DDoS attack detection method and device, equipment, storage medium and program product

Abstract

The invention discloses a DDoS attack detection method and device, equipment, a storage medium and a program product, and the method comprises the steps: obtaining at least two kinds of domain information of traffic original data, and respectively extracting deep features corresponding to the domain information; respectively inputting the deep features into a preset deep learning model, and obtaining an output result of the deep learning model; constructing an initial evidence factor corresponding to each piece of domain information based on an output result by utilizing an evidence theory; determining a correction coefficient according to the difference index between the initial evidence factors, and correcting a target evidence factor in the initial evidence factors by using the correction coefficient; fusing the initial evidence factor which does not need to be corrected and the corrected target evidence factor to obtain a fused evidence factor; and determining a detection result of the DDoS attack by using the fused evidence factor. By adopting the embodiment of the invention, the problem of difficulty in threshold selection of a statistical learning detection method can be effectively solved, the flow multi-dimensional features can be accurately extracted, and the attack detection precision is improved.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a DDoS attack detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the rapid development of internet technology, network security issues are becoming increasingly frequent, and DDoS (Distributed Denial of Service) attacks have become one of the most dangerous threats to internet security. DDoS refers to an attacker using a controlled group of computers on a network to continuously send massive amounts of data packets to a target server or network node, maliciously consuming the target's network bandwidth, server computing power, and other system resources. This prevents the target from processing legitimate user access requests, thereby achieving a network attack that denies service to legitimate users.

[0003] Currently, mainstream DDoS attack detection methods typically employ statistical learning. This involves analyzing the statistical characteristics of DDoS attack traffic and normal traffic to create statistical models. The modeling process usually selects the entropy value of the traffic data as the detection indicator, and then sets a threshold with effective discriminative power for this indicator. When detecting new network traffic, its entropy value is calculated and compared with the preset threshold to classify and infer the traffic type, thereby determining whether the traffic is attack traffic. While statistical learning can determine whether traffic is attack traffic, selecting the appropriate threshold is difficult. It's challenging to determine a threshold that effectively distinguishes between normal and attack traffic. Furthermore, different DDoS attack scenarios and traffic fluctuations in the actual network environment can affect the detection results. If the preset threshold is not adjusted in a timely manner for different scenarios, it will directly lead to a significant decrease in detection accuracy, making it impossible to effectively identify attack traffic. Summary of the Invention

[0004] The purpose of this invention is to provide a DDoS attack detection method, apparatus, device, storage medium, and program product that can effectively solve the problem of threshold selection in statistical learning detection methods, accurately extract multi-dimensional features of traffic, and improve attack detection accuracy.

[0005] To achieve the above objectives, embodiments of the present invention provide a DDoS attack detection method, comprising: Obtain at least two types of domain information from the raw traffic data, and extract the deep features corresponding to each domain information; The deep features are input into a preset deep learning model, and the output of the deep learning model is obtained. Using evidence theory, initial evidence factors corresponding to each domain information are constructed based on the output results; A correction coefficient is determined based on the difference index among the initial evidence factors, and the target evidence factor among the initial evidence factors is corrected using the correction coefficient. The initial evidence factors that do not require modification and the modified target evidence factors are fused to obtain the fused evidence factors; The detection results of DDoS attacks are determined using the fused evidence factors.

[0006] As an improvement to the above scheme, the domain information includes time domain information, frequency domain information, and spatial domain information.

[0007] As an improvement to the above scheme, the step of extracting the deep features corresponding to the domain information includes: When the domain information includes time domain information, the time domain information is processed by a sliding window and then input into the long short-term memory network to obtain the deep features output by the long short-term memory network that correspond to the time domain information. When the domain information includes frequency domain information, the approximate components of the frequency domain information are input into the encoder to obtain the deep features output by the encoder that correspond to the frequency domain information. When the domain information includes spatial domain information, a network topology graph is constructed based on the spatial domain information, and the network topology graph is input into a graph convolutional network to obtain the deep features output by the graph convolutional network that correspond to the spatial domain information.

[0008] As an improvement to the above scheme, the step of using evidence theory to construct initial evidence factors corresponding to each domain information based on the output results includes: By using evidence theory to calculate the output results and preset output extreme values ​​corresponding to each domain information, the first type of evidence factors corresponding to each domain information are obtained. By using evidence theory, the similarity between the output result corresponding to each domain information and the preset expected value is calculated to obtain the second type of evidence factor corresponding to each domain information. The first type of evidence factors and the second type of evidence factors are weighted to obtain the initial evidence factors corresponding to each domain information.

[0009] As an improvement to the above scheme, the step of determining the correction coefficient based on the difference index among the initial evidence factors includes: Based on the discrepancy index, calculate the support between any two initial evidence factors and construct a support matrix; Determine the eigenvalues ​​and eigenvectors of the support matrix, and use the eigenvector corresponding to the largest eigenvalue as the target weight of each of the initial evidence factors; The correction coefficient is determined based on the target weight.

[0010] As an improvement to the above scheme, the step of determining the detection result of a DDoS attack using the fused evidence factors includes: Extract the confidence level corresponding to each traffic label in the fused evidence factors; wherein, the traffic labels include normal traffic labels and DDoS attack traffic labels; The traffic label corresponding to the highest confidence level is determined as the detection result of a DDoS attack.

[0011] To achieve the above objectives, embodiments of the present invention also provide a DDoS attack detection device, comprising: The deep feature extraction module is used to obtain at least two types of domain information from the raw traffic data and extract the deep features corresponding to the domain information respectively. The model processing module is used to input the deep features into a preset deep learning model and obtain the output results of the deep learning model. The initial evidence factor construction module is used to construct the initial evidence factors corresponding to each domain information based on the output results using evidence theory. The initial evidence factor correction module is used to determine correction coefficients based on the difference indicators among the initial evidence factors, and to use the correction coefficients to correct the target evidence factors among the initial evidence factors. The fusion evidence factor generation module is used to fuse the initial evidence factors that do not require modification and the modified target evidence factors to obtain fusion evidence factors; The detection result determination module is used to determine the detection result of the DDoS attack using the fused evidence factors.

[0012] To achieve the above objectives, embodiments of the present invention also provide a DDoS attack detection device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the DDoS attack detection method as described in any of the above embodiments.

