DDoS attack detection method and device, equipment, medium and product

Abstract

The invention relates to a DDoS attack detection method and device, equipment, a medium and a product. The method comprises the following steps: acquiring a characteristic variable of to-be-detected traffic data of a to-be-detected network; dividing the feature variable into a plurality of feature sub-blocks; wherein each feature sub-block comprises a feature variable, the correlation of which meets a preset requirement; extracting a low-dimensional feature vector of each feature sub-block, and processing the low-dimensional feature vector of each feature sub-block through an attack detection model obtained through pre-training to obtain a detection result; and determining whether the to-be-detected network has the DDoS attack based on the detection result. According to the method, intelligent blocking and parallel analysis can be carried out on the characteristic variables of the flow data, so that the local abnormal mode of the DDoS attack is effectively captured, the accuracy and the real-time performance of DDoS attack detection are remarkably improved, and meanwhile, the risks of misinformation and missing report are greatly reduced.

Description

Technical Field

[0001] This disclosure relates to the field of distributed denial-of-service attacks, and in particular to a method, apparatus, device, medium, and product for detecting DDoS attacks. Background Technology

[0002] With the popularization of technologies such as cloud computing and the Internet of Things, the scale and complexity of network services have surged, and the Distributed Denial of Service (DDoS) attacks have become increasingly frequent and complex. These attacks seriously threaten the stability and security of online services and pose a severe challenge to the detection capabilities of existing network security protection systems.

[0003] In related technologies, DDoS attack detection methods often rely on global modeling and analysis of high-dimensional data. However, such methods are difficult to effectively capture the complex local relationships between data features, and the commonly used linear dimensionality reduction techniques will lose key nonlinear structural information, ultimately leading to insufficient accuracy of the detection model and the occurrence of false positives and false negatives. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, medium, and product for detecting DDoS attacks.

[0005] According to a first aspect of this disclosure, a method for detecting DDoS attacks is provided, the method comprising: Obtain the characteristic variables of the traffic data to be detected from the network to be detected; The feature variables are divided into multiple feature sub-blocks; wherein each feature sub-block contains feature variables whose correlation meets preset requirements; Extract the low-dimensional feature vector of each feature sub-block, and process the low-dimensional feature vector of each feature sub-block using a pre-trained attack detection model to obtain the detection result; Based on the detection results, it is determined whether the network under test is subject to a DDoS attack.

[0006] Furthermore, dividing the feature variable into multiple feature sub-blocks includes: A mutual information matrix is ​​determined based on the feature variables, wherein the mutual information matrix is ​​used to indicate the mutual information between any two feature variables, and the mutual information is used to quantify the linear and non-linear dependencies between any two feature variables; The mutual information matrix is ​​processed by a spectral clustering algorithm to obtain the multiple feature sub-blocks.

[0007] Further, determining the mutual information matrix based on the feature variables includes: The mutual information between any two of the feature variables is calculated using a first formula; wherein, the first formula is: , and For any two of the feature variables, Let be the joint probability distribution of any two feature variables. and Let each be a marginal probability distribution of any two of the feature variables. The mutual information of any two feature variables among the feature variables; The mutual information matrix is ​​determined based on the mutual information.

[0008] Further, the process of processing the mutual information matrix using a spectral clustering algorithm to obtain the multiple feature sub-blocks includes: The mutual information matrix is ​​processed by a Gaussian kernel function to obtain an affinity matrix; the affinity matrix is ​​used to characterize the similarity between any two feature variables in the mutual information matrix in the clustering dimension. The Laplacian matrix is ​​determined based on the affinity matrix, and an eigenvector space is constructed based on the Laplacian matrix; wherein the eigenvector space is a low-dimensional space composed of the eigenvectors of the Laplacian matrix. The vector points in the feature vector space are clustered using a clustering algorithm to obtain the multiple feature sub-blocks.

[0009] Furthermore, there are multiple detection results, and each detection result corresponds to one feature sub-block; Determining whether the network under test is subject to a DDoS attack based on the detection results includes: If at least one first result is included among the multiple detection results, it is determined that the network to be detected is under DDoS attack; wherein, the first result is used to indicate that the feature sub-block is abnormal; If multiple detection results are determined to be the second result, then it is determined that the network to be detected is not subject to a DDoS attack; wherein, the second result is used to indicate that the feature sub-block is not abnormal.

[0010] Furthermore, the method also includes: Obtain the characteristic variables of the traffic data sample; wherein, the traffic data sample is the traffic data of the network to be detected during a simulated DDoS attack; The feature variables are divided into multiple training feature sub-blocks; wherein each training feature sub-block contains feature variables whose correlation meets preset requirements; Extract the low-dimensional feature vector of each of the trained feature sub-blocks; The support vector machine is trained based on each of the low-dimensional feature vectors to obtain the attack detection model corresponding to each of the trained feature sub-blocks.

[0011] According to a second aspect of this disclosure, a DDoS attack detection device is provided, the device comprising: The first acquisition module is used to acquire the characteristic variables of the traffic data to be detected in the network to be detected; The first grouping module is used to divide the feature variables into multiple feature sub-blocks; wherein each feature sub-block contains feature variables whose correlation meets preset requirements; The detection module is used to extract the low-dimensional feature vector of each feature sub-block and process the low-dimensional feature vector of each feature sub-block using a pre-trained attack detection model to obtain the detection result. The determination module is used to determine whether the network to be detected is under DDoS attack based on the detection results.

