Fault-tolerant control system and method for denial of service attack flow based on packet loss detection

Abstract

The invention discloses a packet loss detection-based denial of service attack flow fault-tolerant control system and method, and relates to the technical field of network security, and the method comprises a network packet loss detection control module and a flow priority adjustment module. And the network packet loss detection control module constructs a packet loss detection path meeting a link single coverage condition, ensures that each link only appears in a single path, sends a packet loss detection data packet through the network packet loss detection auxiliary device, and determines an abnormal switch input-output pair according to the packet loss condition. The flow priority adjustment module obtains a data flow set passing through the abnormal switch input-output pair, the forwarding priority is dynamically adjusted through multiple priority adjustment and abnormity verification steps, and the suspicious denial of service attack flow is set to be the lowest forwarding priority until abnormity is eliminated. According to the method, a dynamic priority adjustment mechanism is adopted to limit suspicious traffic without interrupting service, so that attack influence is relieved, misjudgment is reduced, and network toughness is enhanced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a fault-tolerant control system and method for denial-of-service attack flows based on packet loss detection. Background Technology

[0002] Denial-of-service (DoS) attacks involve malicious traffic designed to exhaust the resources of a target system, including network bandwidth and server computing power. Attackers generate massive amounts of malicious traffic to force the target service to stop or completely crash. Due to the high severity of DoS attacks, effective defense against them is crucial. Software-defined networking (SDN) environments, due to their centralized control characteristics, exhibit particular vulnerability to DoS attacks. Attackers can disrupt the normal operation of the entire network by launching attacks against the control plane, making DoS attack defense in SDN environments especially urgent and important.

[0003] In recent years, researchers have proposed various methods for detecting denial-of-service attacks in software-defined networking (SDN) environments. These methods can be broadly categorized into two types: detection methods based on traffic feature analysis and detection methods based on machine learning. Traffic feature analysis-based methods identify anomalies by analyzing the statistical characteristics of network traffic, such as changes in traffic rate and packet size distribution. Machine learning-based methods utilize various algorithmic models to train and classify network traffic data to identify potential denial-of-service attack traffic. Both methods fully leverage the advantages of the software-defined network architecture, particularly its centralized control characteristics and global network view, providing convenient conditions for traffic monitoring and analysis.

[0004] However, existing denial-of-service (DoS) attack detection methods still have significant shortcomings in accurately identifying DoS attack flows. Due to the complexity of network traffic and the continuous evolution of attack techniques, feature-based methods are prone to misjudgments, while machine learning methods often perform poorly when facing new attack patterns. More importantly, these methods mainly focus on the attack detection phase and lack effective countermeasures after attack traffic bypasses the detection system. They cannot provide timely and effective fault-tolerant control when the attack has already caused network congestion, resulting in significant gaps in the existing defense system.

[0005] To address the aforementioned technical deficiencies, there is an urgent need for a supplementary solution that can still provide effective protection even after a denial-of-service attack bypasses the defense system. The denial-of-service attack flow fault-tolerant control device and method based on packet loss detection proposed in this invention aims to fill this technical gap. By rapidly detecting attacks when they achieve their objectives and taking corresponding control measures, it provides a deeper level of protection for software-defined network security. Summary of the Invention

[0006] The technical problem to be solved by this invention is to address the shortcomings of existing technologies. Specifically, it provides a fault-tolerant control system and method for denial-of-service attack flows based on packet loss detection, as detailed below: 1) In a first aspect, the present invention provides a fault-tolerant control system for denial-of-service attack flows based on packet loss detection, the specific technical solution of which is as follows: Includes: a network packet loss detection and control module and a flow priority adjustment module; The network packet loss detection control module is used to: construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link in the software-defined network. The single-pass coverage condition means that each link in the software-defined network appears in one and only one packet loss detection path. The network packet loss detection control module is also used to: send packet loss detection data packets to each packet loss detection path through the network packet loss detection auxiliary device, and determine the abnormal switch input-output pairs according to the packet loss situation; wherein, the switch input-output pair refers to the logical path that the packet loss detection data packet traverses from the ingress port to the egress port within a switch; The flow priority adjustment module is used to: obtain the data flow set of each abnormal switch input-output pair, and dynamically adjust the forwarding priority of the data flow in the data flow set through multiple priority adjustment and abnormal verification steps, set the forwarding priority of suspicious denial-of-service attack flow to the lowest forwarding priority, until all abnormal switch input-output pairs are no longer judged as abnormal.

[0007] The beneficial effects of the denial-of-service attack flow fault-tolerant control system based on packet loss detection provided by this invention are as follows: The network packet loss detection control module constructs packet loss detection paths that meet the single-coverage condition of the links, ensuring that each link in the software-defined network appears on only one packet loss detection path, avoiding detection interference and thus improving the reliability and accuracy of packet loss detection. This module sends packet loss detection data packets through a network packet loss detection auxiliary device and quickly identifies abnormal switch input-output pairs based on packet loss conditions, promptly locating network congestion points caused by denial-of-service attacks. The flow priority adjustment module dynamically adjusts the forwarding priority of data flows by acquiring the set of data flows passing through abnormal switch input-output pairs and performing multiple priority adjustment and anomaly verification steps. It sets the forwarding priority of suspicious denial-of-service attack flows to the lowest forwarding priority without directly interrupting the data flow. This process iterates until all abnormal switch input-output pairs are no longer judged as abnormal, effectively mitigating the impact of denial-of-service attacks and minimizing false positives to normal data flows, thus improving the availability and resilience of network services. This solution, as a supplement to the existing defense system, enhances the overall protection capability of software-defined networks against attacks that bypass detection.

[0008] Based on the above scheme, the fault-tolerant control system for denial-of-service attack flow based on packet loss detection of the present invention can be further improved as follows.

[0009] Furthermore, the network packet loss detection control module is specifically used to: construct the Eulerian circuit of the software-defined network, and divide the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link.

[0010] The beneficial effects of adopting the above-mentioned further scheme are as follows: By constructing Eulerian circuits in the software-defined network and dividing these circuits to create a set of packet loss detection paths that satisfy the single-coverage condition of the links, this method ensures that each link in the network appears in only one packet loss detection path, thereby effectively avoiding detection interference between different paths. The construction of Eulerian circuits utilizes the connectivity principle in graph theory, ensuring complete and non-repeating path coverage. The segmentation process uses network packet loss detection auxiliary devices as nodes to divide the circuit into multiple independent packet loss detection paths. This construction method not only simplifies the complexity of path deployment but also improves the comprehensiveness and reliability of packet loss detection. Since each link is uniquely covered, the transmission of probe data packets will not affect each other, reducing the possibility of false alarms and missed alarms, thereby improving the accuracy of packet loss detection. In addition, this method supports dynamic adjustment; when the network topology changes, the Eulerian circuits and segmented paths can be recalculated to ensure the continuous effectiveness of detection. Ultimately, this path construction based on Eulerian circuits provides an efficient and scalable foundation for the network packet loss detection control module, enhancing the monitoring capabilities of software-defined networks in the face of denial-of-service attacks.

[0011] Furthermore, the network packet loss detection control module is specifically used to: enable the network packet loss detection auxiliary device to send packet loss detection data packets to each packet loss detection path in a periodic-random mixed mode. The periodic-random mixed mode means: dividing the packet loss detection time into packet loss detection time slots of fixed length, and continuously sending m packet loss detection data packets at random times within the packet loss detection time slots, where m is a positive integer.

