A DDoS attack identification method based on a variational quantum neural hybrid technology

Abstract

This invention relates to the field of network security technology and discloses a DDoS attack identification method based on variable quantum neural hybrid technology. The method includes: Step 1, mapping the quintuple of each network packet to a quantum bit state, performing quantum measurement using variable quantum circuits to obtain the quantum measurement result; Step 2, fusing the quantum measurement result with classical statistical features to obtain a hybrid feature vector, inputting the hybrid feature vector into a neural network to obtain the DDoS attack probability; Step 3, performing dynamic threshold adjustment and attack determination, judging whether a DDoS attack has occurred based on historical data and the DDoS attack probability. Utilizing this invention, through the high parallelism of quantum computing and the deep representation learning capability of neural networks, essential features are directly learned from data, dynamically adapting to changes, and identifying the most covert and complex attack patterns that are almost invisible in classical computing models.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a DDoS attack identification method based on variable quantum neural hybrid technology. Background Technology

[0002] DDoS attack identification is the process of quickly and accurately distinguishing between "malicious traffic congestion" and "normal peak traffic" within massive amounts of network traffic. Traditional DDoS attack identification technologies, whether based on static thresholds or simple machine learning models, are fundamentally limited by their static nature, shallow analysis, and reliance on explicit rules. Thresholding methods are rigid and passive, unable to differentiate between normal business peaks and carefully designed, slow-moving attacks, leading to high false positives and false negatives. Simple machine learning models, on the other hand, heavily rely on manual feature engineering, making it difficult to capture complex patterns in high-dimensional, non-linear traffic data, especially the synergistic effects of multi-vector attacks. More importantly, existing solutions generally lack true adaptive capabilities, failing to respond in real-time and intelligently when attackers dynamically adjust their strategies. Summary of the Invention

[0003] This invention provides a DDoS attack identification method based on variable quantum neural hybrid technology, which provides a more comprehensive description of the characteristics of DDoS attacks and helps to improve the accuracy of attack identification.

[0004] Therefore, the present invention provides the following technical solution: A DDoS attack identification method based on variable quantum neural hybrid technology, the method comprising: Step 1: Map the quintuple of each network packet to a quantum bit state, and use a variable quantum circuit to perform quantum measurement to obtain the quantum measurement result; Step 2: The quantum measurement results are fused with classical statistical features to obtain a hybrid feature vector. The hybrid feature vector is then input into a neural network to obtain the DDoS attack probability. Step 3: Perform dynamic threshold adjustment and attack determination, and determine whether a DDoS attack has occurred based on historical data and the DDoS attack probability.

[0005] Optionally, step 1 includes: Step 11: Perform traffic quantum encoding, mapping the quintuple of each network packet to a 4-qubit state. The quintuple includes source IP, destination IP, source port, destination port, and protocol. After processing, the quintuple corresponds to one binary code bit. Where i = 1, 2, 3, 4; the final quantum state is:

[0006] : Binary code bit, representing the encoding result of a certain element in the quintuple; quantum state |x It is represented as a combination of four qubits, each of which can be in the state of |0. or |1 The states are combined to form a four-qubit system; Step 12, employing a parameterized single-qubit gate Constructing trainable variable quantum circuits with two-qubit CNOT gates; unitary transform of variable quantum circuits. Represented as:

[0007] L: The number of circuit layers determines the depth and complexity of the circuit; k: qubit index; n: Number of qubits, corresponding to the dimension of the input quantum state; Trainable parameters for adjusting single-qubit gates The rotation angle; Step 13: Optimize the parameters of the variable quantum circuit; Step 14: Perform quantum measurement. Measure the quantum state (output state) after processing by the variable quantum circuit to obtain the expected value of the quantum characteristic, i.e., the quantum measurement result. :

[0008] in, Z The expected value of the Pauli-Z operator; Z: Represents the Pauli-Z operator; ∣ψ : Represents a quantum state vector; ψ |: indicates | ψ The left arrow.

[0009] Optionally, in step 13, firstly, in DDoS attack identification, the loss function is minimized using cross-entropy and quantum circuit fidelity, where the cross-entropy component is used to measure the prediction probability. With real labels The difference between them, while the quantum circuit fidelity part considers the degree of closeness between the output of the variable quantum circuit and the ideal output, through weighting coefficients. The effects of both can be balanced as follows:

[0010] N is the number of samples; As a true label, in DDoS attack identification, it indicates whether a sample is an attack sample; This is the predicted probability, that is, the probability that the model predicts a sample is an attack sample; Quantum circuit fidelity is used to measure the actual output state of a variable quantum circuit. Compared to the ideal output state The degree of closeness; λ is a weighting coefficient used to adjust the weight of quantum circuit fidelity in the loss function; Then, the fidelity between the actual output state and the ideal output state of the variational quantum circuit is calculated; the fidelity value is between 0 and 1, and the closer the value is to 1, the closer the actual output state is to the ideal output state; specifically as follows:

[0011] in, The ideal output state is the quantum state that a variable quantum circuit should produce under ideal conditions; The actual output state is the quantum state actually generated by the variable quantum circuit under the current parameter θ.

