A method, apparatus, and electronic device for assessing DDoS attack mitigation capabilities.

Abstract

This application discloses a method, apparatus, and electronic device for assessing DDoS attack mitigation capabilities, relating to the field of network security technology. It aims to accurately assess the mitigation capabilities of a device when subjected to DDoS attacks. The method includes: first, determining multiple attack types of the DDoS attack based on detected DDoS attack data; second, determining N resilience assessment indicators for attack defense under each attack type; third, constructing a judgment matrix based on the N resilience assessment indicators for each attack type; and fourth, determining the resilience assessment score of the device when performing attack defense based on the judgment matrix and the N resilience assessment indicators. This differentiates attack types and assesses mitigation capabilities from different dimensions, comprehensively reflecting the overall resilience level in the face of different types of DDoS attacks, thus improving the accuracy of resilience assessment.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and electronic device for assessing DDoS attack mitigation capabilities. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks refer to attacks that control a large number of computers and IoT devices to send a massive number of requests to a target website, thereby exhausting its server resources and preventing users from accessing the service. With increasing user concern about cybersecurity, DDoS attacks have become a major focus. To combat new types of DDoS attacks, various defense methods have emerged. Studying DDoS attack defense methods can help avoid or reduce the losses caused by DDoS attacks.

[0003] While various DDoS attack defense methods can effectively defend against DDoS attacks to a large extent, some powerful DDoS attacks can inevitably breach defenses and cause losses to users. Therefore, for unavoidable DDoS attacks, a system resilience assessment can be performed to allow for adjustments to defense methods in response to different DDoS attacks.

[0004] In related technologies, DDoS attacks are often highly dynamic and variable, with different attack methods exhibiting varying attack effects and the target's mitigation capabilities. However, when conducting resilience assessments, a fixed strategy is typically used for DDoS attacks; that is, DDoS attacks are not categorized, and the same resilience assessment method is applied to all attacks. This fails to consider the diversity of different types of DDoS attacks and the impact of various influencing factors on resilience assessments, resulting in assessment results that do not accurately reflect the true performance of devices when subjected to different types of DDoS attacks. Summary of the Invention

[0005] This application provides a method, apparatus, and electronic device for assessing DDoS attack mitigation capabilities, thereby improving the accuracy of the assessment of the mitigation capabilities demonstrated by the device when subjected to different types of DDoS attacks.

[0006] Firstly, this application provides a method for assessing DDoS attack mitigation capabilities, the method comprising:

[0007] Based on the detected DDoS attack data, various types of DDoS attacks were identified; each type of attack had its attack intensity, attack frequency, and attack distribution pattern at the current time.

[0008] For different attack types, N resilience assessment indicators are determined for attack defense under each attack type; where any one resilience assessment indicator is used to indicate the device's defense capability when subjected to DDoS attack, and N is a positive integer greater than or equal to 1.

[0009] A judgment matrix is ​​constructed based on N resilience assessment indicators corresponding to each type of attack, and a resilience assessment score is determined based on the judgment matrix and the N resilience assessment indicators when the device is defending against attacks. The resilience assessment score is used to evaluate the device's ability to mitigate DDoS attacks.

[0010] By differentiating attack types using the methods described above and assessing mitigation capabilities from different dimensions for each attack type, the overall resilience of a device against different types of DDoS attacks can be comprehensively reflected from various perspectives, thus improving the accuracy of resilience assessment.

[0011] In one alternative implementation, multiple attack types of DDoS attacks are determined based on the detected DDoS attack data, including:

[0012] Based on DDoS attack data, the target attack feature set was determined;

[0013] By comparing the target attack feature set with the attack feature set in the preset attack template library, the similarity between each target attack feature and each preset attack feature is determined, and multiple attack types of DDoS attacks are determined based on the similarity corresponding to different target attack features.

[0014] Using the methods described above, DDoS attacks can be accurately classified based on the attack elements corresponding to different attack types, so as to assess the resilience of devices against different types of DDoS attacks from different dimensions.

[0015] In one optional implementation, a judgment matrix is ​​constructed based on N resilience assessment metrics corresponding to each attack type, including:

[0016] For each type of attack, N resilience assessment indicators are compared in pairs to determine the importance of each resilience assessment indicator.

[0017] A judgment matrix is ​​constructed based on the importance of each resilience assessment indicator.

[0018] Using the above method, the importance of resilience assessment indicators is determined, and a judgment matrix is ​​constructed based on the importance. This matrix can dynamically allocate weights to different attack types to highlight the true performance of each attack type.

[0019] In one optional implementation, a resilience score is determined based on a judgment matrix and N resilience assessment metrics when the device is performing attack defense, including:

[0020] A consistency check is performed on the judgment matrix. If the consistency check passes, the weight parameters corresponding to each resilience assessment index are determined based on the judgment matrix.

[0021] Based on each resilience assessment index and its corresponding weighting parameter, a resilience assessment score is determined for the device when performing attack defense.

[0022] By using the above method and dynamically allocating weights, the resilience of a device under different types of attacks can be reflected more accurately.

