Server and gateway cooperative based massive carpet DDoS attack detection system

Abstract

This application relates to the field of network security technology and discloses a massive, carpet-bombing DDoS attack detection system based on server and gateway collaboration. The protected server monitors application-layer behavior and extracts resource access frequency and active resource size characteristics. These are then piggybacked to the gateway via reserved fields in outbound response packets. The gateway device extracts network-layer features and concatenates them with server-side features to construct an unordered comprehensive feature vector set. A cross-server inbound traffic analyzer uses a permutation-based equivariant neural network model and a sorting-based grouping function to extract cross-server traffic distribution patterns and generate a list of victim servers, triggering DDoS mitigation devices to clean up traffic. This invention effectively identifies low-rate covert attacks and carpet-bombing coordinated attacks through multi-dimensional feature fusion and global correlation analysis, and solves the feature mismatch problem during defense by using a random replacement training strategy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a massive, comprehensive DDoS attack detection system based on server and gateway collaboration. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks have consistently been one of the major threats to network security. With the continuous development of attack defense technologies, attackers are increasingly adopting more covert carpet bombing strategies. Unlike traditional large-scale DDoS attacks targeting a single objective, carpet bombing distributes attack traffic across hundreds or thousands of servers within the target network segment. This attack pattern means that the traffic received by a single server is often below the conventional detection threshold, thus circumventing traditional traffic statistics-based detection mechanisms. However, the total traffic aggregated is sufficient to cause upstream link congestion or service paralysis.

[0003] Existing DDoS detection technologies primarily rely on traffic scrubbing equipment deployed at gateways or ISPs for flow-based statistical analysis. However, this single-point detection mechanism has significant technical limitations. Firstly, gateway-side detection lacks the ability to perceive the application-layer behavior of downstream servers. When facing low-rate application-layer attacks targeting specific business logic, it is difficult to distinguish malicious requests from normal business access based solely on network layer traffic characteristics (such as throughput and packet length distribution). Secondly, due to the lack of server-side feedback on resource consumption, gateway devices cannot identify covert attacks that, while having small traffic volumes, consume significant computing or database resources.

[0004] Existing traffic analysis solutions typically employ independent analysis logic targeting a single IP or a single line. In carpet bombing scenarios, attack traffic is diluted across a large number of victim hosts, and analysis targeting a single target cannot capture the coordinated patterns exhibited by attackers across the entire subnet. Existing detection models often lack cross-server global analysis capabilities and cannot effectively extract similarity features of traffic scattered across different target IPs, making it difficult for the system to confirm the existence of coordinated attacks at a macro level.

[0005] In actual defense deployments, there is a state inconsistency between the detection system and the mitigation system. When an attack is detected and traffic scrubbing (DDoS mitigation) is triggered, traffic destined for the victim server is filtered by the scrubbing equipment, and the traffic received by the server returns to benign characteristics. For systems that rely on server-side characteristics for auxiliary detection, this sudden change in the characteristic environment caused by the intervention of defense measures often leads the detection model to misjudge that the attack has stopped, thus triggering the revocation of the defense strategy. Once the defense is revoked, the original attack traffic surges in again, forcing the system to restart scrubbing. This logical deadlock between detection and defense causes the routing strategy to oscillate frequently between scrubbing and pass-through, severely impacting business continuity. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a massive, carpet-bombing DDoS attack detection system based on server and gateway collaboration. It solves the problem that existing gateway-side detection mechanisms lack application-layer awareness and struggle to identify low-rate, covert attacks targeting business logic. It also addresses the issue that traditional single-flow analysis techniques lack a cross-server global correlation perspective, failing to capture carpet-bombing collaborative attack patterns scattered across multiple target hosts. Furthermore, it resolves the problem that after traffic scrubbing equipment is deployed, the detection model fails due to mismatched feature distributions, leading to frequent fluctuations in defense strategies.

[0007] To achieve the above objectives, the present invention provides the following technical solution: The first aspect of this invention provides a massive, blanket-style DDoS attack detection system based on server and gateway collaboration. The system includes a protected server group, a gateway device, and DDoS mitigation devices. The protected server group is located downstream of the network edge, and each protected server within the group is equipped with a server auxiliary detector. The gateway device connects the external network to the protected server group and deploys a cross-server inbound traffic analyzer within it.

[0008] In terms of distributed feature acquisition, the server-assisted detector is configured to monitor application layer behavior and extract server-side features. These server-side features are transmitted to the gateway device via reserved or option fields in the outbound response data packets, using an in-band piggyback method. This transmission method utilizes existing business data channels without establishing additional control connections. The cross-server inbound traffic analyzer at the gateway device is configured to extract network layer features and parse and reconstruct server-side features from the outbound response data packets. The system aligns and concatenates the network layer features and server-side features to construct a comprehensive feature vector set. The cross-server inbound traffic analyzer uses a permutational equivariant neural network model to process this comprehensive feature vector set, identify target servers exhibiting abnormal traffic patterns, and generate a list of victim servers. Based on this list, the gateway device modifies its routing policy, redirecting traffic destined for victim servers to DDoS mitigation devices for cleaning, and then reinjecting the cleaned, benign traffic.

[0009] In terms of application-layer feature extraction logic, the server-assisted detector operates based on a resource request-response model. The detector defines independently addressable data objects on the server as resources and client access operations as requests. It counts the number of requests for the same independent resource object within a preset time window, generating resource access frequency features; simultaneously, it identifies requests currently in an active connection state, calculates the total data size of the resource objects corresponding to those requests, and generates active resource size features. For malformed data packets or requests that cannot be located to legitimate physical resources, the system defines their corresponding resource size value as zero. The detector performs normalization processing on the above statistical values ​​to generate standardized server-side features, eliminating dimensional differences between different business types.

[0010] Regarding the standardized transmission of features, the server-assisted detector serializes and encodes standardized server-side features, writing them into the protocol header options field or reserved field of the outbound response data packet. The cross-server inbound traffic analyzer is configured with corresponding parsing logic to intercept and read the content of this field, thereby achieving feature data synchronization.