[0012] Optionally, step 2 includes: Step 21, transmit the quantum measurement results Concatenate with classical statistical features to form a hybrid feature vector The details are as follows:

[0013] m: Quantum feature dimension, representing the number of quantum measurement results; : The expected value of the i-th quantum feature, which reflects the projection of the quantum state in the Z direction; Packet rate: The number of data packets transmitted per unit time. : Bytes, indicating the amount of data transmitted; Step 22: Input the hybrid feature vector into a one-dimensional convolutional neural network (1D-CNN) for processing; through convolution, pooling and fully connected operations, the one-dimensional convolutional neural network learns the complex patterns in the features and outputs the DDoS attack probability.

[0014] Optionally, in step 22, the one-dimensional convolutional neural network 1D-CNN includes an input layer, a convolutional layer 1, a max pooling layer, a convolutional layer 2, a fully connected layer, and an output layer; The input layer is:

[0015] m: Quantum feature dimension, corresponding to the four expected values ​​obtained from quantum measurement, reflecting the projection characteristics of the quantum state in the Z direction, used to capture flow patterns that are difficult to capture by classical statistics; : The expected value of the i-th quantum feature, obtained through quantum measurement, represents the projection intensity of the quantum state under the Z basis, and is used to detect abnormal quantum state distribution in DDoS identification; Packet rate, a classic characteristic, reflects the number of data packets per unit time. This value increases significantly during DDoS attacks. : Byte count, a classic feature, reflects the amount of data transmitted; attack traffic is usually accompanied by abnormally high byte transmissions; Convolutional layer 1 is:

[0016] 32 1×3 filter weight matrices are used to extract local features; each filter learns a combination of features from 3 consecutive time windows to capture short-term traffic anomalies in DDoS identification; Bias vector: Adjusts the filter output threshold to enhance the sensitivity of 1D-CNN to low-amplitude anomalous signals; One-dimensional convolution operation extracts local features through a sliding window while preserving the time series sequence information; Activation functions introduce nonlinearity, enhance feature representation, filter negative noise, and highlight positively correlated anomalies. The max pooling layer is:

[0017] The pooling window size is 1×2 with a stride of 2, used for dimensionality reduction while preserving salient features; Convolutional layer 2 is:

[0018] : 64 1×3 filters to further extract high-order abstract features; used in DDoS identification to capture complex attack patterns; Bias vector, which adjusts the output distribution of the second convolutional layer; The fully connected layer is:

[0019] : Weight matrix, d is The features extracted by the convolutional layers are integrated to form a global feature representation; in DDoS identification, it is used to associate local features with global attack patterns. Bias vector, used to adjust the output distribution of fully connected layers; : Randomly discard 50% of neurons to prevent overfitting; The output layer is:

[0020] Weight vectors map the fully connected layer output to attack probabilities; Bias term, adjusts the final output threshold; The Sigmoid activation function outputs the probability of the DDoS attack. In DDoS identification, p close to 1 indicates a high probability attack, triggering the defense mechanism; p close to 0 indicates normal traffic.

[0021] Optionally, step 3 includes: Step 31: Perform dynamic threshold adjustment. Based on the historical DDoS attack frequency, adaptively adjust the judgment threshold τ to identify DDoS attacks. Step 32: Perform dynamic threshold convergence verification; Step 33: Perform DDoS attack determination. Based on the DDoS attack probability p output by the one-dimensional convolutional neural network (1D-CNN) and the dynamically adjusted judgment threshold τ, determine whether a DDoS attack has occurred; specifically as follows: If p > τ, it is determined to be a DDoS attack, and the defense mechanism is triggered; p: The probability of a DDoS attack output by the lightweight neural network, with a value range of [0,1]. The closer the value is to 1, the greater the probability of an attack. τ: The dynamically adjusted judgment threshold is used to compare with the attack probability p to determine whether to trigger the defense mechanism.

[0022] Optionally, in step 31, the formula for adjusting the judgment threshold τ is:

[0023] The threshold for judging the current time step; The threshold for judgment in the previous time step; : Smoothing coefficient, with a value range of [0,1]; it controls the degree of influence of historical thresholds on the current threshold. The closer α is to 1, the greater the influence of historical thresholds. The attack probability value output by the lightweight neural network over the past k time steps; : The median of attack probabilities over the past k time steps, used to reflect the central tendency of historical attack probabilities; k is the size of the historical window.

