Digital quantum computing-based computing power network DDoS detection method and system

Abstract

The application discloses a digital quantum computing-based computing power network DDoS detection method and system, and relates to the technical field of network space safety management and control.The application comprises the following steps: collecting real-time network flow data in a jurisdictional area through a dispersed detection point, constructing a graph neural network DDoS detection algorithm based on quantum random walk sampling, and performing quantum random walk to obtain quantum probability distribution of each node; performing quantum probability weighted non-replacement sampling on neighbor nodes of each target node to obtain a sampled neighbor set; performing message passing on the sampled neighbor set through a graph sampling aggregation network; uploading local model parameters to a safety management center through a federated learning architecture, and outputting a DDoS attack detection result.The application realizes DDoS flow feature extraction based on a graph structure, and utilizes a neighbor sampling mechanism guided by quantum random walk to complete real-time identification and detection of DDoS attacks.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security management and control technology, and in particular relates to a method and system for DDoS detection of computing power networks based on digital quantum computing. Background Technology

[0002] Against the backdrop of the deepening global digital applications, Distributed Denial-of-Service (DDoS) attacks have become one of the most dangerous and frequent security threats in cyberspace. Attack traffic volumes have rapidly increased from the Gbps level to the Tbps level, and attack patterns have evolved from traditional traffic-based attacks to complex hybrid attacks that combine application-layer attacks, pulse attacks, and slow-moving attacks. These trends pose a severe challenge to various organizations that rely on networks to provide services, especially computing networks. Disruptions to computing services can lead to systemic business paralysis and significant losses.

[0003] Current mainstream DDoS attack detection and defense technologies primarily focus on traffic feature analysis, relying on the identification of known attack patterns. They achieve anomaly detection by parsing network packet header information and traffic statistical characteristics, mainly including traffic threshold monitoring, protocol anomaly detection, deep packet inspection (DPI), and machine learning-based intelligent detection methods. While existing technologies can identify typical attacks to a certain extent, they still have significant shortcomings in computing power network scenarios: First, single-point detection has limitations. Traditional defenses often adopt a single-point deployment model, deploying detection equipment only in data centers or network egress points. They lack the ability to have a global awareness of the entire network traffic topology and spatiotemporal dimensions, making it difficult to reconstruct the attack propagation path and scope of impact. In the face of distributed, multi-source attacks, they are prone to misjudgment and missed detection, and cannot form a global collaborative defense. Second, the detection logic is lagging. Most solutions rely on static traffic thresholds and fixed feature rules, which are difficult to adapt to dynamically changing business traffic and new attack variants. In particular, they are prone to generating a large number of false positives and false negatives for low-speed attacks, encrypted traffic attacks, and application layer attacks that impersonate legitimate users. They are unable to build a dynamic business traffic baseline and find it difficult to discover subtle abnormal features in massive amounts of normal traffic. Third, the response mechanism has a delay. In the existing system, the detection module and the mitigation module are independent of each other. After an attack is detected, manual intervention is required to analyze, configure strategies, and perform traffic diversion and cleaning. There is a significant delay between detection and response, which can easily lead to premature business interruption in high-speed DDoS attack scenarios and greatly reduce the effectiveness of defense. Fourth, insufficient adaptability to different scenarios. With the popularization of IoT devices and the expansion of botnets, network bandwidth and structural complexity continue to increase. Traditional defense architectures have poor scalability, insufficient computing power support, and slow detection model updates, making it difficult to adapt to the dynamic evolution requirements of computing networks. They also lack the ability to adaptively learn and continuously iterate in the face of new types of attacks.

[0004] Therefore, in order to address the limitations of single-point detection, lagging detection logic, delayed response mechanism, and lack of adaptability in DDoS attack defense of computing power networks, this invention proposes a DDoS detection method and system for computing power networks based on digital quantum computing. Summary of the Invention

[0005] The purpose of this invention is to provide a DDoS detection method and system for computing power networks based on digital quantum computing. By using a graph neural network DDoS detection algorithm based on quantum random walk sampling, it realizes the extraction of DDoS traffic features based on graph structure. Furthermore, by utilizing a neighbor sampling mechanism guided by quantum random walk, it completes the real-time identification and detection of DDoS attacks. This invention solves the shortcomings of existing computing power network DDoS attack detection and defense, such as the limitations of single-point detection, the lag in detection logic, the delay in response mechanism, and the lack of adaptability.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: As the first aspect provided by this invention, this invention provides a method for detecting DDoS attacks on computing power networks based on digital quantum computing, comprising the following steps: Real-time network traffic data within the jurisdiction is collected by distributing detection points. A local traffic graph is constructed with IP addresses as nodes and the communication relationships between IP addresses as edges. Traffic behavior feature vectors are extracted for each node. A graph neural network DDoS detection algorithm based on quantum random walk sampling is constructed. Using a local traffic graph as input, a quantum random walk is performed to obtain the quantum probability distribution of each node. The probabilities of boundary nodes are reported to the security management center, which then performs weighted aggregation and updates the local node probability distribution. For each target node, perform quantum probability-weighted sampling without replacement on its neighboring nodes to obtain the sampled neighbor set; The sampling neighbor set is message-passed through a graph sampling aggregation network to aggregate neighbor information and update the node representation vector. The local model parameters are uploaded to the security management center through the federated learning architecture. The security management center performs federated averaging and aggregation to generate global model parameters and distributes them. Each distributed detection point uses the trained model to classify the node representation vectors and outputs DDoS attack detection results. The computational tasks of the quantum random walk, the message passing of the graph sampling aggregation network, and the federated average aggregation are supported by parallel computing power provided by the digital quantum computing platform.

