A dual-flow robust DDoS covertness behavior detection method and related device

Abstract

The application relates to the technical field of network security, in particular to a double-flow robust DDoS cover behavior detection method and related equipment, which comprises the following steps: acquiring multi-source network security data and converting the same into standardized event records; dividing network flow data, extracting distribution statistical features and time dynamic features, and then screening a candidate feature set; inputting the distribution statistical features into an explicit cross network to generate distribution feature representation, and inputting the time dynamic features into a differential gate time sequence network to generate dynamic feature representation; adaptively weighting and fusing the two kinds of feature representations to obtain fused feature representation; inputting the fused feature representation into a classifier to output a DDoS attack detection probability, and combining multi-dimensional associated security events to calculate an APT stage association score, and outputting a detection category, an associated attack stage and an evidence timeline. The application can effectively distinguish between ordinary DDoS attacks and APT cover type DDoS attacks, and improve detection accuracy and robustness.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a dual-stream robust DDoS cover behavior detection method and related equipment. Background Technology

[0002] Distributed Denial-of-Service (DDoS) attacks control a large number of distributed nodes to send massive amounts of requests to a target server, consuming the target's network bandwidth and computing resources, thus preventing legitimate users from accessing services. Due to their low barrier to entry and significant destructive effects, DDoS attacks have become one of the major security threats facing the internet today. With the evolution of network infrastructure, DDoS attacks are showing trends of increasing traffic volume, diversified attack methods, and more precise targeting.

[0003] In Advanced Persistent Threat (APT) attack scenarios, attackers are increasingly using DDoS attacks as a cover. Specifically, while performing core attack actions such as data theft, malware implantation, and privilege escalation, attackers launch large-scale DDoS attacks to overwhelm the alert traffic of the security operations center, diverting the attention of security analysts and thus concealing their true attack intent and lateral movement trajectory. These cover-up DDoS attacks often exhibit characteristics such as traffic patterns similar to normal bursts of traffic, attack duration synchronizing with critical APT operation windows, and overlapping attack sources with normal business sources. This makes it difficult for traditional DDoS detection methods to distinguish them from legitimate bursts of traffic or ordinary DDoS attacks. Summary of the Invention

[0004] In view of this, embodiments of this application propose a dual-stream robust DDoS cover behavior detection method and related equipment, aiming to accurately distinguish between ordinary DDoS attacks and APT cover-up DDoS attacks.

[0005] On one hand, embodiments of this application provide a dual-stream robust DDoS cover behavior detection method, the method comprising the following steps: Acquire multi-source network security data and convert the multi-source network security data into standardized event logs. The multi-source network security data includes network traffic data. The network traffic data is segmented according to a preset time window, and distribution statistical features and time dynamic features are extracted; the distribution statistical features and time dynamic features are screened based on a multi-index evaluation method to obtain a candidate feature set; The distribution statistical features in the candidate feature set are input into an explicit cross-connect network to generate a distribution feature representation; the temporal dynamic features of multiple consecutive time windows are combined into a dynamic feature sequence and input into a differentially gated temporal network to generate a dynamic feature representation. The distributed feature representation and the dynamic feature representation are fused to obtain a joint feature vector; the joint feature vector is processed by a bottleneck attention network to generate an adaptive weight vector; the joint feature vector is weighted based on the adaptive weight vector, and the weighted result is superimposed on the joint feature vector to obtain a fused feature representation; The fused feature representation is input into the classifier, which outputs the DDoS attack detection probability. Based on the multidimensional correlation between the DDoS behavior and associated security events corresponding to the DDoS attack detection probability, the APT stage correlation score is calculated. Then, based on the APT stage correlation score and the DDoS attack detection probability, the detection category, associated attack stage, and evidence timeline are identified and output.

[0006] Optionally, the step of acquiring multi-source network security data and uniformly converting the multi-source network security data into standardized event records includes: Collect multi-source network security data, including network traffic mirroring data, NetFlow flow records, WAF alarms, IDS alarms, host process logs, file operation logs, authentication logs, asset ledgers, and threat intelligence data; The multi-source network security data is uniformly converted into event logs, which include event number, occurrence time, involved entities, event type, corresponding APT attack stage, confidence level, data source, and extended attributes.

[0007] Optionally, the step of segmenting the network traffic data according to a preset time window and extracting distribution statistical features and temporal dynamic features includes: The timestamps generated by different devices are uniformly converted, and IP addresses, domain names, hosts, users, processes, and file hashes are normalized and mapped to unified entity identifiers. The raw network traffic is divided according to the basic time window, and each basic time window is further divided into multiple time sub-slices; For each basic time window, based on the network traffic data within that basic time window, the source IP address entropy, destination IP address entropy, source port entropy, destination port entropy, mean packet size, standard deviation of packet size, uplink / downlink traffic ratio, request method ratio, status code distribution, number of connections, number of concurrent sessions, as well as the moving average and change of the above features, are extracted as distribution statistical features. For each time segment, traffic rate, rate variation coefficient, and rate acceleration are extracted from the network traffic data within each time segment as time dynamic features. The traffic rate is the ratio of the number of packets in each time segment to the current time window length, the rate variation coefficient is the ratio of the standard deviation to the mean of the packet rate in each time segment, and the rate acceleration is the average value of the traffic rate differences between adjacent time segments.

[0008] Optionally, the multi-index evaluation method is used to filter the distribution statistical features and the time dynamic features to obtain a candidate feature set, including: For each candidate feature, calculate the cross-protocol conditional mutual information, the difference in optimal transmission distribution, and the time fluctuation penalty factor, and then construct an index vector. The index vector is standardized, the covariance matrix is ​​calculated based on the index vectors of all candidate features, and an ideal discriminant vector is established. Calculate the Mahalanobis distance between the candidate features and the ideal discriminant vector, calculate the candidate feature score based on the Mahalanobis distance, sort the candidate features from high to low, and select the top K candidate features as the candidate feature set.

[0009] Optionally, the step of inputting the distribution statistical features from the candidate feature set into an explicit cross-network to generate a distribution feature representation includes: The filtered distribution statistics features are input into the first layer of the explicit cross network. The input features are linearly transformed by the trainable weight matrix. The transformation result is multiplied element-wise with the original input features. The result of the element-wise multiplication is then added to the original input features to obtain the output features of the first layer. For each layer after the first layer in the explicit cross-network, the product of the trainable weight matrix and the output feature of the previous layer is added to the trainable bias to obtain the linear transformation result. The original distribution statistical features are multiplied element-wise with the linear transformation result and added to the output feature of the previous layer to obtain the output feature of the current layer. This process is repeated layer by layer until the last layer, and the output feature of the last layer is used as the distribution feature representation.

[0010] Optionally, the step of assembling a dynamic feature sequence from the temporal dynamic features of multiple consecutive time windows and inputting it into a differentially gated temporal network to generate a dynamic feature representation includes: Calculate the difference features for the dynamic features of adjacent time windows; The differential gate is calculated based on the current differential characteristics and the hidden state at the previous time step. The differential gate is used to enhance local flow change information and suppress stable background flow. The update gate and reset gate are calculated based on the current input features and the hidden state of the previous time step. The hidden state of the previous time step is reset according to the reset gate. The reset hidden state of the previous time step is fused with the current input features to calculate the candidate hidden state. The previous hidden state and the candidate hidden state are weighted and fused according to the update gate to update the current hidden state, and the current hidden state is used as a dynamic feature representation.

[0011] Optionally, the step of fusing the distributed feature representation and the dynamic feature representation to obtain a joint feature vector; processing the joint feature vector through a bottleneck attention network to generate an adaptive weight vector; weighting the joint feature vector based on the adaptive weight vector, and superimposing the weighted result with the joint feature vector to obtain a fused feature representation includes: Random inactivation is performed by applying a first drop-off rate to the distribution feature representation and a second drop-off rate to the dynamic feature representation. The inactivated distribution feature representation and the inactivated dynamic feature representation are then fused into a joint feature vector. The first drop-off rate is greater than the second drop-off rate. The joint feature vector is subjected to dimensionality reduction, nonlinear activation, and dimensionality increase through a bottleneck attention network to generate an adaptive weight vector. The adaptive weight vector is multiplied element-wise with the joint feature vector, and then added to the joint feature vector to obtain the fused feature representation.

