A detection method for a quic protocol denial of service attack in a backbone network

Abstract

The application discloses a detection method for a QUIC protocol denial of service attack (QDA) in a backbone network. The method can realize detection of a composite denial of service attack under the QUIC protocol. The detection method comprises an offline training stage and an online detection stage. In the offline training stage, according to the attack characteristics of the composite QDA, representative one-way traffic feature data is extracted, and corresponding feature groups are constructed. These features can effectively deal with the case that there is a large amount of one-way traffic in the backbone network node. Finally, a specific machine learning method is used for training to obtain an attack detection model. The application can be used for QDA attack behavior detection and early warning in a massive traffic scene such as a backbone network, and provides a basis for maintaining the security of the network.

Description

Technical Field

[0001] This invention relates to a method for detecting QUIC protocol denial-of-service attacks in backbone networks, belonging to the field of cyberspace security technology. Background Technology

[0002] Currently, Distributed Denial-of-Service (DDoS) attacks have become one of the most destructive and widespread threats in the field of internet security. Traditional DDoS attacks often focus on specific layers of the TCP / IP protocol stack, including ICMP / UDP flooding at the network layer, SYN flooding at the transport layer, and HTTP flooding at the application layer. Detection technologies for these different layers have been gradually improved. However, with the widespread deployment of the QUIC protocol in commercial applications, attackers have developed a new form of DDoS attack—QUIC-based Denial-of-Service (QDA) attacks. These attacks fully utilize the multi-layered integration characteristics of the QUIC protocol, simultaneously consuming the target system's transmission control resources, cryptographic computing capabilities, and application-layer processing capabilities through a single attack vector (such as QUIC connection flooding or exhausting encrypted handshake resources), significantly increasing the complexity of the attack and the difficulty of defense.

[0003] It is worth noting that QDA attacks often target core nodes of the backbone network, and these critical nodes handle extremely large volumes of traffic, further exacerbating the technical challenges of QDA detection. Despite the numerous difficulties in detecting QDA attacks in the backbone network environment, strengthening the backbone network security system and preventing potential losses remains of significant practical importance. Therefore, developing efficient QDA attack detection solutions suitable for backbone network environments is particularly urgent.

[0004] In recent years, the academic community has proposed various QDA detection techniques. Existing methods generally rely on in-depth observation of bidirectional flow data, such as uplink and downlink packet counts, TTL value distribution, and inter-packet time intervals, to select key features for a comprehensive description of the state characteristics of each network flow. These methods can achieve relatively ideal detection results in network environments with smaller traffic volumes. However, in today's high-speed backbone network environments, the throughput of critical network nodes typically reaches gigabits per second or even higher, and existing QDA detection techniques have revealed significant limitations in high-traffic backbone network applications.

[0005] (1) Detection method based on encrypted traffic mode.

[0006] Such methods require in-depth research into QDA attack behavior patterns and traffic characteristics, identifying potential attacks by analyzing side-channel information (such as packet length sequences and arrival time intervals) in encrypted traffic. This method achieves ideal detection results in small network environments, mainly due to the relatively limited data scale. However, in backbone network scenarios, processing massive amounts of traffic data and calculating and analyzing numerous side-channel features incurs significant computational overhead, severely impacting system efficiency. Furthermore, the QUIC protocol encrypts most data, including the protocol header, from the initial handshake phase, even encrypting critical metadata such as the TLS handshake process and Server Name Indication (SNI), which are originally transmitted in plaintext in HTTPS. This forces the detection method to rely solely on a limited set of indirect features. In asymmetric routing environments, unidirectional traffic observation further compromises the integrity of these features, making this method difficult to apply effectively in backbone network QDA detection.

[0007] (2) Detection methods based on artificial intelligence.