[0012] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0013] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described above.

[0014] According to a fifth aspect of this disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, implements the methods described above in this disclosure.

[0015] This disclosure provides a method, apparatus, device, medium, and product for detecting DDoS attacks. In this embodiment, firstly, feature variables of the traffic data to be detected from the network to be detected are obtained; then, the feature variables are divided into multiple feature sub-blocks; each feature sub-block contains feature variables whose correlation meets preset requirements; subsequently, low-dimensional feature vectors of each feature sub-block are extracted, and the low-dimensional feature vectors of each feature sub-block are processed by a pre-trained attack detection model to obtain detection results; finally, based on the detection results, it is determined whether a DDoS attack exists on the network to be detected.

[0016] As described above, this embodiment of the present disclosure acquires the feature variables of the traffic data to be detected from the network to be detected, divides these feature variables into multiple feature sub-blocks with the same correlation as preset requirements, extracts low-dimensional feature vectors for each feature sub-block, and processes each feature sub-block using a pre-trained attack detection model to obtain detection results. Finally, the detection results are used to determine whether the network to be detected is under DDoS attack. This embodiment of the present disclosure divides high-dimensional feature variables into multiple feature sub-blocks with the same correlation as preset requirements, enabling independent anomaly detection for each sub-block, thereby effectively capturing local anomaly patterns, significantly improving detection accuracy and reducing false positives and false negatives. Furthermore, the feature variable division strategy fully considers the inherent correlation between feature variables, avoiding information loss and detection blind spots caused by the complexity of high-dimensional features in traditional global modeling. In addition, the parallel processing mechanism of each feature sub-block optimizes the utilization of computing resources and greatly improves detection efficiency, thereby effectively solving the technical problem of untimely and inaccurate DDoS attack detection caused by insufficient model generalization ability and high computational complexity in the prior art. Attached Figure Description

[0017] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0018] Figure 1 A flowchart illustrating a DDoS attack detection method provided as an exemplary embodiment of this disclosure; Figure 2 One of the flowcharts for a DDoS attack detection method provided as another exemplary embodiment of this disclosure; Figure 3 A second flowchart of a method for detecting DDoS attacks provided as another exemplary embodiment of this disclosure; Figure 4 A flowchart of a method for detecting DDoS attacks provided as another exemplary embodiment of this disclosure; Figure 5 A schematic diagram of the overall process of a DDoS attack detection method provided for an exemplary embodiment of this disclosure; Figure 6 A schematic block diagram of the functional modules of a DDoS attack detection device provided as an exemplary embodiment of this disclosure; Figure 7 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure; Figure 8A structural block diagram of a computer system provided as an exemplary embodiment of this disclosure; Figure 9 A structural block diagram of a computer program product provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0019] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0020] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0021] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0022] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more". The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0023] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0024] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0025] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of this disclosure; other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0026] In one embodiment, such as Figure 1 As shown, a method for detecting DDoS attacks is provided, including the following steps: Step 101: Obtain the feature variables of the traffic data to be detected from the network to be detected.

[0027] Here, the executing entity can obtain the characteristic variables of the traffic data to be detected in the network to be detected. The traffic data to be detected in the network to be detected can be network flow records, packet header information, session logs, etc. It should be noted that the specific content of the traffic data to be detected is not limited here.

[0028] In one possible embodiment, the feature variables of the traffic data to be detected typically include non-numerical features, such as protocol type, service type, and connection status flag. Therefore, the executing entity needs to preprocess the feature variables of the traffic data to be detected, including but not limited to numerical operations, data cleaning, and data standardization.

[0029] Specifically, the executing entity can perform numerical operations on the feature variables of the traffic data to be detected. The executing entity can convert the traffic data containing non-numerical features into numerical values ​​through methods such as label encoding or one-hot encoding, so as to facilitate subsequent mathematical modeling and calculation. For example, the executing entity can map tcp, udp and icmp in the protocol type protocol_type of the traffic data to be detected to the numbers 0, 1 and 2 respectively.

[0030] The execution entity can perform data cleaning on the feature variables of the traffic data to be detected. Data cleaning includes filling missing features and removing redundant features. Filling missing features means that the execution entity checks whether there are missing values ​​in the extracted feature data. For features with missing values, a preset strategy is used to fill them, such as using the mean, median or mode of the feature in historical normal data to ensure the integrity of the dataset. Removing redundant features means that the execution entity removes features that contribute very little or no to the detection target. This includes removing constant features with variance close to zero and redundant features that are highly linearly correlated with other features, in order to reduce the data dimensionality and computational complexity of the traffic data to be detected and prevent overfitting.

[0031] The executing entity can standardize the feature variables of the traffic flow data to be detected. To ensure the comparability of feature variables with different dimensions and numerical ranges in subsequent analysis and to meet the model's requirements for data distribution, the executing entity can perform standardization processing on the cleaned numerical features. This processing is based on statistical parameters learned from historical normal traffic flow data. For example, if the current traffic flow data to be detected is X, which contains m feature variables, the standardization processing uses the following formula to transform the data into a distribution with a mean of 0 and a standard deviation of 1:

[0032] in, It is the vector of the mean values ​​of each feature variable in historical normal data. It is the corresponding standard deviation vector. These are standardized feature variables. After the preprocessing process described in the above embodiments, the executing entity finally obtains a standardized, dimensionless set of numerical feature variables.