[0011] In cross-server collaborative analysis, the system constructs a comprehensive feature vector set that is structurally an unordered collection containing multiple comprehensive feature vectors. The cross-server inbound traffic analyzer employs a permutation-variable neural network model that includes a shared feature extraction layer, a global context aggregation layer, and a feature fusion and anomaly detection layer. The shared feature extraction layer uses a multilayer perceptron structure, applying the same set of weight parameters in parallel to each comprehensive feature vector in the set, mapping it to a single IP embedding vector. This structure ensures that the model output is insensitive to the order of the input vectors in the set.

[0012] In terms of global feature aggregation, the global context aggregation layer introduces a sorting-based grouping function logic. The model rearranges the set of single-IP embedding vectors according to the numerical values ​​of a specific dimension, generating a sequence with a defined order in the feature space. Subsequently, a one-dimensional convolutional neural network is used to perform sliding window calculations on this sequence, aggregating local contextual information, and generating a global feature vector representing the overall network attack posture through max pooling. This global feature vector is concatenated with each single-IP embedding vector, and used by the anomaly detection layer to calculate the anomaly probability value for each protected server.

[0013] Regarding the constraint mechanism for model training, the system calculates the matrix product of the sorting matrix and its transpose during the training phase, and then calculates the difference norm between this product and the identity matrix. The system defines this difference norm as the sorting matrix constraint loss component, constraining the sorting matrix to satisfy orthogonality, thereby ensuring the effectiveness of the sorting transformation operation.

[0014] To adapt to changes in defense status, the system constructs a complete feature set containing data from unresolved states and a benign feature set containing data from resolved states during the training phase. The training module employs a random replacement strategy, randomly selecting some targets in each iteration to construct inputs using the benign feature set, while simultaneously constructing inputs for the remaining targets using the complete feature set, generating mixed training samples. These samples are used to update the model weights, enabling the model to adapt to changes in feature distribution caused by traffic scrubbing.

[0015] Regarding the defense feedback mechanism, during traffic scrubbing, the permutation-based neural network model continuously calculates the anomaly probability value of the protected server. If the anomaly probability value falls below the security threshold within a preset period, the system removes the protected server from the list of victim servers and instructs the gateway device to revoke the redirection routing policy and restore the pass-through mode.

[0016] This invention provides a massive, comprehensive DDoS attack detection system based on server and gateway collaboration. It offers the following advantages: 1. This invention effectively solves the problem of limited single-point detection perspective through the collaborative mechanism of server and gateway, and improves the detection accuracy of low-rate attacks at the application layer. The system uses an auxiliary detector deployed on the server side to extract application layer features such as resource access frequency and active resource size, and uses outbound response data packets to piggyback these features to the gateway. This design can integrate business logic layer features that the gateway cannot perceive with network layer traffic features without establishing additional control connections or increasing network communication overhead, thereby identifying covert attacks that have malicious business behavior characteristics but whose traffic rate has not reached the traditional threshold.

[0017] 2. This invention utilizes a permutation-equivariant neural network model to perform cross-server global analysis, effectively capturing collaborative attack patterns. By introducing a sorting-based grouping function and sorting matrix constraint mechanism, the model treats the input features of multiple servers as an unordered set and extracts the implicit cross-server traffic distribution features. This mechanism eliminates the impact of changes in the order of protected servers on detection stability, enabling the system to correlate small amounts of attack traffic scattered across different targets from a global perspective. This compensates for the lack of a global contextual perspective in traditional single-flow analysis techniques when facing carpet-bombing attacks.

[0018] 3. This invention ensures the continuous stability of the detection system after defense intervention by employing a dual-version feature preprocessing and random replacement training strategy. Addressing the issue of missing malicious statistical information on the server side after traffic scrubbing equipment is activated, this invention constructs hybrid training samples during the training phase, enabling the model to learn to adapt to changes in feature distribution caused by traffic scrubbing. This ensures that the detection model maintains accurate anomaly detection in both unresolved and resolved states, avoiding frequent changes in the victim server list and routing strategy oscillations caused by feature mismatch. Attached Figure Description

[0019] Figure 1 This is the system logic diagram of the present invention; Figure 2 This is an architecture diagram of the massive carpet-style DDoS attack detection system based on server-gateway collaboration of the present invention; Figure 3 Auxiliary model diagram for the server; Figure 4 This is a structural diagram of the substitutional equivariant model; Figure 5 This is a graph of sort-based grouping functions. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1 Please see the appendix Figure 1 This invention provides a massive carpet-style DDoS attack detection system based on server and gateway collaboration, including: gateway devices, protected server groups, and DDoS mitigation devices.

[0022] The gateway device is deployed at the edge access point of the protected network to connect the external network and the protected server group. A cross-server inbound traffic analyzer is deployed within the gateway device. The cross-server inbound traffic analyzer is configured to collect inbound traffic data passing through the gateway device and extract network layer traffic characteristics.

[0023] The protected server group is located downstream of the gateway device in the network and consists of multiple servers running online services. Each server is equipped with a server auxiliary detector.

[0024] The server-side auxiliary detector is configured to monitor resource access behavior at the server application layer. It parses the packet payload of inbound requests, calculates the frequency of resource access and the size of active resources within a preset time window, and thus generates server-side characteristics.

[0025] A data collaborative transmission mechanism is established between the server and the gateway device. The server encapsulates its own characteristics in reserved or optional fields of the outbound response data packet and sends these characteristics to the gateway device via piggyback transmission.

[0026] The cross-server inbound traffic analyzer is configured to receive and parse server-side features from multiple servers. It aligns and concatenates locally extracted network layer traffic features with the received server-side features to construct a comprehensive feature vector set.

[0027] The cross-server inbound traffic analyzer incorporates a permutation-equivariant neural network model. This model performs a global analysis of the comprehensive feature vector set, identifies target server IP addresses exhibiting abnormal traffic patterns, and generates a list of victim servers.

