Network control method for resisting denial of service attack

Abstract

The invention provides a network control method for resisting denial of service attack, which belongs to the technical field of network security, and comprises the following steps of: outputting a threat level score and an evolution trend predicted value by using a flow situation pre-judgment model of a multi-layer feature extraction backtracking mechanism; a Navier-Stokes flow control algorithm is adopted for high-risk flow and suspicious flow to calculate velocity field and pressure field distribution, flow states are judged according to Reynolds numbers to recognize vortex structures, and when the number of the vortex structures exceeds a congestion threshold value, an active flow shaping mechanism is started to adjust inlet boundary conditions to limit the injection rate; by combining hardware-level depth detection, hierarchical Bloom filter connection state maintenance, dynamic graph computing framework collaborative attack source identification, defense strategy generation and model parameter updating, the technical problem that traffic prediction and active control are difficult to realize before network congestion caused by denial of service attack is solved.

Description

A network control method to resist denial-of-service attacks Technical Field

[0001] This invention belongs to the field of network security technology, and more specifically, relates to a network control method for resisting denial-of-service attacks. Background Technology

[0002] In the field of network security, denial-of-service (DoS) attack defense technologies primarily employ signature-based intrusion detection systems and statistical threshold-based traffic anomaly detection methods to identify attack traffic. Traditional defense systems typically deploy detection devices at the network boundary, analyzing packet characteristics and comparing them with known attack patterns. When attack characteristics are detected, defense strategies are triggered to perform traffic dropping or rate limiting. However, traditional technologies have significant drawbacks. Their detection mechanisms are passive, only identifying and processing attack traffic after it has entered the network and caused congestion. By this time, network device queues are already backlogged, and the transmission quality of normal business traffic has been compromised. Furthermore, traditional methods lack the ability to predict traffic evolution trends, failing to identify potential traffic anomalies before congestion occurs, resulting in defense measures lagging behind the attack process. In existing technologies, the lack of an active control mechanism that combines traffic dynamics with physical fluid models makes it difficult for defense systems to implement effective traffic regulation before the attack causes substantial network congestion. In other words, existing technologies face the technical challenge of predicting and actively controlling traffic before DoS attacks cause network congestion. Summary of the Invention

[0003] In view of this, the present invention provides a network control method for resisting denial-of-service attacks, which can solve the technical problem in the prior art that it is difficult to achieve traffic prediction and proactive control before denial-of-service attacks cause network congestion.

[0004] This invention is implemented as follows: It provides a network control method resistant to denial-of-service attacks. A traffic acquisition node is deployed at the network entry point to collect all incoming data packets and extract quintuple information and timestamp information to establish an initial traffic feature vector set. This initial traffic feature vector set is input into a traffic situation prediction model, which outputs a threat level score and traffic evolution trend prediction value for each data flow. Based on the threat level score, the data flows are classified into three categories: high-risk flows, suspicious flows, and normal flows. For high-risk and suspicious flows, the Navier-Stokes flow control algorithm is used to calculate the fluid velocity field distribution and pressure gradient distribution. The flow state is determined based on the Reynolds number, and the location of vortex structures is identified. When the number of vortex structures exceeds the congestion threshold... When a threshold is reached, an active traffic shaping mechanism is activated. By adjusting the inlet boundary conditions, the injection rate of high-risk flows is limited, causing the flow state to change from turbulent to laminar. After the traffic has been shaped, hardware-level deep detection is performed, and the detection results are compared with the threat signature database. Based on the comparison results, the connection state table is updated, and connections identified as attack traffic are dropped and their attack characteristics are recorded. The attack characteristics are input into a dynamic graph computing framework to construct a network traffic topology graph and perform community detection and abnormal subgraph mining to identify the set of collaborative attack source nodes for distributed denial-of-service attacks. Based on the set of collaborative attack source nodes, a defense strategy is generated and distributed to each traffic collection node to update the parameter weights of the threat signature database and the traffic situation prediction model.

[0005] The five-tuple information includes the source Internet Protocol address, the destination Internet Protocol address, the source port number, the destination port number, and the transport layer protocol type.

[0006] Each vector in the initial traffic feature vector set contains the packet size, arrival time interval, transmission control protocol flag status, and payload entropy value.

[0007] The traffic situation prediction model adopts a deep encoder-decoder architecture with a multi-layer feature extraction backtracking mechanism, which includes an input layer, three feature extraction layers, a feature backtracking fusion layer, two decoding prediction layers, and an output layer.

[0008] The first feature extraction layer uses a one-dimensional convolution kernel to extract temporal local patterns, the second feature extraction layer uses bidirectional long short-term memory units to capture long-term dependencies, and the third feature extraction layer uses multi-scale dilated convolution to expand the receptive field.

[0009] The feature backtracking fusion layer fuses the features extracted by the three feature extraction layers through an attention weighting mechanism, and the weight coefficients are dynamically adjusted according to the importance of the features.

[0010] The attention weight coefficient is determined based on three parameters: average packet size, average arrival time interval, and standard deviation of load entropy.

[0011] The training dataset for the traffic situation prediction model is established by collecting six months of traffic data in a real network environment. It includes traffic samples of synchronous flooding attacks, UDP flooding attacks, Transmission Control Protocol connection exhaustion attacks, application layer slow attacks, and distributed reflection amplification attacks as positive sample sets.

[0012] The traffic situation prediction model training uses cross-entropy loss function to measure threat level classification error, mean square error loss function to measure trend prediction deviation, and adaptive moment estimation optimization algorithm to update model parameters.

[0013] The Navier-Stokes flow control algorithm compares network flow to an incompressible viscous fluid, uses the Navier-Stokes equations to describe the evolution of flow in time and space, and obtains the velocity field distribution and pressure field distribution through numerical solution using the finite volume method.

[0014] The Reynolds number is defined as the ratio of flow rate to viscosity coefficient. When the Reynolds number exceeds a critical value, the flow changes to a turbulent state. The location and intensity of the vortex structure are identified through vorticity field analysis.

[0015] The congestion threshold is determined by injecting flood-type denial-of-service attack traffic of different intensities into the test network, recording the router queue length, packet loss rate, and service response delay, and plotting the relationship curve between the number of vortex structures and the packet loss rate.

[0016] The hardware-level deep detection uses a programmable field-programmable gate array (FPGA) chip to implement seven-layer protocol parsing and content matching, including a data packet parsing module, a protocol identification module, a content matching module, and a result output module.

[0017] The connection state table uses a hierarchical Bloom filter and a counting data summary structure to maintain connection state information. The hierarchical Bloom filter contains a three-layer hash structure.

[0018] The dynamic graph computing framework uses a graph segmentation algorithm to divide the network traffic topology graph into multiple subgraphs for parallel processing, and the community detection algorithm uses a label propagation algorithm to identify tightly connected communities.

[0019] The parameter weight update adopts an incremental learning method to add newly identified attack features to the training dataset to fine-tune the traffic situation prediction model online, while maintaining the original model parameters as regularization constraints to avoid catastrophic forgetting.

[0020] This invention constructs a proactive attack defense system by combining a flow situation prediction model with the Navier-Stokes flow control algorithm. First, the flow situation prediction model employs a deep encoder-decoder architecture with a multi-layer feature extraction backtracking mechanism. This architecture extracts temporal local patterns and long-term scale-dependent receptive field features from the initial flow feature vector set. Through an attention-weighted mechanism in the feature backtracking fusion layer, it integrates multi-layer feature information and outputs a threat level score and a predicted flow evolution trend, achieving early identification and future state prediction of attack traffic. Second, the Navier-Stokes flow control algorithm analogizes network traffic to an incompressible viscous fluid. By solving the Navier-Stokes equations, it calculates the velocity and pressure field distributions, uses the Reynolds number to determine the flow state, and identifies the location of vortex structures through vorticity field analysis. When the number of vortex structures exceeds the congestion threshold, an active flow shaping mechanism is activated to adjust the inlet boundary conditions and limit the injection rate of high-risk flows, transforming the flow state from turbulent to laminar, thus completing flow regulation before congestion occurs. In summary, this invention solves the technical problem mentioned in the background art of difficulty in achieving traffic prediction and proactive control before network congestion is caused by denial-of-service attacks by combining situational prediction and fluid dynamics control. Attached Figure Description

[0021] Figure 1 is a flowchart of the method of the present invention.

[0022] Figure 2 is a schematic diagram of the flow situation prediction model.

[0023] Figure 3 shows the velocity and pressure field distributions of the Navier-Stokes flow control algorithm.

[0024] Figure 4 shows the changes in Reynolds number and queue length over time under the active flow shaping mechanism.

[0025] Figure 5 shows the results of community detection and abnormal subgraph identification in the network traffic topology graph. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below.

