DDoS attack detection method based on ResNet and attention mechanism

Abstract

This invention discloses a DDoS attack detection method based on ResNet and an attention mechanism, comprising: preprocessing raw network traffic data; reconstructing the data into a three-channel two-dimensional image to form a sample set through feature extraction and standardization; constructing a model including input, feature extraction, and output parts, wherein the feature extraction part adopts BTNK residual blocks with skip connections and embeds an SE-CA attention module, generates channel attention weights through squeezing and activation operations, and optimizes the structure using depthwise separable convolution; training the model using a label smoothing regularization loss function and an AdamW optimizer; and finally using the trained model to identify and classify traffic. This invention effectively improves the model's ability to identify DDoS attack features and its detection efficiency, while also enhancing the model's generalization performance and deployment feasibility.

Description

Technical Field

[0001] This invention belongs to the field of computer network security technology, and in particular relates to a DDoS attack detection method based on ResNet and attention mechanism. Background Technology

[0002] With the rapid development of technologies such as the Internet of Things (IoT) and edge computing, the scale and complexity of Distributed Denial-of-Service (DDoS) attacks are constantly increasing, posing a significant threat to cybersecurity. Traditional DDoS detection methods largely rely on rule-based matching, traffic threshold statistics, or machine learning models. These methods often have the following shortcomings when dealing with new and evolving attack patterns: High model complexity makes it difficult to deploy in resource-constrained environments: Existing deep learning detection models (such as RLS-DDoSNET based on ResNet) have high detection accuracy, but they have a large number of parameters and high computational complexity, requiring strong computing resources and making it difficult to run efficiently in resource-constrained environments such as edge devices and IoT terminals.

[0003] Lightweighting methods have limited effectiveness: While existing lightweighting methods (such as structured pruning) can reduce the number of model parameters, they often lead to a decrease in detection accuracy and a lack of significant improvement in inference speed, failing to achieve a good balance between accuracy and efficiency.

[0004] Limited feature extraction capability: Traditional lightweight convolutional networks (such as LCNN, LUCID, etc.) have simple structures and lack the ability to model long-distance dependencies and global features, making it difficult to extract deep discriminative features from complex and ever-changing attack traffic.

[0005] Insufficient real-time performance: Existing methods are complex in data preprocessing, feature transformation and other stages, which affects the real-time performance of detection and makes it difficult to meet the needs of rapid response to attacks. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a DDoS attack detection method based on ResNet and attention mechanism, thereby resolving the issues present in the prior art.

[0007] To achieve the above objectives, this invention provides a DDoS attack detection method based on ResNet and attention mechanisms, comprising: Preprocess the raw network traffic data to obtain a sample set; A DDoS attack detection model is constructed, comprising an input part, a feature extraction part, and an output part connected in sequence; the feature extraction part contains multiple residual blocks with skip connections; at least one residual block integrates an SE-CA attention mechanism module, which is used to generate channel attention weights through global average pooling and fully connected operations, and to perform weighted adjustment on the feature channels; Based on the sample set, the DDoS attack detection model is trained using a label-smoothed regularized cross-entropy loss function and the AdamW optimizer. The trained DDoS attack detection model is used to detect network traffic data and output the corresponding classification and detection results of attack or normal traffic.

[0008] Optionally, the process of preprocessing the raw network traffic data to obtain a sample set includes: The network traffic features are extracted from the raw network traffic data to obtain an initial feature dataset; the initial feature dataset is cleaned, the cleaned feature data is standardized, and the standardized numerical sequence is reconstructed into a two-dimensional image with three channels to obtain the sample set.

[0009] Optionally, the standardized numerical sequence is reconstructed into a two-dimensional image with three channels, including: The standardized numerical sequence is divided into multiple data blocks; the continuous samples contained in each data block are assigned to three different groups; the values ​​of each group of samples are filled into a two-dimensional matrix to obtain data for three channels respectively; the data of the three channels are combined to construct a three-channel two-dimensional image corresponding to the data block.

[0010] Optionally, the input portion includes a convolutional layer, a batch normalization layer, a ReLU activation function layer, and a max pooling layer arranged sequentially; the convolutional layer is used to perform convolution operations on the input three-channel two-dimensional image to extract preliminary features.

[0011] Optionally, the residual stage of the feature extraction part includes a BTNK block; the BTNK block includes three convolutional layers, each of which is followed by a batch normalization layer and a ReLU activation function; the BTNK block has a shortcut connection that directly connects the block input to the output of the last convolutional layer; the second convolutional layer is a depthwise separable convolutional layer.