[0023] In one optional implementation, the N resilience assessment metrics include at least: mitigation efficiency, recovery time, stability index, network resource parameters, system resource parameters, and device type information;

[0024] Among them, mitigation efficiency indicates the proportion of attack data that is successfully filtered for each type of attack; recovery time indicates the speed at which a device recovers to normal after suffering a DDoS attack; stability index indicates the performance fluctuation of a device when suffering a DDoS attack; network resource parameters indicate the usage of network resources; system resource parameters indicate the usage of system resources of the device; and device type information is used to determine the degree of impact of a DDoS attack on the device.

[0025] In an optional implementation, the method further includes:

[0026] Receive the obtained set of indicator data; wherein, the set of indicator data includes at least the attack data corresponding to each attack type, the resilience assessment index corresponding to each attack type, and the resilience assessment score corresponding to the device;

[0027] The obtained set of indicator data is added to a preset visualization report template to generate the corresponding visualization report and display the visualization report; wherein, the visualization report template includes at least one display format for the set of indicator data.

[0028] By using the above methods to monitor the equipment and collect various indicators, an intuitive and dynamic visualization interface can be generated, enabling technicians to more intuitively understand the current trends and abnormal situations of the equipment, thereby making targeted adjustments to improve DDoS attack defense capabilities.

[0029] Secondly, this application provides a DDoS attack mitigation capability assessment device, the device comprising:

[0030] The classification module is used to determine various attack types of DDoS attacks based on the detected DDoS attack data; each attack type has the attack intensity, attack frequency, and attack distribution pattern at the current time.

[0031] The processing module is used to determine N resilience assessment indicators for attack defense under each attack type; where any one of the resilience assessment indicators is used to indicate the device's defense capability when subjected to a DDoS attack, and N is a positive integer greater than or equal to 1.

[0032] The evaluation module is used to construct a judgment matrix based on N resilience evaluation indicators corresponding to each type of attack, and to determine the resilience evaluation score of the device when performing attack defense based on the judgment matrix and the N resilience evaluation indicators; wherein, the resilience evaluation score is used to evaluate the device's mitigation capability when suffering DDoS attacks.

[0033] In one optional implementation, when determining multiple attack types of a DDoS attack based on detected DDoS attack data, the classification module is specifically used for:

[0034] Based on DDoS attack data, the target attack feature set was determined;

[0035] By comparing the target attack feature set with the attack feature set in the preset attack template library, the similarity between each target attack element and each preset attack feature is determined, and multiple attack types of DDoS attacks are determined based on the similarity corresponding to different target attack features.

[0036] In one optional implementation, when constructing a judgment matrix based on N resilience assessment metrics corresponding to each attack type, the assessment module is specifically used for:

[0037] For each type of attack, N resilience assessment indicators are compared in pairs to determine the importance of each resilience assessment indicator.

[0038] A judgment matrix is ​​constructed based on the importance of each resilience assessment indicator.

[0039] In one optional implementation, when determining the resilience score of the device during attack defense based on the judgment matrix and N resilience assessment indicators, the assessment module is specifically used for:

[0040] A consistency check is performed on the judgment matrix. If the consistency check passes, the weight parameters corresponding to each resilience assessment index are determined based on the judgment matrix.

[0041] Based on each resilience assessment index and its corresponding weight parameters, the resilience assessment score of the device is determined when performing attack defense.

[0042] In one optional implementation, the N resilience assessment metrics include at least: mitigation efficiency, recovery time, stability index, network resource parameters, system resource parameters, and device type information;

[0043] Among them, mitigation efficiency indicates the proportion of attack data that is successfully filtered for each type of attack; recovery time indicates the speed at which a device recovers to normal after suffering a DDoS attack; stability index indicates the performance fluctuation of a device when suffering a DDoS attack; network resource parameters indicate the usage of network resources; system resource parameters indicate the usage of system resources of the device; and device type information is used to determine the degree of impact of a DDoS attack on the device.

[0044] In an optional implementation, a visualization module is further included, the visualization module being used for:

[0045] Receive the obtained set of indicator data; wherein, the set of indicator data includes at least the attack data corresponding to each attack type, the resilience assessment index corresponding to each attack type, and the resilience assessment score corresponding to the device;

[0046] The obtained set of indicator data is added to a preset visualization report template to generate the corresponding visualization report and display the visualization report; wherein, the visualization report template includes at least one display format for the set of indicator data.

[0047] Thirdly, this application provides an electronic device including a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the DDoS attack mitigation capability assessment method described in the first aspect.

[0048] Fourthly, this application provides a computer-readable storage medium including program code that, when executed on an electronic device, causes the electronic device to perform the steps of the DDoS attack mitigation capability assessment method described in the first aspect.

[0049] Fifthly, this application provides a computer program product that, when invoked by a computer, causes the computer to execute the steps of the DDoS attack mitigation capability assessment method as described in the first aspect.

[0050] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0052] Figure 1 A schematic diagram of a suitable system architecture is provided for an embodiment of this application;

[0053] Figure 2 A schematic diagram illustrating the implementation process of a DDoS attack mitigation capability assessment method provided in this application embodiment;

[0054] Figure 3 A logical diagram of an analytic hierarchy process provided for an embodiment of this application;

[0055] Figure 4 A schematic diagram of a DDoS attack mitigation capability assessment device provided in this application embodiment;

[0056] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0058] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0059] Furthermore, the data collection, dissemination, and use in the technical solution of this application all comply with the requirements of relevant national laws and regulations.