[0024] Optionally, in step 32, let the historical attack probability sequence be... Threshold updates can be viewed as first-order filtering:

[0025] when At that time, threshold sequence Converging to the steady-state value of historical attack probabilities:

[0026] It is the judgment threshold at the current time step, which is used to compare with the attack probability output by the lightweight neural network to determine whether a DDoS attack has occurred. It is the judgment threshold of the previous time step, reflecting the influence of the historical threshold on the current threshold; It is a smoothing coefficient that controls the weight of historical thresholds during the update process; The closer the threshold is to 1, the greater the influence of the historical threshold, and the smoother the threshold update. The closer the threshold is to 0, the greater the impact of the current historical attack probability on the threshold. It represents the attack probability over a past period, reflecting historical attack patterns, and is used to adjust the current threshold to adapt to changes in attack frequency. When the smoothing coefficient α is in the interval (0,1), as the time step t approaches infinity, the dynamic threshold sequence... It will converge to the steady-state value of the historical attack probability. , It is the expected value of the historical attack probability.

[0027] A DDoS attack identification device based on variable quantum neural hybrid technology, the device comprising: The quantum feature extraction unit maps the five-tuple of each network packet to a quantum bit state, and uses a variable quantum circuit to perform quantum measurement to obtain the quantum measurement result; The hybrid computing unit fuses the quantum measurement results with classical statistical features to obtain a hybrid feature vector, and inputs the hybrid feature vector into a neural network to obtain the DDoS attack probability; The dynamic decision-making unit performs dynamic threshold adjustments and attack determination, and judges whether a DDoS attack has occurred based on historical data and the DDoS attack probability.

[0028] A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to perform the steps of the DDoS attack identification method based on variable quantum neural hybrid technology.

[0029] The DDoS attack identification method based on variable quantum neural hybrid technology provided by this invention overcomes the aforementioned limitations of existing DDoS identification technologies. By leveraging the high parallelism of quantum computing and the deep representation learning capabilities of neural networks, it directly learns essential features from data, dynamically adapts to changes, and identifies the most covert and complex attack patterns that are almost invisible in classical computing models. Compared with existing technologies, this invention has the following technical advantages: Feature richness: Quantum-classical hybrid feature extraction can capture information that neither purely classical nor quantum features can obtain on their own. Quantum features can reflect microscopic traffic patterns, while classical features provide macroscopic traffic statistics. The combination of the two makes the model's feature description of DDoS attacks more comprehensive, which helps to improve the accuracy of attack identification.

[0030] Model Adaptability: Parameter optimization of the variable quantum circuit enables it to continuously adjust its parameters based on feedback from the loss function, better adapting to different DDoS attack types and scenarios. Simultaneously, the dynamic threshold adjustment mechanism adjusts the judgment threshold in real time based on historical attack frequencies, ensuring the system maintains high recognition performance even when facing changing attack frequencies. The optimized parameters allow the variable quantum circuit to more accurately predict attack probabilities when working in conjunction with neural networks, thereby improving the overall performance of the DDoS attack identification system. Furthermore, the parameter optimization process allows the variable quantum circuit to adapt to different types and intensities of DDoS attack scenarios, enhancing the model's generalization ability.

[0031] High efficiency and lightweight design: The use of a lightweight neural network structure reduces the computational load and number of parameters in the model, improves the model's operating efficiency, and lowers the requirements for hardware resources, enabling the solution to quickly and effectively identify DDoS attacks in resource-constrained environments. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart of a DDoS attack identification method based on variable quantum neural hybrid technology in a specific embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a DDoS attack identification device based on variable quantum neural hybrid technology in a specific embodiment of the present invention. Detailed Implementation

[0034] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0035] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0036] like Figure 1 The diagram shown is a flowchart of a DDoS attack identification method based on variable quantum neural hybrid technology in an embodiment of the present invention, including the following steps: Step 101, perform quantum feature extraction, specifically including: 1.1 Flow quantum coding.

[0037] Each network packet's quintuple (source IP, destination IP, source port, destination port, protocol) is mapped to a 4-qubit state. Specifically, each element (source IP, destination IP, source port, destination port, protocol) corresponds to a binary code bit after processing. Where i = 1, 2, 3, 4. The final quantum state is:

[0038] : Binary encoding bit, representing the encoding result of a certain element in the quintuple.

[0039] quantum state It is represented as a combination of four qubits, each of which can be in the state of or The states are combined to form a four-qubit system.

[0040] By encoding the quintuple information of network packets into quantum states, network security information is transformed into quantum states in quantum computing, providing input for subsequent quantum computing processing.

[0041] 1.2 Variable quantum circuits.

