Carpet type DDoS attack detection system based on address-behavior traffic decomposition

Abstract

The invention discloses a carpet type DDoS attack detection system based on address-behavior traffic decomposition, and the system is characterized in that an offline multi-scale dictionary learning module learns a multi-scale behavior template dictionary based on historical benign network traffic, and builds a cross-IP baseline activation standard and an anomaly detection threshold value of each behavior template; the online rapid decomposition module decomposes the real-time network traffic by using the behavior template dictionary, calculates the activation intensity of each IP address on each behavior template and generates a real-time activation matrix; and the collaborative anomaly detection module calculates abnormal activation conditions of the behavior template on a plurality of IP addresses based on the real-time activation matrix, and performs joint judgment through spatial diffusion and total intensity to identify carpet DDoS attacks and output an attacked IP address list. According to the method, efficient identification of cross-IP collaborative abnormal traffic is realized, and the problem that carpet-type DDoS attacks are difficult to detect in a traditional method is solved.

Description

Technical Field

[0001] This invention relates to the field of distributed denial-of-service (DDoS) attack detection technology, and in particular to a comprehensive DDoS attack detection system based on address-behavior traffic decomposition. Background Technology

[0002] Carpet-bombing DDoS attacks are a new type of evasion attack. Their core strategy is to distribute attack traffic to a large number of IP addresses (up to 15,000) within the victim's network. The traffic rate of a single IP is close to the normal background traffic, and the target IP pool is rotated rapidly every 5-10 seconds. By aggregating traffic to saturate the shared access link, traditional detection systems are evaded.

[0003] Existing detection technologies are mainly divided into three categories: (1) Address-centric detection methods: including threshold-based traffic statistics (such as Cisco DefensePro), flow feature extraction and classification (such as FlowLens), frequency domain clustering detection (such as Whisper), etc. The core logic is to divide traffic according to destination IP and monitor single IP indicator anomalies. (2) Deep learning detection methods: such as Kitsune, DoLLM, etc., which analyze traffic features through fine-grained 5-tuple flow analysis or large language models to capture distributed attack patterns. (3) Matrix factorization / tensor learning detection methods: such as TensorDet, D2LAD, etc., which extract potential traffic features through matrix / tensor factorization, but still anchor the address-behavior binding relationship.

[0004] The aforementioned technologies have inherent limitations in dealing with carpet bombing attacks: address-centric methods fail due to weak single-IP signals and rapid target rotation; deep learning methods have high computational overhead and inference latency (unable to match the 10-second rotation cycle of attacks), and rely on large amounts of labeled data; traditional matrix factorization methods require online joint optimization of the dictionary and activation matrix, resulting in high computational complexity and difficulty in meeting real-time detection requirements. Summary of the Invention

[0005] The main objective of this invention is to provide a comprehensive DDoS attack detection system based on address-behavior traffic decomposition.

[0006] Another objective of this invention is to propose a carpet-style DDoS attack detection method based on address-behavior traffic decomposition.

[0007] The third objective of this invention is to provide an electronic device.

[0008] The fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0009] To achieve the above objectives, a first aspect of the present invention proposes a comprehensive DDoS attack detection system based on address-behavior traffic decomposition, comprising:

[0010] An offline multi-scale dictionary learning module is used to learn a multi-scale behavior template dictionary based on historical benign network traffic. The behavior template dictionary is obtained by learning traffic features at different time scales, and cross-IP baseline activation criteria and anomaly detection thresholds for each behavior template are established based on historical traffic statistics. The anomaly detection thresholds include spatial diffusion thresholds and total intensity thresholds. The online rapid decomposition module is used to decompose real-time network traffic using the multi-scale behavior template dictionary, calculate the activation intensity of each IP address on each behavior template by iteratively matching behavior templates, and generate a real-time activation matrix that reflects the behavior patterns of each IP address. The collaborative anomaly detection module is used to calculate the abnormal activation status of each behavior template on multiple IP addresses based on the real-time activation matrix, and to make a joint judgment by statistically analyzing the spatial diffusion degree and total intensity index of abnormal activation. When the spatial diffusion degree exceeds the spatial diffusion degree threshold and the total intensity exceeds the total intensity threshold, it is determined that a carpet-style distributed denial-of-service attack has occurred, and the corresponding list of attacked IP addresses is output.

[0011] Optionally, the offline multi-scale dictionary learning module is deployed on the backend computing nodes, specifically for: Historical benign network traffic is sliced ​​into time segments according to a preset time granularity, and the traffic feature vector of each IP address in each time segment is extracted. The traffic feature vector is divided into multiple scales based on the duration or behavior pattern of the traffic flow to form a traffic feature sequence at different time scales. Behavioral template learning is performed on traffic feature sequences at various time scales to obtain a set of candidate behavioral templates that can represent different network behavior patterns. The candidate behavior template set is filtered and optimized to retain behavior templates with high activation frequency and strong traffic interpretation ability, forming a multi-scale behavior template dictionary; Based on historical benign traffic statistics on the activation status of each behavior template across multiple IP addresses, cross-IP baseline activation standards for each behavior template are established, and corresponding spatial diffusion thresholds and total intensity thresholds are determined for subsequent anomaly detection.

