from which the data originates. The destination IP address range refers to the range of IP addresses of the network data receiving device, and its expression can be consistent with the source IP address range, used to limit the range of devices receiving the data. Protocol type refers to the rules and standards followed by network data transmission; for example, it can include Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), etc. Network data filtering conditions refer to a set of rules formed by combining parameters such as source IP address range, destination IP address range, and protocol type, used to filter specific data that meets requirements from massive amounts of network data. Traffic monitoring tools refer to software or hardware devices used to collect and analyze network traffic data; for example, they can include open-source network traffic monitoring and analysis tools such as CICFlowMeter, which can capture data packets or flow data in the network in real time and filter data according to configured rules. Raw network flow data refers to the unprocessed raw network data captured by the traffic monitoring tool according to the filtering conditions, and may contain basic information such as the source IP, destination IP, protocol type, packet size, transmission timestamp, and port number.

[0092] In practice, a data acquisition module can be configured to collect raw network flow data. The operation of this module revolves around configuring traffic monitoring tools (such as data capture tools) to adapt them to specific network environments, thereby ensuring the accuracy and adaptability of network data collection. During configuration, the network interface parameters corresponding to the traffic monitoring tool can be set according to actual network deployment needs. Simultaneously, appropriate filtering rules can be set based on the characteristics of the data to be collected. This series of parameter configurations provides the foundation for accurately capturing the required network data.

[0093] For application scenarios with deployed servers, to further optimize data collection efficiency and reduce unnecessary data collection volume, in addition to the above configuration, the collection scope can be limited based on the network data interaction characteristics of the server, combined with parameters such as source IP address range, destination IP address range, and protocol type, to achieve targeted filtering of server-related network data. After completing the above configuration, the traffic monitoring tool can enter continuous collection mode, continuously capturing network data that meets the conditions, and generating an output file containing rich information during the collection process. The key data covered in the output file may include, but is not limited to, source IP address, destination IP address, protocol type, number of packets, number of bytes, flow start time, and flow end time. This data can provide comprehensive basic information support for subsequent network data analysis.

[0094] After obtaining the output file generated by the traffic monitoring tool, the format of the output file can be checked. For example, the output file can be in pcap format. Then, the traffic feature extraction tool built into the traffic monitoring tool can be called, and the format-checked pcap file can be used as the input data of the tool. Through the processing of the tool, the traffic feature information is finally output in the form of a CSV table. The feature information in the CSV table can be directly used for subsequent data analysis.

[0095] In the data acquisition process of this embodiment, precise filtering based on parameters such as source IP address, destination IP address, and protocol type effectively ensures the relevance and effectiveness of data acquisition. This data acquisition strategy can eliminate unnecessary data during the acquisition stage, which not only reduces the cost of subsequent data processing but also avoids interference from irrelevant data on the analysis results, thereby ensuring the accuracy of subsequent analysis. Compared with the traditional approach of broad acquisition but lack of relevance, this method has significantly greater practicality and reliability.

[0096] In one embodiment, the prediction result may include whether the network is under a distributed denial-of-service (DDoS) attack, and the type of DDoS attack. To this end, the attack prediction model can be trained using the following steps:

[0097] Identify the network data fields associated with various attack types of distributed denial-of-service attacks; the attribute values ​​under the associated network data fields are related to the attack type; collect sample network flow data containing the attribute values ​​of the associated network data fields using traffic monitoring tools; obtain sample network flow time series data for each of the various attack types based on the sample network flow time series data and attack type labels; and perform supervised training on the attack prediction model to be trained based on the sample network flow time series data and attack type labels to obtain the trained attack prediction model.

[0098] The various attack types refer to DDoS attack categories, which may include, for example, SYN Flood attacks, UDP Flood attacks, ICMP Flood attacks, and HTTP Flood attacks. The associated network data fields satisfy the requirement that their attribute values ​​are correlated with the attack type; that is, different attack types will cause significant differences in the attribute values ​​of specific fields. In specific implementations, the characteristic fields corresponding to each type of attack can be determined first to provide a basis for subsequent data collection and model training. In some embodiments, the traffic characteristics of various attacks can be analyzed based on the technical principles of DDoS attacks to determine the associated fields. For example, a SYN Flood attack exhausts server connection resources by sending a large number of half-open connection requests (SYN packets), and its main characteristics are reflected in related fields such as "number of TCP connection requests (number of SYN packets)," "half-open connection timeout time," and "source IP address diversity." A UDP Flood attack consumes bandwidth by sending a large number of UDP packets, and its associated fields include "UDP packet throughput" and "target port concentration." Sample network flow time-series data refers to sequence data formed by splicing the collected sample network flow data in chronological order of collection time, which can reflect the changing trend of network traffic within a certain time period. Attack type label refers to the true state of each sample time series data.

