MCP flooding attack detection method based on behavior characteristics

Abstract

An MCP flooding attack detection method based on behavior characteristics comprises the following steps: collecting and learning a large amount of legal MCP traffic, extracting parameter length, request interval, nesting depth and response time characteristics, and constructing four-dimensional normal distribution as a legal traffic model based on the parameters, the request interval, the nesting depth and the response time characteristics; the probability density of the feature vector of each new request under the legal model is calculated to judge the abnormal request and the attack type thereof, finally, an SIR infectious disease dynamic model and an ARIMA time sequence model are further innovatively integrated to predict the zombie node scale and the attack trend, and the prediction result is used as input to automatically trigger and adjust a defense strategy; according to the method, botnet attack detection is carried out on the large language model integrated with the MCP protocol by utilizing the multi-dimensional behavior characteristics, so that attack detection and an adaptive defense strategy are effectively realized, and a security protection capability is also provided for a complex network environment in which the large language model is integrated with the MCP protocol; the invention further comprises a system, equipment and a storage medium for implementing the method.

Description

Technical Field

[0001] This invention relates to the field of network security technology for large language models, specifically to a method for detecting MCP flooding attacks based on behavioral characteristics. Background Technology

[0002] As the scale and capabilities of large language models continue to increase, they have demonstrated powerful processing capabilities for both natural language generation and complex programming tasks. Today, LLMs are being endowed with even more powerful attributes, enabling them to connect to diverse tools such as databases, web servers, and file systems. This makes the interaction protocols between AI models and external tools a critical infrastructure for AI applications. However, these extended capabilities bring enormous engineering complexity, primarily due to the lack of standardized interfaces. Historically, developers have had to customize "plugins" or "adapters" for each new external tool, resulting in fragmented solutions that are difficult to maintain on a large scale.

[0003] Model Context Protocol (MCP), as an emerging standard protocol for AI tool invocation, is widely used in scenarios where large language models access external resources such as databases, file systems, and APIs. Based on the JSON-RPC 2.0 standard, the MCP protocol transmits data via HTTP or WebSocket and includes both tools / call interfaces for listing available tools and for invoking tools. Unlike traditional REST APIs, the MCP protocol allows clients to pass complex nested parameter structures, thus meeting the diverse tool invocation needs of AI models. However, traditional traffic detection schemes, such as the malicious traffic detection method integrating CNN-LSTM proposed in patent publication number CN120811657A, cannot identify attack traffic targeting the MCP protocol. More seriously, these attack requests against the MCP protocol initiated by botnets are completely legal in content format but exhibit abnormal behavior patterns. Existing intrusion detection systems (IDS) based on signature matching or rule engines cannot identify this type of "protocol-compliant but behaviorally abnormal" attack. Summary of the Invention

[0004] To address the problems and shortcomings of existing technologies, the present invention aims to provide a behavioral feature-based method for detecting MCP flooding attacks. This method quantifies the spread speed and final scale of a botnet composed of MCP nodes using the SIR model of infectious disease dynamics. A multidimensional normal distribution model is employed to model the parameter length, nesting depth, request time interval, and server response time of MCP requests. Attacks are identified by calculating the similarity between the tested traffic and the legitimate traffic model. An ARIMA time series model is established based on the detected attack traffic intensity to predict future attack intensity. A greedy algorithm is used to optimize the allocation of detection resources, providing effective measures for subsequent defense against botnet attacks.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A behavioral feature-based method for detecting MCP flooding attacks includes the following steps: Step 1: Set up the environment required for the MCP server and each node, simulate benign nodes and attacking nodes to make requests to the server, collect and transform the raw logs into usable request data, preprocess the request data, and extract four-dimensional feature vectors of parameter byte length, nesting depth, request time interval and server response time. Step 2: Calculate the mean vector μ and covariance matrix Σ of the four-dimensional feature vectors extracted in Step 1, establish a K-dimensional normal distribution model N(μ, Σ) for the combined traffic, and determine the optimal threshold ε* to detect and classify attack traffic; Step 3: Build an ARIMA time series model based on the attack traffic intensity detected in Step 2 to predict the intensity of future attacks; Step 4: Based on the attack data detected in Step 2, use the Infectious Disease Dynamics (SIR) model to simulate the spread of zombie nodes, and automatically adjust the defense strategy based on the S3 prediction results. Step 5: Calculate the risk score based on the traffic characteristics, formalize the detection system, and use a greedy algorithm to optimize the allocation of detection resources.

