DDoS attack prediction method of space-time joint model

Abstract

The invention discloses a DDoS (Distributed Denial of Service) attack prediction method of a spatio-temporal joint model, and relates to a graph convolutional network and a long and short-term memory network in the field of deep learning and a DDoS attack prediction and traceability technology in the field of network security. The method comprises two parts of network topological graph data set construction and model construction: in the network topological graph data set construction part, a scheme for constructing node features by using edge features is provided, the features of the data set are enriched, and a topological graph data set with the edges and nodes both comprising the features is constructed; in a prediction model building part, a spatio-temporal joint architecture of a double-branch graph convolutional network model and a long-short-term memory network is provided, feature aggregation updating by using network topology structure information and traffic time sequence information of communication traffic data is supported, and an attack mode hidden in a communication flow is more effectively mined. According to the DDoS attack prediction method, the identification accuracy of the subdivision type of the DDoS attack can be improved, and the DDoS attack behavior can be predicted and inferred more effectively.

Description

Technical Field

[0001] This invention relates to graph neural networks and long short-term memory networks in the field of deep learning technology, as well as DDoS attack prediction and tracing technology in the field of network security. It is a spatiotemporal joint model for DDoS attack prediction. Background Technology

[0002] With the rapid development of global digital information technology, the iterative updates of network communication technologies, while bringing convenience, have also made network security issues, represented by distributed denial-of-service (DDoS) attacks, increasingly prominent. Establishing effective prediction and attribution mechanisms can significantly reduce the damage of DDoS attacks to network systems and improve the overall level of security protection.

[0003] However, existing research on DDoS attack prediction, both domestically and internationally, still has the following shortcomings and deficiencies: 1. Neglecting the inherent topology and relational information of the network Most existing methods, whether classical machine learning based on statistical features or end-to-end methods based on deep learning, treat network traffic data as independent and identically distributed data points or isolated time series. This approach fails to fully model and utilize the graph structure information formed by the inherent connections and dynamic interactions between network communication entities (such as hosts, routers, and servers). A network is essentially a dynamic graph upon which attacks propagate, and existing research severely underutilizes prior knowledge of this structure, limiting the model's ability to understand attack propagation paths and global impact.

[0004] 2. Limitations in the model's adaptability to complex, dynamic network environments Classical machine learning approaches heavily rely on manually designed and selected traffic statistics features. While they perform stably in relatively structured scenarios, feature engineering may struggle to keep pace with the complex and ever-evolving attack patterns of real-world networks, limiting the model's generalization and adaptability. Deep learning, on the other hand, can automatically learn features, but current research (such as CNNs) primarily focuses on capturing sequences or local patterns, failing to adequately model the dynamic changes in the network's global state and the implicit dependencies between nodes. Despite the introduction of augmentation techniques like federated learning and XAI, their underlying data representation has not yet broken free from the "non-graph structure" paradigm.

[0005] 3. The isolation of the detection perspective and the lag in defense. Existing methods primarily focus on "point detection" of attacks on individual data streams or traffic sequences. This perspective fails to consider the overall network topology and model attacks as graph processes that propagate and spread across nodes and edges. Consequently, it may be difficult to identify the source of an attack, its propagation path, and potential threats to critical network infrastructure in the early stages, resulting in a relatively delayed defense response and a lack of ability to predict and infer the global impact of attacks.