[0012] The advantages of adopting the above-mentioned further scheme are: random sending times make denial-of-service attacks unpredictable in their probing behavior, thus making it difficult to evade detection; the fixed time slot structure allows for smaller time slot lengths, increasing the probing frequency and enhancing real-time performance; and continuous sending of multiple data packets improves the reliability of the probing and reduces false positives caused by brief network fluctuations. Ultimately, this mode ensures the accuracy and efficiency of packet loss detection, providing reliable data support for the identification of abnormal switch input-output pairs.

[0013] Furthermore, the network packet loss detection control module is also specifically used to: when the network packet loss detection auxiliary device determines the packet loss detection path where packet loss occurs, obtain the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss occurs, and determine the switch input-output pairs whose packet loss frequency exceeds a specified threshold as abnormal switch input-output pairs.

[0014] The advantages of adopting the above-mentioned further approach are: Quantitative judgment based on packet loss frequency avoids subjective errors and improves the objectivity and reliability of anomaly detection. Threshold comparison quickly identifies problem areas, reducing the possibility of misjudgment and ensuring targeted subsequent processing. This method enhances the response efficiency of the network packet loss detection and control module, provides accurate input to the flow priority adjustment module, and thus improves the overall system's fault tolerance.

[0015] 2) Secondly, the present invention also provides a fault-tolerant control method for denial-of-service attack flows based on packet loss detection, the specific technical solution of which is as follows: In a software-defined network, construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the links. The single-pass coverage condition means that each link in the software-defined network appears in one and only one packet loss detection path. The network packet loss detection auxiliary device sends packet loss detection data packets to each packet loss detection path, and determines the abnormal switch input-output pairs based on the packet loss situation; where, the switch input-output pair refers to the logical path that the packet loss detection data packet traverses from the ingress port to the egress port within a switch. The system acquires the data flow set of each abnormal switch input-output pair and dynamically adjusts the forwarding priority of the data flow in the data flow set through multiple priority adjustment and abnormal verification steps. The forwarding priority of suspicious denial-of-service attack flows is set to the lowest forwarding priority until all abnormal switch input-output pairs are no longer judged as abnormal.

[0016] Based on the above scheme, the fault tolerance control method for denial-of-service attack flow based on packet loss detection of the present invention can be further improved as follows.

[0017] Furthermore, in the software-defined network, a set of packet loss detection paths that satisfy the single-pass coverage condition of the link are constructed, including: constructing an Eulerian circuit of the software-defined network and dividing the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link.

[0018] Furthermore, the network packet loss detection auxiliary device sends packet loss detection data packets to each packet loss detection path, including: enabling the network packet loss detection auxiliary device to send packet loss detection data packets to each packet loss detection path in a periodic-random mixed mode. The periodic-random mixed mode refers to: dividing the packet loss detection time into packet loss detection time slots of fixed length, and continuously sending m packet loss detection data packets at random times within the packet loss detection time slots, where m is a positive integer.

[0019] Furthermore, the abnormal switch input-output pairs are determined based on the packet loss situation, including: when the network packet loss detection auxiliary device determines the packet loss detection path where packet loss occurs, the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss occurs is obtained, and the switch input-output pairs whose packet loss frequency exceeds a specified threshold are determined as abnormal switch input-output pairs.

[0020] 3) In a third aspect, the present invention also provides an electronic device, the electronic device including a processor coupled to a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor, so that the electronic device implements any of the above-mentioned denial-of-service attack flow fault tolerance control methods based on packet loss detection.

[0021] 4) In a fourth aspect, the present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements any of the above-mentioned denial-of-service attack flow fault-tolerant control methods based on packet loss detection.

[0022] It should be noted that the beneficial effects of the technical solutions of the second to fourth aspects of the present invention and their corresponding possible implementations can be found in the above description of the technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below: Figure 1 This is one of the structural schematic diagrams of a denial-of-service attack flow fault-tolerant control system based on packet loss detection according to an embodiment of the present invention; Figure 2 This is a second schematic diagram of a fault-tolerant control system for denial-of-service attack streams based on packet loss detection, according to an embodiment of the present invention. Figure 3 Construct a flowchart for the packet loss detection path; Figure 4 This is a flowchart illustrating a denial-of-service attack flow fault tolerance control method based on packet loss detection according to an embodiment of the present invention. Figure 5This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0024] The principles and features of the present invention are described below. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0025] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0026] like Figure 1 As shown in the figure, a fault-tolerant control system for denial-of-service attack flow based on packet loss detection according to an embodiment of the present invention includes: a network packet loss detection control module and a flow priority adjustment module; The network packet loss detection control module is used to: construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link in a software-defined network, specifically: Construct an Eulerian circuit for a software-defined network, and divide the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link.

[0027] Software-defined networking (SDN) is a network architecture whose core idea is to separate the network's control plane from its data plane. The control plane is managed by a logically centralized controller that manages network resources through software programming, while the data plane is handled by devices such as switches that perform packet forwarding. This architecture provides flexibility and automation in network management, making network traffic monitoring and policy enforcement more efficient.

[0028] Eulerian circuits are a concept in graph theory, referring to a path in a connected graph that traverses every edge exactly once, with the starting and ending points coinciding. In software-defined networking environments, Eulerian circuits are used to traverse all links in the network topology exactly once, ensuring that each link is covered without repetition, thus providing a foundation for constructing subsequent packet loss detection paths.

[0029] The packet loss detection path is a predefined network path constructed by the software-defined network controller (SDB) for transmitting packet loss detection data packets. These paths satisfy the single-pass coverage condition, ensuring that each link in the network appears in only one packet loss detection path, thereby avoiding detection interference between different paths. The packet loss detection path starts and ends at the network packet loss detection auxiliary device and is deployed to the network switch via the flow table installation instructions of the SDB.

[0030] The single-path coverage condition in a software-defined network (SDN) means that each link in the network must appear in exactly one packet loss detection path. This condition aims to prevent interference between different packet loss detection paths, thus ensuring the accuracy of packet loss detection. For example, consider a simple network topology with three links L1, L2, and L3. If two packet loss detection paths are constructed, where the first path includes links L1 and L2, and the second path includes link L3, then each link appears in only one path, satisfying the single-path coverage condition. Conversely, if the first path includes both L1 and L2, and the second path also includes L1, then link L1 appears in multiple paths, violating the single-path coverage condition.

[0031] The specific implementation process for constructing a set of packet loss detection paths is as follows: 1) Obtain complete topology information for the software-defined network. Topology information includes all switches, network packet loss detection aids, and the physical links between them. The network topology is modeled as an undirected graph, denoted as [Graph showing network topology]. ,in This represents a set of vertices, symbolizing devices in the network, including switches and network packet loss detection aids. An undirected graph represents a set of edges, symbolizing the physical links between devices. The conditions for ensuring the existence of an Eulerian circuit are met: connectivity and all vertices having even degrees. Then, an Eulerian circuit construction algorithm, such as Fleury's algorithm, is applied to construct the circuit. The basic steps of Fleury's algorithm are: starting from any vertex, traversing edges, prioritizing non-bridge edges unless there are no other options, thus ensuring that the path traverses each edge exactly once and returns to the starting point. Specifically, let the current path be... Initially empty; from vertex Initially, select one edge at a time. This makes deletion The following diagram is still connected or As the only option, Add path The process is repeated until all edges have been traversed, eventually forming an Eulerian circuit. An Eulerian circuit can be represented as a sequence of vertices and edges. ,in Indicates the first One vertex, Indicates the first The length of each edge sequence depends on the network size.