[0012] Optionally, the step of calculating the APT phase correlation score based on the multidimensional correlation between the DDoS behavior corresponding to the DDoS attack detection probability and the associated security events, and then identifying and outputting the detection category, associated attack phase, and evidence timeline based on the APT phase correlation score and the DDoS attack detection probability, includes: Retrieve host alarms, process behaviors, authentication, network connections, asset information, and threat intelligence within a preset time range before and after the DDoS attack detection probability occurs, and use them as associated security events; Based on the retrieved associated security events, the temporal proximity, entity overlap, and attack phase consistency between the associated security events and the DDoS behavior are calculated respectively. The threat intelligence credibility corresponding to the associated security events is obtained, and then the APT phase association score is calculated based on the temporal proximity, entity overlap, attack phase consistency, and threat intelligence credibility. Based on the APT phase correlation score and the DDoS attack detection probability, identify and output the detection category of normal traffic, legitimate sudden events, ordinary DDoS attacks, or suspected APT cover-up DDoS attacks, and output the associated attack phase and evidence timeline of the DDoS attack.

[0013] On the other hand, embodiments of this application also provide a dual-stream robust DDoS cover behavior detection device, including: The data acquisition module is used to acquire multi-source network security data and convert the multi-source network security data into standardized event records. The multi-source network security data includes network traffic data. The feature filtering module is used to segment the network traffic data according to a preset time window, extract distribution statistical features and time dynamic features; and filter the distribution statistical features and time dynamic features based on a multi-index evaluation method to obtain a candidate feature set. The feature mapping module is used to input the distribution statistical features in the candidate feature set into an explicit cross-connect network to generate a distribution feature representation; and to combine the temporal dynamic features of multiple consecutive time windows into a dynamic feature sequence and input it into a differentially gated temporal network to generate a dynamic feature representation. An attention fusion module is used to fuse the distributed feature representation and the dynamic feature representation to obtain a joint feature vector; process the joint feature vector through a bottleneck attention network to generate an adaptive weight vector; weight the joint feature vector based on the adaptive weight vector, and superimpose the weighted result with the joint feature vector to obtain a fused feature representation; The detection output module is used to input the fused feature representation into the classifier and output the DDoS attack detection probability; calculate the APT stage correlation score based on the multidimensional correlation between the DDoS behavior and the associated security events corresponding to the DDoS attack detection probability; and then identify and output the detection category, associated attack stage, and evidence timeline based on the APT stage correlation score and the DDoS attack detection probability.

[0014] On the other hand, embodiments of this application also provide an electronic device, including: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described in any of the preceding statements.

[0015] On the other hand, embodiments of this application also provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the methods described above.

[0016] The dual-stream robust DDoS cover behavior detection method and related equipment described in this application have the following beneficial effects: This application effectively solves the information blind spot problem caused by the single data source in traditional DDoS detection by standardizing access and unified preprocessing of multi-source heterogeneous security data; it fully explores the complementarity of the two types of features in describing DDoS behavior by using a dual-stream parallel coding architecture to specifically model distributional statistical features and temporal dynamic features, significantly improving the model's coverage of diverse DDoS attack patterns; it enhances the interpretability and generalization ability of the model to unknown attack variants by explicitly modeling high-order combination relationships of features through explicit cross-networks; it enhances the sensitivity to local traffic changes and suppresses interference from stable background traffic by using differentially gated temporal networks, effectively improving the detection sensitivity to covert DDoS attacks; and it comprehensively evaluates features from three dimensions—information relevance, category separability, and temporal stability—through multi-index feature screening. The model improves detection robustness by retaining strong discriminative information while avoiding the negative impacts of redundant and unstable features. It employs a bottleneck attention network to adaptively weight and fuse dual-stream features, enabling the model to dynamically adjust feature contribution weights based on input samples, thus enhancing its adaptability under different attack scenarios. Furthermore, the APT stage correlation analysis mechanism performs multi-dimensional correlation reasoning between DDoS detection events and multi-source security events, overcoming the limitations of traditional isolated binary classification. This allows for a leap from single traffic anomalies to APT kill chain contextual reasoning, effectively distinguishing between ordinary DDoS attacks and APT covert DDoS attacks. It outputs detection categories, correlated attack stages, and evidence timelines, providing actionable contextual information for security operations personnel and significantly improving the response efficiency and handling accuracy of security incidents. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic flowchart of a dual-stream robust DDoS cover behavior detection method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating the overall process of dual-stream robust DDoS cover behavior detection provided in an embodiment of this application. Figure 3 This is a structural diagram of the dual-stream sensing detection model based on distribution statistical features and temporal dynamic features provided in the embodiments of this application; Figure 4 This is a schematic diagram of dynamic traffic characteristic calculation based on time windows and time sub-slices provided in an embodiment of this application; Figure 5This is a diagram of the dynamic traffic feature mapping network structure based on differential gating mechanism provided in the embodiments of this application; Figure 6 This is a structural block diagram of a dual-stream robust DDoS cover behavior detection device provided in an embodiment of this application; Figure 7 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] It should be noted that although the device diagram shows a modular division and the flowchart illustrates a logical order, in some cases, the steps shown or described may be performed in a different order than the modular division in the device or the order shown in the flowchart. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0021] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0022] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0023] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily need to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0024] First, let's analyze some of the terms used in this application: Multi-scale time window: This refers to a method of dividing continuous network traffic data into time slices of different lengths during network traffic analysis. By setting multiple time scales (such as 1 second, 5 seconds, 30 seconds, 5 minutes, etc.), traffic characteristics at different granularities can be captured, reflecting both instantaneous traffic fluctuations and long-term traffic trends, thereby enhancing the ability to identify various attack behaviors.

[0025] Flow distribution statistical features refer to the characteristic quantities extracted from network traffic data that reflect the statistical distribution patterns of traffic, including but not limited to the distribution of traffic bytes, packet length, protocol type, source / destination IP address, port, and traffic rate. These features describe the spatial distribution characteristics of traffic using statistical methods and are used to characterize the static patterns of network traffic.

[0026] Temporal dynamic features refer to the characteristic quantities extracted from network traffic data that reflect the changes in traffic over time, including but not limited to traffic rate change trends, packet arrival time interval sequences, traffic autocorrelation, periodic patterns, and abrupt change detection. These features describe the dynamic evolution characteristics of traffic through time series analysis methods and are used to characterize the temporal behavior of network traffic.

[0027] Mahalanobis distance is a distance metric that considers the correlation between features. By weighting features using the covariance matrix, Mahalanobis distance can eliminate the influence of feature dimensions and correlation, and more accurately measure the deviation of sample points from the distribution center. In this application, Mahalanobis distance is used to construct a multi-index feature scoring model to comprehensively evaluate the discriminative power of candidate features.

[0028] Cross-protocol conditional mutual information (CPME) refers to the amount of mutual information between different network protocols (such as TCP, UDP, ICMP, etc.) under conditional constraints. Mutual information is used to measure the degree of interdependence between two random variables, while conditional mutual information calculates the remaining uncertainty given certain known information. In this application, this metric is used to evaluate the discriminative contribution of candidate features to attack behavior in cross-protocol scenarios.

[0029] Explicit Cross Network: A deep learning network architecture that models high-order interactions between features by explicitly constructing feature cross terms. Unlike implicit feature crosses, explicit cross networks directly introduce product or combination terms of features into the network layers, enabling the model to explicitly learn cross effects between features and enhancing its ability to express complex patterns (such as nonlinear correlations in traffic distribution statistics).

[0030] Differential Gated Temporal Network (GTN): An improved recurrent neural network architecture that introduces differential operations on top of traditional gating mechanisms (such as LSTM or GRU) to enhance sensitivity to the rate of change of time-series data. Through differential gating, the network can better capture abrupt changes and trend variations in the dynamic characteristics of traffic over time, improving the detection sensitivity to time-series attacks.

[0031] Asymmetric Attention Fusion: An attention-driven feature fusion method that achieves adaptive fusion of heterogeneous features by assigning asymmetric attention weights to features from different sources (such as statistical distribution features and temporal dynamic features). The asymmetry lies in assigning different levels of attention to different feature sources, enabling the model to dynamically adjust the fusion strategy based on the current input, highlighting features more important to the detection task.