[0028] The DDoS mitigation device communicates with the gateway device to perform traffic scrubbing tasks. The gateway device updates routing policies based on the list of victim servers, redirecting traffic destined for servers in the list to the DDoS mitigation device. The DDoS mitigation device filters malicious traffic and injects the cleaned, benign traffic back into the protected server group.

[0029] The massive carpet-style DDoS attack detection system based on server and gateway collaboration provided by this invention is logically divided into two core collaborative components: a server-assisted detector and a cross-server inbound traffic analyzer.

[0030] The server-assisted detector is deployed on each protected server in the protected server group. The server-assisted detector is configured to perform application-layer feature extraction operations. It leverages the protected servers' ability to parse application-layer protocols to obtain access behavior data at the business logic layer.

[0031] The server-assisted detector is configured to statistically analyze resource access frequency and active resource size within a preset time window. Resource access frequency is defined as the cumulative number of times the same resource is requested within the preset time window. Active resource size is defined as the total amount of data involved in the current active requests. The server-assisted detector standardizes the resource access frequency and active resource size to generate server-side characteristics.

[0032] The server-assisted detector performs traffic piggybacking operations. It encodes server-side characteristics and embeds these characteristics into the outbound response data packet sent by the protected server to the gateway device. The server-assisted detector then transmits these server-side characteristics to the gateway device via the outbound response data packet.

[0033] A cross-server inbound traffic analyzer is deployed at the gateway device. It is configured to perform global traffic feature analysis. The cross-server inbound traffic analyzer monitors inbound traffic flowing through the gateway device and extracts network layer features from the inbound traffic. These network layer features include throughput metrics, packet length distribution metrics, and latency metrics.

[0034] The cross-server inbound traffic analyzer is configured to parse and reconstruct server-side features from outbound response packets. It then correlates the reconstructed server-side features with locally extracted network layer features. Based on the target server IP address and a preset time window, the cross-server inbound traffic analyzer aligns and concatenates the network layer features with the server-side features to generate a comprehensive feature vector.

[0035] The cross-server inbound traffic analyzer inputs multiple composite feature vectors corresponding to multiple protected servers into a permutational equivariant neural network model. The analyzer then uses this model to calculate similarity patterns among the traffic characteristics of the multiple protected servers. Based on these similarity patterns, the analyzer identifies coordinated attack behaviors targeting groups of protected servers.

[0036] The massive carpet-style DDoS attack detection method based on server and gateway collaboration provided by the present invention includes step S1: performing distributed multi-dimensional feature collection.

[0037] At the gateway device, a cross-server inbound traffic analyzer monitors inbound traffic passing through the gateway device in real time. For each target IP address, the cross-server inbound traffic analyzer extracts network layer characteristics within a preset time window. These network layer characteristics include throughput, packet length distribution, and packet arrival delay statistics.

[0038] At the protected server, the server-assisted detector performs application-layer feature extraction operations in parallel. The server-assisted detector parses the received application-layer request packets and identifies the resource objects that the application-layer request packets are attempting to access.

[0039] The server-side auxiliary detector tracks resource access frequency. Resource access frequency is the cumulative number of times the same resource object is requested within a preset time window.

[0040] The server-side auxiliary detector tracks the active resource size. Active resource size is the total amount of resource data involved in all requests currently in an active connection state. For malformed data packet requests that cannot be mapped to legitimate physical resources, the server-side auxiliary detector sets the corresponding resource size value to zero. The server-side auxiliary detector generates server-side characteristics based on resource access frequency and active resource size.

[0041] The massive carpet-style DDoS attack detection method based on server and gateway collaboration provided by the present invention includes step S2: performing feature transmission and collaborative fusion.

[0042] The server-assisted detector performs feature piggyback transmission. It serializes and encodes the server-side features. The server-assisted detector then writes the serialized and encoded server-side features into a reserved field or option field of the outbound response packet. The protected server sends the outbound response packet containing the server-side features to the gateway device.

[0043] The massive carpet-style DDoS attack detection method based on server and gateway collaboration provided by the present invention includes step S3: performing cross-server global inbound traffic analysis.

[0044] The cross-server inbound traffic analyzer obtains a comprehensive feature vector set corresponding to multiple protected servers. The comprehensive feature vector set contains the comprehensive feature vectors corresponding to the active protected servers in the network within a preset time window.

[0045] The cross-server inbound traffic analyzer inputs a set of composite feature vectors into a permutation equivariant neural network model. The permutation equivariant neural network model uses a shared feature extraction layer to independently encode each composite feature vector in the set. The shared feature extraction layer uses neural network weight parameters shared across all protected servers, outputting a single IP embedding vector corresponding to each protected server.

[0046] The permutational equivariant neural network model performs a ranking-based grouping aggregation operation. It aggregates all single-IP embedding vectors using a ranking-based grouping function. This function performs a ranking transformation on the set of single-IP embedding vectors, generating a global feature vector. This global feature vector represents the similarity patterns among the traffic characteristics of multiple protected servers.

[0047] The permutational equivariant neural network model performs hybrid feature classification. It concatenates the global feature vector with each individual IP embedding vector to generate a hybrid feature representation. The model then uses an anomaly detection layer to process this hybrid feature representation and calculate the anomaly probability value for each protected server.

[0048] Cross-server inbound traffic analyzers identify protected servers under attack based on anomaly probability values. The cross-server inbound traffic analyzer then adds the IP addresses of the identified protected servers to the victim server list.

[0049] Cross-server inbound traffic analyzers capture outbound response packets at the gateway device. They then parse and reconstruct server-side characteristics from reserved or option fields in the outbound response packets.

[0050] The cross-server inbound traffic analyzer retrieves locally cached network layer features based on the target server's IP address and a preset time window. It then aligns the network layer features with the server-side features using indexes. Finally, it concatenates the network layer and server-side features into a vector representation, generating a comprehensive feature vector.

[0051] The massive carpet-style DDoS attack detection method based on server and gateway collaboration provided by the present invention includes step S4: executing defense response and dynamic update.

