Sdn saturation attack detection method based on hypergraph neural network

Abstract

The application discloses a supergraph neural network-based SDN saturation attack detection method and relates to the technical field of network communication. In order to solve the technical problems that the existing SDN security protection work has the problems of insufficient description ability of complex network structure, limited dynamic adaptation ability and weak accurate detection ability, the technical scheme provided by the application is as follows: a CHS graph is established according to state information of a target network; in the preset model learning of a throttling point of the CSH graph, an attention mechanism is used to capture the influence of a node on a hyperedge to which the node belongs and the influence of the hyperedge on the nodes in the hyperedge; the features of the hyperedge are relearned; the preset model is trained according to a preset loss function; the throttling points in the CHS graph of the target network are classified through the trained preset model, and the saturation attack types are distinguished according to the classification results, including the saturation attack on the SDN switch and the saturation attack on the SDN controller. The application is suitable for application in the work of SDN saturation attack detection.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to an SDN saturation attack detection scheme based on a hypergraph neural network. Background Technology

[0002] Software-defined networking (SDN) is an emerging network architecture whose core idea is to separate the forwarding and control functions of traditional network devices, achieving global network visibility and programmability through a centralized control plane. This architecture has led to the widespread application of SDN in scenarios such as data center networks, 5G networks, and cloud computing. However, despite SDN's significant advantages in global management, dynamic adjustment, and resource optimization, its unique architectural design also brings a series of security challenges.

[0003] In existing technologies, research on SDN security issues mainly focuses on the following aspects:

[0004] Detection and protection against Distributed Denial-of-Service (DDoS) attacks:

[0005] Most current research employs machine learning or statistical analysis-based methods to detect DDoS attacks. For example, some researchers analyze abnormal traffic fluctuations and use classification algorithms such as Support Vector Machines (SVM) and Random Forests to detect attacks. However, these methods are typically based on fixed rules or static features and cannot adapt to complex network environments and diverse attack methods.

[0006] Abnormal traffic detection:

[0007] For the detection of abnormal traffic, existing research has proposed traffic classification models based on deep learning, such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs). These models identify potential attack behaviors by extracting the temporal and spatial features of network traffic. However, traditional graph models cannot effectively represent the much more complex relational network structures in SDN, especially in capturing the nonlinear relationships between network nodes, where they have significant limitations.

[0008] Flow table management optimization:

[0009] Studies have shown that attackers can exhaust flow table storage space by forging a large number of malicious packets to send flow rule requests to switches. Existing flow table optimization methods mostly employ policy restrictions or flow table reclamation mechanisms, such as time-to-live and priority management. However, these methods lack accurate identification of attack behavior, are prone to misclassifying normal traffic, and impact network performance.

[0010] While the above research provides some technical means for the security protection of SDN, it still has the following shortcomings when facing more covert and complex attacks:

[0011] Insufficient ability to describe complex network structures: Traditional methods have limitations in describing the multi-layered and multi-relational structures in SDN networks, making it difficult to accurately capture the global characteristics of attack behavior.

[0012] Limited dynamic adaptability: Existing models mostly rely on fixed rules or single feature extraction methods, which cannot adapt to rapid changes in attack patterns.

[0013] Limited accuracy in detection: Detection methods based on traffic statistics have limited ability to distinguish attack types and are difficult to identify multiple types of saturation attacks simultaneously.

[0014] Therefore, there is an urgent need in the existing technology for an efficient and accurate detection scheme that can comprehensively characterize the multi-relationship structure of SDN networks, dynamically adapt to changes in attack patterns, and accurately identify complex saturation attacks. Summary of the Invention

[0015] To address the technical problems existing in current SDN security protection methods, such as insufficient ability to describe complex network structures, limited dynamic adaptability, and weak accurate detection capabilities, the technical solution provided by this invention is as follows:

[0016] SDN saturation attack detection methods based on hypergraph neural networks include:

[0017] The steps for collecting state information of the target network;

[0018] The steps for establishing a CHS diagram based on the aforementioned status information;

[0019] In the learning of throttling point representations of the CSH graph using the pre-defined model, the steps of capturing the influence of nodes on their superedges and the influence of superedges on nodes in the superedges are carried out using the attention mechanism.