[0033] Step 102: Divide the feature variables into multiple feature sub-blocks.

[0034] Here, after obtaining the feature variables of the traffic data to be detected in the network to be detected, the executing entity can divide the feature variables into multiple feature sub-blocks, where each feature sub-block contains feature variables whose correlation meets preset requirements.

[0035] In one possible embodiment, such as Figure 2 As shown, dividing the feature variables into multiple feature sub-blocks includes the following steps: Step 1021: Determine the mutual information matrix based on the feature variables.

[0036] Here, after obtaining the feature variables of the traffic data to be detected in the network to be detected, the executing entity can determine the mutual information matrix based on the feature variables. The mutual information matrix is ​​used to indicate the mutual information between any two feature variables, and the mutual information is used to quantify the linear and non-linear dependencies between any two feature variables.

[0037] In one possible embodiment, determining the mutual information matrix based on feature variables includes the following steps: The mutual information between any two feature variables is calculated using the first formula; The mutual information matrix is ​​determined based on mutual information.

[0038] Specifically, after obtaining the feature variables of the traffic data to be detected from the network to be detected, the executing entity first calculates the mutual information between any two feature variables using the first formula, where the first formula is: , and Let be any two characteristic variables among the characteristic variables. Let be the joint probability distribution of any two feature variables. and Let be the marginal probability distributions of any two feature variables. The mutual information is the information between any two feature variables; then, the executing agent determines the mutual information matrix based on the mutual information.

[0039] In one possible embodiment, the executing entity calculates the mutual information between any two feature variables using a first formula, the expression of which is:

[0040] in, and Let be any two characteristic variables among the characteristic variables. Let be the joint probability distribution of any two feature variables. and Let be the marginal probability distributions of any two feature variables. It represents the mutual information between any two feature variables.

[0041] In one possible embodiment, the first formula can also be equivalently expressed and calculated using information entropy:

[0042] in, and It is a variable and The marginal entropy can be calculated as:

[0043] The joint entropy of two variables can be calculated as:

[0044] After calculating the mutual information between any two feature variables using the first formula, the executing entity determines the mutual information matrix based on the mutual information. Assuming there are m feature variables, the mutual information matrix R constructed by the executing entity is an m×m matrix. Each element in this mutual information matrix R... The specific form of the mutual information matrix R is as follows:

[0045] It should be noted that, due to the symmetry of mutual information, that is... Therefore, the mutual information matrix R is a symmetric matrix, and each row vector of this matrix... It comprehensively represents the characteristic variables The overall association pattern with all other feature variables.

[0046] Step 1022: The mutual information matrix is ​​processed by the spectral clustering algorithm to obtain multiple feature sub-blocks.

[0047] Here, after determining the mutual information matrix based on the feature variables, the executing entity can process the mutual information matrix using a spectral clustering algorithm to obtain multiple feature sub-blocks. The spectral clustering algorithm can be a spectral-clustering chunking strategy based on the correlation matrix (SCM).

[0048] In one possible embodiment, the mutual information matrix is ​​processed by a spectral clustering algorithm to obtain multiple feature sub-blocks, including the following steps: The mutual information matrix is ​​processed by the Gaussian kernel function to obtain the affinity matrix; The Laplacian matrix is ​​determined based on the affinity matrix, and the eigenvector space is constructed based on the Laplacian matrix; Clustering algorithms are used to cluster vector points in the feature vector space to obtain multiple feature sub-blocks.

[0049] Specifically, after determining the mutual information matrix based on the feature variables, the executing entity first processes the mutual information matrix using a Gaussian kernel function to obtain an affinity matrix, where the affinity matrix characterizes the similarity between any two feature variables in the mutual information matrix in the clustering dimension. Then, the executing entity determines the Laplacian matrix based on the affinity matrix and constructs an eigenvector space based on the Laplacian matrix, where the eigenvector space is a low-dimensional space composed of the eigenvectors of the Laplacian matrix. Finally, the executing entity clusters the vector points in the eigenvector space using a clustering algorithm to obtain multiple feature sub-blocks.

[0050] In one possible embodiment, the executing entity will use each row vector of the mutual information matrix R. Treating it as an independent sample point, this vector This characterizes the association pattern between the i-th feature variable and the global cluster. To quantify the similarity of these sample points, i.e., the feature variables, along the clustering dimension, the execution entity uses a Gaussian kernel function to calculate the similarity between any two sample points. and Affinity between Thus, the affinity matrix W is constructed. and Affinity between The calculation formula is as follows:

[0051] in, It is a distance function. It involves adjusting parameters to improve clustering results. The Calinski-Harbasz Score (CH score) is used for evaluation. It's a core internal evaluation metric in cluster analysis, used to quantitatively assess the quality of clustering results. A higher score indicates better clustering performance. The core logic is to measure the balance between between-cluster separation and within-cluster compactness. The calculation formula is:

[0052] in, Represents the number of cluster categories. Represents the total number of data points, and the inter-class variance. Represented as Within-class variance Represented as , and The calculation formula is:

[0053]

[0054] in, Is class The collection of all data in For class The center of mass, For all data center locations, For class The total number of data points.