[0099] In some exemplary embodiments, to further refine the classification and prediction of DDoS attacks, more collected fields can be used for model training. This enables the attack prediction model to not only determine whether the network is likely to suffer a DDoS attack, but also to predict the specific attack category. For example, the attack category may include SYN Flood, UDP Flood, HTTP Flood, etc., thereby providing more accurate protection strategies for network protection and improving the pertinence and effectiveness of network security protection.

[0100] In practice, during the data collection and preprocessing stage, traffic monitoring tools can continue to be used to collect network data. In order to capture the characteristics of different types of DDoS attacks more comprehensively, additional data fields can be added. For example, TCP flags, UDP port numbers, and HTTP request methods can be added. These new fields can reflect the behavioral characteristics of various DDoS attacks from different dimensions, providing a richer data foundation for subsequent attack classification and prediction.

[0101] In the data preprocessing process, in addition to standardizing the collected numerical data and encoding the non-numerical data, special feature extraction operations can be carried out on the newly added fields. For example, for TCP flags, their frequency of occurrence and combination patterns within a specific time window can be obtained through statistical analysis; for UDP port numbers, their frequency distribution in the network flow can be analyzed to identify whether there are high-frequency access phenomena of abnormal ports; for HTTP request methods, the occurrence patterns of different request methods (such as GET, POST, etc.) in the network flow can be mined through pattern recognition, thereby obtaining preprocessed data that can effectively characterize various attack features.

[0102] In the network flow processing stage, to effectively distinguish between different types of DDoS attacks, specific feature combination schemes can be designed for different types of DDoS attacks. Specifically, for SYN Flood attacks, since their typical characteristic is a large number of TCP connection requests with the SYN flag, the frequency of the SYN flag in the TCP flag bits within a unit of time can be considered when combining features. Auxiliary features such as the connection establishment success rate of the network flow can also be combined to enhance the ability to identify SYN Flood attacks. For UDP Flood attacks, which are usually characterized by a massive influx of data packets into specific UDP ports, the distribution of UDP ports can be used as a core feature. Specifically, this can be achieved by analyzing the proportion of data packets received on different UDP ports and the burstiness of port access, thereby constructing feature combinations targeting UDP Flood attacks. For HTTP Flood attacks, which mainly consume server resources through a large number of HTTP requests, the types and frequencies of HTTP request methods can be used as key features. Statistics on the occurrence frequency of different HTTP request methods and request intervals can be compiled to form feature combinations suitable for identifying HTTP Flood attacks. Through the above feature selection and combination operations, a feature set that can effectively distinguish various types of DDoS attacks can be constructed, providing high-quality input features for subsequent model training.

[0103] In the process of building and training the model, regarding the model architecture, in one embodiment, the same input structure and network main structure as the basic attack judgment model can be adopted. At the same time, in order to achieve classification prediction of multiple attack categories, the number of category labels can be increased in the fully connected layer of the model. Specifically, the number of output nodes of the fully connected layer can be adjusted to a value corresponding to the number of attack categories according to the actual number of DDoS attack categories to be identified, and a corresponding mapping relationship between the model output and each attack category can be established, so that the model can output the predicted probability for different attack categories.

[0104] In terms of dataset preparation, datasets containing various DDoS attack types can be collected, such as the CIC-DDoS-2019 dataset. This dataset covers many common DDoS attack types and has a sufficient number of samples to meet the data diversity and scale requirements for model training. Before using the dataset, it should be partitioned. For example, it can be divided into training, validation, and test sets in a 7:2:1 ratio. The training set is used for learning model parameters, the validation set is used for parameter tuning and performance verification during model training, and the test set is used for the final performance evaluation of the model to ensure the objectivity and reliability of the model evaluation results.

[0105] During the model training phase, since the model in this embodiment is a multi-class classification model, the cross-entropy loss function can be used as the model's loss calculation function. This loss function can effectively measure the difference between the model's prediction results and the actual attack categories, providing direction for optimizing model parameters. During training, parameters such as the model's learning rate, batch size, and number of iterations can be adjusted, combined with the model's performance on the validation set (such as validation set accuracy and validation set loss value), to iteratively optimize the model and gradually improve its classification performance on the validation set until the model's performance on the validation set stabilizes and reaches the preset performance standard.