[0052] The cross-server inbound traffic analyzer generates a list of victim servers. This list contains the IP addresses of protected servers identified as being under attack. The gateway device reads the victim server list and modifies its routing policy accordingly.

[0053] The gateway device performs traffic redirection. It redirects inbound traffic destined for addresses in the victim server list to the DDoS mitigation device. The DDoS mitigation device performs cleaning and filtering on the inbound traffic. The DDoS mitigation device then reinjects the cleaned, benign traffic back to the protected servers. The gateway device maintains a direct route for inbound traffic to protected servers not included in the victim server list.

[0054] A cross-server inbound traffic analyzer continuously performs detection during traffic scrubbing. A permutational equivariant neural network model receives features from both network layers and server-side features. During traffic scrubbing, server-side features only represent benign business behavior. The permutational equivariant neural network model leverages the adversarial feature adaptation learned during training to continuously output anomaly probability values ​​for protected servers.

[0055] The cross-server inbound traffic analyzer dynamically updates the victim server list. If the anomaly probability value of a protected server falls below a security threshold within a preset period, the cross-server inbound traffic analyzer removes the protected server's IP address from the victim server list. In response to the updated victim server list, the gateway device revoks the redirection routing policy for the removed protected server and restores direct inbound traffic.

[0056] The server-assisted detector in this embodiment of the invention performs application-layer monitoring based on a resource request-response abstraction model. This invention defines a resource request-response abstraction model that abstracts the online services running on the protected server into a sequence of request and response interactions.

[0057] The resource request-response abstract model defines a resource as a data object on a protected server that can be independently addressed by a client. It defines a request as an operation initiated by a client to locate and access a specific resource.

[0058] Upon receiving inbound data streams, the server-assisted detector parses the application-layer payload content. Based on the resource request-response abstract model, the server-assisted detector locates the target resource to which the request points. The server-assisted detector records access events for the target resource and uses these access events as the basis for extracting server-side features.

[0059] In this embodiment of the invention, the server-assisted detector is configured to perform the definition and calculation of key application layer features. The key application layer feature calculation method provided by this invention includes resource access frequency calculation and active resource size calculation.

[0060] The server-assisted detector statistically analyzes resource access frequency based on a preset time window. For each individual resource object within the protected server, the server-assisted detector accumulates the number of requests received for that individual resource object within the preset time window. The server-assisted detector maps the number of requests for different individual resource objects to a statistical distribution vector, generating resource access frequency characteristics.

[0061] The server-side auxiliary detector calculates the size of active resources. It identifies requests currently in an active connection state. The detector obtains the data size of the resource object corresponding to each active connection request. Finally, it calculates the sum of the data sizes of the resource objects corresponding to all active connection requests to obtain the active resource size characteristic.

[0062] For malformed data packet requests or requests that cannot be located to legitimate physical resources, the server auxiliary detector defines the resource size value corresponding to such requests as zero. The server auxiliary detector includes access events to zero-sized resources in the statistical scope of active resource size characteristics.

[0063] The server-assisted detector performs standardization processing on resource access frequency features and active resource size features. It maps the values ​​of these features to a uniform range, generating a standardized server-side feature vector.

[0064] The server-assisted detector in this embodiment of the invention is configured to perform feature standardization processing and lightweight piggyback transmission operations. The feature standardization and transmission method provided by this invention includes converting raw statistical data into a standard format feature vector and utilizing outbound traffic to carry feature data.

[0065] The server-assisted detector obtains raw statistics on resource access frequency and active resource size. It then performs normalization on these raw statistics. Finally, the server-assisted detector constructs a standardized server-side feature vector from the normalized values, independent of the specific service type.

[0066] The server-assisted detector performs in-band piggyback transmission. It serializes and encodes the standardized server-side feature vectors. It also intercepts outbound response packets from the protected server destined for the gateway device.

[0067] The server-assisted detector writes the serialized and encoded standardized server-side feature vector into the protocol header options field or reserved field of the outbound response packet. The protected server sends the outbound response packet carrying the standardized server-side feature vector to the gateway device. The gateway device parses the standardized server-side feature vector from the outbound response packet.

[0068] This invention defines a runtime feature mismatch problem in a detection process based on server and gateway collaboration. The detection scenario includes both unresolved and resolved states.

[0069] In the unmitigated state, DDoS mitigation devices do not perform scrubbing and filtering on inbound traffic destined for the protected server. The protected server receives mixed inbound traffic containing both benign and malicious traffic. Server-side features extracted by the server auxiliary detector characterize a mixed statistical distribution of benign and malicious traffic behavior.

[0070] In the mitigation state, the DDoS mitigation device performs scrubbing and filtering operations on inbound traffic destined for the protected server. The protected server only receives benign traffic that has been scrubbed by the DDoS mitigation device. The server-side features extracted by the server auxiliary detector only characterize benign traffic behavior.

[0071] Runtime feature mismatch is defined as the difference in statistical distribution of server-side features between mitigated and unmitigated states. In the mitigated state, external attack traffic persists on the gateway device, but server-side features lack statistical information on malicious traffic. If the detection model is trained solely on data from the unmitigated state, it cannot correctly correlate network layer features with server-side features in the mitigated state, leading to detection failure or inconsistent defense strategies.

[0072] This invention performs dual-version feature preprocessing during the training phase of the detection model. The dual-version feature preprocessing method provided by this invention includes constructing a complete feature set and constructing a benign feature set.

[0073] A cross-server inbound traffic analyzer constructs a complete feature set. This complete feature set is generated based on raw traffic data that has not been filtered by DDoS mitigation devices. The complete feature set includes network layer features extracted by gateway devices and server-side features extracted by server-assisted detectors in the unmitigated state. The server-side features extracted in the unmitigated state characterize the resource access statistics distribution when the protected server handles mixed traffic containing malicious attack traffic.

[0074] A cross-server inbound traffic analyzer constructs a benign feature set. This benign feature set is generated based on cleaned traffic data filtered by DDoS mitigation devices. The benign feature set includes network layer features extracted by gateway devices and server-side features extracted by server-assisted detectors under mitigation conditions. The server-side features extracted under mitigation conditions only characterize the resource access statistics distribution when the protected server processes benign business traffic.