[0055] After obtaining the affinity matrix W, the executing entity calculates its corresponding degree matrix D. The degree matrix D is a diagonal matrix, and its diagonal elements... That is, the degree of the i-th node represents the degree of the feature variable. The sum of the weights of all connected edges. After calculating the degree matrix D corresponding to the affinity matrix W, the executing entity constructs a normalized Laplacian matrix L based on the degree matrix D and the affinity matrix W. In this embodiment, the executing entity uses a symmetric normalized Laplacian matrix, the calculation formula of which is:

[0056] Where I is the identity matrix, which is a square matrix with all elements on its main diagonal being 1 and all other elements being 0.

[0057] Next, the executing entity performs eigenvalue decomposition on the Laplacian matrix L. In order to map the original data to a low-dimensional space, the executing entity selects the eigenvectors corresponding to the first k smallest non-zero eigenvalues ​​of the Laplacian matrix L, where k is the preset number of feature sub-blocks. The executing entity arranges these k eigenvectors in columns to form an m×k dimensional matrix. Each row of this matrix can be regarded as a new representation of the original feature variables in the low-dimensional space. The set of all these rows constitutes a low-dimensional feature vector space.

[0058] After constructing the eigenvector space based on the Laplacian matrix, the executing entity clusters the vector points in the eigenvector space using a clustering algorithm to obtain multiple feature sub-blocks. In this low-dimensional eigenvector space, the executing entity uses a clustering algorithm, such as the K-Means algorithm, to cluster m vector points in the aforementioned low-dimensional space. Each vector point corresponds to an original feature variable. The number of clusters k can be optimized based on clustering evaluation metrics, such as the Calinski-Harabasz Score in the above embodiment. After the executing entity completes the clustering, the original set of feature variables is divided into k feature sub-blocks. The variables contained within each feature sub-block exhibit high similarity in their row vectors in the mutual information matrix R, i.e., the correlation contours, thereby achieving the goal of grouping feature variables with common conditions into the same sub-block.

[0059] In this embodiment, firstly, the executing entity determines the mutual information matrix based on the feature variables. The mutual information matrix is ​​used to indicate the mutual information between any two feature variables, and the mutual information is used to quantify the linear and nonlinear dependencies between any two feature variables. Then, the executing entity processes the mutual information matrix through a spectral clustering algorithm to obtain multiple feature sub-blocks.

[0060] As described above, this embodiment effectively overcomes the limitations of traditional linear correlation measures by introducing a mutual information matrix as input to the spectral clustering algorithm. It comprehensively captures the complex linear and nonlinear dependencies between feature variables, thus providing a more scientific and accurate basis for subsequent feature sub-block partitioning. Based on this, this embodiment uses the spectral clustering algorithm to intelligently partition feature variables, generating multiple feature sub-blocks with strong internal correlations. Each sub-block can specifically reflect the local behavior patterns of the system, significantly improving the detection sensitivity of local anomaly features in DDoS attacks and effectively reducing the risk of false positives and false negatives caused by global modeling of high-dimensional features. Simultaneously, this partitioning strategy provides a natural advantage for parallel computing, greatly improving the processing efficiency of large-scale network traffic data, thereby achieving more timely and accurate detection of DDoS attacks.

[0061] Step 103: Extract the low-dimensional feature vector of each feature sub-block, and process the low-dimensional feature vector of each feature sub-block using the pre-trained attack detection model to obtain the detection result.

[0062] Here, after the execution entity divides the feature variables into multiple feature sub-blocks, it can extract the low-dimensional feature vector of each feature sub-block and process the low-dimensional feature vector of each feature sub-block through the pre-trained attack detection model to obtain the detection result.

[0063] In one possible embodiment, the executing entity uses Kernel Principal Component Analysis (KPCA) to perform nonlinear feature extraction on each feature sub-block to obtain a low-dimensional feature vector for each feature sub-block. This process aims to preserve the inherent nonlinear structure in the original feature space and overcome the limitations of the traditional linear dimensionality reduction method of Principal Component Analysis (PCA).

[0064] Specifically, the executing entity handles feature sub-blocks containing p feature variables. Where n refers to the number of historical network traffic data samples used to train the attack detection model during the offline training phase, and the feature sub-blocks. The KPCA processing flow is as follows: First, the execution entity selects the radial basis kernel function as the kernel function of KPCA, and this kernel function is defined as , where is the kernel parameter. This kernel function can effectively map the data into a high-dimensional feature space to capture non-linear features. Then, based on the selected kernel function, the execution entity calculates the kernel matrix of this feature sub-block. The elements in its kernel matrix ; Next, the execution entity centralizes the kernel matrix to obtain , where is an n×n matrix with all elements being 1 / n. After that, the execution entity performs eigenvalue decomposition on the centralized kernel matrix to obtain eigenvalues and corresponding eigenvectors. Finally, the execution entity selects the eigenvectors corresponding to the first d principal components (d < p), and projects the original feature sub-block data onto the subspace spanned by these principal components, thereby obtaining the low-dimensional feature vector representation of this feature sub-block .