[0106] In the model evaluation and optimization phase, test set data is first input into the trained model to obtain the model's classification prediction results. Then, the multi-class performance of the model is evaluated based on these prediction results. Evaluation metrics (i.e., performance information) may include accuracy, recall, and F1 score. These metrics reflect the model's classification performance from different perspectives. Accuracy measures the overall correctness of the model's classification, recall measures the model's ability to identify and cover various types of attacks, and the F1 score comprehensively reflects both accuracy and recall, providing a basis for a comprehensive evaluation of model performance. Simultaneously, by constructing a confusion matrix, the model's accuracy and false positive rate in identifying various attack categories can be analyzed to identify which attack categories the model is deficient in (e.g., high false positive rate, high false negative rate). For the problems identified during the evaluation process, model parameters can be adjusted (e.g., adjusting the number of neurons in the fully connected layer, optimizing the learning rate strategy, etc.) or the feature set can be optimized (e.g., adding targeted features for attack categories with poor recognition performance, removing redundant features, etc.). The model is then retrained and evaluated until the model's classification performance reaches a satisfactory level.

[0107] In the practical application and result feedback phase, the trained and optimized DDoS attack classification and prediction model can be deployed in a real-time network monitoring system. This system can collect network flow data in real time and process the collected data according to the aforementioned data preprocessing and network flow processing methods to obtain feature data that meets the model input requirements. Subsequently, the feature data is input into the model, and the model can output the corresponding DDoS attack category prediction result (or a judgment result of no attack) in real time.

[0108] In this embodiment, by clarifying the correlation between attack type and network data fields, it can be ensured that the collected sample data contains the key features required for attack identification. Then, by processing the samples into time series data and combining them with attack type labels for supervised training, the model can learn the judgment logic of whether an attack exists and the attack type at the same time, achieving a two-dimensional prediction result that combines whether an attack exists and the attack type. This solves the limitation of only being able to judge the existence of an attack but not the type, and provides a basis for subsequent targeted defense.

[0109] In one embodiment, after obtaining the prediction results of distributed denial-of-service attacks based on various attack prediction information, the following steps may be included: if it is determined from the prediction results that the network will suffer a distributed denial-of-service attack at a future time, then the expected attack type of the expected distributed denial-of-service attack is determined; and a defense strategy for the expected attack type is determined and the defense strategy is triggered to take effect.

[0110] Here, "future time" can refer to any time within a preset time period from the current time. Defense strategies refer to the technical means and operational rules pre-defined for different types of DDoS attacks, which can be used to block or mitigate the impact of attacks. Examples include traffic scrubbing, access control list (ACL) configuration, session entry restrictions, and CDN traffic offloading. Each attack type can correspond to at least one defense strategy.

[0111] In practice, based on the obtained prediction results, it can be determined whether the network will suffer a DDoS attack at a set future time. When it is determined that the network is expected to suffer a distributed denial-of-service attack at a future time, the specific type of attack can be further determined, and a pre-established attack type-defense policy mapping relationship can be obtained. Based on this mapping relationship, the defense policy corresponding to each expected attack type can be determined. In some embodiments, if the defense policy is feasible, it can be distributed to the corresponding defense device through a preset triggering mechanism (such as timed triggering or event triggering) to ensure that the policy takes effect before the attack occurs; if the policy is not feasible, a backup policy can be retrieved and the above verification and triggering process can be repeated. In some embodiments, the corresponding defense policy, such as firewall rule adjustment and traffic scrubbing, can be automatically or manually activated based on the prediction results to mitigate the impact of the attack.

[0112] In other embodiments, corresponding protection strategies can be triggered in a timely manner based on the model's prediction results, such as starting a SYN Cookie protection mechanism for SYN Flood attacks and implementing port traffic restrictions for UDP Flood attacks. At the same time, the model's prediction results can be recorded and analyzed, and the model's performance in practical applications can be fed back regularly to provide practical application data support for the model's subsequent continuous optimization, thereby further improving the model's adaptability and classification accuracy in complex network environments.