[0060] The design concept of the embodiments of this application is briefly introduced below:

[0061] DDoS attacks refer to attacks that use a large number of computers and IoT devices to send a massive number of requests to a target website, thereby exhausting its server resources and preventing users from accessing the service. As users become increasingly concerned about cybersecurity, DDoS attacks have become a major focus. To combat new types of DDoS attacks, various defense methods have emerged. Studying DDoS attack defense methods can help avoid or reduce the losses caused by DDoS attacks.

[0062] While various DDoS attack defense methods can effectively defend against DDoS attacks to a large extent, some powerful DDoS attacks can inevitably breach defenses and cause losses to users. Therefore, for unavoidable DDoS attacks, a system resilience assessment can be performed to allow for adjustments to defense methods in response to different DDoS attacks.

[0063] In related technologies, DDoS attacks are often highly dynamic and variable, with different attack methods exhibiting varying attack effects and the target's mitigation capabilities. However, when conducting resilience assessments, a fixed strategy is typically used for DDoS attacks; that is, DDoS attacks are not categorized, and the same resilience assessment method is applied to all attacks. This fails to consider the diversity of different types of DDoS attacks and the impact of various influencing factors on resilience assessments, resulting in assessment results that do not accurately reflect the true performance of devices when subjected to different types of DDoS attacks.

[0064] In view of this, this application provides a method for assessing DDoS attack mitigation capabilities. The method includes: first, identifying multiple attack types of DDoS attacks based on detected DDoS attack data; then, determining N resilience assessment indicators for attack defense under each attack type; wherein any one resilience assessment indicator is used to indicate the device's defense capability when subjected to a DDoS attack, and N is a positive integer greater than or equal to 1; finally, constructing a judgment matrix based on the N resilience assessment indicators corresponding to each attack type, and determining the device's corresponding resilience assessment score based on the judgment matrix and the N resilience assessment indicators; wherein the resilience assessment score is used to assess the device's mitigation capability when subjected to a DDoS attack. By differentiating attack types and assessing mitigation capabilities from different dimensions for different attack types, this method comprehensively reflects the overall resilience level of the device when facing different types of DDoS attacks, improving the accuracy of resilience assessment.

[0065] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0066] See Figure 1 The diagram shown illustrates a system architecture according to an embodiment of this application. This system architecture includes a target terminal 101 and a server 102. The target terminal 101 and the server 102 can interact via a communication network. The communication network can employ wireless communication or wired communication methods.

[0067] For example, the target terminal 101 can access the network and communicate with the server 102 through cellular mobile communication technology, wherein the cellular mobile communication technology includes, for example, 5th generation mobile networks (5G) technology.

[0068] Optionally, the target terminal 101 can access the network and communicate with the server 102 via short-range wireless communication, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.

[0069] This application embodiment does not impose any limitation on the number of communication devices involved in the above system architecture. For example, there may be more target terminals, or no target terminals, or other network devices may be included, such as... Figure 1 As shown, only the target terminal 101 and server 102 are described as examples. The following is a brief introduction to each of the above devices and their respective functions.

[0070] The target terminal 101 is a device that can provide voice and / or data connectivity to a user, and may be a device that supports limited and / or wireless connectivity.

[0071] For example, the target terminal 101 includes, but is not limited to: mobile phones, tablets, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in autonomous driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.

[0072] Furthermore, the target terminal 101 may have a related client installed, and this client may be software, such as an application (APP), browser, short video software, etc., or it may be a network element, mini-program, etc. In this embodiment, the target terminal 101 may use the aforementioned client related to DDoS attack mitigation capability assessment to send the obtained valid card information corresponding to the user's existing credit card to the server 102 for subsequent DDoS attack mitigation capability assessment methods.

[0073] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0074] It is worth noting that, in the embodiments of this application, the methods in these embodiments can be executed by an electronic device, which can be the target terminal 101 or the server 102. That is, the method can be executed by the terminal device 101 or the server 102 alone, or by the target terminal device 101 and the server 102 together. Furthermore, the executing entities for each method can be the same or different, and this embodiment of the application does not impose any restrictions on this.

[0075] For example, when the target terminal 101 executes the DDoS attack mitigation capability assessment method provided in this application alone, the target terminal 101 can directly determine the various attack types of the DDoS attack based on the detected DDoS attack data; then, for different attack types, it determines N resilience assessment indicators for attack defense under each attack type; wherein, any one of the resilience assessment indicators is used to indicate the device's defense capability when subjected to a DDoS attack, and N is a positive integer greater than or equal to 1; finally, a judgment matrix is ​​constructed based on the N resilience assessment indicators corresponding to each attack type, and the resilience assessment score corresponding to the device when performing attack defense is determined based on the judgment matrix and the N resilience assessment indicators; wherein, the resilience assessment score is used to assess the device's mitigation capability when subjected to a DDoS attack.