[0012] Optionally, the online rapid decomposition module is deployed on the network boundary detection node, specifically for: The system receives real-time network traffic data and performs behavioral decomposition on the real-time network traffic based on a pre-trained multi-scale behavioral template dictionary; wherein the traffic decomposition process for different IP addresses is processed in parallel. The behavior templates are matched according to a preset multi-scale priority matching order, wherein the matching order is long-term scale template, medium-term scale template, and short-term scale template; For each IP address, a traffic residual is initialized based on real-time traffic data. A behavior template most similar to the traffic residual is selected through a greedy iterative method. The activation intensity of the behavior template is calculated, and the corresponding traffic component is extracted from the traffic residual to update the residual. Repeat the behavior template matching and residual update process until the traffic residual is lower than the preset traffic interpretation sufficiency threshold or the preset maximum number of iterations is reached; A real-time activation matrix is ​​generated based on the activation intensity corresponding to each behavior template. The real-time activation matrix is ​​used to record the activation intensity of each IP address on each behavior template.

[0013] Optionally, the collaborative anomaly detection module is deployed on the network security management node, specifically for: Receive the real-time activation matrix generated by the online rapid decomposition module, and obtain the cross-IP baseline activation criteria and anomaly detection thresholds for each behavior template established in the offline stage; The activation intensity of the behavior templates in the real-time activation matrix is ​​compared with the corresponding baseline activation standard. The excess activation amount of each behavior template on each IP address is calculated, and the activation amount below the preset numerical noise filtering threshold is filtered out. For each behavior template, the spatial diffusion and total intensity of abnormal activation are calculated, where the spatial diffusion represents the number of IP addresses whose over-activation exceeds the numerical noise filtering threshold, and the total intensity represents the cumulative value of the over-activation of each IP address. The spatial diffusion degree is compared with a preset spatial diffusion degree threshold, and the total strength is compared with a preset total strength threshold. When a behavior template simultaneously satisfies the conditions that the spatial diffusion degree exceeds the spatial diffusion threshold and the total strength exceeds the total strength threshold, a carpet-style distributed denial-of-service attack is determined to have occurred, and the corresponding list of attacked IP addresses and abnormal behavior template identifiers are output.

[0014] To achieve the above objectives, a second aspect of the present invention proposes a carpet-style DDoS attack detection method based on address-behavior traffic decomposition, comprising: A multi-scale behavior template dictionary is learned based on historical benign network traffic. The behavior template dictionary is obtained by learning traffic characteristics at different time scales, and cross-IP baseline activation criteria and anomaly detection thresholds for each behavior template are established based on historical traffic statistics. The anomaly detection thresholds include spatial diffusion thresholds and total intensity thresholds. The multi-scale behavior template dictionary is used to decompose real-time network traffic. The activation intensity of each IP address on each behavior template is calculated by iteratively matching behavior templates, and a real-time activation matrix reflecting the behavior patterns of each IP address is generated. Based on the real-time activation matrix, the abnormal activation status of each behavior template on multiple IP addresses is calculated, and the spatial diffusion degree and total intensity index of the abnormal activation are jointly judged. When the spatial diffusion degree exceeds the spatial diffusion degree threshold and the total intensity exceeds the total intensity threshold, it is determined that a carpet-style distributed denial-of-service attack has occurred, and the corresponding list of attacked IP addresses is output.

[0015] To achieve the above objectives, a third aspect of this application provides an electronic device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory to implement the method described in the first aspect.

[0016] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the method described in the first aspect.

[0017] The embodiments of the present invention have the following beneficial effects: Regarding detection accuracy, this application represents network traffic as a combination of behavioral templates and IP address activation strength, and uses two statistical indicators, spatial diffusion and total strength, for joint judgment, enabling the system to effectively identify distributed weak attack signals. Traditional detection methods typically analyze single IP addresses or single traffic characteristics, making it difficult to identify the dispersed distribution of attack traffic across multiple target addresses. This application, however, analyzes the coordinated activation of behavioral templates across multiple IP addresses, more accurately capturing the distributed coordinated characteristics of carpet-bombing attacks. Experimental results show that compared to existing address-centric detection methods, this application significantly reduces the false positive rate while improving the AUC and F1 scores, thus significantly enhancing overall detection accuracy.

[0018] Regarding real-time performance, this application employs a system architecture combining offline behavior template learning with online rapid traffic decomposition. The behavior template dictionary is learned and baseline thresholds are calculated offline, while online, traffic behavior parsing is achieved simply by using a pre-trained dictionary to quickly match and decompose real-time traffic. By employing a scale-priority matching strategy and a greedy iterative decomposition method, rapid processing of real-time traffic can be achieved with low computational complexity. Furthermore, since the traffic decomposition process for different IP addresses is independent, this application also supports parallel processing of multiple IP addresses, further reducing processing latency. Experimental results show that with a single detection window of 1 second, the processing latency of this application's system can be controlled at a low level, and it can support concurrent detection of a large number of IP addresses, thus meeting the real-time detection requirements in practical network environments.

[0019] Regarding robustness, this application introduces a multi-scale traffic modeling mechanism, enabling the system to adapt to different types of network traffic behavior simultaneously. For example, short timescales can describe bursty request behavior, medium timescales can describe regular interaction behavior, and long timescales can describe stable transmission behavior over a longer period. Multi-scale behavior modeling effectively reduces feature interference between different types of traffic. Simultaneously, the use of a convolution decomposition method with time-translation invariance during behavior template learning allows the system to tolerate time shifts caused by network jitter or scheduling delays to a certain extent, thereby improving the stability of the detection system in complex network environments. Furthermore, this application employs unsupervised learning to construct the behavior template dictionary, independent of known attack samples, thus better adapting to changes in attack patterns and unknown attack types.