[0113] In this embodiment, on the one hand, attack risks are judged in advance based on prediction results, avoiding the passive situation of starting defense only after the attack occurs; on the other hand, by accurately identifying the expected attack type, the defense strategy is ensured to be highly targeted, avoiding resource waste or defense failure; furthermore, through a controllable strategy triggering mechanism, the defense strategy is ensured to take effect before the attack occurs, minimizing the impact of the attack on network services.

[0114] To enable those skilled in the art to better understand the above steps, the following example illustrates the embodiments of this application, but it should be understood that the embodiments of this application are not limited thereto.

[0115] In this embodiment, its overall framework can be as follows: Figure 5 As shown, it includes a network data acquisition module, a network flow generation module, a network flow processing module, a DDoS attack prediction module, and a DDoS attack prediction result module. The specific steps for model training and practical application prediction are described below. Figure 6 To further explain, let's first discuss the network data acquisition module. In this module, CICFlowMeter can be used for data acquisition, as an example. Specifically, the network interface can be set as a mirror port of the user's network switch to obtain network data. The source IP address range is limited to the user's internal IP address range, such as 10.0.0.0 / 6. The destination IP address range can cover common user partner IP ranges and public service IP ranges. For protocol type filtering, only TCP, UDP, and HTTP protocols can be retained. CICFlowMeter continuously collects network data and generates an output file containing key data such as source IP address, destination IP address, protocol type, number of packets, number of bytes, flow start time, and end time. After obtaining the output file, check if its format is a pcap file. If the format is correct, use the traffic feature extraction tool in CICFlowMeter to convert it into CSV table feature information. The final data format can be seen in the example shown in Table 1.

[0116] Subsequently, for the network flow generation module, the multi-length trial range can be determined as scale 10, with an initial packet length of 20, gradually increasing to 120 packets. For each length value, network flow grouping and segmentation are performed. For example, when processing a trial with a length of 40, grouping is based on the source IP address and destination IP address. If the number of packets in a network flow is greater than 40, the excess packets are truncated at the end of the network flow; if it is less than 40, zero-padding is performed. After this processing, the network flow data can present the state shown in Table 2. Then, experiments are conducted on network flow data with different packet lengths, and the optimal accuracy result is selected for application in actual prediction.

[0117] Next, the network data can be preprocessed using the network stream processing module, which is divided into two parts: numerical data processing and non-numerical data processing. For numerical data such as network traffic size, number of packets, and connection duration, Z-score standardization can be used to eliminate the impact of differences in magnitude between different data dimensions on subsequent model training. In one embodiment, assuming there is a set of raw data representing the number of network packets, with specific values ​​of 400, 1200, and 200, the mean of this set of data is first calculated, which is 600. Then, the standard deviation of this set of data is calculated, which is 464.05. After that, each raw data point is processed according to the Z-score standardization formula (i.e., standardized value = (raw value - mean) / standard deviation). The standardized results for this set of data after processing are -0.43, 1.29, and -0.86, respectively. This standardization process can convert numerical data into standardized features that meet the requirements of model input.

[0118] For non-numerical network data, corresponding encoding methods can be adopted according to different data types. For data with discrete category attributes, such as protocol types, one-hot encoding can be used. For example, if the network protocol types to be processed include TCP, UDP, and HTTP, then when the network stream to be encoded corresponds to the HTTP protocol, one-hot encoding can convert the protocol type into a 3-dimensional encoding vector, with the specific encoding result being [0,0,1]. This encoding method can convert non-numerical protocol type information into numerical features that the model can recognize. For data with identification attributes and a large number of source and destination IP addresses, hash encoding can be performed first to convert the IP addresses into a fixed-length numerical form. Then, the encoded results can be grouped according to the network segment information of the IP addresses. Network segment grouping can further explore the correlation characteristics of IP addresses at the network topology level, providing more comprehensive feature support for subsequent attack prediction.