[0006] The specific process of step 1 is as follows: Step 1.1: Set up the environment required for the MCP server, simulating requests from benign and attacking nodes; Step 1.2: Integrate the generated logs into usable legitimate traffic and mixed traffic datasets; the legitimate traffic dataset is used as training samples, and the mixed traffic dataset is used as samples to be detected; Step 1.3: Clean and preprocess the legitimate traffic and mixed traffic datasets, and label the mixed traffic dataset; Step 1.4: Extract a four-dimensional feature vector from the preprocessed data, including parameter byte length, nesting depth, request time interval, and server response.

[0007] The specific process of step 2 is as follows: Step 2.1: Using the four-dimensional feature vector set obtained from S1, calculate the mean vector μ and covariance matrix Σ, and establish a K-dimensional normal distribution model N(μ, Σ) for the legal flow, with the following formula: In the formula: Y is a four-dimensional feature vector, namely parameter length, nesting depth, time interval, and response time; μ is the average value of each feature in the legitimate traffic; Σ is the covariance matrix representing the linear correlation between the four features; n is the number of samples in the legitimate traffic feature vector; K is the dimension of the vector, which is 4 in this case. Step 2.2: Calculate the probability density of the feature vector Y0 of the request to be detected in the legitimate traffic distribution model. The formula is: In the formula: |Σ| is the determinant of the covariance matrix, Σ - ¹ is the inverse of the covariance matrix; Y0 is the feature vector of the single request to be detected; K is the dimension of the feature vector; It is the square of the Mahalanobis distance, reflecting the degree of deviation of the flow rate from the legal flow rate; Step 2.3: Determine if an attack is detected based on the comparison between the probability density and the preset threshold. If the probability density is lower than the preset threshold, the feature vector Y0 of the request to be detected is marked as the attack traffic. Step 2.4: Classify the traffic identified as an attack in Step 2.3 as data.

[0008] The specific process of step 3 is as follows: Step 3.1: Based on the detected attack traffic intensity, use the ADF test to determine the stationarity of the data from Step 2. If the sequence is non-stationary, perform d-order differencing. In the formula: Z t This represents the attack traffic intensity sequence at time t; L represents the d-th order difference operator; L represents the lag operator; d represents the difference order, determined by the ADF test. Step 3.2: Complete the ARIMA time series model construction. The formula is: in: i The coefficients of the autoregressive term, i 1,2 q represents the influence of past values ​​on the present; θ j The coefficient of the moving average term, j 1,2 p represents the impact of past error terms on the present; p is the autoregression order; q is the moving average order; For the white noise error term, the autoregression order p and the moving average order q are determined by the ACF and PACF functions, with parameters { i ,θ j It is estimated by the maximum likelihood estimation method; Step 3.3: After completing the ARIMA time series model parameter estimation, calculate the warning threshold τ based on the model's fitting results to historical attack traffic sequences. τ is the time series warning threshold for the attack traffic sequence, used to characterize the upper bound of normal traffic. The warning threshold is defined as: in: This represents the average of the attack traffic sequence. Its standard deviation is given by k, which is an adjustment factor used to control the sensitivity of the early warning. Step 3.4: Calculate the predicted value for the next h steps based on the established ARIMA time series model, when Z t+h Value > At that time, the system determines that the intensity of future attacks will enter an abnormal growth range: In the formula: Z t+h E represents the attack traffic intensity predicted at time t+h; E[...] is the conditional expectation, representing the best prediction value under the current model; h is the prediction step size.