[0075] This invention employs a random erasure and replacement strategy during the training of the detection model. The random erasure and replacement training method provided by this invention includes generating mixed training samples and updating model parameters.

[0076] In each training iteration, the cross-server inbound traffic analyzer determines the total number N of protected servers included in the current training batch. The cross-server inbound traffic analyzer randomly generates an integer m within a closed interval between zero and the total number N.

[0077] The cross-server inbound traffic analyzer randomly selects m protected servers from all protected servers in the current training batch as feature replacement targets.

[0078] The cross-server inbound traffic analyzer acquires benign feature set data corresponding to the feature replacement target. The benign feature set data consists of network layer features under mitigated conditions and server-side features. The cross-server inbound traffic analyzer uses the benign feature set data to construct the input features for the feature replacement target.

[0079] The cross-server inbound traffic analyzer identifies the remaining unselected protected servers in the current training batch. It acquires the complete feature set data for each unselected protected server. This complete feature set data consists of network layer features in the unrelieved state and server-side features. The cross-server inbound traffic analyzer uses this complete feature set data to construct input features for the unselected protected servers.

[0080] The cross-server inbound traffic analyzer combines the input features of the feature replacement target with the input features of the unselected protected server to generate a set of hybrid feature vectors.

[0081] The cross-server inbound traffic analyzer inputs a mixed feature vector set into a permutation equivariant neural network model. Based on the mixed feature vector set, the cross-server inbound traffic analyzer calculates a loss function and updates the weight parameters of the permutation equivariant neural network model according to the loss function value.

[0082] The multidimensional input data structure provided by this invention consists of a comprehensive feature vector set.

[0083] The comprehensive feature vector set contains the comprehensive feature vectors corresponding to all active protected servers in the network within a preset time window. Each comprehensive feature vector in the comprehensive feature vector set uniquely corresponds to one protected server.

[0084] The composite feature vector is generated by concatenating network layer features and server-side features. Network layer features include throughput, packet length distribution, and packet arrival delay statistics extracted by the cross-server inbound traffic analyzer at the gateway device. Server-side features include normalized resource access frequency and normalized active resource size extracted by the server-assisted detector at the protected server.

[0085] The comprehensive feature vector set is defined in data structure as an unordered set containing N comprehensive feature vectors. N represents the total number of protected servers within the current preset time window. The permutation equivariant neural network model processes the comprehensive feature vector set as an input tensor, and the input tensor does not have a predefined arrangement order.

[0086] This invention constructs a permutational equivariant neural network model. The permutational equivariant neural network model architecture provided by this invention includes a shared feature extraction layer, a global context aggregation layer, and an anomaly detection layer.

[0087] The shared feature extraction layer is configured to process a comprehensive set of feature vectors. The shared feature extraction layer employs a multilayer perceptron architecture. It applies the same set of neural network weight parameters in parallel to each comprehensive feature vector in the comprehensive feature vector set. The shared feature extraction layer maps low-dimensional comprehensive feature vectors to high-dimensional single-IP embedding vectors.

[0088] The global context aggregation layer receives a set of single-IP embedding vectors output by the shared feature extraction layer. The global context aggregation layer performs a numerical feature-based ranking transformation on this set of single-IP embedding vectors. This ranking transformation eliminates the influence of differences in the order of the protected servers within the input data structure on global feature extraction, ensuring that the model is invariant to the order of the input data.

[0089] The global context aggregation layer uses a one-dimensional convolutional neural network to process the sorted sequence of single-IP embedding vectors. It then extracts the cross-server traffic distribution patterns implicit in these vectors. The output of the global context aggregation layer is a global feature vector reflecting the overall network attack situation.

[0090] The permutational equivariant neural network model performs feature fusion operations. It concatenates the global feature vector with each individual IP embedding vector. This concatenation operation generates a hybrid feature representation. This hybrid feature representation simultaneously incorporates the individual behavioral characteristics of the protected server and the overall statistical characteristics of the protected server group.

[0091] The anomaly detection layer processes mixed feature representations. It employs a fully connected neural network structure. Utilizing shared classification weight parameters, the anomaly detection layer independently calculates the anomaly probability value for each mixed feature representation. Through this architecture, the permutational equivariant neural network model ensures that the output anomaly probability value sequence maintains permutational equivariance in its correspondence with the input comprehensive feature vector set.

[0092] This invention configures a sorting-based grouping function in the global context aggregation layer. The sorting-based grouping function provided by this invention is used to process unordered sets of single-IP embedding vectors and extract cross-server traffic distribution characteristics.

[0093] The global context aggregation layer performs a sorting transformation on the set of single IP embedding vectors. The global context aggregation layer rearranges all single IP embedding vectors in the set according to the numerical value of a specific dimension in each single IP embedding vector. This sorting transformation converts the unordered set of single IP embedding vectors at the input into a sequence of single IP embedding vectors with a defined order in the feature space.

[0094] The global context aggregation layer utilizes a one-dimensional convolutional neural network (CNN) to process single IP embedding vector sequences. The CNN is configured with convolutional kernels of a preset size. The kernels perform sliding window computation on the single IP embedding vector sequences. The CNN aggregates feature information from adjacent positions within the single IP embedding vector sequences, generating a feature sequence that includes local contextual relationships.

[0095] The global context aggregation layer performs max pooling on the feature sequences containing local context associations. Max pooling selects the maximum response value for each feature channel along the length of the feature sequence. Max pooling compresses the variable-length feature sequence into a fixed-dimensional global feature vector. This global feature vector serves as a compact representation of the overall attack situation and participates in subsequent feature fusion processes.

[0096] In this embodiment of the invention, a ranking matrix constraint loss function is configured during the training phase of the detection model. The loss function calculation method provided by this invention includes calculating the classification loss component, calculating the ranking matrix constraint loss component, and performing a weighted summation update.