[0119] After preprocessing the network flow data, the DDoS attack prediction module can proceed to the next step. The DDoS attack prediction stage specifically includes three phases: model construction, data training and parameter tuning, and input of actual business data and output of results. Regarding model construction, the prediction model used in this embodiment includes a BiGRU layer, a bottleneck residual structure, and an Attention layer. The BiGRU layer is set to two layers and is used to extract temporal features from the network flow data to capture the patterns of network traffic changes over time. The input data dimension of the model is determined by the processed network flow feature dimension, which specifically includes the dimension of numerical features and the dimension of non-numerical features after encoding. In a specific example, if there are four numerical features in the input data, and each numerical feature has a dimension of 1 after standardization, while the non-numerical features have a dimension of 3 after encoding, then the total input data dimension of the model is 4 × 1 + 3 = 7. The bottleneck residual structure in the model is used for further feature extraction and dimensionality optimization of the input features. Specifically, the bottleneck residual structure first performs dimensionality reduction on the shallow input features through a 1×1 convolutional layer. In some optional embodiments, if the feature dimension input to the bottleneck residual structure is 7 as mentioned above, it can be reduced to 4 dimensions through a 1×1 convolutional layer to reduce the complexity of subsequent calculations. Then, the dimensionality-reduced features are input into a 3×3 convolutional layer, which performs depth extraction on the features to obtain more discriminative feature information. Finally, a 1×1 convolutional layer is used to upscale the extracted features to the same size as the input to the bottleneck residual structure, thereby achieving effective feature transfer and reuse. In addition, the attention layer in the model is set with two attention heads. By setting multiple attention heads, the model can allocate different attention weights on different feature dimensions, thereby focusing on features that have an important impact on DDoS attack prediction and improving the prediction accuracy of the model.

[0120] In the data training and parameter tuning phase, a large amount of network traffic data with known labels can first be collected as training data. For example, publicly available datasets such as CIC-IDS-2017 or CIC-IDS-2018 can be used. These datasets contain both normal network traffic data and network traffic data under simulated DDoS attack scenarios, providing comprehensive data support for model training. After obtaining the original dataset, the network flow generation operation and the aforementioned network flow processing operation need to be performed sequentially on the dataset to convert the original data into training data that conforms to the model input format. Subsequently, the processed training data is divided into training set, validation set, and test set according to a preset ratio. In this embodiment, the division ratio can be 7:2:1, that is, the training set data accounts for 70% of the total data volume, the validation set data accounts for 20% of the total data volume, and the test set data accounts for 10% of the total data volume.

[0121] The model training process employs stochastic gradient descent to optimize model parameters. The initial learning rate is set to 0.01. To avoid overfitting or instability caused by an excessively high learning rate, the learning rate is decayed to 0.9 times the current learning rate every 10 training epochs. During training, the loss function on the validation set is monitored in real-time. When the loss value on the validation set stops decreasing for five consecutive training epochs, the model is considered to have converged, and training is stopped to prevent overtraining from reducing the model's generalization ability. After training, the model's hyperparameters are further adjusted and optimized. Adjustable hyperparameters include the number of BiGRU layers, the number of attention heads in the attention layer, the initial learning rate, and the learning rate decay coefficient. Through multiple adjustments and tests, the optimal hyperparameter combination on the test set is selected to ensure good predictive performance in real-world applications.

[0122] In the actual business data input and result output stage, the business data in the real network environment is first processed in the same way as the training data, including data collection, network flow generation, and network flow processing, to convert the real business data into input features that the model can recognize. Then, the processed input features are input into the trained and optimized DDoS attack prediction model. The model will calculate and output the corresponding prediction results based on the input features. The prediction results are represented in a hard-coded form, where a code of 0 indicates that no DDoS attack behavior was detected in the current input network business data, and a code of 1 indicates that a DDoS attack behavior was detected in the current input network business data.

[0123] In the DDoS attack prediction module, the DDoS attack situation can be further determined and recorded based on the hard-coded results output by the model: if the model output is 0, it is determined that no DDoS attack has occurred in the current network environment; if the model output is 1, it is determined that a DDoS attack has occurred in the current network environment. At this time, relevant information about the DDoS attack can be further recorded, such as the time of the attack, the characteristics of network traffic during the attack (such as abnormal traffic size, trend of data packet number changes, etc.), and the source IP address and destination IP address network segments involved in the attack. This recorded information can be used for subsequent analysis of DDoS attack behavior, summarizing attack patterns and characteristics, and thus providing data support for optimizing network security protection strategies and improving the network's ability to defend against DDoS attacks.