[0013] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the DDoS attack detection method as described in any of the above embodiments.

[0014] To achieve the above objectives, embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the DDoS attack detection method as described in any of the above embodiments.

[0015] Compared to existing technologies, the DDoS attack detection method, apparatus, device, storage medium, and program products disclosed in this invention extract deep features from at least two domains of raw traffic data and process them independently using a deep learning model. They then combine evidence theory to construct and optimize initial evidence factors for each domain, and finally fuse these features to determine the detection result. This not only fully mines the multi-dimensional features of traffic, effectively improving the accuracy of DDoS attack detection, but also avoids the impact of single model failure on the detection result, enhancing the robustness and generalization ability of the detection model. Simultaneously, it improves the efficiency of the detection process, enabling stable and efficient differentiation between normal traffic and DDoS attack traffic in complex network environments, providing reliable technical support for network security protection. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the TDMFEF model architecture provided in an embodiment of the present invention; Figure 2 This is a flowchart of the training process of the MLP model provided in this embodiment of the invention; Figure 3 This is a flowchart of a DDoS attack detection method provided in an embodiment of the present invention; Figure 4 This is a flowchart of the sliding window processing provided in an embodiment of the present invention; Figure 5 This is a flowchart of the TDMFEF algorithm provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of a DDoS attack detection device provided in an embodiment of the present invention; Figure 7 This is a structural block diagram of a DDoS attack detection device provided in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] See Figure 1 , Figure 1This is a schematic diagram of the TDMFEF (Triple-Domain Multi-Factor Evidence Fusion) model architecture provided in this embodiment of the invention. This architecture comprehensively considers the temporal, frequency, and spatial information of network traffic to construct a multi-model collaborative detection system. LSTM (Long Short-Term Memory) is used to model the temporal information of traffic, accurately extracting the deep temporal features of traffic changes over time; SSAE (Stacked Sparse Auto-encoder) combined with DWT (Discrete Wavelet Transform) models the frequency information of traffic, mining the periodic deep features contained in the traffic; GCN (Graph Convolutional Network) is used to model the spatial information of traffic, extracting the deep spatial features of traffic distribution based on the network topology graph; MLP (Multi-layer...)... The Perceptron (multilayer perceptron) performs unified parallel training on the deep features extracted by the above three-domain model, outputs the preliminary judgment results of each domain, provides data support for subsequent evidence fusion, and finally uses a multi-factor evidence fusion algorithm to fuse and judge the results of each domain to complete the identification of traffic labels.

[0019] See Figure 2 , Figure 2 This is a flowchart of the training process for the MLP model provided in this embodiment of the invention. Traffic data serves as the input source for the entire training process, containing complete original network traffic data packets, which form the basis for subsequent feature extraction. The traffic data is decomposed into multiple dimensions, extracting time-domain, frequency-domain, and spatial-domain information respectively. Among them, time-domain information is the time-series data of traffic changes over time, such as the time interval between data packet arrivals and traffic rate fluctuations; frequency-domain information is the distribution data of traffic in the frequency dimension, such as the frequency domain features after conversion by Discrete Wavelet Transform (DWT); and spatial-domain information is the spatial distribution data of the network topology corresponding to the traffic, such as the connection relationship between source hosts and destination hosts, and the node topology graph.

[0020] In this embodiment of the invention, corresponding models are pre-constructed to extract deep features based on the different data characteristics of the three domains of information. For example, for time domain information, a Long Short-Term Memory (LSTM) model is constructed to extract deep temporal features of time-domain traffic by utilizing its ability to remember time-series data; for frequency domain information, a Stacked Sparse Autoencoder (SSAE) model is constructed to mine deep implicit frequency domain features of traffic by combining frequency domain data after DWT transformation; for spatial domain information, a Graph Convolutional Network (GCN) model is constructed to extract deep spatial features of traffic distribution based on the network topology graph structure. The deep features of time, frequency, and spatial domains extracted by LSTM, SSAE, and GCN are uniformly input into the same MLP model, and parallel training is performed for each domain feature. Parallel training means that each domain feature is independently transformed and mapped nonlinearly through multiple fully connected layers of the MLP, which not only ensures the independence of the training of each domain feature, but also achieves standardized processing of multi-domain features through a unified MLP architecture, providing unified and standardized preliminary judgment results for each domain for subsequent evidence fusion. Finally, the preliminary judgment results of each domain from the parallel training output of the MLP are received. Initial evidence factors for each domain are constructed based on evidence theory, and evidence difference indices are calculated to determine correction coefficients. After correcting the evidence factors, multi-source evidence fusion is completed, resolving the uncertainty and conflict issues of single-model decision-making and improving the reliability of the final detection results. The final result after multi-factor evidence fusion outputs labels for the corresponding traffic, such as normal traffic labels and DDoS attack traffic labels, achieving accurate detection of DDoS attacks.

[0021] In this embodiment of the invention, the MLP model inherits the multi-dimensional deep features extracted by the triple-domain model, realizes the unified processing and preliminary judgment of multi-domain features through parallel training, and provides standardized and structured data support for subsequent evidence fusion, ensuring that multi-source information can be effectively fused, and ultimately achieving high accuracy and strong robustness in DDoS attack detection.

[0022] See Figure 3 , Figure 3 This is a flowchart of a DDoS attack detection method provided by an embodiment of the present invention, which includes steps S1 to S6.

[0023] S1. Obtain at least two types of domain information from the raw traffic data, and extract the deep features corresponding to the domain information respectively.

[0024] For example, the domain information includes time domain information, frequency domain information, and spatial domain information. DDoS attack traffic characteristics can exhibit anomalies in any of the time, frequency, or spatial domains. To increase the accuracy of attack detection, this invention needs to fuse at least two types of domain information, thus achieving DDoS attack detection through the complementarity of multi-dimensional features. Deep features, relative to the original statistical features of traffic (such as the number of data packets and transmission rate), refer to high-dimensional, high-discrimination features obtained by nonlinear transformation, multi-level abstraction, and correlation fusion of domain information using deep learning models such as LSTM, SSAE, and GCN. These features are no longer surface attributes of traffic data but rather abstract features that contain the inherent correlation patterns and implicit anomaly patterns of the traffic data. For example, the time domain deep features extracted by LSTM contain long-term dependencies in traffic time series, the spatial domain deep features extracted by GCN contain correlated attack patterns of network nodes, and the frequency domain deep features extracted by SSAE contain the implicit periodicity of traffic frequency. The shallow traffic characteristics of DDoS attacks are highly similar to normal traffic, making it difficult to effectively identify them using only raw statistical features. However, deep features can uncover the implicit correlations behind the data, transforming seemingly normal traffic patterns into feature vectors with significant distinguishability, thus enabling accurate identification of complex attacks.