[0006] Therefore, it is necessary to provide a spatiotemporal joint model for DDoS attack prediction to solve the above-mentioned technical problems. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention aims to propose a spatiotemporal joint model framework for DDoS attack prediction, constructing a theoretical system for DDoS attack prediction and attribution based on a spatiotemporal joint model of Long Short-Term Memory (LSTM) networks and graph neural networks. The scheme utilizes LSTM networks to capture temporal information from traffic data, while simultaneously employing graph neural networks to capture topological information. By fusing the features of spatiotemporal information, it makes inference predictions about abnormal attack traffic. This solves the problems of insufficient accuracy in identifying DDoS attack traffic and the inability to determine attack paths in existing technologies. The entire framework includes the following steps: 1. Graph dataset edge construction and feature engineering Each data entry in the network communication dataset represents a network flow, and its characteristics are mainly divided into four parts: basic flow characteristics (including flow identifier, source IP, destination IP, source port, destination port, protocol type, etc.), traffic statistics characteristics (duration, total number of forward and backward packets, total packet length, etc.), time-related characteristics (time interval between packet arrivals, flow active time, flow idle time, etc.), and labels. In the graph dataset, each unique IP address is treated as a node when constructing edges. Therefore, each network flow from the source IP to the destination IP in the dataset can be treated as a directed communication edge. Since the original edge features are numerous and not all features are correlated with the labels, mutual information theory is used to evaluate and filter the original features. The calculation method is shown in formula (1). The top-20 features with the highest correlation with the labels are determined by calculation and concatenated into a one-dimensional vector as the features of the edge data. .

[0008] 2. Graph Dataset Node Construction and Feature Engineering Network communication datasets lack features directly belonging to nodes, and existing technologies neglect the contribution of node features to abnormal traffic detection. This invention proposes constructing node features using edge node features and raw communication flow data. This transforms nodes in the directed graph data of the network topology from logical nodes used to determine the topology into physical nodes with features and practical significance. The specific features and construction method include in-degree ratio, weighted clustering coefficients, IP entropy, and aggregated statistical values ​​of some edge features (such as average packet length and average latency passing through nodes), ultimately yielding one-dimensional node features. The specific calculation method is as follows: (1) Discrepancy ratio In network topology, the ratio of out-degree to in-degree (2) reflects the communication behavior pattern of nodes. Normal network nodes usually exhibit balanced bidirectional communication, while the roles of nodes in an attack show significant asymmetry: Zombie hosts: initiate a large number of connection requests, with out-degree much higher than in-degree; Reflector amplifiers: have high in-degree (receive requests) and high out-degree (send amplified responses); Attacked hosts: receive a large number of connection requests, with in-degree much higher than out-degree. Therefore, using the out-degree to in-degree ratio as a node feature helps the model identify attackers and victims.

[0009] in Smoothing factor (ii) Weighted clustering coefficient In network topology graphs, the weighted clustering coefficient formula (3) is a key structural feature indicator. It not only measures the existence of connections between neighboring nodes, but more importantly, it incorporates the weight information of connection strength, thus enabling a more refined characterization of network interaction patterns. In DDoS attack detection scenarios, this indicator exhibits distinct attack topology characteristics: for botnets, multiple bot hosts often coordinate attacks on the same target, forming similar triangular attack structures, but due to the lack of direct communication between bots, their weighted clustering coefficients are often low; in reflection attack networks, reflectors are rarely directly connected due to their independent functions, resulting in significantly low clustering coefficients; while in command and control architectures, the control server and controlled bots form a star topology, and if there is auxiliary communication between some bot nodes, a moderate level of clustering coefficient may be generated. These differentiated clustering patterns provide important graph structure basis for identifying different types of DDoS attacks.

[0010] (III) IP Entropy In the graph analysis framework of network intrusion detection, the IP entropy formula (4) is a key traffic distribution characteristic indicator. It not only measures the diversity of node communication IP addresses, but more importantly, it quantifies the concentration and uncertainty of IP distribution, thus more accurately representing the source-target relationship pattern of network interaction. In the DDoS attack detection scenario, this indicator exhibits distinct attack traffic characteristics: for the attacked node, when subjected to a distributed attack, a large number of IPs from different sources initiate connections simultaneously, resulting in a sharp increase in in-degree IP entropy and forming a highly dispersed traffic access pattern; when a botnet performs an attack task, it usually accesses a small number of target IPs in a concentrated manner, and its out-degree IP entropy decreases significantly, exhibiting a highly concentrated traffic output characteristic; in reflection attack networks, reflectors are abused by many attackers, resulting in an abnormally high in-degree IP entropy, while sending responses to victims also exhibits a relatively concentrated out-degree IP entropy. These differentiated entropy distribution patterns provide important traffic distribution basis for identifying attack participants with different roles.