[0012] Optionally, the SE-CA attention mechanism module includes: A global average pooling layer is used to perform a squeezing operation on the input feature map to obtain channel feature vectors; The first fully connected layer, the ReLU activation function, and the second fully connected layer, connected in sequence, are used to perform activation operations on the channel feature vectors to generate channel weight parameters. The Sigmoid activation function, connected after the second fully connected layer, is used to convert the channel weight parameters into channel attention weights. The multiplication unit is used to multiply the channel attention weights by the input feature map and output a weighted feature map.

[0013] Optionally, the output portion includes a global average pooling layer and a fully connected layer; the global average pooling layer is used to spatially downsample the feature map output by the feature extraction portion to obtain a feature vector; the fully connected layer is used to map the feature vector to the classification result.

[0014] Optionally, the cross-entropy loss function for label smoothing regularization is: ; Among them, L LS It is a labeled smooth cross-entropy loss, y i It is the true label of category i. It is a smooth Hirsch number. p i It is the probability that the model predicts for category i.

[0015] Optionally, the AdamW optimizer calculates the first-order moment estimate and the second-order moment estimate of the gradient, corrects the deviation of the first-order moment estimate and the second-order moment estimate, and updates the model parameters based on the corrected first-order moment, the corrected second-order moment, the learning rate and the weight decay coefficient.

[0016] Optionally, after cleaning the initial feature dataset and before standardization, the method further includes: using synthetic oversampling techniques to oversample samples of a minority of categories in order to balance the number of samples in each category of the sample set.

[0017] Compared with the prior art, the present invention has the following advantages and technical effects: This invention proposes a DDoS attack detection method based on ResNet and an attention mechanism. At the data processing level, by effectively converting network traffic data into a structured image format and balancing the class distribution, high-quality input is provided for model training, solving the training challenges caused by the unstructured nature of the original data and class imbalance. At the model architecture level, by introducing an improved residual structure with skip connections and combining it with a channel attention mechanism, not only is the training stability and feature reuse efficiency of the deep network guaranteed, but the model's ability to focus on and extract key attack features is also significantly enhanced. Simultaneously, through a lightweight convolutional design, model complexity and computational overhead are effectively reduced while maintaining high detection accuracy. At the training optimization level, the specific regularized loss function and optimization strategy effectively improve the model's generalization ability and convergence stability. Ultimately, these collaborative innovations enable this solution to exhibit high accuracy, strong robustness, and good real-time detection potential under various complex network environments and attack types, resulting in a significant improvement in overall detection performance. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a diagram showing the overall network structure of the RLS-DDoSNET according to an embodiment of the present invention. Figure 2 This is a structural diagram of the BTNK module according to an embodiment of the present invention; Figure 3 This is a data processing flowchart of an embodiment of the present invention; Figure 4 This is a schematic diagram of a dataset sample according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the SE-CA network structure according to an embodiment of the present invention; Figure 6 This is a schematic diagram of a BTNK block structure improved by depth-separable convolution in an embodiment of the present invention. Detailed Implementation

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0021] Example 1 This embodiment provides a DDoS attack detection method based on ResNet and attention mechanism, including: (a) RLS-DDoSNET model; The RLS-DDoSNET model mainly consists of six parts. STAGE 0 is the input, STAGE 5 is the output, and the remaining parts are feature extraction parts used for feature reuse and fusion. The skip connection property in the residual blocks is used to achieve feature reuse and summation fusion. The overall structure of the RLS-DDoSNET network is as follows: Figure 1 As shown.

[0022] (1) Input section; The input part consists of an initial convolutional layer, batch normalization, ReLU activation function, and max pooling layer. It extracts preliminary features from the input image. The main function of the input part is to prepare features for subsequent deep networks, helping the network to train more stably, reducing training time and computation. The input of the initial convolution is a 3-channel image, and the output is 64 feature maps. The convolutional kernel size is 7x7, the stride is 2, and the padding is 3. The convolutional layer extracts features from the input data. It scans the image through the convolutional kernel to extract local spatial features. Batch normalization is applied to the output of the convolutional layer to normalize the features of each channel. Batch normalization calculates the mean and variance of each channel. Each data point is subtracted from the mean of that channel and divided by the standard deviation of that channel, thereby standardizing the data to zero mean and unit variance. The standardization process formula is as shown in (1).

[0023] (1) Where X is the input data, μ is the mean, and σ is the mean. 2 ϵ is the variance, and ϵ is a small constant used to prevent division by zero errors.

[0024] The batch normalization layer introduces two parameters: γ (scaling factor) and β (offset factor), which are used to perform a linear transformation on the normalized data to restore the expressive power of the network. The scaling and offset formulas are as shown in formula (2).

[0025] (2) The ReLU activation function is used to introduce non-linearity. Max pooling layers are used to reduce the size of the feature map. The ReLU formula is shown in equation (3).