[0027] Figure 1 shows a flowchart of a network control method for resisting denial-of-service attacks provided by this invention. The method includes the following steps: S01, deploying a traffic acquisition node at the network inlet to collect all data packets entering the network and extracting quintuple information and timestamp information to establish an initial traffic feature vector set; S02, inputting the initial traffic feature vector set into a traffic situation prediction model to output a threat level score and traffic evolution trend prediction value for each data flow, classifying data flows into three categories based on the threat level score: high-risk flow, suspicious flow, and normal flow; S03, using the Navier-Stokes flow control algorithm to calculate the fluid velocity field distribution and pressure gradient distribution for high-risk and suspicious flows, determining the flow state and identifying the location of vortex structures based on the Reynolds number; S04, when the number of vortex structures exceeds the congestion threshold, activating an active flow shaping mechanism to limit high-risk flows by adjusting the inlet boundary conditions. The injection rate is adjusted to change the flow state from turbulent to laminar; S05, after the traffic has been shaped, hardware-level deep detection is performed, using a programmable field-programmable gate array (FPGA) chip to implement seven-layer protocol parsing and content matching, and the detection results are compared with the threat signature database; S06, the connection state table is updated according to the comparison results, and a hierarchical Bloom filter and a counting data summary structure are used to maintain the connection state information. Connections identified as attack traffic are dropped and attack characteristics are recorded; S07, the attack characteristics are input into a dynamic graph calculation framework to construct a network traffic topology graph and perform community detection and abnormal subgraph mining to identify the set of cooperative attack source nodes for distributed denial-of-service attacks; S08, a defense strategy is generated based on the set of cooperative attack source nodes and distributed to each traffic collection node, the parameter weights of the threat signature database and the traffic situation prediction model are updated, and a complete defense cycle is completed.

[0028] The quintuple information includes the source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and transport layer protocol type; the timestamp information records the precise time when the data packet arrives at the network entry point; each vector in the initial traffic feature vector set includes the data packet size, arrival time interval, transmission control protocol flag status, and payload entropy value.

[0029] The specific structure of the traffic situation prediction model is a deep encoder-decoder architecture with a multi-layer feature extraction backtracking mechanism, including an input layer, three feature extraction layers, a feature backtracking fusion layer, two decoding prediction layers, and an output layer. The input layer receives an initial traffic feature vector set; the first feature extraction layer uses a one-dimensional convolutional kernel to extract temporal local patterns; the second feature extraction layer uses bidirectional long short-term memory units to capture long-term dependencies; the third feature extraction layer uses multi-scale dilated convolution to expand the receptive field; the feature backtracking fusion layer fuses the features extracted by the three feature extraction layers through an attention weighting mechanism, with the weight coefficients dynamically adjusted according to the importance of the features; the decoding prediction layer uses a fully connected layer to map the fused features to the threat scoring space and the trend prediction space; the output layer generates a threat level score and a traffic evolution trend prediction value for the future time window.

[0030] The steps for establishing the training dataset for the traffic situation prediction model specifically include: collecting six months of traffic data from a real network environment as the original dataset; cleaning the original dataset to remove duplicate and corrupted data packets; extracting traffic samples subjected to synchronous flooding attacks, UDP flooding attacks, Transmission Control Protocol connection exhaustion attacks, application layer slow attacks, and distributed reflection amplification attacks from the cleaned data as the positive sample set; extracting normal business traffic samples as the negative sample set; labeling each attack sample in the positive sample set with the attack type, attack intensity, and attack duration; dividing the sample set into a training set and a validation set in a 7:3 ratio; and performing maximum and minimum value normalization on the feature vectors in the training set and the validation set to unify the numerical range to the interval between 0 and 1.

[0031] The specific steps for training the traffic situation prediction model include: initializing model parameters using the He Kaiming initialization method; setting the batch size to 128, the learning rate to 0.001, and the number of training epochs to 200; using the cross-entropy loss function to measure the threat level classification error and the mean squared error loss function to measure the trend prediction bias; updating model parameters using the adaptive moment estimation optimization algorithm; evaluating model performance on the validation set every 10 training epochs; triggering an early stopping mechanism to terminate training when the validation set loss does not decrease for 20 consecutive epochs; and saving the optimal model parameters on the validation set as the final model.

[0032] The working principle of the multi-layer feature extraction backtracking mechanism is to retain the intermediate feature representations of each layer during the feature extraction process and fuse deep abstract features with shallow detailed features through the backtracking path. The local temporal pattern features extracted by the first feature extraction layer contain micro-fluctuation information of data packet arrival, which is sensitive to the identification of sudden flood attacks. The long-term dependency features extracted by the second feature extraction layer capture the macro-evolution trend of traffic, providing key clues for detecting persistent slow attacks. The multi-scale receptive field features extracted by the third feature extraction layer integrate traffic behavior patterns at different time granularities, providing a basis for distinguishing between normal traffic fluctuations and abnormal attack traffic. The feature backtracking fusion layer calculates the contribution of each layer's features to the current prediction task through an attention weighting mechanism and adaptively adjusts the fusion weights of features from different layers. This mechanism enables the traffic situation prediction model to quickly respond to the sudden traffic peak features captured by the first feature extraction layer when facing synchronous flood attacks, to rely on the long-term low-rate abnormal patterns identified by the second feature extraction layer when facing application layer slow attacks, and to make a comprehensive judgment by integrating multiple layers of features when facing hybrid distributed denial-of-service attacks. The multi-layer feature extraction backtracking mechanism effectively improves the generalization recognition capability of the traffic situation prediction model for different attack types, reduces the false alarm rate and false negative rate, enhances the adaptability of the defense system to unknown attack variants, and provides accurate threat intelligence support for subsequent traffic control and defense strategy generation.

[0033] The attention weight coefficients in the feature backtracking fusion layer are determined based on three parameters: the average packet size, the average arrival time interval, and the standard deviation of the load entropy value in the initial traffic feature vector set. When the average packet size is less than 64 bytes and the average arrival time interval is less than 10 milliseconds, the weight coefficients of the local temporal features in the first feature extraction layer are increased. When the standard deviation of the load entropy value is less than 0.3, the weight coefficients of the long-term dependent features in the second feature extraction layer are increased. When the average packet size is between 512 bytes and 1500 bytes and the standard deviation of the load entropy value is greater than 0.7, the weight coefficients of the multi-scale features in the third feature extraction layer are increased.

[0034] The Navier-Stokes flow control algorithm analogizes network traffic to an incompressible viscous fluid, with data packets corresponding to fluid particles, network bandwidth to pipe cross-sectional area, and flow rate to fluid velocity. The algorithm uses the Navier-Stokes equations to describe the temporal and spatial evolution of flow. In these equations, the velocity field represents the distribution of flow transmission rates at different locations in the network, the pressure field represents the degree of queue congestion at network nodes, and the viscosity term represents the mutual interference and competition between different data flows. The network space is discretized into a finite number of control volumes using the finite volume method. The Navier-Stokes equations are numerically solved on each control volume to calculate the velocity and pressure field distributions for the next time step. The Reynolds number is defined as the ratio of flow rate to viscosity. When the Reynolds number is below a critical value, the flow exhibits a laminar state, indicating stable and orderly flow. When the Reynolds number exceeds the critical value, the flow transitions to a turbulent state, indicating flow congestion and disordered fluctuations. Under turbulent conditions, the location and intensity of vortex structures are identified through vortex field analysis. These vortex structures correspond to flow hotspots and congestion points in the network.

[0035] The Navier-Stokes flow control algorithm is primarily applicable to flooding-type denial-of-service attacks, including synchronous flooding, User Datagram Protocol (UDP) flooding, and Internet Control Message Protocol (ICP-MS) flooding. Flooding-type denial-of-service attacks are characterized by injecting massive amounts of data packets into the target network within a short period, leading to network bandwidth exhaustion and router queue overflow. From a fluid dynamics perspective, flooding-type denial-of-service attacks are equivalent to a sudden increase in the ingress flow rate, causing the Reynolds number to rapidly rise above a critical value, transforming the flow from laminar to turbulent, and forming strong vortex structures at the queue points. The Navier-Stokes flow control algorithm, by monitoring changes in the Reynolds number and the distribution of vortex structures in real time, can identify abnormal traffic injection in the early stages of an attack. By adjusting the ingress boundary conditions, i.e., limiting the injection rate of high-risk flows, it is equivalent to reducing the ingress velocity and lowering the Reynolds number, causing the turbulent flow to revert to laminar flow, dissipating the vortex structures, and alleviating queue backlog. The active flow shaping mechanism can intercept and smooth attack traffic before it reaches core network devices, preventing congestion from propagating deeper into the network and protecting the normal transmission of critical service traffic. The Navier-Stokes flow control algorithm is relatively weakly applicable to slow denial-of-service attacks because the flow rate of slow attacks is close to that of normal business traffic, the Reynolds number does not change significantly, and it is difficult to identify the attack through flow state judgment.