[0097] The cross-server inbound traffic analyzer calculates the classification loss component. It then obtains the anomaly probability values ​​output by the permutation-equivariant neural network model. Next, it retrieves the ground truth labels corresponding to the protected servers. These labels indicate whether the protected servers are under attack within the current time window. Finally, the cross-server inbound traffic analyzer uses the cross-entropy function to calculate the difference between the anomaly probability values ​​and the ground truth labels, thus obtaining the classification loss component.

[0098] The global context aggregation layer generates a sorting matrix when performing sorting transformation operations. The sorting matrix is ​​a two-dimensional numerical matrix. It defines the position probability of each single-IP embedding vector in the single-IP embedding vector set within the sorted sequence.

[0099] The cross-server inbound traffic analyzer calculates the sorting matrix constraint loss component. This component is used to constrain the permutation matrix of the sorting matrix approximation standard. The cross-server inbound traffic analyzer also calculates the matrix product of the sorting matrix and its transpose.

[0100] The cross-server inbound traffic analyzer calculates the difference norm between the matrix product and the identity matrix. The cross-server inbound traffic analyzer defines the difference norm as a sorting matrix constraint loss component. This sorting matrix constraint loss component ensures that the sorting matrix satisfies orthogonality constraints, guaranteeing the effectiveness of sorting transformation operations.

[0101] The cross-server inbound traffic analyzer calculates the total loss function. It then performs a weighted sum of the classification loss component and the ranking matrix constraint loss component. Based on the total loss function, the cross-server inbound traffic analyzer updates the weight parameters of the permutation equivariant neural network model using the backpropagation algorithm.

[0102] Example 2 This invention proposes a server-gateway collaborative architecture that aggregates available network traffic and server-side features while minimizing feature transmission overhead. It supports cross-server analysis for carpet bombing attack detection and works in conjunction with DDoS mitigation systems. The method comprises two core components: a server-assisted detector and a cross-server inbound traffic analyzer. The server-assisted detector captures service access patterns for effective carpet bombing detection and provides a robust model training method to address runtime feature mismatches caused by traffic scrubbing. The cross-server inbound traffic analyzer can simultaneously analyze features from multiple servers and effectively leverages the similarity of carpet bombing traffic to identify anomalous traffic.

[0103] This invention proposes a massive, carpet-style DDoS attack detection system architecture based on server-gateway collaboration (e.g., Figure 2 (As shown). The system's collaborative architecture mainly consists of a server-side and a gateway-side. The server-side primarily extracts application-layer common features invisible to the gateway, including resource hit frequency and active resource size. These features are piggybacked through outbound traffic to reduce bandwidth overhead. The gateway-side (cloud) mainly aggregates locally extracted network-layer features (throughput, packet length, latency) and server backhaul features for global cross-server analysis. The core of this system mainly consists of two modules: a "server auxiliary detector" and a "cross-server inbound traffic analyzer."

[0104] The workflow of this invention's architecture is as follows: 1) The server extracts key service features that the gateway cannot see and sends them to the upstream detection model to achieve server-assisted detection. 2) Traffic features are extracted from the replicated traffic on the gateway and then merged with server-side features transmitted from the victim server. Based on the traffic and server-side features, cross-server inbound traffic analysis is performed, and victim IPs receiving malicious traffic are identified. 3) According to the victim IP list, malicious traffic is rerouted to DDoS mitigation devices, while benign traffic passes through the gateway. During an attack, the victim IP list is continuously updated to prevent dynamic carpet bombing attacks and promptly revert outdated defense strategies.

[0105] The specific implementation methods of the two modules are explained in detail below: Module 1: Server-Auxiliary Detector: This module is one of the core collaborative components of the detection system, deployed on the server side. It primarily utilizes a generalized server-side feature extraction method to extract application-layer access behavior features that the gateway cannot obtain, achieving feature standardization and lightweight reporting. Through training a robust server-aided model, it ensures reliable detection even after defenses are enabled. Includes: (1) Generalized Server-Side Feature Extraction: This method mainly abstracts online services into a resource request-response model. After receiving a request, the server locates the requested resource and generates a response. The standardized feature extraction of this method mainly includes two aspects: 1) Extracting resource access frequency features: counting the number of requests for the same resource within a preset time window; 2) Extracting active resource size features: counting the total amount of data involved in all current active requests. For malformed data packet requests, they can be mapped to access events of zero-size resources. At the same time, after feature extraction, a standard format feature vector is uniformly output, which is independent of the service type.

[0106] (2) Robust Server-Assisted Model: Traffic characteristics are collected at the gateway, while service access pattern characteristics are collected on the victim server. This distributed collection mechanism presents a key challenge during carpet bombing attacks: when an attack is detected, the victim server's traffic is redirected through DDoS mitigation devices, leading to runtime feature mismatches between the characteristics collected by the server and those collected by the gateway (see Appendix). Figure 3 When mitigation is off, both the victim server and the gateway receive the full traffic, allowing for direct signature merging. However, when mitigation is on, the traffic received by the victim server has already been inspected and filtered by the DDoS mitigation device, so the signatures collected on the server only represent benign traffic. Furthermore, the activation state of mitigation is not fixed but adjusted by real-time defense strategies, therefore the solution must adapt to both states.

[0107] Therefore, this invention preprocesses two versions of features for each test scenario: Featurecomplete (based on raw traffic collection) and Featurebenign (based on firewall-processed traffic collection). For each training sample (containing features from multiple servers for cross-server analysis), a subset of servers is randomly selected, and their server-side features are replaced with the Featurebenign version. During each inference in the training process, the number of server-side features erased is also randomly selected from zero to the maximum number of hosts.

[0108] Module 2: Cross-Server Inbound Traffic Analyzer: This module is deployed at the gateway or network central control point and is responsible for the collaborative analysis and correlation detection of inbound traffic characteristics from multiple servers. It primarily treats the characteristics of multiple servers as an unordered set using a permutation-based equivariant model structure, eliminating input order dependencies. Through a sorting-based group function design, it analyzes similarity patterns between traffic characteristics of different servers, identifies coordinated attack behaviors, and supports real-time analysis of large-scale server clusters while maintaining low computational overhead.