[0009] The specific process of step 4 is as follows: Step 4.1: Divide MCP network nodes into three categories to construct a diffusion model of zombie nodes based on the SIR model of infectious disease dynamics: (1) S(t): Susceptible node, which refers to a node that has not been infected but may be exploited; (2) I(t): Infected node, which refers to a node that has become a zombie node and is launching an attack; (3) R(t): Recovery node, which refers to a node that has been cleaned of malicious programs and has immunity; The formula is: Among them: β is the infection rate, γ is the recovery rate, and N is the total number of summary nodes; represents the change rate of susceptible nodes over time; represents the change rate of infected nodes over time; represents the change rate of recovered nodes over time; Step 4.2: Predict the evolution trend of the number of infected nodes I(t) according to the constructed SIR model; Step 4.3: The predicted value I(t) of the number of future infected nodes obtained from the SIR model and the predicted value Z(t+h) of the future attack traffic intensity obtained from the ARIMA model in Step 3 are used to construct a comprehensive risk score: In the formula: I(t) is the predicted number of infected nodes at time t calculated by the SIR model; is the predicted value of the future h-step of the attack traffic obtained from the ARIMA model; N is the total number of network nodes; τ is the warning threshold calculated in Step 3; α1 and α2 are weight coefficients; According to the magnitude of the risk index L, the system defense strategy is divided into three levels and the defense is automatically adjusted: (4.3.1) Normal level, L < L1: Use the default detection frequency and the default request rate limiting strategy; (4.3.2) Alert level, L1 ≤ L < L2: Lower the upper limit of the request rate of the can nodes and increase the detection ratio of high-risk feature vectors; (4.3.3) Emergency level, L ≥ L2: Start a more strict threshold ε' to re-detect suspicious traffic, and add nodes that are repeatedly judged as abnormal to the blacklist.

[0010] The specific process of Step 5 is as follows: Step 5.1: According to the four-dimensional behavior characteristics extracted in Step 1, calculate the preliminary risk score for each task to be detected and divide the tasks into three priorities: high, medium, and low. The risk score calculation formula is as follows: Among them: L is the parameter byte length; D is the nesting depth; ΔT is the request time interval; Lmax and Dmax are the normalized upper limit values of the parameter length and the nesting depth respectively; is the weight coefficient, satisfying ; According to the comparison relationship between the risk score and the preset thresholds θ1 and θ2, the detection tasks are divided into: low priority when Risk_score < θ1; medium priority when θ1 ≤ Risk_score < θ2; high priority when Risk_score ≥ θ2; Step 5.2: Formalize the detection system. Assume the detection system has M tasks and a total resource of R. Set the delay function and task-specific constants for each task. Step 5.3: Design constraints and use a greedy algorithm to solve for the optimal detection resource allocation. The scheduling objective is to minimize the weighted average delay. Where: Pj represents the weight coefficient of the j-th task, d j (x j This indicates that task j is allocating resources x. j The cost function at time M is the total number of tasks. Constraints: Where: R represents the total amount of available system resources, r j This represents the maximum amount of resources that task j can be allocated.

[0011] The present invention also includes: A system, including a processor, is capable of running the aforementioned behavior-based MCP flood attack detection method.

[0012] An apparatus comprising: Memory: Used to store the computer program for the behavioral feature-based MCP flood attack detection method described above; Processor: Used to implement the behavioral feature-based MCP flood attack detection method when executing the computer program.

[0013] A computer-readable storage medium storing a computer program, characterized in that, when executed by a processor, the computer program implements the aforementioned MCP flood attack detection method based on behavioral characteristics.

[0014] Compared with the prior art, the advantages of the present invention are: 1. In step 2 of this invention, a multidimensional normal distribution model of legitimate traffic is constructed using four-dimensional feature vectors. By calculating the probability density difference between the feature vectors and the legitimate behavior model, botnet flooding attacks that appear legitimate but deviate from the normal distribution in behavior pattern can be accurately identified. 2. This invention constructs an ARIMA model in step 3 to predict the intensity of future attack traffic, and introduces the SIR infectious disease dynamics model in step 4 to characterize the infection, spread and recovery process of zombie nodes. By combining traffic prediction with node spread prediction, it can predict and judge the scale of the attack and the timing of the outbreak, which helps to trigger defense in advance and improve the system's active defense capability and overall stability. 3. In step 5, this invention constructs a risk scoring model based on four-dimensional behavioral features, dynamically adjusts the allocation ratio of detection resources according to the urgency of the task, and uses a greedy algorithm to achieve near-optimal real-time scheduling. This strategy enables high-risk detection tasks to obtain more resources, improves the overall real-time performance and accuracy of detection, and avoids wasting resources on low-risk traffic, demonstrating significant advantages in large-scale concurrent scenarios.