[0026] (3) That is, for an input value x, when x>0, output x; when x≤0, output 0.

[0027] (2) Feature extraction section; In the feature extraction section, this invention improves the residual block structure of the ResNet model, carefully designing four residual blocks to extract features at different scales. Unlike the traditional ResNet model, this invention proposes a novel multi-scale feature fusion mechanism, introducing cross-stage feature connections in each residual block to achieve more efficient information flow and feature reuse. STAGE 1 is mainly responsible for preliminary feature extraction and initial network construction, employing a lightweight convolutional module with depthwise separable convolutions, reducing computation while retaining key features. STAGE 2, based on the preliminary feature extraction, increases the number of BTNK modules and introduces multi-branch feature extraction paths, enhancing feature extraction capabilities and capturing richer feature levels. STAGE 3, as the core of feature extraction, dynamically fuses local and global features to capture more abstract and complex feature representations. STAGE 4 is responsible for further processing and fusion of the features extracted in the first three stages. This invention generates the final feature representation through adaptive weighted fusion of multi-scale features, effectively improving the model's feature representation capability and classification accuracy for complex attack traffic.

[0028] BTNK blocks are used in each feature extraction module. This structure differs slightly from standard residual blocks; it replaces two convolutional layers with three. The first layer uses a 1x1 convolutional layer for dimensionality reduction and expansion, reducing computation. The second layer uses a 3x3 convolutional layer for the main feature extraction. The third layer uses a 1x1 convolutional layer to restore dimensionality. Each convolutional layer is followed by a BatchNorm layer and a ReLU activation function for output normalization. The BTNK module structure diagram is shown below. Figure 2 As shown.

[0029] The BTNK module can alleviate the gradient vanishing problem, solving the issue in traditional deep networks where gradients may decay layer by layer during backpropagation, leading to slower or even non-existent updates in earlier layers. The BTNK block uses shortcut connections to ensure that even when the gradients in the convolutional parts become very small during backpropagation, the gradients can flow to the forward layers via shortcuts, thus helping the network to effectively propagate gradients. The shortcut connections in the BTNK block avoid the degradation phenomenon found in deep networks. The gradient propagation and shortcut connection formulas are shown in equation (4).

[0030] (4) Where L is the loss function, x is the input data or feature, y is the output of the residual block, and F(x) is the feature extracted through operations such as convolution.

[0031] Using the BTNK module makes it easier to train deep networks, even very deep ones. The network can directly copy the input to the output via shortcut connections, making it easier to converge during initial training and avoiding the vanishing gradient problem. The residual connection formula is shown in formula (5).

[0032] (5) Where x is the input, F(x,{W i }) The output is processed by convolution, BatchNorm, ReLU, etc., W i y represents the weights of the convolutional layer, and y represents the final output.

[0033] (3) Output section; The output of RLS-DDoSNET employs a multi-level feature fusion classification structure to transform the high-level features extracted by the network into the final output for classification. This structure mainly includes a global average pooling layer, a fully connected layer, and an activation function. This invention proposes a novel pooling strategy that combines global average pooling and local region pooling to capture local details in the feature map while preserving key information in the channels, further reducing the number of parameters and enhancing the model's ability to perceive feature details. To reduce computational cost and overfitting risk, the fully connected layer is optimized using a sparse connection strategy and a dynamic weight allocation mechanism, enabling the model to improve classification accuracy while reducing the number of parameters. The fully connected layer maps the pooled feature vectors to the classification space, generating a predicted score for each class.

[0034] (ii) Loss function; Label Smoothing is a regularization technique designed to improve the generalization ability of a model and reduce overfitting. It reduces the risk of overfitting by transforming the "hard label" of the target label into a "soft label," thus reducing the model's overconfidence in a particular class. This makes model training more stable, especially in complex tasks or with imbalanced data, resulting in better performance. For an N-class classification problem, the formula for the cross-entropy loss function using Label Smoothing is shown in Equation (6).

[0035] (6) Among them, L LS It is a labeled smooth cross-entropy loss, y i It is the true label of category i. It is a smooth seldom number. p i It is the probability that the model predicts for category i.

[0036] (iii) Optimizer; The model uses the AdamW optimizer, a variant of the Adam optimizer. AdamW introduces a weight decay mechanism on top of Adam, essentially constraining the model's parameter updates through L2 regularization. Specifically, AdamW separates the gradient update from the weight decay term with each parameter update, thus avoiding the interaction between weight decay and gradient calculation in the original Adam optimizer. This adjustment helps maintain better generalization performance during training and prevents the model from overfitting in the later stages of training.