[0042] Using parameterized single-qubit gates A trainable circuit is constructed using a two-qubit CNOT gate. The unitary transform of the circuit is expressed as:

[0043] L: The number of circuit layers determines the depth and complexity of the circuit.

[0044] k: Quantum bit index.

[0045] n: Number of qubits, corresponding to the dimension of the input quantum state.

[0046] Trainable parameters for adjusting single-qubit gates The rotation angle is determined, and these parameters are optimized through training to improve the circuit's performance.

[0047] Variable quantum circuits extract and transform quantum features by performing a series of quantum gate operations on the input quantum state, enabling the circuit to learn patterns and characteristics in network traffic, thereby distinguishing between normal traffic and DDoS attack traffic.

[0048] 1.3 Optimization of Variable Quantum Circuit Parameters.

[0049] Variable quantum circuit parameter optimization involves adjusting the parameters of a variable quantum circuit to minimize a specific loss function. In the application scenario of DDoS attack identification, the goal is to enable the variable quantum circuit to better cooperate with the overall model for tasks such as attack probability prediction, thereby improving the model's ability to capture and accurately identify DDoS attack characteristics by optimizing the parameters.

[0050] This method combines cross-entropy and quantum circuit fidelity, with the cross-entropy component used to measure the prediction probability. With real labels The difference between them, while the quantum circuit fidelity part considers the degree of closeness between the output of the variable quantum circuit and the ideal output, through weighting coefficients. Balancing the impact of both. In DDoS attack detection, minimizing this loss function allows the model's predictions to more closely approximate reality while maintaining the performance of the variable quantum circuit. Specifically:

[0051] N is the number of samples.

[0052] As a true label, in DDoS attack identification, it indicates whether a sample is an attack sample (e.g., =1 indicates that it is an attack sample. =0 indicates a normal sample.

[0053] This is the prediction probability, that is, the probability that the model predicts a sample is an attack sample.

[0054] Quantum circuit fidelity is used to measure the actual output state of a variable quantum circuit. Compared to the ideal output state The degree of similarity.

[0055] λ=0.1 is a weighting coefficient used to adjust the weight of quantum circuit fidelity in the loss function.

[0056] Next, the fidelity between the actual output state and the ideal output state of the variable quantum circuit is calculated. The fidelity value is between 0 and 1; the closer the value is to 1, the closer the actual output state is to the ideal output state. In DDoS attack detection, ensuring the fidelity of the variable quantum circuit helps ensure the reliability of its output results, thereby improving the accuracy of the entire model in attack detection. Specifically:

[0057] The ideal output state is the quantum state that a variable quantum circuit should produce under ideal conditions.

[0058] The actual output state is the quantum state actually generated by the variable quantum circuit under the current parameter θ.

[0059] 1.4 Quantum measurement.

[0060] The output state (which is the quantum state after processing by the variable quantum circuit) is measured to obtain the expected value as the flow characteristic vector:

[0061] In the formula, Z : is the expected value of the Pauli-Z operator.

[0062] Z: Represents the Pauli-Z operator.

[0063] ∣ψ : Represents a quantum state vector.

[0064] ψ |:is| ψ The left arrow.

[0065] The expected value reflects the projection of the quantum state in the Z direction, serving as the extracted quantum feature.

[0066] Quantum measurement transforms the information of quantum states into classical numerical features, which can be used in subsequent attack identification to determine whether network traffic constitutes a DDoS attack.

[0067] Step 102, perform mixed calculations, specifically including: 2.1 Quantum and Feature Fusion.

[0068] Quantum measurement results This is then concatenated with classical statistical features (such as packet rate and number of bytes) to form a hybrid feature vector. This step combines information from quantum computing and classical computing to provide a more comprehensive feature representation. Specifically:

[0069] m: Quantum feature dimension, representing the number of quantum measurement results.

[0070] : The expected value of the i-th quantum feature, which reflects the projection of the quantum state in the Z direction.

[0071] Packet rate: The number of data packets transmitted per unit of time.

[0072] : Number of bytes, indicating the amount of data transmitted.

[0073] quantum characteristics It provides network traffic features extracted from a quantum computing perspective, capturing patterns that are difficult to detect with conventional computing. Classical features and It provides traditional network traffic statistics, such as packet transmission rate and data volume.

[0074] 2.2 Neural Networks.

[0075] The mixed feature vectors are then fed into a 1D-CNN for processing. Through convolution, pooling, and fully connected operations, the complex patterns in the features are learned using a one-dimensional convolutional neural network, and the attack probability is output.

[0076] 2.2.1 Input layer.

[0077] Specifically as follows:

[0078] m: Quantum feature dimension (m=4 in this method), corresponding to the four expected values ​​obtained by quantum measurement, reflecting the projection characteristics of the quantum state in the Z direction, used to capture flow patterns that are difficult to capture by classical statistics.