[0015] In summary, this invention employs a multidimensional normal distribution model to model the parameter length, nesting depth, request time interval, and server response time of MCP requests. Attacks are identified by calculating the similarity between the tested traffic and the legitimate traffic model. An ARIMA time series model is established based on the detected attack traffic intensity, combined with a SIR infectious disease dynamics model to predict the size of botnet nodes and attack trends. A greedy algorithm is used to optimize the allocation of detection resources, providing effective assistance to the MCP server. Firstly, this method achieves high-accuracy, low-latency real-time detection of MCP protocol botnet flooding attacks through multidimensional feature joint detection, adaptive resource scheduling, and attack evolution prediction, and possesses proactive defense capabilities, demonstrating significant theoretical value and promising practical applications. Attached Figure Description

[0016] Figure 1 This is the overall flowchart of the present invention.

[0017] Figure 2 This is a flowchart of the data preprocessing and feature extraction module of the present invention.

[0018] Figure 3 This is a flowchart of the abnormal traffic detection process of the present invention.

[0019] Figure 4 This is a flowchart of the timing prediction process of the present invention.

[0020] Figure 5 This is a flowchart of the resource adaptive scheduling module of the present invention.

[0021] Figure 6 This is a box plot comparing the features of three attack types under the four dimensions of the present invention.

[0022] Figure 7 This is a comparison chart of the predicted ROC curves of this invention.

[0023] Figure 8 This is a fitting graph of the zombie node diffusion simulation results for the SIR model of this invention. Detailed Implementation

[0024] The present invention will now be described in detail with reference to the accompanying drawings and specific implementation methods.

[0025] See Figure 1A behavioral feature-based method for detecting MCP flooding attacks includes the following steps: Step 1: Set up the MCP server and the necessary environment for each node; simulate benign and attacking nodes making requests to the server and obtain the corresponding request data. Transform and extract the raw data into usable request data, and perform preprocessing to extract four-dimensional feature vectors. Reference Figure 2 Specifically: Step 1.1: Set up a topology simulation MCP server environment in Mininet, deploying a network runtime environment including the MCP Server, benign client nodes, and attack simulation nodes. The MCP Server adopts an API structure conforming to the JSON-RPC 2.0 protocol, possessing capabilities such as parameter parsing, utility function scheduling, and response return. Each node connects to the same logical switching domain through a virtual network interface; benign nodes simulate normal user tool calls to the server through script automation, while attack nodes simulate high-frequency scheduling behavior of a botnet by repeatedly constructing a large number of tool call requests.

[0026] Step 1.2: The system collects raw logs from all nodes' call records, including request body content, parameter byte count, nesting level, request timestamp, response latency, server CPU usage, and other information. After collection, the raw data is formatted, outliers are removed, and missing items are filled in to form a usable dataset of legitimate and mixed traffic. Step 1.3: Clean and preprocess the legitimate traffic and mixed traffic datasets, and label the mixed traffic dataset; Step 1.4: Extract a four-dimensional feature vector from the preprocessed data, including parameter byte length, nesting depth, request time interval, and server response time. This feature vector serves as the basic input for subsequent behavior modeling and anomaly detection.

[0027] Step 2: Select traffic labeled as legitimate as training samples and perform statistical modeling on the four-dimensional feature space. Calculate the mean vector μ and covariance matrix Σ of the four-dimensional feature vectors extracted in Step 1, establish a K-dimensional normal distribution model N(μ, Σ) for the combined traffic, and determine the optimal threshold ε* to detect and classify attack traffic; Reference Figure 3 Specifically: Step 2.1: Obtain the four-dimensional feature vector set {Y1,Y2,...,Y} obtained in Step 1. n} Calculate the mean vector μ and covariance matrix Σ, and establish a K-dimensional normal distribution model N(μ, Σ) for the legal flow, as shown in the formula: In the formula: Y is a four-dimensional feature vector, namely parameter length, nesting depth, time interval, and response time; μ is the average value of each feature in the legitimate traffic; Σ is the covariance matrix representing the linear correlation between the four features; n is the number of samples in the legitimate traffic feature vector; K is the dimension of the vector, which is 4 in this case.

