Enhanced fingerprint DDoS attack identification, mode clustering and tracing method and system
By constructing an enhanced multidimensional traffic fingerprint vector and combining it with a Bi-LSTM model and the HDBSCAN algorithm, the problems of single feature dimension and difficulty in tracing the source in existing DDoS detection technologies are solved, achieving efficient identification and accurate tracing of DDoS attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-25
- Publication Date
- 2026-04-14
AI Technical Summary
Existing DDoS detection technologies suffer from limitations such as single feature dimensions, susceptibility to interference, difficulty in identifying low-rate DDoS attacks, lack of time-dependent and covert identification capabilities, and lack of in-depth mining and tracing capabilities, resulting in high false negative and false positive rates and difficulties in tracing the source.
By extracting multidimensional features, constructing an enhanced multidimensional traffic fingerprint vector, performing secondary verification using a Bi-LSTM model, clustering using the HDBSCAN algorithm, and tracing the source using network topology information, we can achieve accurate identification, classification, and source tracing of DDoS attacks.
It achieves high-precision identification and low false alarm rate of DDoS attacks, can distinguish between attack groups and independent attackers, improves the accuracy and practicality of source tracing, and provides detailed attack path and source analysis.
Smart Images
Figure CN121864385A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of DDoS detection technology, and in particular to a method and system for DDoS attack identification, pattern clustering and source tracing using enhanced fingerprinting. Background Technology
[0002] With the widespread use of the Internet, DDoS attacks have become a major threat to cybersecurity, posing a serious threat to critical business systems in finance, e-commerce, and government sectors.
[0003] Existing DDoS detection technologies have the following significant drawbacks:
[0004] 1. Limited Feature Dimensions and Susceptibility to Interference: Existing DDoS detection technologies mostly rely on single-dimensional features such as traffic rate and packet count, which cannot effectively distinguish between normal traffic and DDoS attack traffic. They are also susceptible to interference from normal traffic fluctuations, resulting in high rates of missed and false alarms.
[0005] 2. Lack of time-series dependence and covert identification: Existing DDoS detection technologies are unable to effectively identify low-rate DDoS attacks that use time-series features for disguise, and they do not have real-time, adaptive feature enhancement capabilities, making it difficult to deal with new attack variants.
[0006] 3. Lack of in-depth mining and tracing capabilities: Existing DDoS detection technologies lack the ability to cluster and analyze attack behaviors, making it difficult to classify similar attacks and accurately locate the source of attacks, which makes the tracing work extremely difficult. Summary of the Invention
[0007] To address the significant shortcomings of existing DDoS detection technologies, this invention provides an enhanced fingerprint-based DDoS attack identification, pattern clustering, and source tracing method and system. By extracting, enhancing, and analyzing multidimensional features of network traffic (i.e., "traffic fingerprints"), it achieves intelligent identification of DDoS attack traffic, clustering analysis of similar attack behaviors, and tracing the source of attacks. The system can be deployed at network boundaries or critical nodes for real-time detection, early warning, and response to DDoS attacks, enhancing proactive network security defense capabilities.
[0008] This invention relates to an intelligent network traffic prediction system.
[0009] To achieve the above objectives, the present invention adopts the following technical solution:
[0010] In one embodiment of the present invention, an enhanced fingerprint-based DDoS attack identification, pattern clustering, and source tracing method is proposed, the method comprising:
[0011] Multi-dimensional features are extracted from network traffic, including basic features, application layer behavioral features, load entropy features, and time-series statistical features, and derived features, including time-series features and rate features, are calculated.
[0012] The multi-dimensional features and the derived features are normalized and then weighted and fused into an enhanced multi-dimensional traffic fingerprint vector. ;
[0013] The enhanced multidimensional traffic fingerprint vector is initially screened using a dual-threshold screening logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize;
[0014] Cluster the identified DDoS attack traffic;
[0015] Based on network topology information and traffic logs, the identified DDoS attack traffic is traced back to its source.
[0016] Furthermore, the derived features include packets per second, bytes per second, average packet size, burst ratio, and byte standard deviation ratio.