[0032] APT (Advanced Persistent Threat): refers to cyberattacks characterized by clear targets, long duration, strong concealment, and complex attack phases.

[0033] DDoS (Distributed Denial of Service): This attack involves multiple sources simultaneously sending a large number of requests to a target, exhausting the target's bandwidth and computing resources, and causing the service to become unavailable.

[0034] DDoS Covert Behavior: This refers to the deliberate launch of a Distributed Denial-of-Service (DDoS) attack by an Advanced Persistent Threat (APT) attacker before or simultaneously with their core attack objectives (such as data theft or system disruption) to distract defenders, deplete security resources, and conceal their true attack intentions. Such DDoS attacks often share characteristics with normal traffic or ordinary DDoS attacks, but their true purpose is to provide cover for the APT attack.

[0035] APT Stage Association Score: A quantitative metric used to assess the correlation between detected DDoS behavior and different stages in the APT attack chain (such as initial intrusion, privilege escalation, lateral movement, data theft, etc.). This score comprehensively considers multiple dimensions, including temporal proximity (the closeness of time between DDoS behavior and APT alerts), entity overlap (the degree of overlap of involved IP addresses, hosts, users, etc.), attack stage consistency (the degree of matching with known APT attack stages), and threat intelligence credibility (the degree of support from external threat intelligence).

[0036] Host Alert: Security alerts generated by security devices or software deployed on the host (such as Host Intrusion Detection System (HIDS), Endpoint Detection and Response (EDR), etc.), including but not limited to file tampering alerts, abnormal process alerts, suspicious registry modification alerts, malware detection alerts, etc.

[0037] Process behavior refers to the activity record of running processes in the operating system, including behavioral information such as process creation, termination, memory access, file operations, network connections, and system call sequences, which is used to analyze whether there is malicious process activity.

[0038] Identity authentication refers to the process of verifying the identity of a user or system entity, including log information of activities such as login authentication, permission verification, multi-factor authentication, and single sign-on, which is used to detect whether there is identity impersonation or permission abuse.

[0039] Threat intelligence refers to evidence-based knowledge about existing or emerging threats, including attacker tactics, techniques and procedures (TTPs), attack indicators (IOCs), vulnerability information, malware characteristics, etc., which are external intelligence data used to assist security decisions and threat assessment.

[0040] Evidence Timeline: This refers to a visual time sequence formed by arranging and correlating various detected security events (such as DDoS attacks, host alarms, process anomalies, authentication anomalies, etc.) in chronological order. The evidence timeline can intuitively show the order of occurrence, duration, and interrelationships of attack events, providing security analysts with complete evidence for attack process reconstruction and forensic investigation.

[0041] Legitimate Burst Events: These are network events caused by normal business activities, resulting in a rapid increase in traffic within a short period. Examples include surges in traffic due to promotional activities, traffic spikes caused by trending news, and traffic bursts generated by scheduled data backups. While these events may resemble DDoS attacks in terms of traffic characteristics, their origin and purpose are legitimate, and they do not constitute a security threat.

[0042] Conventional DDoS attacks are distributed denial-of-service attacks primarily aimed at disrupting service availability. Attackers control a large number of botnets to send massive amounts of requests to the target system, exhausting its bandwidth, computing resources, or connection limits, thus preventing legitimate users from accessing the service. These attacks do not involve the covert intentions of APT attacks; their target is singular and direct.

[0043] Suspected APT-covert DDoS Attack: This refers to a DDoS attack that, after detection and analysis, is suspected to have a true purpose that is not simply to disrupt service availability, but rather to provide cover for other stages of an APT attack (such as data theft or system penetration). Such attacks may exhibit similar traffic characteristics to ordinary DDoS attacks, but APT stage correlation analysis can reveal a high degree of correlation with the APT attack chain.

[0044] In related technologies, DDoS attack detection typically employs methods based on traffic thresholds, statistical anomalies, or machine learning. Traffic threshold-based methods trigger alarms by setting fixed bandwidth or connection thresholds, making them ill-suited to dynamic changes in network traffic, resulting in high false positive and false negative rates. Statistical anomaly-based methods detect DDoS attacks by analyzing deviations in traffic distribution, but lack sensitivity to slowly changing, covert DDoS attacks. While machine learning methods can learn complex traffic patterns, most existing solutions rely on single-type features, failing to fully exploit the complementarity between statistical distribution features and temporal dynamic features in describing DDoS behavior. Furthermore, existing methods often treat DDoS detection as an isolated binary classification problem, lacking the ability to perform contextual analysis of detected DDoS events with other security events in the network, thus failing to identify whether a DDoS attack serves as a continuation of a larger-scale APT attack.

[0045] To overcome the technical problems in related technologies, this application proposes a dual-stream robust DDoS cover-up behavior detection method and related equipment. By constructing a dual-stream parallel coding architecture of distributed statistical feature stream and temporal dynamic feature stream, and combining multi-index feature screening, adaptive attention fusion and APT stage correlation analysis mechanism, it can accurately distinguish between ordinary DDoS attacks and APT cover-up DDoS attacks.

[0046] like Figure 1 As shown, Figure 1 A dual-stream robust DDoS cover behavior detection method provided in this application embodiment includes the following steps: S100, acquire multi-source network security data, and convert the multi-source network security data into standardized event records. The multi-source network security data includes network traffic data. S200: The network traffic data is segmented according to a preset time window, and distribution statistical features and time dynamic features are extracted; the distribution statistical features and time dynamic features are screened based on a multi-index evaluation method to obtain a candidate feature set; S300, input the distribution statistical features in the candidate feature set into an explicit cross-connect network to generate a distribution feature representation; combine the time dynamic features of multiple consecutive time windows into a dynamic feature sequence and input it into a differentially gated temporal network to generate a dynamic feature representation; S400, the distributed feature representation and the dynamic feature representation are fused to obtain a joint feature vector; the joint feature vector is processed by a bottleneck attention network to generate an adaptive weight vector; the joint feature vector is weighted based on the adaptive weight vector, and the weighted result is superimposed on the joint feature vector to obtain a fused feature representation; S500, the fused feature representation is input into the classifier, and the DDoS attack detection probability is output; the APT stage correlation score is calculated based on the multidimensional correlation between the DDoS behavior and the associated security events corresponding to the DDoS attack detection probability, and then the detection category, associated attack stage and evidence timeline are identified and output based on the APT stage correlation score and the DDoS attack detection probability.

[0047] This application proposes a dual-stream robust DDoS cover behavior detection method and related equipment. It acquires multi-source network security data and uniformly converts it into standardized event logs, compatible with multi-source heterogeneous data access including network traffic mirroring data, NetFlow stream records, WAF alarms, IDS alarms, host process logs, file operation logs, authentication logs, asset ledgers, and threat intelligence data. This lays a data foundation for subsequent dual-stream feature coding and APT correlation analysis. By segmenting network traffic data according to a preset time window and extracting distributional statistical features and temporal dynamic features, a candidate feature set is obtained through screening based on a multi-index evaluation method. This achieves adaptive quality assessment and dimensionality reduction selection of high-dimensional heterogeneous features. Furthermore, by inputting the distributional statistical features into an explicit cross-network to learn higher-order combinatorial relationships... The system generates distributed feature representations by inputting a dynamic feature sequence composed of temporal dynamic features into a differentially gated temporal network to enhance local traffic change information and generate dynamic feature representations. A dual-stream parallel coding architecture is constructed to fully exploit the complementarity of the two types of features in describing DDoS behavior. A bottleneck attention network is used to process the joint feature vector and generate an adaptive weight vector. The joint feature vector is then weighted and superimposed with the original joint feature vector to achieve adaptive weighted fusion of dual-stream features. By inputting the fused feature representation into a classifier to output the DDoS attack detection probability, and combining it with multi-dimensional associated security events to calculate the APT stage association score, the system breaks through the limitation of traditional DDoS detection performing isolated binary classification, and realizes the leap from single traffic anomaly to APT kill chain context inference.