[0036] The specific implementation steps of the Navier-Stokes flow control algorithm in the scheme are as follows: First, a fluid computation domain is established based on the network topology, mapping each router node to a fluid control volume and the network link to a fluid channel connecting the fluid control volumes; flow rate information is extracted from the high-risk and suspicious flow data obtained in step S02 as the initial condition for the velocity field, and queue length information is extracted as the initial condition for the pressure field; the fluid viscosity coefficient is set as the ratio of network delay to bandwidth; a discretized Navier-Stokes equation is established for each fluid control volume using the finite volume method, wherein the time derivative term is discretized using the backward Euler scheme, the convection term is discretized using the second-order upwind scheme, and the diffusion term is discretized using... The flow is discretized using a central difference scheme; the velocity components and pressure values ​​of each fluid control volume at the next time step are obtained by solving the discrete equations; the Reynolds number of each fluid control volume is calculated; when the Reynolds number exceeds 2300, the flow is considered to be in a turbulent state; the vorticity field is calculated for the turbulent region, and vorticity is defined as the curl of the velocity field; vortex structures are identified through the vorticity field, and regions with an absolute vorticity value greater than the vorticity threshold are identified as vortex centers; the number and intensity of vortex structures are statistically analyzed; when the number of vortex structures exceeds the congestion threshold, the velocity value of the inlet boundary conditions is adjusted through feedback control, and the adjustment amount is proportional to the vortex intensity; the updated inlet boundary condition velocity is used as a flow rate limiting strategy and sent to the flow acquisition node to limit the injection rate of the corresponding data stream.

[0037] The described Navier-Stokes flow control algorithm introduces fluid dynamics-based flow prediction and proactive regulation capabilities to the entire defense scheme. Traditional defense methods typically employ a passive detection and discard strategy, only processing attack traffic after it has entered the network and caused congestion, at which point normal services are already affected. The Navier-Stokes flow control algorithm, by solving the Navier-Stokes equations, can predict the future flow distribution, identifying potential flow anomaly areas before congestion occurs. The Reynolds number, as a dimensionless parameter for distinguishing flow states, simplifies complex flow behavior patterns into two states: laminar and turbulent, providing clear physical criteria for attack detection. The identification of vortex structures locates traffic hotspots and congestion sources in the network, providing spatial guidance for the precise deployment of defense strategies. The proactive flow shaping mechanism, by adjusting inlet boundary conditions, effectively curbs the source of attack traffic, preventing its spread and amplification within the network. The Navier-Stokes flow control algorithm transforms the flow control problem into a numerical solution problem of fluid dynamics equations, utilizing mature computational fluid dynamics methods to ensure the stability and convergence of the control strategy. Compared to purely statistical learning methods, the physical model-based method has stronger interpretability and generalization ability, can adapt to dynamic changes in network traffic patterns, improves the defense system's ability to respond to unknown attacks, and provides strong technical support for ensuring the continuity and availability of network services.

[0038] The threat level score ranges from 0 to 1. Data streams with a threat level score greater than 0.8 are considered high-risk streams, data streams with a threat level score between 0.5 and 0.8 are considered suspicious streams, and data streams with a threat level score less than 0.5 are considered normal streams.

[0039] The steps for obtaining the congestion threshold specifically include: building a test network with the same topology as the actual network in the experimental environment, including traffic acquisition nodes, router nodes, and a target server; injecting flood-type denial-of-service attack traffic of different intensities into the test network, with the attack traffic intensity increasing from 1 Gbit / s to 100 Gbit / s in 1 Gbit / s increments; collecting network operation data for each attack traffic intensity, recording three indicators: router queue length, packet loss rate, and service response latency; calculating the number of vortex structures for each attack traffic intensity using the Navier-Stokes flow control algorithm; and plotting the number of vortex structures and packet loss. The relationship curve of packet loss rate is obtained; the inflection point on the curve where the packet loss rate begins to rise significantly is found, and the number of vortex structures corresponding to the inflection point is used as the initial value of the congestion threshold; the above experimental steps are repeated for different combinations of network bandwidth and router buffer size to establish a mapping table between the congestion threshold and network bandwidth and router buffer size; when the network bandwidth is 10 Gbit / s and the router buffer size is 1048576 bytes, the congestion threshold is found to be 15 vortex structures through experimental data analysis; when the network bandwidth is 100 Gbit / s and the router buffer size is 10485760 bytes, the congestion threshold is found to be 50 vortex structures through experimental data analysis.

[0040] The steps for obtaining the vortex threshold specifically include: collecting vortex field data of all high-risk and suspicious flows during the training of the flow situation prediction model; calculating the statistical distribution characteristics of the vortex field data, including the mean, standard deviation, and percentile of the absolute vortex value; selecting the 95th percentile of the absolute vortex value as the initial value of the vortex threshold; observing the changes in accuracy and recall of vortex structure identification by adjusting the vortex threshold; and using the absolute vortex value corresponding to the maximum value of both accuracy and recall of vortex structure identification as the final vortex threshold.

[0041] The programmable field-programmable gate array (FPGA) chip adopts a pipelined parallel processing architecture, including a packet parsing module, a protocol identification module, a content matching module, and a result output module. The packet parsing module extracts the protocol header fields of each layer; the protocol identification module determines the application layer protocol type based on the protocol header fields; the content matching module uses a content-addressable memory to implement pattern matching, comparing the packet payload with the attack signature in the threat signature database; and the result output module generates a detection result identifier.

[0042] The hierarchical Bloom filter contains a three-layer hash structure. The first layer hash structure is used to quickly determine whether a connection exists. The second layer hash structure is used to distinguish connections of different transport layer protocol types. The third layer hash structure is used to store detailed status information of the connection. The counting data summary structure adopts the minimum counting data summary algorithm, which estimates the packet count and byte count of the connection through multiple independent hash functions and counter arrays. The memory usage is proportional to the logarithm of the number of connections.

[0043] The dynamic graph computation framework employs a graph partitioning algorithm to divide the network traffic topology graph into multiple subgraphs, with each subgraph assigned to an independent computing node for parallel processing. It uses a compressed sparse row format to store the adjacency matrix of the network traffic topology graph, reducing storage overhead. A graph reordering technique is used to store adjacent nodes contiguously in memory, improving cache hit rate. The community detection algorithm uses a label propagation algorithm to identify tightly connected communities in the network traffic topology graph. The abnormal subgraph mining algorithm identifies anomalous attack subgraphs by calculating the density and connectivity indices of the subgraph. Density is defined as the ratio of the number of edges inside the subgraph to the square of the number of nodes, and connectivity is defined as the ratio of the number of edges between the subgraph and the external graph to the number of edges inside the subgraph.

[0044] The set of collaborative attack source nodes contains all source Internet Protocol addresses that participate in the distributed denial-of-service attack. The Internet Protocol addresses corresponding to the nodes in the subgraph obtained by the anomaly subgraph mining algorithm are the collaborative attack source nodes in the set of collaborative attack source nodes.

[0045] The defense strategy includes access control list rules and traffic rate limiting policies. Access control list rules prohibit Internet Protocol addresses from the source node set of coordinated attacks from accessing the protected network. Traffic rate limiting policies limit the maximum transmission rate of suspicious flows. The maximum transmission rate is determined based on network bandwidth and normal business traffic requirements.

[0046] The parameter weight update adopts an incremental learning approach, adding newly identified attack features to the training dataset to fine-tune the traffic situation prediction model online. When updating the parameter weights, the original model parameters are maintained as regularization constraints to avoid catastrophic forgetting.

[0047] The present invention also provides a network control system resistant to denial-of-service attacks, which is implemented by a computer. The computer is provided with a readable storage medium, which stores program instructions. When the program instructions are run on the computer, they can execute the above-described method.

[0048] The specific implementation methods of the above steps are described in detail below.

[0049] The specific implementation of step S01 involves deploying a hardware traffic acquisition node at the network entry point. This hardware traffic acquisition node uses port mirroring technology to copy all data packets passing through the network entry point. Each data packet copy is parsed to extract a five-tuple of information: source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and transport layer protocol type. Simultaneously, the nanosecond-level timestamp of the data packet arrival at the traffic acquisition node is recorded. Based on this five-tuple information, data packets belonging to the same data stream are aggregated. The size of each data stream's data packets, the arrival time interval between adjacent data packets, the status of the Transmission Control Protocol (TCP) flags, and the Shannon entropy of the data packet payload are calculated. These parameters are combined to form an initial traffic feature vector, which has an 8-dimensional dimension. The initial traffic feature vectors of all data streams constitute an initial traffic feature vector set. The purpose of this step is to convert network traffic into a structured numerical feature representation to prepare for subsequent machine learning model input.