[0076] For example, when the target terminal 101 and server 102 jointly execute the DDoS attack mitigation capability assessment method of this application, the target terminal 101 can collect DDoS attack data in real time and send the DDoS attack data to the server 102. The server 102 can then determine various attack types of DDoS attacks based on the acquired DDoS attack data. Then, for different attack types, N resilience assessment indicators are determined for each attack type to perform attack defense. Each resilience assessment indicator is used to indicate the device's defense capability when subjected to a DDoS attack, and N is a positive integer greater than or equal to 1. Finally, a judgment matrix is ​​constructed based on the N resilience assessment indicators corresponding to each attack type, and the resilience assessment score of the device when performing attack defense is determined based on the judgment matrix and the N resilience assessment indicators. The resilience assessment score is used to assess the device's mitigation capability when subjected to a DDoS attack.

[0077] The method for assessing DDoS attack mitigation capabilities provided by exemplary embodiments of this application will now be described with reference to the accompanying drawings.

[0078] See Figure 2 The diagram shown illustrates the implementation flow of a DDoS attack mitigation capability assessment method provided in this application embodiment. The specific implementation flow of this method is as follows:

[0079] S1: Based on the detected DDoS attack data, identify various types of DDoS attacks.

[0080] To avoid the problem in related technologies where, when assessing the mitigation capabilities of a device under a DDoS attack, the attack type is not differentiated, and all DDoS attacks are treated uniformly for assessment, resulting in overly general mitigation capability evaluations that fail to reflect the differences between different attack types, this application's embodiment first distinguishes the attack type when a DDoS attack is detected. This identifies multiple attack types, allowing for a more comprehensive assessment of the device's mitigation capabilities based on different attack types and dimensions.

[0081] Specifically, when classifying DDoS attacks, the first step is to collect device traffic using traffic mirroring technologies such as port mirroring and remote mirroring. During traffic mirroring, traffic data including request rate, number of connections, and packet size can be collected. Based on this collected traffic data, attack elements such as attack intensity, frequency, and distribution of DDoS attack data at the current time can be recorded. Furthermore, attack characteristics such as protocol type, attack payload, and flag bits for each attack type at the current point in time can be obtained from the traffic data.

[0082] Furthermore, various DDoS attack types are identified based on the detected DDoS attack data. In this embodiment, when DDoS attack data is detected, attack characteristics such as the protocol type, attack payload, and flag bits of the DDoS attack data can be used as a target attack feature set. The DDoS attack data is then analyzed based on this target attack feature set to determine various DDoS attack types.

[0083] Optionally, when classifying DDoS attacks, each target attack feature in the target attack feature set can be compared with the attack feature set in the preset attack template library to determine the similarity between each target attack feature corresponding to the DDoS attack and each preset attack feature in the preset attack feature set. Then, based on the similarity corresponding to different target attack features, multiple attack types of DDoS attacks can be determined. In this case, each target attack feature in the target attack feature set can be converted into feature data that can characterize its essence, and then the feature data corresponding to each target attack feature can be compared with the attack feature set in the preset attack template library. For example, methods such as cosine similarity and Euclidean distance can be used to compare the feature data corresponding to each attack element with each attack feature in the attack feature set to determine the similarity between each attack element and different attack features. When each attack element meets a similarity condition with one of the attack features (e.g., similarity greater than 95%), the attack type corresponding to that attack element is determined. In this way, all attack elements can be compared with the attack feature set to determine the multiple attack types mixed in the current DDoS attack.

[0084] For example, if the current target attack feature set includes target attack feature 1, target attack feature 2 and target attack feature 3, then the similarity between target attack feature 1, target attack feature 2 and target attack feature 3 and each preset attack feature in the attack feature set is determined, thereby determining the attack type corresponding to target attack feature 1, target attack feature 2 and target attack feature 3 respectively.

[0085] In this embodiment, the system can also embed protocol stack template libraries such as ICMP / TCP / UDP / HTTP / DNS to enable custom detection of different attack variants (e.g., SYN Flood, ACK reflection attacks, HTTP slow attacks, etc.). For example, when implementing SYN Flood detection, a protocol parsing interface can be maintained, with a corresponding parser for each protocol, capable of IP protocol parsing, transport layer protocol parsing, and application layer protocol parsing. This allows the acquisition of relevant traffic data. By maintaining a hash table to record the number of SYN packets sent by the source IP address within a preset time, if the number of received SYN packets exceeds a preset threshold, it is determined to be a SYN Flood attack. By embedding multiple protocol stack templates, accurate classification of different DDoS attack variants can be achieved.

[0086] The above method can detect the attack characteristics of DDoS attacks in real time, and classify the attacks according to the attack characteristics. It can then identify the different types of DDoS attacks that the device suffers at the same time, so that the device can be evaluated from different dimensions and the mitigation capabilities of the device when it suffers different types of DDoS attacks at the same time can be comprehensively determined.

[0087] S2: For different attack types, determine N resilience assessment indicators for attack defense under each attack type.