[0032] 2) Using the network packet loss detection auxiliary devices as dividing points, the Eulerian circuit is divided into multiple packet loss detection paths. Specifically, the positions of all network packet loss detection auxiliary devices are identified along the sequence of the Eulerian circuit. Assume that the vertex sequence of the Eulerian circuit contains... A network packet loss detection auxiliary device, denoted as Starting with any network packet loss detection auxiliary device, for example... Traversing along the Eulerian circuit, each time a network packet loss detection auxiliary device is encountered... At that time, it will move from the previous network packet loss detection auxiliary device to The sub-path is extracted into a packet loss detection path. Since the Eulerian circuit is closed, the last segment may originate from... Return to However, to ensure that each packet loss detection path begins and ends with the network packet loss detection auxiliary device, the segmentation process needs to process the entire loop cyclically. Ultimately, a set of packet loss detection paths is generated. Each path It consists of a series of continuous edges, with both the starting and ending points being network packet loss detection auxiliary devices. Since each edge in an Eulerian circuit appears only once, after segmentation, each edge belongs to only one packet loss detection path, thus satisfying the single-coverage condition of the link.

[0033] The network packet loss detection control module is also used to: send packet loss detection data packets to each packet loss detection path through the network packet loss detection auxiliary device, and determine the abnormal switch input-output pairs based on the packet loss situation.

[0034] Among them, the network packet loss detection auxiliary device is a server device deployed in a software-defined network (SDN) to assist in network packet loss detection. These devices are deployed according to the needs of network operators, with less stringent performance requirements. Their main responsibility is to generate and receive packet loss probe data packets to help detect packet loss in the network path. The network packet loss detection auxiliary device works in conjunction with the SDN controller to achieve automated and distributed management of packet loss detection.

[0035] Among them, packet loss detection packets are special packets, typically using the UDP protocol, sent by the network packet loss detection auxiliary device to detect packet loss along the network path. These packets are transmitted along the packet loss detection path, and the network packet loss detection auxiliary device at the destination determines whether packet loss has occurred based on the received data. The content and format of the packet loss detection packets are defined by the network packet loss detection control module to ensure the accuracy and efficiency of the detection.

[0036] The process includes sending packet loss detection data packets to each packet loss detection path via a network packet loss detection auxiliary device, including: The network packet loss detection auxiliary device sends packet loss detection data packets to each packet loss detection path in a periodic-random hybrid mode.

[0037] The periodic-random hybrid mode refers to dividing the packet loss detection time into fixed-length packet loss detection slots, and continuously sending m packet loss detection data packets at random times within each packet loss detection slot, where m is a positive integer. This periodic-random hybrid mode is a data packet sending pattern that divides the packet loss detection time into fixed-length slots, called packet loss detection slots, and continuously sends multiple packet loss detection data packets at random times within each packet loss detection slot. For example, assuming the packet loss detection slot length is 1 second, within each slot, a random time, such as 0.3 seconds, is selected to continuously send two UDP data packets. This mode combines periodicity and randomness, making it difficult for denial-of-service attacks to evade detection, while improving the timeliness and reliability of packet loss detection.

[0038] The specific implementation process of sending packet loss detection data packets is described as follows: 1) Configure relevant parameters for the network packet loss detection control module, and denot the packet loss detection time slot length as follows: The unit is seconds, for example The specific value is dynamically specified by the network packet loss detection control module based on network conditions, in seconds. The number of packet loss detection data packets continuously sent within each packet loss detection time slot is denoted as... ,in These are positive integers, with a default value of 2, but can be adjusted based on network load and detection requirements. These parameters are sent to the network packet loss detection auxiliary device through the configuration interface of the software-defined network controller.

[0039] 2) Initialization Time Management of the Network Packet Loss Detection Auxiliary Device. The network packet loss detection auxiliary device maintains a global clock internally and divides time into continuous packet loss detection time slots. The start time of each packet loss detection time slot is recorded as follows: ,in Indicates the time slot index. Time slot length To maintain consistency, therefore the first The time interval of each time slot is The network packet loss detection auxiliary device starts a local timer at the beginning of each time slot to manage the timing of packet transmission.

[0040] Within each packet loss detection time slot, the network packet loss detection auxiliary device generates a random time offset. This random time offset is denoted as... ,in It is in the interval A uniformly distributed random variable. Random time offset. The generation uses a pseudo-random number algorithm to ensure that the number of times within each time slot is within a certain range. The values ​​are independent and unpredictable. For example, in programming implementations, standard library functions can be used to generate... ,like ,in The function returns a uniformly distributed floating-point number.

[0041] Then, the network packet loss detection auxiliary device sends packet loss detection data packets at random time points. Specifically, at the start time of the time slot. The time after The device continuously sends signals at that location. UDP packet loss detection packets. The packet sending interval is denoted as . The unit is seconds, usually This is set to an extremely small value, such as milliseconds, to ensure that data packets are sent continuously within a short period. Each packet loss detection packet contains a sequence number and timestamp information, which are used by the destination device to determine packet loss. The sending process is implemented through a network socket interface, and data packets are directed to the corresponding packet loss detection path.

[0042] 3) The network packet loss detection auxiliary device monitors data packet reception at the endpoint. The endpoint device determines the packet loss detection time slot length based on the data packet loss detection time slot length. and number of messages sent Expected to receive data packets; if not all packets are received within the time slot. If a data packet is detected, it is determined that packet loss has occurred along the path, and the network packet loss detection and control module is notified. The entire sending process is repeated periodically to ensure the continuity and real-time nature of network packet loss detection.

[0043] Among them, identifying abnormal switch input-output pairs based on packet loss includes: When the network packet loss detection auxiliary device determines the packet loss detection path where packet loss occurs, it obtains the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss occurs, and identifies the switch input-output pairs whose packet loss frequency exceeds a specified threshold as abnormal switch input-output pairs.

[0044] In this context, a switch input-output pair refers to the logical path a packet loss detection data packet follows within a switch, from its ingress port to its egress port. The input port is where the packet enters the switch, and the output port is where it leaves. For example, if a packet enters from port 1 (the ingress port) and is forwarded from port 2 (the egress port), the forwarding path from port 1 to port 2 constitutes a switch input-output pair. This pairing is used to accurately identify packet loss locations within the switch, regardless of packet loss on the physical link.

[0045] The specific implementation process of the network packet loss detection auxiliary device in determining the packet loss detection path when packet loss occurs is as follows: 1) The device synchronizes the global clock via a software-defined network controller or network time protocol to ensure time consistency across all network packet loss detection auxiliary devices. Time is divided into consecutive packet loss detection time slots, each with a fixed length. seconds, for example The time in seconds is specified by the network packet loss detection control module. The start time of each packet loss detection slot is denoted as . ,in Indicates the time slot index. Time slot The time interval is The network packet loss detection auxiliary device maintains an internal timer to track the start and end of each packet loss detection time slot.

[0046] 2) The network packet loss detection auxiliary device maintains a receiver counter for each packet loss detection path, denoted as... ,in Corresponding time slot index. The receive counter starts at the beginning of the time slot. Automatically reset to zero. The device listens for incoming packet loss probe packets via the network interface card. These packets use the UDP protocol and contain specific header information such as a path identifier, sequence number, and timestamp. The path identifier distinguishes different packet loss probe paths, the sequence number identifies the packet order, and the timestamp verifies that the packet belongs to the current timeslot. Whenever the device receives a packet loss probe packet, it first verifies whether the packet's path identifier and timestamp fall within the current timeslot interval. If the verification passes, the receive counter... Add one; otherwise, the packet is dropped or logged as an anomaly.