[0020] The steps for relearning the features of the hyperedge;

[0021] The step of training the preset model according to the preset loss function;

[0022] The trained preset model is used to classify throttling points in the CHS graph of the target network and to distinguish saturation attack types based on the classification results, including saturation attacks against SDN switches and saturation attacks against SDN controllers.

[0023] Furthermore, a preferred implementation is provided, wherein the status information includes flow rule information, flow table information, port information, host information, and packet-in messages.

[0024] Furthermore, a preferred implementation is provided, in which the features of the hyperedge are learned through an overlapping graph and a graph convolutional network.

[0025] Furthermore, a preferred embodiment is provided in which the preset loss function is obtained by weighted summation of the hyperedge loss function and the node loss function.

[0026] Furthermore, a preferred implementation method is provided, in which the preset model is trained by backpropagation based on the preset loss function.

[0027] Furthermore, a preferred embodiment is provided, wherein the rules for establishing the CHS diagram include:

[0028] When all network flows originate from the same source host, these network flow nodes form a hyperedge;

[0029] When all network flows are destined for the same target host, these network flow nodes form a hyperedge;

[0030] When network flows pass through the same switch, these network flow nodes form a hyperedge;

[0031] When network flows trigger packet-in messages, these network flow nodes form a hyperedge.

[0032] Based on the same inventive concept, this invention also provides an SDN saturation attack detection device based on a hypergraph neural network, comprising:

[0033] A module for collecting status information of the target network;

[0034] A module for establishing a CHS diagram based on the aforementioned status information;

[0035] In the learning of throttling point representations of the CSH graph using the preset model, a module is used to capture the influence of nodes on their superedges and the influence of superedges on nodes in the superedges using the attention mechanism.

[0036] A module that relearns the features of the hyperedge;

[0037] A module that trains the preset model according to a preset loss function;

[0038] The trained preset model is used to classify throttling points in the CHS graph of the target network and to distinguish saturation attack types based on the classification results, including modules for saturation attacks against SDN switches and saturation attacks against SDN controllers.

[0039] Based on the same inventive concept, the present invention also provides a computer storage medium for storing a computer program, wherein when the computer program is read by a computer, the computer executes the method described thereon.

[0040] Based on the same inventive concept, the present invention also provides a computer, including a processor and a storage medium, wherein when the processor reads a computer program stored in the storage medium, the computer executes the method described thereon.

[0041] Based on the same inventive concept, the present invention also provides a computer program product, which, when executed, implements the method described.

[0042] Compared with the prior art, the advantages of the technical solution provided by the present invention are as follows:

[0043] By generating a Controller-Switch-Host Hypergraph (CSH), the solution accurately describes the multi-relationship structure in SDN networks, significantly improving the ability to represent complex networks. Compared to traditional graph models based solely on point-to-point connections, the CSH graph generation rules utilize the interaction characteristics of network flows between hosts, switches, and controllers, more comprehensively depicting the relationships between nodes and enabling attack detection to have higher accuracy and adaptability.

[0044] By leveraging an attention mechanism to capture the interaction between nodes and hyperedges in hypergraph node representation learning, this approach improves the learning performance of node and hyperedge features. Traditional methods typically employ fixed feature extraction strategies, which struggle to flexibly address complex attack patterns. In contrast, the attention mechanism, through dynamic weight allocation, can focus on key features of important nodes and hyperedges, thereby enhancing the detection model's responsiveness to diverse attack types.

[0045] By combining overlapping graphs and graph convolutional networks to relearn hyperedge features, this approach addresses the problem that traditional graph models cannot adequately represent hyperedge states. Traditional methods often rely on node information, neglecting the importance of device states within hyperedges. In contrast, this approach, by integrating multiple graph representation learning techniques, not only enriches hyperedge features but also significantly enhances the model's generalization ability in high-dimensional complex networks.