[0124] The above embodiments provide a DDoS attack prediction method based on Multi-Attention-BiGRU, which can significantly improve prediction accuracy and response speed, especially demonstrating remarkable performance in complex network environments. In the data acquisition module, CICFlowMeter is configured to accurately capture network data, ensuring data integrity and accuracy, and providing solid data support for subsequent analysis. In the network flow generation module, a variable-length traversal strategy is used to determine the optimal network flow length, and data packets are grouped, truncated, or zero-padding is performed to ensure data consistency and validity. This addresses the shortcomings of traditional methods in data preprocessing and improves the flexibility and efficiency of data processing. In the network flow processing module, numerical data is Z-score normalized, and non-numerical data is processed through one-hot encoding and hash encoding to optimize the data format, facilitate model training, help ensure data quality, and provide good input for deep learning model training. In the DDoS attack prediction module, a ResFeature-Attention-BiGRU network architecture is adopted. Through two sub-modules—feature extraction and DDoS behavior prediction—combined with a multi-head attention mechanism, it accurately predicts abnormal behaviors in network flows. Deep learning technology significantly improves the accuracy and real-time performance of predictions, effectively addressing complex and ever-changing network attacks. Finally, in the DDoS attack result module, an attack is determined based on the prediction results, and the system promptly outputs whether a DDoS attack has occurred, providing strong technical support for network security protection. This embodiment solves the limitations of traditional DDoS prediction methods in complex network environments, overcomes the challenges of prediction accuracy and response speed, achieves accurate prediction and rapid response to DDoS attacks, and improves the system's robustness and adaptability. By introducing deep learning technology, this embodiment not only adapts to the prediction needs of different network flows but also significantly improves prediction efficiency and accuracy, providing outputs that are more conducive to the prevention and handling of DDoS attacks, offering strong technical protection for network security.

[0125] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0126] Based on the same inventive concept, this application also provides a distributed denial-of-service (DDoS) attack prediction apparatus for implementing the aforementioned DDoS attack prediction method. The solution provided by this apparatus is similar to the implementation described in the above-described method; therefore, the specific limitations in one or more DDoS attack prediction apparatus embodiments provided below can be found in the limitations of the DDoS attack prediction method described above, and will not be repeated here. In an exemplary embodiment, such as... Figure 7 As shown, a device for predicting distributed denial-of-service (DDoS) attacks is provided, comprising: a time-series data acquisition module 701, used to acquire network flow time-series data; the network flow time-series data includes attribute information corresponding to each of multiple network flow data; a first processing module 702, used to input the network flow time-series data into multiple first bidirectional gated loop units of a feature extraction module in an attack prediction model; each first bidirectional gated loop unit is used to determine a gate unit output result based on the output of the first bidirectional gated loop unit at a previous time step and the output of the first bidirectional gated loop unit at a subsequent time step; a second processing module 703, used to acquire feature extraction results based on the gate unit output results, and input multiple feature extraction results into multiple second bidirectional gated loop units of a prediction module in an attack prediction model; each second bidirectional gated loop unit is used to determine attack prediction information corresponding to the current feature extraction result based on the output of the second bidirectional gated loop unit at a previous time step and the output of the second bidirectional gated loop unit at a subsequent time step; and a prediction result acquisition module 704, used to acquire a prediction result of a DDoS attack based on each of the attack prediction information.

[0127] In one embodiment, the prediction result acquisition module 704 is configured to: input each of the attack prediction information into an attention layer; the attention layer includes multiple attention heads, each attention head being configured to perform attention calculation on each of the input attack prediction information from the feature dimension corresponding to the attention head, to obtain the attention calculation result corresponding to the attention head; the multiple attention heads each correspond to different feature dimensions; input the attention layer processing result of the attention layer into a fully connected layer, and the fully connected layer determines the distributed denial-of-service attack prediction result of the network based on the attention layer processing result; the attention layer processing result is determined based on each of the attention calculation results.

[0128] In one embodiment, the second processing module 703 is configured to: input the output result of each gated unit into a residual block cascaded with the first bidirectional gated loop unit, and obtain feature extraction results based on the output of the residual block.

[0129] In one embodiment, the time-series data acquisition module 701 is configured to: acquire multiple raw network flow data from the network; adjust the raw network flow data according to the target network flow length to obtain adjusted network flow data, and extract attribute information from the adjusted network flow data to obtain network flow data; wherein the target network flow length is selected from the multiple candidate network flow lengths based on the performance information of the attack prediction model under multiple candidate network flow lengths; and generate network flow time-series data based on the multiple network flow data and the time-series relationship of the multiple network flow data.