[0017] Furthermore, the enhanced multidimensional traffic fingerprint vector is further processed using a dual-threshold initial screening logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize the results, including:
[0018] The enhanced multidimensional traffic fingerprint vector is initially screened using a dual-threshold screening logic. Packets per second included and bytes per second Perform vectorized judgment: If any one of the conditions is met, the enhanced multidimensional traffic fingerprint vector is preliminarily determined. For DDoS attack traffic;
[0019] The initially screened DDoS attack traffic is input into the trained Bi-LSTM model to calculate its attack probability in real time. ,like Then determine the enhanced multidimensional traffic fingerprint vector. For DDoS attack traffic;
[0020] After determining the DDoS attack traffic, the enhanced multidimensional traffic fingerprint vector is used in conjunction with it. Average package size and the main agreement Infer its attack type;
[0021] like Therefore, the attack type is inferred to be... ;
[0022] like Therefore, it can be inferred that the attack type is a large-scale flood attack; .
[0023] Furthermore, the identified DDoS attack traffic is clustered, including:
[0024] Select average package size, As a characteristic of DDoS attack traffic;
[0025] After standardizing the DDoS attack traffic characteristics, the clustering algorithm HDBSCAN is used to group the DDoS attack traffic source IP addresses with similar DDoS attack traffic characteristics into one category, namely the attack group, and to regard the DDoS attack traffic source IP addresses with independent DDoS attack traffic characteristics as noise points.
[0026] Furthermore, the identified DDoS attack traffic is traced back to its source, including:
[0027] By aggregating the collector IP and ingress interface index, the DDoS attack traffic and the number of DDoS attack traffic at each ingress point are counted.
[0028] By combining the geographic location information in NetFlow data and aggregating it by country, province, city, and ISP, the main geographic sources and operators of the DDoS attack traffic can be determined.
[0029] By performing multi-dimensional correlation analysis between the IP addresses of the DDoS attack traffic sources and geographical location information, ASN information, and network topology information, the distribution characteristics of the IP addresses of the DDoS attack traffic sources are obtained.
[0030] Based on the correlation results, identify the network to which the source IP address of the DDoS attack traffic belongs and the possible attack group;
[0031] Generate a source tracing report, which includes DDoS attack source information, DDoS attack type, and DDoS attack path, for use in security decision-making and response.
[0032] In one embodiment of the present invention, an enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing system is also proposed, the system comprising:
[0033] The traffic acquisition module is used to collect network traffic data and perform preprocessing.
[0034] The multi-dimensional feature extraction module is used to extract multi-dimensional features from network traffic, including basic features, application layer behavioral features, load entropy features and time-series statistical features, and to calculate derived features, including time-series features and rate features.
[0035] An enhanced traffic fingerprint construction module is used to normalize the multi-dimensional features and the derived features, and then weighted and fused them into an enhanced multi-dimensional traffic fingerprint vector. ;
[0036] The attack behavior pattern recognition module is used to perform initial screening of the enhanced multidimensional traffic fingerprint vector using a dual-threshold logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize;
[0037] The attack behavior clustering module is used to cluster identified DDoS attack traffic.
[0038] The attack tracing module is used to trace the identified DDoS attack traffic based on network topology information and traffic logs.
[0039] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it realizes the aforementioned enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing.
[0040] In one embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that performs enhanced fingerprinting for DDoS attack identification, pattern clustering and source tracing.
[0041] Beneficial effects:
[0042] 1. Enhanced Multidimensional Flow Fingerprint: Innovatively constructs an enhanced multidimensional flow fingerprint vector that integrates time-series statistical features (such as burst ratio and standard deviation ratio) and load entropy features. This effectively solves the shortcomings of traditional methods, such as having a single feature dimension and difficulty in identifying slow or covert attacks.
[0043] 2. Bi-LSTM Deep Learning Recognition: By adopting the Bi-LSTM model and combining it with dual-threshold initial screening logic, high-precision and high-efficiency recognition of DDoS attack traffic is achieved.
[0044] 3. HDBSCAN Advanced Clustering: This is the first time that the HDBSCAN algorithm has been applied to DDoS attack traffic clustering, which can effectively distinguish between attack groups (clusters) and independent attackers (noise points), and achieve in-depth mining of DDoS attack patterns.
[0045] 4. Attack Path Reconstruction and Multi-dimensional Source Tracing: It realizes the reconstruction of the precise entry point of the attack path through the aggregation analysis of the IP / ingress interface index of the aggregate collector, and combines ASN, network topology information and other multi-dimensional correlations to improve the accuracy and practicality of source tracing. Attached Figure Description
[0046] Figure 1 This is a schematic diagram of the enhanced fingerprint DDoS attack identification, pattern clustering and source tracing method of the present invention;
[0047] Figure 2 This is a schematic diagram of the enhanced fingerprint DDoS attack identification, pattern clustering and source tracing system of the present invention;
[0048] Figure 3 This is a schematic diagram of the computer device structure of the present invention. Detailed Implementation
[0049] The principles and spirit of the present invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.