[0025] It should be noted that the embodiment of this invention uses time-domain, frequency-domain, and spatial-domain information as examples, which is the optimal implementation of this invention. The three domains of information comprehensively characterize traffic features from three dimensions: time variation, frequency distribution, and spatial topology. This can maximize the discovery of hidden anomalies in DDoS attacks and solve the problem of missed feature detection that may occur when fusing single-domain or dual-domain information, achieving high-precision detection results. However, in practical applications, it is also feasible to fuse any two domains of information for detection, and the choice can be flexibly made based on the computing power conditions, detection accuracy requirements, and network environment characteristics of the deployment scenario. For example, in edge nodes with limited computing power or lightweight detection scenarios, time-domain and frequency-domain information can be fused. Time-domain features can capture sudden fluctuations in traffic rates, while frequency-domain features can identify periodic patterns in attack traffic. Combining the two can meet the need for rapid detection of low- to medium-intensity DDoS attacks while reducing model computational overhead. In data centers or campus networks with relatively fixed topologies, time-domain and spatial-domain information can be fused. By correlating time-series fluctuations with anomalies in node access distribution, the source host cluster of distributed attacks can be quickly located, ensuring detection accuracy while adapting to the attack tracing needs under specific network topologies. In scenarios sensitive to attack frequency characteristics, frequency-domain and spatial-domain information can be fused. Frequency-domain features can identify the frequency patterns of attack traffic, while spatial-domain features can characterize the spatial distribution of attacks. Combining the two can accurately distinguish between low-frequency distributed attacks and normal business traffic, improving detection robustness in complex attack scenarios.

[0026] Furthermore, in step S1, the extraction of deep features corresponding to the domain information includes steps S11 to S13.

[0027] S11. When the domain information includes time domain information, the time domain information is processed by a sliding window and then input into a long short-term memory network to obtain the deep features output by the long short-term memory network that correspond to the time domain information.

[0028] For example, raw traffic data is typically a data stream consisting of several hexadecimal bytes, often wrapped by layers of different protocol layers to form a data frame. Using raw stream data as input results in significant redundancy (such as frame length and protocol type), potentially leading to model structure deviations. Therefore, preprocessing of the raw traffic data is necessary. The raw traffic data is sampled at fixed intervals T, resulting in a sample set of n. The mean, variance, skewness, and kurtosis of the traffic within each interval are extracted as traffic statistical features F, denoted as F = ( , , , The four types of eigenvalues ​​are calculated as follows: (1); (2); (3); (4); in, The mean of the traffic data reflects the central tendency of the traffic data within the sliding window; The first of the flow signals n is the total window length of the signal, i.e., the total number of samples; For variance; The skewness of traffic data measures the degree of asymmetry in the distribution of traffic data, reflecting whether the distribution is left-skewed, right-skewed, or symmetrical. Kuroism is used to measure the steepness of the traffic data distribution, and it is compared with a normal distribution to determine the degree of concentration or flatness of the data.

[0029] The extracted flow statistics feature F is standardized and calculated as follows: (5); In the formula, The traffic characteristics after standardization; This represents the minimum value of this type of traffic statistical feature across the entire dataset. This represents the maximum value of this type of traffic statistical feature across the entire dataset.

[0030] For example, the standardized traffic characteristics The original traffic label L is used as the dataset D, and a sliding window process is applied to it. The original traffic label L is used to identify the category or nature of each traffic data point, such as whether the traffic is normal or a DDoS attack. It should be noted that the original traffic label L is used here because a pre-labeled dataset is used during model training. The original traffic label L serves as a supervisory signal to guide the model in learning the mapping relationship between traffic features and traffic categories. However, in the actual application (inference / prediction) stage, the original traffic label L is not required. Only the real-time collected and standardized traffic features are input into the model, and the trained model automatically predicts and classifies the traffic category based on the learned feature patterns. Figure 4 As shown, Figure 4 This is a flowchart of the sliding window processing provided in an embodiment of the present invention. Let the window length be m. Figure 4 In the middle, m=4, and the step size is 1. , For the first Given a sample of data, the dataset D after sliding window processing is divided into: Subset , No. Subset The labels within each subset are uniformly set to the labels of the last sample data within that subset. All subsets Construct a new dataset ,Right now And used as input during LSTM model training. Figure 4 In and These represent the first and second sliding window subsets, respectively.

[0031] LSTM introduces a cell state C, which includes an input gate, an output gate, and a forget gate, defined as follows: (6); in, , and These are the input gate, output gate, and forget gate. , and These are their weights. , and These are their biases, This is the vector of the previous hidden layer. Let represent the input vector fed into the LSTM network at time step t. This is the Sigmoid activation function.

[0032] Each sliding window subset The standardized flow feature sequence is input into the LSTM model sequentially in chronological order. The forget gate, based on the hidden layer state of the previous time step and the current input, judges and discards invalid or redundant parts of the historical time-domain information, retaining historical dependencies valuable for the current analysis. The input gate controls the degree of integration of newly added time-domain information into the current input sample, filtering out effective features that need to be updated to the cell state. The output gate, based on the updated cell state, determines which deep time-domain information can be output as the hidden layer features of the current time step. Combining the outputs of the forget gate and the input gate, the cell state of the LSTM is updated, fusing the filtered historical information with the newly added effective features to form a state that carries all current time-domain dependencies. Based on the updated cell state, the hidden layer output of the current time step is generated through the output gate, which is the deep feature encoding of the input sequence's time-domain information by the LSTM. For each sliding window subset, the hidden layer output of the last time step of the sequence is taken as the corresponding deep time-domain feature. The deep features of all windows are integrated to obtain a complete set of deep features for subsequent flow analysis tasks.