[0047] 3) The network packet loss detection auxiliary device performs packet loss judgment at the end of the packet loss detection time slot, and the judgment is based on the receiver counter. The number of packet loss probe packets expected to be received in each time slot The comparison, among which This is a positive integer, with a default value of 2, and is configurable. Specifically, it refers to the time slot end time. Equipment inspection The value of. If If so, it is determined that packet loss has occurred in the current time slot of the packet loss detection path. For example, suppose... If only 0 or 1 packet loss probe data packets are received within a time slot, it is considered a packet loss. The judgment logic can be expressed mathematically: if condition... If the condition is met, packet loss occurs; otherwise, no packet loss occurs.

[0048] 4) After determining packet loss, the network packet loss detection auxiliary device generates a packet loss event report, which includes the packet loss detection path identifier and the time slot index. Receiver counter Expected value The report, along with a timestamp, is sent via a secure channel to the network packet loss detection control module in the software-defined network controller for subsequent anomaly switch input-output pair determination and fault tolerance control. The entire implementation process is repeated periodically to ensure continuous operation of network packet loss detection and allows the controller to dynamically adjust parameters as the network topology changes.

[0049] The process involves obtaining the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss occurs, and identifying switch input-output pairs with packet loss frequencies exceeding a specified threshold as abnormal switch input-output pairs. The specific implementation process is as follows: 1) After receiving a notification from the network packet loss detection auxiliary device regarding packet loss along a certain packet loss detection path, the network packet loss detection control module identifies all input-output pairs of switches traversed by that path. Let's assume the packet loss detection path is denoted as... ,path It contains a series of switch input-output pairs, denoted as ,in Representing a path The number of input-output pairs in the switch. The network packet loss detection control module obtains the path through the flow table lookup function of the software-defined network controller. The topology information includes the identifiers of each switch input-output pair and the associated switch device.

[0050] 2) The network packet loss detection control module performs packet loss frequency calculation for each switch input-output pair. Packet loss frequency is defined as the number of packet loss detection packets dropped per unit time. The calculation process involves multiple queries to the switch's packet loss detection flow status. Specifically, for each switch input-output pair... The network packet loss detection control module sends a query request to the corresponding switch to obtain the number of packets dropped in the packet loss detection flow. The number of dropped packets is a value recorded by an internal counter of the switch, representing the cumulative number of packet loss detection packets dropped since the start of the flow.

[0051] Network packet loss detection and control module at time points Perform the first query to obtain the number of dropped packets. Then, at the point in time... Perform a second query to obtain the number of dropped packets. Time interval It is a fixed value, specified by the network packet loss detection and control module, for example... Seconds. Packet loss frequency. The calculation formula is: in, Indicates the packet loss frequency, measured in data packets per second; Indicates the number of data packets dropped during the first query; Indicates the number of packets dropped during the second query; This indicates the time interval between two queries.

[0052] To improve accuracy, the network packet loss detection control module can repeat the above query and calculation process multiple times. Assume the number of repetitions is... The packet loss frequency calculated each time is denoted as . ,in, Average packet loss frequency The calculation formula is: in, This indicates the average packet loss frequency; Indicates the number of repetitions; Indicates the first The packet loss frequency was calculated once.

[0053] 3) The network packet loss detection and control module compares the packet loss frequency of each switch's input-output pairs with a specified threshold. The specified threshold is denoted as... This is a configurable value set by the network operator based on network conditions. If the packet loss frequency... or average packet loss frequency Exceeding the threshold That is, the conditions are met. or If such an input-output pair is detected, it is identified as an abnormal input-output pair. The network packet loss detection and control module records these abnormal input-output pairs and notifies the suspicious denial-of-service attack flow forwarding priority adjustment module for further processing.

[0054] The flow priority adjustment module is used to: obtain the data flow set of each abnormal switch input-output pair, and dynamically adjust the forwarding priority of the data flow in the data flow set through multiple priority adjustment and abnormal verification steps, set the forwarding priority of suspicious denial-of-service attack flow to the lowest forwarding priority, until all abnormal switch input-output pairs are no longer judged as abnormal.

[0055] The suspected denial-of-service attack flow forwarding priority adjustment module initiates the process of acquiring a data flow set after receiving notification from the network packet loss detection control module regarding abnormal switch input-output pairs. An abnormal switch input-output pair refers to a switch input-output pair whose packet loss frequency exceeds a specified threshold within a fixed period, meaning excessive packet loss occurs in the logical path from the ingress port to the egress port within the switch. The suspected denial-of-service attack flow forwarding priority adjustment module uses the flow table lookup function of the software-defined network controller to send a query request to the associated switch. The switch maintains flow table entries, recording information on all active data flows passing through the abnormal switch input-output pair. The query request includes the identifier of the abnormal switch input-output pair, such as the port number or flow table index. The switch returns a list of data flows, containing detailed information such as flow identifier, forwarding priority, packet count, and timestamp. The suspected denial-of-service attack flow forwarding priority adjustment module organizes these data flows into a set, denoted as the data flow set. Data stream collection Include A data stream, denoted as ,in, It is the number of data streams. Indicates the first A data stream. Module verification of the data stream set. The integrity and consistency of data are ensured, guaranteeing that all data flows are associated with the input-output pairs of the faulty switch. This process is achieved through the centralized control capabilities of software-defined networks, ensuring the real-time nature and accuracy of data acquisition.

[0056] The process of dynamically adjusting the forwarding priority of data flows in the data flow set through multiple priority adjustments and anomaly verification steps involves iterative operations to identify suspicious denial-of-service attack flows and participate in cyclical iterations. Suspicious denial-of-service attack flows refer to those data flows that cause abnormal switch input-output pairs to be continuously judged as abnormal after adjusting forwarding priorities, and are identified through step-by-step testing and verification.

[0057] First, the suspected denial-of-service attack flow forwarding priority adjustment module initializes an empty set. Used to temporarily store and track data streams during the adjustment process. Collection Initially empty, that is .

[0058] First priority adjustment step: From the data stream set Let half of the data stream be randomly selected and denoted as the set. Random selection is achieved using a uniform distribution algorithm, ensuring that each data stream has an equal probability of being selected. (Set) The size is calculated as or Specifically depends on The parity of, among which, It is a collection of data streams The size. Then, the module will collect the collection. The forwarding priority of all data flows is set to the lowest forwarding priority. The lowest forwarding priority is a predefined value configured by the network operator to limit the ability of data flows to use network resources. Simultaneously, the module update set... For data stream collection Subtract set .

[0059] First anomaly verification step: The suspicious denial-of-service attack flow forwarding priority adjustment module requests the network packet loss detection control module to re-detect the abnormal switch input-output pairs. The network packet loss detection control module queries the packet loss detection flow status of the switch, calculates the packet loss frequency, and compares it with a specified threshold. If the packet loss frequency exceeds the threshold, an abnormal switch input-output pair is identified. If still considered abnormal, then considered normal. If the abnormal switch input-output pair... If it is determined to be abnormal, the module will collect... The forwarding priority of all data streams is reset to the lowest forwarding priority to ensure consistency, and the set is updated. For set With sets The union of, i.e. This step ensures that all suspected data streams are kept within the adjustment range while the anomaly persists.