[0050] Those skilled in the art will recognize that embodiments of the present invention can be implemented as a system, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.
[0051] According to embodiments of the present invention, an enhanced fingerprinting method for DDoS attack identification, pattern clustering, and source tracing is proposed. This method extracts multi-dimensional features from traffic, including time series, protocol behavior, payload characteristics, and source-destination relationships. A weighted fusion algorithm is used to improve the distinguishability of these features. A machine learning model is used to identify DDoS attack traffic, a clustering algorithm is used to group similar DDoS attack traffic, and network topology and traffic logs are combined to achieve DDoS attack source tracing, thus enabling accurate identification, classification, and source tracing of DDoS attacks.
[0052] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.
[0053] Figure 1 This is a schematic diagram of the enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing method of this invention. Figure 1 As shown, the specific steps are as follows:
[0054] S1. Selection and quantification of multidimensional features:
[0055] Basic features: traditional IP address, port, protocol, packet size, and packet interval;
[0056] Application layer behavioral characteristics: For protocols such as HTTP / HTTPS, extract information such as URL access frequency, diversity of request header fields (e.g., User-Agent), and distribution of request methods. For example, DDoS attacks typically exhibit highly consistent or frequently changing User-Agents;
[0057] Load entropy characteristics: calculating the information entropy of data packet payloads. Pi is the probability of each byte value occurring. Normal encrypted traffic or text transmission has a higher entropy value, while some padding attacks or specific protocol attacks have a lower or more regular payload entropy value.
[0058] Time-series statistical features: Calculate advanced statistics such as variance, skewness, and kurtosis of traffic within time windows of 1 second, 5 seconds, and 10 seconds to capture the magnitude and direction of traffic changes over time in order to identify slow DDoS attacks.
[0059] S2, Enhanced Multidimensional Traffic Fingerprint Construction:
[0060] 2.1 A multi-dimensional feature extraction algorithm (including basic, application layer, load entropy, and time-series statistical derived features) and a weighted fusion algorithm are adopted;
[0061] 2.2 By calculating the burst ratio The multi-dimensional features and derived features, such as the byte standard deviation ratio, are normalized (e.g., Z-score normalization) to eliminate the influence of different dimensions. Then, based on the attack type inference, the derived features are weighted to finally construct an enhanced multi-dimensional traffic fingerprint vector. This solves the problem of traditional techniques having a single feature dimension and being difficult to distinguish from covert attacks. The enhanced multidimensional traffic fingerprint vector is processed using a hash function. Encode and generate a unique fingerprint identifier to facilitate the processing of the enhanced multidimensional traffic fingerprint vector. Perform fast indexing and tracking.
[0062] S3. Combining Bi-LSTM pattern recognition with two-level verification:
[0063] Model selection: A bidirectional long short-term memory network was adopted. Perform attack probability calculations and combine them with dual-threshold initial screening logic;
[0064] Bi-LSTM models excel at handling time-dependent sequence data and can extract data from the enhanced multidimensional flow fingerprint vector. The system learns patterns from temporal features to effectively identify low-rate DDoS attack traffic; the two-level verification structure ensures high efficiency and low false positive rate; the two-level verification structure is the core identification framework to ensure high efficiency and low false positive rate, which combines fast statistical judgment with a high-precision deep learning model; the first level: dual threshold initial screening logic, the second level: high-precision verification of the Bi-LSTM model, for the DDoS attack traffic initially screened, the attack probability is calculated by utilizing the characteristics of the Bi-LSTM model that is good at processing time series;
[0065] Training: The Bi-LSTM model is trained using a large fingerprint dataset containing normal traffic and different types of DDoS attack traffic to optimize its recognition accuracy.
[0066] Deployment: The trained Bi-LSTM model is deployed to the traffic analysis engine to process real-time data and output it to the quantized system. Classify them.
[0067] S4, HDBSCAN advanced clustering:
[0068] Cluster analysis is performed on the identified DDoS attack traffic to group similar attack traffic characteristics into one category. The specific steps are as follows:
[0069] 4.1 The clustering algorithm HDBSCAN is used to cluster the identified DDoS attack traffic. HDBSCAN can identify clusters of arbitrary shapes, group source IPs with similar attack traffic characteristics into one category (attack group), and regard source IPs with independent attack traffic characteristics as noise points, thereby realizing in-depth mining and classification of DDoS attack traffic.