[0007] Furthermore, the method for constructing the local traffic graph includes: using all IP addresses appearing within a fixed time window as the node set, using the presence or absence of data packet transmission between IP addresses as the directed edge set, constructing a directed graph, and representing the topology of the graph using an adjacency matrix.

[0008] Furthermore, the traffic behavior feature vector includes at least one of the following features: packet rate, average packet length, packet interval time variance, port distribution entropy, and TCP connection success rate.

[0009] Furthermore, the execution steps of the quantum random walk include: The graph Laplace matrix of the local flow graph is used as the Hamiltonian of the quantum walk to prepare an initial quantum state that is uniformly superimposed on all nodes. The initial quantum state is evolved using a unitary evolution operator, and the node local access probability is obtained by measuring the evolved quantum state. The access probability of the boundary node is reported to the security management center for weighted aggregation. The aggregated global probability is then distributed to each distributed detection point to update the local node probability distribution.

[0010] Furthermore, the quantum probability-weighted sampling method without replacement includes: using the probability of each neighboring node as a weight, iteratively performing multiple samplings on the neighbor set of the target node, randomly selecting a node each time in a manner proportional to the probability of nodes in the current candidate set, and removing the selected node from the candidate set, until a preset sampling scale is reached.

[0011] Furthermore, the message passing method of the graph sampling aggregation network includes: in each layer, performing probability-weighted mean aggregation on the previous layer representation vectors of the neighbor nodes in the sampling neighbor set, concatenating the aggregation result with the previous layer representation vector of the node itself, transforming it through a fully connected layer and activating it with ReLU to obtain the node representation vector of the current layer.

[0012] Furthermore, the method for training the model using the federated learning architecture includes: each distributed detection point independently trains the model using local data, calculates the loss function, updates the local model parameters using stochastic gradient descent, and uploads the updated parameters to the security management center; the security management center generates global model parameters by weighted averaging based on the sample size of each distributed detection point, and distributes them to each distributed detection point for the next round of iteration until the model converges.

[0013] Furthermore, methods for outputting DDoS attack detection results include: Multi-level feature aggregation and node representation update are performed based on the sampled neighbor set, and multi-hop neighborhood topology and traffic features are fused. The final representation vector of a node is input into a fully connected classifier with a Sigmoid activation function to obtain the probability value of a node being identified as a DDoS attack. When the probability value exceeds a preset threshold, the node is identified as a DDoS attack node.

[0014] Furthermore, the digital quantum computing platform provides parallel computing power support through state vector simulation and tensor networks. The state vector simulation uses recursive CSD decomposition to decompose multi-qubit gates into combinations of single-qubit gates and CNOT gates, and adopts a multi-threaded parallel and distributed simulation framework to realize the state vector piecewise parallel computation.

[0015] As a second aspect of the present invention, the present invention provides a computing power network DDoS detection system based on digital quantum computing. The computing power network DDoS detection system is used to implement the computing power network DDoS detection method described in the first aspect. The computing power network DDoS detection system includes: The distributed traffic security management module adopts a three-layer architecture that combines centralized management and distributed execution. It consists of a central control center, hub and edge detection and control nodes, and computing network infrastructure. The hub and edge detection and control nodes are deployed in pairs of detectors and mitigation controllers to collect local network traffic status and report it to the central control center. The central control center completes global traffic security situation analysis, risk assessment, policy generation and commands each node to coordinate and link. The graph neural network DDoS detection module takes a local traffic graph as input, calculates the node access probability distribution through quantum random walk, performs quantum probability weighted neighbor sampling, combines a graph sampling aggregation network to complete node feature representation learning, and achieves distributed collaborative training through federated learning to output DDoS attack detection results. The heterogeneous computing power unified scheduling support module is used to map the heterogeneous computing power of CPU, GPU, TPU, NPU and FPGA to a unified quantization dimension and build a computing power demand model. The digital quantum computing platform is used for digital quantum state preparation, quantum circuit generation and segmentation, and tensor network dimensionality reduction calculation, providing computing power support for detection, analysis and control processes with parallel computing power.

[0016] The present invention has the following beneficial effects: This invention presents a graph neural network DDoS detection algorithm based on quantum random walk sampling. It achieves DDoS traffic feature extraction based on graph structure and utilizes a neighbor sampling mechanism guided by quantum random walks to complete real-time identification and detection of DDoS attacks. Employing a digital quantum technology platform that integrates digital quantum state representation and preparation, quantum circuit generation and segmentation, tensor network dimensionality reduction computation, and multi-node collaborative computation, it provides strong computing power support for AI detection and comprehensive analysis and evaluation in security management centers through a unified computing task computing power requirement model. This enables real-time mitigation and response control of DDoS attacks on computing power networks, ensuring the stable operation of the computing power network.

[0017] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a diagram illustrating the architecture of the DDoS detection system based on digital quantum computing in this invention. Figure 2 This is a diagram of the digital quantum computing platform architecture of the present invention; Figure 3 This is a schematic diagram of the computation node layer of the present invention. Detailed Implementation

[0020] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0021] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0022] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0023] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0024] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0025] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0026] Example 1: This invention relates to a DDoS detection method for computing power networks based on digital quantum computing, comprising the following steps: Real-time network traffic data within the jurisdiction is collected by distributing detection points. A local traffic graph is constructed with IP addresses as nodes and the communication relationships between IP addresses as edges. Traffic behavior feature vectors are extracted for each node. A graph neural network DDoS detection algorithm based on quantum random walk sampling is constructed. Taking the local traffic graph as input, quantum random walks are performed to obtain the quantum probability distribution of each node. The probability of the boundary node is reported to the security management center. The security management center performs weighted aggregation of the probabilities reported by the same boundary node and sends them back to the relevant scattered detection points. Each scattered detection point updates its local node probability distribution. The algorithm realizes DDoS traffic feature extraction based on graph structure and uses the neighbor sampling mechanism guided by quantum random walk to complete the real-time identification and detection of DDoS attacks. Each distributed detection point performs quantum probability-weighted sampling without replacement on the neighboring nodes of each target node according to the updated node probability distribution, and obtains the sampled neighbor set. The sampling neighbor set is message-passed through a graph sampling aggregation network to aggregate neighbor information and update the node representation vector. The local model parameters are uploaded to the security management center through the federated learning architecture. The security management center performs federated averaging and aggregation to generate global model parameters and distributes them. Each distributed detection point uses the trained model to classify the node representation vectors and outputs DDoS attack detection results. The computational tasks of the quantum random walk, the message passing of the graph sampling aggregation network, and the federated average aggregation are supported by parallel computing power provided by the digital quantum computing platform.