[0011] 3. Design of a Two-Branch Graph Convolutional Network Model Graph Convolutional Networks (GCNs) are deep learning models specifically designed for processing graph-structured data. They effectively model non-Euclidean structured data by locally propagating and aggregating node features across the graph topology. When extracting features from a network topology graph constructed from a communication flow dataset, nodes in the network can represent communication entities such as hosts, switches, and servers, while edges reflect traffic connections or communication relationships between entities. Edge and node features have been determined by the method given in step 2. GCNs aggregate neighbor node features layer by layer through multi-layer convolutional operations and update node and edge representations, thereby capturing local connectivity patterns and global topological dependencies. This capability enables them to identify traffic anomalies, predict network status, detect security threats, or optimize resource allocation, making them particularly suitable for dynamic, complex, and spatially dependent network traffic analysis scenarios.

[0012] Graph data obtained from network communication datasets exhibits significant characteristics: the number of edges is far greater than that of nodes, and edges have higher feature dimensions and carry richer information; while nodes, as relatively static entities, are fewer in number than edges, and their feature dimensions are also lower. Therefore, a bi-branch graph convolutional network model architecture was invented, employing differentiated graph convolution operators for edges and nodes. This strategy is determined by the inherent asymmetry between the two in terms of data structure, feature dimensions, and task roles. Its significance lies in achieving refined modeling of heterogeneous graph elements and optimized allocation of computational resources.

[0013] Edge features are characterized by a rich feature space. Edges act as carriers of dynamic interactions between entities, carrying high-dimensional feature vectors, and their information density is significantly higher than that of node features describing static attributes. Their massive scale, with the number of edges typically growing quadratically with the number of nodes, constitutes the main source of computational complexity in graphs. Traditional graph convolutional layers are node-centric, and the core of learning is node representation. The message passing process involves nodes aggregating information from their neighbors and updating their own feature vectors. In this process, edges exist only as static, binary connections, but they are not themselves rich, learnable feature carriers.

[0014] To address this, a novel graph convolution operator, EAGN (Edge Aggregate Graph Network), is proposed. It shifts the core of learning to edge representation, computing and maintaining a feature vector for each edge. Its message passing no longer focuses solely on nodes. and Instead, it focuses on its adjacent edges and its parallel edges. Specifically, it focuses on the edges related to the node. and Other connected edges, and connecting nodes. and The other edges. Their feature update method is as follows: in It is the edge feature vector. () is the update function, which is usually a learnable neural network (such as an MLP). () is an aggregate function. It is a node The set of adjacent nodes, It is a node Except for nodes The set of all adjacent nodes except those in the set of all other nodes. Indicates connection and The others do not include eigenvectors.

[0015] For node features, the key characteristics are a small feature space. As communication entities (such as hosts, switches, servers, zombie hosts, etc.), the physical attributes of nodes (such as host configuration, network card model, switch model, etc.) are not correlated with DDoS attack tags. Therefore, for nodes, logical attributes of nodes in the topology graph are constructed and calculated using edge features as features (such as in-degree ratio, weighted clustering coefficient, etc.), resulting in a relatively lower feature vector dimension. Furthermore, the number of nodes is small and heterogeneous, with few communication entity nodes in the network topology graph and clear differences between edge nodes and central hub nodes. Based on these characteristics, using traditional multi-layer GCNs can easily lead to convergence of node features due to excessive smoothing, ignoring some implicit information.