[0008] These methods utilize artificial intelligence (AI) to intelligently classify encrypted traffic. Researchers typically extract QDA traffic features manually or automatically. Thanks to the powerful learning capabilities of AI and the excellent performance of specific algorithms in classification tasks, these methods achieve good detection accuracy. However, existing intelligent algorithm-based methods face multiple challenges in backbone network environments: First, deep learning-based detection schemes (such as recurrent neural networks, long short-term memory networks, and Transformer architectures) suffer from high computational complexity, making real-time detection difficult when dealing with massive amounts of backbone network data. Second, traditional machine learning-based detection methods typically select a large number of parameters as feature inputs, significantly increasing computational overhead and making them unsuitable for backbone network environments. Excessive feature dimensions also mean insufficient feature representativeness, hindering subsequent traffic analysis in the defense phase. More importantly, existing methods are generally based on bidirectional traffic data, failing to fully consider the reality that key backbone nodes often only capture unidirectional traffic (i.e., the asymmetric routing problem), a phenomenon quite common in backbone network environments. Therefore, existing intelligent algorithm-based methods have significant shortcomings in backbone network QDA detection applications.

[0009] Detecting QDA attacks in backbone network environments places extremely high demands on the accuracy, environmental adaptability, and computational efficiency of methods. The main technical challenges currently faced can be summarized as follows: First, the end-to-end encryption of the QUIC protocol renders traditional detection methods ineffective, while the high-speed transmission environment of backbone networks further increases the difficulty of QDA traffic identification. Second, most existing methods rely on bidirectional flow data and fail to fully consider the unidirectional characteristics of traffic at key backbone nodes (i.e., routing asymmetry). In asymmetric routing environments, unidirectional traffic observation can lead to session reconstruction failures and biased behavioral analysis. If the detection method cannot effectively solve either of these challenges, it may result in missed or delayed detection of attack traffic, potentially leading to serious consequences such as node paralysis and network communication interruptions.

[0010] To address the aforementioned challenges, this invention proposes an innovative method specifically for detecting denial-of-service attacks based on the QUIC protocol in backbone networks, effectively solving the current technical bottleneck in backbone network QDA traffic identification in the network security field. Summary of the Invention

[0011] To address the aforementioned technical challenges, this invention proposes a specific scheme for identifying QUIC-based Denial-of-Service (DoS) Attacks (QDA) in backbone network environments. This scheme effectively and accurately identifies DoS attack behaviors within the QUIC protocol framework. The core process of this scheme comprises two key stages: an offline model construction stage and an online real-time identification stage.

[0012] In the offline model building phase, based on the typical behavioral characteristics of QDA attacks, discriminative one-way traffic feature indicators were systematically selected and organized into a feature set. The design of these feature indicators fully considers the actual situation that one-way traffic observation is common in backbone network nodes. Subsequently, optimized machine learning algorithms are used to train the model on the feature data, ultimately generating an attack identification model.

[0013] In the online real-time identification process, a standardized data processing procedure is performed on the network traffic collected on the actual backbone network nodes to extract the corresponding traffic feature vectors, which are then input into a pre-trained attack identification model for real-time judgment, thereby quickly identifying whether the current traffic contains attack behavior.

[0014] This solution is particularly suitable for QDA attack identification and risk warning in high-traffic-density environments such as backbone networks, providing strong technical support for ensuring the safe and stable operation of network infrastructure.

[0015] To achieve the objectives of this invention, the specific technical steps of this solution are as follows: A method for detecting QUIC protocol denial-of-service attacks in a backbone network, the method comprising the following steps:

[0016] (1) Collect current real backbone network traffic datasets, normal QUIC service datasets and known attack sample datasets, and extract raw network traffic from them;

[0017] (2) In-depth analysis of the attack mechanism of QDA, screening out statistical indicators that can effectively reflect the overall behavioral characteristics of such attacks from the unidirectional data flow, and then constructing a feature set specifically for QDA;

[0018] (3) Based on the actual nature of each traffic flow, assign corresponding category labels to the extracted features to form a labeled feature vector. The label types cover both normal traffic and attack traffic.

[0019] (4) In order to balance detection efficiency and resource consumption, a machine learning algorithm with low computational complexity is selected, and the above labeled feature vectors are used as training input to train and generate a QDA attack identification model.

[0020] (5) Collect network traffic in real time from the actual operating backbone network nodes, and extract the same feature data from the unidirectional flow in accordance with the methods described in steps (1) and (2) for online detection;

[0021] (6) Input the real-time extracted but unlabeled feature vectors into the detection model trained in step (4), and have the model output the predicted category, thereby labeling the traffic as normal or attacking, and thus guiding subsequent defense response measures. Further, in step (1), the steps for obtaining the traffic data used for training are as follows:

[0022] (1.1) Collect real backbone network datasets and normal QUIC service traffic as background traffic. In order to verify the effectiveness of the proposed method in the actual environment, it is necessary to actively capture real traffic on the backbone network links and perform unified formatting processing to support subsequent analysis.