[0046] A dual-loss function optimization model is adopted, optimizing hyperedge learning and node learning separately, and then weighted and summed as the loss function of the overall model, ensuring unified optimization of the model. Compared with traditional methods using a single optimization strategy, this design balances the diversity of feature learning, significantly improves the model's stability and detection accuracy, and effectively reduces the false positive and false negative rates.

[0047] By periodically collecting network status information and updating the CSH graph in real time, this scheme exhibits extremely high dynamic adaptability. Traditional static detection methods typically lag behind rapid changes in attack patterns, while this scheme can reflect the dynamic changes in the network environment in real time, ensuring that the detection model remains sensitive to new attack patterns and improving the overall security protection capability of SDN networks.

[0048] Suitable for use in SDN saturation attack detection. Attached Figure Description

[0049] Figure 1 The flowchart shows a saturation attack detection method based on a hypergraph neural network.

[0050] Figure 2 The flowchart shows the CSH graph generation method for saturation attack detection based on hypergraph neural networks.

[0051] Figure 3 This is a flowchart of the detection model for a saturation attack detection method based on a hypergraph neural network. Detailed Implementation

[0052] To make the advantages and benefits of the technical solution provided by the present invention clearer, the technical solution provided by the present invention will now be described in further detail with reference to the accompanying drawings, specifically:

[0053] Implementation Method 1: This implementation method provides an SDN saturation attack detection method based on a hypergraph neural network, including:

[0054] The steps for collecting state information of the target network;

[0055] The steps for establishing a CHS diagram based on the aforementioned status information;

[0056] In the learning of throttling point representations of the CSH graph using the pre-defined model, the steps of capturing the influence of nodes on their superedges and the influence of superedges on nodes in the superedges are carried out using the attention mechanism.

[0057] The steps for relearning the features of the hyperedge;

[0058] The step of training the preset model according to the preset loss function;

[0059] The trained preset model is used to classify throttling points in the CHS graph of the target network and to distinguish saturation attack types based on the classification results, including saturation attacks against SDN switches and saturation attacks against SDN controllers.

[0060] Specifically, the technical solution provided in this embodiment includes:

[0061] Step 1: Information Collection

[0062] Use an SDN controller to periodically monitor the network status and collect the following key information:

[0063] 1. Flow rule information:

[0064] This includes the matching rules, priority, and traffic type (such as TCP / UDP streams) for each flow. This information is used to determine the forwarding path and priority of the flow, thereby capturing potentially abnormal traffic.

[0065] 2. Flow table information:

[0066] This describes the current state of the flow table storage, including the number of installed flow table entries, the flow table storage space occupied, and the validity period of the flow table entries. Flow table information reflects the load status of the switch and can be used to analyze whether there are any attacks that illegally occupy flow table resources.

[0067] 3. Port information:

[0068] Record traffic statistics for switch ports, such as the number of packets transmitted per second, packet loss rate, and port utilization. Port information can help identify abnormal traffic hotspots or bottlenecks in the network.

[0069] 4. Host Information:

[0070] This includes the host's source IP address, destination IP address, MAC address, and network activity status. Host information allows for the identification of legitimate traffic sources and destinations, and the detection of spoofed attack traffic.

[0071] 5. Packet-in message:

[0072] This section analyzes the number and frequency distribution of packet-in messages triggered by the switch and sent to the controller within the current period. Frequent triggering of packet-in messages may be a signal of a saturation attack and can be used for further analysis.

[0073] The above information is collected and integrated into structured data on a regular basis. After outliers and noise are removed, it is transmitted to the graph generation module as input for generating the CSH graph.

[0074] Step 2: CSH chart generation

[0075] After receiving the above information, the graph generation module generates a controller-switch-host graph (CSH graph) according to the following rules:

[0076] 1. Hyperedge generation rules:

[0077] If all network flows originate from the same source host, these flow nodes form a hyperedge, reflecting the traffic characteristics of the same host to different destinations.

[0078] If network flows pass through the same switch, these flow nodes form a hyperedge, describing the traffic distribution characteristics of the switch ports.