[0016] Therefore, GAT (Graph Attention Network) was chosen as the convolution operator for node features when constructing the bi-branch graph convolutional network model. It introduces an attention mechanism into graph structure learning, achieving non-uniform and adaptive weighted aggregation of neighborhood information. It overcomes the limitations of fixed weights or topological priors in traditional graph convolution, dynamically characterizing the differences in relationships between nodes through learnable attention coefficients, enabling the model to automatically focus on key connections based on the task objective. Especially when the node feature dimension is limited, GAT achieves information gain and selective enhancement of low-dimensional features through the adjustment of attention weights, providing a computationally efficient solution for refined modeling of small-scale graphs. The node feature update mechanism is mainly as follows: Feature projection and attention coefficient calculation: for nodes and adjacent nodes Through shared linear transformation Will Features Projected into a new feature space Then calculate the attention coefficient. , This indicates feature splicing.

[0017] Attention weight normalization: The attention coefficients are normalized using the softmax function, where... express The set of neighboring nodes of a node.

[0018] Weighted aggregation and feature update: The normalized attention weights are used for the weighted summation of features of neighboring nodes, and a new node representation is obtained through nonlinear activation.

[0019] To enhance stability and expressive power, GAT typically employs a multi-head attention mechanism, concatenating or averaging the outputs of multiple attention heads to obtain the final node representation. This attention mechanism makes it particularly effective in small- to medium-scale graph learning tasks driven by node features, with uneven relational importance, and insensitive to computational complexity. It is especially suitable for extracting and representing node features from the graph dataset constructed in this scenario.

[0020] 4. Design of a classification predictor based on a long short-term memory model In communication flow data analysis, the time and spatial dimensions are equally crucial. While GCNs can effectively capture the spatial dependencies in network topology, communication flow data is inherently spatiotemporally coupled: the traffic between nodes is not only influenced by the network structure but also exhibits complex dynamic patterns over time, such as periodic fluctuations, sudden anomalies, and trend evolution. LSTM, as a classic variant of recurrent neural networks, is specifically designed to handle long-term dependencies in sequential data. In the context of network flow data analysis, LSTM models can capture temporal dynamics, learn the periodic, trend, and sudden changes in traffic data, and memorize historical traffic states to predict future network behavior.

[0021] Based on the bi-branch graph convolutional network model designed in step 3, separate processing of edge features and node features has been achieved. Now, the features are concatenated and used as input to the LSTM model. , This represents the feature vector extracted and concatenated using the bi-branch graph convolutional model at time t. The specific algorithm design is as follows: Initialize LSTM cells The cell state and hidden state are updated cyclically through the input gate, forget gate, and output gate. Obtain the fused temporal features: Add Dropout layer Fully connected layer transformation Activation function processing Output layer outputs prediction results Attached Figure Description Figure 1 A schematic diagram of the DDoS attack prediction framework of the spatiotemporal joint model provided by this invention patent; Figure 2 The experimental comparison diagram provided for this invention patent is compared with the existing solution. Detailed Implementation

[0022] 1. Dataset Preparation The dataset used to verify the effectiveness of this invention comes from the paper "Dataset - Detecting Distributed Denial of Service Attacks Using Data Mining Techniques". The data collected in this paper can be downloaded from ResearchGate, an academic social networking platform for researchers worldwide. (Link provided). https: / / www.researchgate.net / publication / 292967044_Dataset-_Detecting_Distributed_Denial_of_Service_Attacks_Using_Data_Mining_Techniques This dataset contains more than 2 million labeled traffic records, each with nearly 30 multidimensional features. In addition to normal communication traffic data, there are four types of DDoS abnormal traffic data, including UDP-Flood, Smurf, SIDDOS, and HTTP-FLOOD.

[0023] 2. Dataset Processing The data is read and saved into DataFrame format using the pandas library in Python. After reading, the data is uniformly converted to DataFrame format and cleaned to handle missing values, outliers, and duplicate records, ensuring that the data quality meets the requirements for model training. The source IPs and destination IPs in the dataset are encoded to construct a global IP address set. Each unique IP is assigned a continuous integer identifier, forming an IP-to-Index mapping dictionary. This encoding method converts discrete IP addresses into numerical features that the model can process. The remaining original features are evaluated and filtered using mutual information theory. The calculation method is shown in formula (1). The top-20 features with the highest correlation to the labels are determined by calculation and concatenated into a one-dimensional vector as the features of the side data. .