[0023] (1.2) Construct an attack simulation environment, implement QDA attack using the publicly available go-quic library, generate corresponding attack traffic, and adjust its format to be consistent with the background traffic described in (1.1);

[0024] (1.3) Normal QUIC service traffic in real-world scenarios is introduced as the basic traffic component. Attack traffic, normal QUIC service traffic, and background traffic are sliced ​​into equal-length segments with a time window t as the granularity, forming a structurally aligned traffic block sequence. Based on this, a random temporal embedding strategy is adopted to dynamically inject attack traffic blocks and QUIC service traffic blocks into discontinuous positions in the background traffic block sequence, thereby generating a hybrid traffic dataset with reasonable spatiotemporal distribution and rich semantic diversity, effectively simulating the complex communication environment in real networks where attacks and normal services coexist.

[0025] Furthermore, in step (2), the step of constructing feature groups based on the attack is as follows:

[0026] (2.1) Observe the process of high-concurrency logical clients frequently triggering QUIC connections during a QDA attack, and analyze the characteristics of the Long Header message responsible for connection ID and initial key exchange. Specifically, let the... The statistical window is Define the total number of QUIC messages within the window. (in Count the QUIC messages within the window. (constant) and the number of LongHeader messages Then the characteristic formula (4) can be constructed as follows:

[0027]

[0028] According to formula (4), the key observable index of QDA handshake pressure intensity can be obtained and used as a protocol layer detection feature without decryption.

[0029] (2.2) Observe the packet payload length pattern that is significantly different from normal business during QDA attacks, and analyze the characteristics of QUIC packets in QDA attacks. Specifically, the payload length of QUIC packets is bucketed in units of 100 bytes to construct a payload length feature vector. Let the first byte in each statistical window be the first byte. The payload length of each message is denoted as , then the first The definition of the length bin feature is shown in formula (5):

[0030]

[0031] According to formula (5), the observable index of load distribution during QDA attack can be obtained, and then the statistical characteristics of low entropy, single peak or abnormal tail distribution of traffic during QDA attack can be characterized.

[0032] (2.3) Observe the process of high downlink throughput caused by the server being forced to respond during the resource consumption phase of a QDA attack, and analyze the change in load transmission rate per unit time. Specifically, define an average bit rate characteristic based on a fixed time window to characterize the actual intensity of the attack's occupation of network egress resources and provide measurable correlation evidence for service degradation phenomena. Specify the statistical window. Average bit rate within As a measure of bandwidth occupancy intensity, the observed QUIC message sequence within the window is... For the first Each message, with its effective payload length recorded as... The average throughput within the window is defined as shown in formula (6):

[0033]

[0034] The characteristics obtained from formula (3) can reflect whether the server is suffering from a persistent load attack aimed at bandwidth squeezing.

[0035] (2.4) Check the feature data to ensure that the selected features can be effectively captured in a one-way network flow and do not depend on the specific payload content or semantic information of the application layer, so as to ensure the applicability of encrypted traffic in actual deployment.

[0036] (2.5) Verify the multi-dimensional attack parameters to ensure the high robustness and discriminative consistency of the extracted features under different QDA attack variants, so that they have strong generalization ability and deployment reliability in the actual network environment.

[0037] Furthermore, in step (3), all QDA attack traffic originates from a specific source IP address preset in the experimental topology. Therefore, the feature data is labeled by the source IP address: if the IP address of a certain flow matches the known attack IP list, it is marked as attack traffic; otherwise, it is regarded as background traffic and uniformly labeled as normal category.

[0038] Furthermore, in step (4), a machine learning algorithm with high robustness and adaptability is used to model the extracted feature data. The selected algorithm needs to ensure high classification accuracy while taking into account the computational efficiency required for online deployment and the generalization ability when facing unknown attack variants, and effectively suppress model overfitting. After comprehensive evaluation of various mainstream algorithms in actual network environments, random forest is finally adopted as the core learning engine to construct an efficient and scalable QDA attack intelligent identification model.