[0079] : The expected value of the i-th quantum feature, obtained through quantum measurement, represents the projection intensity of the quantum state under the Z basis. In DDoS identification, it is used to detect abnormal quantum state distributions, such as quantum state collapse patterns caused by attack traffic.

[0080] Packet rate: A classic characteristic that reflects the number of data packets per unit time. This value increases significantly during DDoS attacks.

[0081] Byte count: A classic characteristic that reflects the amount of data transmitted. Attack traffic is usually accompanied by abnormally high byte transmissions.

[0082] 2.2.2 Convolutional layer 1.

[0083] Specifically as follows:

[0084] 32 1×3 filter weight matrices are used to extract local features (such as traffic burst patterns). Each filter learns a combination of features from three consecutive time windows to capture short-term traffic anomalies (such as periodic pulses of SYN flooding) in DDoS identification.

[0085] Bias vector: Adjusts the filter output threshold to enhance the sensitivity of the one-dimensional convolutional neural network model to low-amplitude anomalous signals.

[0086] One-dimensional convolution operation extracts local features through a sliding window while preserving the time series sequence information.

[0087] Activation functions introduce nonlinearity, enhance feature representation, filter negative noise, and highlight positively correlated abnormal features (such as high response values ​​of attack traffic).

[0088] 2.2.3 Max pooling layer.

[0089] Specifically as follows:

[0090] The pooling window size is 1×2 with a stride of 2, used for dimensionality reduction while preserving salient features. In DDoS scenarios, robustness to burst attacks is enhanced by extracting local maxima (such as peak packet rate) while reducing computational cost.

[0091] 2.2.4 Convolutional layer 2.

[0092] Specifically as follows:

[0093] 64 1×3 filters are used to further extract higher-order abstract features (such as hierarchical representations of traffic patterns). In DDoS identification, this is used to capture complex attack patterns (such as mixed features of multiple attack stream types).

[0094] : Bias vector, which adjusts the output distribution of the second convolutional layer.

[0095] 2.2.5 Fully connected layer.

[0096] Specifically as follows:

[0097] Weight matrix (d is) The features extracted by the convolutional layers are integrated to form a global feature representation. In DDoS identification, this is used to correlate local features with global attack patterns (such as global traffic anomalies in distributed attacks).

[0098] Bias vector, used to adjust the output distribution of fully connected layers.

[0099] Randomly discarding 50% of neurons prevents overfitting and enhances the model's generalization ability, especially improving robustness when there are various types of DDoS attacks (such as UDP flooding and HTTP slow attacks).

[0100] 2.2.6 Output layer.

[0101] Specifically as follows:

[0102] : Weight vector, which maps the output of the fully connected layer to the attack probability.

[0103] : Bias term, adjusts the final output threshold.

[0104] Sigmoid activation function, outputs attack probability. In DDoS identification, p close to 1 indicates a high probability attack, triggering defense mechanisms; p close to 0 indicates normal traffic.

[0105] In this invention, a hybrid feature vector is formed by fusing quantum and classical features. The hybrid feature vector provides multi-dimensional input to the neural network and enhances the feature richness by combining quantum and classical features.

[0106] An end-to-end attack identification process is formed by extracting local patterns through convolutional layers, reducing dimensions through pooling layers, integrating global features through fully connected layers, and making decisions through the output layer.

[0107] Neural networks provide real-time decision support for DDoS attack identification through efficient feature extraction and classification. Their output probability p can be directly used to trigger defense strategies (such as traffic scrubbing and rate limiting), while model parameters (such as filter weights) can feed back into quantum circuit optimization, forming a quantum-classical cooperative closed-loop system.

[0108] Step 103, Dynamic Decision-Making: After the neural network outputs the attack probability, the dynamic decision-making layer uses dynamic threshold adjustment and attack judgment steps to make a final judgment based on historical data and the current attack probability. Specifically, this includes: 3.1 Dynamic threshold adjustment.

[0109] The purpose of dynamic threshold adjustment is to adaptively adjust the judgment threshold τ based on historical DDoS attack frequency, in order to more accurately identify attacks. Specifically:

[0110] : The threshold for judging the current time step.

[0111] The judgment threshold of the previous time step.

[0112] : Smoothing coefficient, with a value range of [0,1]. It controls the degree of influence of historical thresholds on the current threshold; the closer α is to 1, the greater the influence of historical thresholds.

[0113] : The attack probability value output by the lightweight neural network over the past k time steps.

[0114] : The median of attack probabilities over the past k time steps, used to reflect the central tendency of historical attack probabilities. k is the size of the historical window.