[0020] In terms of computational efficiency, this application completes the computationally complex behavior template learning process offline, allowing the online detection phase to perform only template matching, activation calculation, and anomaly statistics, thus significantly reducing the online computational load. Compared to traditional methods that require full matrix factorization in real-time, this application significantly reduces computational complexity. Furthermore, this application supports a multi-IP parallel processing mechanism, which further enhances the overall system processing capabilities, enabling stable operation in large-scale network environments. Attached Figure Description

[0021] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a structural diagram of a carpet-style DDoS attack detection system based on address-behavior traffic decomposition, provided in an embodiment of the present invention. Figure 2This is a flowchart illustrating a carpet-style DDoS attack detection method based on address-behavior traffic decomposition, provided as an embodiment of the present invention. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] Carpet-bombing DDoS attacks employ a core strategy of "traffic dispersion + rapid target rotation," causing single-IP attack traffic to fall below conventional detection thresholds (e.g., 100Mbps vs 1Gbps). Furthermore, the target IP pool dynamically changes every 5-10 seconds, leading to multiple challenges for existing detection technologies. The core shortcomings of existing technologies can be summarized in four points: First, signal dispersion causes detection failure. Existing address-centric detection methods (such as FlowLens and Whisper) divide traffic by target IP, relying on anomalies in single-IP metrics for detection. However, carpet-bombing attacks disperse traffic across a massive number of IPs (up to 15,000). Single-IP attack signals are weak and brief (93.9% of target IPs are attacked for less than 10 seconds). These dispersed weak signals are far below conventional detection thresholds, making it impossible for address-centric methods to capture the global characteristics of distributed attacks, ultimately failing due to a "seeing the trees but not the forest" mentality. Second, real-time performance is severely lacking, failing to match the attack rhythm. On the one hand, deep learning methods (such as DoLLM and NetMamba) require fine-grained 5-tuple flow analysis or complex feature inference, resulting in extremely high computational overhead and inference latency of tens of seconds, far exceeding the 5-10 second target rotation cycle of an attack. This causes detection results to lag behind the attack dynamics, rendering them ineffective for defense. On the other hand, traditional matrix factorization methods (such as TensorDet and D2LAD) require online joint optimization of the dictionary and activation matrix, involving high-dimensional matrix iterative operations, which also have high computational complexity and cannot meet the requirements of real-time detection. Thirdly, they have poor robustness and are difficult to adapt to complex traffic dynamics. Network traffic naturally exhibits multi-scale characteristics, with short burst flows (such as interactive requests) and long steady-state flows (such as video downloads) coexisting. Network jitter can cause time shifts in behavior patterns, and existing methods lack corresponding adaptation mechanisms. For example, traditional nonnegative matrix factorization (NMF) learns templates with fixed time alignment and cannot identify the same behavior with time shifts, leading to inconsistent factorization results. Single-scale feature extraction methods cannot fully cover different types of traffic patterns, further reducing the stability of detection. Fourthly, they rely too heavily on labeled data, limiting adaptability. As an emerging threat, carpet bombing attacks not only suffer from a scarcity of labeled samples but also frequently combine with other attack vectors to form hybrid variants (87% of carpet bombing attacks are multi-vector combinations), making it difficult for supervised learning methods that rely on large amounts of labeled data to adapt. Furthermore, when facing zero-day attacks, these methods suffer a sharp decline in detection performance due to the lack of corresponding training samples, failing to cope with the evolving characteristics of attacks.

[0025] To address the inherent shortcomings of the existing technologies mentioned above, this application focuses on the following four core technical issues to construct an efficient, accurate, and robust comprehensive DDoS attack detection system: First, how to break the binding relationship between address and behavior and aggregate distributed weak attack signals? A completely new traffic modeling approach needs to be designed, shifting from "address-centric" to "behavior-centric". By extracting shared behavior templates across IPs, weak attack signals scattered across massive IPs can be aggregated into detectable global anomaly patterns, solving the problem of detection failure caused by weak single IP signals.

[0026] Second, how to build a lightweight detection architecture to meet the sub-second real-time detection requirements? It is necessary to break through the computational bottleneck of traditional matrix factorization, and complete the high-overhead dictionary learning offline by splitting the computational tasks and optimizing the algorithm logic, while only performing fast activation solving online, so as to ensure that the detection latency is controlled at the sub-second level and match the rapid target rotation rhythm of the attack.

[0027] Third, how to improve system robustness and adapt to the multi-scale characteristics and time shifts of traffic? It is necessary to design a multi-scale, translation-invariant feature extraction mechanism so that the system can simultaneously capture the features of short burst flows and long steady-state flows, and effectively resist the time shifts caused by network jitter, so as to ensure that the detection results can still be output stably in complex traffic environments.

[0028] Fourth, how to achieve unsupervised detection and adapt to attack variants and zero-day attack scenarios? It needs to be based on the unsupervised learning paradigm, using only benign traffic to train the model, and achieve detection by capturing the essential differences between attack behavior and benign behavior in activation patterns. It does not need to rely on attack labeled samples, thus flexibly responding to attack variants and zero-day attacks and improving the actual deployment value of the system.