[0039] Furthermore, in step (5), the steps for effectively collecting backbone network traffic are as follows:

[0040] (5.1) The acquisition system deployed at key nodes of the backbone network uses unidirectional network flow as the basic acquisition unit, which fits the actual deployment scenario of traffic mirroring or bypass monitoring in the backbone network, avoids dependence on bidirectional session reassembly, and improves acquisition efficiency and deployment flexibility.

[0041] (5.2) In response to the scale of backbone network traffic, the acquisition system implements an extreme simplification strategy for the original packet payload during the packet capture stage—only the first byte is retained and the rest of the content is discarded immediately. This significantly reduces storage and processing overhead while still effectively distinguishing between long and short packet types, providing key metadata for subsequent attack feature extraction.

[0042] (5.3) All collected stream records strictly follow the unified data format specifications defined in step (1.1) to ensure seamless integration with subsequent analysis modules and lay a data consistency foundation for QDA detection.

[0043] Furthermore, in step (6), the steps of predicting the current traffic and taking corresponding measures are as follows:

[0044] (6.1) The QDA attack detection model has been built during the training phase; during the detection phase, the feature data extracted in real time is input into the model for prediction, and the model output results are summarized to assign the corresponding category label to the current traffic sample, thereby achieving effective identification of QDA attacks.

[0045] (6.2) Implement differentiated response strategies based on the actual prediction results of the model: if the traffic is determined to be normal, it is allowed to pass; if it is identified as attack traffic, an alarm mechanism is triggered to notify network operation and maintenance personnel in a timely manner; in addition, since the IP of the feature data comes from the specific source IP address preset in the laboratory environment, the system can selectively output the corresponding attack source IP address according to the actual defense needs, providing supporting information for subsequent implementation of active defense measures such as blocking and traffic limiting.

[0046] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the aforementioned method for detecting denial-of-service attacks under the QDA protocol in a backbone network.

[0047] A computer-readable storage medium storing computer instructions that, when executed by a processor, implement the aforementioned method for detecting denial-of-service attacks under the QDA protocol in a backbone network.

[0048] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects.

[0049] (1) This invention provides an efficient detection scheme suitable for high-throughput network environments such as backbone networks, for quickly and accurately identifying denial-of-service attacks (QDA) based on the QUIC protocol. This method analyzes the statistical characteristics of backbone network traffic and uses the extracted feature data to achieve efficient discrimination of QDA traffic, providing reliable data support for network security operation and maintenance.

[0050] (2) Based on in-depth observation and analysis of QDA traffic behavior characteristics, this invention extracts several key discriminative features, including the proportion of LongHeader packets, packet length distribution characteristics, and average bit rate. These features characterize the abnormal patterns of attack traffic from multiple dimensions such as protocol layer, payload distribution, and bandwidth occupancy. This method effectively alleviates the computational pressure of processing massive amounts of data on the backbone network and has excellent detection robustness and accuracy.

[0051] (3) All features used in this invention can be extracted using only unidirectional traffic. This means that even in real-world scenarios where asymmetric routing is common in backbone networks and key monitoring points can only obtain unidirectional flow data, this method still has good applicability. In contrast, most existing studies rely on bidirectional session information and do not fully consider the common real-world constraint of unidirectional traffic. Because this solution only requires unidirectional flow, it is not only easier to deploy in backbone networks, but also helps security personnel respond and implement defense measures more quickly, meeting the core requirements of backbone networks for real-time performance and deployability.