[0065] In a possible embodiment, following the above example, after the execution entity extracts the low-dimensional feature vector of each feature sub-block , it processes the low-dimensional feature vector of each feature sub-block through a pre-trained attack detection model to obtain a detection result.

[0066] Specifically, the execution entity inputs the low-dimensional feature vector corresponding to each feature sub-block into the attack detection model pre-trained for this sub-block. This attack detection model can be a Support Vector Machine (SVM) classifier. The low-dimensional feature vector of each feature sub-block is used as the input of its corresponding SVM model. The kernel function of the SVM also selects the radial basis kernel function. This kernel function enables the SVM to find the optimal classification hyperplane in the high-dimensional feature space and effectively handle non-linearly separable problems. For the input low-dimensional feature vector , after the trained SVM model calculates the input through the decision function, it outputs a detection result. This result can be a binary classification label. Exemplarily, a detection result of +1 indicates "normal", and a detection result of -1 indicates "abnormal". The detection result can also be a probability or confidence score indicating belonging to a certain category. It should be noted that the specific form of the detection result is not limited here.

[0067] Step 104, determine whether there is a DDoS attack on the network to be detected based on the detection result.

[0068] Here, the execution entity processes the low-dimensional feature vector of each feature sub-block using a pre-trained attack detection model. After obtaining the detection results, it can determine whether the network to be detected is under DDoS attack based on the detection results.

[0069] In one possible embodiment, such as Figure 3 As shown, there are multiple detection results, each corresponding to a feature sub-block. Determining whether the network under test is subject to a DDoS attack based on the detection results includes the following steps: Step 1041: If at least one first result is included in multiple detection results, it is determined that the network to be detected is under DDoS attack.

[0070] Here, the execution entity processes the low-dimensional feature vector of each feature sub-block using a pre-trained attack detection model. After obtaining the detection results, if at least one first result is included in multiple detection results, it is determined that the network to be detected is under DDoS attack. The first result is used to indicate that the feature sub-block is abnormal.

[0071] In one possible implementation, if multiple detection results include at least one first result, this means that as long as any feature sub-block among all monitored feature sub-blocks has a first detection result, the network under test is considered to be under DDoS attack. This determination mechanism embodies the principle of veto power and is highly sensitive to local anomalies in the network under test. Once this condition is met, the executing entity immediately determines that the network under test is under DDoS attack.

[0072] Step 1042: If multiple detection results are all the second result, then it is determined that the network to be detected is not under DDoS attack.

[0073] Here, the execution entity processes the low-dimensional feature vector of each feature sub-block using a pre-trained attack detection model. After obtaining the detection results, if multiple detection results are determined to be the second result, it is determined that the network to be detected does not have a DDoS attack. The second result is used to indicate that the feature sub-block does not have anomalies.

[0074] In one possible embodiment, if multiple detection results are determined to be the second result, it means that the behavior pattern exhibited by the current network traffic data on all the divided feature sub-blocks has not exceeded the normal range defined by their respective feature sub-blocks. That is, all local behaviors of the network to be detected are normal, and the executing entity determines that there is no DDoS attack on the network to be detected.

[0075] In this embodiment, if at least one first result is included in multiple detection results, the executing entity determines that the network to be detected is under DDoS attack; if multiple detection results are all second results, the executing entity determines that the network to be detected is not under DDoS attack.

[0076] As described above, this embodiment transforms the local detection advantage of the multi-block modeling strategy into high reliability of global judgment by setting a decision mechanism that triggers a global alarm for any abnormal sub-block. This enables timely detection of subtle attack features that are easily missed by traditional global modeling, thereby significantly reducing the false alarm rate. At the same time, since this judgment is based on the consensus of multiple independent sub-block models, it effectively avoids misjudgments caused by noise or normal traffic fluctuations in a single model, greatly reducing the false alarm rate. This decision logic, which takes into account both local sensitivity and global consistency, combined with the efficiency brought by multi-block parallel processing, ultimately achieves both rapid and accurate identification of complex DDoS attacks in big data environments, comprehensively improving the real-time performance and accuracy of network security protection.

[0077] This disclosure provides a method, apparatus, device, medium, and product for detecting DDoS attacks. In this embodiment, firstly, feature variables of the traffic data to be detected from the network to be detected are obtained; then, the feature variables are divided into multiple feature sub-blocks; each feature sub-block contains feature variables whose correlation meets preset requirements; subsequently, low-dimensional feature vectors of each feature sub-block are extracted, and the low-dimensional feature vectors of each feature sub-block are processed by a pre-trained attack detection model to obtain detection results; finally, based on the detection results, it is determined whether a DDoS attack exists on the network to be detected.

[0078] As described above, this embodiment of the present disclosure acquires the feature variables of the traffic data to be detected from the network to be detected, divides these feature variables into multiple feature sub-blocks with the same correlation as preset requirements, extracts low-dimensional feature vectors for each feature sub-block, and processes each feature sub-block using a pre-trained attack detection model to obtain detection results. Finally, the detection results are used to determine whether the network to be detected is under DDoS attack. This embodiment of the present disclosure divides high-dimensional feature variables into multiple feature sub-blocks with the same correlation as preset requirements, enabling independent anomaly detection for each sub-block, thereby effectively capturing local anomaly patterns, significantly improving detection accuracy and reducing false positives and false negatives. Furthermore, the feature variable division strategy fully considers the inherent correlation between feature variables, avoiding information loss and detection blind spots caused by the complexity of high-dimensional features in traditional global modeling. In addition, the parallel processing mechanism of each feature sub-block optimizes the utilization of computing resources and greatly improves detection efficiency, thereby effectively solving the technical problem of untimely and inaccurate DDoS attack detection caused by insufficient model generalization ability and high computational complexity in the prior art.