[0088] In this application embodiment, different types of DDoS attacks exhibit different attack characteristics. Based on these characteristics, different attack types can be categorized into resource-consuming, network bandwidth-consuming, and vulnerability-exploiting attacks. For example, a SYN Flood sends a large number of SYN request packets to the target host without completing the full TCP three-way handshake. This forces the target host to allocate resources for each request while waiting for a response. When a large number of half-open connection requests accumulate, the target host's connection resources are exhausted, preventing normal connection requests from being processed. Therefore, defenses against SYN Floods typically focus on reducing invalid connection usage and quickly releasing resources. Another example is a DNS amplification attack, which sends a large number of query requests to a DNS server by forging the source IP address of the target host. Upon receiving these requests, the DNS server sends a large number of response packets to the forged target IP address. The traffic of these DNS response packets is far greater than that of the request packets, thus amplifying the traffic to the target host. Defenses against DNS amplification attacks typically focus on increasing link bandwidth to withstand larger-scale attack traffic or restricting DNS resolution to only respond to queries from trusted sources.

[0089] Obviously, different types of DDoS attacks exhibit different attack characteristics. Therefore, the response methods used to deal with different types of DDoS attacks are also different. Consequently, it is understandable that due to the different response methods used to deal with different types of DDoS attacks, there will be differences in resource consumption and defense effectiveness during the response process.

[0090] Therefore, in the embodiments of this application, resilience evaluation indicators for defending against different types of DDoS attacks can be evaluated from different dimensions.

[0091] It should be noted that in this embodiment, each attack type corresponds to N resilience assessment indicators. Any one of these resilience assessment indicators is used to indicate the device's defense capability against that type of DDoS attack, or its ability to maintain normal operation, quickly recover, and adapt to changes when subjected to that type of DDoS attack. N is a positive integer greater than or equal to 1. For example, N can be 6, 7, or 8. Different resilience assessment indicators can be set according to the application scenario and actual needs. This embodiment does not impose specific limitations on the number and type of resilience assessment indicators.

[0092] In one optional implementation, the N resilience assessment indicators used in this application embodiment include at least: mitigation efficiency, recovery time, stability index, network resource parameters, system resource parameters, and device type information. The above are merely optional resilience assessment indicators provided by this application embodiment; other resilience assessment indicators can be set according to actual application scenarios and needs.

[0093] Among them, mitigation efficiency indicates the proportion of attack data successfully filtered for each type of attack; recovery time indicates the speed at which a device recovers to normal after suffering a DDoS attack; stability index indicates the performance fluctuation of a device when suffering a DDoS attack; network resource parameters indicate network resource usage; system resource parameters indicate the device's system resource usage; and device type information is used to determine the extent to which a device is affected by a DDoS attack.

[0094] When facing a mixed attack involving multiple attack types, the mitigation efficiency can be calculated individually for each attack type. A weighted average can then be used to calculate the overall mitigation efficiency when facing a mixed attack involving multiple attack types. The specific expression for calculating the overall mitigation efficiency is as follows:

[0095]

[0096] in, This represents the weight corresponding to the i-th attack type;

[0097] This represents the mitigation efficiency of the i-th attack type, i.e., the proportion of attack traffic of the i-th attack type that is successfully filtered.

[0098] Recovery time indicates the speed at which a device recovers to normal operation after a DDoS attack. When attack traffic reaches a preset threshold, load balancing or automatic bandwidth increases will be triggered to reduce recovery time. The specific expression for calculating recovery time is as follows:

[0099]

[0100] in, Indicates the start time of the attack;

[0101] Indicates the time it takes for the equipment to return to normal operation;

[0102] This indicates the CPU resources dynamically allocated by the device during the recovery process;

[0103] This indicates the memory resources dynamically allocated by the device during the recovery process.

[0104] Furthermore, the stability index is used to indicate the performance fluctuation of a device when subjected to a DDoS attack. Generally speaking, as the attack intensity increases, the stability of the device may decrease non-linearly. Therefore, considering the non-linear relationship between attack intensity and device performance, the calculation expression of the stability index in this embodiment is as follows:

[0105]

[0106] in, Indicates the current attack traffic intensity;

[0107] Indicates the device's flow capacity threshold;

[0108] This represents an adjustment factor used to adjust the impact of attack traffic on system stability.

[0109] This indicates the device's state before it was attacked;

[0110] This indicates the device's state before the attack ended.

[0111] Network resource parameters can be obtained through API interfaces, such as bandwidth utilization, packet loss rate, and latency. System resource parameters can also be obtained through API interfaces, such as CPU, memory, and disk I / O usage. Furthermore, proactive scanning can be used to probe device-related information, such as detailed configuration information and operating status, to determine the extent of the impact of a DDoS attack on a device.

[0112] Using the above method, N resilience assessment indicators corresponding to each attack type can be obtained. Then, based on the N resilience assessment indicators corresponding to each attack type, the overall mitigation capability of the device can be assessed. Starting from multi-dimensional attack types and multi-dimensional resilience assessment indicators, the accuracy of the assessment of the device's mitigation capability when suffering DDoS attacks is improved, and the device's defense capability can be reflected from multiple dimensions.

[0113] S3: Construct a judgment matrix based on the resilience assessment index corresponding to each type of attack, and determine the resilience assessment score of the device when performing attack defense based on the judgment matrix and N resilience assessment indexes.