[0079] If a network flow triggers a packet-in message, these flow nodes form a hyperedge that identifies traffic that frequently interacts with the controller.

[0080] If all network flows are destined for the same target host, these flow nodes form a hyperedge, representing the concentrated nature of traffic to the target host.

[0081] 2. Hyperedge attribute information:

[0082] Each hyperedge includes associated flow table statistics (such as the number of flow table entries), port information (such as port traffic), host information (such as IP address), and packet-in statistics (such as trigger frequency).

[0083] 3. CSH chart output:

[0084] A CSH hypergraph is generated based on the above rules. Nodes and hyperedges in the CSH graph are accompanied by detailed attribute information to ensure that subsequent models can fully utilize network characteristics for attack detection. The generated CSH graph is then transmitted to the detection module.

[0085] Step 3: Model Training and Optimization

[0086] 1. CSH diagram partitioning:

[0087] The generated CSH graph is divided into training and test sets for model training and validation. The training set is used to learn the interaction relationships between nodes and hyperedges, while the test set is used to validate the model's detection performance.

[0088] 2. Node and Hyperedge Feature Learning:

[0089] In hypergraph neural networks, an attention mechanism is introduced to dynamically learn the following relationships:

[0090] The degree of influence a node has on its superedge, such as the contribution of the source host node to the traffic characteristic superedge.

[0091] The degree of influence of a hyperedge on its containing nodes, such as the constraint of a packet-in hyperedge on a node.

[0092] 3. Hyperedge feature relearning:

[0093] Hyperedge features are relearned using overlapping graphs and graph convolutional networks, combining node information with network device state to generate hyperedge features with richer semantics. This step improves upon the shortcomings of traditional hypergraph models that rely solely on node information.

[0094] 4. Loss function design:

[0095] Set a hyperedge loss function for hyperedge feature learning to optimize the representation capability of hyperedges.

[0096] Set a node loss function for node feature learning to improve the accuracy of network flow node classification.

[0097] The two are weighted and summed to form the loss function of the overall model, achieving a balanced optimization of feature learning.

[0098] 5. Model backpropagation training:

[0099] The model parameters are tuned using multiple iterations and backpropagation to ensure that the model can accurately capture network characteristics and complete the classification task of saturation attacks.

[0100] Step 4: Attack Detection and Type Identification

[0101] 1. Attack detection:

[0102] The trained detection model is used to analyze the new CSH graph to classify whether network flow nodes are attack flows.

[0103] 2. Attack type identification:

[0104] The attack types are further identified based on the classification results, including:

[0105] Saturation attacks targeting switches, such as flow table entry occupancy attacks.

[0106] Saturation attacks targeting the controller, such as attacks that frequently trigger packet-in messages.

[0107] 3. Output detection results:

[0108] The detection results are output as structured data, including:

[0109] Types of attack flows.

[0110] Characteristics of the attacking node.

[0111] The positional relationship of attack flows in the CSH diagram.

[0112] The output displays the attack path and affected network devices in a graphical format, providing support for further protection.

[0113] Implementation Method 2: This implementation method further defines the SDN saturation attack detection method based on hypergraph neural networks provided in Implementation Method 1. The status information includes flow rule information, flow table information, port information, host information, and packet-in messages.

[0114] Implementation Method 3: This implementation method further defines the SDN saturation attack detection method based on hypergraph neural networks provided in Implementation Method 1. It learns the features of the hyperedges through overlapping graphs and graph convolutional networks.

[0115] Implementation Method 4: This implementation method further defines the SDN saturation attack detection method based on hypergraph neural networks provided in Implementation Method 1. The preset loss function is obtained by weighted summation of the hyperedge loss function and the node loss function.

[0116] Implementation Method 5: This implementation method further defines the SDN saturation attack detection method based on hypergraph neural networks provided in Implementation Method 1. Based on the preset loss function, the preset model is trained through backpropagation.