[0037] Weight decay, by introducing a regularization term into the loss function, keeps the model's parameters within a smaller range, thereby improving the model's generalization ability to the training data. Using the AdamW optimizer, the model exhibits more stable convergence behavior during long training periods, especially in the later stages of training, and also demonstrates stronger resistance to overfitting on different datasets. Therefore, the introduction of the AdamW optimizer provides a more stable and efficient training process for the ResNet50 model used in this invention.

[0038] The update rules of the AdamW optimizer can be divided into two parts: one part is gradient-based updates, and the other part is updates related to weight decay.

[0039] The gradient update part calculates the first moment of the gradient ( m t ) and second moment ( v t The exponentially weighted average of ) is given by formulas (7) and (8): (7) (8) in, g t It is the gradient at the current time step t. and These are the first and second moments of the gradient at the previous time step, respectively. and It is a hyperparameter that controls the decay of the first and second moments.

[0040] because and The initial value of is 0, so in the early stage of training, the values ​​of these two moments will be biased. AdamW introduces a bias correction, as shown in formulas (9) and (10): (9) (10) The parameter update formula for AdamW is formula (11).

[0041] (11) Where η is the learning rate. It is a small constant, and λ is the attenuation coefficient. These are the model parameters from the previous step.

[0042] (iv) Data processing; The data processing workflow mainly includes data preparation, data cleaning, and data transformation steps. The specific data processing workflow is as follows: Figure 3 As shown.

[0043] (1) Data preparation; The original PCAP files of three datasets (IDS2017-DDoS, IDS2018-DDoS, and CICDDoS2019) were analyzed using the CICFlowMeter tool to extract a large number of network traffic features. These traffic data were then generated into CSV files, recording the characteristics of each flow. These features include basic traffic characteristics, statistical characteristics, protocol characteristics, time-series characteristics, and advanced characteristics. Basic traffic characteristics include start time, end time, traffic size, transport layer protocol, source / destination IP address, and source / destination port. Statistical characteristics include the number of packets, number of bytes, traffic duration, flow rate, latency, minimum, maximum, and average packet size. Protocol characteristics are calculated for different protocols (e.g., TCP, UDP, ICMP). Time-series characteristics include the interval and duration of each packet, helping to analyze traffic patterns. Advanced characteristics include traffic ratios, traffic direction, and number of connections, enabling further identification of abnormal traffic or attack patterns.

[0044] (2) Data cleaning; After obtaining the CSV files, data cleaning was performed. Each file contains over 80 traffic features. To better train the model for DDoS attack detection, features that do not distinguish between attack and normal traffic were removed. These features included static features such as flow ID, source IP, source port, destination IP, destination port, protocol, and timestamps. These features could not determine whether a particular flow ID or source IP would generate attack packets, so they were removed to reduce data complexity. Furthermore, some data in the dataset contained missing values ​​or data from different device models. Samples with missing values ​​and unreasonable values, such as NAN, -INF, and +INF, were removed. After these steps, duplicate features and features that were completely constant were removed from all labels to minimize the impact of the data on model performance. Constant features were removed from the data, including Bwd PSH Flags, Fwd URG Flags, BwdURG Flags, FIN Flag Count, PSH Flag Count, ECE Flag Count, Fwd Avg Bytes / Bulk, Fwd Avg Packets / Bulk, Fwd Avg Bulk Rate, Bwd Avg Bytes / Bulk, Bwd Avg Packets / Bulk, and Bwd Avg Bulk Rate. When dealing with duplicate features, the first original feature was retained, and its duplicates were removed. These duplicate features included: RST Flag Count, Fwd Header Length, Subflow Fwd Packets, Subflow Fwd Bytes, Subflow Bwd Packets, and Subflow Bwd Bytes. After data cleaning, 60 important features were retained.

[0045] (3) Data conversion; After data cleaning, data transformation is performed. Since the data is saved in CSV format, and convolutional neural networks perform well when trained on image-based datasets, in order to obtain efficient DDoS attack detection results, the CSV format data is converted into image data. Therefore, min-max normalization is used to process each feature of the dataset, and the normalization formula is shown in formula (12).

[0046] (12) Where X is the original data point. X min It is the minimum value in the dataset. X max It is the maximum value in the dataset.X scaled These are standardized data points, ranging from 0 to 255. This formula first scales the data to the interval [0, 1], then expands it to the interval [0, 255] by multiplying by 255. Thus, the minimum value in the original data is mapped to 0, the maximum value to 255, and the intermediate values ​​are linearly mapped to their corresponding values ​​between 0 and 255.