[0024] Node features are constructed based on the existing edge features. Statistical values ​​(including mean, variance, maximum, minimum, etc.) of various edge features, such as in-degree ratio, weighted clustering coefficient, IP entropy, are calculated to capture the behavioral patterns and feature distributions of nodes in the network. These values ​​are then concatenated into a one-dimensional vector as the feature data of the nodes. For detailed calculation methods, please refer to formulas (2), (3), and (4).

[0025] 3. Construction of a dual-branch graph convolutional network model The convolution operator for edge features is a novel graph convolution operator EAGN (EdgeAggregate Graph Network) proposed in this invention. An EAGN class is built using the definition of convolution operation layer classes in the PyTorch library. For details on message passing and feature update implementation, please refer to formula (5).

[0026] The convolution operator for node features is the GATConv operator defined and implemented in the torch_geometric library. It can be called after the torch_geometric library is installed in the Python interpreter environment. Its message passing and feature update methods are shown in formulas (6) and (7).

[0027] The dual-branch graph convolutional network model was successfully built for collaborative representation learning. GATConv focuses on node-level feature learning, while EAGN specifically handles edge features. The final output features are then concatenated.

[0028] 4. Building a classification predictor based on the Long Short-Term Memory model The edge node fusion features extracted by the graph convolutional network are reorganized into sequential data along the time dimension. Through a two-layer cascaded LSTM structure, feature extraction of dynamic change patterns in network traffic is achieved: the collaborative working mechanism of the input gate, forget gate, and output gate enables the model to selectively memorize long-term dependencies and filter noise information; the bidirectional LSTM architecture further enhances the temporal representation capability, with forward propagation capturing historical dependency patterns and backpropagation learning future context information.

[0029] The specific implementation involves calling an LSTM layer defined in the PyTorch library. The features obtained after concatenating edges and nodes are processed by the LSTM layer to obtain fused temporal features, which are then input into a fully connected layer. After transformation by the fully connected layer, the final prediction of the edge label is output through an activation function. The final comparison and verification results are shown in the appendix of the specification. Figure 2 As shown.

[0030] The above description is merely an embodiment of the present invention and does not limit the scope of the present invention patent. Any equivalent structural or procedural transformations made using the content of the present invention patent specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of protection of the present invention patent.

Claims

1. A spatiotemporal joint model for predicting DDoS attacks, the specific design of which includes: This paper presents a method for constructing topology graphs based on network communication datasets, the design of a two-branch graph neural network model, and the design of a classification predictor based on a long short-term memory model.

2. The method for constructing topology graph data based on network communication datasets according to claim 1, specifically designed for edge construction and feature engineering of the graph dataset, is as follows. Each data entry in the network communication dataset represents a network flow, and its features are mainly divided into four parts: basic flow features, traffic statistics features, time-related features, and labels. When constructing edges in the graph dataset, each unique IP address is treated as a node, thus each network flow from the source IP to the destination IP in the dataset can be treated as a directed communication edge. Since the number of original edge features is large, and not all features are correlated with the labels, mutual information theory is used to evaluate and filter the original features, retaining the 20 features with the highest correlation to the labels as edge features. The main process includes: a) The input is a network communication dataset Each data item Includes source IP and destination IP characteristics; b) Construct a directed graph in: For a set of nodes, each node A communication entity in the corresponding network has a unique IP address (such as a host, switch, server, etc.). This is a set of directed edges, representing the communication relationships between nodes; c) For any two nodes If in network communication dataset There exists from arrive For data packet transmission, a directed edge is defined. The eigenvectors of the directed edge are used express; d) For the original feature vector Each feature Tag of this communication stream data The correlation is calculated using formula (1) of mutual information theory, and the 20 features with the highest correlation are retained as edge features. .