[0048] refer to Figure 2 This application generally includes a multi-source data access module, a time synchronization and entity normalization module, a multi-scale traffic window construction module, a candidate feature extraction module, a multi-index feature screening module based on Mahalanobis distance, a distributed feature mapping module, a dynamic feature mapping module, an asymmetric attention fusion module, a DDoS basic classification module, an APT stage association module, an evidence interpretation and response module, and a model training and update module.

[0049] The data processing flow of this application is as follows: First, collect network traffic, network security alerts, host behavior logs, identity authentication logs, asset information, and threat intelligence; Second, synchronize traffic and security events in time and normalize entities according to a preset time window; Third, extract traffic distribution statistical features and temporal dynamic features; Fourth, select key traffic features using a multi-index feature scoring method based on Mahalanobis distance; Fifth, learn distribution statistical features and temporal dynamic features using explicit cross-networks and differentially gated temporal networks respectively; Sixth, complete dual-stream feature fusion through a bottleneck attention network and output the DDoS detection probability; Seventh, calculate the APT stage correlation score based on the time, entity, attack stage, and threat intelligence relationship between DDoS behavior and other security events; Eighth, output the detection category, associated attack stage, and evidence timeline.

[0050] In some embodiments, acquiring multi-source network security data and uniformly converting the multi-source network security data into standardized event records includes: S110 collects multi-source network security data, including network traffic mirroring data, NetFlow flow records, WAF alarms, IDS alarms, host process logs, file operation logs, authentication logs, asset ledgers, and threat intelligence data. S120, the multi-source network security data is uniformly converted into event records, which include event number, occurrence time, involved entities, event type, corresponding APT attack stage, confidence level, data source and extended attributes.

[0051] Specifically, network traffic mirroring data is collected through traffic acquisition probes deployed at key network nodes; NetFlow flow records are obtained through NetFlow / sFlow collectors; WAF alarm data is obtained through Web Application Firewall (WAF) interfaces; IDS alarm data is obtained through Intrusion Detection System (IDS); host process logs and file operation logs are obtained through host EDR (Endpoint Detection and Response) agents; authentication logs are obtained through the Identity and Access Management (IAM) system; asset ledger data is obtained through the Configuration Management Database (CMDB); and threat intelligence data is obtained through the Threat Intelligence Platform (TIP) using the STIX / TAXII protocol. For the collected multi-source heterogeneous security data, each security event undergoes unified standardization processing, converting it into a standardized event record with a unified schema. The event record is represented as follows: The event log contains the following fields: Event Number Used to globally and uniquely identify the event; time of occurrence It adopts a unified timestamp format; it involves entities This includes source IP address, destination IP address, domain name, hostname, username, process identifier, and file hash value. All of these entities have been normalized and mapped to a unified entity identifier; event type. The data is labeled using a predefined classification system, corresponding to different stages of an APT attack. According to the MITRE ATT&CK framework or Kill Chain model, the APT attack phase to which this event belongs is identified, including reconnaissance, weaponization, delivery, exploitation, installation, command and control, and target achievement; confidence level. This indicates the probability that the event is a genuine security incident; data source: Identifies the data source type for this event; extended properties It is used to store extended information unique to each data source.

[0052] In this embodiment, by collecting multi-source heterogeneous security data and uniformly converting it into standardized event logs, subsequent dual-stream feature coding and APT correlation analysis can be performed based on a unified data format, effectively solving the analysis barrier problem caused by the heterogeneity of multi-source data. Compared with the traditional approach that relies on only a single network traffic data source, this embodiment makes full use of multi-dimensional data such as network traffic, host behavior, identity authentication, and threat intelligence, providing richer contextual information support for identifying APT-masked DDoS attacks.

[0053] refer to Figure 3 and Figure 4 In some embodiments, the step of segmenting the network traffic data according to a preset time window and extracting distribution statistical features and temporal dynamic features includes: S210 performs unified conversion on timestamps generated by different devices, and performs normalization processing on IP addresses, domain names, hosts, users, processes and file hashes and maps them to unified entity identifiers; S220 divides the raw network traffic according to the basic time window, and further divides each basic time window into multiple time sub-slices; S230, for each basic time window, extract source IP address entropy, destination IP address entropy, source port entropy, destination port entropy, mean packet size, standard deviation of packet size, uplink / downlink traffic ratio, request method ratio, status code distribution, number of connections, number of concurrent sessions, and the moving average and change of the above features based on the network traffic data within the basic time window, as distribution statistical features; S240, for each time segment, extract the traffic rate, rate variation coefficient, and rate acceleration based on the network traffic data within each time segment as time dynamic features, wherein the traffic rate is the ratio of the number of packets in each time segment to the current time window length, the rate variation coefficient is the ratio of the standard deviation to the mean of the packet rate in each time segment, and the rate acceleration is the average value of the traffic rate difference between adjacent time segments.

[0054] Specifically, firstly, a unified conversion is performed on event timestamps generated by different security devices, normalizing all timestamps to Coordinated Universal Time (UTC) to eliminate the impact of time zone differences on time series analysis, converting second-level, millisecond-level, or time zone-specific timestamps into a unified time format. IP addresses are anonymized or normalized, domain names are uniformly converted to lowercase and redundant subdomains are removed, hostnames are standardized according to naming conventions, user identifiers are mapped to unified user IDs, and process names and file hash values ​​are mapped to unified hash identifiers. Different representations of the same entity in different data sources are mapped to a unified entity identifier; for example, asset IDs, hostnames, and internal IP addresses are mapped to the same protected asset, and user accounts and login devices are mapped to corresponding user entities.

[0055] The raw network traffic is divided according to a preset basic time window. In this embodiment, the duration of the basic time window is set to... Furthermore, each basic time window is evenly divided into m time sub-slices. For each basic time window, distribution statistical features are extracted based on the network traffic data within that window, including: source IP address entropy (measuring the dispersion of source IP address distribution); destination IP address entropy (measuring the dispersion of destination IP address distribution); source port entropy (measuring the dispersion of source port distribution); destination port entropy (measuring the dispersion of destination port distribution); mean packet size (the arithmetic mean of the payload lengths of all packets within the window); standard deviation of packet size (the dispersion of packet payload lengths within the window); uplink / downlink traffic ratio (the ratio of uplink bytes to downlink bytes); request method ratio (the proportion of various HTTP request methods in the total requests); status code distribution (the frequency distribution of various HTTP status codes); number of connections (the total number of TCP / UDP connections established within the window); and session concurrency (the number of sessions simultaneously active within the window). In addition, the sliding average and changes of the above features between adjacent windows are calculated to capture the short-term evolution trend of the features.

[0056] For each time segment, dynamic temporal features are extracted based on the network traffic data within each time segment, including: traffic rate. Rate variation coefficient and velocity acceleration .

[0057] The flow rate is: .in, This represents the number of packets in the i-th time segment. Indicates the length of the current time window.

[0058] The rate variation coefficient is: .in, This represents the standard deviation of the packet rate for each time segment. This represents the average packet rate of each sub-segment at different times. A preset constant is used to prevent the denominator from being zero.

[0059] The velocity acceleration is: .

[0060] Temporal dynamic characteristics are used to describe the degree of fluctuation and local changes in traffic rates within a time window. Legitimate bursts are usually formed by real user access, and their local traffic fluctuations are more obvious; automated DDoS traffic usually exhibits relatively flat, periodic, or scripted sending characteristics.

[0061] In this embodiment, by segmenting the original network traffic according to a preset time window and simultaneously extracting distribution statistics and temporal dynamic features, subsequent dual-stream coding can specifically model the spatial distribution distortions and temporal evolution patterns of the traffic, respectively. Distribution statistics can effectively characterize spatial distribution distortions caused by DDoS attacks, such as source address aggregation, port scanning, and abnormal packet sizes; temporal dynamic features can accurately capture temporal evolution patterns such as sudden changes in traffic rate and persistent congestion patterns. The parallel extraction of these two types of features lays the data foundation for dual-stream fusion detection.

[0062] In some embodiments, the selection of candidate feature set by filtering the distribution statistical features and the time dynamic features based on the multi-index evaluation method includes: S250: For each candidate feature, calculate the cross-protocol conditional mutual information, the difference in optimal transmission distribution, and the time fluctuation penalty factor to construct an index vector. S260, Standardize the index vector, calculate the covariance matrix based on the index vectors of all candidate features, and establish an ideal discriminant vector; S270, calculate the Mahalanobis distance between the candidate features and the ideal discriminant vector, calculate the candidate feature score based on the Mahalanobis distance, sort the candidate features from high to low, and select the top K candidate features as the candidate feature set.