[0033] In this embodiment of the invention, by processing temporal information through a sliding window before inputting it into a Long Short-Term Memory (LSTM) network, the temporal dependencies and dynamic changes of temporal data can be effectively captured. The sliding window enables segmented parsing and feature extraction of continuous temporal information, adapting to temporal inputs of different lengths and improving the flexibility and robustness of data processing. Furthermore, the LSTM network can perform deep modeling of the segmented temporal information output by the sliding window, learning and mining the deep temporal features hidden within the temporal information. This avoids the information loss and gradient vanishing problems that are common in traditional processing methods, thereby improving the accuracy and completeness of feature representation and enhancing the system's processing precision and generalization ability for temporal information.

[0034] S12. When the domain information includes frequency domain information, the approximate component of the frequency domain information is input into the encoder to obtain the deep features output by the encoder that correspond to the frequency domain information.

[0035] For example, the encoder is a Stacked Sparse Auto Encoder (SSAE). Compared to normal network traffic, DDoS attack traffic often exhibits strong periodicity, and frequency domain information typically contains these periodic characteristics. Therefore, by extracting the frequency domain information of the traffic, normal traffic and attack traffic can be characterized more accurately. Discrete Wavelet Transform (DWT) is not only suitable for analyzing non-stationary signals but can also discretize continuous data, thus providing a more suitable input format for the model. Therefore, this invention uses DWT to sample the original traffic data at a fixed period T, converting the time domain information of the traffic within each period into frequency domain information. Original traffic data The signal is decomposed into multiple sub-bands using DWT, with each sub-band corresponding to approximate and detail components at different scales. The approximate component refers to the low-frequency component obtained after wavelet transform of the frequency domain information, which characterizes the overall trend and main energy distribution of the frequency domain information. It retains the core features of the frequency domain information while eliminating high-frequency noise and redundant details, facilitating subsequent feature extraction. The detail component refers to the component obtained after wavelet transform of the frequency domain information, which characterizes local abrupt changes, instantaneous disturbances, and high-frequency detail changes. It mainly reflects abnormal fluctuations, sudden impacts, and detail features in the signal, effectively highlighting the abrupt changes in attack traffic compared to normal traffic.

[0036] For a first-level DWT decomposition, the approximate components and detail components can be represented as: (7); in, , These are the approximate components (low-frequency part) and the detail components (high-frequency part), respectively. , , respectively, are the coefficients of the low-pass and high-pass filters; k is the output index after wavelet decomposition, representing the kth sampling point of the subband signal after decomposition.

[0037] The original signal is processed through low-pass and high-pass filtering to obtain approximate components (low-frequency part) and detail components (high-frequency part). The approximate components are then recursively decomposed to obtain approximate and detail components at several scales. Since the approximate components (low-frequency part) represent the overall trend of the signal, while the detail components (high-frequency part) represent the specific details of the signal, the approximate components after K-level decomposition are used. As the sampling result of frequency domain analysis, i.e. Together with the original traffic label L, it constitutes the dataset. ,Right now This is then used as the model input for SSAE. Similarly, the original flow label L is only used as a supervision signal during the model training phase to characterize the corresponding approximate component. The traffic category is used to guide the Stacked Sparse Autoencoder (SSAE) to learn more discriminative deep frequency domain features. In the actual inference and application stages, there is no need to input the original traffic label L. Only the approximate components obtained by the real-time traffic through Discrete Wavelet Transform (DWT) decomposition need to be input into the trained SSAE model to achieve automatic extraction of traffic features and anomaly detection, ensuring the practicality and detection efficiency of the model in real deployment scenarios.

[0038] For example, SSAE stacks multiple autoencoders and controls the average activation level of neurons by introducing a sparse penalty term. The loss function of SSAE is as follows: (8); in, This is the loss value; For the number of samples, This represents the number of neurons in the hidden layer. The coefficient is the penalty term coefficient; The original input for SSAE, i.e. The Middle Approximate components corresponding to each sample ; This is the output after decoding by the autoencoder; KL The relative entropy is calculated as follows: (9); in, This is a sparsity parameter, which generally approaches 0; The average output activation of the i-th neuron is calculated as follows: (10); in, The number of samples; For input samples; , These represent the weights and biases of the neurons, respectively. The activation function is typically the Sigmoid function.

[0039] In this embodiment of the invention, the approximate component can retain the overall trend and main energy distribution characteristics of the traffic in the frequency domain information, filter out high-frequency noise and redundant details, reduce data complexity and interference information, and input the purified approximate component into the encoder for deep feature mining. This can make full use of the encoder's ability to abstract and express frequency domain features, accurately extract key periodic and regular features that can distinguish normal traffic from DDoS attack traffic, improve feature effectiveness, reduce model computation, and improve the accuracy and stability of attack detection.

[0040] S13. When the domain information includes spatial domain information, a network topology graph is constructed based on the spatial domain information, and the network topology graph is input into a graph convolutional network to obtain the deep features output by the graph convolutional network that correspond to the spatial domain information.

[0041] For example, a network topology graph is a graph structure data constructed based on the connection relationships, communication paths, and traffic interaction behaviors between nodes in a network. Nodes represent hosts, devices, or communication entities in the network, while edges represent communication associations, data transmission relationships, or adjacency relationships between nodes. It can intuitively represent the spatial information in network space and the dependencies between nodes. When a DDoS attack occurs, the destination hosts receiving traffic are mostly distributed in a dispersed manner on the network topology graph, while the source hosts sending traffic are mostly concentrated in a concentrated manner, resulting in an unbalanced network distribution on the topology graph. Therefore, learning the topological spatial information of network traffic can better assist in DDoS attack detection. A network topology graph is constructed based on the source address, destination address, and standardized traffic statistical characteristics in the original traffic data. This is used as the model input for GCN, where V is the set of host nodes in the network, with each node corresponding to a host or communication entity; A is the adjacency matrix of the network topology graph, which represents the connectivity between hosts, with dimensions N×N, used to represent the connectivity between host nodes. =1 indicates a node and There is a connection. =0 indicates a node and Connectionless; X is the set of traffic features from the source host node to the destination host node, i.e., the node feature matrix, which contains standardized traffic statistics. Let the node be... and The characteristics of the traffic sent between them are .