[0029] Reference Figure 1 This invention proposes a comprehensive DDoS attack detection system based on address-behavior traffic decomposition. The core idea is to model network traffic as a linear combination of "behavioral templates + address activations." This is achieved through offline learning of the behavior dictionary, online rapid decomposition of the activation matrix, and identification of cross-IP collaborative anomalies, resulting in efficient detection. The system architecture consists of four main modules: data preprocessing, offline behavior dictionary learning, online traffic decomposition, and anomaly detection. The overall process is shown in the attached figure. Figure 1 As shown.

[0030] The workflow of this invention is as follows: 1) In the offline stage, historical benign traffic is first preprocessed (10ms time slicing, aggregating packet and byte counts of protocols such as TCP ACK / SYN, UDP, and ICMP to generate non-negative feature vectors, and clustering based on flow duration to divide into 40 / 100 / 500ms multi-scales). Then, a translation-invariant behavior template dictionary is learned through multi-scale convolutional non-negative matrix factorization (Conv-NMF), and the cross-IP baseline activation vector and anomaly judgment threshold of each behavior template are calibrated to complete the detection preparation. 2) In the online stage, real-time access traffic is first preprocessed in the same way as in the offline stage. Then, a greedy matching and tracking algorithm with "long-medium-short" scale hierarchical matching is used to quickly project the real-time traffic onto the pre-trained dictionary to solve the activation matrix. Finally, cross-IP collaborative anomalies are identified through the dual indicators of "spatial diffusion degree + total intensity" to locate the list of victim IPs. 3) After an attack is detected, the system pushes alarm information in real time and links with DDoS mitigation devices to redirect only the traffic of the victim IP to the cleaning node, while the traffic of benign IP is forwarded normally. At the same time, the dictionary is updated weekly using recent benign traffic (after the same preprocessing) to adapt to the drift of traffic concepts and ensure long-term detection accuracy.

[0031] The specific implementation methods of the three core modules of the system will be explained in detail below.

[0032] (1) Offline multi-scale dictionary learning module.

[0033] In this embodiment, the offline multi-scale dictionary learning module learns a behavioral template dictionary that can characterize different network behavior patterns from historical benign network traffic. Based on the behavioral template dictionary, it establishes an activation baseline for normal traffic and anomaly detection thresholds, thereby providing basic model support for subsequent online rapid decomposition and collaborative anomaly detection. This application constructs the behavioral template dictionary through offline learning, enabling attack identification to be completed in the online detection stage only by rapid matching and decomposition, thus significantly reducing online computational overhead and improving detection efficiency.

[0034] The offline multi-scale dictionary learning module can be deployed on backend computing nodes, such as cloud servers, data center servers, or dedicated security analysis nodes, to process historical traffic data and generate a behavior template dictionary. The module's input can include historical benign traffic data, a preset dictionary size, and iterative convergence conditions. Its output includes a multi-scale behavior template dictionary, cross-IP baseline activation criteria for each behavior template, and anomaly detection thresholds, where the anomaly detection thresholds include a spatial diffusion threshold and a total intensity threshold.

[0035] In practice, the offline multi-scale dictionary learning module first standardizes the traffic features of historical benign network traffic. Specifically, network traffic can be time-sliced ​​according to a preset time granularity, such as dividing traffic into segments with a 10ms time granularity. For each IP address's network traffic within each time slice, traffic features of various protocol types can be statistically analyzed, such as the number of TCP ACK packets, TCP SYN packets, UDP packets, ICMP packets, and the corresponding number of data bytes, thereby constructing a non-negative feature vector in a unified format. In this way, traffic data across different IP addresses and time slices can have a unified representation, facilitating subsequent behavioral pattern learning.

[0036] After obtaining the standardized traffic feature vector, this embodiment further divides the traffic features into multiple scales based on traffic duration or behavior patterns. Specifically, traffic can be divided into multiple time scales, such as short time scales, medium time scales, and long time scales, based on the duration distribution of different types of network behavior in historical traffic. In some embodiments, a short time scale may correspond to a behavior window of approximately 40ms, a medium time scale may correspond to a behavior window of approximately 100ms, and a long time scale may correspond to a behavior window of approximately 500ms. Through this multi-scale division, the system can capture different types of traffic patterns, such as bursty request behavior, regular data interaction behavior, and long-term steady-state transmission behavior, thereby reducing mutual interference between different types of traffic features.

[0037] After completing the multi-scale partitioning, this application embodiment performs behavior template learning on the traffic feature sequences at each time scale to obtain a set of candidate behavior templates that can characterize different network behavior patterns. In some embodiments, convolutional nonnegative matrix factorization can be used to model the traffic feature sequences, representing network traffic as a combination of several behavior templates and corresponding activation intensities. By introducing a convolutional structure, the obtained behavior templates can be slidably matched on the time axis, thus possessing time translation invariance. Even if there is a certain time shift in network behavior, such as behavior misalignment due to network jitter or scheduling delay, it can still be identified by the same behavior template.

[0038] During the behavior template learning process, multiple candidate behavior templates are typically generated. This application further optimizes the candidate behavior template set to form a compact and representative behavior template dictionary. Specifically, candidate templates can be evaluated based on template activation frequency and the template's ability to interpret traffic data. Template activation frequency indicates how frequently a behavior template is triggered in historical traffic, while traffic interpretability indicates the template's ability to reconstruct the original traffic data. By comprehensively evaluating these indicators, behavior templates with high activation frequency and strong traffic interpretability can be retained, while redundant or low-contribution templates can be removed, thus forming the final multi-scale behavior template dictionary. In some embodiments, the size of the final behavior template dictionary can be controlled within a preset range, such as no more than 30 templates, to reduce the computational overhead of the subsequent online detection stage.