[0114] In this embodiment, the Analytic Hierarchy Process (AHP) is used to comprehensively evaluate the mitigation capabilities of the device. See also... Figure 3 As shown, the AHP (Analytic Hierarchy Process) includes a target layer, a criterion layer, and an evaluation layer. The target layer contains the objective for assessing the mitigation capabilities of the device. The criterion layer includes N resilience assessment indicators, namely the aforementioned mitigation efficiency, recovery time, stability index, network resource parameters, system resource parameters, and device type information. The evaluation layer identifies indicators based on a fixed time window. Real-time resilience assessment scores at each time point.

[0115] In this embodiment, for each type of attack, N resilience assessment indicators are used. A 1-9 scale is employed to compare every two resilience assessment indicators, thereby determining the importance of each indicator. When assessing the importance of each resilience assessment indicator, based on the different attack methods and effects of each attack type, expert experience is used to evaluate the relative importance of the resilience assessment indicators under different attack types in real time. An importance score of 1 indicates that the two resilience assessment indicators are equally important; an importance score of 9 indicates that one resilience assessment indicator is extremely important than the other; and importance scores of 2-8 represent different degrees of relative importance.

[0116] Furthermore, after obtaining the relative importance of each resilience assessment indicator, a judgment matrix can be constructed based on the relative importance of each indicator. This judgment matrix is ​​established by comparing the relative importance of each pair of resilience assessment indicators and is used to subsequently calculate the weight of each resilience assessment indicator.

[0117] After constructing the judgment matrix, a consistency check needs to be performed on it. Specifically, the consistency ratio CR is calculated based on the judgment matrix. The consistency ratio CR is calculated using the following expression:

[0118]

[0119] CI stands for Consistency Index, which measures the degree to which the judgment matrix deviates from consistency.

[0120] RI stands for Random Consistency Index, which represents the average consistency index of random judgment matrices of the same order. It is obtained by looking up a table, and the RI values ​​corresponding to matrices of different orders are different.

[0121] Furthermore, CI can be calculated using the following expression:

[0122]

[0123] in, This represents the largest eigenvalue in the judgment matrix;

[0124] N represents the order of the matrix.

[0125] Using the above method, the consistency ratio CR is calculated to perform a consistency check on the judgment matrix. When CR is less than a preset threshold, such as CR being less than 0.1, the consistency check of the judgment matrix is ​​considered to have passed.

[0126] Then, based on this judgment matrix, the weight parameters corresponding to each resilience assessment index under different attack types are determined. Specifically, the weight parameters corresponding to each resilience assessment index are calculated using the geometric mean method based on this judgment matrix. These weight parameters can be calculated using the following expression:

[0127]

[0128] in, This indicates the product of the elements in each row of the judgment matrix.

[0129] It should be noted that this weighting parameter can be used as the weighting parameter for each resilience assessment indicator, or as the weighting parameter for calculating mitigation efficiency. This weighting parameter can accurately quantify the relative relationship between different resilience assessment indicators, reflecting the different levels of importance of different resilience assessment indicators in participating in the mitigation capacity assessment.

[0130] Furthermore, after obtaining the weight parameters corresponding to each resilience index, the resilience assessment score of the device during attack defense can be determined based on each resilience assessment index and its corresponding weight parameters. This resilience assessment score can be calculated using the following expression:

[0131]

[0132] in, This represents the weight parameter corresponding to the i-th resilience assessment index;

[0133] This represents the i-th resilience assessment index.

[0134] Using the above method, we can accurately obtain the comprehensive resilience assessment score of the device when it suffers from various types of DDoS attacks. This resilience assessment score can be used to evaluate the device's ability to mitigate various types of DDoS attacks.

[0135] After obtaining the resilience assessment score of the device during attack defense, the mitigation capability level corresponding to the current resilience assessment score can be determined based on the mapping relationship between the resilience assessment score and mitigation capability. The mitigation capability level directly reflects the device's ability to mitigate various types of DDoS attacks in its current state.

[0136] Based on the resilience assessment score, the mitigation capability level corresponding to the current resilience assessment score can be determined according to the resilience assessment score range and the mitigation capability level. For example, see Table 1:

[0137] Table 1

[0138]

[0139] As shown in the table above, the corresponding mitigation capability level can be determined based on the resilience assessment score range to which different resilience assessment scores belong. For example, if the current resilience assessment score is 55, it falls within the range of 41-60, and therefore the corresponding mitigation capability level is level three. It should be noted that a higher mitigation capability level indicates better resilience against various types of DDoS attacks and an easier recovery to normal operation.

[0140] Furthermore, the system can also receive a set of indicator data. In this embodiment, the set of indicator data includes at least attack data (i.e., attack elements, including attack intensity, attack frequency, and attack distribution pattern of each attack type at the current time point), resilience assessment indicators, resilience assessment scores of devices, network resource parameters, system resource parameters, etc., corresponding to each attack type.

[0141] Then, the obtained set of indicator data is added to the data information population field of the preset visualization report display template to generate the corresponding visualization report and display the visualization report.