[0042] GCN is a neural network that operates on graph-structured data, capable of processing both node feature information and graph structure information simultaneously. Let N nodes form a graph G, and the features of all nodes form a matrix. The relationships between all nodes will form a An adjacency matrix A of size 1 / 2, which is shared among all nodes in the hidden layer. Let A be the input to the model. The propagation method for each layer of GCN is calculated as follows: (11); in, The graph convolutional network represents the first... The node feature output matrix of the hidden layer; β represents the network weights; β is the ReLU activation function. This is the normalized graph adjacency matrix. , The adjacency matrix and degree matrix of a graph with self-loop edges are calculated as follows: (12); in, It is a unit diagonal matrix that satisfies D is the degree matrix corresponding to the original adjacency matrix A, which is a diagonal matrix, calculated as follows: (13); in, Represents a node The degree, i.e., the number of edges connected.

[0043] In this embodiment of the invention, by constructing a network topology graph based on spatial information and inputting it into a graph convolutional network to extract deep features, the advantages of graph convolutional networks in processing non-Euclidean structure data can be fully utilized. This effectively learns the spatial association features and topological dependencies between network nodes, and uncovers network structure anomalies and attack propagation characteristics that are difficult to capture by traditional methods. As a result, the model's ability to perceive and identify distributed attacks and abnormal node behaviors in cyberspace is improved, and the integrity and adaptability of the detection model are enhanced.

[0044] S2. Input the deep features into the preset deep learning model respectively, and obtain the output results of the deep learning model.

[0045] For example, the deep learning model is a deep network composed of MLPs. For the deep features obtained after modeling the triple domain, a deep network composed of MLPs is uniformly used for training. The output is the original output value of each node in the output layer of the MLP deep network. This output value serves as the basic data for subsequent evidence construction. It contains both preliminary discrimination information for different traffic categories and retains the numerical features in the feature mapping process. It can be transformed into the BPA function of the first type of evidence factor through normalization processing, or into the BPA function of the second type of evidence factor through similarity calculation, thus achieving a seamless connection between deep features and evidence theory input.

[0046] It should be noted that, since deep features correspond to domain information (including at least two types of deep features corresponding to the time domain, frequency domain, and spatial domain), the output of the MLP model also forms a precise one-to-one correspondence with the domain information. For example, after the time domain deep features are input into the MLP, the original values ​​of the output layer nodes focus on the discrimination information of traffic behavior characteristics in the time dimension (such as packet transmission interval, session duration, etc.), and their numerical distribution and magnitude directly reflect the distinguishability of different traffic categories in the time domain dimension. The MLP output values ​​corresponding to the frequency domain deep features are anchored to the feature mapping results of traffic in the frequency dimension (such as packet transmission frequency, periodic fluctuation characteristics, etc.), retaining the core numerical characteristics of traffic signals such as energy distribution and frequency peaks in frequency domain analysis. The output values ​​obtained after the spatial domain deep features are input accurately correspond to the feature representation of traffic in the spatial dimension (such as source and destination IP distribution, port access patterns, data transmission path characteristics, etc.), and their numerical characteristics can directly reflect the differences in traffic categories under different spatial feature dimensions.

[0047] In this embodiment of the invention, since the output values ​​of each domain retain the original numerical characteristics, in the multi-domain evidence fusion stage, the BPA functions corresponding to the time domain, frequency domain, and spatial domain can be combined and operated through a unified evidence theory framework. This not only retains the discriminative value of single-domain features, but also improves the overall discriminative accuracy through the complementarity and verification of multi-domain evidence.

[0048] Furthermore, the MLP consists of multiple fully connected layers, and the output of each hidden layer is calculated as follows: (14); in, For MLP The output feature vectors of each hidden layer; This is the output of the previous hidden layer. , For the first The weights and biases of each hidden layer The activation function is typically the Sigmoid function.

[0049] Calculate the cross-entropy loss of the model As shown below: (15); Where n is the total number of samples, and k is the number of sample labels. Let be the true label (expected output) of the i-th sample in the j-th category. The model predicts the probability (actual output) of the i-th sample in the j-th class.

[0050] The network parameters of the MLP are trained using the following formula: (16); in, The optimal network parameters for the domain feature extraction model (including at least two of LSTM, SSAE and GCN); The network parameters to be optimized for the domain feature extraction model; The optimal network parameters for the MLP classifier; The network parameters to be optimized for the MLP; This indicates the search in the parameter space for the parameter that results in the cross-entropy loss. Minimize the optimal combination of parameters.

[0051] S3. Using evidence theory, construct the initial evidence factors corresponding to each domain information based on the output results.

[0052] For example, evidence theory, also known as DS theory, is used to deal with uncertainty problems. Suppose there exists a set consisting of multiple independent and mutually exclusive elements. The set consisting of all subsets of the identification frame Θ is called the power set of Θ, denoted as Θ_power_set. If a mapping exists satisfy: , Then e is called the BPA (Basic Probability Assignment) function on Θ, which is used to describe the degree of trust in the evidence θ.

[0053] It should be noted that while evidence theory can flexibly and effectively handle uncertain information and integrate and make decisions using evidence combination rules within the same identification framework, the results produced by the DS combination rules can lead to serious paradoxes when evidence is highly conflicting, failing to accurately reflect the true situation. To address this issue, this invention proposes an evidence discrepancy index, which consists of two parts: evidence probability distance and evidence conflict coefficient.

[0054] For example, the evidence probability distance is calculated as follows: (17); in, This represents the probability distance between the i-th and j-th evidence bodies (BPAs), used to measure the degree of difference between the evidences. Let BPA represent the basic probability assignment functions for the i-th and j-th pieces of evidence, respectively. To identify the frame The k-th single-element proposition in the equation; t is an adjustable parameter greater than 0, used to adjust the sensitivity of distance to differences; and These represent the propositions corresponding to the i-th and j-th pieces of evidence after probability transformation. The probability value.

[0055] Furthermore, probability value The following formula can be used to calculate: (18); in, Indicates the proposition after transformation The corresponding probability value; For the proposition The Belief Function (Bel) represents the confidence level of a proposition. The minimum level of trust required to satisfy ,in Let BPA be the basic probability assignment function, representing the probability distribution of a proposition. The degree of direct support; For the proposition The likelihood function Pl (Plausibility Function) represents the likelihood of a proposition. To achieve the highest level of trust, satisfying ; The total value of the reliability function, i.e., the sum of the reliability values ​​of all single-element propositions, satisfies the following condition: By performing probability transformation on the BPA of the original evidence, the influence of the confidence function and the likelihood function can be comprehensively considered, thereby obtaining a more effective probability function and reducing the uncertainty of information.