[0060] Priority adjustment and exception verification steps for loop iteration: The module enters a loop process, starting from the set Let half of the data stream be randomly selected and denoted as the set. .gather The size is calculated as or ,in, Represents a set The size of the module. The forwarding priority of all data flows is set to the normal forwarding priority. The normal forwarding priority is either the initial priority of the data flow or a default value defined by network policy, used to restore normal forwarding of data flows. Afterwards, the module updates the set. For set Subtract set .

[0061] The iterative anomaly verification steps are as follows: The module requests the network packet loss detection control module again to detect abnormal switch input-output pairs. The status of the switch input-output pair. If it is determined to be abnormal, the module will collect... Set the forwarding priority of all data streams in the set to the lowest forwarding priority, and update the set. For set With sets The union of, i.e. Then, the module repeatedly executes from the collection. The steps involve randomly selecting half of the data streams and setting normal priorities. If an abnormal switch input-output pair... Not judged as abnormal and set If not empty, the module will also be executed repeatedly from the collection. The steps involve randomly selecting half of the data streams and setting their normal priority.

[0062] In the iterative loop, the identification of suspicious denial-of-service attack flows depends on the anomaly verification results: those data flows that cause anomalies to reappear after being set to normal priority are classified as suspicious denial-of-service attack flows, and are therefore reset to the lowest forwarding priority and retained in the set. This process involves participating in subsequent iterations. It uses a binary search method to gradually narrow down the scope, efficiently identifying suspicious flows.

[0063] The specific implementation of setting the forwarding priority of suspicious denial-of-service attack flows to the lowest forwarding priority until all abnormal switch input-output pairs are no longer considered abnormal depends on the termination condition of the aforementioned cyclical adjustment. No longer judged as abnormal and collection Empty.

[0064] During the cyclical adjustment process, after each priority adjustment, the suspected denial-of-service attack flow forwarding priority adjustment module triggers an anomaly verification step. The network packet loss detection control module calculates the packet loss frequency by querying the packet loss detection flow status of the switch. The packet loss frequency calculation formula is as follows: ,in, Indicates the packet loss frequency. This indicates the number of packets dropped during the first query. This indicates the number of packets dropped during the second query. This indicates the time interval between two queries. (If the packet loss frequency...) Not exceeding the specified threshold Then determine the abnormal switch input-output pair This is normal.

[0065] When the abnormal switch input-output pair Determined to be normal and set When empty, the loop terminates. At this point, all suspicious denial-of-service attack flows have been set to the lowest forwarding priority, while normal data flows have been restored to their normal forwarding priority. The module records the final state and notifies the network packet loss detection control module to stop additional monitoring of the abnormal switch's input-output pairs.

[0066] The technical solution of the present invention will be further illustrated by the following embodiments, as detailed below: like Figure 2 As shown, a software-defined network controller (SDN) is centrally located, integrating a network packet loss detection control module and a suspicious denial-of-service attack flow forwarding priority adjustment module. This, along with a network packet loss detection auxiliary device and switches in the network data plane, achieves end-to-end fault tolerance management. The network packet loss detection control module first constructs an Eulerian circuit for the SDN and divides it into packet loss detection paths that satisfy the single-pass coverage condition of the links, ensuring that each link appears in only one path. Then, it coordinates the network packet loss detection auxiliary device to send packet loss detection data packets in a periodic-random hybrid mode, where the packet loss detection time is divided into fixed lengths. The packet loss detection time slots, within each time slot, continuously send packets at random times. For each UDP packet, the network packet loss detection auxiliary device monitors packet loss along the path and notifies the network packet loss detection control module. The latter calculates the packet loss frequency of each switch's input-output pairs by querying the switch status. Use formula The calculation yielded that, and The query value represents the number of packets dropped. Indicates the time interval and the packet loss frequency exceeding the threshold. The system identifies abnormal switch input-output pairs. Subsequently, the suspicious denial-of-service (DoS) attack flow forwarding priority adjustment module acquires the set of data flows passing through the abnormal switch input-output pairs. Through multiple priority adjustment and anomaly verification steps, it dynamically adjusts the forwarding priority of these data flows. This includes initializing an empty set, randomly selecting data flows and setting the lowest forwarding priority, and iteratively executing the adjustment process based on the verification results from the network packet loss detection control module. Finally, it sets the forwarding priority of the suspicious DoS attack flow to the lowest value via a forwarding priority adjustment command, thereby limiting abnormal traffic in the network data plane without interrupting service. Simultaneously, the switch executes these commands to ensure that data flow forwarding meets fault-tolerance objectives. The entire framework achieves closed-loop control from packet loss detection to priority adjustment, enhancing the software-defined network's resilience against DoS attacks. Clearly, this framework involves two functional modules deployed in the software-defined network controller: the network packet loss detection control module and the suspicious DoS attack flow forwarding priority adjustment module. The network packet loss detection control module is responsible for constructing packet loss detection paths that satisfy the single-pass coverage condition of the link. This is achieved by constructing an Eulerian circuit in the software-defined network and segmenting the Eulerian circuit. This module is also responsible for coordinating the network packet loss detection auxiliary device to send packet loss probe data packets in a periodic-random mixed mode, and calculating the packet loss frequency of each switch's input-output pairs based on the detection results. The suspicious denial-of-service attack flow forwarding priority adjustment module is responsible for obtaining the set of data flows passing through abnormal switch input-output pairs, and dynamically adjusting the forwarding priority of the data flows through multiple priority adjustment and anomaly verification steps.

[0067] Furthermore, this framework utilizes network packet loss detection auxiliary devices, which are typically servers with less stringent performance requirements. These devices are deployed in the software-defined network according to the network operator's needs, responsible for sending and receiving packet loss probe data packets to assist in completing the network packet loss detection task.

[0068] Unlike existing denial-of-service attack defense methods, this invention utilizes a method based on a set of non-intersecting links and software-defined network controller assistance to detect network packet loss. These paths satisfy the single-coverage condition, ensuring that each link in the network appears in one and only one packet loss detection path. Based on the packet loss detection results, the system performs fault-tolerant control on link traffic. This invention only considers packet loss at the switch level, not packet loss on physical links. This invention uses switch input-output pairs to refer to a switch inlet to a switch outlet. This invention sets a minimum forwarding priority to limit the network resource usage capacity of suspicious denial-of-service attack flows.

[0069] Fault tolerance control for suspicious denial-of-service attack flows in software-defined networks includes the following two aspects: The first step involves network packet loss detection and anomaly switch input-output pair identification. Specifically, packet loss detection is performed collaboratively by a network packet loss detection auxiliary device and a network packet loss detection control module. The network packet loss detection auxiliary device sends packet loss detection data packets to the packet loss detection path in a periodic-random hybrid mode. This periodic-random hybrid mode divides the packet loss detection time into fixed-length packet loss detection time slots, and continuously sends multiple packet loss detection data packets at random times within each packet loss detection time slot. The network packet loss detection control module calculates the packet loss frequency of each switch input-output pair based on the detection results, and identifies switch input-output pairs whose packet loss frequency exceeds a specified threshold as anomaly switch input-output pairs. Anomaly switch input-output pairs are defined as switch input-output pairs that experience packet loss exceeding the specified threshold within a fixed period.