[0047] Before converting network traffic into image form, all normal and attack samples are separated. After separation, the data is divided into blocks, each containing 180 samples. These 180 samples are iteratively converted into 60x60x3 images. The first 60 samples from each block are converted into an image matrix for channel 1, the middle 60 samples for channel 2, and the last 60 samples for channel 3. Finally, these matrices are mapped to the RGB channels of an image. These normal and attack sample matrices are converted into images using the OpenCV library and labeled accordingly. Data transformation is performed on each CSV file of the dataset until all samples are converted into images. Figure 4 A sample of each type of transformed image is given, including 11 types of DDoS attacks as well as normal traffic.

[0048] To address the class imbalance problem in the dataset, synthetic oversampling is used to process the transformed dataset. This involves creating synthetic samples of the minority class to increase their quantity, thereby reducing class imbalance in the dataset.

[0049] (v) Improve the RLS-DDoSNET detection model; (1) Introduce the SE-CA attention mechanism module; This invention introduces a module that combines SE (Search Engine) and channel attention mechanisms (Squeeze-Excitation with Channel Attention, SE-CA), the network structure of which is as follows: Figure 5 As shown.

[0050] The SE module processes channel features through two steps: "squeezing" and "activation." Global average pooling compresses the features of each channel into a scalar, capturing global information about each channel. Weights for each channel are generated using fully connected layers and a sigmoid activation function. This emphasizes important channels and suppresses less important ones, thereby enhancing the model's focus on key features. This improves the model's expressive power and enhances classification accuracy and performance.

[0051] The CA module focuses on the relationships between channels, adjusting the importance of each channel in the feature map by weighting it. Global pooling is typically used to capture channel information, and the original feature map is readjusted using the learned weights. By capturing the interrelationships between different channels, the model's understanding of complex features is enhanced, improving its discriminative power.

[0052] This invention introduces an SE-CA module, combining the advantages of SE and CA attention mechanisms. By integrating the strengths of both mechanisms, it can focus on important information at the channel level and adjust the weights of each channel through global pooling. This effectively captures global information from each channel, enhancing key features and suppressing redundant information. This feature extraction method helps the model learn to focus on features related to DDoS attacks, thereby improving the model's ability to identify attack traffic.

[0053] The combined process is as follows: The input feature map is processed by global average pooling to generate compressed features. Attention weights are generated through two fully connected layers. The CA attention weights are then used to adjust the channel information in the input feature map.

[0054] (2) Optimize BTNK blocks using depthwise separable convolution; Traditional standard convolution requires numerous convolution operations, especially with multi-channel input, leading to a sharp increase in computation and parameters. This results in long training times and slow inference speeds. Standard convolution also has a large number of parameters and large intermediate feature map sizes, requiring significant memory consumption during model training and inference, which is a challenge for memory-constrained devices. Therefore, this invention modifies the BTNK block using depthwise separable convolution, which decomposes the standard convolution operation into two parts: depthwise convolution and pointwise convolution. Depthwise convolution performs convolution operations on each input channel separately, while pointwise convolution uses 1x1 convolutions to integrate information between channels. This significantly reduces the number of parameters and computational cost of the model. Compared to standard convolution, depthwise separable convolution significantly reduces computational complexity and memory requirements. The modified BTNK block structure is shown below. Figure 6 As shown.

[0055] (vi) Experimental analysis; This experiment was conducted on a server equipped with an Intel(R) Xeon(R) Gold 5418Y CPU (12 cores), an NVIDIA RTX 4090 GPU (24GB RAM), and 120GB of RAM. Python version 3.10.14 was used, and all models were implemented using PyTorch version 2.1.0. The batch size of the model was 64, the number of epochs was 1000, and the AdamW optimizer was used as the optimization algorithm with a learning rate of 0.00001.

[0056] The detailed hardware environment and the software environment required for the experiment are shown in Table 1.

[0057] Table 1 (1) Evaluation indicators; This evaluation used accuracy, precision, recall, and F1 score as evaluation metrics. Accuracy represents the proportion of samples correctly classified by the model, and is suitable for cases where the class distribution is balanced, as shown in formula (13). Precision measures the proportion of samples predicted as positive that are actually positive, as shown in formula (14). Recall measures the proportion of samples that are actually positive that are predicted as positive, as shown in formula (15). The F1 score is the harmonic mean of precision and recall, which can comprehensively measure the accuracy and coverage of the classifier in predicting positive classes, as shown in formula (16).

[0058] (13) (14) (15) (16) Among them, TP (True Positives) refers to the number of samples correctly predicted as positive by the model, TN (True Negatives) refers to the number of samples correctly predicted as negative by the model, FP (False Positives) refers to the number of samples incorrectly predicted as positive by the model, and FN (False Negatives) refers to the number of samples incorrectly predicted as negative by the model.