[0056] For example, suppose and To identify two pieces of evidence in frame Θ, the correlation coefficient is calculated as follows: (19); in, express and The correlation coefficient between pieces of evidence is used to measure the degree of similarity between pieces of evidence; the higher the value, the higher the similarity. To identify the number of elements in frame Θ; and They represent and After probability transformation, the corresponding proposition The probability value.

[0057] Furthermore, The result is obtained by calculation using the following formula ( The calculation process is the same and will not be repeated here). (20); in, Let e ​​represent the Pignistic probability obtained based on the transformation of the evidence body e, and let θ represent the probability assignment for the single-element proposition θ. This indicates that the evidence body e is assigned to the empty set. The basic probability represents the global conflict.

[0058] The coefficient of evidence conflict is calculated as follows: (twenty one); in, Indicating evidence and The coefficient of evidence conflict between them; and Each represents a piece of evidence. and The focal element with the highest BPA value (proposition).

[0059] Furthermore, The result is obtained by calculation using the following formula ( The calculation process is the same and will not be repeated here). (twenty two); in, The power set of the identification frame Θ is represented by all possible subsets (propositions). Indicating evidence On the proposition The basic probability allocation value.

[0060] In formula (21), when the focal element with the largest BPA of two pieces of evidence is the same, it means that they trust the same conclusion the most. This indicates that the two are consistent in their judgment and there is no fundamental contradiction. Therefore, it is believed that there is no conflict between them and the conflict coefficient is 0. Otherwise, the conflict coefficient is represented by subtracting the correlation coefficient between the two from the constant 1.

[0061] Furthermore, by comprehensively considering both evidence distance and conflict coefficient, and synthesizing the two measures mentioned above, this invention proposes an evidence discrepancy index, the calculation process of which is as follows: (twenty three); in, Indicating evidence and Evidence discrepancy indicators are used to comprehensively measure the degree of difference between pieces of evidence; Indicates the conflict coefficient used to synthesize evidence. Distance from Evidence Probability The composition function, where x and y are the input variables of the composition function, satisfies ,Right now The value range is [0,1]. Corresponding to the coefficient of evidence conflict Distance from Evidence Probability ; It is an adjustable parameter. ≥0 is used to adjust the characteristics of the composition function, and is usually taken as 0. =2.

[0062] Furthermore, Defined as: (twenty four); Furthermore, when When =2, in formula (23) It can be rewritten as: (25); Among them, the evidence difference index meets the requirements. And with and It increases with the increase of.

[0063] Further, step S13 specifically includes: using evidence theory to calculate the output result corresponding to each domain information and the preset output extreme value to obtain the first type of evidence factor corresponding to each domain information; using evidence theory to calculate the similarity between the output result corresponding to each domain information and the preset expected value to obtain the second type of evidence factor corresponding to each domain information; and performing weighted processing on the first type of evidence factor and the second type of evidence factor to obtain the initial evidence factor corresponding to each domain information.

[0064] For example, see Figure 5 , Figure 5 This is a flowchart of the TDMFEF algorithm provided in this embodiment of the invention. The first type of evidence factor characterizes the degree to which the current traffic characteristics deviate from the extreme range of normal traffic, and can intuitively reflect whether the traffic exhibits extreme attack characteristics such as abnormal surges or sudden drops. The second type of evidence factor characterizes the degree to which the current traffic characteristics are close to the expected distribution of normal traffic, and can stably reflect the degree of abnormality in the overall trend, periodicity, and statistical regularity of traffic. The initial evidence factors reflect the degree of independence, credibility, and abnormal contribution of each time-domain, frequency-domain, and spatial-domain information in the attack detection task, serving as the basis for subsequent evidence fusion and decision-making, and are used to comprehensively measure the support and credibility of different domain information for the final DDoS attack identification result.

[0065] For example, the BPA function is calculated based on the MLP output results of the multiple domain models obtained in step S2, and used as a first type of evidence factor. The calculation process satisfies the following formula: (26); in, The first type of evidence factor (BPA function) represents the evidence for the proposition. The basic probability distribution; This represents the total number of nodes in the MLP output layer (i.e., the number of classification categories). This is the output of the MLP, specifically the normalized output value of the i-th node in the output layer.

[0066] The calculation is as follows: (27); in, The actual output value of the i-th node in the MLP output layer, including the output extrema. and , and These are the maximum and minimum values ​​of the output layer, respectively.

[0067] Meanwhile, a similarity-based method was used to calculate the BPA function as a second type of evidence factor. Second type of evidence factors The calculation process is as follows: (28); In the formula, Let the similarity between the actual and expected values ​​of the output of the i-th node in the output layer of the MLP satisfy the following condition: ; Let be the expected output value of the i-th node in the MLP output layer.

[0068] The first type of evidence factors obtained from the above calculations Second type of evidence factors The initial evidentiary factor F is weighted, and the weighting process satisfies the following formula: (29); Where λ is the weighting coefficient, and .

[0069] It should be noted that different domain information corresponds to independent first-type evidence factors. Second type of evidence factors , and each corresponds to an initial evidence factor F.

[0070] In this embodiment of the invention, by constructing a first type of evidence factor and a second type of evidence factor based on the domain information output results and preset output extreme values ​​and preset expected values ​​respectively, and by weighting and fusing the two to obtain the initial evidence factor, the abnormal characterization ability of each domain information can be comprehensively characterized from two dimensions: the degree of extreme deviation and the degree of trend similarity. This fully leverages the advantages of evidence theory in describing uncertain information and improves the sensitivity and reliability of abnormal traffic perception. At the same time, the weighted processing achieves complementary advantages of evidence from different dimensions, enhances the stability and discriminativeness of the initial evidence factor, and provides a more accurate and reliable basis for subsequent multi-domain evidence fusion and final attack decision-making, effectively improving the overall accuracy and robustness of DDoS attack detection.

[0071] S4. Determine the correction coefficient based on the difference index among the initial evidence factors, and use the correction coefficient to correct the target evidence factor among the initial evidence factors.