[0050] The specific implementation of step S02 involves inputting the initial traffic feature vector set into a pre-trained traffic situation prediction model. The model first standardizes the initial traffic feature vector through an input layer, then sequentially passes it through a first feature extraction layer, a second feature extraction layer, and a third feature extraction layer to extract traffic features at different levels. The first feature extraction layer uses a one-dimensional convolution operation with a convolution window size of 3 to capture short-term traffic mutation patterns. The second feature extraction layer uses bidirectional long short-term memory units with 128 hidden units to learn the temporal dependencies of traffic. The third feature extraction layer uses multi-scale dilated convolutions with dilation rates of 1, 2, and 4 to extract traffic features at different time granularities. The backtracking fusion layer dynamically calculates attention weight coefficients based on three parameters: average packet size, average arrival time interval, and standard deviation of payload entropy. It then weights and sums the output features of the three feature extraction layers to obtain fused features. The decoding prediction layer maps these fused features to threat level scores and traffic evolution trend predictions through two fully connected layers. Based on the comparison between the threat level score and a preset threshold, the data stream is divided into high-risk, suspicious, and normal flows. A threat level score greater than 0.8 is classified as a high-risk flow, a threat level score between 0.5 and 0.8 as a suspicious flow, and a threat level score less than 0.5 as a normal flow. The purpose of this step is to utilize a deep learning model to assess and classify traffic threats, providing a basis for subsequent differentiated processing.

[0051] The specific implementation of step S03 involves using the Navier-Stokes flow control algorithm to model the high-risk and suspicious flows identified in step S02. First, each router node is mapped to a fluid control volume based on the network topology, and network links are mapped to fluid channels connecting these volumes. Flow rate information is extracted from the initial flow feature vectors of the high-risk and suspicious flows as the initial condition for the velocity field, and router queue length information is extracted as the initial condition for the pressure field. The fluid viscosity coefficient is set as the ratio of network delay to bandwidth. The Navier-Stokes equations are discretized using the finite volume method. The time derivative term is discretized using a backward Euler scheme to ensure numerical stability, and the convection term is discretized using a second-order upwind approach. Discretization reduces numerical dissipation, and the diffusion term is discretized using a central difference scheme to maintain computational accuracy. The velocity components and pressure values ​​of each fluid control volume at the next moment are obtained by iteratively solving the discrete equations. The Reynolds number of each fluid control volume is calculated to determine the flow state. The Reynolds number is equal to the velocity magnitude multiplied by the characteristic length divided by the viscosity coefficient. When the Reynolds number exceeds 2300, it is determined to be a turbulent state. The curl of the velocity field in the turbulent region is calculated to obtain the vorticity field. Regions with an absolute vorticity value greater than the vorticity threshold are identified as vortex structures. The number of vortex structures and the vorticity integral intensity of each vortex structure are counted. The purpose of these steps is to predict the evolution trend of flow rate and identify the location of network congestion through fluid dynamics equations, providing a theoretical basis for active flow control.

[0052] The specific implementation of step S04 involves comparing the number of vortex structures calculated in step S03 with the congestion threshold. When the number of vortex structures exceeds the congestion threshold, the network is determined to be in a congested state, requiring the activation of an active traffic shaping mechanism. The congestion threshold is determined based on the network bandwidth and router buffer size. For a network with 10 Gbit / s bandwidth and a 1,048,576-byte buffer, the congestion threshold is set to 15 vortex structures; for a network with 100 Gbit / s bandwidth and a 10,485,760-byte buffer, the congestion threshold is set to 50 vortex structures. The active traffic shaping mechanism calculates the ingress boundary conditions using a feedback control algorithm. The velocity adjustment amount is proportional to the total strength of the vortex structure, and the proportionality coefficient is calibrated experimentally to a reference value of 0.01. The original inlet velocity is subtracted from the velocity adjustment amount to obtain the updated inlet boundary condition velocity. The updated inlet boundary condition velocity is used as a flow rate limiting strategy parameter for high-risk flows and sent to the flow acquisition node. The flow acquisition node performs token bucket rate limiting on the high-risk flows according to the flow rate limiting strategy parameter to reduce their injection rate, so that the network flow state changes from turbulent flow to laminar flow and restores normal transmission order. The purpose of the above steps is to protect the normal operation of the network by actively limiting the injection of attack traffic before congestion occurs.

[0053] The specific implementation of step S05 is as follows: High-risk and suspicious flows after the shaping process in step S04 are used as input traffic. The threat level score, data flow quintuple information, timestamp information, and shaped injection rate parameters output in step S02 are written into the detection task description as the detection context. Deep detection is implemented on the hardware data path side using a pipelined parallel processing architecture of a field-programmable gate array (FPGA) chip. This involves sequentially executing packet parsing, protocol identification, content matching, and result output. In the packet parsing stage, key header fields of the link layer, network layer, transport layer, and application layer are extracted layer by layer. Fragmentation, out-of-order delivery, and retransmission scenarios are reassembled and marked to ensure consistency in subsequent parsing. In the protocol identification stage, a combination of port number, packet direction, session handshake features, and application layer features is used for judgment. When the port number is unavailable or obfuscated, a lightweight discrimination rule based on byte sequence statistical features is introduced to complete the protocol type identification result, thereby ensuring the coverage of the seven-layer protocol parsing. In the content matching stage, the payload data is compared with the attack signature in the threat signature database, using content... The parallel pattern matching principle of addressing memory enables simultaneous retrieval of multiple signatures. The matching objects include flood attack feature payload fragments, protocol feature field combinations of reflection amplification attacks, application layer request fragment features of slow attacks, and sets of abnormal header values. For each matching result, a matching confidence score and a hit signature identifier are generated. In the result output stage, the parsed protocol stack information, matching hit information, and contextual threat level score are fused together to output a detection result identifier, hit signature number, confidence score, and suggested handling flag. The confidence score reference threshold is 0.7. When the confidence score is not less than 0.7, it is judged as a strong hit and enters the attack confirmation candidate set. When the confidence score is between 0.4 and 0.7, it is judged as a weak hit and enters the secondary correlation analysis queue. When the confidence score is less than 0.4, it is only recorded as an abnormal clue. The purpose of this step is to use the hardware parallel parsing and matching capabilities to complete the seven-layer protocol parsing and content-level evidence extraction in high-throughput scenarios, providing a highly reliable detection basis for subsequent connection state updates, attack traffic confirmation, and collaborative source identification, and avoiding misjudgments and omissions caused by relying solely on statistical features.

[0054] The specific implementation of step S06 is as follows: Taking the detection result identifier, hit signature number, confidence level, and data stream 5-tuple information output from step S05 as input, a lookup and update are first performed on the connection state table. The connection state table uses the 5-tuple as the primary key and includes the most recent arrival timestamp, cumulative packet count, cumulative byte count, protocol type, detection hit history, and handling status fields. To reduce storage and query overhead, a layered Bloom filter is introduced for fast judgment of connection existence and protocol routing. The first-layer hash structure uses the 5-tuple hash value to determine whether a connection may exist, and the second-layer hash structure determines whether a connection may exist. Under the premise of further traffic splitting based on transport layer protocol type, the third-layer hash structure points to the detailed state index of the connection to support fine-grained state maintenance, and the Bloom filter's tolerable false positives but no false negatives ensure fast passage under high concurrency; at the same time, a counting data summary structure is used to maintain connection count information. The counting data summary structure uses the minimum count data summary algorithm, which uses multiple independent hash functions to map to a counter array to estimate the packet count and byte count, so that the memory usage remains proportional to the logarithm of the number of connections when the connection scale increases suddenly; when step S05 determines that it is a strong hit and a threat When the signature comparison results show that the hit signature belongs to the confirmed attack type, the corresponding connection handling status is set to drop, and the drop operation is performed on the traffic collection node side. The drop execution can adopt a combination strategy of precise drop by five-tuple and aggregate drop by source Internet Protocol address. Among them, when the same source Internet Protocol address triggers strong hits no less than 3 times within a 1-second time window, aggregate drop is initiated to improve handling efficiency. When it is determined to be a weak hit, the connection is set to rate limiting or observation status, and the rate and queue change trend estimated by the count-type data summary structure are written into the connection status for subsequent correlation. For Bloom filters To mitigate potential misjudgments, an aging mechanism based on the connection's most recent activity time is introduced to reclaim the third-layer detailed state index. The aging reference threshold is set to 60 seconds, meaning that if no valid data packets arrive within 60 seconds, the corresponding detailed state is released and the count digest is updated synchronously. The purpose of this step is to maintain massive connection states and statistical summaries with a low-overhead data structure, transforming the content-level detection evidence from step S05 into executable connection handling decisions. This enables the rapid discarding of confirmed attack connections and the continuous tracking of suspicious connections, providing structured state data and a stable handling baseline for subsequent collaborative source identification in graph computation.