[0142] It should be noted that the visualization report template includes at least one display format for a set of indicator data. For example, it can use pre-defined tables, 2D charts, 3D charts, including bar charts, line charts, pie charts, scatter plots, etc. Users can also customize the colors and styles of the visualization reports, and adjust their size and position.

[0143] Obviously, using visual reports to display indicator data can intuitively show the dynamic situation of a device when it is under DDoS attack. Transforming the indicator dataset into easy-to-understand charts and / or images makes it easier for users to view the current data status more intuitively.

[0144] Furthermore, based on the same technical concept, embodiments of this application provide a DDoS attack mitigation capability assessment device, which is used to implement the above-described method flow of embodiments of this application. See also... Figure 4 As shown, the device includes: a classification module 401, a processing module 402, and an evaluation module 403, wherein,

[0145] The classification module 401 is used to determine multiple attack types of DDoS attacks based on the detected DDoS attack data; wherein each attack type has the attack intensity, attack frequency and attack distribution pattern at the current time.

[0146] The processing module 402 is used to determine N resilience assessment indicators for attack defense under each attack type, for different attack types; wherein, any one of the resilience assessment indicators is used to indicate the device's defense capability when subjected to DDoS attack, and N is a positive integer greater than or equal to 1.

[0147] The evaluation module 403 is used to construct a judgment matrix based on N resilience evaluation indicators corresponding to each type of attack, and to determine the resilience evaluation score of the device when performing attack defense based on the judgment matrix and the N resilience evaluation indicators; wherein, the resilience evaluation score is used to evaluate the device's mitigation capability when suffering DDoS attacks.

[0148] In an optional implementation, when determining multiple attack types of a DDoS attack based on detected DDoS attack data, the classification module 401 is specifically used for:

[0149] Based on DDoS attack data, a set of attack elements was identified;

[0150] By comparing the target attack feature set with the attack feature set in the preset attack template library, the similarity between each target attack feature and each preset attack feature is determined, and multiple attack types of DDoS attacks are determined based on the similarity corresponding to different target attack features.

[0151] In one optional implementation, when constructing a judgment matrix based on N resilience assessment metrics corresponding to each attack type, the assessment module 403 is specifically used for:

[0152] For each type of attack, N resilience assessment indicators are compared in pairs to determine the importance of each resilience assessment indicator.

[0153] A judgment matrix is ​​constructed based on the importance of each resilience assessment indicator.

[0154] In one optional implementation, when determining the resilience score of the device during attack defense based on the judgment matrix and N resilience assessment indicators, the assessment module 403 is specifically used for:

[0155] A consistency check is performed on the judgment matrix. If the consistency check passes, the weight parameters corresponding to each resilience assessment index are determined based on the judgment matrix.

[0156] Based on each resilience assessment index and its corresponding weight parameters, the resilience assessment score of the device is determined when performing attack defense.

[0157] In one optional implementation, the N resilience assessment metrics include at least: mitigation efficiency, recovery time, stability index, network resource parameters, system resource parameters, and device type information;

[0158] Among them, mitigation efficiency indicates the proportion of attack data that is successfully filtered for each type of attack; recovery time indicates the speed at which a device recovers to normal after suffering a DDoS attack; stability index indicates the performance fluctuation of a device when suffering a DDoS attack; network resource parameters indicate the usage of network resources; system resource parameters indicate the usage of system resources of the device; and device type information is used to determine the degree of impact of a DDoS attack on the device.

[0159] In an optional implementation, a visualization module 404 is further included, the visualization module 404 being used for:

[0160] Receive the obtained set of indicator data; wherein, the set of indicator data includes at least the attack data corresponding to each attack type, the resilience assessment index corresponding to each attack type, and the resilience assessment score corresponding to the device;

[0161] The obtained set of indicator data is added to a preset visualization report template to generate the corresponding visualization report and display the visualization report; wherein, the visualization report template includes at least one display format for the set of indicator data.

[0162] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the DDoS attack mitigation capability assessment method provided in the above embodiments of this application. In one embodiment, the electronic device may be a server, a terminal device, or other electronic equipment. See also... Figure 5 As shown, the electronic device may include:

[0163] At least one processor 501 and a memory 502 connected to at least one processor 501. In this embodiment, the specific connection medium between the processor 501 and the memory 502 is not limited. Figure 5 The example shown is the connection between processor 501 and memory 502 via bus 500. Bus 500 is... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 500 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 5 The term 501 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller; there is no restriction on the name.

[0164] In this embodiment, the memory 502 stores instructions executable by at least one processor 501. By executing the instructions stored in the memory 502, the at least one processor 501 can execute a DDoS attack mitigation capability assessment method discussed above. The processor 501 can implement... Figure 4 The functions of each module in the device shown.

[0165] The processor 501 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 502 and calling data stored in memory 502, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0166] In one possible design, processor 501 may include one or more processing units. Processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 501. In some embodiments, processor 501 and memory 502 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0167] Processor 501 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the DDoS attack mitigation capability assessment method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0168] Memory 502, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 502 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 502 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. Memory 302 in the embodiments of this application may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0169] By designing and programming the processor 501, the code corresponding to the DDoS attack mitigation capability assessment method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute it during operation. Figure 2 The illustrated embodiment presents the steps of a DDoS attack mitigation capability assessment method. How to design and program the processor 501 is a technique well-known to those skilled in the art and will not be described further here.