[0039] After obtaining the multi-scale behavior template dictionary, this embodiment of the application also needs to establish a cross-IP baseline activation standard for each behavior template based on historical benign traffic. Specifically, the activation intensity distribution of each behavior template on different IP addresses can be calculated using historical benign traffic data to obtain the activation range under normal conditions. Based on the activation range, the activation upper limit of each behavior template under normal traffic conditions can be further calculated and used as the baseline activation standard.

[0040] Furthermore, embodiments of this application can also determine anomaly detection thresholds based on statistical results of historical benign traffic. In some embodiments, spatial diffusion thresholds and total intensity thresholds can be determined based on the statistical distribution of benign traffic. For example, the distribution of the number of IP addresses whose activation exceeds the baseline under normal traffic conditions and the corresponding cumulative distribution of activation intensity can be statistically analyzed, and, for example, the 99th percentile can be selected as the basis for threshold setting, thereby ensuring that the system does not frequently trigger false alarms under normal traffic fluctuations.

[0041] Through the above processing, the embodiments of this application can learn a multi-scale behavior template dictionary from historical benign traffic and establish corresponding baseline activation criteria and anomaly detection thresholds, thereby providing reliable basic model support for subsequent online traffic decomposition and collaborative anomaly detection, while ensuring that the detection system has good detection accuracy and stability in actual deployment environments.

[0042] (2) Online rapid decomposition module.

[0043] In this embodiment, the online fast decomposition module utilizes a multi-scale behavior template dictionary learned in the offline phase to perform behavioral decomposition on real-time network traffic, thereby obtaining the activation intensity of each IP address under different network behavior patterns and generating a real-time activation matrix for subsequent anomaly detection. This application achieves rapid parsing of the real-time traffic behavior structure through the online fast decomposition module, enabling the system to achieve sub-second response while maintaining high detection accuracy.

[0044] The online rapid decomposition module can be deployed at network boundary detection nodes, such as internet service provider boundary routers, cloud gateways, security gateways, or dedicated traffic inspection devices, to perform online analysis of traffic accessing the network in real time. By deploying this module at the network boundary, traffic can be rapidly detected before it enters the target network, thereby enabling timely identification of potential attack behaviors.

[0045] In specific processing, the input of the online fast decomposition module may include parameters such as real-time access network traffic, multi-scale behavior template dictionary obtained from offline training, traffic interpretation sufficiency threshold, and maximum number of iterations. The output is a real-time activation matrix, which is used to record the activation intensity of each IP address on each behavior template, thereby reflecting the network behavior composition of different IP addresses.

[0046] In this embodiment, the online rapid decomposition module first receives real-time network traffic data and performs feature construction processing on the real-time traffic consistent with the offline stage. For example, the real-time traffic can be time-sliced ​​according to a preset time granularity, such as dividing the traffic into 10ms time windows, and statistically analyzing the various protocol traffic characteristics of each IP address in each time slice, such as the number of TCP ACK packets, TCP SYN packets, UDP packets, ICMP packets, and the corresponding number of bytes, thereby generating a standardized traffic feature vector. By adopting a feature representation method consistent with the offline stage, the consistency of matching between real-time traffic features and the behavior template dictionary can be guaranteed.

[0047] After obtaining real-time traffic characteristics, this embodiment of the application performs behavioral decomposition on the real-time traffic based on a pre-trained multi-scale behavioral template dictionary. In this process, behavioral templates can be matched according to a preset multi-scale priority matching order, wherein the matching order is long-term template, medium-term template, and short-term template. By prioritizing the matching of long-term templates, steady-state network behaviors such as video downloads or large file transfers can be interpreted first. After long-term behaviors are parsed, medium-term and short-term behaviors are parsed sequentially, thereby avoiding misinterpreting short-term burst traffic as long-term stable behavior and improving the accuracy of traffic decomposition.

[0048] In this embodiment, the real-time traffic data for each IP address can be independently processed for behavior decomposition. Specifically, the traffic residual corresponding to the IP address can first be initialized to represent the traffic portion that has not yet been interpreted by the behavior template. Then, a behavior template most similar to the current traffic residual is selected from the behavior template dictionary using a greedy iterative approach, and the activation intensity of the behavior template in the current traffic is calculated. Next, the corresponding traffic component is extracted from the traffic residual based on the calculated activation intensity, thereby updating the traffic residual.

[0049] It is important to note that the above-described behavior template matching and residual update process can be repeated multiple times. In each iteration, the system selects the behavior template that best matches the current residual and calculates its activation strength, thereby gradually decomposing real-time traffic into combinations of multiple behavior templates. When the traffic residual is below a preset traffic interpretability threshold, the current traffic can be considered to have been adequately interpreted by the behavior template; alternatively, the decomposition process can be terminated when the preset maximum number of iterations is reached to avoid performance overhead from excessive computation.