[0130] In one embodiment, the timing data acquisition module 701 is configured to: acquire the number of data packets contained in the original network flow data; if the number of data packets is greater than the target network flow length, delete excess data packets exceeding the target network flow length from the tail according to the order of multiple data packets in the original network flow to obtain adjusted network flow data; if the number of data packets is less than the target network flow length, perform data padding at the tail of the original network flow data until the number of data packets reaches the target network flow length to obtain adjusted network flow data.

[0131] In one embodiment, the time-series data acquisition module 701 is configured to: determine the source IP address and destination IP address of data packets transmitted in the network; group each data packet according to its source IP address and destination IP address to obtain multiple data packet groups; wherein data packets in the same data packet group have the same source IP address and destination IP address; and for each data packet group, obtain the original network flow data corresponding to the data packet group according to each data packet in the data packet group.

[0132] In one embodiment, the apparatus is further configured to: obtain a test length range for network flow length; divide the test length range according to a preset step size to obtain multiple candidate network flow lengths; for each candidate network flow length, obtain sample network flow data for the candidate network flow length, and perform performance testing on the attack prediction model based on the sample network flow data to obtain performance information under the candidate network flow length; and determine the target network flow length from the multiple candidate network flow lengths based on the performance information under each candidate network flow length.

[0133] In one embodiment, the time-series data acquisition module 701 is configured to: determine the attribute values ​​of the adjusted network flow data under multiple network flow attributes; for numerical attribute values, standardize the attribute values ​​to obtain standardized attribute information; for non-numerical attribute values, encode the attribute values ​​to obtain encoded attribute information; and obtain network flow data based on the standardized attribute information and the encoded attribute information.

[0134] In one embodiment, the time-series data acquisition module 701 is configured to: determine network data filtering conditions based on pre-acquired source IP address range, destination IP address range, and protocol type; configure the traffic monitoring tool corresponding to the network according to the network data filtering conditions, so as to obtain raw network flow data matching the network data filtering conditions through the traffic monitoring tool; and acquire network flow time-series data based on the raw network flow data.

[0135] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores network streaming data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a method for predicting distributed denial-of-service attacks.

[0136] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0137] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments. In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program, when executed by a processor, implements the steps in the above-described method embodiments. In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps in the above-described method embodiments.

[0138] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0139] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0140] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this application. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for predicting distributed denial-of-service attacks, characterized in that, The method includes: Obtain network flow time-series data; the network flow time-series data includes attribute information corresponding to each of multiple network flow data; The network flow time-series data is input into multiple first bidirectional gated loop units of the feature extraction module in the attack prediction model; each first bidirectional gated loop unit is used to determine the gate unit output result based on the output of the first bidirectional gated loop unit at the preceding time and the output of the first bidirectional gated loop unit at the following time. The feature extraction result is obtained based on the output of the gating unit, and the multiple feature extraction results are respectively input into multiple second bidirectional gating loop units of the prediction module in the attack prediction model; each second bidirectional gating loop unit is used to determine the attack prediction information corresponding to the current feature extraction result based on the output of the second bidirectional gating loop unit at the previous time step and the output of the second bidirectional gating loop unit at the subsequent time step. Based on the attack prediction information provided, the prediction results for distributed denial-of-service attacks are obtained.

2. The method according to claim 1, characterized in that, The step of obtaining the prediction result of the distributed denial-of-service attack based on each of the attack prediction information includes: Each of the attack prediction information is input into the attention layer; the attention layer includes multiple attention heads, each of which is used to perform attention calculation on each of the input attack prediction information from the feature dimension corresponding to the attention head, and obtain the attention calculation result corresponding to the attention head; the feature dimensions corresponding to the multiple attention heads are different; The attention layer processing result is input into the fully connected layer, and the fully connected layer determines the distributed denial-of-service attack prediction result of the network based on the attention layer processing result; the attention layer processing result is determined based on the individual attention calculation results.

3. The method according to claim 2, characterized in that, The step of obtaining the feature extraction result based on the output of the gating unit includes: For each gated unit output, the gated unit output is input into a residual block cascaded with the first bidirectional gated loop unit, and the feature extraction result is obtained based on the output of the residual block.

4. The method according to claim 1, characterized in that, The acquisition of network flow time-series data includes: Acquire multiple raw network flow data from the network; The original network flow data is adjusted according to the target network flow length to obtain adjusted network flow data, and attribute information is extracted from the adjusted network flow data to obtain network flow data; wherein, the target network flow length is selected from the multiple candidate network flow lengths based on the performance information of the attack prediction model under multiple candidate network flow lengths; Network flow time series data is generated based on multiple network flow data and their temporal relationships.