[0055] The specific implementation of step S07 is as follows: The attack features recorded in step S06 and the abnormal connection set in the connection state table are input into the dynamic graph computation framework. The attack features include at least a 5-tuple, timestamp sequence, hit signature number, confidence level, estimated packet rate, estimated byte rate, and handling status. In the graph construction phase, Internet Protocol addresses, ports, and sessions are used as nodes, and communication behavior is used as edges. Edge attributes include the number of interactions within the time window, cumulative bytes, average arrival time interval, load entropy statistics, and hit signature distribution, thereby forming a network traffic topology graph that slides and updates over time. To adapt to high throughput and low latency requirements, a graph partitioning algorithm is used to divide the topology graph into multiple subgraphs according to nodes and distribute them to independent computing nodes for parallel processing. The adjacency matrix is ​​stored in a compressed sparse row format to reduce storage overhead, and a graph reordering technique is used to store highly correlated adjacent nodes continuously in memory to improve cache hit rate. In the community detection phase, a label propagation algorithm is used to identify tightly connected communities. Through iterative propagation, node labels converge to local high-density connection groups, thereby obtaining potential cooperative groups. In the abnormal In the subgraph mining phase, density and connectivity indices are calculated for each subgraph. Density is defined as the ratio of the number of internal edges to the square of the number of nodes in the subgraph, and connectivity is defined as the ratio of the number of edges between the subgraph and the external graph to the number of internal edges in the subgraph. These indices are used to identify anomalous attack subgraphs that simultaneously satisfy high density and high external connectivity. A density reference threshold of 0.6 and a connectivity reference threshold of 0.8 are used. Subgraphs with a density not less than 0.6 and a connectivity not less than 0.8 are considered anomalous attack subgraphs. Source node extraction is performed on the node set of the identified anomalous attack subgraphs. The corresponding set of source Internet Protocol addresses in the subgraph is the set of collaborative attack source nodes. This set is cross-validated with the strong hit records from step S06. When the cross-validation consistency is not less than 0.7, the confidence of the source nodes is increased and they are included in the high-priority handling list. The purpose of this step is to use dynamic graph computation and graph mining principles to elevate discrete connection-level anomaly evidence to evidence of group collaborative structure, identify the collaborative attack source node set of distributed denial-of-service attacks, solve the problem that single-point detection cannot reveal multi-source collaborative relationships, and provide interpretable attack source sets and propagation path clues for subsequent strategy generation.

[0056] The specific implementation of step S08 is as follows: Taking the set of collaborative attack source nodes, source node confidence, and statistical indicators of the abnormal subgraph output in step S07 as input, a set of defense strategies is first generated. The defense strategies include two parts: access control list rules and traffic rate limiting strategies. The access control list rules deny access to high-confidence source nodes according to the source Internet Protocol address dimension. The reference threshold for the duration of the denial is 300 seconds. After the expiration, the renewal is determined based on the number of re-offenses by the source node in the most recent 300-second window. The reference threshold for triggering the renewal is that the number of re-offenses is not less than 2. The traffic rate limiting strategy targets suspicious flows and low-confidence source nodes. The system implements rate cap control, with the rate cap determined based on network bandwidth and normal business needs. A reference value is 10% to 30% of the available link bandwidth. If the traffic evolution trend predicted in step S02 indicates an increasing risk of congestion, the cap is lowered to 10%. If the trend indicates a decreasing risk and normal business is restricted, the cap is widened to 30%. Subsequently, access control list rules and rate limiting parameters are distributed to each traffic collection node and take effect at the ingress point. At the ingress point, execution is performed using a dual-granularity matching of the five-tuple and the source Internet Protocol address to ensure both precise targeting of single-connection attacks and suppression of multi-connection concurrent attacks. The threat signature database is updated. In the initial stage, newly identified attack signatures, hit signature combination patterns, abnormal subgraph structure features, and high-confidence source node profiles are written into the feature library. Each feature is accompanied by an effective time window and a confidence field, with a confidence reference threshold of 0.8. Features below 0.8 are only used for auxiliary judgment and do not directly trigger strong actions. In the traffic situation prediction model parameter weight update stage, an incremental learning approach is adopted. After aligning the confirmed attack samples and corresponding negative samples from the current defense cycle, they are added to the training dataset, and the model is fine-tuned online. During fine-tuning, the original model parameters are maintained as regularization constraints to reduce the risk of catastrophic forgetting. The learning rate for online fine-tuning is referenced... The value ranges from 0.0001 to 0.0005, and the number of fine-tuning rounds is estimated to be between 5 and 20 rounds. After fine-tuning, the change in loss of the most recent verification window is used as the criterion for whether to roll back. When the increase in loss of the verification window exceeds 0.05, the system rolls back to the previous version of the parameters. The purpose of this step is to transform the collaborative source identification results into executable entry protection rules and rate control strategies, realize the implementation of the defense closed-loop strategy, and improve the system's continuous adaptability to new variant attacks through the linkage update of feature library and model parameters. This enables subsequent cycles to complete network control against denial-of-service attacks with higher accuracy and lower response latency.

[0057] It should be noted that the key technical ideas of this invention include a multi-layer feature extraction backtracking mechanism, a flow control algorithm based on the Navier-Stokes equations, and a collaborative defense using a dynamic graph computation framework. The multi-layer feature extraction backtracking mechanism, by retaining feature representations at different levels and adaptively fusing them, enables the flow situation prediction model to simultaneously capture both micro-level mutations and macro-level trends in flow. Compared to traditional single-layer feature extraction methods, it significantly improves the accuracy of identifying multiple attack types and the generalization ability to unknown attack variants, solving the problem that traditional methods struggle to detect both short-term burst attacks and long-term slow attacks. The flow control algorithm based on the Navier-Stokes equations abstracts network traffic as fluid motion, predicting the future evolution of flow by solving fluid dynamics equations. Compared to traditional passive detection methods, it achieves early warning and proactive defense against congestion. By determining the flow regime and vortex structure through Reynolds number analysis, it identifies the source of congestion, providing a physical basis for precise rate limiting and avoiding the false positives of traditional methods on normal flow. The synergy between the multi-layer feature extraction backtracking mechanism and the Navier-Stokes flow control algorithm lies in the fact that the former provides accurate threat assessment results to guide the latter to differentiate traffic of different threat levels, and the latter's flow control results are fed back to optimize the model parameters of the former, forming a closed-loop defense system of detection-control-optimization. Compared with the single defense methods of existing technologies, it has stronger adaptability and robustness and can cope with complex and ever-changing distributed denial-of-service attack scenarios.

[0058] It should be noted that this invention also solves the following technical problem: existing technologies struggle to accurately identify different attack types in hybrid distributed denial-of-service (DDoS) attacks and implement targeted defenses. This invention addresses this by employing a multi-layer feature extraction and backtracking mechanism in a traffic situation prediction model. The first feature extraction layer uses a one-dimensional convolutional kernel to extract temporal local patterns and capture peak traffic features of sudden flooding attacks. The second feature extraction layer uses bidirectional long short-term memory units to capture long-term dependencies and identify low-rate anomaly patterns in persistent slow attacks. The third feature extraction layer uses multi-scale dilated convolution to expand the receptive field and integrate traffic behavior patterns at different time granularities. The feature backtracking fusion layer dynamically adjusts the feature weights of each layer based on average packet size, average arrival time interval, and the standard deviation of payload entropy. This enables the model to simultaneously identify multiple attack types, including synchronous flooding attacks, UDP flooding attacks, Transmission Control Protocol (TCP) connection exhaustion attacks, application layer slow attacks, and distributed reflection amplification attacks. Combined with a dynamic graph computation framework, community detection and anomaly subgraph mining identify collaborative attack source node sets, generating targeted defense strategies for different attack types.

[0059] Furthermore, this invention addresses the technical problem in existing technologies where it is difficult to maintain a low false alarm rate while simultaneously ensuring generalized recognition capabilities against unknown attack variants. This invention establishes a positive sample set containing five attack types and a negative sample set of normal business traffic by collecting six months of real-world network traffic data during the training of the traffic situation prediction model. It employs a cross-entropy loss function and a mean squared error loss function to jointly optimize threat level classification and trend prediction tasks. An adaptive moment estimation optimization algorithm is used to update model parameters, and an early stopping mechanism is employed to avoid overfitting. The attention weighting mechanism of the feature backtracking fusion layer adaptively adjusts the fusion weights of features from different layers based on traffic feature parameters, without relying on a specific attack signature. This allows the model to learn the essential behavioral patterns of attack traffic rather than superficial features. Combined with incremental learning, newly identified attack features are added to the training dataset for online fine-tuning while maintaining the original model parameters as a regularization constraint to avoid catastrophic forgetting, thus improving the adaptability of the defense system to unknown attack variants.