[0027] Example 2: This invention relates to a DDoS detection method for computing power networks based on digital quantum computing. The method for constructing the local traffic graph includes: Each distributed detection point independently collects real-time network traffic data within its jurisdiction and models network communication behavior using a graph structure, providing structured input for quantum random walk and graph neural network detection. The distributed detection points operate within a fixed time window. as a unit, with All IP addresses appearing in the window are treated as nodes, and the communication relationships between these IP addresses are used as edges to construct a local traffic graph. .in, For a set of nodes, ; Let be a set of directed edges. If there exists an edge from... arrive For data packet transmission, there exists a directed edge. , local flow map The topological structure uses an adjacency matrix This indicates that the adjacency matrix is: .

[0028] As an embodiment of the present invention, preferably, for each node Extract one 3D feature vector This is used to characterize the traffic behavior patterns of a corresponding IP address within a time window. The feature vectors of all nodes constitute the feature matrix. The feature vector contains the following statistical features: Packet rate, set node In the time window The total number of data packets sent and received within the time limit were respectively and Then the packet sending rate Receive packet rate ; Average packet length, set nodes The sequence of data packet lengths sent within the time window is as follows: The length sequence of the received data packets is Then the average packet length sent Average packet length received ; Packet interval time variance, set nodes In the time window The timestamp sequence of data packets sent and received within the internal network is as follows: The time interval between adjacent data packets is Then the sample variance of the interval time is ; Port distribution entropy, let node The set of target ports for communication within the time window is , where the port The frequency percentage of occurrence is Then the Shannon entropy of the port distribution for ; TCP connection success rate, for TCP traffic, define nodes The total number of connection attempts initiated is The number of SYN packets sent, and the number of connections that successfully completed the three-way handshake. The connection success rate is... ; The above feature vectors are concatenated to form nodes. Complete feature vector Each distributed detection point completes a local flow map. The construction.

[0029] As an embodiment of the present invention, preferably, each distributed detection point invokes a unified digital quantum computing platform to perform a quantum random walk on the local flow graph. The execution steps of the quantum random walk include: Local flow map The adjacency matrix is The degree matrix is ,in The Graph Laplace matrix is ​​defined as follows: The Graph Laplace operator Hamiltonian as a quantum walk ,Right now ; Preparation of initial quantum state This allows it to be uniformly superimposed on all nodes, resulting in the initial quantum state. for:

[0030] in, Represents a node The corresponding computational ground state, the evolution of the quantum random walk, is governed by the Schrödinger equation. The description is that its solution is a unitary evolution operator. ; The initial quantum state is evolved using a unitary evolution operator, and after an evolution time... Afterwards, the quantum state is:

[0031] because It is a real symmetric matrix, and spectral decomposition can be performed. ,in It is an eigenvalue diagonal matrix. Let be the eigenvector matrix. Then the unitary evolution can be written as: ; For the evolved quantum state Nodes were obtained through measurement. The probability of local access is: ; Due to quantum interference effects, this probability distribution enhances the probability weights of key nodes in the graph, naturally focusing on nodes with high structural importance without requiring a full graph traversal. Each distributed detection point obtains a local node probability distribution. ; The probability value of extracting the boundary node (i.e., the IP address that has communication records with the jurisdiction of other distributed detection points) of each distributed detection point. The report is submitted to the security management center, which maintains a global boundary node probability table. For the same boundary node... If received from multiple scattered testing points The reported probability values ​​are then weighted and aggregated:

[0032] in, Given preset region weights, the aggregated boundary node probabilities The data is sent back to each relevant distributed detection point to update the probability values ​​of the corresponding local boundary nodes. Each distributed detection point obtains the updated node probability distribution, which is represented as follows: .

[0033] As an embodiment of the present invention, preferably, each dispersed detection point is based on the obtained node probability distribution. Quantum probability-weighted neighbor sampling is performed, explicitly injecting the structural importance perceived by quantum random walks into the message passing process of the graph neural network for each target node. The neighbor set is represented as Based on neighboring nodes probability (Node probability distribution) Using the probability of ( ) as the weight, a weighted sampling method without replacement is employed, from... Selected from The sampled neighbor set consists of 10 neighboring nodes. ,in The sampling size is preset; the weighted sampling without replacement method is executed iteratively. Each time, proportional to A node is randomly selected from the remaining unsampled neighbors with a certain probability. Once selected, the node is removed from the sampling pool to ensure that the same neighbor is not selected repeatedly in a round of sampling.

[0034] As an embodiment of the present invention, the preferred procedure for quantum probability-weighted neighbor sampling is as follows: Step S1: For the target node Let its neighbor set be The corresponding quantum probability is The preset sampling size is ( ); Step S2: Initialize the sampling neighbor set Candidate set Repeat the following steps Second-rate: Step S21: Calculate the value of each node in the candidate set sampling probability ; Step S22: According to probability distribution Randomly select a node ; Step S23: Add to sampling set And from the candidate set Remove from ; Step S3: Output the sampled neighbor set If node Total number of neighbors Then all neighbors are taken to form the sampled neighbor set. ,Right now .