[0059] In DDoS attack detection, selecting a suitable deep learning model is crucial for improving detection accuracy and reducing inference time. Since the model is based on the ResNet architecture, four ResNet models with different depths—ResNet18, ResNet34, ResNet50, and ResNet101—were compared to evaluate their performance in DDoS attack detection. Comparison data is shown in Table 2.

[0060] Table 2 The experimental results in the table show that the accuracy of the ResNet model in DDoS attack detection improves with increasing network depth. ResNet18 has the shortest inference time, but its accuracy is relatively low, indicating that this model is weak and cannot effectively improve accuracy. The inference times of ResNet34 and ResNet50 are both around 0.03 seconds. Although ResNet50's inference speed is slightly slower, its accuracy improvement far exceeds that of ResNet34. While ResNet101 has the highest accuracy, its inference time is significantly longer compared to other models, resulting in lower inference efficiency. The RLS-DDoSNET model has slightly lower accuracy than ResNet101, but its inference time is much shorter, achieving a good balance between accuracy and inference time, demonstrating the best overall performance. Therefore, RLS-DDoSNET outperforms ResNet18, ResNet34, and ResNet50 in accuracy, and compared to ResNet101, its inference time is more efficient, enabling it to complete the detection task faster.

[0061] (2) Comparative experiment; To verify the effectiveness of the optimized model of this invention, binary classification comparison experiments were conducted using SVM, SAE-MLP, Composite DNN, DCFD-CA, Random Forest, DeepRES, ASD2ER, FL-LSTM, FL-B-BiGRU, DSA-BiLSTM, and SAE-CNN models. The optimized RLS-DDoSNET is represented by the model of this invention.

[0062] SVM and Random Forest are machine learning algorithms; SAE-MLP is a stacked autoencoder multilayer perceptron model. Stacked autoencoders are based on the idea of ​​layer-by-layer representation in deep learning, utilizing the dimensionality reduction capability of autoencoders to learn features layer by layer by stacking multiple autoencoders to form a deep model structure; Composite DNN is a composite and efficient DDoS detection algorithm proposed by Amaizu et al. This algorithm consists of two deep neural network models with different structures; DCFD-CA is a dual-channel fusion detection model based on convolutional neural networks and attention mechanisms. This model inputs statistical feature samples into a CNN-based local feature extraction channel and an attention-based global feature extraction channel, fusing the functions of the two models, then using a stacking method to fuse the feature data from the two different channels, and finally using a three-layer neural network for detection and classification; DeepRES is a deep residual neural network function and synthetic oversampling technique, introducing an enhanced DDoS attack detection method; ASD2ER is an intrusion detection method based on reinforcement learning and integrating an adaptive sample distribution dual-experience pool replay mechanism for detecting DDoS attacks. FL-LSTM is a federated learning and long short-term memory framework approach that deploys an initial LSTM model on all user servers. Each user trains their individual model and uploads the model parameters to a central server, which aggregates the parameters to form a new global model. FL-B-BiGRU is an improved federated learning detection model that combines recurrent neural networks. DSA-BiLSTM is a DDoS attack detection model that integrates DSA and BiLSTM, introducing feature fusion and data augmentation techniques. SAE-CNN is a DDoS attack detection model that integrates SAE and CNN and incorporates adaptive preprocessing techniques.

[0063] The evaluation was conducted on the IDS2017-DDoS dataset, and the accuracy results for binary classification are shown in Table 3.

[0064] Table 3 As shown in Table 3, on the IDS2017-DDoS dataset, the accuracy of the model proposed in this invention is 0.9912, second only to DCFD-CA, but DCFD-CA is weaker in other metrics. Compared with other models, the model proposed in this invention performs well in accuracy, indicating that its overall classification ability is superior to most models. Accuracy measures the proportion of samples that the model predicts to be positive but are actually positive. The accuracy of the model proposed in this invention is 0.9921, which is much higher than other models, especially significantly higher than SVM and SAE-MLP. This shows that the model proposed in this invention has very high accuracy in predicting positive samples and can effectively reduce the number of false positives. This proves that the overall performance of the model proposed in this study is superior to other compared models, and it has a more comprehensive detection capability in the DDoS attack detection process.

[0065] The binary classification experiment using the above model and the model of this invention was conducted on the IDS2018-DDoS dataset, and the results are shown in Table 4.

[0066] Table 4 As shown in Table 4, on the IDS2018-DDoS dataset, the model of this invention outperforms most models in all four metrics: accuracy, precision, recall, and F1 score, demonstrating superior overall performance. Compared to DCFD-CA's accuracy of 0.9821, the model of this invention exhibits higher accuracy, and the improvements in precision, recall, and F1 score are more significant. Compared to Random Forest's accuracy of 0.9856 and Composite DNN's accuracy of 0.9774, the model of this invention demonstrates a more balanced performance in precision, recall, and F1 score, proving that it possesses stronger overall capabilities when handling complex tasks.