[0063] Specifically, for each candidate feature Three evaluation metrics were calculated and a metric vector was constructed. The first metric, Cross-Protocol Conditional Mutual Information (CPCMI), measures the conditional dependency between candidate features and attack labels. It also considers redundant information provided by other features, calculates the mutual information between feature variables and label variables, and subtracts the remaining mutual information under known conditions of other features to obtain the independent information contribution of the feature after removing redundancy. This is used to evaluate the degree of information correlation between candidate features and attack categories after controlling for the influence of protocol type. The second metric, Optimal Transmission Distribution Difference (OTDD), is based on optimal transmission theory and uses a one-dimensional Wasserstein distance to measure the distribution difference between attack traffic and normal traffic on candidate features. The larger the distribution difference, the stronger the feature's ability to distinguish between attack traffic and normal traffic. The third metric, Time Fluctuation Penalty Factor (TFPF), is used to suppress candidate features that frequently exhibit unstable changes in normal background traffic, preventing the model from incorrectly learning the random fluctuations of normal traffic as attack features.

[0064] Construct an index vector for the i-th candidate feature: .

[0065] The index vectors are standardized, and the covariance matrix is ​​calculated based on the index vectors of all candidate features. And establish the ideal discriminant vector. The Mahalanobis distance between the candidate feature and the ideal discriminant vector is: .in, The regularization coefficient is . It is the identity matrix, used to prevent the covariance matrix from being non-invertible.

[0066] The final score for the candidate features is: .

[0067] according to The features are sorted from highest to lowest, and the top K candidate features are selected as input to the dual-stream detection model.

[0068] In this embodiment, a multi-index feature selection method based on Mahalanobis distance is used to comprehensively consider three dimensions: cross-protocol conditional mutual information, optimal transmission distribution difference, and time fluctuation penalty factor. The feature quality is comprehensively evaluated from three perspectives: information relevance, class separability, and time stability. The selected candidate feature set retains strong discriminative information and avoids the negative impact of redundant and unstable features on model training, thereby improving the robustness of detection.

[0069] In some embodiments, the step of inputting the distribution statistical features from the candidate feature set into an explicit cross-network to generate a distribution feature representation includes: S310: Input the filtered distribution statistics features into the first layer of the explicit cross network, perform a linear transformation on the input features through the trainable weight matrix, multiply the transformation result with the original input features element by element, and then add the result of the element-wise multiplication with the original input features to obtain the output features of the first layer. S320, for each layer after the first layer in the explicit cross-network, the product of the trainable weight matrix and the output feature of the previous layer is added to the trainable bias to obtain the linear transformation result. The original distribution statistical features are multiplied element-wise with the linear transformation result and added to the output feature of the previous layer to obtain the output feature of the current layer. This process is repeated layer by layer until the last layer, and the output feature of the last layer is used as the distribution feature representation.

[0070] Specifically, the filtered distributional statistical features are used as the original input features, denoted as... The original input features are input into the first layer of the explicit cross-connect network, where a trainable weight matrix is ​​used. Perform a linear transformation on the input features to obtain the transformed result; then compare the transformed result with the original input features. Perform element-wise multiplication, and then combine the result of the element-wise multiplication with the original input features. Add them together to obtain the first layer output features. For each layer after the first layer in the explicit cross-connect network (the... layer, ), will trainable weight matrix Compared with the output features of the previous layer The product plus the trainable bias The linear transformation result is obtained, which transforms the original distribution statistical characteristics. Perform element-wise multiplication with the linear transformation result and with the output features of the previous layer. Add them together to obtain the output features of the current layer. The formula for calculating each layer is as follows: Where ⊙ represents element-wise multiplication and · represents matrix multiplication. The calculation is performed layer by layer until the last layer (the Lth layer) to obtain the distribution characteristic representation. In this embodiment, the number of layers L of the explicit cross-network is set to 4.

[0071] In this embodiment, the high-order combination relationship between the original features and the transformed features is explicitly modeled layer by layer through an explicit cross-network, which avoids the black box problem of feature interaction in traditional deep networks. This enables the model to learn combination features with clear physical meaning (such as the reflection amplification attack pattern indicated by "high source IP entropy and low destination port entropy"), thereby enhancing the interpretability of the model and its ability to generalize to unknown attack variants.

[0072] refer to Figure 5 In some embodiments, the step of assembling a dynamic feature sequence from the temporal dynamic features of multiple consecutive time windows and inputting it into a differentially gated temporal network to generate a dynamic feature representation includes: S330, calculates the difference features for the dynamic features of adjacent time windows; S340, calculate the differential gate based on the current differential features and the hidden state at the previous moment, and enhance the local flow change information and suppress the stable background flow based on the differential gate; S350, calculate update gate and reset gate based on current input features and previous hidden state, reset the previous hidden state based on reset gate, fuse the reset previous hidden state with current input features to calculate candidate hidden state; perform weighted fusion of previous hidden state and candidate hidden state based on update gate to update current hidden state, and use current hidden state as dynamic feature representation.

[0073] Specifically, firstly, the temporal dynamic features of k consecutive time windows are arranged in chronological order to form a dynamic feature sequence. Then, difference features are calculated for the dynamic features of adjacent time windows. The formula for calculating these difference features is as follows: .in, This represents the difference feature of the t-th time window. This represents the temporal dynamic characteristics of the t-th time window. This represents the temporal dynamic characteristics of the (t-1)th time window.

[0074] Based on the current difference characteristics Hidden state from the previous moment Computational differential gate The calculation formula for the differential gate is as follows: .in, This represents the Sigmoid activation function. This represents the weight matrix of the difference gate. [·,·] represents the bias vector of the differential gate, and [·,·] represents the vector concatenation operation.

[0075] Based on the differential gate enhancing local flow change information and suppressing stable background flow, the current input features are modulated using the differential gate to obtain differential enhanced features: When the differential threshold is close to 1, the model mainly focuses on differential features, that is, local flow change information is enhanced; when the differential threshold is close to 0, the model mainly focuses on original input features, and stable background flow information is preserved but not excessively amplified.

[0076] Based on the current differential enhancement features Hidden state from the previous moment Computational update gate and reset door The calculation formulas for the update door and the reset door are as follows: , .in, and These represent the weight matrices for the update gate and the reset gate, respectively. and These represent the corresponding bias vectors.

[0077] The previously hidden state is reset according to the reset gate: The reset hidden state from the previous time step is fused with the current input features to calculate the candidate hidden state. The formula for calculating the candidate hidden state is: .in, The weight matrix representing the candidate hidden state. This represents the corresponding bias vector. This represents the hyperbolic tangent activation function.

[0078] The current hidden state is updated by weighted fusion of the previous hidden state and the candidate hidden states according to the update gate. The update formula for the current hidden state is: Hide the state corresponding to the last time window. As a dynamic feature representation The output, the dynamic feature representation, encodes long-term dependencies and local change patterns in a time-dynamic feature sequence.

[0079] In this embodiment, a differential gate mechanism is introduced through a differentially gated time series network, enhancing the sensitivity to local traffic changes compared to the standard gated loop unit. The differential gate dynamically adjusts the information flow ratio based on the characteristic differences between adjacent time windows, effectively suppressing the interference of stable background traffic on time series modeling, and enabling the model to have higher detection sensitivity to covert DDoS attacks such as low-rate and pulsed attacks.

[0080] In some embodiments, the process of fusing the distributed feature representation and the dynamic feature representation to obtain a joint feature vector; processing the joint feature vector through a bottleneck attention network to generate an adaptive weight vector; weighting the joint feature vector based on the adaptive weight vector; and superimposing the weighted result with the joint feature vector to obtain a fused feature representation includes: S410, apply a first drop-off rate to the distribution feature representation to perform random deactivation, apply a second drop-off rate to the dynamic feature representation to perform random deactivation, and fuse the deactivated distribution feature representation and the deactivated dynamic feature representation into a joint feature vector; wherein the first drop-off rate is greater than the second drop-off rate; S420, the joint feature vector is subjected to dimensionality reduction, nonlinear activation and dimensionality increase processing through a bottleneck attention network to generate an adaptive weight vector; S430, the adaptive weight vector is multiplied element-wise with the joint feature vector, and then added to the joint feature vector to obtain the fused feature representation.