[0035] As an embodiment of the present invention, preferably, each dispersed detection point obtains a sampling neighbor set based on quantum probability weighting. Then, the GraphSAGE network, through message passing and collaboration with the federated model, completes the learning and updating of node representations. The GraphSAGE network, through multi-layer message passing, gradually integrates the topological structure and traffic characteristics of its multi-hop neighborhood into the representation vector of each node.

[0036] As an embodiment of the present invention, preferably, the method for learning and updating node representations is as follows: [The method involves] processing node representations... The initial representation vector is represented as For the first layer( ), each node The message passing is divided into two sub-phases: aggregation and updating; the aggregation phase starts from the sampled neighbor set based on quantum probability weighting. The representations of neighbors from the previous layer are collected and aggregated using a probability-weighted mean.

[0037] The update phase will aggregate the obtained neighbor information The representation of the node itself at the next higher level The layers are concatenated, transformed through a fully connected layer, and activated using ReLU to obtain the output of the current layer.

[0038] in, and For the first The layer's weight matrix and bias vector, after... After layer transmission, the node The final representation vector is It integrates nodes of The system utilizes topological and traffic characteristics within the hop neighborhood, and due to the quantum probability-weighted sampling mechanism, information from key nodes is prioritized for transmission and aggregation.

[0039] As an embodiment of the present invention, preferably, to achieve distributed privacy-preserving collaborative training, a federated learning architecture is used for training. Each distributed detection point independently uses local data for model training, and only uploads the model parameters to the security management center. The method for training the model through the federated learning architecture includes: Let the first Each decentralized testing site has its own local training sample set. The sample size is The detection point performs forward and backward propagation of the graph sampling aggregation network locally, and calculates the loss function:

[0040] in, For nodes The true label indicates that the node is involved in a DDoS attack, and 0 indicates a normal node. The probability value predicted by the model; Optimize local model parameters using stochastic gradient descent , is represented as:

[0041] in, As the learning rate, after each distributed detection point completes one round of local training, the model parameters are... Uploaded to the security management center, the security management center performs federated average aggregation to generate global model parameters:

[0042] in, This represents the total number of distributed testing points participating in the training. The total number of global samples is used by the security management center to aggregate the global model parameters. The data is distributed to various distributed detection points for the next round of training. This process is iterated until the model converges. The federated collaboration mechanism ensures that the original traffic data is always stored locally to meet data privacy compliance requirements. At the same time, it achieves global collaborative learning through parameter aggregation, thereby improving the model's ability to detect cross-regional attacks.

[0043] As an embodiment of the present invention, a preferred method for outputting DDoS attack detection results includes: Multi-level feature aggregation and node representation update are performed based on the sampled neighbor set, and multi-hop neighborhood topology and traffic features are fused. Each distributed detection point will generate the final node representation vector. The input classifier is implemented by a fully connected layer with a sigmoid activation function, and is represented as follows:

[0044] in, and Here are the weight matrix and bias vector of the classifier. For nodes The probability value of being identified as involved in a DDoS attack; let the preset threshold be... Then the node The final judgment result is: ; Each distributed detection point organizes its local detection results into a structured data format and reports them to the security management center. The reported content includes the detection point identifier and timestamp, and a list of IP addresses of the nodes involved in the DDoS attack. The probability value of DDoS attacks After receiving the reports from each distributed monitoring point, the security management center executes DDoS attack response processing.

[0045] Example 3: As an embodiment of the present invention, preferably, the digital quantum computing platform provides parallel computing power support through state vector simulation and tensor networks. The state vector simulation uses recursive CSD decomposition to decompose multi-qubit gates into a combination of single-qubit gates and CNOT gates, and uses a multi-threaded parallel and distributed simulation framework to realize the state vector piecewise parallel computation.

[0046] As an embodiment of the present invention, preferably, the present invention unifies the modeling of heterogeneous computing capabilities, mapping different types of computing resources to a unified dimension. The unified computing power model is as follows: The total computing power C in the computing power pool is:

[0047] This consists of n chips with logic computing capabilities, m chips with parallel computing capabilities, and p chips with neural network computing capabilities, forming a computing resource pool. C represents the quantized total computing power. It is a mapping function. This is the mapping scaling factor, and q is the redundant computing capacity, which can be obtained through numerical simulation. The historical average peak computing capacity of the computing capacity resource pool is collected. If the historical average peak computing capacity is... ,but: .

[0048] As an embodiment of the present invention, preferably, the computational power requirements of user tasks are mapped to functions, specifically as follows: ; in, Let P represent the processing latency of the computation task, P represent the performance of the computing node including computing resources, storage resources, and input / output resources, and S represent the nature of the computation task. Then: ; in, These represent the total computing power, the percentage of computing resources consumed when the task arrives, and the average percentage of computing resources consumed during task execution, respectively. This represents the percentage of total storage resources consumed when a task arrives, and the average percentage of storage resources consumed during task execution. Let represent the read / write rate when the task arrives and the average read / write rate when the task is executed, respectively. Then:

[0049]

[0050] in, It is the computational load of the task. It is the size of the task, therefore, ; ; By modeling the relationship between the processing latency of computing tasks and the capabilities of computing nodes through function fitting of the above equations, the computing network system can intelligently allocate appropriate computing power to user tasks.