[0109] (1) Permutational Equivariant Model Structure: The carpet bombing detection model should avoid being affected by the order of input features in order to achieve robust detection. This invention adopts a permutational equivariant model structure (as shown in the attached diagram). Figure 4 This enables efficient cross-server inbound traffic analysis. In the permutation equivariant model, the characteristics of each IP (or each server) are shared through the MLP encoding. Embedding is then performed. These individual IP embeddings are then aggregated using a grouping function to generate a global feature representing all inputs. This global embedding is subsequently copied multiple times, concatenated with the previous individual IP embeddings, and used by the subsequent classifier model. Processing is required. Due to the classification model... It processes both per-IP characteristics and global characteristics, and supports cross-server analysis. Note that... and These are all MLPs that share features across single IPs, meaning that the processing for each stream is exactly the same, and therefore the order can be interchanged. The core structure of the permutation equivariant model is the group function. It aggregates features from multiple inputs. (Function) It is a symmetric function that takes multiple vectors and outputs a vector whose order remains unchanged for those vectors. Specifically, for any permutation... group function In the set of elements The following permutation equivariance properties are satisfied:

[0110] (2) Ranking-based grouping function: In carpet bombing detection tasks, the focus is on the similarity between elements within a set, rather than the overall features. While maintaining permutation equivariance, individual feature information needs to be preserved for similarity analysis.

[0111] Grouping functions based on sorting, such as Figure 5 As shown, it mainly receives multiple single-IP embeddings and outputs a global embedding containing compressed information of all individual IP features. First, a shared neural network is used to further compress the single-IP embeddings. Then, a separate Sort-Net is used to construct a ranking matrix, and this matrix is ​​used to rank the compressed embeddings. The ranked compressed embeddings are then used as the global embeddings for the permutation equivariant model. To ensure the effectiveness of the ranking matrix, this invention introduces a special loss function (…). The permutation matrix ensures that each feature is assigned to one and only one fixed position, thereby eliminating interference from the input order and providing a stable reference for subsequent malicious behavior identification.

[0112]

[0113] Where A is the sorting matrix predicted by Sort-Net. Let be the i-th row of the ranking matrix. The first term ensures that the ranking matrix is ​​close to an orthogonal matrix. The second term ensures that each row contains only one valid parameter. Since we restrict the matrix to orthogonality through the first term, the matrix that satisfies both constraints is a permutation matrix, which guarantees that each feature is assigned to exactly one position. In other words, the matrix that satisfies the above loss function will rearrange the input and can be used to rank individual IP embeddings.

[0114] In summary, this invention designs a server-gateway collaborative detection architecture that aggregates available network traffic and server-side features while minimizing feature transmission overhead. It supports cross-server analysis to detect carpet bombing attacks and works in conjunction with DDoS mitigation systems. A server-assisted detector is designed, employing a generalized server-side feature extraction method to extract application-layer access behavior features that gateways cannot obtain, achieving feature standardization and lightweight reporting. By training a robust server-assisted model, the system maintains reliable detection even after defenses are enabled. A cross-server inbound traffic analyzer is designed, treating the features of multiple servers as an unordered set through a permutation-equivariant model structure, eliminating input order dependencies. It analyzes similarity patterns between traffic features of different servers using a sorting-based grouping function design to identify coordinated attack behaviors and supports real-time analysis of large-scale server clusters while maintaining low computational overhead. The invention comprises a server-gateway collaborative detection system, a server-assisted detector, and a cross-server inbound traffic analyzer combining a permutation-equivariant model and a sorting-based grouping function.

[0115] Example 3 This invention provides an electronic device. The electronic device includes a processor, a memory, a communication interface, and a communication bus.

[0116] The processor, memory, and communication interface communicate with each other via a communication bus. The communication bus is used to enable data transmission between internal components of an electronic device.

[0117] The memory stores computer programs. Computer programs include computer operating instructions. Memory includes high-speed random access memory and non-volatile memory.

[0118] The processor executes the computer program stored in memory. When executing the computer program, the processor implements the steps of the aforementioned massive, blanket DDoS attack detection method based on server and gateway collaboration.

[0119] Specifically, when the processor executes the computer program, it implements a distributed, multi-dimensional feature acquisition process. The processor controls the cross-server inbound traffic analyzer on the gateway device side to extract network layer features. The processor controls the server-side auxiliary detector on the protected server side to extract server-side features.

[0120] When the processor executes the computer program, it performs feature transfer and collaborative fusion steps. The processor processes the server-side features acquired through piggybacking mechanisms. The processor aligns and concatenates the server-side features with the network layer features.

[0121] When the processor executes the computer program, it performs a cross-server global inbound traffic analysis. The processor uses a permutational equivariant neural network model to process the comprehensive feature vector set. The processor calculates the anomaly probability value corresponding to the protected server.

[0122] When the processor executes the computer program, it implements defense response and dynamic update steps. The processor updates the list of victim servers based on the anomaly probability value. The processor adjusts the routing policy and triggers DDoS mitigation operations based on the list of victim servers.

[0123] Example 4 This invention provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When executed by a processor, the computer program implements a method for detecting massive, blanket DDoS attacks based on server and gateway collaboration.

[0124] When the computer program is executed by the processor, it implements a distributed, multi-dimensional feature acquisition process. The computer program controls the cross-server inbound traffic analyzer on the gateway device side to extract network layer features. The computer program controls the server-side auxiliary detector on the protected server side to extract server-side features.

[0125] When the computer program is executed by the processor, it performs feature transfer and collaborative fusion steps. The computer program parses the server-side features transmitted via piggybacking. The computer program concatenates the server-side features with the network layer feature vectors to construct a comprehensive feature vector set.

[0126] When the computer program is executed by the processor, it performs cross-server global inbound traffic analysis. The program uses a permutational equivariant neural network model to process the comprehensive feature vector set. Finally, the program calculates the anomaly probability value corresponding to the protected server.