[0070] The second step is the adjustment of forwarding priorities for suspicious denial-of-service attack flows: dynamically adjusting the forwarding priorities of data flows passing through abnormal switch input-output pairs. The suspicious denial-of-service attack flow forwarding priority adjustment module first obtains the set of data flows passing through abnormal switch input-output pairs, and then dynamically adjusts the forwarding priorities of the data flows in the set through multiple priority adjustment and anomaly verification steps. The adjustment process includes initializing an empty set, randomly selecting a portion of data flows from the set to set the lowest forwarding priority, verifying the abnormal state through the network packet loss detection and control module, and iteratively adjusting based on the verification results, ultimately setting the forwarding priority of the suspicious denial-of-service attack flows to the lowest forwarding priority.

[0071] In the second step, the forwarding priority of suspicious denial-of-service (DoS) attack flows is set to the lowest level, rather than directly interrupting the data flow. The main reasons are as follows: Accurately identifying DoS attack flows is very difficult. The above approach achieves the goal of defending against DoS attacks while also providing a certain degree of fault tolerance, meaning that packets from suspicious data flows can be forwarded without affecting other data flows. This approach effectively mitigates the impact of DoS attacks while avoiding service interruptions caused by misjudging legitimate data flows.

[0072] The following sections will provide a detailed introduction to the two steps mentioned above.

[0073] (1) Network packet loss detection and abnormal switch input-output pair determination, specifically: Network packet loss detection is performed collaboratively by a network packet loss detection auxiliary device and a network packet loss detection control module. The process is as follows: The network packet loss detection control module first constructs an Eulerian circuit for the software-defined network and divides the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link. Then, the network packet loss detection auxiliary device sends packet loss detection data packets to each packet loss detection path in a periodic-random hybrid mode. The periodic-random hybrid mode divides the packet loss detection time into packet loss detection time slots of fixed length T, and continuously sends m UDP packet loss detection data packets at random times within each packet loss detection time slot, where T represents the length of the packet loss detection time slot and m represents a positive integer. The path packet loss detection method assisted by the network packet loss detection auxiliary device performs real-time detection of packet loss on the network path, and when path packet loss is detected, it notifies the network packet loss detection control module to further determine the specific location of the path packet loss, i.e., the switch input-output pair. (2) The network packet loss detection control module queries the packet loss detection flow status along the above path, calculates the packet loss situation of each link based on these statuses, and determines whether the input-output pairs of each switch are in an abnormal state. Specifically: The network packet loss detection control module obtains the number of dropped packets by querying the packet loss detection flow status of the switch and calculates the packet loss frequency. Packet loss frequency. Through formula Calculation, where Indicates the packet loss frequency, measured in data packets per second; Indicates the number of data packets dropped during the first query; Indicates the number of packets dropped during the second query; This represents the time interval between two queries. If the packet loss frequency exceeds a specified threshold... If the network packet loss detection and control module determines the switch's input-output pair as abnormal, then the network packet loss detection and control module will identify it as abnormal.

[0074] The path packet loss detection method assisted by the network packet loss detection auxiliary device utilizes a set of packet loss detection paths that satisfy the single-pass coverage condition of the link, with the goal of avoiding mutual interference between different packet loss detection paths. The construction process of the packet loss detection paths that meet the above conditions is as follows: Figure 3 As shown. Figure 3 The construction shown involves two steps. Step 1: Using existing Eulerian circuit construction algorithms, such as Fleury's algorithm, construct an Eulerian circuit for the network topology graph. The network topology graph, including the network packet loss detection auxiliary device and its connecting links, is modeled as an undirected graph. ,in This represents a set of vertices, including switches and network packet loss detection aids. This represents a set of edges, symbolizing a physical link. (Graph) The conditions for ensuring the existence of an Eulerian circuit are that the circuit is connected and all vertices have an even degree. Specifically, Figure 3 (a) illustrates the process of constructing an Eulerian circuit in a network topology graph containing network packet loss detection aids A, B, C, and D, where the network topology is modeled as an undirected graph. ,in This represents the set of vertices, including all switches and network packet loss detection auxiliary devices A, B, C, and D. Let represent the set of edges and represent the physical links. An Eulerian circuit is constructed using the Fleury algorithm, ensuring that the Eulerian circuit traverses each edge in the graph exactly once and returns to the starting point, thus satisfying the single-pass coverage condition. Step two: Using the network packet loss detection auxiliary device as the dividing point, the Eulerian circuit constructed in step one is divided into a series of packet loss detection paths. The Eulerian circuit is denoted as . After segmentation, a set of packet loss detection paths is generated. Each path Composed of a series of continuous edges, with both the starting and ending points being network packet loss detection auxiliary devices. Since Eulerian circuits satisfy the single-pass coverage condition of a link, and Eulerian circuit splitting does not disrupt this condition, the packet loss detection path constructed using the above method also satisfies the single-pass coverage condition. The construction of this packet loss detection path is completed by the network packet loss detection control module in the software-defined network controller (SDB), and the path is recalculated when the network topology changes. After the packet loss detection path is constructed, the SDB sends flow installation commands to each switch in the network to complete the deployment of the packet loss detection path. Specifically, Figure 3 (b) demonstrates the process of constructing packet loss detection paths, using network packet loss detection auxiliary devices A, B, C, and D as dividing points to divide the Eulerian circuit into a series of packet loss detection paths. Each packet loss detection path Composed of continuous edges and starting and ending with network packet loss detection auxiliary devices, for example, the path may connect network packet loss detection auxiliary device A to network packet loss detection auxiliary device B, network packet loss detection auxiliary device B to network packet loss detection auxiliary device C, etc. Since the Eulerian circuit itself satisfies the single coverage condition of the link, after segmentation, each link only appears in one packet loss detection path, thereby avoiding interference between paths and ensuring the accuracy of packet loss detection.

[0075] The packet loss detection auxiliary device assists in path packet loss detection using a periodic-random hybrid mode to send probe packets. The stream of these probe packets constitutes the packet loss detection stream. In the periodic-random hybrid mode, the packet loss detection time is divided into fixed-length time slots, called packet loss detection time slots, with a slot length of, for example, 1 second, specified by the network packet loss detection control module. The starting point of the packet loss detection path, i.e., the network packet loss detection auxiliary device continuously sends m UDP packet loss detection data packets at random times within each packet loss detection time slot, where m defaults to 2 but is configurable and is a positive integer. The ending point of the packet loss detection path, i.e., the network packet loss detection auxiliary device determines whether packet loss has occurred based on the length of the packet loss detection time slot and the value of m. Specifically, this is achieved by monitoring and comparing the actual number of packet loss detection data packets received in each time slot with the expected value m. If the received number is less than m, it is considered packet loss. The reason for sending probe data packets at random times within the specified time slots is to prevent denial-of-service attacks from effectively evading detection. Because packet loss detection based on the path has a distributed nature, the packet loss detection time slot can be set to a smaller value to improve the timeliness of packet loss detection. The network packet loss detection auxiliary device manages the time slot allocation through an internal clock and uses a pseudo-random number generator to determine the transmission time within each time slot, ensuring the unpredictability of transmission time and thus enhancing the robustness and real-time performance of the detection.