[0067] The experimental results on the CICDDoS2019 dataset are shown in Table 5.

[0068] Table 5 As shown in Table 5, on the CICDDoS2019 dataset, the model of this invention achieves optimal overall performance across all evaluation metrics (accuracy, precision, recall, and F1 score), ensuring that the model can effectively distinguish between positive and negative samples. Therefore, the model of this invention demonstrates optimal comprehensiveness.

[0069] Multi-class comparison experiments were conducted using three selected public datasets. Among the models selected for comparison, SAE-MLP, Composite DNN, DCFD-CA, ASD2ER, DSA-BiLSTM, SAE-CNN, and FL-B-BiGRU were used to conduct multi-class comparison experiments with the model of this invention. The comparison models are represented by A1 to A7 respectively.

[0070] The multi-class classification results on the IDS2017-DDoS dataset are shown in Table 6. The multi-class classification accuracy results on the IDS2018-DDoS dataset are shown in Table 7. The multi-class classification results on the CICDDoS2019 dataset are shown in Table 8.

[0071] Table 6 Table 6 shows that the model of this invention performs excellently across all attack types and normal traffic classifications, especially achieving extremely high accuracy in DDoS and GoldenEye attacks, reflecting its superior performance in malicious traffic identification. It also demonstrates high accuracy in detecting low-speed or covert attacks such as Slowloris and Slow HTTP, showcasing the model's robustness and ability to effectively handle diverse attacks. The model maintains high accuracy across different attack types and datasets, demonstrating its stability and generalization ability.

[0072] Table 7 Table 7 shows that the model of this invention performs exceptionally well across all categories on the IDS2018-DDoS dataset, particularly in attack categories such as HOIC, LOIC HTTP, GoldenEye, Hulk, and Slowloris, where its accuracy is significantly higher than other models. The model accurately identifies highly covert attack types like Slowloris and LOIC UDP, demonstrating its strong robustness. Across various malicious traffic types, the model maintains high accuracy and stability, indicating excellent performance under different attack modes. The model of this invention exhibits superior performance in malicious traffic detection tasks, particularly in accuracy, stability, and the ability to identify complex attack types, showing significant advantages over other models.

[0073] Table 8 Table 8 shows that the model of this invention achieves significant improvements in some previously weaker categories (such as LDAP, UDPLAG, and TFTP). This indicates that the model has been optimized in feature extraction, data augmentation, or model architecture, enhancing its ability to identify these categories. Particularly in the detection of more complex attack traffic (such as UDP, DNS, and SYN), the model of this invention demonstrates a significant performance improvement. Overall, the model of this invention achieves high accuracy across all categories, indicating good overall performance and strong generalization ability. The model proposed in this invention demonstrates excellent performance in malicious traffic detection tasks, especially in accuracy and generalization ability, showing significant advantages over traditional methods.

[0074] (3) Ablation experiment; This invention designs a series of ablation experiments to evaluate the performance of the ResNet-based DDoS detection model. The experiments mainly verify the performance of the SE and CA modules of the optimized RLS-DDoSNET network model. Binary classification verification is performed using the three datasets mentioned above. The accuracy results of the ablation experiments on the three datasets are shown in Table 9.

[0075] Table 9 Table 9 analyzes the ablation experiments of the RLS-DDoSNET model, highlighting the independent contributions of each module (SE and CA) and their combined effect. The following is a detailed analysis of each experimental case: The baseline model without attention mechanisms (SE and CA removed) shows a significant performance drop after removing these modules, with both accuracy and precision below 0.9. This indicates that while residual blocks effectively mitigate gradient vanishing, they lack enhancement mechanisms for important features, making it difficult for the model to fully extract key information when facing complex DDoS attack features. Without attention mechanisms, the model cannot weight the importance of each channel, resulting in insufficient classification ability, especially in datasets with high feature redundancy such as CICDDoS2019. Removing SE and retaining only CA (channel attention mechanism) allows CA to focus on assigning different weights to different channels, thus highlighting the most discriminative channel features. Using only the CA module significantly improves model performance, demonstrating its effectiveness in DDoS attack detection and its ability to enhance channel-level discrimination. Removing CA and retaining only the SE (Squeeze-and-Excitation) attention mechanism, the SE module generates weights for each channel through global average pooling and a fully connected network, emphasizing more representative channels. The SE module also effectively improves model performance, but the improvement is slightly less than that of the CA module. When the SE and CA modules are combined, the model achieves optimal accuracy and precision. The SE module enhances the global feature representation, while the CA module further refines the importance of channels, enabling the model to extract features from different levels.