[0050] Furthermore, since the traffic behavior of different IP addresses is usually independent, the traffic decomposition process for each IP address in this embodiment can be performed in parallel. For example, the traffic decomposition tasks for multiple IP addresses can be processed simultaneously using multithreading or parallel computing mechanisms, thereby significantly improving the overall processing efficiency. In some embodiments, a parallel acceleration mechanism can ensure that the system completes the traffic decomposition process for all active IP addresses within, for example, a 1-second detection window, thereby meeting the performance requirements of real-time detection.

[0051] After traffic decomposition, this embodiment generates a real-time activation matrix based on the activation intensity corresponding to each behavior template. This real-time activation matrix records the activation intensity distribution of each IP address across each behavior template. This real-time activation matrix reflects the behavioral patterns of each IP address in the current network and serves as crucial input data for subsequent collaborative anomaly detection modules to perform comprehensive distributed denial-of-service attack identification.

[0052] (3) Collaborative anomaly detection module.

[0053] In this embodiment, the collaborative anomaly detection module analyzes the activation status of each behavioral template on multiple IP addresses based on the real-time activation matrix generated by the online rapid decomposition module, thereby identifying whether there are abnormal behaviors with distributed collaborative characteristics in the network. This application introduces two statistical indicators, spatial diffusion and total intensity, for joint determination, enabling the system to accurately identify carpet-bombing distributed denial-of-service attacks while effectively distinguishing between attack behaviors and normal traffic fluctuations.

[0054] The collaborative anomaly detection module can be deployed on network security management nodes, such as security management servers, network monitoring platforms, or centralized security control systems, to centrally process analysis results from multiple detection nodes. By performing anomaly detection on network security management nodes, unified analysis and attack identification of large-scale network traffic behavior can be achieved.

[0055] Specifically, the inputs to the collaborative anomaly detection module may include parameters such as the real-time activation matrix generated by the online rapid decomposition module, the cross-IP baseline activation criteria for each behavior template established in the offline phase, the anomaly detection threshold, and the numerical noise filtering threshold. The real-time activation matrix records the activation intensity distribution of each IP address across each behavior template, while the cross-IP baseline activation criteria describe the typical activation range of each behavior template under normal network conditions.

[0056] In this embodiment, the collaborative anomaly detection module first receives the real-time activation matrix and obtains the corresponding behavior template baseline activation standard. Then, the system compares the activation intensity of the behavior templates in the real-time activation matrix with the corresponding baseline activation standard to calculate the excess activation amount of each behavior template on each IP address. Specifically, when the real-time activation intensity of an IP address on a certain behavior template exceeds the baseline activation standard corresponding to that template, the excess portion can be defined as the excess activation amount of that IP address on that behavior template. This method effectively filters out normal traffic fluctuations, retaining only the abnormally increased activation portion for subsequent analysis.

[0057] Furthermore, after obtaining the excess activation amount for each IP address, this embodiment of the application can also filter the excess activation amount by setting a numerical noise filtering threshold. When the excess activation amount of a certain IP address is lower than the numerical noise filtering threshold, the change can be considered to be within the normal noise range, and thus it can be filtered out to avoid small fluctuations interfering with the abnormal detection results.

[0058] After calculating the excess activation amount and filtering noise, this embodiment of the application calculates two key indicators for each behavior template: spatial diffusion and total intensity. Spatial diffusion represents the distribution range of anomalous activation within the network. In a specific implementation, the number of IP addresses whose excess activation amount exceeds the numerical noise filtering threshold can be counted, and this number can be used as the spatial diffusion indicator for that behavior template. A larger spatial diffusion indicates that the anomalous behavior simultaneously affects a greater number of IP addresses, demonstrating stronger distributed characteristics.

[0059] Furthermore, this application embodiment also calculates a total strength index to reflect the overall traffic scale of abnormal behavior. Specifically, the excess activation amount of all IP addresses on this behavior template can be summed to obtain the total strength index of the behavior template. The higher the total strength, the larger the abnormal traffic scale corresponding to the behavior template.

[0060] After obtaining the two statistical indicators, spatial diffusion and total intensity, this embodiment compares them with preset spatial diffusion thresholds and total intensity thresholds, respectively. When a behavior template simultaneously satisfies both the spatial diffusion threshold and the total intensity threshold, it can be determined that a carpet-style distributed denial-of-service attack exists in the current network. By adopting the above-mentioned dual-indicator joint judgment mechanism, it can be ensured that attack alarms are triggered only when abnormal behavior has both wide distribution coverage and high traffic intensity, thereby effectively reducing the false alarm rate.

[0061] After determining that an attack has occurred, this embodiment of the application can also output the corresponding attack detection results, including the attack determination result, a list of attacked IP addresses, and corresponding abnormal behavior template identifiers. The list of attacked IP addresses can be used to indicate the target IP addresses currently affected by the attack, while the abnormal behavior template identifiers can be used to represent the traffic pattern corresponding to the current attack behavior, thereby providing a basis for subsequent attack analysis or traffic scrubbing strategy formulation.

[0062] Furthermore, in some embodiments, the system of this application can also dynamically update the behavior template dictionary periodically. For example, recent benign network traffic can be collected according to a preset cycle (such as weekly), and the behavior template dictionary can be updated through the same learning process as in the offline phase, thereby replacing outdated or no longer applicable behavior templates. In this way, the system can continuously adapt to long-term changes in network traffic patterns, such as changes in traffic characteristics caused by the addition of new network services or applications, and the dictionary update process can be executed in the background without affecting the online detection process, thereby ensuring the detection accuracy and stability of the system in the long term.