5. The method according to claim 4, characterized in that, The step of adjusting the original network flow data according to the target network flow length to obtain adjusted network flow data includes: Obtain the number of data packets contained in the original network flow data; If the number of data packets is greater than the target network flow length, then the excess data packets exceeding the target network flow length are deleted from the end according to the order of multiple data packets in the original network flow to obtain the adjusted network flow data; If the number of data packets is less than the target network flow length, data padding is performed at the end of the original network flow data until the number of data packets reaches the target network flow length, resulting in adjusted network flow data.

6. The method according to claim 4, characterized in that, The acquisition of raw network flow data includes: Determine the source IP address and destination IP address of data packets transmitted over the network; Based on the source IP address and destination IP address of each data packet, the data packets are grouped to obtain multiple data packet groups; wherein, the data packets in the same data packet group have the same source IP address and destination IP address; For each data packet, the original network flow data corresponding to the data packet is obtained based on each data packet in the data packet.

7. The method according to claim 4, characterized in that, The target network flow length is determined based on the following steps: Test length range to obtain network flow length; The test length range is divided according to a preset step size to obtain multiple candidate network flow lengths; For each candidate network flow length, sample network flow data for that candidate network flow length is obtained, and the attack prediction model is tested based on the sample network flow data to obtain performance information for that candidate network flow length. Based on the performance information of each candidate network flow length, the target network flow length is determined from the plurality of candidate network flow lengths.

8. The method according to claim 4, characterized in that, The step of extracting attribute information from the adjusted network flow data to obtain network flow data includes: Determine the attribute values ​​of the adjusted network flow data under multiple network flow attributes; For the numerical attribute values, the attribute values ​​are standardized to obtain standardized attribute information; For non-numerical attribute values, the attribute values ​​are encoded to obtain encoded attribute information; Network stream data is obtained based on the standardized attribute information and the encoded attribute information.

9. The method according to claim 1, characterized in that, The acquisition of network flow time-series data includes: Based on the pre-obtained source IP address range, destination IP address range, and protocol type, determine the network data filtering criteria; Configure the traffic monitoring tool corresponding to the network according to the network data filtering conditions, so as to obtain the original network flow data that matches the network data filtering conditions through the traffic monitoring tool; Based on the original network flow data, obtain the network flow time series data.

10. The method according to claim 1, characterized in that, The prediction results include whether the network is under a distributed denial-of-service (DDoS) attack, and the type of DDoS attack; the attack prediction model is trained through the following steps: Identify the network data fields associated with various attack types of distributed denial-of-service attacks; the attribute values ​​under the associated network data fields are related to the attack type. Using network traffic monitoring tools, sample network flow data containing attribute values ​​of the associated network data fields are collected; Based on the sample network flow data, obtain the sample network flow time series data for each of the various attack types, and perform supervised training on the attack prediction model to be trained based on the sample network flow time series data and attack type labels to obtain the trained attack prediction model.

11. The method according to claim 10, characterized in that, After obtaining the prediction result of the distributed denial-of-service attack based on each of the attack prediction information, the method further includes: If it is determined from the prediction results that the network will suffer from the distributed denial-of-service attack at a future time, then the expected attack type of the expected distributed denial-of-service attack is determined. Determine the defense strategy for the expected attack type and trigger the defense strategy to take effect.

12. A device for predicting distributed denial-of-service attacks, characterized in that, The device includes: The timing data acquisition module is used to acquire network flow timing data of the network; the network flow timing data includes attribute information corresponding to each of multiple network flow data. The first processing module is used to input the network flow time-series data into multiple first bidirectional gated loop units of the feature extraction module in the attack prediction model; each first bidirectional gated loop unit is used to determine the gate unit output result based on the output of the first bidirectional gated loop unit at the preceding time and the output of the first bidirectional gated loop unit at the following time. The second processing module is used to obtain feature extraction results based on the output of the gating unit, and input the multiple feature extraction results into multiple second bidirectional gating loop units of the prediction module in the attack prediction model; each second bidirectional gating loop unit is used to determine attack prediction information corresponding to the current feature extraction result based on the output of the second bidirectional gating loop unit at the previous time step and the output of the second bidirectional gating loop unit at the subsequent time step. The prediction result acquisition module is used to acquire the prediction result of distributed denial-of-service attacks based on the various attack prediction information.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 11.

Images