[0028] Step 2.2: Calculate the probability density of the feature vector Y0 of the request to be detected in the legitimate traffic distribution model. The formula is: In the formula, |Σ| is the determinant of the covariance matrix, Σ - ¹ is the inverse of the covariance matrix; Y0 is the feature vector of the single request to be detected; K is the dimension of the feature vector; It is the square of the Mahalanobis distance, reflecting the degree of deviation of the flow rate from the legal flow rate.

[0029] Step 2.3: Attack determination is performed based on the comparison between the probability density f(Y0) and a preset threshold. For any request Y0 to be detected, its probability density function value is calculated as a behavioral similarity index. When this density value is lower than the automatically selected threshold ε, the system determines that the request behavior significantly deviates from the normal pattern and marks it as abnormal traffic. The threshold ε is automatically determined through ROC curve analysis.

[0030] Step 2.4: Classify the traffic identified as an attack in Step 2.3 as data.

[0031] Step 3: First, aggregate the abnormal requests detected in Step 2 in chronological order to form an attack strength sequence {Z}. t Then, an ARIMA time series model is built to predict the intensity of future attacks. Reference Figure 4 Specifically: Step 3.1: To ensure the quality of time series modeling, the data from Step 2 is used to determine the stationarity of the sequence using the ADF test based on the detected attack traffic intensity. The system uses the ADF test to determine the stationarity of the sequence; if it is not stationary, it performs d-order differencing to stabilize the mean trend. In the formula: Z t This represents the attack traffic intensity sequence at time t; L represents the d-order difference operator; L represents the lag operator; d represents the difference order, which is determined by the ADF test.

[0032] Step 3.4: Complete the ARIMA time series model construction, the formula is: in: i The coefficients of the autoregressive term, i 1,2 q represents the influence of past values ​​on the present; θ j The coefficient of the moving average term, j 1,2 p represents the impact of past error terms on the present; p is the autoregression order; q is the moving average order; For the white noise error term, the autoregression order p and the moving average order q are determined by the ACF and PACF functions, with parameters { i ,θ j It is estimated by the maximum likelihood estimation method; Step 3.3: After completing the ARIMA time series model parameter estimation, calculate the warning threshold τ based on the model's fitting results to historical attack traffic sequences. τ is the time series warning threshold for the attack traffic sequence, used to characterize the upper bound of normal traffic. When the predicted future attack intensity exceeds this threshold, it indicates that the attack has a tendency to spread to a large scale. The warning threshold is defined as: in: This represents the average of the attack traffic sequence. Its standard deviation is given by k, which is an adjustment factor used to control the sensitivity of the early warning system.

[0033] Step 3.4: Calculate the predicted value for the next h steps based on the established ARIMA time series model. In the formula: Z t+h E represents the attack traffic intensity predicted at time t+h; E[...] is the conditional expectation, representing the best prediction value under the current model; h is the prediction step size.

[0034] Step 4: Based on the attack data detected in Step 2, use the Infectious Disease Dynamics (SIR) model to simulate the spread of zombie nodes, and automatically adjust the defense strategy based on the S3 prediction results. Reference Figure 5 Specifically: Step 4.1: Treat all nodes in the network as susceptible nodes S(t), infected nodes I(t), and recovering nodes R(t) in the SIR model to construct a diffusion model of zombie nodes based on the SIR model of infectious disease dynamics: S(t): Susceptible nodes (nodes that are not infected but may be exploited); I(t): Infected nodes (nodes that have become zombie nodes and are launching attacks); R(t): Recovered nodes (nodes that have cleared malicious programs and have immunity); The formula is: Where: β is the infection rate, γ is the recovery rate, and N is the total number of nodes; Represents the rate of change of susceptible nodes over time; Represents the rate of change of infected nodes over time; Represents the rate of change of recovered nodes over time.

[0035] Step 4.2: By solving the SIR differential equation, the system obtains the predicted value I(t) of the number of future infected nodes.

[0036] Step 4.3: Construct a comprehensive risk scoring calculation module with the predicted value I(t) of the number of future infected nodes obtained from the SIR model and the predicted value Z(t + h) of the future attack intensity obtained in Step 3: In the formula: I(t) is the predicted number of infected nodes at time t calculated by the SIR model; Is the predicted value of the future h-step of the attack traffic obtained from the ARIMA model; N is the total number of network nodes; τ is the warning threshold calculated in Step 3; α₁, α₂ are weight coefficients.