[0117] Implementation Method Six: This implementation method further defines the SDN saturation attack detection method based on hypergraph neural networks provided in Implementation Method One. The rules for establishing the CHS graph include:

[0118] When all network flows originate from the same source host, these network flow nodes form a hyperedge;

[0119] When all network flows are destined for the same target host, these network flow nodes form a hyperedge;

[0120] When network flows pass through the same switch, these network flow nodes form a hyperedge;

[0121] When network flows trigger packet-in messages, these network flow nodes form a hyperedge.

[0122] Implementation Method Seven: This implementation method provides an SDN saturation attack detection device based on a hypergraph neural network, including:

[0123] A module for collecting status information of the target network;

[0124] A module for establishing a CHS diagram based on the aforementioned status information;

[0125] In the learning of throttling point representations of the CSH graph using the preset model, a module is used to capture the influence of nodes on their superedges and the influence of superedges on nodes in the superedges using the attention mechanism.

[0126] A module that relearns the features of the hyperedge;

[0127] A module that trains the preset model according to a preset loss function;

[0128] The trained preset model is used to classify throttling points in the CHS graph of the target network and to distinguish saturation attack types based on the classification results, including modules for saturation attacks against SDN switches and saturation attacks against SDN controllers.

[0129] Implementation Method 8: This implementation method provides a computer storage medium for storing a computer program. When the computer program is read by the computer, the computer executes the method provided in Implementation Method 1.

[0130] Implementation Method Nine: This implementation method provides a computer, including a processor and a storage medium. When the processor reads a computer program stored in the storage medium, the computer executes the method provided in Implementation Method One.

[0131] Implementation Method 10: This implementation method provides a computer program product. As a computer program, when the computer program is executed, it implements the method provided in Implementation Method 1.

[0132] Implementation Method Eleven: Combination Figure 1-3 This embodiment describes the technical solution provided above in further detail through specific examples. Specifically:

[0133] Figure 1 This is a flowchart of a saturation attack detection method based on hypergraph neural networks.

[0134] The saturation attack detection method based on hypergraph neural networks includes the following steps:

[0135] Step S1: Use the SDN controller to periodically obtain flow rule information, flow table information, port information, and host information, and at the same time obtain packet-in messages within the period;

[0136] Step S2: Generate a Controller-Switch-Host diagram (CSH diagram) based on the information provided;

[0137] Step S3: Use a saturation attack detection model based on hypergraph neural networks and graph convolutional networks to detect flow nodes in the CSH graph.

[0138] like Figure 2 As shown, the specific steps for generating a CSH diagram are as follows:

[0139] Step D1: Use statistical methods to preprocess packet-in messages, flow rule information, flow table information, port information, and host information, calculate statistical characteristics, and retain relevant information;

[0140] Step D2: Generate flow nodes based on flow rule information and assign statistical characteristics;

[0141] Step D3: If the current network flow triggers a packet-in message, then the network flow and the other network flows that triggered packet-in messages together form a hyperedge, and assign a value to the hyperedge; otherwise, proceed to step D4.

[0142] Step D4: If the source hosts of multiple network flows are the same, then these network flows together form a hyperedge and a value is assigned to the hyperedge; otherwise, proceed to step D5.

[0143] Step D5: If multiple network flows have the same destination host, these network flows together form a hyperedge and a value is assigned to the hyperedge; otherwise, proceed to step D6.

[0144] Step D6: If multiple network flows have passed through a certain switch, these network flows together form a hyperedge, and a value is assigned to the hyperedge; otherwise, these network flow nodes form a hyperedge individually.

[0145] Step D7: Generate a CSH hypergraph based on existing network flow nodes and hyperedges.

