A federated network DDoS attack defense method, system, device and medium
Patent Information
- Application Number
- CN202611165519.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-03
- Publication Date
- 2026-10-09
AI Technical Summary
上述两类防御技术仅针对静态攻击策略进行检测和过滤，在超大流量DDoS攻击场景下，该检测过滤过程的防御成本可能耗尽防火墙主机的硬件资源，导致防御系统自身失效，导致防御策略被动，实际防御效果被高估
本发明在超大流量DDoS攻击下，通过MEC小区中攻击者与防御者的策略交互，获取当前策略，并结合M/M/1/N排队论获取任务阻塞率、防御者的效用函数和攻击者的效用函数，将防御从被动检测过滤转变为主动的、资源感知的卸载调度与博弈预判，使系统在攻击强度变化前进行防御资源动态平衡，自适应调整检测率与卸载策略，从而避免防御资源因被动应对静态攻击而过度消耗甚至耗尽，从而在超大流量DDoS下实现真实且稳健的防御效能。
Smart Images
Figure CN122891333A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of deep learning security technology, and in particular to a method, system, device and medium for defending against DDoS attacks on federated networks. Background Technology
[0002] As fifth-generation mobile communication systems (5G) evolve towards next-fifth generation (B5G) and sixth-generation (6G) networks, the number of Internet of Things (IoT) devices is growing explosively, placing higher demands on services such as enhanced mobile broadband (eMBB) and ultra-reliable low-latency communication (URLLC). Multi-access edge computing (MEC) federated networks, by offloading computing and storage capabilities to the network edge, can effectively reduce task offloading latency and have become one of the key technologies for B5G and 6G networks.
[0003] However, MEC federated networks face a severe threat of distributed denial-of-service (DDoS) attacks. Attackers use malicious viruses to capture large numbers of IoT nodes, turning them into botnets that send massive amounts of malicious task requests to target MEC servers. This exhausts the MEC's CPU and memory resources, causing serious delays or blockages for legitimate tasks and disrupting network availability. According to F5 Labs, the number of DDoS attacks grew at an average annual rate of 24% between 2020 and 2024, with over 60% of these attacks related to IoT devices, making edge servers the most frequent target.
[0004] Existing DDoS defense technologies are mainly divided into two categories. The first category is collaborative defense technologies, including task offloading, SDN dynamic routing, and blockchain; the second category is detection and filtering technologies, including traffic analysis firewalls, security entropy detection, and deep learning detection. Some research has attempted to combine SDN controllers with 5GC networks to provide a unified control plane for MEC federation. Both of these defense technologies only detect and filter static attack strategies. In scenarios involving extremely high-volume DDoS attacks, the cost of this detection and filtering process may exhaust the hardware resources of the firewall host, causing the defense system itself to fail, resulting in a passive defense strategy and an overestimation of the actual defense effectiveness. Summary of the Invention
[0005] The purpose of this invention is to address the shortcomings of the prior art by providing a federal network DDoS attack defense method, system, device, and medium to solve the problems in the prior art.
[0006] The present invention specifically provides the following technical solution: A method for defending against DDoS attacks on federal networks, comprising the following steps: Obtain the operational status information of each MEC cell and the attacker's attack constraints information; The attacker and defender in the federated network are respectively designated as leader and follower. The strategy interaction between the attacker and defender is generated to obtain the current strategy. The attack resource vector allocated by the attacker to each MEC cell is used as the attack strategy, and the detection rate vector and offload matrix of the defender are used as the defense strategy. Based on the M / M / 1 / N queuing theory, and according to the current strategy's consumption of CPU and memory resources, the remaining service capacity and effective concurrent capacity acquisition task blocking rate of each MEC cell are determined. The defender's utility is constructed based on the unloading delay, task blocking rate, and average business value in the running status information, and the attacker's utility is constructed based on the attack cost in the attack constraint information. With maximizing the attacker's utility as the outer goal and maximizing the defender's utility as the inner goal, the subgame perfect Nash equilibrium with respect to the outer and inner goals is iteratively solved, and the optimal detection rate vector and the optimal unloading matrix are output. Firewalls are deployed on each MEC host according to the optimal detection rate vector, and the OPF switch flow table is updated according to the optimal offload matrix as the task offload scheduling result.
[0007] Preferably, the step of determining the remaining service capacity and effective concurrent capacity acquisition task blocking rate of each MEC cell based on the M / M / 1 / N queuing theory and the consumption of CPU and memory resources by the current strategy is as follows: Considering firewall resource consumption, the effective strength is obtained by weighting the task arrival rate and attack resource vector through the offload matrix. The service rate of the j-th MEC cell is determined by the coupling relationship between the effective strength and the remaining service capacity after adjustment by the CPU scaling factor. For the j-th MEC cell, obtain the memory buffer capacity and the equivalent number of connections occupied by the firewall detection. Obtain the effective concurrent capacity based on the difference between the memory buffer capacity and the equivalent number of connections. Determine the normalization term using the service rate and the effective concurrent capacity, and use the effective concurrent capacity raised to the power of the service rate as the factor term. Obtain the task request blocking rate by the product of the normalization term and the factor term.