[0072] For example, since each domain information corresponds to an initial evidence factor F, and this invention has at least two types of domain information, a difference index can be determined for the initial evidence factors F corresponding to these at least two types of domain information. The difference index reflects the degree of consistency, conflict, or deviation between the initial evidence factors corresponding to different domain information. Different domain information has inherent differences in feature sources, representation dimensions, and discrimination emphases, resulting in the corresponding initial evidence factors not being entirely identical in credibility, reliability, and discrimination trends, and even exhibiting local contradictions or mutual interference. If uncorrected initial evidence factors are directly fused, inconsistencies between domain evidence, uneven evidence credibility, and noise or bias in local evidence can lead to misjudgments and reduced robustness in the final fusion result. Therefore, it is necessary to construct corresponding correction coefficients through the difference index to adaptively correct the initial evidence factors. For example, the weight of initial evidence factors with high consistency and reliability can be increased, while the interference of initial evidence factors with significant conflict and low credibility can be suppressed, thereby weakening the negative impact of evidence conflicts between different domains and improving the accuracy and stability of subsequent evidence fusion.

[0073] Further, in step S4, determining the correction coefficient based on the difference index among the initial evidence factors includes: calculating the support between any two initial evidence factors based on the difference index, and constructing a support matrix; determining the eigenvalues ​​and eigenvectors of the support matrix, and using the eigenvector corresponding to the largest eigenvalue as the target weight of each initial evidence factor; and determining the correction coefficient based on the target weight.

[0074] For example, since it is necessary to fuse the initial evidence factors F calculated from multiple domains, let the initial evidence factors to be fused be as follows: Here, n represents the number of initial evidence factors. Based on the proposed evidence dissimilarity index, the support between every two evidence factors is calculated, satisfying the following formula: (30); in, Indicating initial evidence factors and Support between the two measures their consistency or compatibility; difference indicators The calculation process can be referred to the calculation process of formula (23) or formula (25) above; This is an adjustment parameter used to control the strength of the influence of variability on support; it is generally a real number greater than 0.

[0075] Evidence support matrix calculated based on support. Support matrix It is an n×n symmetric matrix with elements If the diagonal elements are all 1s (and their own support is 1), then: (31).

[0076] Calculate the support matrix eigenvalues and eigenvectors It satisfies the following formula: (32).

[0077] The largest eigenvalue corresponding feature vector As the target weights for each initial evidence factor, such as the eigenvector. satisfy: Here, n is the number of initial evidence factors, where each component... The target weights corresponding to the i-th initial evidence factor. Support matrix. It describes the consistency relationship between pieces of evidence. The eigenvector corresponding to the largest eigenvalue is the principal eigenvector of the matrix, representing the weight distribution that best reflects overall consistency among all mutually supporting evidence. Components The larger the value, the more reliable the evidence is within the overall evidence network, and therefore the higher its target weight. The evidence with the largest target weight is considered the most reliable source of evidence and the one that best represents the overall consensus. Since it is the most reliable benchmark, it does not need to be modified and its original evidence is retained. The remaining initial evidence factors need to be modified by calculating discount coefficients (i.e., correction coefficients).

[0078] For these target evidence factors that require correction, the calculation process for their correction coefficients satisfies the following: (33); in, The correction coefficient is the i-th target evidence factor that needs to be corrected, used to correct its credibility; Let the target weight be the i-th target evidence factor that needs to be corrected. It is the maximum value among all objective weights.

[0079] Furthermore, the evidence sources that need to be corrected are corrected based on the correction coefficients. This process satisfies the following formula: (34); in, Let be the modified Basic Probability Assignment (BPA) function for the i-th target evidence factor; Let i be the target evidence factor to be corrected; when When, it indicates a correction to the basic probability assignment of a single proposition (or category) outside the entire set in the identification framework; that is, the confidence level of the original evidence for that proposition is directly multiplied by a correction coefficient. This weakens the discriminative weight of the evidence for a single proposition; when θ=Θ, it indicates a correction to the basic probability allocation of the entire identification frame, reducing the confidence level that was discounted from the original evidence (i.e., ) and the degree of trust in the original evidence for the complete set The uncertain confidence level is accumulated and redistributed to the entire set, ensuring that the modified BPA function satisfies the normalization constraint. This modification method not only suppresses the weight of conflicting or low-confidence evidence, but also preserves the uncertainty information of the evidence by transferring the discounted confidence level to the entire set. This avoids the loss of discriminative information due to over-modification and provides a more reliable and reasonable input basis for subsequent multi-evidence fusion.

[0080] S5. The initial evidence factors that do not require modification and the modified target evidence factors are fused to obtain the fused evidence factors.

[0081] For example, the initial evidence factors that do not require modification and the modified target evidence factors are fused to obtain a single fused evidence factor. The fusion process satisfies the following formula: (35); Among them, the fusion of any two evidentiary factors The calculation process is as follows: (36); in, and Intermediate propositions used for combinatorial computation, satisfying (Non-empty set case) or (Conflict situation); The conflict coefficient between evidentiary factors is calculated as follows: (37).

[0082] S6. Determine the detection result of DDoS attack using the fused evidence factors.

[0083] Further, step S6 specifically includes: extracting the confidence level corresponding to each traffic label in the fused evidence factors; wherein, the traffic label includes normal traffic labels and DDoS attack traffic labels; and determining the traffic label corresponding to the highest confidence level as the detection result of the DDoS attack.

[0084] For example, the fused evidence factors are used as the final discrimination criterion to discriminate the traffic labels to be tested, and the confidence scores corresponding to each traffic label in the fused evidence factors are extracted. This process satisfies the following formula: (38); in, The traffic label corresponding to the highest confidence level.

[0085] For example, after completing the fusion of multi-domain evidence, the resulting fused evidence factors A basic probability assignment value will be assigned to each traffic label in the identification framework Θ={normal traffic, DDoS attack traffic}, which is the confidence level of the corresponding label. For example, if the fusion results in: ({Normal traffic}) = 0.25, If ({DDoS attack traffic}) = 0.7, then the confidence scores for each traffic label can be extracted as follows: the confidence score for the normal traffic label is 0.25, and the confidence score for the DDoS attack traffic label is 0.7. Subsequently, the confidence scores of each traffic label are compared using formula (38), and the label with the highest confidence score is selected as the detection result. In the above example, the confidence score (0.7) of the DDoS attack traffic label is greater than the confidence score (0.25) of the normal traffic label; therefore, the current traffic to be tested can be determined to be DDoS attack traffic.