[0037] According to the magnitude of the risk index L, the system defense strategies are divided into three levels: (4.3.1) Normal level (L < L₁): Use the default detection frequency and the default request rate limiting strategy; (4.3.2) Alert level (L₁ ≤ L < L₂): Lower the upper limit of the request rate of can nodes and increase the detection ratio of high-risk feature vectors; (4.3.3) Emergency level (L ≥ L₂): Start re-detecting suspicious traffic with a more stringent threshold ε', and add nodes that are repeatedly determined to be abnormal to the blacklist.

[0038] Step 5: Preliminarily calculate the risk score based on traffic characteristics, formalize the detection system, and use the greedy algorithm to optimize the allocation of detection resources.

[0039] The specific process is as follows: Step 5.1: Based on the four-dimensional behavioral features extracted in Step 1, the system first calculates a local risk score for each request and divides the task into three priorities: high, medium, and low. The risk score calculation formula is as follows: Where: L is the parameter byte length; D is the nesting depth; ΔT is the request time interval; Lmax and Dmax are the normalized upper limits of the parameter length and nesting depth, respectively; Let be the weighting coefficient, satisfying ; Based on the comparison relationship between the risk score and the preset thresholds θ1 and θ2, the detection task is divided into the following categories: low priority when Risk_score < θ1; medium priority when θ1 ≤ Risk_score < θ2; and high priority when Risk_score ≥ θ2.

[0040] Step 5.2: Construct a task scheduling model based on this. Assume the detection system has M tasks and a total resource of R. Set the task delay function. And task-specific constants: in: This represents the base processing time for task j. The amount of resources allocated to task j; The value is 1; Step 5.3: To achieve near-optimal real-time resource allocation, the system employs a greedy algorithm, prioritizing tasks and allocating resources accordingly. When resources are insufficient, the system prioritizes reducing resources for lower-priority tasks to ensure the real-time detection capability of higher-priority tasks. The scheduling objective is to minimize the weighted average latency. Where: Pj represents the weight coefficient of the j-th task, d j (x j This indicates that task j is allocating resources x. j The cost function is given by M, where M is the total number of tasks.

[0041] Constraints: Where: R represents the total amount of available system resources, r j This represents the maximum amount of resources that task j can be allocated.

[0042] See Figure 6 Four-dimensional features were extracted from the obtained benign and mixed request datasets to create box plots comparing the features of the three attack types. (See [link]). Figure 7The ROC curve comparison chart demonstrates the detection performance of this invention for suspicious requests. See [link / reference]. Figure 8 The effectiveness of this invention in simulating the spread of zombie nodes is demonstrated through a comparison of SIR model simulation and environmental simulation.

[0043] The present invention also includes: A system, including a processor, is capable of running the aforementioned behavior-based MCP flood attack detection method.

[0044] An apparatus comprising: Memory: Used to store the computer program for the MCP flood attack detection method based on behavioral characteristics; Processor: Used to implement the behavioral feature-based MCP flood attack detection method when executing the computer program.

[0045] A computer-readable storage medium storing a computer program, characterized in that, when executed by a processor, the computer program implements the aforementioned MCP flood attack detection method based on behavioral characteristics.

[0046] In summary, this invention extracts feature vectors of parameter length, nesting depth, request interval, and response time from real-time MCP traffic and inputs them into a pre-trained "normal behavior model" to calculate the Mahalanobis distance D in real time. m Ultimately, this method achieves accurate detection of botnet attacks such as resource abuse and protocol malformation. By establishing a "normal behavior baseline" with multi-dimensional features, it effectively captures zero-day attacks and behavioral anomalies that traditional signature scanners cannot detect, greatly improving the system's detection accuracy and proactive defense capabilities. Furthermore, the system combines the SIR infectious disease dynamics model and the ARIMA time series model to predict the scale and attack trends of botnet nodes, providing precise decision-making basis for implementing adaptive security defense strategies. This has significant theoretical value and broad application prospects in ensuring the secure transmission of the MCP protocol and large models.