[0079] In one embodiment, such as Figure 4 As shown, the method for detecting DDoS attacks also includes the following steps: Step 401: Obtain the feature variables of the traffic data sample.

[0080] Here, before the execution entity processes the low-dimensional feature vector of each feature sub-block using the pre-trained attack detection model, it needs to train the attack detection model through offline modeling. Training the attack detection model requires first obtaining the feature variables of traffic data samples, which are the traffic data of the network to be detected when simulating a DDoS attack.

[0081] In one possible embodiment, the executing entity extracts feature variables from the raw traffic data, i.e., the traffic data sample, based on a predefined feature set. This traffic data sample contains multiple quantitative indicators that can comprehensively characterize network connectivity behavior patterns. These quantitative indicators can refer to a simulation experiment feature table containing 34 features, as shown below:

[0082] The simulation experiment feature table includes, but is not limited to, various types of features such as duration, protocol type, service type, source bytes, destination bytes, connection status flags, error rate percentages (serror_rate, rerror_rate), login behavior features (guest_login, logged_in), and system access features (file_creations, shells). These features together constitute the high-dimensional feature vector required to train the attack detection model.

[0083] Step 402: Divide the feature variables into multiple training feature sub-blocks.

[0084] Here, after obtaining the feature variables of the traffic data sample, the executing entity can divide the feature variables into multiple training feature sub-blocks, where each training feature sub-block contains feature variables whose correlation meets preset requirements.

[0085] In one possible embodiment, following the previous example, the executing entity divides the feature variables into multiple training feature sub-blocks. The division rules need to be based on the inherent correlation between the feature variables to ensure that each training feature sub-block contains highly correlated feature variables. It should be noted that the method for dividing the training feature sub-blocks can be referred to the method in step 102, and the specific division process will not be repeated here.

[0086] Step 403: Extract the low-dimensional feature vector of each training feature sub-block.

[0087] Here, after dividing the feature variables into multiple training feature sub-blocks, the executing entity can extract the low-dimensional feature vector of each training feature sub-block.

[0088] In one possible embodiment, continuing from the previous example, the executing entity performs nonlinear feature extraction on each training feature sub-block to obtain its low-dimensional representation. The feature extraction can be performed using the kernel principal component analysis (KPCA) method, which aims to preserve the nonlinear structure in the original feature space. It should be noted that the KPCA processing flow for each training feature sub-block can be found in the detailed description of the feature extraction part in step 103. The specific process will not be repeated here. Through this step, the executing entity determines the corresponding low-dimensional feature vector set for each training feature sub-block.

[0089] Step 404: Train the support vector machine based on each low-dimensional feature vector to obtain the attack detection model corresponding to each training feature sub-block.

[0090] Here, after the execution entity extracts the low-dimensional feature vector of each training feature sub-block, it can train the support vector machine based on each low-dimensional feature vector to obtain the attack detection model corresponding to each training feature sub-block.

[0091] In one possible embodiment, continuing from the previous example, for each training feature sub-block, the execution entity has obtained traffic data samples containing normal and DDoS attack labels through step 401, completed the division of feature sub-blocks based on mutual information matrix and spectral clustering algorithm through step 402, and extracted the low-dimensional feature vectors of each sub-block using kernel principal component analysis through step 403. Based on this, the execution entity uses the low-dimensional feature vectors of each training feature sub-block and their corresponding class labels as training datasets and inputs them into SVM for training. During the training process, the radial basis function kernel function is selected for the SVM kernel function, which is consistent with the kernel function used in the online detection stage in step 103. After the training is completed, the execution entity obtains the attack detection model corresponding to each training feature sub-block. This attack detection model provides complete model support for the online real-time detection in step 103.

[0092] In one embodiment, such as Figure 5The diagram illustrates the overall process of a DDoS attack detection method. The offline modeling stage corresponds to steps 401 to 404 in the aforementioned embodiment, and mainly includes the following processing steps: preprocessing the acquired traffic data samples, including numericalization, redundant feature removal, feature filling, label encoding, and standardization (corresponding to numericalization, data cleaning, and data standardization in step 101); SCM variable segmentation, which is the feature sub-block partitioning based on mutual information matrix and spectral clustering algorithm in step 102, dividing all feature variables into multiple training feature sub-blocks (sub-block 1 to sub-block n); KPCA feature extraction for each sub-block, i.e., using KPCA to perform nonlinear feature extraction on each feature sub-block in step 403, obtaining a low-dimensional feature vector for each training feature sub-block; SVM model training to determine its parameters, i.e., training a support vector machine based on each low-dimensional feature vector in step 404, generating a dedicated attack detection model for each training feature sub-block. Figure 5 Various classification models used for online detection.