3. The method for constructing topology graph data based on network communication datasets according to claim 1, specifically the design of node construction and feature engineering for the graph dataset is as follows. Since there are no features directly belonging to nodes in the network communication dataset, this paper proposes to construct node features using the features of edge nodes and the original communication flow data, so that the nodes in the directed graph data of the network topology are not only logical nodes used to determine the topology structure, but also physical nodes with features and practical significance. The specific constructed features and methods include in-degree ratio, weighted clustering coefficient, IP entropy, and aggregated statistical values ​​of some edge features. The main process includes: a) Based on nodes Connectivity information with other nodes Indicates the degree of departure. Let in-degree be the in-degree, and calculate the in-degree ratio as the node feature, as shown in formula (2), where It is a smoothing factor; b) Based on nodes Connectivity information with other nodes, compute node The weighted clustering coefficients are shown in formula (3); c) Based on nodes Connectivity information with other nodes, compute node The IP entropy is shown in formula (4); d) Based on the node Connected edges are aggregated, and some features of the edges are used as node features, such as the average packet length and average latency of the nodes. Finally, these features are combined to obtain the node features. .

4. The design method of the bi-branch graph neural network model according to claim 1 is specifically designed as follows. Based on the different characteristics of the constructed edge features and node features—the number of edges is much larger than that of nodes, and the edge features are richer—to ensure efficient and reliable model computation, a graph convolutional network operator called EAGN (Edge Aggregate Graph Network) is proposed. Its advantage lies in its specific design for updating edge features and its suitability for scenarios where edge features are more important. For the aggregation and updating of node features, the GAT (Graph Attention Network) operator is selected, introducing an attention mechanism to better handle heterogeneous nodes, such as heterogeneous network scenarios containing hosts, servers, and switches. The main process includes: a) The EAGN operator is used for the aggregation and update of edge features. The update method of its edge features is shown in formula (5), where It is the edge feature vector. () is the update function, which is usually a learnable neural network (such as an MLP). () is an aggregate function. It is a node The set of adjacent nodes, It is a node Except for nodes The set of all adjacent nodes except those in the set of all other nodes. Indicates connection and The others do not include eigenvectors; b) The GAT operator is used for the aggregation update of node features. The update method for node features has the following three steps: 1) Feature projection and attention coefficient calculation: for nodes and adjacent nodes Through shared linear transformation Will Features Projected into a new feature space Then calculate the attention coefficient. , Indicates feature splicing; 2) Normalization of attention weights: The attention coefficients are normalized using the softmax function, as shown in formula (6), where express The set of neighboring nodes of a node; 3) Weighted aggregation and feature update: The normalized attention weights are used for the weighted summation of features of adjacent nodes, and a new node representation is obtained through nonlinear activation, as shown in formula (7).

5. The design method for a classification predictor based on a long short-term memory model according to claim 1 is specifically designed as follows. Besides network topology information being valuable for predicting abnormal traffic, the temporal information of traffic in network communication datasets also implicitly reveals attack pattern characteristics. Therefore, the features updated by the bi-branch graph convolutional network are concatenated and used as input to the long short-term memory model. The fused temporal features are obtained through the calculation of the input gate, forget gate, and output gate. Finally, the predicted edges are output through a fully connected layer, serving as the classifier for the entire framework. The main process includes: a) Concatenate the features and use them as input to the LSTM model. , This represents the feature vector extracted and concatenated using a bi-branch graph convolutional model at time t. b) Initialize the LSTM unit The cell state and hidden state are updated cyclically through the input gate, forget gate, and output gate; c) Obtain the fused temporal features: ; d) Add a Dropout layer ; e) Fully connected layer transformation ; f) Activation function processing ; g) Output layer outputs prediction results .

Images