Claims

1. A method for detecting MCP flooding attacks based on behavioral characteristics, characterized in that, Includes the following steps: Step 1: Set up the environment required for the MCP server and each node, simulate benign nodes and attacking nodes to make requests to the server, collect and transform the raw logs into usable request data, preprocess the request data, and extract four-dimensional feature vectors of parameter byte length, nesting depth, request time interval and server response time. Step 2: Calculate the mean vector μ and covariance matrix Σ of the four-dimensional feature vectors extracted in Step 1, establish a K-dimensional normal distribution model N(μ, Σ) for the combined traffic, and determine the optimal threshold ε* to detect and classify attack traffic; Step 3: Build an ARIMA time series model based on the attack traffic intensity detected in Step 2 to predict the intensity of future attacks; Step 4: Based on the attack data detected in Step 2, use the Infectious Disease Dynamics (SIR) model to simulate the spread of zombie nodes, and automatically adjust the defense strategy based on the S3 prediction results. Step 5: Calculate the risk score based on the traffic characteristics, formalize the detection system, and use a greedy algorithm to optimize the allocation of detection resources.

2. The MCP flooding attack detection method based on behavioral characteristics according to claim 1, characterized in that, The specific process of step 1 is as follows: Step 1.1: Set up the environment required for the MCP server, simulating requests from benign and attacking nodes; Step 1.2: Integrate the generated logs into a usable dataset of legitimate traffic and mixed traffic; Legitimate traffic is used as training samples, and mixed traffic dataset is used as samples to be detected; Step 1.3: Clean and preprocess the legitimate traffic and mixed traffic datasets, and label the mixed traffic dataset; Step 1.4: Extract a four-dimensional feature vector from the preprocessed data, including parameter byte length, nesting depth, request time interval, and server response.

3. The MCP flooding attack detection method based on behavioral characteristics according to claim 1, characterized in that, The specific process of step 2 is as follows: Step 2.1: Using the four-dimensional feature vector set obtained from S1, calculate the mean vector μ and covariance matrix Σ, and establish a K-dimensional normal distribution model N(μ, Σ) for the legal flow, with the following formula: In the formula: Y is a four-dimensional feature vector, namely parameter length, nesting depth, time interval, and response time; μ is the average value of each feature in the legitimate traffic; Σ is the covariance matrix representing the linear correlation between the four features; n is the number of samples in the legitimate traffic feature vector; K is the dimension of the vector, which is 4 in this case. Step 2.2: Calculate the probability density of the feature vector Y0 of the request to be detected in the legitimate traffic distribution model. The formula is: In the formula: |Σ| is the determinant of the covariance matrix, Σ - ¹ is the inverse of the covariance matrix; Y0 is the feature vector of the single request to be detected; K is the dimension of the feature vector; It is the square of the Mahalanobis distance, reflecting the degree of deviation of the flow rate from the legal flow rate; Step 2.3: Determine if an attack is detected based on the comparison between the probability density and the preset threshold. If the probability density is lower than the preset threshold, the feature vector Y0 of the request to be detected is marked as the attack traffic. Step 2.4: Classify the traffic identified as an attack in Step 2.3 as data.

4. The MCP flooding attack detection method based on behavioral characteristics according to claim 1, characterized in that, The specific process of step 3 is as follows: Step 3.1: Based on the detected attack traffic intensity, use the ADF test to determine the stationarity of the data from Step 2. If the sequence is non-stationary, perform d-order differencing. In the formula: Z t This represents the attack traffic intensity sequence at time t; L represents the d-th order difference operator; L represents the lag operator; d represents the difference order, determined by the ADF test. Step 3.2: Complete the ARIMA time series model construction. The formula is: in: i The coefficients of the autoregressive term, i 1,2 q represents the influence of past values ​​on the present; θ j The coefficient of the moving average term, j 1,2 p represents the impact of past error terms on the present; p is the autoregression order; q is the moving average order; For the white noise error term, the autoregression order p and the moving average order q are determined by the ACF and PACF functions, with parameters { i ,θ j It is estimated by the maximum likelihood estimation method; Step 3.3: After completing the ARIMA time series model parameter estimation, calculate the warning threshold τ based on the model's fitting results to historical attack traffic sequences. τ is the time series warning threshold for the attack traffic sequence, used to characterize the upper bound of normal traffic. The warning threshold is defined as: in: This represents the average of the attack traffic sequence. Its standard deviation is given by k, which is an adjustment factor used to control the sensitivity of the early warning. Step 3.4: Calculate the predicted value for the next h steps based on the established ARIMA time series model, when Z t+h Value > At that time, the system determines that the intensity of future attacks will enter an abnormal growth range: In the formula: Z t+h E represents the attack traffic intensity predicted at time t+h; E[...] is the conditional expectation, representing the best prediction value under the current model; h is the prediction step size.