[0051] As an embodiment of the present invention, preferably, a digital quantum state representation and preparation method based on classical von Neumann computation is used to establish state vector simulation; a dual-path classical bit coupling mechanism is employed, by applying the coupling mechanism, the output results of two classical circuits are coupled to form a commutation relationship to simulate physical bits; based on the Ising spin model and vector amplitude encoding, the simulated physical bits are mapped to quantum state vectors represented by Bloch spheres to complete single-qubit generation. A state vector simulation technology system is established, and the storage overhead of an n-qubit system is defined as 2. n The exponential growth characteristic of ×16 bytes is utilized; recursive CSD decomposition is adopted to decompose multi-qubit gates into combinations of CNOT gates and single-qubit gates; and state vector piecewise parallel computation is achieved through OpenMP, pthread multi-threaded parallelism and MPI distributed simulation framework, which effectively improves simulation efficiency.

[0052] As an embodiment of the present invention, preferably, based on the Ising spin model and the SDN network control model, simulated quantum logic gates such as H-gates, X-gates, Y-gates, Z-gates, T-gates, and CNOT gates are generated by configuring the interaction parameters between qubits, and quantum circuits are constructed by connecting them according to the computational sequence. A dynamic partitioning method is used to adaptively determine the spatial and temporal dimension dividing lines to ensure that cross-region gates are dominated by CZ gates; through implicit decomposition technology, the branch indices of CZ gates that meet the conditions are absorbed into the control bit state index to avoid doubling the memory; cross-node interactions are optimized through data fragmentation localization and communication mode reconstruction to achieve large-scale parallel simulation of circuits.

[0053] As an embodiment of the present invention, preferably, the n-quantum state is represented by a matrix product state, and the high-dimensional quantum state is decomposed into multiple one-dimensional tensor products. Tensor chain decomposition (TTD), matrix tensorization, tensor chain singular value decomposition (TTSVD), and rounding calculations are used to decompose the high-dimensional tensor into a low-dimensional tensor chain form. Data flow matching is achieved through tensor chain reconstruction, tensor shrinking, and tensor kernel computability transformation. After applying a two-qubit gate, adjacent tensors are shrunk and then decomposed again through singular value decomposition, retaining the number of singular values ​​(bond dimension) to represent the degree of entanglement between subsystems. Efficient simulation of entangled finite circuits is achieved by controlling the bond dimension.

[0054] Example 4: Please see Figure 1 As shown, this invention is a computing power network DDoS detection system based on digital quantum computing. This system implements the computing power network DDoS detection methods provided in Embodiments 1, 2, and 3. Relying on the high-performance parallel computing power provided by the digital quantum computing platform, it constructs a DDoS attack detection and defense system integrating traffic awareness, intelligent analysis, policy decision-making, and attack mitigation. It accurately resists traffic-based, protocol-based, and resource-exhaustion-based DDoS attacks, ensuring the link connectivity, bandwidth resources, forwarding performance, and service stability of the computing power network infrastructure. It solves key problems of insufficient computing power, delayed detection, and weak ability to identify complex attacks in traditional defense architectures. Adopting a design concept of computing power support, layered protection, and closed-loop management, the system is divided into a computing power network layer (protected object), a traffic collection and execution layer, an AI engine layer, and a traffic security management layer. Using the digital quantum computing platform as the parallel computing power foundation, it provides high-performance computing power guarantees for the entire process of detection, analysis, management, and mitigation, forming a fully closed-loop DDoS defense mechanism encompassing traffic collection, AI intelligent detection, security policy generation, and attack mitigation execution.

[0055] As an embodiment of the present invention, preferably, the computing power network DDoS detection system includes: The distributed traffic security management module adopts a three-layer architecture that combines centralized management and distributed execution. It is responsible for the real-time collection of computing network traffic and the precise handling of DDoS attacks. It is the perception terminal and attack mitigation control execution unit of the defense system. It consists of a central control center, hub and edge detection and control nodes, and computing network infrastructure. The hub and edge detection and control nodes are deployed in pairs of detectors and mitigation controllers to collect local network traffic status and report it to the central control center. The central control center completes global traffic security situation analysis, risk assessment, policy generation and commands the nodes to coordinate and link. The graph neural network DDoS detection module takes a local traffic graph as input, calculates the node access probability distribution through quantum random walk, performs quantum probability weighted neighbor sampling, combines a graph sampling aggregation network to complete node feature representation learning, and achieves distributed collaborative training through federated learning to output DDoS attack detection results. The heterogeneous computing power unified scheduling support module is used for computing power, heterogeneous computing power unified modeling and computing task requirement modeling, and maps the heterogeneous computing power of CPU, GPU, TPU, NPU and FPGA to a unified quantization dimension to build a computing power requirement model. The digital quantum computing platform is used for digital quantum state preparation, quantum circuit generation and segmentation, and tensor network dimensionality reduction calculation, providing computing power support for detection, analysis and control processes with parallel computing power.

[0056] As an embodiment of the present invention, preferably, the computing power network includes computing power infrastructure and network infrastructure. The network infrastructure mainly includes devices such as switches, routers, network isolation devices, and gateways, which are responsible for data forwarding, boundary isolation, and link carrying in the computing power network. It is susceptible to DDoS attacks such as bandwidth congestion, protocol exhaustion, and session table overflow. The computing power infrastructure mainly includes hardware resources such as TPU, GPU, CPU, DPU, NPU, FPGA, ARM, servers, and clusters, which are responsible for computing power scheduling and service carrying. It is susceptible to resource crowding-out and request exhaustion-type DDoS attacks.

[0057] As an embodiment of the present invention, preferably, the traffic detector is based on the proposed graph neural network DDoS detection algorithm. Through technologies such as traffic probe deployment, full packet capture, and data preprocessing, it collects bidirectional traffic in real time at the boundary of the computing power network, core links, and key nodes, and completes data cleaning, protocol parsing, and feature extraction to provide standardized, high-quality traffic data for upper-layer analysis. The traffic mitigation controller receives traffic security management policies and performs operations such as traffic diversion, load balancing, malicious traffic blocking, and attack traffic cleaning to quickly suppress DDoS attacks and ensure that normal traffic of the computing power network is forwarded without loss and that resources are not compromised.