[0115] By dynamically adjusting the threshold, the system can adapt to changes in attack frequency over different time periods. For example, during periods of frequent attacks, the threshold may be raised to avoid false positives; while during periods of fewer attacks, the threshold may be lowered to increase sensitivity to attacks.

[0116] 3.2 Dynamic threshold convergence verification.

[0117] Let the historical attack probability sequence be... Threshold updates can be viewed as first-order filtering:

[0118] when At that time, threshold sequence Converging to the steady-state value of historical attack probabilities:

[0119] It is the judgment threshold at the current time step, used to compare with the attack probability output by the lightweight neural network to determine whether a DDoS attack has occurred.

[0120] It is the judgment threshold of the previous time step, reflecting the influence of historical thresholds on the current threshold.

[0121] It is a smoothing coefficient that controls the weight of historical thresholds during the update process. The closer the threshold is to 1, the greater the influence of the historical threshold, and the smoother the threshold update. The closer it is to 0, the greater the impact of the current historical attack probability on the threshold.

[0122] It represents the attack probability over a past period, reflecting historical attack patterns, and is used to adjust the current threshold to adapt to changes in attack frequency.

[0123] When the smoothing coefficient α is in the interval (0,1), as the time step t approaches infinity, the dynamic threshold sequence... It will converge to the steady-state value of the historical attack probability. Here It is the expected value of the historical attack probability. This verification method ensures that the dynamic threshold adjustment algorithm has stability and predictability in long-term operation, and will not fluctuate without bounds. It can be stably adjusted around a reasonable value.

[0124] The convergence verification of the dynamic threshold theoretically guarantees the stability and reliability of the dynamic threshold adjustment algorithm. As the system runs for longer, the threshold tends to reach a stable state without divergence or unreasonable fluctuations, thus enhancing the algorithm's credibility and practicality.

[0125] 3.3 Attack Detection.

[0126] The attack determination step uses the attack probability p output by the one-dimensional convolutional neural network and the dynamically adjusted threshold τ to determine whether a DDoS attack has occurred.

[0127] Specifically: if p > τ, it is determined to be a DDoS attack, and the defense mechanism is triggered.

[0128] p: The attack probability output by the lightweight neural network, with a value range of [0,1]. The closer the value is to 1, the greater the probability of an attack.

[0129] τ: The dynamically adjusted judgment threshold is used to compare with the attack probability p to determine whether to trigger the defense mechanism.

[0130] By comparing the attack probability with a dynamic threshold, the system can accurately determine in real time whether a DDoS attack has occurred and promptly trigger corresponding defense measures, such as traffic scrubbing and IP access restriction, to protect the normal operation of network services.

[0131] In summary, the DDoS attack identification method based on variable quantum neural hybrid technology of the present invention has the following technical features compared with the prior art: Quantum-classical hybrid feature extraction: This method combines the expected value obtained from quantum measurements with classical network features (packet rate, number of bytes) to form a unique hybrid feature vector. This fusion approach fully leverages the potential advantages of quantum computing in handling certain complex patterns and the ability of classical features to describe the basic attributes of network traffic, providing more comprehensive and richer feature information for DDoS attack identification.

[0132] Variable quantum circuit parameter optimization: A specialized loss function is designed, combining cross-entropy and quantum circuit fidelity to optimize the parameters of the variable quantum circuit. This approach enables the variable quantum circuit to better adapt to DDoS attack detection tasks, improving its feature extraction and prediction capabilities.

[0133] Dynamic Threshold Adjustment and Attack Detection: The judgment threshold is adaptively adjusted based on historical attack frequencies. A dynamic threshold adjustment formula is used, and attack detection is performed based on the adjusted threshold and the attack probability output by the lightweight neural network. This dynamic adjustment mechanism can adapt to changes in attack frequency over different time periods and scenarios, improving the accuracy of attack identification.

[0134] Accordingly, embodiments of the present invention also provide a DDoS attack identification device based on variable quantum neural hybrid technology, such as... Figure 2The image shown is a schematic diagram of one possible structure of the device. This DDoS attack identification device based on variable quantum neural hybrid technology includes the following modules: The quantum feature extraction unit 201 maps the five-tuple of each network packet to a quantum bit state, and uses a variable quantum circuit to perform quantum measurement to obtain the quantum measurement result; The hybrid computing unit 202 fuses the quantum measurement results with classical statistical features to obtain a hybrid feature vector, and inputs the hybrid feature vector into a neural network to obtain the DDoS attack probability; The dynamic decision-making unit 203 performs dynamic threshold adjustment and attack determination, and determines whether a DDoS attack has occurred based on historical data and the DDoS attack probability.

[0135] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0136] The present invention also provides a storage medium, which is a computer-readable storage medium storing a computer program thereon, the computer program being executable when it runs. Figure 1 The method shown may include some or all of the steps. The storage medium may include read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0137] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data provider to another website, computer, server, or data provider via wired or wireless means.