[0076] After receiving a notification that packet loss has been detected on a packet loss detection path p, the network packet loss detection control module determines the packet loss status of the input-output pairs of the switches in p by querying the packet loss detection flow status. In a software-defined network architecture, the status of the data flow passing through the switch can be queried, including the number of dropped packets. The network packet loss detection control module queries the switches in p twice at specified time intervals to obtain the number of dropped packets in the packet loss detection flow. The number of dropped packets obtained in the first query is recorded as follows: The number of data packets dropped in the second query is recorded as follows. The time interval between two queries is denoted as The difference between the two, divided by the time interval, is the packet loss frequency of the switch within the aforementioned time interval. The calculation formula is: ,in This indicates the packet loss frequency, measured in packets per second. This indicates the number of packets dropped during the first query. This indicates the number of packets dropped during the second query. This represents the time interval between two queries. The above process can be repeated multiple times; the number of repetitions is denoted as . In this case, the average packet loss frequency is taken. The calculation formula is: ,in, Indicates the average packet loss frequency. Indicates the number of repetitions. This represents the packet loss frequency calculated in the j-th iteration. If the switch's packet loss frequency... or average packet loss frequency Exceeding the specified threshold If the network packet loss detection and control module notifies the suspicious denial-of-service attack flow forwarding priority adjustment module for further processing.

[0077] Upon receiving a packet loss anomaly, the suspected denial-of-service attack flow forwarding priority adjustment module adjusts the forwarding priority of data flows passing through that link. Assume the abnormal switch's input-output pair is... The suspected denial-of-service attack flow forwarding priority adjustment module utilizes the flow table lookup capability of software-defined networks to obtain the forwarding priority of the incoming flow. The data stream information, let these data stream sets be... ,Include A data stream, denoted as , Indicates the number of data streams. Indicates the first A data stream. The priority adjustment module for suspected denial-of-service attack streams performs the following adjustment steps: Step (1): The suspected denial-of-service attack flow forwarding priority adjustment module initializes an empty set. Used to temporarily store and track data streams during the adjustment process. Collection Initially empty, that is .

[0078] Step (2): The suspicious denial-of-service attack flow forwarding priority adjustment module adjusts the data flow set. Let half of the data stream be randomly selected and denoted as the set. Random selection is achieved using a uniform distribution algorithm, ensuring that each data stream has an equal probability of being selected. (Set) The size is calculated as or Specifically depends on The parity of the set. Then, the module will set... The forwarding priority of all data flows is set to the lowest forwarding priority. The lowest forwarding priority is a predefined value configured by the network operator to limit the ability of data flows to use network resources. Simultaneously, the module update set... For data stream collection Subtract set .

[0079] Step (3): The suspicious denial-of-service attack flow forwarding priority adjustment module judges the switch input-output pair based on the switch input-output pair packet loss detection method executed by the network packet loss detection control module. Is it abnormal? The network packet loss detection control module calculates the packet loss frequency by querying the packet loss detection flow status of the switch. Use formula Calculate, where, This indicates the packet loss frequency, measured in packets per second. This indicates the number of packets dropped during the first query. This indicates the number of packets dropped during the second query. This indicates the time interval between two queries. (If the packet loss frequency...) Exceeding the specified threshold Then determine the input-output pair of the switch. This is abnormal. If... For abnormal switch input-output pairs, the suspected denial-of-service attack flow forwarding priority adjustment module will aggregate... The forwarding priority of all data streams is set to the lowest forwarding priority to ensure consistency, and the set is updated. For set With sets The union of, i.e. .

[0080] Step (4): The suspicious denial-of-service attack flow forwarding priority adjustment module adjusts the priority of the collection. Let half of the data stream be randomly selected and denoted as the set. .gather The size is calculated as or ,in Represents a set The size of the set. Random selection is achieved through a uniform distribution algorithm. The module will set... The forwarding priority of all data flows is set to the normal forwarding priority. The normal forwarding priority is either the initial priority of the data flow or a default value defined by network policy, used to restore normal forwarding of data flows. Afterwards, the module updates the set. For set Subtract set .

[0081] Step (5): The suspicious denial-of-service attack flow forwarding priority adjustment module judges the switch input-output pair based on the switch input-output pair packet loss detection method executed by the network packet loss detection control module. Is it abnormal? If If an exception occurs, the module will collect... Set the forwarding priority of all data streams in the set to the lowest forwarding priority, and update the set. For set With sets The union of, i.e. Then proceed to step (4). If Not an exception and set If not empty, the module proceeds to step (4). The loop adjustment continues until an abnormal switch input-output pair is found. No longer judged as abnormal and collection Empty.

[0082] This invention achieves the technical effect of rapid detection and effective control even after a denial-of-service attack bypasses traditional defense systems by constructing a complete packet loss detection and response system. Specifically, the network packet loss detection and control module first constructs an Eulerian circuit and divides it into packet loss detection paths that satisfy the single-coverage condition of the link. This path construction method ensures that each link in the network appears only in a single detection path, fundamentally avoiding mutual interference during multi-path detection. During the network detection phase, a periodic-random hybrid mode is used to send detection data packets. The detection time is divided into fixed-length packet loss detection time slots, and multiple packet loss detection data packets are continuously sent at random times within each time slot. This design ensures both the periodicity of the detection and introduces randomness, making it impossible for attackers to predict their detection behavior and thus evade detection. When abnormal packet loss occurs in the network, the system can quickly locate the specific abnormal switch input-output pair. By calculating the packet loss frequency of each switch input-output pair and comparing it with a preset threshold, the network congestion point caused by the denial-of-service attack is accurately identified. This quantitative indicator-based judgment method improves the accuracy of detection and avoids errors caused by subjective judgment. In the control phase, the flow priority adjustment module employs an iterative adjustment strategy. Through multiple priority adjustments and anomaly verification steps, it dynamically adjusts the forwarding priority of data flows passing through abnormal switch input-output pairs. This process is continuous, gradually reducing the forwarding priority of suspicious denial-of-service attack flows to the minimum. Simultaneously, the adjustment strategy is continuously optimized through verification feedback until all abnormal switch input-output pairs return to normal. This approach effectively limits the use of network resources by attack flows while avoiding the potential for misjudgments caused by directly interrupting data flows, maintaining service continuity while ensuring network security. The entire system, through close coordination between detection and control, forms a complete fault-tolerant control mechanism. After a denial-of-service attack breaches the front-end defenses, the system can promptly detect the anomaly and take targeted control measures, effectively mitigating the impact of the attack and improving the anti-attack capability and service reliability of the software-defined network. This design compensates for the lack of effective countermeasures in traditional defense systems after an attack takes effect, providing crucial technical support for network security management.

[0083] like Figure 4 As shown in the figure, a fault-tolerant control method for denial-of-service attack flows based on packet loss detection according to an embodiment of the present invention includes the following steps: S1. Construct a set of packet loss detection paths in a software-defined network that satisfy the single-pass coverage condition of the links. The single-pass coverage condition of the links means that each link in the software-defined network appears in one and only one packet loss detection path. S2. Send packet loss detection data packets to each packet loss detection path through the network packet loss detection auxiliary device, and determine the abnormal switch input-output pairs based on the packet loss situation; where, the switch input-output pair refers to: the logical path that the packet loss detection data packet traverses from the ingress port to the egress port within a switch; S3. Obtain the data flow set of each abnormal switch input-output pair, and dynamically adjust the forwarding priority of the data flow in the data flow set through multiple priority adjustment and abnormal verification steps. Set the forwarding priority of the suspicious denial-of-service attack flow to the lowest forwarding priority until all abnormal switch input-output pairs are no longer judged as abnormal.

[0084] Optionally, in the above technical solution, constructing a set of packet loss detection paths that satisfy the single-pass coverage condition of the link in the software-defined network includes: constructing an Eulerian circuit of the software-defined network and dividing the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link.