[0093] The online detection stage corresponds to steps 101 to 104 in the aforementioned embodiments, and mainly includes the following processing steps: data preprocessing, that is, performing preprocessing operations on the traffic data to be detected in the same way as in the offline stage; SCM variable segmentation, that is, using the same segmentation strategy as in the offline stage to divide the feature variables of the data to be detected into corresponding feature sub-blocks; KPCA feature extraction, that is, using the same method as in the offline stage to extract features from the corresponding feature sub-blocks to obtain low-dimensional feature vectors; Figure 5 Each classification model is obtained by processing the corresponding low-dimensional feature vector using the SVM classifiers trained in the offline stage; the process of judging whether any sub-block is abnormal, namely the decision logic in step 104, judges whether there is at least one first result in the detection results of each sub-block. If so, it is judged as "attacked", otherwise it is judged as "data is normal".

[0094] As described above, this technical solution introduces a multi-block modeling strategy, intelligently dividing high-dimensional feature variables into multiple feature sub-blocks with strong internal correlation based on mutual information matrix and spectral clustering algorithm. This enables precise monitoring of local network traffic behavior patterns, effectively overcoming the detection blind spots and insufficient sensitivity issues of traditional global modeling in the face of high-dimensional complex features. Simultaneously, this solution combines kernel principal component analysis to extract nonlinear features from each sub-block, fully preserving the nonlinear structure in the original feature space and avoiding the information loss defects of linear dimensionality reduction methods. Furthermore, this solution uses support vector machines to establish dedicated detection models for each sub-block and achieves efficient fusion through a "one-vote veto" decision-making mechanism. Ultimately, while significantly improving DDoS attack detection accuracy and reducing false positive and false negative rates, the parallel processing capabilities of each sub-block greatly improve detection efficiency, providing a timely and accurate solution for network security protection in big data environments.

[0095] By dividing each functional module according to its corresponding function, this disclosure provides a DDoS attack detection device, which can be a server or a chip applied to a server. Figure 6 This is a schematic block diagram of the functional modules of a DDoS attack detection device provided as an exemplary embodiment of this disclosure. Figure 6 As shown, the detection device for this DDoS attack includes: The first acquisition module 601 is used to acquire the characteristic variables of the traffic data to be detected in the network to be detected; The first grouping module 602 is used to divide the feature variables into multiple feature sub-blocks; wherein each feature sub-block contains feature variables whose correlation meets preset requirements; The detection module 603 is used to extract the low-dimensional feature vector of each feature sub-block and process the low-dimensional feature vector of each feature sub-block through a pre-trained attack detection model to obtain the detection result. The determination module 604 is used to determine whether the network to be detected is under DDoS attack based on the detection results.

[0096] In one embodiment, the first grouping module 602 includes: The first determining unit is configured to determine a mutual information matrix based on the feature variables, wherein the mutual information matrix is ​​used to indicate the mutual information between any two feature variables, and the mutual information is used to quantify the linear and nonlinear dependencies between any two feature variables; The first processing unit is used to process the mutual information matrix using a spectral clustering algorithm to obtain the multiple feature sub-blocks.

[0097] In one embodiment, the first grouping module 602 includes: The calculation unit is configured to calculate the mutual information between any two of the feature variables using a first formula; wherein the first formula is: , and For any two of the feature variables, Let be the joint probability distribution of any two feature variables. and Let each be a marginal probability distribution of any two of the feature variables. The mutual information of any two feature variables among the feature variables; The second determining unit is used to determine the mutual information matrix based on the mutual information.

[0098] In one embodiment, the first grouping module 602 includes: The second processing unit is used to process the mutual information matrix using a Gaussian kernel function to obtain an affinity matrix; the affinity matrix is ​​used to characterize the similarity between any two feature variables in the mutual information matrix in the clustering dimension. A construction unit is used to determine the Laplacian matrix based on the affinity matrix and construct an eigenvector space based on the Laplacian matrix; wherein the eigenvector space is a low-dimensional space composed of the eigenvectors of the Laplacian matrix; Clustering units are used to cluster vector points in the feature vector space using a clustering algorithm to obtain the multiple feature sub-blocks.

[0099] In one embodiment, determining module 604 includes: A first detection unit is configured to determine that the network to be detected is under DDoS attack if at least one first result is included among the multiple detection results; wherein the first result is used to indicate that the feature sub-block is abnormal; The second detection unit is used to determine that the network to be detected is not under DDoS attack if multiple detection results are all the second result; wherein the second result is used to indicate that the feature sub-block is not abnormal.

[0100] In one embodiment, the apparatus further includes: The second acquisition module is used to acquire the feature variables of the traffic data sample; wherein, the traffic data sample is the traffic data of the network to be detected when simulating a DDoS attack; The second grouping module is used to divide the feature variables into multiple training feature sub-blocks; wherein each training feature sub-block contains feature variables whose correlation meets preset requirements; An extraction module is used to extract the low-dimensional feature vector of each of the training feature sub-blocks; The training module is used to train the support vector machine based on each of the low-dimensional feature vectors to obtain the attack detection model corresponding to each of the training feature sub-blocks.

[0101] This disclosure also provides an electronic device, including: at least one processor; a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the methods disclosed in this disclosure.