[0081] Specifically, the distribution characteristics are first represented as follows: and the dynamic feature representation Perform vector concatenation to obtain joint feature vectors. A first discard rate is set for the distribution characteristics. A second discard rate is set for the dynamic feature representation. ,in In this embodiment, the first drop rate is set to 0.3, and the second drop rate is set to 0.1. The reason for setting differentiated drop rates is that statistical distribution characteristics are easily manipulated by attackers. Attackers can make attack traffic statistically close to normal traffic by changing the source address, adjusting the packet size, or changing the request format. Dynamic characteristics such as rate fluctuations, rate changes, and transmission acceleration are constrained by the attack traffic generation mechanism and the effectiveness of the attack, making it difficult for attackers to arbitrarily modify them without reducing the attack's effectiveness. Therefore, applying a higher drop rate to the distribution characteristic branch reduces the model's reliance on easily manipulated statistical characteristics.

[0082] The joint feature vector is processed using a bottleneck attention network, which includes a dimensionality reduction layer, a nonlinear activation layer, and a dimensionality increase layer. First, the dimensionality reduction weight matrix... The joint feature vector is then subjected to dimensionality reduction. Next, a non-linear activation process is applied to the dimensionality-reduced features; in this embodiment, the ReLU activation function is used. Finally, the dimensionality-increasing weight matrix is ​​used... The activated features are then subjected to dimensionality upscaling, and the dimensionality-upscaling output is activated using Sigmoid activation to generate an adaptive recalibration vector. : .in, Each element takes a value in the range (0,1), representing the importance weight of the corresponding feature dimension.

[0083] The adaptive recalibration vector Element-wise multiplication with the joint feature vector h, and then addition with the joint feature vector h, yields the fused feature representation. : The fusion feature represents The residual connection mechanism preserves all the information of the original joint feature vector, while the adaptive recalibration vector... The key feature dimensions were enhanced, enabling adaptive weighted fusion of distributed feature representation and dynamic feature representation.

[0084] To reduce feature redundancy between two feature branches, orthogonal constraints are set: Where M is a learnable orthogonal constraint matrix, This represents the square of the Frobenius norm.

[0085] The total loss of the model is: .in, For classifying losses, For orthogonal constraint loss, For the APT phase associated auxiliary loss, and The corresponding loss weights.

[0086] In this embodiment, adaptive weighted fusion of dual-stream features is achieved by setting differentiated dropout rates for distributed feature representation and dynamic feature representation and generating adaptive weight vectors. This mechanism enables the model to dynamically adjust the contribution weights of the two types of features according to the characteristics of the input samples, emphasizing distributed statistical features for ordinary DDoS samples and emphasizing temporal dynamic features for covert DDoS samples, thereby improving the model's adaptability and adversarial robustness under different attack scenarios.

[0087] In some embodiments, the classifier consists of two fully connected layers and one output layer. The fully connected layers use the ReLU activation function, and the output layer uses the Sigmoid activation function. The step of inputting the fused feature representation into the classifier and outputting the DDoS attack detection probability includes: Represent the fusion features The input classifier has a first fully connected layer that maps the fused features to the hidden space, a second fully connected layer that further transforms the feature representation, and an output layer that outputs the DDoS attack detection probability p, where the probability p represents the confidence that the network traffic within the current time window belongs to a DDoS attack.

[0088] In some embodiments, the step of calculating an APT phase correlation score based on the multidimensional correlation between DDoS behavior and associated security events corresponding to the DDoS attack detection probability, and then identifying and outputting the detection category, associated attack phase, and evidence timeline based on the APT phase correlation score and the DDoS attack detection probability, includes: S510, retrieve host alarms, process behaviors, identity authentication, network connections, asset information and threat intelligence within a preset time range before and after the DDoS behavior corresponding to the DDoS attack detection probability, as associated security events; S520, based on the retrieved associated security events, calculate the temporal proximity between the associated security events and the DDoS behavior, the overlap of the entities involved, and the consistency of the corresponding APT attack phases, and obtain the threat intelligence credibility corresponding to the associated security events. Then, calculate the APT phase association score based on the temporal proximity, the overlap of entities, the consistency of the attack phases, and the credibility of the threat intelligence. S530, based on the APT stage correlation score and the DDoS attack detection probability, identify and output the detection category of normal traffic, legitimate sudden events, ordinary DDoS attacks or suspected APT cover-up DDoS attacks, and output the associated attack stages and evidence timeline of the DDoS attack.

[0089] Specifically, after obtaining the DDoS attack detection probability p, an APT phase correlation analysis is performed. First, focusing on the time point of the detected high-probability DDoS behavior, related security events within a preset time range before and after are retrieved. This preset time range is set according to the typical time span of an APT attack; in this embodiment, it is set to one hour before and after the DDoS behavior. The retrieved related security events include: host alarms, such as host intrusion detection alarms and malware alarms; process behaviors, such as abnormal process creation and process injection; authentication, such as abnormal logins and privilege escalation events; network connections, such as abnormal external connections and lateral movement connections; asset information, such as asset changes and vulnerability exposure information; and threat intelligence, such as IP reputation, domain reputation, and attack organization affiliation information.

[0090] Based on the retrieved associated security events, an APT phase association score is calculated, which is based on four dimensions of association indicators. The first dimension is time proximity, calculating the time difference between the associated event and the DDoS behavior. The time proximity score is calculated using an exponential decay function. .in, Indicates the time when the related event occurred. Indicates the detection time of DDoS attacks. The first dimension is the time decay constant; the smaller the time difference, the higher the time proximity score. The second dimension is entity overlap, which calculates the degree of overlap between the entities involved in the related event and the DDoS behavior, representing the sets of entities involved in both as follows: and The entity overlap score is calculated using Jaccard similarity: The higher the entity overlap, the greater the likelihood that the related events and DDoS attacks target the same network assets. The third dimension is attack phase consistency, which assesses the logical relationship between the APT attack phase of the related event and the DDoS attack within the kill chain. If the related event belongs to an attack phase logically adjacent to or coordinated with the DDoS cover-up, the attack phase consistency score is high; if the related event belongs to a phase with no logical connection to the DDoS attack, the score is low. The fourth dimension is threat intelligence credibility, which weights the threat intelligence indicators in the related events based on the reliability, timeliness, and confidence level of the threat intelligence source, resulting in a threat intelligence credibility score. We directly adopted the confidence score provided by the threat intelligence platform.

[0091] Based on the above four dimensions, the APT stage association score is calculated. : .in, , , , The weight coefficients for the four dimensions are respectively, satisfying... In this embodiment, , , , Set them to 0.25, 0.25, 0.3, and 0.2 respectively.

[0092] Based on the DDoS attack detection probability p and the APT phase correlation score The system comprehensively determines the detection category and APT cover behavior level, and outputs the associated attack phase, key features, and evidence timeline. The specific determination rules are as follows: If... and If the output detection category is normal traffic, then the output detection category is normal traffic. The first probability threshold, The first correlation score threshold; if and If the output detection category is "legitimate sudden event," it indicates that there is abnormal traffic but no evidence of APT association; if and If the output detection category is "ordinary DDoS attack", it indicates that a DDoS attack exists but there is insufficient evidence of APT association; if and The output detection category is "Suspected APT-covered DDoS attack," indicating a high probability of a DDoS attack and strong evidence of APT association. Simultaneously, based on... The numerical range outputs the corresponding APT cover behavior level. In this embodiment, Set to 0.7, Set to 0.3, Set it to 0.7.

[0093] Simultaneously, it outputs the associated attack phase, specifically the APT attack phase labeled with the associated event having the highest APT phase association score. It also outputs key features, based on the adaptive recalibration vector. The system uses weighted values ​​to select the highest-weighted feature dimensions as key features. It outputs an evidence timeline, sorting all retrieved related security events by their occurrence time to generate a chronologically arranged evidence timeline, providing security analysts with a complete view of the attack context.