[0052] (4) This invention does not require parsing plaintext content at the application layer during feature extraction. Although QDA attacks occur at the application layer, their payloads are usually encrypted, rendering traditional detection methods that rely on plaintext information ineffective. This method completely avoids dependence on plaintext at the application layer and constructs features using only observable fields at the transport layer and below. Therefore, even when faced with end-to-end encrypted traffic, it can still reliably identify attack behavior and effectively adapt to the growing trend of encrypted communication in the current backbone network. Attached Figure Description

[0053] Figure 1 A system framework diagram for detecting denial-of-service attacks under the QUIC protocol in backbone networks;

[0054] Figure 2 The QDA attack execution process;

[0055] Figure 3 The proportion of Long Header packets under different QDA attack parameters;

[0056] Figure 4 The distribution of payload length for different QDA attack parameters, different attack stages, and normal traffic loads;

[0057] Figure 5 Test confusion matrices for different model algorithms;

[0058] Figure 6 This is a topology diagram of the attack environment. Detailed Implementation

[0059] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0060] Example: This invention provides a method for detecting QUIC protocol denial-of-service attacks in backbone networks. Its overall system structure is as follows: Figure 1 As shown, it includes the following steps:

[0061] Step (1) Obtain the currently publicly available authoritative backbone network dataset and attack dataset, and extract the traffic data from them;

[0062] In one embodiment of the present invention, the step of obtaining the traffic data used for training is as follows:

[0063] (1.1) To construct the background traffic dataset, network traffic needs to be collected in a real backbone network environment. Given the differences in format of existing publicly available backbone network datasets, this study chooses to capture traffic in a backbone network confirmed to be free of QDA attacks and standardize it into a unified data format;

[0064] (1.2) To generate attack traffic samples, a distributed attack simulation platform was constructed. QDA attack traffic was generated using the go-quic development library, ensuring that its data format remained consistent with the background traffic in step (1.1). Furthermore, QDA attack traffic with different QDA parameters was collected to ensure the diversity of attacks in the dataset. In this embodiment, the attack source was set to a host within the 192.168.8.8 / 29 network segment, and the target host address was 192.168.8.162.

[0065] (1.3) In order to introduce normal QUIC business traffic in real scenarios as the basic traffic component, a high-performance QUIC server was built independently in the laboratory environment to reproduce typical QUIC business scenarios of the Internet, including the simulation of mainstream application protocols such as file transfer and video streaming supported by the platform, and the ability to generate business traffic with real user behavior characteristics.

[0066] (1.4) To construct the hybrid dataset, attack traffic, normal QUIC service traffic, and background traffic are sliced ​​into equal-length segments at the time window t, forming a structurally aligned traffic block sequence. Based on this, a random temporal embedding strategy is adopted to dynamically inject attack traffic blocks and QUIC service traffic blocks into non-contiguous positions in the background traffic block sequence, thereby generating a hybrid traffic dataset with reasonable spatiotemporal distribution and rich semantic diversity, effectively simulating the complex communication environment in real networks where attacks and normal services coexist. Some parameters are shown in Table 1.

[0067] Table 1. Some parameters of mixed flow rate

[0068]

[0069] Step (2) combined Figure 2 The implementation process of QDA attacks is analyzed in depth, the attack mechanism of QDA is dissected, statistical indicators that can effectively reflect the overall behavioral characteristics of such attacks are selected from unidirectional data streams, and then a feature set specifically for QDA is constructed.

[0070] In one embodiment of the present invention, the step of constructing corresponding feature groups according to attack type is as follows:

[0071] (2.1) Analyzing the characteristic of the abnormally high proportion of Long Header packets caused by the establishment of high-frequency QUIC connections in QDA attacks, the pcap file is divided into windows according to a fixed number of QUIC packets. The proportion of Long Header packets in each window is calculated, and the final result is as follows: Figure 3 The protocol layer detection features shown are stable and do not require decryption.

[0072] (2.2) Analyzing the concentrated distribution and single pattern of QUIC packet payload length in QDA attacks, the packet length within each window is statistically analyzed by bucketing the traffic file into 100-byte segments, resulting in the following... Figure 4 The distribution characteristics shown include low entropy, unimodal distribution, and anomalous tails. These characteristics clearly demonstrate the anomalies between QDA attacks and normal traffic, as well as the distinct features of different attack stages, and can serve as a criterion for identifying attacks in encrypted traffic.

[0073] (2.3) Analyze the characteristics of the downlink bandwidth being heavily occupied by the server due to continuous response to requests during the QDA resource consumption phase. Count the total effective payload length of QUIC messages in a fixed time window and calculate the average bit rate accordingly to identify abnormally high throughput or periodic pulse bandwidth occupation patterns caused by attacks.