[0170] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a DDoS attack mitigation capability assessment method described above.

[0171] In some possible implementations, this application also provides a DDoS attack mitigation capability assessment method that can also be implemented as a program product including program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in a DDoS attack mitigation capability assessment method according to various exemplary embodiments of this application as described above.

[0172] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0173] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0174] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0175] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable DDoS attack mitigation capability assessment device to produce a server, such that the instructions, which execute via the processor of the computer or other programmable DDoS attack mitigation capability assessment device, generate instructions for implementing the process... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0176] Program code for performing the operations of this application can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0177] These computer program instructions can also be loaded onto a computer or other programmable DDoS attack mitigation capability assessment device, causing a series of operational steps to be executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0178] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for evaluating DDoS attack mitigation capabilities, characterized in that, The method includes: Based on the detected DDoS attack data, multiple attack types of the DDoS attack are determined; each attack type has the attack intensity, attack frequency, and attack distribution pattern at the current time. For different attack types, N resilience assessment indicators are determined for attack defense under each attack type; wherein any one of the resilience assessment indicators is used to indicate the device's defense capability when subjected to DDoS attack, and N is a positive integer greater than or equal to 1. A judgment matrix is ​​constructed based on N resilience assessment indicators corresponding to each attack type. A resilience assessment score is then determined based on the judgment matrix and the N resilience assessment indicators to determine the device's resilience score when defending against each attack type. The judgment matrix is ​​constructed based on the importance of each of the N resilience assessment indicators for each attack type. This importance is determined by real-time evaluation of the relative importance of the resilience assessment indicators under different attack types, based on the different attack methods and effects of each attack type, using expert experience. The resilience assessment score is used to evaluate the device's mitigation capability when subjected to DDoS attacks.

2. The method as described in claim 1, characterized in that, The detected DDoS attack data identifies multiple attack types of the DDoS attack, including: Based on the DDoS attack data, the target attack feature set was determined; Based on the comparison between the target attack feature set and the attack feature set in the preset attack template library, the similarity between each target attack feature and each preset attack feature is determined, and the various attack types of the DDoS attack are determined according to the similarity corresponding to different target attack features.

3. The method as described in claim 1, characterized in that, The judgment matrix is ​​constructed based on N resilience assessment indicators corresponding to each attack type, including: For each type of attack, N resilience assessment indicators are compared in pairs to determine the importance of each resilience assessment indicator. The judgment matrix is ​​constructed based on the importance of each resilience assessment index.

4. The method as described in claim 1 or 3, characterized in that, The determination of the resilience score of the device during attack defense based on the judgment matrix and the N resilience assessment indicators includes: A consistency check is performed on the judgment matrix. If the consistency check passes, the weight parameters corresponding to each resilience assessment index are determined based on the judgment matrix. Based on each resilience assessment index and the corresponding weight parameter, the resilience assessment score of the device when performing attack defense is determined.

5. The method as described in claim 1, characterized in that, The N resilience assessment indicators include at least: mitigation efficiency, recovery time, stability index, network resource parameters, system resource parameters, and device type information; The mitigation efficiency is used to indicate the proportion of attack data that is successfully filtered for each type of attack; the recovery time is used to indicate the recovery speed of the device after suffering a DDoS attack; the stability index is used to indicate the performance fluctuation of the device when suffering a DDoS attack; the network resource parameters are used to indicate the network resource usage; the system resource parameters are used to indicate the system resource usage of the device; and the device type information is used to determine the degree of impact of the device suffering a DDoS attack.

6. The method as described in claim 1, characterized in that, The method further includes: Receive the obtained set of indicator data; wherein, the set of indicator data includes at least the attack data corresponding to each attack type, the resilience assessment index corresponding to each attack type, and the resilience assessment score corresponding to the device; The obtained set of indicator data is added to a preset visualization report template to generate a corresponding visualization report and to display the visualization report; wherein, the visualization report template includes at least one display format for the set of indicator data.

7. A DDoS attack mitigation capability assessment device, characterized in that, The device includes: The classification module is used to determine multiple attack types of the DDoS attack based on the detected DDoS attack data; wherein each attack type has the attack intensity, attack frequency and attack distribution pattern at the current time; The processing module is used to determine N resilience assessment indicators for attack defense under each attack type, for different attack types; wherein any one of the resilience assessment indicators is used to indicate the device's defense capability when subjected to DDoS attack, and N is a positive integer greater than or equal to 1. The evaluation module is used to construct a judgment matrix for each attack type based on N resilience evaluation indicators corresponding to each attack type, and to determine the resilience evaluation score of the device when defending against each attack type based on the judgment matrix and the N resilience evaluation indicators. The judgment matrix is ​​constructed based on the importance of each of the N resilience evaluation indicators corresponding to each attack type. The importance is obtained by real-time evaluation of the relative importance of the resilience evaluation indicators under different attack types based on the different attack methods and effects of each attack type, using expert experience. The resilience evaluation score is used to evaluate the device's mitigation capability when suffering a DDoS attack.

8. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of claims 1-6.

Images