[0058] As an embodiment of the present invention, preferably, the AI ​​engine serves as the intelligent detection hub of the system and is the core of DDoS intelligent detection and analysis. It primarily relies on the parallel computing power of a digital quantum computing platform to achieve high-speed analysis of complex traffic and accurate attack identification. It mainly comprises four components: a large language model calling interface, a network security domain knowledge base, an AI algorithm model, and a large traffic model. The large language model calling interface provides standardized model integration capabilities, supporting attack log parsing, intelligent alarm information analysis, and auxiliary generation of defense strategies. The domain knowledge base constructs a dedicated knowledge base for DDoS defense in computing power networks, integrating attack feature libraries, normal traffic baselines, protocol rules, and defense strategy libraries to provide knowledge support for intelligent detection. It integrates various professional knowledge required in the process of network space security protection, including network security attack and defense knowledge bases (such as blacklist knowledge like vulnerability libraries, virus libraries, and threat libraries, and whitelist knowledge like configuration baseline libraries and behavior baseline libraries), and network security related knowledge (such as network information security policies, laws and regulations, information security level protection, commercial cryptography applications, national critical information infrastructure security protection related standard systems, network information security attack and defense technology foundations and operation and maintenance requirements, etc.). The construction and continuous updating of the domain knowledge base are crucial for training a large language model into an expert system for the application domain. AI algorithm model: Integrating machine learning, deep learning, and reinforcement learning algorithms for specific tasks such as threat detection, security incident classification, and automated response. Large traffic model: Based on a general-purpose foundation model, fine-tuning and training the model using a domain-specific knowledge base to construct a dedicated large traffic language model for DDoS attacks on computing power networks. Based on this, and supported by parallel acceleration using quantum computing power, high-speed identification and accurate classification of known DDoS attacks (SYNFlood, UDPFlood, HTTPFlood, CC attacks), unknown variant attacks, and low-speed, covert attacks are achieved, improving detection efficiency and accuracy.

[0059] As an embodiment of the present invention, preferably, the distributed traffic security management module completes attack determination, policy generation, and full-process management based on AI analysis results, serving as the overall policy decision-making and scheduling command center of the system. It mainly includes components such as traffic statistics and feature extraction, pattern recognition and baseline management, policy generation and management, and system management. Among them: Traffic statistics and feature extraction: Real-time statistics of traffic bandwidth, concurrent connections, request rate, resource consumption and other indicators, and extraction of key features of DDoS attacks; Pattern recognition and baseline management: By using the learning results of the AI ​​engine, a normal traffic baseline for the computing power network is established. By determining the baseline deviation, real-time alarms for abnormal traffic are achieved, and accurate identification of attack patterns is completed. Strategy generation and management: Automatically generate defense strategies such as rate limiting, blocking, and traffic diversion and cleaning based on attack type and intensity; supports strategy distribution, updating, retrospection, and optimization. System Management: Provides functions such as log auditing, alarm management, device monitoring, and operation and maintenance configuration to make the defense system visible, manageable, and controllable.

[0060] As an embodiment provided by the present invention, preferably, such as Figure 2 As shown, the digital quantum computing platform connects user terminals and massive computing nodes through an SDN fully switched network, providing computing power support for large-scale quantum computing tasks. The overall architecture is a typical three-layer network topology, consisting of a user terminal layer, a core switching layer, and a computing node layer from top to bottom. Specifically: Layer 1: Task Operation Terminal Layer (User Access Layer): This layer contains multiple user terminals, labeled in the diagram as: Task Operation Terminal 1, ..., Task Operation Terminal h. Users / developers submit quantum computing tasks, configure parameters, and view results through these terminals, which serve as the interaction entry point for the entire platform. All terminals are connected to the next-level backbone SDN switch. Layer 2: Core Switching Layer (SDN Network Layer): This layer consists of two levels of switches and serves as the communication hub of the platform: Backbone SDN Switch: Located below the terminal layer, it is the core node of the entire network, responsible for aggregating traffic from all terminals and distributing it downwards to lower-level switches; Secondary SDN Switch Cluster: Contains multiple switches, labeled: SDN Switch 1, SDN Switch 2, ..., SDN Switch m. Each secondary switch is connected to the backbone SDN switch, forming a star topology to achieve distributed traffic management. The third layer: Computation node layer (computing power layer): Each secondary SDN switch is connected to a set of computing nodes. Taking SDN switch 1 as an example, it is connected to computing node 1, ..., computing node n. SDN switches 2 and m have completely identical structures, each carrying a set of computing nodes. These computing nodes are the core of the platform's computing power, responsible for executing specific digital quantum computing tasks (such as quantum simulation, quantum algorithm operations, etc.). Through the combination of multiple sets of switches and nodes, horizontal scaling of computing power is achieved (m sets of switches × n nodes), supporting large-scale parallel computing. The digital quantum computing platform employs SDN switch networking for flexible network topology configuration and dynamic allocation of computing node resources. It performs fine-grained scheduling of task traffic, ensuring low-latency and high-reliability communication for quantum computing tasks. The structure, from terminal → backbone switch → secondary switch → computing node, supports: horizontal scaling: increasing the number of terminals (h), switches (m), and nodes (n) linearly improves the platform's access capacity and computing power; distributed scheduling: different secondary switches can manage different types of computing nodes, enabling partitioned task processing; terminals handle interaction and task submission; the SDN network handles high-speed, flexible communication scheduling; and a large number of computing nodes execute quantum simulations or classical quantum computing tasks in parallel, solving the problem of insufficient computing power on a single node.