[0127] When the computer program is executed by the processor, it implements defense response and dynamic update steps. The computer program determines the attack status of the protected server based on the anomaly probability value. The computer program generates DDoS mitigation instructions for the protected server.

[0128] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A massive, comprehensive DDoS attack detection system based on server and gateway collaboration, characterized in that: include: A protected server group comprises multiple protected servers, each of which is equipped with a server auxiliary detector. The server-assisted detector is configured to monitor application layer behavior and extract server-side features, and send the server-side features to the gateway device through the reserved field or option field of the outbound response data packet; A gateway device connects an external network to the protected server group. The gateway device is equipped with a cross-server inbound traffic analyzer. The cross-server inbound traffic analyzer is configured to extract network layer features, parse the server-side features from the outbound response data packets, concatenate the network layer features and the server-side features to construct a comprehensive feature vector set, and use a permutation equivariant neural network model to perform global analysis on the comprehensive feature vector set to generate a list of victim servers. The DDoS mitigation device is communicatively connected to the gateway device; the gateway device is configured to modify the routing policy according to the victim server list, redirecting inbound traffic destined for protected servers in the victim server list to the DDoS mitigation device. The DDoS mitigation device is configured to clean inbound traffic and reinject benign traffic back to the protected server group.

2. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 1, characterized in that, The server-assisted detector includes: The resource access frequency statistics module is configured to count the number of requests for the same independent resource object within a preset time window and generate resource access frequency characteristics. The active resource size statistics module is configured to identify requests currently in an active connection state, calculate the total data size of the resource objects corresponding to the requests, and generate active resource size characteristics; wherein, the active resource size statistics module is configured to define the resource size value corresponding to malformed data packet requests or requests that cannot be located to legitimate physical resources as zero; The feature standardization module is configured to perform numerical normalization processing on the resource access frequency feature and the active resource size feature to generate standardized server-side features.

3. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 1, characterized in that, The server-assisted detector also includes: The feature encoding and embedding module is configured to serialize and encode the standardized server-side features, and write the serialized and encoded server-side features into the protocol header option field or reserved field of the outbound response data packet; The cross-server inbound traffic analyzer includes: The feature parsing and restoration module is configured to intercept the outbound response data packet and restore the server-side features from the protocol header option field or reserved field.

4. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 1, characterized in that, The cross-server inbound traffic analyzer also includes: The feature alignment and construction module is configured to perform index alignment and vector concatenation of the network layer features and the server-side features based on the target server IP address and a preset time window to generate the comprehensive feature vector set; the comprehensive feature vector set is defined in data structure as an unordered set containing multiple comprehensive feature vectors.

5. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 1, characterized in that, The permutational equivariant neural network model includes: A shared feature extraction layer is adopted, which uses a multilayer perceptron structure and is configured to apply the same set of neural network weight parameters in parallel to each comprehensive feature vector in the comprehensive feature vector set, and to map the comprehensive feature vector into a single IP embedding vector. The global context aggregation layer is configured to receive a set of single IP embedding vectors, perform a sorting-based grouping aggregation operation on the set of single IP embedding vectors, and output a global feature vector representing the overall network attack situation. The feature fusion and anomaly detection layer is configured to concatenate the global feature vector with each of the single IP embedding vectors to generate a hybrid feature representation, and use shared classification weight parameters to classify the hybrid feature representation and calculate the anomaly probability value corresponding to each of the protected servers.

6. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 5, characterized in that, The global context aggregation layer is internally configured with sorting-based grouping function logic, and the global context aggregation layer includes: The sorting transformation module is configured to rearrange the set of single IP embedding vectors according to the numerical values ​​of a specific dimension in the single IP embedding vectors, generating a sequence of single IP embedding vectors with a definite order in the feature space. The convolutional aggregation module is configured to perform sliding window computation on the single IP embedding vector sequence using a one-dimensional convolutional neural network to generate a feature sequence containing local contextual associations. The pooling compression module is configured to perform max pooling on the feature sequence containing local context associations to generate the global feature vector.

7. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 5, characterized in that, The system further includes a training module for training the permutation equivariant neural network model, the training module being configured as follows: Construct a complete feature set and a benign feature set. The complete feature set includes network layer features and server-side features in the unrelieved state, and the benign feature set includes network layer features and server-side features in the relieved state. In the training iteration, a portion of the protected servers are randomly selected as feature replacement targets. The input features of the feature replacement targets are constructed using the benign feature set, and the input features of the remaining protected servers are constructed using the complete feature set. The combined features generate a set of mixed feature vectors as training samples. The weight parameters of the permutation equivariant neural network model are updated using the hybrid feature vector set to adapt the model to the feature distribution changes caused by flow cleaning.

8. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 7, characterized in that, The training module further includes a ranking constraint loss calculation unit, which is configured as follows: Obtain the sorting matrix that defines the position probability of the single IP embedding vector set in the sorted sequence; Calculate the matrix product of the sorting matrix and the transpose of the sorting matrix; Calculate the difference norm between the matrix product and the identity matrix; The difference norm is defined as a sorting matrix constraint loss component to constrain the sorting matrix to satisfy orthogonality.

9. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 1, characterized in that, The cross-server inbound traffic analyzer also includes a defense feedback update module, which is configured as follows: During the DDoS mitigation device's traffic scrubbing process, the permutation equivariant neural network model is used to continuously calculate the anomaly probability value of the protected server. If the anomaly probability value is lower than the security threshold within a preset period, the IP address of the protected server is removed from the list of victim servers, and the gateway device is instructed to revoke the redirection routing policy for the protected server.

10. The massive carpet-style DDoS attack detection system based on server and gateway collaboration as described in claim 2, characterized in that, The server-assisted detector operates based on resource request-response parsing logic, which is configured as follows: Data objects in the protected server that can be independently addressed by the client are defined as resources, and operations initiated by the client to locate and access specific resources are defined as requests. Upon receiving an inbound data stream, the application layer load content is parsed to locate the target resource to which the request points, and access events for the target resource are recorded as the data basis for the resource access frequency statistics module and the active resource size statistics module.

Images