[0146] like Figure 3 As shown, when using a saturation attack detection module based on hypergraph neural networks and graph convolutional networks, the specific steps for model training and detection are as follows:

[0147] Step D1: Divide the obtained CSH graph into a training set and a test set;

[0148] Step D2: Obtain the attention weights of the nodes to the hyperedges;

[0149] Step D3: Obtain the attention weights of the nodes in the hyperedge pair;

[0150] Step D4: Obtain the hyperedge features learned by the hypergraph neural network based on the attention weights of the nodes to the hyperedges;

[0151] Step D5: Utilize SDN device status information to relearn hyperedge features using overlapping graphs and graph convolutional networks;

[0152] Step D6: Set the hyperedge loss function for the hyperedge learning model;

[0153] Step D7: Based on the attention weights of the hyperedges to the nodes and the relearned hyperedge features, learn new network flow node features;

[0154] Step D8: Set the node loss function for the node learning model;

[0155] Step D9: Weight the sum of the hyperedge loss function and the node loss function to form the loss function of the overall model;

[0156] Step D10: Backpropagate to train the model and obtain the trained model;

[0157] Step D11: Test the trained model using the test set;

[0158] Step D12: Obtain the test results.

[0159] The saturation attack detection method based on hypergraph neural network proposed in this embodiment detects saturation attacks in SDN based on network statistical features, CSH graph, and hypergraph neural network, thereby improving the representation ability of graph and the representation learning ability of graph learning model, and improving the accuracy of saturation attack detection.

[0160] The above description of several specific embodiments further details the technical solution provided by the present invention in order to highlight the advantages and benefits of the technical solution provided by the present invention. However, the above-described specific embodiments are not intended to limit the present invention. Any reasonable modifications and improvements to the present invention, combinations of embodiments, and equivalent substitutions based on the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting SDN saturation attacks based on hypergraph neural networks, characterized in that, include: The steps for collecting state information of the target network; The steps for establishing a CHS diagram based on the aforementioned status information; In the learning of throttling point representations of the CSH graph using the pre-defined model, the steps of capturing the influence of nodes on their superedges and the influence of superedges on nodes in the superedges are carried out using the attention mechanism. The steps for relearning the features of the hyperedge; The step of training the preset model according to the preset loss function; The trained preset model is used to classify throttling points in the CHS graph of the target network and to distinguish saturation attack types based on the classification results, including saturation attacks against SDN switches and saturation attacks against SDN controllers.

2. The SDN saturation attack detection method based on hypergraph neural networks according to claim 1, characterized in that, The status information includes flow rule information, flow table information, port information, host information, and packet-in messages.

3. The SDN saturation attack detection method based on hypergraph neural networks according to claim 1, characterized in that, The features of the hyperedges are learned by using overlapping graphs and graph convolutional networks.

4. The SDN saturation attack detection method based on hypergraph neural network according to claim 1, characterized in that, The preset loss function is obtained by weighted summation of the hyperedge loss function and the node loss function.

5. The SDN saturation attack detection method based on hypergraph neural networks according to claim 1, characterized in that, The preset model is trained using backpropagation based on the preset loss function.

6. The SDN saturation attack detection method based on hypergraph neural networks according to claim 1, characterized in that, The rules for establishing the CHS diagram include: When all network flows originate from the same source host, these network flow nodes form a hyperedge; When all network flows are destined for the same target host, these network flow nodes form a hyperedge; When network flows pass through the same switch, these network flow nodes form a hyperedge; When network flows trigger packet-in messages, these network flow nodes form a hyperedge.

7. An SDN saturation attack detection device based on a hypergraph neural network, characterized in that, include: A module for collecting status information of the target network; A module for establishing a CHS diagram based on the aforementioned status information; In the learning of throttling point representations of the CSH graph using the preset model, a module is used to capture the influence of nodes on their superedges and the influence of superedges on nodes in the superedges using the attention mechanism. A module that relearns the features of the hyperedge; A module that trains the preset model according to a preset loss function; The trained preset model is used to classify throttling points in the CHS graph of the target network and distinguish saturation attack types based on the classification results, including modules for saturation attacks against SDN switches and saturation attacks against SDN controllers.

8. A computer storage medium for storing computer programs, characterized in that, When the computer program is read by the computer, the computer executes the method of claim 1.

9. A computer, comprising a processor and a storage medium, characterized in that, When the processor reads the computer program stored in the storage medium, the computer executes the method of claim 1.

10. A computer program product, as a computer program, is characterized by: When the computer program is executed, it implements the method of claim 1.

Images