5. The MCP flooding attack detection method based on behavioral characteristics according to claim 1, characterized in that, The specific process of step 4 is as follows: Step 4.1: Divide MCP network nodes into three categories to construct a diffusion model of zombie nodes based on the SIR model of infectious disease dynamics: (1) S(t): Susceptible node, which refers to a node that has not been infected but may be exploited; (2) I(t): Infected node, which refers to a node that has become a zombie node and is launching an attack; (3) R(t): Recovery node, which refers to a node that has been cleaned of malicious programs and has immunity; The formula is: Where: β is the infection rate, γ is the recovery rate, and N is the number of summary sections; This represents the rate of change of susceptible nodes over time; This represents the rate of change of infected nodes over time; This represents the rate of change of the recovery node over time; Step 4.2: Predict the evolution trend of the number of infected nodes I(t) based on the constructed SIR model; Step 4.3: Construct a comprehensive risk score using the predicted number of future infected nodes I(t) obtained from the SIR model and the predicted attack traffic intensity Z(t+h) obtained from the ARIMA model in Step 3. In the formula: I(t) is the number of infected nodes predicted at time t calculated by the SIR model; τ is the attack traffic predicted h steps ahead by the ARIMA model; N is the total number of network nodes; τ is the warning threshold calculated in step 3; α1 and α2 are weighting coefficients. Based on the risk index L, the system defense strategy is divided into three levels and the defense is automatically adjusted: (4.3.1) Normal level, L < L1: Use the default detection frequency and default request rate limiting strategy; (4.3.2) Alert level, L1 ≤ L < L2: Lower the upper limit of the request rate of the node and increase the proportion of detection of high-risk feature vectors; (4.3.3) Emergency level, L ≥ L2: Activate a stricter threshold ε' to re-detect suspicious traffic and add nodes that are repeatedly judged as abnormal to the blacklist.

6. The MCP flooding attack detection method based on behavioral characteristics according to claim 1, characterized in that, The specific process of step 5 is as follows: Step 5.1: Based on the four-dimensional behavioral features extracted in Step 1, calculate a preliminary risk score for each task to be detected, and classify the tasks into three priorities: high, medium, and low. The risk score calculation formula is as follows: Where: L is the parameter byte length; D is the nesting depth; ΔT is the request time interval; Lmax and Dmax are the normalized upper limits of the parameter length and nesting depth, respectively; Let be the weighting coefficient, satisfying ; Based on the comparison relationship between the risk score and preset thresholds θ1 and θ2, the detection tasks are divided into: low priority when Risk_score < θ1; medium priority when θ1 ≤ Risk_score < θ2; and high priority when Risk_score ≥ θ2. Step 5.2: Formalize the detection system. Assume the detection system has M tasks and a total resource of R. Set the delay function and task-specific constants for each task. Step 5.3: Design constraints and use a greedy algorithm to solve for the optimal detection resource allocation. The scheduling objective is to minimize the weighted average delay. Where: Pj represents the weight coefficient of the j-th task, d j (x j This indicates that task j is allocating resources x. j The cost function at time M is the total number of tasks. Constraints: Where: R represents the total amount of available system resources, r j This represents the maximum amount of resources that task j can be allocated.

7. A system comprising a processor, characterized in that it is capable of running the MCP flood attack detection method based on behavioral characteristics as described in any one of claims 1-6.

8. An apparatus, characterized in that it comprises: Memory: for storing the computer program of the MCP flood attack detection method based on behavioral characteristics as described in any one of claims 1-6; Processor: Used to implement the behavioral feature-based MCP flood attack detection method when executing any of the computer programs described in claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the MCP flood attack detection method based on behavioral characteristics as described in any one of claims 1-6.

Images