[0074] (2.4) Check the feature data to ensure that the selected features can be effectively captured in a one-way network flow and do not depend on the specific payload content or semantic information of the application layer, so as to ensure the applicability of encrypted traffic in actual deployment.

[0075] (2.5) Verify the multi-dimensional attack parameters to ensure the high robustness and discriminative consistency of the extracted features under different QDA attack variants, so that they have strong generalization ability and deployment reliability in the actual network environment. Table 2 lists some feature names and their meanings.

[0076] Table 2. Some feature names and their meanings

[0077]

[0078] Step (3) Label the feature data according to the real attributes of the traffic and construct a feature vector containing category information, which covers two categories: offensive traffic and regular traffic.

[0079] In one embodiment of the present invention, the feature extraction process uses the source / destination IP address of the data packet as a key index. Since all types of attack traffic are initiated by hosts within the 192.168.8.8 / 29 subnet during the attack simulation phase, the feature data can be labeled with attack categories based on IP address information. Specifically, when the IP address corresponding to the feature data is neither within the subnet nor the target address 192.168.8.162, the traffic is determined to be background traffic and is accordingly marked as normal traffic.

[0080] In step (4), to improve the system's processing efficiency, this scheme selects a machine learning method with low computational overhead, uses the labeled feature vector generated in step (3) as input for model training, and finally constructs a QDA attack identification model.

[0081] In one embodiment of the present invention, the model training process needs to comprehensively balance the computational efficiency, classification accuracy, and generalization ability of the algorithm. Based on the above considerations, this embodiment first compares and verifies four models: random forest, decision tree, support vector machine, and convolutional neural network, and finally obtains the following... Figure 5 The training results are shown in Table 3.

[0082] Table 3 Detection results of different models

[0083]

[0084] The results show that the random forest model exhibits significant technical advantages. By integrating a voting mechanism across multiple decision trees, this model effectively balances detection sensitivity and false positive control, ensuring the integrity of attack identification while keeping the false positive rate of normal traffic extremely low. More importantly, the model demonstrates highly consistent performance on both the training and test sets, exhibiting excellent generalization ability and resistance to overfitting. In contrast, other candidate models either have the risk of overfitting or are insufficient in false positive control, making it difficult to meet the stringent requirements of backbone network environments for the stability and reliability of detection systems. Based on the above verification results, this invention ultimately adopts the random forest algorithm as the core classifier, using the sample feature set labeled in step (3) for model learning, successfully training an effective detection model against QDA attacks.

[0085] Step (5) involves collecting network traffic data in real time from the actual operating backbone network nodes and performing the traffic feature extraction process according to the methods described in steps (1) and (2). It should be noted that the feature information required by this solution can be obtained by analyzing only unidirectional traffic.

[0086] In one embodiment of the present invention, the following steps are included to achieve effective monitoring of backbone network traffic:

[0087] (5.1) A data acquisition system is deployed at one-way nodes of the backbone network to collect one-way network flows.

[0088] (5.2) During the packet capture stage, the acquisition system will only retain the first byte of the raw traffic and discard the rest of the content immediately, thereby significantly reducing the system storage and processing overhead.

[0089] (5.3) All collected stream records strictly follow the unified data format specifications defined in step (1.1) to ensure seamless integration with subsequent analysis modules and lay a data consistency foundation for QDA detection.

[0090] (5.4) such as Figure 6 The simplified network topology shown reflects the attack correlations in the backbone network: by deploying monitoring points at key nodes, the system captured a total of 45 terminal devices accessing specific target nodes in the backbone network, of which terminals numbered 1 to 40 were legitimate users, while terminals numbered 41 to 45 were identified as attack sources.

[0091] Step (6) sends the unlabeled feature vectors generated online into the QDA attack identification model constructed in step (5) for classification and judgment. Based on the model output results, each feature vector is assigned a corresponding category label to clarify the traffic attributes and activate the corresponding security protection mechanism based on the identification conclusion.

[0092] In one embodiment of the present invention, the identification and response process for real-time traffic includes the following steps:

[0093] (6.1) After comprehensive evaluation during the training phase, the optimal QDA attack detection model was obtained. Here, the real-time generated feature data is input into the QDA attack detection model for prediction. The prediction results of all models are integrated to label the current feature data and complete the detection of QDA traffic.