[0061] As an embodiment of the present invention, preferably, the composition framework of a single computing node layer is as follows: Figure 3 As shown, it mainly includes digital quantum state representation and preparation, quantum circuit generation and segmentation, quantum state measurement, state vector simulation, tensor network calculation, database, and customized result output module. Specifically: The digital quantum state representation and preparation module is the input / startup module of the computing node, corresponding to the "initialization" phase of quantum computing. Its function is to transform the user-submitted quantum computing task into a digital quantum state (e.g., a qubit state represented in vector, matrix, or tensor form) that can be processed on a classical computer, and to complete the initialization and preparation of the state. It transforms abstract quantum problems into digital signals that can be processed by subsequent modules, serving as the "data entry point" for the entire node. It primarily uses two independent classical computing circuits to prepare classical qubits separately. By applying dual mapping (such as left-right commutation, positive-negative commutation, etc.) to the commutator, the outputs of the two classical circuits are coupled to form a commutation relationship, generating random physical qubits that satisfy the commutation relationship of mechanical quantities. The quantum circuit generation and segmentation module takes over the quantum state preparation results and is responsible for constructing and optimizing the core computational logic for the computational task. It mainly consists of a logic quantum gate controller that, based on the computational logic requirements of the quantum gates, calls upon qubits generated by multiple qubit controllers to dynamically generate various simulated quantum logic gates. These gates are then connected according to the computational sequence to form simulated quantum circuits. Furthermore, through methods such as gate transformation, dynamic partitioning, and implicit decomposition, the large-scale circuits are segmented into parallel-simulation sub-circuit modules, overcoming the limitations of single-node storage and computation. The quantum state measurement module, which interacts directly with the database, is a crucial component of quantum computing. It primarily performs "measurement" operations on the simulated quantum states, mimicking the measurement collapse process of a real quantum computer to obtain results such as the probability distribution and expected value of the quantum states. During the measurement process, historical data is read, parameters are configured, and the measurement results are written to the database to support subsequent analysis. State vector simulation module: A state vector is a system state consisting of n qubits defined by Hilbert space. A vector description in a vector is called a state vector, denoted as |ψ|. This method employs classical digital logic to simulate and calculate quantum state vectors, thus realizing the digital simulation of the quantum computing process. It includes the following steps: The state vector representation of a qubit: For an n-qubit system, the state vector can be represented as: Where x is the integer corresponding to the binary string, and c x For the corresponding ground state |x The complex amplitude; State vector storage: The state vector needs to be stored in 2... n Each complex number is typically represented by a double-precision floating-point number (8 bytes for the real part and 8 bytes for the imaginary part). The number of qubits, the number of amplitudes, and the memory requirements are shown in Table 1 below. Table 1

[0062] Quantum state evolution equation: The evolution of a quantum system follows the Schrödinger equation: ; Discretization of the evolution process: U k This is the unitary matrix corresponding to the k-th quantum gate; Quantum gate operations: performing matrix-vector multiplication: However, for n qubits, the matrix size is 2. n ×2 n The direct computation complexity is 2. 2n This far exceeds the capabilities of classical computers.

[0063] Multi-qubit gate decomposition: Recursive CSD decomposition (CSD stands for Controlled Single-Qubit Decomposition) is used to decompose it into a series of CNOT gates and single-qubit rotation gates. Any two-qubit gate can be decomposed into: ; Among them, u ij It is a single-qubit gate; Parallel acceleration: Use OpenMP or pthread to slice state vectors and process them in parallel with multiple threads: QuEST (QuantumExactSimulationToolkit) supports multi-threaded MPI distributed simulation and can run efficiently on CPU clusters.

[0064] Tensor Network Computation Module: Directly simulating the state vectors of multi-qubit quantum systems results in exponentially increasing computational power. However, employing tensor networks enables optimized computation for large-scale / complex quantum systems. Its main function is to represent quantum states using tensor networks (such as MPS and PEPS), significantly reducing the computational complexity of large-scale quantum system simulations and enhancing node processing capabilities. This allows computing nodes to handle larger-scale and more complex quantum computing tasks, breaking through the computational power bottleneck of direct state vector simulation. Quantum gates can be represented as multidimensional tensors; a single-qubit gate corresponds to a second-order tensor, a two-qubit gate to a fourth-order tensor, and so on. Nonlocal quantum gates (such as CNOT) can be implemented using tensor network models with shared entangled states. Further dimensionality reduction computation can be performed using tensor network chain decomposition, efficiently simulating quantum parallel computing processes.

[0065] Customized Result Output Module: Based on user needs, this module organizes, analyzes, and templates the simulation results, measurement data, and tensor network calculation results obtained from the previous modules, outputting them in a customized format required by the user. It transforms complex calculation results into a user-readable and usable form, completing the entire task loop.

[0066] It supports bidirectional connections between the database and "quantum state measurement" and "state vector simulation". Its main function is to serve as the data hub of the entire node, storing information such as initial quantum state, circuit configuration, intermediate calculation results, measurement data, and user configuration, supporting the read and write needs of the simulation and measurement process, and also providing data support for task backtracking and repeated calculations.

[0067] This invention designs a graph neural network DDoS detection algorithm based on quantum random walk sampling, realizing DDoS traffic feature extraction based on graph structure, and using a neighbor sampling mechanism guided by quantum random walk to complete real-time identification and detection of DDoS attacks. It adopts a distributed security management approach, with multiple distributed detection points interfacing with a security management and control center platform. Distributed detection points report local network traffic status information, while the security management center is responsible for comprehensive analysis, risk assessment, strategy generation, and command of distributed nodes for coordinated control of the overall traffic security situation. It employs a digital quantum technology platform integrating digital quantum state representation and preparation, quantum circuit generation and segmentation, tensor network dimensionality reduction calculation, and multi-node collaborative computing. Through a unified computing task computing power requirement model, it provides strong computing power support for AI detection and comprehensive analysis and evaluation by the security management center, enabling real-time mitigation and response control of DDoS attacks on the computing network and ensuring the stable operation of the computing network.