[0094] In this embodiment, the APT phase correlation analysis mechanism overcomes the limitations of traditional DDoS detection's isolated binary classification. By performing multi-dimensional correlation analysis between detected DDoS events and multi-source security events, and calculating APT phase correlation scores, it achieves a leap from single traffic anomalies to contextual reasoning of the APT kill chain. This mechanism can effectively distinguish between ordinary DDoS attacks and APT cover-up DDoS attacks, providing security operators with actionable contextual information such as detection category, APT cover-up behavior level, associated attack phase, key characteristics, and evidence timeline, significantly improving the response efficiency and handling accuracy of security incidents.

[0095] The following are several specific embodiments provided in this application: Example 1: Data preprocessing and feature selection.

[0096] First, quantile truncation is performed on each numerical feature, setting values ​​below the 0.1% quantile to the 0.1% quantile and values ​​above the 99.9% quantile to the 99.9% quantile. Then, Z-score standardization is performed on the truncated features. For each candidate feature, cross-protocol conditional mutual information (CPCMI), optimal transport distribution difference (OTDD), and time fluctuation penalty factor (TFPF) are calculated, and a three-dimensional index vector is constructed.

[0097] The covariance matrix is ​​calculated based on the index vectors of all candidate features, by adding... To prevent the covariance matrix from becoming non-invertible, the Mahalanobis distance from each candidate feature to the ideal discriminant vector is calculated.

[0098] Sort the features by score from highest to lowest, and select Top-K features from both distribution features and dynamic features as inputs for the subsequent models.

[0099] Example 2: Two-stream model training.

[0100] The distribution statistics of the current time window are input into a two-layer explicit cross-connection network, and the flow rates of five consecutive time windows are used. Rate variation coefficient and velocity acceleration Input differential gating timing network.

[0101] Example setting distribution feature drop rate The dynamic feature discard rate is 0.5. The orthogonal constraint weight is 0.3. The value is 0.2. The model outputs the classification probabilities of normal traffic, legitimate burst events, and DDoS attacks. Training data is divided into training, validation, and test sets according to time or attack scenario to avoid the same traffic session appearing in both the training and test sets simultaneously.

[0102] Example 3: Correlation of APT cover behavior.

[0103] Suppose a protected server is to A DDoS candidate window appeared within the time frame, and the probability of a DDoS attack output by the dual-stream detection model was 0.96. Within 30 minutes before and after this time window, the system detected abnormal logins and new process execution events on the same server, and within 10 minutes of the DDoS attack occurring, it detected that the server was sending a large amount of data to an external address.

[0104] The system further discovered a correlation between the abnormal login source IP address and the malicious IP address in the threat intelligence. The system calculated the temporal proximity, entity overlap, attack phase consistency, and threat intelligence confidence to obtain the APT phase correlation score A(w).

[0105] When A(w) is greater than or equal to the high-risk threshold At that time, the DDoS candidate window is marked as a high-confidence APT-masked DDoS attack and associated with the execution, persistence, and data transfer phases.

[0106] If only a DDoS attack is detected, but no other APT phase evidence is found within a preset time range, then the candidate window is marked as a normal DDoS attack.

[0107] Example 4: Distinguishing between counter-disturbances and legitimate emergencies.

[0108] When attackers adjust the source IP address dispersion or packet size to reduce the detection confidence of the distributed feature branch, the dynamic feature branch can still maintain the detection results based on traffic rate, rate fluctuation and rate acceleration.

[0109] When promotional activities, trending news, or concentrated access lead to a rapid increase in the number of legitimate concurrent users, although the overall traffic volume is large, its time segments usually have more obvious high-frequency fluctuations, and the request sources and session behavior are consistent with the real user access patterns.

[0110] The system combines distribution and dynamic characteristics to identify this type of traffic as a legitimate burst event, avoiding false DDoS reports based solely on high traffic thresholds.

[0111] Compared with related technologies, this application has the following advantages: This application acquires multi-source network security data and converts it into standardized event logs, enabling access to multi-source heterogeneous data such as network traffic mirroring data, NetFlow stream records, WAF alarms, IDS alarms, host process logs, file operation logs, authentication logs, asset ledgers, and threat intelligence data. This effectively solves the information blind spot problem caused by the single data source in traditional DDoS detection and realizes standardized access and unified analysis and preprocessing of multi-source heterogeneous monitoring data.

[0112] This application constructs a dual-stream parallel coding architecture by segmenting network traffic data according to a preset time window and simultaneously extracting distribution statistical features and temporal dynamic features. This architecture fully leverages the complementarity of the two types of features in describing DDoS behavior. Distribution statistical features can effectively characterize the spatial distribution distortion caused by DDoS attacks, while temporal dynamic features can accurately capture the temporal evolution of traffic. Dual-stream fusion significantly improves the detection model's coverage of diverse DDoS attack patterns.

[0113] This application avoids the black-box problem of feature interaction in traditional deep networks by inputting distributional statistical features into an explicit cross-network to learn higher-order combinatorial relationships to generate distributional feature representations. This enables the model to learn combinatorial features with clear physical meaning, enhancing the model's interpretability and generalization ability to unknown attack variants.

[0114] This application introduces a differential gating time series network by inputting dynamic feature sequences composed of time dynamic features into the network. The differential gating mechanism enhances local traffic change information and suppresses stable background traffic, effectively solving the problem of insufficient sensitivity of traditional time series models to covert DDoS attacks. This makes the model more sensitive to covert attacks such as low-rate and pulse attacks.

[0115] This application adopts a multi-index feature screening method based on Mahalanobis distance, which comprehensively considers three dimensions: cross-protocol conditional mutual information, optimal transmission distribution difference, and time fluctuation penalty factor. It comprehensively evaluates feature quality from three perspectives: information relevance, class separability, and time stability. The selected candidate feature set not only retains strong discriminative information but also avoids the negative impact of redundant and unstable features on model training, thereby improving the robustness of detection.

[0116] This application uses an asymmetric attention fusion module to adaptively weight and fuse distributed feature representations and dynamic feature representations, sets differentiated dropout rates for the two types of features and generates adaptive recalibration vectors, and introduces orthogonal constraints to reduce the redundancy of dual-stream features. This enables the model to dynamically adjust the contribution weights of the two types of features according to the characteristics of the input samples. On ordinary DDoS samples, it emphasizes distributed statistical features, and on covert DDoS samples, it emphasizes temporal dynamic features, thereby improving the model's adaptability and adversarial robustness under different attack scenarios.

[0117] This application utilizes an APT phase correlation analysis mechanism to perform multi-dimensional correlation analysis between detected DDoS events and multiple sources of security events, including host alarms, process behavior, authentication, network connectivity, asset information, and threat intelligence. It calculates an APT phase correlation score, overcoming the limitations of traditional DDoS detection's isolated binary classification. This mechanism enables a leap from single traffic anomalies to APT kill chain contextual reasoning, effectively distinguishing between ordinary DDoS attacks and APT-masked DDoS attacks. It provides actionable contextual information for security operations personnel, significantly improving the response efficiency and handling accuracy of security incidents.

[0118] See Figure 6 This application provides a dual-stream robust DDoS cover behavior detection device, comprising: The data acquisition module is used to acquire multi-source network security data and convert the multi-source network security data into standardized event records. The multi-source network security data includes network traffic data. The feature filtering module is used to segment the network traffic data according to a preset time window, extract distribution statistical features and time dynamic features; and filter the distribution statistical features and time dynamic features based on a multi-index evaluation method to obtain a candidate feature set. The feature mapping module is used to input the distribution statistical features in the candidate feature set into an explicit cross-connect network to generate a distribution feature representation; and to combine the temporal dynamic features of multiple consecutive time windows into a dynamic feature sequence and input it into a differentially gated temporal network to generate a dynamic feature representation. An attention fusion module is used to fuse the distributed feature representation and the dynamic feature representation to obtain a joint feature vector; process the joint feature vector through a bottleneck attention network to generate an adaptive weight vector; weight the joint feature vector based on the adaptive weight vector, and superimpose the weighted result with the joint feature vector to obtain a fused feature representation; The detection output module is used to input the fused feature representation into the classifier and output the DDoS attack detection probability; calculate the APT stage correlation score based on the multidimensional correlation between the DDoS behavior and the associated security events corresponding to the DDoS attack detection probability; and then identify and output the detection category, associated attack stage, and evidence timeline based on the APT stage correlation score and the DDoS attack detection probability.