[0094] (6.2) Implement differentiated handling strategies based on classification results: Legitimate access traffic generated by hosts 1 to 40 will be allowed to pass normally; for malicious attack traffic generated by hosts 41 to 45, the system will trigger a security alarm at the current monitoring node and promptly notify network operation and maintenance personnel to intervene and handle the situation. At the same time, given that the feature extraction process uses IP addresses as the core identifier, the system can selectively output the IP address information of the attack source hosts (hosts 41 to 45) according to actual security needs, providing key evidence for subsequent security handling, such as including relevant IP addresses in access control blacklists and other protective measures.

[0095] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. A method for detecting QUIC protocol denial-of-service attacks in backbone networks, characterized in that, The method includes the following steps: (1) Collect current real backbone network traffic datasets, normal QUIC service datasets and known attack sample datasets, and extract raw network traffic from them; (2) In-depth analysis of the attack mechanism of QDA (QUIC Denial-of-Service Attack), screening out statistical indicators that can effectively reflect the overall behavioral characteristics of this type of attack from the unidirectional data flow, and then constructing a feature set specifically for QDA; (3) Based on the actual nature of each traffic flow, assign corresponding category labels to the extracted features to form a labeled feature vector. The label types cover both normal traffic and attack traffic. (4) In order to balance detection efficiency and resource consumption, a machine learning algorithm with low computational complexity is selected, and the labeled feature vector is used as training input to train and generate a QDA attack identification model. (5) Collect network traffic in real time from the actual operating backbone network nodes, and extract the same feature data from the unidirectional flow in accordance with steps (1) and (2) for online detection; (6) Input the real-time extracted but unlabeled feature vectors into the detection model trained in step (4), and the model outputs the predicted category, and labels the traffic as normal or attack, thereby guiding subsequent defense response measures.

2. The method for detecting QUIC protocol denial-of-service attacks in a backbone network according to claim 1, characterized in that, Step (1) specifically includes the following sub-steps: (1.1) Collect real backbone network datasets and normal QUIC service traffic as background traffic. In order to verify the effectiveness of the proposed method in the actual environment, it is necessary to actively capture real traffic on the backbone network links and perform unified formatting processing to support subsequent analysis. (1.2) Construct an attack simulation environment, implement QDA attack using the publicly available go-quic library, generate corresponding attack traffic, and adjust its format to be consistent with the background traffic in (1.1); (1.3) Introduce normal QUIC business traffic in real-world scenarios as the basic traffic component; Subsequently, using time window t as the granularity, the attack traffic, normal QUIC service traffic, and background traffic are sliced ​​into equal-length segments to form a structurally aligned traffic block sequence. Based on this, a random temporal embedding strategy is adopted to dynamically inject the attack traffic blocks and QUIC service traffic blocks into non-contiguous positions in the background traffic block sequence, thereby generating a mixed traffic dataset with reasonable spatiotemporal distribution and rich semantic diversity, effectively simulating the complex communication environment in real networks where attacks and normal services coexist.

3. The method for detecting QUIC protocol denial-of-service attacks in a backbone network according to claim 1, characterized in that, Step (2) specifically includes the following sub-steps: (2.1) Observe the process of high-concurrency logical clients triggering QUIC connections frequently during a QDA attack, and analyze the characteristics of the Long Header message responsible for connection ID and initial key exchange, as follows: Let the first... The statistical window is Define the total number of QUIC messages within the window. (in Count the QUIC messages within the window. (constant) and the number of LongHeader messages Then the characteristic formula (1) can be constructed as follows: According to formula (1), the key observable index of QDA handshake pressure strength is obtained and used as a protocol layer detection feature without decryption. (2.2) Observe the message payload length pattern that is significantly different from normal business during QDA attacks, and analyze the characteristics of QUIC messages in QDA attacks. Specifically, the payload length of QUIC messages is divided into buckets of 100 bytes each, and a payload length feature vector is constructed. Let the first byte of each statistical window be the first byte. The payload length of each message is denoted as , then the first The definition of the length bin feature is shown in formula (2): According to formula (2), the observable index of load distribution during QDA attack is obtained, which further characterizes the statistical features of low entropy, single peak or abnormal tail distribution in the traffic during QDA attack. (2.3) Observe the process of high downlink throughput caused by the server being forced to respond during the resource consumption phase of a QDA attack, and analyze the change in load transmission rate per unit time. Specifically, define the average bit rate characteristic based on a fixed time window to characterize the actual intensity of the attack's occupation of network egress resources and provide measurable correlation evidence for service degradation phenomena. Specify the statistical window. Average bit rate within As a measure of bandwidth occupancy, the observed QUIC message sequence within the window is: , for the Each message, with its effective payload length recorded as... The average throughput within the window is defined as shown in formula (3): The characteristics obtained from formula (3) reflect whether the server is suffering from a persistent load attack aimed at bandwidth throttling. (2.4) Examine the feature data to ensure that the selected features can be effectively captured in a unidirectional network flow and do not depend on the specific payload content or semantic information of the application layer, so as to ensure the applicability of encrypted traffic in actual deployment. (2.5) Verify the multi-dimensional attack parameters to ensure the high robustness and discriminative consistency of the extracted features under different QDA attack variants, so that they have strong generalization ability and deployment reliability in the actual network environment.