[0070] 4.2 Based on the clustering results, assign category labels to each type of DDoS attack traffic;
[0071] 4.3 Analyze the characteristics of each type of DDoS attack traffic to form a DDoS attack traffic characteristic database.
[0072] S5. Source Tracing of the Attack:
[0073] The specific steps for tracing the source IP address of the identified DDoS attack traffic are as follows:
[0074] 5.1 By aggregating the collector IP and the ingress interface index (input_if_index), and combining IP geographic location information, ASN and network topology information and other multi-dimensional correlation analysis, the source IP address distribution of DDoS attack traffic is obtained;
[0075] 5.2 Identify the network to which the source IP address of the DDoS attack traffic belongs and the possible attack group.
[0076] 5.3 Generate a source tracing report, including DDoS attack source information, DDoS attack type, and DDoS attack path.
[0077] It should be noted that although the operation of the method of the present invention has been described in a specific order in the above embodiments and figures, this does not require or imply that the operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.
[0078] To provide a clearer explanation of the enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing described above, a specific embodiment will be used for illustration below. However, it is worth noting that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation of the present invention.
[0079] Example:
[0080] This embodiment describes a complete process for real-time DDoS attack detection, behavior clustering, and attribution based on NetFlow data streams (as the output of a traffic acquisition probe). This embodiment focuses on describing the complete technical path based on NetFlow data streams to achieve enhanced fingerprint construction, Bi-LSTM identification, HDBSCAN clustering, and path reconstruction attribution.
[0081] First: System Configuration and Data Preparation
[0082] Step 1: Data source: NetFlow V9 / IPFIX data, collected by the collector (flow_ip_addr) and converted into CSV format; Target: Filter inbound traffic for preset protected target IP addresses (target_ips);
[0083] Data loading and filtering: The system loads NetFlow CSV data and filters it by destination IP address (dst_ip_addr), retaining only inbound traffic. The raw data records fields such as the number of bytes (octets), number of packets (packets), timestamp (app_rcv_time), protocol (protocol), source AS number (src_as), source port (src_port), and TCP flags (tcp_flags) for each flow.
[0084] Step 2: Enhanced fingerprint fusion and vectorization
[0085] 2.1 Normalization processing: The system aggregates all traffic records according to the source IP address (src_ip_addr).
[0086] 2.2 Basic Feature Extraction:
[0087] 2.2.1 Take the basic characteristics: total_packets (including the total number of packets), total_bytes (the total number of bytes);
[0088] 2.2.2 Extract application layer / behavioral features: including dst_port_diversity (target port diversity), src_port_diversity (source port diversity), and flow_count (number of flow records);
[0089] 2.2.3 Time series statistical features: std_packets (standard deviation / mean of packet count), std_bytes (standard deviation / mean of byte count), avg_packets (mean of packet count), avg_bytes (mean of byte count);
[0090] 2.2.4 Content / Protocol Characteristics: protocol_diversity, main_protocol, dominant_tcp_flag;
[0091] 2.2.5 Load entropy characteristics: These cannot be directly obtained from standard NetFlow. In implementation, they can be enhanced by using protocol diversity and average packet size.
[0092] 2.3. Derived Feature Calculation: Time-series and rate features, as enhanced multidimensional traffic fingerprint vectors The core components;
[0093] Duration: ;
[0094] Packets per second (PPS): ;
[0095] Bytes per second (BPS): ;
[0096] Average bag size: ;
[0097] Outbreak rate: ;
[0098] Byte standard deviation ratio: ;
[0099] 2.4 Fingerprint Vector Construction and Normalization
[0100] Normalization: All features, especially the derived time / rate features, are subjected to Z-score normalization to eliminate the influence of dimensions;
[0101] Weighted fusion: Inferring high-discrimination features (such as...) based on attack type. Weighting ;
[0102] Step 3. Attack Pattern Recognition and Behavior Clustering
[0103] 3.1 Attack Behavior Pattern Recognition
[0104] In actual deployment, a high-efficiency initial screening dual-threshold logic is first used for rapid initial screening, and then a deep learning model is used for secondary verification.