[0068] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0069] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A DDoS detection method based on digital quantum computing computing power networks, characterized in that, Includes the following steps: Real-time network traffic data within the jurisdiction is collected by distributing detection points. A local traffic graph is constructed with IP addresses as nodes and the communication relationships between IP addresses as edges. Traffic behavior feature vectors are extracted for each node. A graph neural network DDoS detection algorithm based on quantum random walk sampling is constructed. Taking the local flow graph as input, a quantum random walk is performed to obtain the quantum probability distribution of each node. The probability of the boundary node is reported to the security management center, which performs weighted aggregation and then sends out an update to the local node probability distribution. For each target node, perform quantum probability-weighted sampling without replacement on its neighboring nodes to obtain the sampled neighbor set; The sampling neighbor set is message-passed through a graph sampling aggregation network to aggregate neighbor information and update the node representation vector. The local model parameters are uploaded to the security management center through the federated learning architecture. The security management center performs federated averaging and aggregation to generate global model parameters and distributes them. Each distributed detection point uses the trained model to classify the node representation vectors and outputs DDoS attack detection results. The computational tasks of the quantum random walk, the message passing of the graph sampling aggregation network, and the federated average aggregation are supported by parallel computing power provided by the digital quantum computing platform.

2. The DDoS detection method based on digital quantum computing for computing power networks according to claim 1, characterized in that, The method for constructing the local traffic graph includes: using all IP addresses appearing within a fixed time window as the node set, using the presence or absence of data packet transmission between IP addresses as the directed edge set, constructing a directed graph, and using an adjacency matrix to represent the topology of the graph.

3. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, The traffic behavior feature vector includes at least one of the following features: packet rate, average packet length, packet interval time variance, port distribution entropy, and TCP connection success rate.

4. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, The execution steps of the quantum random walk include: The graph Laplace matrix of the local flow graph is used as the Hamiltonian of the quantum walk to prepare an initial quantum state that is uniformly superimposed on all nodes. The initial quantum state is evolved using a unitary evolution operator, and the node local access probability is obtained by measuring the evolved quantum state. The access probability of the boundary node is reported to the security management center for weighted aggregation. The aggregated global probability is then distributed to each distributed detection point to update the local node probability distribution.

5. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, The quantum probability-weighted sampling method without replacement includes: using the probability of each neighboring node as a weight, iteratively performing multiple sampling operations on the neighbor set of the target node, randomly selecting a node each time in a manner proportional to the probability of nodes in the current candidate set, and removing the selected node from the candidate set, until a preset sampling scale is reached.

6. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, The message passing method of the graph sampling aggregation network includes: in each layer, performing probability-weighted mean aggregation on the previous layer representation vectors of the neighbor nodes in the sampling neighbor set, concatenating the aggregation result with the previous layer representation vector of the node itself, transforming it through a fully connected layer and activating it with ReLU to obtain the node representation vector of the current layer.

7. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, The method for training a model using a federated learning architecture includes: each distributed detection point independently trains the model using local data, calculates the loss function, updates the local model parameters using stochastic gradient descent, and uploads the updated parameters to the security management center; the security management center generates global model parameters by weighted averaging based on the sample size of each distributed detection point, and distributes them to each distributed detection point for the next round of iteration until the model converges.

8. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, Methods for outputting DDoS attack detection results include: Multi-level feature aggregation and node representation update are performed based on the sampled neighbor set, and multi-hop neighborhood topology and traffic features are fused. The final representation vector of a node is input into a fully connected classifier with a Sigmoid activation function to obtain the probability value of a node being identified as a DDoS attack. When the probability value exceeds a preset threshold, the node is identified as a DDoS attack node.

9. The DDoS detection method for computing power networks based on digital quantum computing according to claim 1, characterized in that, The digital quantum computing platform provides parallel computing power through state vector simulation and tensor networks. The state vector simulation uses recursive CSD decomposition to decompose multi-qubit gates into combinations of single-qubit gates and CNOT gates, and adopts a multi-threaded parallel and distributed simulation framework to realize the sliced ​​parallel computation of state vectors.

10. A DDoS detection system based on digital quantum computing power networks, characterized in that, The computing power network DDoS detection system is used to implement the computing power network DDoS detection method according to any one of claims 1-9, and the computing power network DDoS detection system includes: The distributed traffic security management module adopts a three-layer architecture that combines centralized management and distributed execution. It consists of a central control center, hub and edge detection and control nodes, and computing network infrastructure. The hub and edge detection and control nodes are deployed in pairs of detectors and mitigation controllers to collect local network traffic status and report it to the central control center. The central control center completes global traffic security situation analysis, risk assessment, policy generation and commands each node to coordinate and link. The graph neural network DDoS detection module takes a local traffic graph as input, calculates the node access probability distribution through quantum random walk, performs quantum probability weighted neighbor sampling, combines a graph sampling aggregation network to complete node feature representation learning, and achieves distributed collaborative training through federated learning to output DDoS attack detection results. The heterogeneous computing power unified scheduling support module is used to map the heterogeneous computing power of CPU, GPU, TPU, NPU and FPGA to a unified quantization dimension and build a computing power demand model. The digital quantum computing platform is used for digital quantum state preparation, quantum circuit generation and segmentation, and tensor network dimensionality reduction calculation, providing computing power support for detection, analysis and control processes with parallel computing power.

Images