[0060] Specifically, the principle of this invention is as follows: The invention solves the aforementioned technical problems by organically integrating the flow situation prediction capability of deep learning with the physical control model of fluid mechanics, forming a prediction-control closed-loop mechanism. The flow situation prediction model, through a multi-layer feature extraction and backtracking mechanism, can capture flow behavior patterns at different time scales. The local temporal pattern features extracted by the first feature extraction layer are sensitive to sudden flooding attacks; the long-term dependency features extracted by the second feature extraction layer can detect persistent slow attacks; the multi-scale receptive field features extracted by the third feature extraction layer integrate flow behavior at different time granularities; and the feature backtracking fusion layer adaptively adjusts the feature weights of each layer according to the flow feature parameters, enabling the model to accurately identify different types of attacks and predict flow evolution trends. The Navier-Stokes flow control algorithm, based on fluid dynamics principles, maps flow rate, network bandwidth, and queue backlog to velocity, pipe cross-sectional area, and pressure fields, respectively. It uses the finite volume method to numerically solve the Navier-Stokes equations, revealing the spatiotemporal evolution of flow. The Reynolds number, as a dimensionless parameter for distinguishing flow states, simplifies complex flow behavior into laminar and turbulent states. The identification of vortex structures pinpoints network congestion sources, and the active flow shaping mechanism curbs these sources by adjusting inlet boundary conditions. This predictive-control mechanism enables the defense system to identify high-risk flows in the early stages of an attack based on situational predictions, limiting them to safe levels before they enter the network through fluid dynamics control, thus preventing the formation and spread of congestion.

[0061] The following provides a specific embodiment 1 of the present invention, and the specific implementation of each step in this embodiment 1 is described in detail below.

[0062] The specific implementation of step S01 involves deploying a traffic collection node at the network ingress to collect all data packets entering the network and extracting the 5-tuple information and timestamp information to establish an initial traffic feature vector set. The 5-tuple information includes the source Internet Protocol address, destination Internet Protocol address, source port number, destination port number, and transport layer protocol type. The timestamp information records the precise time the data packet arrives at the network ingress, using nanosecond-level time precision. Each vector in the initial traffic feature vector set... Represented as: In the formula, For the first Feature vectors of data packets; For the first The size of each data packet, in bytes; For the first The time interval between the arrival of each data packet and the previous data packet is expressed in milliseconds. For the first The status of the transmission control protocol flags of each data packet is represented by 8-bit binary encoding; For the first The payload entropy value of each data packet, a dimensionless parameter; Data packet number. Payload entropy value. The calculation formula is: In the formula, The byte value in the payload The probability of , a dimensionless parameter; The value for a byte is 1 to 256; this formula is obtained by dividing by... Normalization is performed to ensure that the entropy value is between 0 and 1.

[0063] The specific implementation of step S02 involves inputting the initial traffic feature vector set into the traffic situation prediction model, outputting a threat level score and a traffic evolution trend prediction value for each data stream, and classifying the data streams into three categories based on the threat level score: high-risk streams, suspicious streams, and normal streams. Threat Level Score The range is 0 to 1, a dimensionless parameter, when It was determined to be a high-risk flow at that time. When it is judged as a suspicious flow, when The flow is judged to be normal. The flow situation prediction model adopts a deep encoder-decoder architecture with a multi-layer feature extraction backtracking mechanism, including an input layer, three feature extraction layers, a feature backtracking fusion layer, two decoding prediction layers, and an output layer. The model training uses the He Kaiming initialization method to initialize parameters, with a batch size of 128, a learning rate of 0.001, and 200 training epochs. The attention weight coefficients in the feature backtracking fusion layer are based on the average packet size of the data stream. Average arrival time interval and the standard deviation of load entropy value Confirmed, when byte and Increase the weights of the first feature extraction layer in milliseconds. Increase the weights of the second feature extraction layer when byte and Increase the weight of the third feature extraction layer. It is obtained by taking the arithmetic mean of the sizes of all data packets in the data stream, in bytes; It is obtained by calculating the arithmetic mean of the time intervals between all adjacent data packets in the data stream, in milliseconds; Dimensionless parameter obtained by calculating the standard deviation of the entropy values ​​of all data packet payloads in the data stream.

[0064] The specific implementation of step S03 involves using the Navier-Stokes flow control algorithm to calculate the fluid velocity field distribution and pressure gradient distribution for high-risk and suspicious flows, determining the flow state based on the Reynolds number, and identifying the location of vortex structures. The network flow is analogized to a fluid system, and the discretized Navier-Stokes equations are used for solving them. The parameters in the equations are calibrated to adapt to the network environment. The discrete equation for velocity field update is: In the formula, For the first The flow velocity field vector at the time step represents the distribution of flow transmission rates at different nodes in the network, in megabits per second. For the first The flow velocity field vector at the time step, in megabits per second; This is the time step, measured in seconds, and is typically set to 0.01 seconds. This is a discrete gradient operator, measured in meters. For the first The pressure field at a time step represents the queue length at a network node, expressed in the number of data packets. This is the equivalent density parameter, a dimensionless parameter, with an empirical value of 1; The equivalent kinematic viscosity coefficient, expressed in square meters per second, was obtained through experimental calibration. Numbering the discrete time steps. Equivalent kinematic viscosity coefficient. The acquisition steps include: injecting traffic of known strength into the test network and measuring the network's response time. and effective bandwidth ,pass The calculation yielded, where This is a unit conversion factor, with units of square meters per megabit, and an empirical value of [value missing]. square meters per megabit; Network latency, measured in seconds; Effective bandwidth, measured in megabits per second; The reference density is a dimensionless parameter with an empirical value of 1. The first term on the right-hand side of the equation represents the convection term, with dimensions in megabits per second divided by seconds, i.e., megabits per square second; the second term represents the pressure gradient term, which is obtained by... Divide by Multiplying by the gradient operator, the result, after parameter calibration, has a dimension of megabits per square second; the third term represents the viscous diffusion term. The units are square meters per second multiplied by square meters multiplied by megabits per second, i.e., megabits per square second; through the above parameter definition and calibration, the units of all terms on the right-hand side of the equation are unified to megabits per square second, consistent with the acceleration term on the left-hand side. The dimensions are consistent. Reynolds number. The calculation formula is: In the formula, This is the characteristic value of the traffic rate, in megabits per second, taken as the current average network traffic rate; The characteristic length of the network link, in meters, is the typical node spacing in the network topology; when When the flow is determined to be turbulent, The flow is determined to be laminar. (Vortex field) Defined as the curl of the velocity field, the formula for calculation is: In the formula, This represents the vortex field vector, measured in seconds. Vortex structures are identified by determining the absolute value of the vortex. Is it greater than the vorticity threshold? Achieve, when At that time, this area was determined to be the center of the vortex, in which The vorticity threshold, measured per second, is obtained by collecting vorticity field data of high-risk and suspicious flows during training and calculating the 95th percentile of the absolute value of the vorticity.

[0065] The specific implementation of step S04 involves activating an active flow shaping mechanism when the number of vortex structures exceeds a congestion threshold. This mechanism adjusts the inlet boundary conditions to limit the injection rate of high-risk flows, thereby changing the flow state from turbulent to laminar. (Number of vortex structures) The statistics are obtained by traversing the computation domain to satisfy the following conditions. The controlled volume quantity is obtained under certain conditions. This is a dimensionless count value. The congestion determination criterion is... In the formula, This is a congestion threshold, a dimensionless parameter. An empirical value of 15 is given when the network bandwidth is 10 Gbit / s and the router buffer size is 1048576 bytes; an empirical value of 50 is given when the network bandwidth is 100 Gbit / s and the router buffer size is 10485760 bytes. (Ingress boundary condition speed adjustment amount) The calculation formula is: In the formula, This is the feedback control gain coefficient, measured in megabits per second, with an empirical value of 0.1 megabits per second. The vortex structures are numbered, ranging from 1 to ; For the first The vorticity value at the center of each vortex structure, in units of per second; This is a reference vorticity value, measured in seconds, and is typically taken as the vorticity threshold. Dimensionless vortex quantity is achieved by dividing the vortex value of each vortex by the reference vortex value. The summation is then multiplied by the gain coefficient to obtain the adjustment amount, with dimensions in megabits per second. Updated inlet velocity. The calculation is as follows: In the formula, The input speed before adjustment, in megabits per second; The adjusted ingress rate is expressed in megabits per second.

[0066] The specific implementation method of step S05 is the same as described above, and will not be repeated in detail here.

[0067] The specific implementation of step S06 involves updating the connection state table based on the comparison results, maintaining connection state information using a hierarchical Bloom filter and a counting data summary structure, dropping connections identified as attack traffic, and recording attack characteristics. The minimum count data summary algorithm estimates the packet count of the connection. The calculation is as follows: In the formula, The number of independent hash functions, a dimensionless parameter, with an empirical value of 4; For the first The first counter array of the nth counter array Each counter value represents a data packet count; it is a dimensionless parameter. For the first Each hash function pairs the connection identifier. The hash value, a dimensionless parameter; This is a connection identifier, containing 5-tuple information; This is an operation to retrieve the minimum value; The hash function is numbered, ranging from 1 to... ; The index of the counter array.