[0063] In this embodiment, the collaborative operation of the offline multi-scale dictionary learning module, the online rapid decomposition module, and the collaborative anomaly detection module enables efficient detection of carpet-style distributed denial-of-service attacks. Experimental verification shows that the carpet-style DDoS attack detection system based on address-behavior traffic decomposition proposed in this application exhibits significant advantages in detection accuracy, real-time performance, robustness, and computational efficiency.

[0064] Firstly, regarding detection accuracy, this application models network traffic as a combination of behavioral templates and IP address activation strength, and combines a dual-indicator judgment mechanism of spatial diffusion and total strength, enabling the system to effectively capture distributed weak attack signals. Compared to traditional address-centric detection methods, the embodiments of this application can more accurately identify abnormal behaviors occurring collaboratively across multiple IP addresses. Experimental results show that, compared with the existing optimal address-centric detection methods, the method of this application reduces the false positive rate by approximately 27.4%, while improving the area under the curve (AUC) by approximately 4.1% and the F1 score by approximately 4.7%, indicating that the system of this application can significantly reduce false positives while maintaining a high detection recall rate, thereby improving the overall detection accuracy.

[0065] Secondly, regarding real-time performance, this application structurally separates offline dictionary learning from online traffic decomposition, enabling traffic parsing to be completed in the online phase with only rapid template matching and activation calculation. Furthermore, by employing a scale-priority matching strategy and a greedy iterative decomposition method, traffic decomposition can be completed with lower computational complexity. In addition, since the traffic decomposition processes for different IP addresses are independent, this application's embodiments also support parallel processing of multiple IP addresses, thereby further improving processing efficiency. Experimental results show that, with a single detection window of 1 second, the average processing latency of this application's system does not exceed 0.16 seconds, and it can support a concurrent detection scale of approximately 16,384 IP addresses. The processing speed is significantly faster than the typical 5 to 10-second target rotation cycle of carpet bombing attacks, thus enabling timely identification of attack behaviors.

[0066] Furthermore, regarding robustness, this application introduces a multi-scale behavior modeling mechanism, enabling the system to adapt to different types of network traffic behavior simultaneously. For example, short timescales can capture bursty request behavior, medium timescales can describe regular interactive traffic, and long timescales can characterize stable transmission behavior over a longer period. Through multi-scale collaborative modeling, mutual interference between different types of traffic patterns can be effectively reduced. In addition, a convolutional non-negative matrix factorization method with time translation invariance is used in the behavior template learning process, giving the behavior template a certain degree of offset tolerance on the time axis, thereby resisting behavior time misalignment caused by network jitter or scheduling delay. At the same time, this application uses an unsupervised learning approach to construct the behavior template dictionary, without relying on known attack samples, thus better adapting to changes in attack patterns and potential unknown attack behaviors.

[0067] Finally, regarding computational efficiency, this application adopts a system architecture combining offline dictionary learning and online fast decomposition. The computationally complex behavior template learning process is completed offline, while the online stage only requires fast decomposition and anomaly statistics, thus significantly reducing the online detection load. Compared to traditional methods that require full matrix decomposition or online nonnegative matrix decomposition in real-time, the computational complexity of this application can be reduced by an order of magnitude. Simultaneously, the multi-IP parallel processing mechanism further enhances the overall system throughput, enabling stable operation in large-scale network environments.

[0068] In summary, the carpet-style DDoS attack detection system based on address-behavior traffic decomposition proposed in this application has significant technical advantages in terms of detection accuracy, real-time performance, robustness, and computational efficiency. It can effectively improve the detection capability of carpet-style distributed denial-of-service attacks and is suitable for real-time security protection in large-scale network environments.

[0069] Example 3 This invention also provides a carpet-bombing DDoS attack detection method based on address-behavior traffic decomposition, such as... Figure 2 As shown, the method includes: S1, learn a multi-scale behavior template dictionary based on historical benign network traffic, wherein the behavior template dictionary is obtained by learning traffic features at different time scales, and establish cross-IP baseline activation criteria and anomaly detection thresholds for each behavior template based on historical traffic statistics; the anomaly detection thresholds include spatial diffusion thresholds and total intensity thresholds. S2, decompose the real-time network traffic using the multi-scale behavior template dictionary, calculate the activation intensity of each IP address on each behavior template by iteratively matching behavior templates, and generate a real-time activation matrix that reflects the behavior patterns of each IP address. S3. Based on the real-time activation matrix, calculate the abnormal activation status of each behavior template on multiple IP addresses, and make a joint judgment by statistically analyzing the spatial diffusion degree and total strength index of abnormal activation. When the spatial diffusion degree exceeds the spatial diffusion degree threshold and the total strength exceeds the total strength threshold, determine that a carpet-style distributed denial-of-service attack has occurred, and output the corresponding list of attacked IP addresses.

[0070] Regarding the methods in the above embodiments, the specific manner in which each step is performed has been described in detail in the embodiments of the system, and will not be elaborated here.

[0071] Example 3 To implement the methods of the above embodiments, the present invention also provides an electronic device, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the various steps of the methods described above.