[0138] The embodiments of the present invention have been described in detail above. Specific implementation methods have been used to illustrate the present invention. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and systems of the present invention, and are merely some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention, and the content of this specification should not be construed as a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A DDoS attack identification method based on variable quantum neural hybrid technology, characterized in that, The method includes: Step 1: Map the quintuple of each network packet to a quantum bit state, and use a variable quantum circuit to perform quantum measurement to obtain the quantum measurement result; Step 2: The quantum measurement results are fused with classical statistical features to obtain a hybrid feature vector. The hybrid feature vector is then input into a neural network to obtain the DDoS attack probability. Step 3: Perform dynamic threshold adjustment and attack determination, and determine whether a DDoS attack has occurred based on historical data and the DDoS attack probability.

2. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 1, characterized in that, Step 1 includes: Step 11: Perform traffic quantum encoding, mapping the quintuple of each network packet to a 4-qubit state. The quintuple includes source IP, destination IP, source port, destination port, and protocol. After processing, the quintuple corresponds to one binary code bit. Where i = 1, 2, 3, 4; the final quantum state is: : Binary code bit, representing the encoding result of a certain element in the quintuple; quantum state |x It is represented as a combination of four qubits, each of which can be in the state of |0. or |1 The states are combined to form a four-qubit system; Step 12, employing a parameterized single-qubit gate Constructing trainable variable quantum circuits with two-qubit CNOT gates; unitary transform of variable quantum circuits. Represented as: L: The number of circuit layers determines the depth and complexity of the circuit; k: qubit index; n: Number of qubits, corresponding to the dimension of the input quantum state; Trainable parameters for adjusting single-qubit gates The rotation angle; Step 13: Optimize the parameters of the variable quantum circuit; Step 14: Perform quantum measurement. Measure the quantum state (output state) after processing by the variable quantum circuit to obtain the expected value of the quantum characteristic, i.e., the quantum measurement result. : in, Z The expected value of the Pauli-Z operator; Z: Represents the Pauli-Z operator; ∣ψ : Represents a quantum state vector; ψ |: indicates | ψ The left arrow.

3. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 2, characterized in that, In step 13, firstly, in DDoS attack identification, the loss function is minimized using cross-entropy and quantum circuit fidelity, where the cross-entropy component is used to measure the prediction probability. With real labels The difference between them, while the quantum circuit fidelity part considers the degree of closeness between the output of the variable quantum circuit and the ideal output, through weighting coefficients. The effects of both can be balanced as follows: N is the number of samples; As a true label, in DDoS attack identification, it indicates whether a sample is an attack sample; This is the predicted probability, that is, the probability that the model predicts a sample is an attack sample; Quantum circuit fidelity is used to measure the actual output state of a variable quantum circuit. Compared to the ideal output state The degree of closeness; λ is a weighting coefficient used to adjust the weight of quantum circuit fidelity in the loss function; Then, the fidelity between the actual output state and the ideal output state of the variational quantum circuit is calculated; the fidelity value is between 0 and 1, and the closer the value is to 1, the closer the actual output state is to the ideal output state; specifically as follows: in, The ideal output state is the quantum state that a variable quantum circuit should produce under ideal conditions; The actual output state is the quantum state actually generated by the variable quantum circuit under the current parameter θ.

4. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 1, characterized in that, Step 2 includes: Step 21, transmit the quantum measurement results Concatenate with classical statistical features to form a hybrid feature vector The details are as follows: m: Quantum feature dimension, representing the number of quantum measurement results; : The expected value of the i-th quantum feature, which reflects the projection of the quantum state in the Z direction; Packet rate: The number of data packets transmitted per unit time. : Bytes, indicating the amount of data transmitted; Step 22: Input the hybrid feature vector into a one-dimensional convolutional neural network (1D-CNN) for processing; through convolution, pooling and fully connected operations, the one-dimensional convolutional neural network learns the complex patterns in the features and outputs the DDoS attack probability.

5. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 4, characterized in that, In step 22, the one-dimensional convolutional neural network 1D-CNN includes an input layer, convolutional layer 1, max pooling layer, convolutional layer 2, fully connected layer, and output layer; The input layer is: m: Quantum feature dimension, corresponding to the four expected values ​​obtained from quantum measurement, reflecting the projection characteristics of the quantum state in the Z direction, used to capture flow patterns that are difficult to capture by classical statistics; : The expected value of the i-th quantum feature, obtained through quantum measurement, represents the projection intensity of the quantum state under the Z basis, and is used to detect abnormal quantum state distribution in DDoS identification; Packet rate, a classic characteristic, reflects the number of data packets per unit time. This value increases significantly during DDoS attacks. : Byte count, a classic feature, reflects the amount of data transmitted; attack traffic is usually accompanied by abnormally high byte transmissions; Convolutional layer 1 is: 32 1×3 filter weight matrices are used to extract local features; each filter learns a combination of features from 3 consecutive time windows to capture short-term traffic anomalies in DDoS identification; Bias vector: Adjusts the filter output threshold to enhance the sensitivity of 1D-CNN to low-amplitude anomalous signals; One-dimensional convolution operation extracts local features through a sliding window while preserving the time series sequence information; Activation functions introduce nonlinearity, enhance feature representation, filter negative noise, and highlight positively correlated anomalies. The max pooling layer is: The pooling window size is 1×2 with a stride of 2, used for dimensionality reduction while preserving salient features; Convolutional layer 2 is: : 64 1×3 filters to further extract high-order abstract features; used in DDoS identification to capture complex attack patterns; Bias vector, which adjusts the output distribution of the second convolutional layer; The fully connected layer is: : Weight matrix, d is The features extracted by the convolutional layers are integrated to form a global feature representation; in DDoS identification, it is used to associate local features with global attack patterns. Bias vector, used to adjust the output distribution of fully connected layers; : Randomly discard 50% of neurons to prevent overfitting; The output layer is: Weight vectors map the fully connected layer output to attack probabilities; Bias term, adjusts the final output threshold; The Sigmoid activation function outputs the probability of the DDoS attack. In DDoS identification, p close to 1 indicates a high probability attack, triggering the defense mechanism; p close to 0 indicates normal traffic.

6. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 1, characterized in that, Step 3 includes: Step 31: Perform dynamic threshold adjustment. Based on the historical DDoS attack frequency, adaptively adjust the judgment threshold τ to identify DDoS attacks. Step 32: Perform dynamic threshold convergence verification; Step 33: Perform DDoS attack determination. Based on the DDoS attack probability p output by the one-dimensional convolutional neural network (1D-CNN) and the dynamically adjusted judgment threshold τ, determine whether a DDoS attack has occurred; specifically as follows: If p > τ, it is determined to be a DDoS attack, and the defense mechanism is triggered; p: The probability of a DDoS attack output by the lightweight neural network, with a value range of [0,1]. The closer the value is to 1, the greater the probability of an attack. τ: The dynamically adjusted judgment threshold is used to compare with the attack probability p to determine whether to trigger the defense mechanism.

7. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 6, characterized in that, In step 31, the formula for adjusting the judgment threshold τ is: The threshold for judging the current time step; The threshold for judgment in the previous time step; : Smoothing coefficient, with a value range of [0,1]; it controls the degree of influence of historical thresholds on the current threshold. The closer α is to 1, the greater the influence of historical thresholds. The attack probability value output by the lightweight neural network over the past k time steps; : The median of attack probabilities over the past k time steps, used to reflect the central tendency of historical attack probabilities; k is the size of the historical window.

8. The DDoS attack identification method based on variable quantum neural hybrid technology according to claim 7, characterized in that, In step 32, let the historical attack probability sequence be... Threshold updates can be viewed as first-order filtering: when At that time, threshold sequence Converging to the steady-state value of historical attack probabilities: It is the judgment threshold at the current time step, which is used to compare with the attack probability output by the lightweight neural network to determine whether a DDoS attack has occurred. It is the judgment threshold of the previous time step, reflecting the influence of the historical threshold on the current threshold; It is a smoothing coefficient that controls the weight of historical thresholds during the update process; The closer the threshold is to 1, the greater the influence of the historical threshold, and the smoother the threshold update. The closer the threshold is to 0, the greater the impact of the current historical attack probability on the threshold. It represents the attack probability over a past period, reflecting historical attack patterns, and is used to adjust the current threshold to adapt to changes in attack frequency. When the smoothing coefficient α is in the interval (0,1), as the time step t approaches infinity, the dynamic threshold sequence... It will converge to the steady-state value of the historical attack probability. , It is the expected value of the historical attack probability.

9. A DDoS attack identification device based on variable quantum neural hybrid technology, characterized in that, The device includes: The quantum feature extraction unit maps the five-tuple of each network packet to a quantum bit state, and uses a variable quantum circuit to perform quantum measurement to obtain the quantum measurement result; The hybrid computing unit fuses the quantum measurement results with classical statistical features to obtain a hybrid feature vector, and inputs the hybrid feature vector into a neural network to obtain the DDoS attack probability; The dynamic decision-making unit performs dynamic threshold adjustments and attack determination, and judges whether a DDoS attack has occurred based on historical data and the DDoS attack probability.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program, when run by the processor, executes the steps of the DDoS attack identification method based on variable quantum neural hybrid technology as described in any one of claims 1 to 8.

Images