[0068] The specific implementation of step S07 involves inputting attack characteristics into a dynamic graph computation framework, constructing a network traffic topology graph, performing community detection and anomaly subgraph mining, and identifying the set of collaborative attack source nodes for distributed denial-of-service attacks. The density of the anomaly subgraph... The calculation formula is: In the formula, The number of edges inside the subgraph is a dimensionless parameter. The number of nodes in the subgraph is a dimensionless parameter; it is normalized by dividing the number of edges by the square of the number of nodes. This is a dimensionless density parameter. The connectivity between the subgraph and the outside world. The calculation formula is: In the formula, The number of edges between the subgraph and the outer graph is a dimensionless parameter. This is a dimensionless connectivity parameter. The criterion for determining anomaly subgraphs is... and In the formula, This is the density threshold, a dimensionless parameter with an empirical value of 0.6. The connectivity threshold is a dimensionless parameter with an empirical value of 0.3.

[0069] The specific implementation of step S08 involves generating a defense strategy based on the set of collaborative attack source nodes and distributing it to each traffic collection node, updating the parameter weights of the threat signature database and the traffic situation prediction model, and completing one full defense cycle. The maximum transmission rate of suspicious flows. The calculation formula is: In the formula, Total network bandwidth, measured in megabits per second; Bandwidth required for normal business traffic, in megabits per second; The number of suspicious flows is a dimensionless parameter. The unit is megabits per second. Parameter weight updates use an incremental learning method, with new model parameters... The calculation formula is: In the formula, These are the parameters of the old model, a dimensionless vector. The updated model parameters are dimensionless vectors. The learning rate is a dimensionless parameter with an empirical value of 0.001. For loss function For parameters The gradient vector, and The same dimension is dimensionless; is the regularization coefficient, a dimensionless parameter, with an empirical value of 0.01; The initial model parameters are dimensionless vectors used to prevent catastrophic forgetting; the three terms on the right-hand side of the formula are also dimensionless vectors with uniform dimensions.

[0070] To better understand and implement this invention, a specific application scenario of the invention is provided below as Example 2: To verify the effectiveness of the invention, technicians built a test environment to evaluate the performance of the defense system by simulating a distributed denial-of-service attack scenario in a real network environment. The test environment included 10 traffic collection nodes, 5 core routers, 3 target servers, and 50 attack simulation hosts. The network bandwidth was set to 10 Gbit / s, and the router buffer size was 1,048,576 bytes. The test dataset used real network traffic data collected from July 2024 to January 2025, totaling approximately 320 million data packets, of which normal business traffic accounted for 78% and various attack traffic accounted for 22%.

[0071] Technicians first deployed traffic acquisition nodes at the network ingress and configured a packet acquisition program to extract the five-tuple information and timestamp information of each packet. As shown in Table 1, the statistical information of the feature parameters contained in the initial traffic feature vector set reflects the basic characteristic differences of different types of traffic. Table 1 shows that the average packet size of the synchronous flooding attack is 40 bytes, significantly smaller than the average packet size of normal traffic (512 bytes), and the arrival time interval is only 5 milliseconds, far lower than the 50 milliseconds of normal traffic. The load entropy value is 0.15, indicating that the payload content of the attack traffic lacks randomness. The average packet size of the User Datagram Protocol (UDP) flooding attack is 64 bytes, the arrival time interval is 8 milliseconds, and the load entropy value is 0.22. The Transmission Control Protocol (TCP) connection exhaustion attack is characterized by frequent connection establishment but no data transmission, with an average packet size of 60 bytes, an arrival time interval of 15 milliseconds, and a load entropy value of 0.18. The average packet size of the application layer slow attack is 256 bytes, the arrival time interval is 200 milliseconds, and the load entropy value is 0.65; its traffic characteristics are closer to normal traffic. Distributed reflection amplification attacks amplify traffic by using public servers, with an average packet size of 1200 bytes, an arrival time interval of 12 milliseconds, and a load entropy of 0.48.

[0072] Table 1. Statistical table of characteristic parameters for different types of flow

[0073] Technicians input the initial traffic feature vector set into a pre-trained traffic situation prediction model, which employs a deep encoder-decoder architecture with a multi-layer feature extraction backtracking mechanism. The training set used during model training contains 2.1 million normal traffic samples and 700,000 attack traffic samples, while the validation set contains 900,000 normal traffic samples and 300,000 attack traffic samples. Model parameters were initialized using the He Kaiming initialization method, with a batch size of 128, a learning rate of 0.001, and 200 training epochs. As shown in Figure 2, the first feature extraction layer uses a one-dimensional convolution with a kernel size of 3 to extract temporal local patterns; the second feature extraction layer uses bidirectional long short-term memory units containing 256 hidden units to capture long-term dependencies; and the third feature extraction layer uses multi-scale dilated convolutions with dilation rates of 2, 4, and 8 to expand the receptive field. The feature backtracking fusion layer dynamically adjusts the feature weights of each layer based on traffic characteristic parameters. When the average packet size is less than 64 bytes and the average arrival time interval is less than 10 milliseconds, the weight coefficient of the first feature extraction layer increases from 0.3 to 0.6. When the standard deviation of the load entropy value is less than 0.3, the weight coefficient of the second feature extraction layer increases from 0.3 to 0.5. When the average packet size is between 512 bytes and 1500 bytes and the standard deviation of the load entropy value is greater than 0.7, the weight coefficient of the third feature extraction layer increases from 0.4 to 0.6. The model outputs a threat level score ranging from 0 to 1. Data flows with a score greater than 0.8 are classified as high-risk flows, data flows with a score between 0.5 and 0.8 are classified as suspicious flows, and data flows with a score less than 0.5 are classified as normal flows. On the test dataset, the model identified 45,000 high-risk flows, 28,000 suspicious flows, and 627,000 normal flows.

[0074] Technicians further analyzed the identified high-risk and suspicious flows using the Navier-Stokes flow control algorithm. A fluid computation domain was established based on the network topology, mapping 10 flow acquisition nodes and 5 core routers to 15 fluid control volumes, with network links mapped as fluid channels connecting these volumes. Flow rate information was extracted from the high-risk and suspicious flow data as initial conditions for the velocity field, and router queue length information was extracted as initial conditions for the pressure field. The fluid viscosity coefficient was set as the ratio of a network latency of 10 milliseconds to a bandwidth of 10 Gbit / s, and the viscosity coefficient was calculated. A discretized Navier-Stokes equation was established for each fluid control volume using the finite volume method, with a time step of 1 millisecond and a spatial grid step of 100 meters. As shown in Figure 3, the discrete equations were solved to obtain the velocity components and pressure values ​​for each fluid control volume, and the Reynolds number for each fluid control volume was calculated. Under normal flow conditions, the average Reynolds number is 850, and the flow exhibits a laminar state. When a synchronous flooding attack occurs, the injection of the attack flow causes the velocity of the fluid control volume at the inlet to surge from 1.2 Gbit / s to 8.5 Gbit / s, and the Reynolds number to rapidly increase from 850 to 5800, exceeding the critical value of 2300, and the flow transitions to a turbulent state. Technicians calculate the vorticity field; vorticity is defined as the curl of the velocity field, and the vorticity threshold is set to 2.5 × Every second. Vortex structures were identified using vortex fields. 23 vortex structures were detected in the early stages of the attack, exceeding the congestion threshold of 15.

[0075] When the number of vortex structures exceeds the congestion threshold, technicians initiate an active flow shaping mechanism. Feedback control adjusts the velocity value of the inlet boundary conditions; the adjustment amount is proportional to the vortex intensity, defined as the maximum absolute value of the vortex volume. After detecting 23 vortex structures, the system calculates that the inlet velocity needs to be reduced from 8.5 Gbit / s to 2.8 Gbit / s, and the rate-limiting policy is issued to the corresponding flow acquisition nodes to restrict the injection rate of high-risk flows. After 150 milliseconds of adjustment, the Reynolds number decreases from 5800 to 1650, the flow state changes from turbulent to laminar, the number of vortex structures decreases to 3, and the queue length decreases from 928576 bytes to 125840 bytes. As shown in Figure 4, the active flow shaping mechanism effectively suppresses the injection of attack traffic and avoids network congestion.