[0086] In this embodiment of the invention, by extracting deep features of at least two domains from the original traffic data and processing them independently through a deep learning model, combining evidence theory to construct and optimize the initial evidence factors for each domain, and then fusing them to determine the detection result, not only is the full mining of multi-dimensional traffic features achieved, effectively improving the accuracy of DDoS attack detection, but also the impact of single model failure on the detection result is avoided, enhancing the robustness and generalization ability of the detection model, while improving the efficiency of the detection process. It can stably and efficiently distinguish between normal traffic and DDoS attack traffic in complex network environments, providing reliable technical support for network security protection.

[0087] See Figure 6 , Figure 6 This is a structural block diagram of a DDoS attack detection device 100 provided in an embodiment of the present invention. The DDoS attack detection device 100 includes: The deep feature extraction module 11 is used to obtain at least two types of domain information from the original traffic data and extract the deep features corresponding to the domain information respectively. The model processing module 12 is used to input the deep features into a preset deep learning model and obtain the output results of the deep learning model. The initial evidence factor construction module 13 is used to construct the initial evidence factors corresponding to each domain information based on the output results using evidence theory. The initial evidence factor correction module 14 is used to determine correction coefficients based on the difference indicators among the initial evidence factors, and to use the correction coefficients to correct the target evidence factors among the initial evidence factors. The fusion evidence factor generation module 15 is used to fuse the initial evidence factors that do not need to be corrected and the corrected target evidence factors to obtain fusion evidence factors; The detection result determination module 16 is used to determine the detection result of the DDoS attack using the fused evidence factors.

[0088] It is worth noting that the working process of each module in the DDoS attack detection device 100 described in the embodiments of the present invention can refer to the working process of the DDoS attack detection method described in the above embodiments, and will not be repeated here.

[0089] See Figure 7 , Figure 7 This is a structural block diagram of a DDoS attack detection device 200 provided in an embodiment of the present invention. The DDoS attack detection device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the various DDoS attack detection method embodiments described above.

[0090] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the DDoS attack detection device 200.

[0091] The DDoS attack detection device 200 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the DDoS attack detection device 200 and does not constitute a limitation on the DDoS attack detection device 200. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the DDoS attack detection device 200 may also include input / output devices, network access devices, buses, etc.

[0092] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the DDoS attack detection device 200, connecting all parts of the DDoS attack detection device 200 via various interfaces and lines.

[0093] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the DDoS attack detection device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0094] If the modules / units integrated in the DDoS attack detection device 200 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0095] Furthermore, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the DDoS attack detection method as described in any of the above embodiments.

[0096] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A DDoS attack detection method, characterized in that, include: Obtain at least two types of domain information from the raw traffic data, and extract the deep features corresponding to each domain information; The deep features are input into a preset deep learning model, and the output of the deep learning model is obtained. Using evidence theory, initial evidence factors corresponding to each domain information are constructed based on the output results; A correction coefficient is determined based on the difference index among the initial evidence factors, and the target evidence factor among the initial evidence factors is corrected using the correction coefficient. The initial evidence factors that do not require modification and the modified target evidence factors are fused to obtain the fused evidence factors; The detection results of DDoS attacks are determined using the fused evidence factors.

2. The DDoS attack detection method as described in claim 1, characterized in that, The domain information includes time domain information, frequency domain information, and spatial domain information.

3. The DDoS attack detection method as described in claim 2, characterized in that, The step of extracting the deep features corresponding to the domain information includes: When the domain information includes time domain information, the time domain information is processed by a sliding window and then input into the long short-term memory network to obtain the deep features output by the long short-term memory network that correspond to the time domain information. When the domain information includes frequency domain information, the approximate components of the frequency domain information are input into the encoder to obtain the deep features output by the encoder that correspond to the frequency domain information. When the domain information includes spatial domain information, a network topology graph is constructed based on the spatial domain information, and the network topology graph is input into a graph convolutional network to obtain the deep features output by the graph convolutional network that correspond to the spatial domain information.

4. The DDoS attack detection method as described in claim 1, characterized in that, The method of constructing initial evidence factors for each domain information based on the output results using evidence theory includes: By using evidence theory to calculate the output results and preset output extreme values ​​corresponding to each domain information, the first type of evidence factors corresponding to each domain information are obtained. By using evidence theory, the similarity between the output result corresponding to each domain information and the preset expected value is calculated to obtain the second type of evidence factor corresponding to each domain information. The first type of evidence factors and the second type of evidence factors are weighted to obtain the initial evidence factors corresponding to each domain information.

5. The DDoS attack detection method as described in claim 1, characterized in that, The step of determining the correction coefficient based on the difference index among the initial evidence factors includes: Based on the discrepancy index, calculate the support between any two initial evidence factors and construct a support matrix; Determine the eigenvalues ​​and eigenvectors of the support matrix, and use the eigenvector corresponding to the largest eigenvalue as the target weight of each of the initial evidence factors; The correction coefficient is determined based on the target weight.

6. The DDoS attack detection method as described in claim 1, characterized in that, The determination of DDoS attack detection results using the fused evidence factors includes: Extract the confidence level corresponding to each traffic label in the fused evidence factors; wherein, the traffic labels include normal traffic labels and DDoS attack traffic labels; The traffic label corresponding to the highest confidence level is determined as the detection result of a DDoS attack.

7. A DDoS attack detection device, characterized in that, include: The deep feature extraction module is used to obtain at least two types of domain information from the raw traffic data and extract the deep features corresponding to the domain information respectively. The model processing module is used to input the deep features into a preset deep learning model and obtain the output results of the deep learning model. The initial evidence factor construction module is used to construct the initial evidence factors corresponding to each domain information based on the output results using evidence theory. The initial evidence factor correction module is used to determine correction coefficients based on the difference indicators among the initial evidence factors, and to use the correction coefficients to correct the target evidence factors among the initial evidence factors. The fusion evidence factor generation module is used to fuse the initial evidence factors that do not require modification and the modified target evidence factors to obtain fusion evidence factors; The detection result determination module is used to determine the detection result of the DDoS attack using the fused evidence factors.

8. A DDoS attack detection device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the DDoS attack detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the DDoS attack detection method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the DDoS attack detection method as described in any one of claims 1 to 6.

Images