[0085] Optionally, in the above technical solution, sending packet loss detection data packets to each packet loss detection path through the network packet loss detection auxiliary device includes: enabling the network packet loss detection auxiliary device to send packet loss detection data packets to each packet loss detection path in a periodic-random mixed mode. The periodic-random mixed mode refers to: dividing the packet loss detection time into packet loss detection time slots of fixed length, and continuously sending m packet loss detection data packets at random times within the packet loss detection time slots, where m is a positive integer.

[0086] Optionally, in the above technical solution, determining abnormal switch input-output pairs based on packet loss includes: when the network packet loss detection auxiliary device determines the packet loss detection path where packet loss occurs, obtaining the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss occurs, and determining the switch input-output pairs whose packet loss frequency exceeds a specified threshold as abnormal switch input-output pairs.

[0087] It should be noted that the beneficial effects of the packet loss detection-based fault-tolerant control method for denial-of-service attack flows provided in the above embodiments are the same as those of the packet loss detection-based fault-tolerant control system for denial-of-service attack flows, and will not be repeated here. Furthermore, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments, and will not be repeated here.

[0088] An electronic device according to an embodiment of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-mentioned denial-of-service attack flow fault tolerance control methods based on packet loss detection. That is, an electronic device according to an embodiment of the present invention may include, but is not limited to: a processor and a memory; the memory is used to store the computer program; the processor is used to execute the denial-of-service attack flow fault tolerance control method based on packet loss detection shown in any embodiment of the present invention by calling the computer program.

[0089] In one alternative embodiment, an electronic device is provided, such as Figure 5 As shown, Figure 5 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present invention.

[0090] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0091] Bus 4002 may include a path for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus 4002 is represented by only one thick line, but this does not mean that there is only one bus or one type of bus.

[0092] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0093] The memory 4003 stores application code (computer program) for executing the present invention, and its execution is controlled by the processor 4001. The processor 4001 executes the application code stored in the memory 4003 to implement the content shown in the foregoing method embodiments.

[0094] Among them, electronic devices can also be terminal devices, which can be any device that can install applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart in-vehicle devices.

[0095] It should be noted that, Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0096] An embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-mentioned denial-of-service attack flow fault-tolerant control methods based on packet loss detection.

[0097] Alternatively, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0098] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform any of the above-described denial-of-service attack flow fault-tolerant control methods based on packet loss detection.

[0099] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0100] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0101] The computer-readable storage medium provided in this invention can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EEPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0102] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0103] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0104] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0105] Those skilled in the art will recognize that this invention can be implemented as a system, method, or computer program product. Therefore, this invention can be specifically implemented in the following forms: it can be entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this invention can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0106] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A fault-tolerant control system for denial-of-service attack streams based on packet loss detection, characterized in that, include: Network packet loss detection and control module and flow priority adjustment module; The network packet loss detection control module is used to: construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link in the software-defined network, wherein the single-pass coverage condition of the link means that each link in the software-defined network appears in one and only one packet loss detection path. The network packet loss detection control module is also used to: send packet loss detection data packets to each packet loss detection path through the network packet loss detection auxiliary device, and determine abnormal switch input-output pairs according to the packet loss situation; wherein, the switch input-output pair refers to the logical path that the packet loss detection data packet traverses from the ingress port to the egress port within a switch; The flow priority adjustment module is used to: obtain the data flow set passing through each abnormal switch input-output pair, and dynamically adjust the forwarding priority of the data flow in the data flow set through multiple priority adjustment and abnormal verification steps, set the forwarding priority of the suspicious denial-of-service attack flow to the lowest forwarding priority, until all abnormal switch input-output pairs are no longer judged as abnormal.

2. The fault-tolerant control system for denial-of-service attack streams based on packet loss detection according to claim 1, characterized in that, The network packet loss detection and control module is specifically used to: construct the Eulerian circuit of the software-defined network, and divide the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-coverage condition of the link.

3. A fault-tolerant control system for denial-of-service attack streams based on packet loss detection according to claim 1 or 2, characterized in that, The network packet loss detection control module is further specifically used to: enable the network packet loss detection auxiliary device to send packet loss detection data packets to each packet loss detection path in a periodic-random mixed mode. The periodic-random mixed mode refers to: dividing the packet loss detection time into packet loss detection time slots of fixed length, and continuously sending m packet loss detection data packets at random times within the packet loss detection time slots, where m is a positive integer.

4. A fault-tolerant control system for denial-of-service attack streams based on packet loss detection according to claim 1 or 2, characterized in that, The network packet loss detection control module is further specifically used to: when the network packet loss detection auxiliary device determines the packet loss detection path where packet loss occurs, obtain the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss occurs, and determine the switch input-output pairs whose packet loss frequency exceeds a specified threshold as abnormal switch input-output pairs.

5. A method for fault-tolerant control of denial-of-service attack flows based on packet loss detection, characterized in that, include: In a software-defined network, a set of packet loss detection paths that satisfy the single-pass coverage condition of the links are constructed, wherein the single-pass coverage condition of the links means that each link in the software-defined network appears in one and only one packet loss detection path. The network packet loss detection auxiliary device sends packet loss detection data packets to each packet loss detection path, and determines the abnormal switch input-output pair based on the packet loss situation; wherein, the switch input-output pair refers to the logical path that the packet loss detection data packet traverses from the ingress port to the egress port within a switch; The system acquires a set of data flows passing through each abnormal switch input-output pair, and dynamically adjusts the forwarding priority of the data flows in the set through multiple priority adjustment and anomaly verification steps. The forwarding priority of suspicious denial-of-service attack flows is set to the lowest forwarding priority until all abnormal switch input-output pairs are no longer judged as abnormal.

6. The method for fault-tolerant control of denial-of-service attack flows based on packet loss detection according to claim 5, characterized in that, Constructing a set of packet loss detection paths that satisfy the single-pass coverage condition of a link in a software-defined network includes: constructing an Eulerian circuit of the software-defined network and dividing the Eulerian circuit to construct a set of packet loss detection paths that satisfy the single-pass coverage condition of the link.

7. A method for fault-tolerant control of denial-of-service attack flows based on packet loss detection according to claim 5 or 6, characterized in that, Sending packet loss detection data packets to each packet loss detection path through the network packet loss detection auxiliary device includes: causing the network packet loss detection auxiliary device to send packet loss detection data packets to each packet loss detection path in a periodic-random mixed mode, wherein the periodic-random mixed mode refers to: dividing the packet loss detection time into packet loss detection time slots of fixed length, and continuously sending m packet loss detection data packets at random times within the packet loss detection time slots, where m is a positive integer.

8. A method for fault-tolerant control of denial-of-service attack flows based on packet loss detection according to claim 5 or 6, characterized in that, Determining abnormal switch input-output pairs based on packet loss includes: when the network packet loss detection auxiliary device determines a packet loss detection path where packet loss has occurred, obtaining the packet loss frequency of each switch input-output pair in the packet loss detection path where packet loss has occurred, and determining switch input-output pairs whose packet loss frequency exceeds a specified threshold as abnormal switch input-output pairs.

9. An electronic device, characterized in that, The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the denial-of-service attack flow fault-tolerant control method based on packet loss detection as described in any one of claims 5 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the denial-of-service attack flow fault-tolerant control method based on packet loss detection as described in any one of claims 5 to 8.

Images