[0076] Technicians performed hardware-level deep inspection on the traffic after it underwent shaping, employing a programmable field-programmable gate array (FPGA) chip to perform seven-layer protocol parsing and content matching. The chip utilizes a pipelined parallel processing architecture, including a packet parsing module, a protocol identification module, a content matching module, and a result output module. The packet parsing module extracts the header fields of each protocol layer within 5 nanoseconds. The protocol identification module determines the application layer protocol based on the port number and protocol type. The content matching module uses a content-addressable memory containing 8192 rules to perform pattern matching, comparing the packet payload with attack signatures in a threat signature database. The detection results showed that out of 73,000 high-risk and suspicious flows, 68,500 connections were confirmed as attack traffic, resulting in a false positive rate of 6.2% and a false negative rate of 2.8%.

[0077] Technicians updated the connection status table based on the detection results, using a hierarchical Bloom filter and a counting data summary structure to maintain connection status information. The hierarchical Bloom filter comprises three hash structures: the first layer uses three hash functions to determine the existence of a connection with a false positive rate of 0.01; the second layer uses five hash functions to distinguish connections from different transport layer protocol types; and the third layer uses seven hash functions to store detailed connection status information. The counting data summary structure employs a minimum count data summary algorithm, using four independent hash functions and a counter array containing 16,384 counters to estimate the packet and byte counts of the connection, with a memory footprint of 512KB. 68,500 connections identified as attack traffic were dropped, and the attack characteristics were recorded in the threat signature database. These characteristics included the source Internet Protocol address, attack type, attack strength, and attack duration.

[0078] Technicians input attack characteristics into a dynamic graph computation framework to construct a network traffic topology graph. The topology graph contains 1250 nodes, where nodes represent Internet Protocol addresses (IPAs), edges represent data flow connections, and edge weights are determined by traffic volume. A minimum edge-cut-based graph partitioning algorithm divides the network traffic topology graph into eight subgraphs, each assigned to an independent computation node for parallel processing. As shown in Figure 5, a label propagation algorithm is used for community detection, identifying 12 tightly connected communities. An anomaly subgraph mining algorithm is used to calculate the density and connectivity indices of the subgraphs. Density is defined as the ratio of the number of edges within a subgraph to the square of the number of nodes, and connectivity is defined as the ratio of the number of edges between the subgraph and the external graph to the number of edges within the subgraph. Three anomaly subgraphs were detected, with densities all greater than 0.75 and connectivity all less than 0.15, indicating high internal node coordination and isolation from the external environment. The 385 IPA addresses contained in these anomaly subgraphs constitute a set of coordinated attack source nodes.

[0079] Technical personnel generated a defense strategy based on the set of coordinated attack source nodes. This strategy included access control list rules and traffic rate limiting. The access control list rules prohibited 385 coordinated attack source Internet Protocol addresses from accessing the protected network. The traffic rate limiting strategy restricted the maximum transmission rate of suspicious flows to 1.5 times the average rate of normal business traffic, i.e., 750 Mbit / s. The defense strategy was distributed to 10 traffic collection nodes, and the threat signature database was updated simultaneously, adding 68,500 new attack signatures. An incremental learning approach was used to fine-tune the traffic situation prediction model online. Newly identified attack features were added to the training dataset, the number of training epochs was set to 20, the learning rate was reduced to 0.0001, and the original model parameters were maintained as regularization constraints with a regularization coefficient of 0.01 to avoid catastrophic forgetting. The updated model improved its threat level classification accuracy on the new validation set from 92.5% to 94.8%, and reduced the mean squared error of trend prediction from 0.035 to 0.028.

[0080] The advancement of this invention over traditional defense methods lies in the introduction of a dual mechanism of traffic situation prediction and proactive control. Traditional defense systems employ a passive detection and discard strategy, only identifying and processing attack traffic after it has entered the network and caused queue backlog. At this point, the network device's buffer is nearing saturation, and the transmission latency of normal service traffic has significantly increased. This invention, through a traffic situation prediction model, can identify high-risk and suspicious flows in the early stages of an attack based on the statistical characteristics of traffic feature vector sets, and predict the evolution trend of traffic, providing a basis for subsequent proactive control decisions. The Navier-Stokes flow control algorithm maps flow dynamics to a fluid dynamics model. By solving the Navier-Stokes equations, it can predict the future flow distribution and pressure gradient distribution. The Reynolds number, as a physical parameter for discriminating flow states, can quantify the degree of traffic congestion, and the identification of vortex structures accurately locates traffic hotspots in the network. The proactive traffic shaping mechanism, by adjusting the ingress boundary conditions, achieves source containment of attack traffic, completing rate limiting and smoothing before the traffic spreads to core network devices, preventing congestion from propagating deeper into the network, and protecting the quality of service of critical service traffic. The dynamic graph computation framework identifies the set of collaborative attack source nodes for distributed denial-of-service attacks through community detection and abnormal subgraph mining, providing spatial guidance for the precise deployment of defense strategies and improving the defense system's ability to respond to distributed attacks. The incremental learning mechanism enables the traffic situation prediction model to continuously learn new attack patterns, enhancing the system's generalization ability and adaptability to unknown attack variants.

[0081] It should be noted that the variables involved in this invention are explained in detail in Table 2.

[0082] Table 2 Variable Explanation Table

[0083] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A network control method for resisting denial-of-service attacks, characterized in that, Traffic acquisition nodes are deployed at the network ingress to collect all incoming data packets and extract quintuple and timestamp information to establish an initial traffic feature vector set. This initial feature vector set is then input into a traffic situation prediction model, which outputs a threat level score and traffic evolution trend prediction value for each data stream. Based on the threat level score, data streams are categorized into three types: high-risk, suspicious, and normal. For high-risk and suspicious streams, the Navier-Stokes flow control algorithm is used to calculate the fluid velocity field distribution and pressure gradient distribution. The Reynolds number is used to determine the flow state and identify the location of vortex structures. When the number of vortex structures exceeds the congestion threshold, an active flow shaping mechanism is activated to adjust the flow path. The inlet boundary conditions limit the injection rate of high-risk flows, causing the flow state to change from turbulent to laminar. After the flow has been shaped, hardware-level deep detection is performed on the flow, and the detection results are compared with the threat signature database. Based on the comparison results, the connection state table is updated, and connections identified as attack traffic are dropped and attack characteristics are recorded. The attack characteristics are input into a dynamic graph computing framework to construct a network traffic topology graph and perform community detection and abnormal subgraph mining to identify the set of cooperative attack source nodes for distributed denial-of-service attacks. Based on the set of cooperative attack source nodes, a defense strategy is generated and distributed to each traffic collection node to update the parameter weights of the threat signature database and the traffic situation prediction model.

2. The network control method against denial-of-service attacks according to claim 1, characterized in that, The five-tuple information includes the source Internet Protocol address, the destination Internet Protocol address, the source port number, the destination port number, and the transport layer protocol type.

3. The network control method against denial-of-service attacks according to claim 2, characterized in that, Each vector in the initial traffic feature vector set contains the packet size, arrival time interval, transmission control protocol flag status, and payload entropy value.

4. The network control method against denial-of-service attacks according to claim 3, characterized in that, The traffic situation prediction model adopts a deep encoder-decoder architecture with a multi-layer feature extraction backtracking mechanism, which includes an input layer, three feature extraction layers, a feature backtracking fusion layer, two decoding prediction layers, and an output layer.

5. The network control method for resisting denial-of-service attacks according to claim 4, characterized in that, The first feature extraction layer uses a one-dimensional convolution kernel to extract temporal local patterns, the second feature extraction layer uses bidirectional long short-term memory units to capture long-term dependencies, and the third feature extraction layer uses multi-scale dilated convolution to expand the receptive field.

6. The network control method for resisting denial-of-service attacks according to claim 5, characterized in that, The feature backtracking fusion layer fuses the features extracted by the three feature extraction layers through an attention weighting mechanism, and the weight coefficients are dynamically adjusted according to the importance of the features.

7. The network control method against denial-of-service attacks according to claim 6, characterized in that, The attention weighting coefficient is determined based on three parameters: average packet size, average arrival time interval, and standard deviation of load entropy.

8. The network control method against denial-of-service attacks according to claim 7, characterized in that, The training dataset for the traffic situation prediction model is established by collecting six months of traffic data in a real network environment. It includes traffic samples from synchronous flooding attacks, UDP flooding attacks, Transmission Control Protocol connection exhaustion attacks, application layer slow attacks, and distributed reflection amplification attacks as positive sample sets.

9. The network control method against denial-of-service attacks according to claim 8, characterized in that, The traffic situation prediction model training uses the cross-entropy loss function to measure the threat level classification error, the mean squared error loss function to measure the trend prediction deviation, and the adaptive moment estimation optimization algorithm to update the model parameters.

10. The network control method against denial-of-service attacks according to claim 9, characterized in that, The Navier-Stokes flow control algorithm analogizes network flow to an incompressible viscous fluid, uses the Navier-Stokes equations to describe the evolution of flow in time and space, and obtains the velocity field distribution and pressure field distribution through numerical solution using the finite volume method.

Images