[0072] Example 4 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0073] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0074] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0075] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A comprehensive DDoS attack detection system based on address-behavior traffic decomposition, characterized in that, include: The offline multi-scale dictionary learning module is used to learn a multi-scale behavior template dictionary based on historical benign network traffic. The behavior template dictionary is obtained by learning traffic characteristics at different time scales, and cross-IP baseline activation criteria and anomaly judgment thresholds for each behavior template are established based on historical traffic statistics. The anomaly detection thresholds include a spatial diffusion threshold and a total intensity threshold; The online rapid decomposition module is used to decompose real-time network traffic using the multi-scale behavior template dictionary, calculate the activation intensity of each IP address on each behavior template by iteratively matching behavior templates, and generate a real-time activation matrix that reflects the behavior patterns of each IP address. The collaborative anomaly detection module is used to calculate the abnormal activation status of each behavior template on multiple IP addresses based on the real-time activation matrix, and to make a joint judgment by statistically analyzing the spatial diffusion degree and total intensity index of abnormal activation. When the spatial diffusion degree exceeds the spatial diffusion degree threshold and the total intensity exceeds the total intensity threshold, it is determined that a carpet-style distributed denial-of-service attack has occurred, and the corresponding list of attacked IP addresses is output.

2. The system according to claim 1, characterized in that, The offline multi-scale dictionary learning module is deployed on the backend computing nodes and is specifically used for: Historical benign network traffic is sliced ​​into time segments according to a preset time granularity, and the traffic feature vector of each IP address in each time segment is extracted. The traffic feature vector is divided into multiple scales based on the duration or behavior pattern of the traffic flow to form a traffic feature sequence at different time scales. Behavioral template learning is performed on traffic feature sequences at various time scales to obtain a set of candidate behavioral templates that can represent different network behavior patterns. The candidate behavior template set is filtered and optimized to retain behavior templates with high activation frequency and strong traffic interpretation ability, forming a multi-scale behavior template dictionary; Based on historical benign traffic statistics on the activation status of each behavior template across multiple IP addresses, cross-IP baseline activation standards for each behavior template are established, and corresponding spatial diffusion thresholds and total intensity thresholds are determined for subsequent anomaly detection.

3. The system according to claim 1, characterized in that, The online rapid decomposition module is deployed on network boundary detection nodes, specifically for: The system receives real-time network traffic data and performs behavioral decomposition on the real-time network traffic based on a pre-trained multi-scale behavioral template dictionary; wherein the traffic decomposition process for different IP addresses is processed in parallel. The behavior templates are matched according to a preset multi-scale priority matching order, wherein the matching order is long-term scale template, medium-term scale template, and short-term scale template; For each IP address, a traffic residual is initialized based on real-time traffic data. A behavior template most similar to the traffic residual is selected through a greedy iterative method. The activation intensity of the behavior template is calculated, and the corresponding traffic component is extracted from the traffic residual to update the residual. Repeat the behavior template matching and residual update process until the traffic residual is lower than the preset traffic interpretation sufficiency threshold or the preset maximum number of iterations is reached; A real-time activation matrix is ​​generated based on the activation intensity corresponding to each behavior template. The real-time activation matrix is ​​used to record the activation intensity of each IP address on each behavior template.

4. The system according to claim 1, characterized in that, The collaborative anomaly detection module is deployed on the network security management node and is specifically used for: Receive the real-time activation matrix generated by the online rapid decomposition module, and obtain the cross-IP baseline activation criteria and anomaly detection thresholds for each behavior template established in the offline stage; The activation intensity of the behavior templates in the real-time activation matrix is ​​compared with the corresponding baseline activation standard. The excess activation amount of each behavior template on each IP address is calculated, and the activation amount below the preset numerical noise filtering threshold is filtered out. For each behavior template, the spatial diffusion and total intensity of abnormal activation are calculated, where the spatial diffusion represents the number of IP addresses whose over-activation exceeds the numerical noise filtering threshold, and the total intensity represents the cumulative value of the over-activation of each IP address. The spatial diffusion degree is compared with a preset spatial diffusion degree threshold, and the total strength is compared with a preset total strength threshold. When a behavior template simultaneously satisfies the conditions that the spatial diffusion degree exceeds the spatial diffusion threshold and the total strength exceeds the total strength threshold, a carpet-style distributed denial-of-service attack is determined to have occurred, and the corresponding list of attacked IP addresses and abnormal behavior template identifiers are output.

5. A comprehensive DDoS attack detection method based on address-behavior traffic decomposition, characterized in that, include: A multi-scale behavior template dictionary is learned based on historical benign network traffic. The behavior template dictionary is obtained by learning traffic characteristics at different time scales, and cross-IP baseline activation criteria and anomaly judgment thresholds for each behavior template are established based on historical traffic statistics. The anomaly detection thresholds include a spatial diffusion threshold and a total intensity threshold; The multi-scale behavior template dictionary is used to decompose real-time network traffic. The activation intensity of each IP address on each behavior template is calculated by iteratively matching behavior templates, and a real-time activation matrix reflecting the behavior patterns of each IP address is generated. Based on the real-time activation matrix, the abnormal activation status of each behavior template on multiple IP addresses is calculated, and the spatial diffusion degree and total intensity index of the abnormal activation are jointly judged. When the spatial diffusion degree exceeds the spatial diffusion degree threshold and the total intensity exceeds the total intensity threshold, it is determined that a carpet-style distributed denial-of-service attack has occurred, and the corresponding list of attacked IP addresses is output.

6. An electronic device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in claim 5.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in claim 5.

Images