[0076] The optimized RLS-DDoSNET model (including SE and CA modules) can significantly improve the accuracy and precision of DDoS attack detection, proving the effectiveness and necessity of the attention mechanism for network security detection tasks.

[0077] (4) Simulated attack experiments; This invention constructed a simulated attack experiment, using the open-source attack tool Hping3 for attack testing. An experimental environment was set up, including a server, network devices, and an attacking machine. The Hping3 open-source attack tool was installed on the attacking machine, and relevant attack parameters were configured. An RLS-DDoSNET model was installed and deployed on the server, and the model's operating environment and parameters were configured. The attack process included TCP SYN flood attacks, UDP flood attacks, and ICMP flood attacks. The detection accuracy, precision, and false positive rate of the model in the simulation experiment are shown in Table 10.

[0078] Table 10 Experimental results show that the model performs well in detecting TCP SYN flood attacks, UDP flood attacks, and ICMP flood attacks. This verifies the model's effectiveness in real-world DDoS attack detection scenarios and provides strong support for network defense.

[0079] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A DDoS attack detection method based on ResNet and attention mechanism, characterized in that, Includes the following steps: Preprocess the raw network traffic data to obtain a sample set; A DDoS attack detection model is constructed, comprising an input part, a feature extraction part, and an output part connected in sequence; the feature extraction part contains multiple residual blocks with skip connections; at least one residual block integrates an SE-CA attention mechanism module, which is used to generate channel attention weights through global average pooling and fully connected operations, and to perform weighted adjustment on the feature channels; Based on the sample set, the DDoS attack detection model is trained using a label-smoothed regularized cross-entropy loss function and the AdamW optimizer. The trained DDoS attack detection model is used to detect network traffic data and output the corresponding classification and detection results of attack or normal traffic.

2. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, The process of preprocessing raw network traffic data to obtain a sample set includes: The network traffic features are extracted from the raw network traffic data to obtain an initial feature dataset; the initial feature dataset is cleaned, the cleaned feature data is standardized, and the standardized numerical sequence is reconstructed into a two-dimensional image with three channels to obtain the sample set.

3. The DDoS attack detection method based on ResNet and attention mechanism according to claim 2, characterized in that, The standardized numerical sequence is reconstructed into a two-dimensional image with three channels, including: The standardized numerical sequence is divided into multiple data blocks; the continuous samples contained in each data block are assigned to three different groups; the values ​​of each group of samples are filled into a two-dimensional matrix to obtain data for three channels respectively; the data of the three channels are combined to construct a three-channel two-dimensional image corresponding to the data block.

4. The DDoS attack detection method based on ResNet and attention mechanism according to claim 3, characterized in that, The input portion includes a convolutional layer, a batch normalization layer, a ReLU activation function layer, and a max pooling layer arranged sequentially; the convolutional layer is used to perform convolution operations on the input three-channel two-dimensional image to extract preliminary features.

5. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, The feature extraction part includes a residual stage with a BTNK block; the BTNK block includes three convolutional layers, each followed by a batch normalization layer and a ReLU activation function; the BTNK block has a shortcut connection that directly connects the block input to the output of the last convolutional layer; the second convolutional layer is a depthwise separable convolutional layer.

6. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, The SE-CA attention mechanism module includes: A global average pooling layer is used to perform a squeezing operation on the input feature map to obtain channel feature vectors; The first fully connected layer, the ReLU activation function, and the second fully connected layer, connected in sequence, are used to perform activation operations on the channel feature vectors to generate channel weight parameters. The Sigmoid activation function, connected after the second fully connected layer, is used to convert the channel weight parameters into channel attention weights. The multiplication unit is used to multiply the channel attention weights by the input feature map and output a weighted feature map.

7. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, The output section includes a global average pooling layer and a fully connected layer; the global average pooling layer is used to spatially downsample the feature map output by the feature extraction section to obtain a feature vector; the fully connected layer is used to map the feature vector to the classification result.

8. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, The cross-entropy loss function for label smoothing regularization is: ； where L LS is the cross-entropy loss with label smoothing, y i is the true label for class i, is the smoothed softmax, p i is the probability that the model predicts class i.

9. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, The AdamW optimizer calculates the first and second moment estimates of the gradient, corrects the bias of the first and second moment estimates, and updates the model parameters based on the corrected first and second moments, the learning rate, and the weight decay coefficient.

10. The DDoS attack detection method based on ResNet and attention mechanism according to claim 1, characterized in that, After cleaning the initial feature dataset and before standardization, the process also includes: using synthetic oversampling techniques to oversample samples from a minority of categories in order to balance the number of samples in each category of the sample set.

Images