[0105] 3.1.1 Initial Screening: A dual-threshold OR logic is used. The included PPS and BPS metrics are vectorized to determine whether they are abnormal: If any one of the conditions is met, it is determined to be a preliminary DDoS attack traffic;
[0106] 3.1.2 Secondary Validation (Bi-LSTM): The initially screened DDoS attack traffic is input into the trained Bi-LSTM model to calculate its attack probability in real time. .like Then it will be finally determined. This refers to DDoS attack traffic.
[0107] 3.2 Attack Type Inference (Practical Application of Fingerprints)
[0108] After identifying the DDoS attack traffic, the system combines... Based on the average packet size and main protocol characteristics, the attack type can be inferred:
[0109] 3.2.1 If Inferred as ;
[0110] 3.2.2 If This is inferred to be a large packet flooding attack (bandwidth-consuming type).
[0111] ;
[0112] 3.3 Attacking Fingerprint Clustering
[0113] All identified DDoS attack traffic was analyzed using the HDBSCAN clustering algorithm:
[0114] 3.3.1 Clustering Features: The most distinctive feature subset is selected as the DDoS attack traffic feature for clustering, including:
[0115] ,
[0116] in ;
[0117] 3.3.2 Clustering Execution: After standardizing these DDoS attack traffic characteristics, the following steps are applied: ;
[0118] 3.3.3 Pattern Generation: Source IPs are divided into different clusters (cluster>=0), representing attack groups or botnets with similar DDoS attack traffic characteristics; source IPs that are not clustered (cluster=-1) are regarded as independent attackers (noise points).
[0119] Step 4. Attack attribution
[0120] 4.1 Entry Point and Path Reconstruction Analysis:
[0121] 4.1.1 Entry Point Analysis: By aggregating the collector IP (flow_ip_addr) and the ingress interface index (input_if_index), the DDoS attack traffic and the number of DDoS attack traffic at each entry point are counted, which enables precise reconstruction of the entry point of the attack path;
[0122] 4.1.2 Geographic Source Analysis: Combining the geographic location information field in NetFlow data, the data is aggregated by country, province, city, and ISP to determine the main geographic sources and operators of DDoS attack traffic;
[0123] Step 5: Report Generation
[0124] 5.1 Source IP Analysis: Analyze the distribution characteristics of source IP addresses in DDoS attack traffic;
[0125] 5.2 Correlation Analysis: Multi-dimensional correlation analysis is performed between the source IP address and IP address geographic location information, ASN information, and network topology information;
[0126] 5.3 Identity Recognition: Based on the correlation results, identify the network to which the source IP address of the DDoS attack traffic belongs and the possible attack group;
[0127] 5.4 Generate Report: Generate a source tracing report, which includes key information such as attack source information, attack type, and attack path, for use in security decision-making and response.
[0128] Based on the same inventive concept, this invention also proposes an enhanced fingerprint DDoS attack identification, pattern clustering, and tracing system. The implementation of this system can refer to the implementation of the methods described above; repeated details will not be repeated. The term "module" used below can refer to a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.
[0129] Figure 2 This is a schematic diagram of the enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing system of this invention. Figure 2 As shown, the system includes:
[0130] Traffic acquisition module 101 is used to collect network traffic data and perform preprocessing.
[0131] The multi-dimensional feature extraction module 102 is used to extract multi-dimensional features from network traffic, including basic features, application layer behavioral features, load entropy features and time-series statistical features, and to calculate derived features, including time-series features and rate features.
[0132] The enhanced traffic fingerprint construction module 103 is used to normalize the multi-dimensional features and the derived features, and then weighted and fuse them into an enhanced multi-dimensional traffic fingerprint vector. ;
[0133] Attack behavior pattern recognition module 104 is used to perform initial screening of the enhanced multidimensional traffic fingerprint vector using dual-threshold logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize;
[0134] Attack behavior clustering module 105 is used to cluster identified DDoS attack traffic;
[0135] The attack tracing module 106 is used to trace the identified DDoS attack traffic based on network topology information and traffic logs.
[0136] It should be noted that although several modules of the enhanced fingerprint DDoS attack identification, pattern clustering, and tracing system are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.
[0137] Based on the aforementioned inventive concept, such as Figure 3As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, it realizes the aforementioned enhanced fingerprint DDoS attack identification, pattern clustering and source tracing.
[0138] Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium storing a computer program that performs the aforementioned enhanced fingerprinting DDoS attack identification, pattern clustering, and source tracing.
[0139] The enhanced fingerprinting DDoS attack identification, pattern clustering and source tracing method and system proposed in this invention achieves intelligent identification of DDoS attack traffic, clustering analysis of similar DDoS attack features and source tracing of attack sources by extracting, enhancing and analyzing the multidimensional features of network traffic (i.e., "traffic fingerprints").