[0119] It is evident that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented in this device embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0120] This application also provides an electronic device, including: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.

[0121] It is evident that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented in this device embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0122] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any intelligent terminal, including servers, workstations, personal computers, etc.

[0123] It is understood that the content of the above method embodiments is applicable to the electronic device embodiments. The specific functions implemented by the electronic device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0124] Please see Figure 7 , Figure 7 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to achieve the technical solutions provided in the embodiments of this application. The memory can be implemented in the form of read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory and called by the processor to execute the methods described in the embodiments of this application. Input / output interfaces are used to implement information input and output; The communication interface is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). A bus is used to transfer information between various components of a device, such as processors, memory, input / output interfaces, and communication interfaces. The processor, memory, input / output interfaces, and communication interfaces communicate with each other within the device via a bus.

[0125] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0126] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0127] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0128] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0129] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0130] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0131] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0132] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0134] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0136] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for detecting robust DDoS cover behavior in a dual-stream system, characterized in that, The method includes the following steps: Acquire multi-source network security data and convert the multi-source network security data into standardized event logs. The multi-source network security data includes network traffic data. The network traffic data is segmented according to a preset time window, and distribution statistical features and time dynamic features are extracted; the distribution statistical features and time dynamic features are screened based on a multi-index evaluation method to obtain a candidate feature set; The distribution statistical features in the candidate feature set are input into an explicit cross-connect network to generate a distribution feature representation; the temporal dynamic features of multiple consecutive time windows are combined into a dynamic feature sequence and input into a differentially gated temporal network to generate a dynamic feature representation. The distributed feature representation and the dynamic feature representation are fused to obtain a joint feature vector; the joint feature vector is processed by a bottleneck attention network to generate an adaptive weight vector; the joint feature vector is weighted based on the adaptive weight vector, and the weighted result is superimposed on the joint feature vector to obtain a fused feature representation; The fused feature representation is input into the classifier, which outputs the DDoS attack detection probability. Based on the multidimensional correlation between the DDoS behavior and associated security events corresponding to the DDoS attack detection probability, the APT stage correlation score is calculated. Then, based on the APT stage correlation score and the DDoS attack detection probability, the detection category, associated attack stage, and evidence timeline are identified and output.

2. The method according to claim 1, characterized in that, The process of acquiring multi-source network security data and converting it into standardized event records includes: Collect multi-source network security data, including network traffic mirroring data, NetFlow flow records, WAF alarms, IDS alarms, host process logs, file operation logs, authentication logs, asset ledgers, and threat intelligence data; The multi-source network security data is uniformly converted into event logs, which include event number, occurrence time, involved entities, event type, corresponding APT attack stage, confidence level, data source, and extended attributes.

3. The method according to claim 1, characterized in that, The step of segmenting the network traffic data according to a preset time window and extracting distribution statistical features and temporal dynamic features includes: The timestamps generated by different devices are uniformly converted, and IP addresses, domain names, hosts, users, processes, and file hashes are normalized and mapped to unified entity identifiers. The raw network traffic is divided according to the basic time window, and each basic time window is further divided into multiple time sub-slices; For each basic time window, based on the network traffic data within that basic time window, the source IP address entropy, destination IP address entropy, source port entropy, destination port entropy, mean packet size, standard deviation of packet size, uplink / downlink traffic ratio, request method ratio, status code distribution, number of connections, number of concurrent sessions, as well as the moving average and change of the above features, are extracted as distribution statistical features. For each time segment, traffic rate, rate variation coefficient, and rate acceleration are extracted from the network traffic data within each time segment as time dynamic features. The traffic rate is the ratio of the number of packets in each time segment to the current time window length, the rate variation coefficient is the ratio of the standard deviation to the mean of the packet rate in each time segment, and the rate acceleration is the average value of the traffic rate differences between adjacent time segments.

4. The method according to claim 1, characterized in that, The multi-index evaluation method filters the distribution statistical features and the time dynamic features to obtain a candidate feature set, including: For each candidate feature, calculate the cross-protocol conditional mutual information, the difference in optimal transmission distribution, and the time fluctuation penalty factor, and then construct an index vector. The index vector is standardized, the covariance matrix is ​​calculated based on the index vectors of all candidate features, and an ideal discriminant vector is established. Calculate the Mahalanobis distance between the candidate features and the ideal discriminant vector, calculate the candidate feature score based on the Mahalanobis distance, sort the candidate features from high to low, and select the top K candidate features as the candidate feature set.

5. The method according to claim 1, characterized in that, The step of inputting the distribution statistical features from the candidate feature set into an explicit cross-network to generate a distribution feature representation includes: The filtered distribution statistics features are input into the first layer of the explicit cross network. The input features are linearly transformed by the trainable weight matrix. The transformation result is multiplied element-wise with the original input features. The result of the element-wise multiplication is then added to the original input features to obtain the output features of the first layer. For each layer after the first layer in the explicit cross-network, the product of the trainable weight matrix and the output feature of the previous layer is added to the trainable bias to obtain the linear transformation result. The original distribution statistical features are multiplied element-wise with the linear transformation result and added to the output feature of the previous layer to obtain the output feature of the current layer. This process is repeated layer by layer until the last layer, and the output feature of the last layer is used as the distribution feature representation.

6. The method according to claim 1, characterized in that, The step of assembling a dynamic feature sequence from the temporal dynamic features of multiple consecutive time windows and inputting it into a differentially gated temporal network to generate a dynamic feature representation includes: Calculate the difference features for the dynamic features of adjacent time windows; The differential gate is calculated based on the current differential characteristics and the hidden state at the previous time step. The differential gate is used to enhance local flow change information and suppress stable background flow. The update gate and reset gate are calculated based on the current input features and the hidden state of the previous time step. The hidden state of the previous time step is reset according to the reset gate. The reset hidden state of the previous time step is fused with the current input features to calculate the candidate hidden state. The previous hidden state and the candidate hidden state are weighted and fused according to the update gate to update the current hidden state, and the current hidden state is used as a dynamic feature representation.

7. The method according to claim 1, characterized in that, The process involves fusing the distributed feature representation and the dynamic feature representation to obtain a joint feature vector; processing the joint feature vector using a bottleneck attention network to generate an adaptive weight vector; weighting the joint feature vector based on the adaptive weight vector; and superimposing the weighted result with the joint feature vector to obtain a fused feature representation, including: Random inactivation is performed by applying a first drop-off rate to the distribution feature representation and a second drop-off rate to the dynamic feature representation. The inactivated distribution feature representation and the inactivated dynamic feature representation are then fused into a joint feature vector. The first drop-off rate is greater than the second drop-off rate. The joint feature vector is subjected to dimensionality reduction, nonlinear activation, and dimensionality increase through a bottleneck attention network to generate an adaptive weight vector. The adaptive weight vector is multiplied element-wise with the joint feature vector, and then added to the joint feature vector to obtain the fused feature representation.

8. The method according to claim 1, characterized in that, The step of calculating the APT phase correlation score based on the multidimensional correlation between DDoS behavior and associated security events corresponding to the DDoS attack detection probability, and then identifying and outputting the detection category, associated attack phase, and evidence timeline based on the APT phase correlation score and the DDoS attack detection probability, includes: Retrieve host alarms, process behaviors, authentication, network connections, asset information, and threat intelligence within a preset time range before and after the DDoS attack detection probability occurs, and use them as associated security events; Based on the retrieved associated security events, the temporal proximity, entity overlap, and attack phase consistency between the associated security events and the DDoS behavior are calculated respectively. The threat intelligence credibility corresponding to the associated security events is obtained, and then the APT phase association score is calculated based on the temporal proximity, entity overlap, attack phase consistency, and threat intelligence credibility. Based on the APT phase correlation score and the DDoS attack detection probability, identify and output the detection category of normal traffic, legitimate sudden events, ordinary DDoS attacks, or suspected APT cover-up DDoS attacks, and output the associated attack phase and evidence timeline of the DDoS attack.

9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 8.

Images