4. The method for detecting denial-of-service attacks based on the QUIC protocol in a backbone network according to claim 1, characterized in that, In step (3), all QDA attack traffic originates from a specific source IP address preset in the experimental topology. The feature data is labeled by the source IP address: if the IP address of a certain flow matches the known attack IP list, it is marked as attack traffic; otherwise, it is regarded as background traffic and uniformly labeled as normal category.

5. A method for detecting denial-of-service attacks based on the QUIC protocol in a backbone network according to claim 1, characterized in that, In step (4), a machine learning algorithm with high robustness and adaptability is used to model the extracted feature data. The selected algorithm must ensure high classification accuracy while taking into account the computational efficiency required for online deployment and the generalization ability when facing unknown attack variants, and effectively suppress model overfitting. After comprehensive evaluation of various mainstream algorithms in the actual network environment, random forest is finally adopted as the core learning engine to build an efficient and scalable QDA attack intelligent identification model.

6. The method for detecting denial-of-service attacks based on the QUIC protocol in a backbone network according to claim 1, characterized in that, Step (5) specifically includes the following sub-steps: (5.1) The acquisition system deployed at key nodes of the backbone network uses unidirectional network flow as the basic acquisition unit, which is in line with the actual deployment scenarios of traffic mirroring or bypass monitoring in the backbone network, avoids dependence on bidirectional session reassembly, and improves acquisition efficiency and deployment flexibility. (5.2) In response to the scale of backbone network traffic, the acquisition system implements an extreme simplification strategy for the original packet payload during the packet capture stage—only the first byte is retained, and the rest of the content is discarded immediately. This significantly reduces storage and processing overhead while still effectively distinguishing between long and short packet types, providing key metadata for subsequent attack feature extraction. (5.2) All collected stream records strictly follow the unified data format specifications defined in step (1.1) to ensure seamless integration with subsequent analysis modules and lay a data consistency foundation for QDA detection.

7. The method for detecting denial-of-service attacks under the QDA protocol in a backbone network according to claim 1, characterized in that, Step (6) specifically includes the following sub-steps: (6.1) The QDA attack detection model has been built during the training phase; during the detection phase, the feature data extracted in real time is input into the model for prediction, and the model output results are summarized to assign the corresponding category label to the current traffic sample, thereby achieving effective identification of QDA attacks. (6.2) Implement differentiated response strategies based on the actual prediction results of the model: if the traffic is determined to be normal, it is allowed to pass; if it is identified as attack traffic, an alarm mechanism is triggered to notify network operation and maintenance personnel in a timely manner; in addition, since the IP of the feature data comes from the specific source IP address preset in the laboratory environment, the system can selectively output the corresponding attack source IP address according to the actual defense needs, providing supporting information for subsequent implementation of active defense measures such as blocking and traffic limiting.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements a method for detecting denial-of-service attacks under the QDA protocol in a backbone network as described in any one of claims 1 to 7.

9. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, the computer instructions implement a method for detecting denial-of-service attacks under the QDA protocol in a backbone network as described in any one of claims 1-7.

Images