[0140] While the spirit and principles of the invention have been described with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for ease of description. The invention is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.
[0141] Regarding the limitation of the scope of protection of this invention, those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solution of this invention are still within the scope of protection of this invention.
Claims
1. An enhanced fingerprint-based DDoS attack identification, pattern clustering, and source tracing method, characterized in that, The method includes: Multi-dimensional features are extracted from network traffic, including basic features, application layer behavioral features, load entropy features, and time-series statistical features, and derived features, including time-series features and rate features, are calculated. The multi-dimensional features and the derived features are normalized and then weighted and fused into an enhanced multi-dimensional traffic fingerprint vector. ; The enhanced multidimensional traffic fingerprint vector is initially screened using a dual-threshold screening logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize; Cluster the identified DDoS attack traffic; Based on network topology information and traffic logs, the identified DDoS attack traffic is traced back to its source.
2. The enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing method according to claim 1, characterized in that, The derived features include packets per second, bytes per second, average packet size, burst ratio, and byte standard deviation ratio.
3. The enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing method according to claim 1, characterized in that, The enhanced multidimensional traffic fingerprint vector is initially screened using a dual-threshold screening logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize the results, including: The enhanced multidimensional traffic fingerprint vector is initially screened using a dual-threshold screening logic. Packets per second included and bytes per second Perform vectorized judgment: If any one of the conditions is met, the enhanced multidimensional traffic fingerprint vector is preliminarily determined. For DDoS attack traffic; The initially screened DDoS attack traffic is input into the trained Bi-LSTM model to calculate its attack probability in real time. ,like Then determine the enhanced multidimensional traffic fingerprint vector. For DDoS attack traffic; After determining the DDoS attack traffic, the enhanced multidimensional traffic fingerprint vector is used in conjunction with it. Average package size and the main agreement Infer its attack type; like Therefore, the attack type is inferred to be... ; like Therefore, it can be inferred that the attack type is a large-scale flood attack; .
4. The enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing method according to claim 1, characterized in that, Clustering of identified DDoS attack traffic, including: Select average package size, As a characteristic of DDoS attack traffic; After standardizing the DDoS attack traffic characteristics, the clustering algorithm HDBSCAN is used to group the DDoS attack traffic source IP addresses with similar DDoS attack traffic characteristics into one category, namely the attack group, and to regard the DDoS attack traffic source IP addresses with independent DDoS attack traffic characteristics as noise points.
5. The enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing method according to claim 1, characterized in that, Tracing the identified DDoS attack traffic includes: By aggregating the collector IP and ingress interface index, the DDoS attack traffic and the number of DDoS attack traffic at each ingress point are counted. By combining the geographic location information in NetFlow data and aggregating it by country, province, city, and ISP, the main geographic sources and operators of the DDoS attack traffic can be determined. By performing multi-dimensional correlation analysis between the IP addresses of the DDoS attack traffic sources and geographical location information, ASN information, and network topology information, the distribution characteristics of the IP addresses of the DDoS attack traffic sources are obtained. Based on the correlation results, identify the network to which the source IP address of the DDoS attack traffic belongs and the possible attack group; Generate a source tracing report, which includes DDoS attack source information, DDoS attack type, and DDoS attack path, for use in security decision-making and response.
6. An enhanced fingerprint DDoS attack identification, pattern clustering, and source tracing system, characterized in that, The system includes: The traffic acquisition module is used to collect network traffic data and perform preprocessing. The multi-dimensional feature extraction module is used to extract multi-dimensional features from network traffic, including basic features, application layer behavioral features, load entropy features and time-series statistical features, and to calculate derived features, including time-series features and rate features. An enhanced traffic fingerprint construction module is used to normalize the multi-dimensional features and the derived features, and then weighted and fused them into an enhanced multi-dimensional traffic fingerprint vector. ; The attack behavior pattern recognition module is used to perform initial screening of the enhanced multidimensional traffic fingerprint vector using a dual-threshold logic. Initial screening of DDoS attack traffic is performed, followed by processing with a pre-trained Bi-LSTM. Perform secondary verification and categorize; The attack behavior clustering module is used to cluster identified DDoS attack traffic. The attack tracing module is used to trace the identified DDoS attack traffic based on network topology information and traffic logs.
7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1-5.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that performs the method according to any one of claims 1-5.