[0102] Figure 7 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 7 As shown, the electronic device 700 includes at least one processor 701 and a memory 702 coupled to the processor 701. The processor 701 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0103] The processor 701 described above can also be called a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 701 or by software instructions. The processor 701 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 702, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 701 reads information from the memory 702 and, in conjunction with its hardware, completes the steps of the method described above.

[0104] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 8 The computer system 800 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including those described above. Figure 8 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0105] Computer system 800 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0106] like Figure 8 As shown, the computer system 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. The RAM 803 may also store various programs and data required for the operation of the computer system 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0107] Multiple components in the computer system 800 are connected to the I / O interface 805, including: an input unit 806, an output unit 807, a storage unit 808, and a communication unit 809. The input unit 806 can be any type of device capable of inputting information into the computer system 800. The input unit 806 can receive input numerical or character information and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 807 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. The storage unit 808 may include, but is not limited to, a hard disk and an optical disk. The communication unit 809 allows the computer system 800 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, a modem, network card, infrared communication device, wireless communication transceiver, and / or chipset, such as Bluetooth™ device, WiFi device, WiMax device, cellular communication device, and / or the like.

[0108] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 700 via ROM 802 and / or communication unit 809. In some embodiments, the computing unit 801 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0109] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0110] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0111] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0112] Figure 9 A computer program product 900 is provided as an exemplary embodiment of the present disclosure. The computer program product 900 includes a computer program 901, wherein the computer program 901, when executed by a processor, implements the methods disclosed in the embodiments of the present disclosure.

[0113] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0114] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0115] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0116] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0117] The above description is merely an embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0118] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A method for detecting DDoS attacks, characterized in that, include: Obtain the characteristic variables of the traffic data to be detected from the network to be detected; The feature variables are divided into multiple feature sub-blocks; wherein each feature sub-block contains feature variables whose correlation meets preset requirements; The low-dimensional feature vector of each feature sub-block is extracted, and the low-dimensional feature vector of each feature sub-block is processed by the pre-trained attack detection model to obtain the detection result; Based on the detection results, it is determined whether the network under test is subject to a DDoS attack.

2. The method according to claim 1, characterized in that, The step of dividing the feature variables into multiple feature sub-blocks includes: A mutual information matrix is ​​determined based on the feature variables, wherein the mutual information matrix is ​​used to indicate the mutual information between any two feature variables, and the mutual information is used to quantify the linear and non-linear dependencies between any two feature variables; The mutual information matrix is ​​processed by a spectral clustering algorithm to obtain the multiple feature sub-blocks.

3. The method according to claim 2, characterized in that, Determining the mutual information matrix based on the feature variables includes: The mutual information between any two of the feature variables is calculated using a first formula; wherein, the first formula is: , and For any two of the feature variables, Let be the joint probability distribution of any two feature variables. and Let each be a marginal probability distribution of any two of the feature variables. The mutual information of any two feature variables among the feature variables; The mutual information matrix is ​​determined based on the mutual information.

4. The method according to claim 2, characterized in that, The process of processing the mutual information matrix using a spectral clustering algorithm to obtain the multiple feature sub-blocks includes: The mutual information matrix is ​​processed by a Gaussian kernel function to obtain an affinity matrix; the affinity matrix is ​​used to characterize the similarity between any two feature variables in the mutual information matrix in the clustering dimension. The Laplacian matrix is ​​determined based on the affinity matrix, and an eigenvector space is constructed based on the Laplacian matrix; wherein the eigenvector space is a low-dimensional space composed of the eigenvectors of the Laplacian matrix. The vector points in the feature vector space are clustered using a clustering algorithm to obtain the multiple feature sub-blocks.

5. The method according to claim 1, characterized in that, There are multiple detection results, and each detection result corresponds to one feature sub-block; Determining whether the network under test is subject to a DDoS attack based on the detection results includes: If at least one first result is included among the multiple detection results, it is determined that the network to be detected is under DDoS attack; wherein, the first result is used to indicate that the feature sub-block is abnormal; If multiple detection results are determined to be the second result, then it is determined that the network to be detected is not subject to a DDoS attack; wherein, the second result is used to indicate that the feature sub-block is not abnormal.

6. The method according to claim 1, characterized in that, The method further includes: Obtain the characteristic variables of the traffic data sample; wherein, the traffic data sample is the traffic data of the network to be detected during a simulated DDoS attack; The feature variables are divided into multiple training feature sub-blocks; wherein each training feature sub-block contains feature variables whose correlation meets preset requirements; Extract the low-dimensional feature vector of each of the trained feature sub-blocks; The support vector machine is trained based on each of the low-dimensional feature vectors to obtain the attack detection model corresponding to each of the trained feature sub-blocks.

7. A DDoS attack detection device, characterized in that, include: The first acquisition module is used to acquire the characteristic variables of the traffic data to be detected in the network to be detected; The first grouping module is used to divide the feature variables into multiple feature sub-blocks; wherein each feature sub-block contains feature variables whose correlation meets preset requirements; The detection module is used to extract the low-dimensional feature vector of each feature sub-block and process the low-dimensional feature vector of each feature sub-block using a pre-trained attack detection model to obtain the detection result. The determination module is used to determine whether the network to be detected is under DDoS attack based on the detection results.

8. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images