[0008] Preferably, the attacker's utility is constructed based on the attack cost in the attack constraint information, specifically as follows: Based on the defender utility, the offloading delay is reduced to zero to obtain the defender utility; The attacker's utility function is obtained by subtracting the attack cost from the defender's utility when there is no attack; wherein the attack cost is the sum of the cost of the attacker sending each malicious task under different attacker strategies and the defender's utility function under different offloading delays.
[0009] Preferably, the process involves iteratively solving for the subgame perfect Nash equilibrium with respect to the outer and inner objectives, using the attacker's utility maximization as the outer objective and the defender's utility maximization as the inner objective, and outputting the optimal detection rate vector and the optimal unloading matrix. Specifically: The outer layer is the target-optimized attack strategy, which is used to traverse the set of candidate attacker strategies. The outer layer selects the attack vector that maximizes the attacker's utility as the optimal attack strategy. The corresponding (D*, d̄*) is the optimal defense strategy, where D* is the optimal unloading matrix and d̄* is the optimal detection rate. Among the attacker strategies selected during the traversal, the attacker chooses the attack strategy with the highest probability as the outer layer, and the inner layer optimizes the defense strategy (D, d̄) through a genetic algorithm to obtain the defender's optimal response; the defender's optimal response includes outputting the optimal detection rate vector and the optimal unloading matrix.
[0010] Preferably, firewalls are deployed on each MEC host according to the optimal detection rate vector, specifically as follows: The optimal detection rate vector is sent to the MEC orchestrator, which instructs the MEC hosts to deploy firewalls.
[0011] Preferably, the OPF switch flow table is updated according to the optimal offload matrix, specifically as follows: The optimal offload matrix is sent to the SDN controller, which updates the flow tables of the switches to obtain the optimal load of the task across different MEC cells.
[0012] Preferably, when the attacker and defender in the federated network are respectively regarded as the leader and the follower, the strategy interaction between the attacker and the defender is carried out through the Stackelberg game model.
[0013] This invention provides a federal network DDoS attack defense system, comprising: The data acquisition module is used to obtain the operating status information of each MEC cell and the attacker's attack constraints information; The strategy interaction module is used to generate strategy interaction between attackers and defenders in the federated network, with attackers and defenders as leaders and followers respectively, to obtain the current strategy. The attack strategy is based on the attack resource vector allocated by the attacker to each MEC cell, and the defense strategy is based on the detection rate vector and offload matrix of the defender. The blocking rate acquisition module is used to determine the remaining service capacity and effective concurrent capacity of each MEC cell and obtain the task blocking rate based on the M / M / 1 / N queuing theory and the consumption of CPU and memory resources according to the current strategy. The defense strategy generation module is used to construct the defender's utility based on the unloading delay, task blocking rate and average business value in the running status information, and to construct the attacker's utility based on the attack cost in the attack constraint information; with the attacker's utility maximization as the outer goal and the defender's utility maximization as the inner goal, iteratively solves the subgame perfect Nash equilibrium with respect to the outer goal and the inner goal, and outputs the optimal detection rate vector and the optimal unloading matrix. The defense module is used to deploy firewalls on each MEC host according to the optimal detection rate vector and update the OPF switch flow table according to the optimal offload matrix as the task offload scheduling result.
[0014] The present invention provides a computer device, including a memory and a processor. The memory stores a program, and when the program is executed by the processor, the processor performs the steps of the above-described federated network DDoS attack defense method.
[0015] The present invention provides a storage medium on which a computer program is stored, wherein the computer program, when executed by a processor, implements the steps of the above-described method for defending against DDoS attacks on a federated network.
[0016] Compared with the prior art, the present invention has the following significant advantages: This invention addresses the challenges of massive DDoS attacks by leveraging the strategic interaction between attackers and defenders within an MEC cell to obtain the current strategy. It then combines M / M / 1 / N queuing theory to determine the task blocking rate, the defender's utility function, and the attacker's utility function. This transforms defense from passive detection and filtering to proactive, resource-aware offloading scheduling and game theory prediction. The system dynamically balances defense resources before changes in attack intensity, adaptively adjusting the detection rate and offloading strategy. This prevents excessive consumption or even depletion of defense resources due to passively responding to static attacks, thus achieving realistic and robust defense performance under massive DDoS attacks. Attached Figure Description
[0017] Figure 1 This is a schematic diagram of the system architecture for DDoS attacks in the B5G SDN MEC federated network of this invention; Figure 2 This is a high-level information flow diagram of the MEC federated DDoS defense architecture provided by the present invention; Figure 3 This is a schematic diagram of the MEC federated DDoS attack and defense system in the IoT scenario provided by the present invention; Figure 4 A flowchart of a federal network DDoS attack defense method provided by the present invention. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0019] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.
[0020] In a B5G multi-access edge computing (MEC) federated network using software-defined networking (SDN) as the controller, multiple different MEC cells exist, each serving different types of IoT services. Network attackers can launch distributed denial-of-service (DDoS) attacks against MEC servers by connecting malicious nodes to different MEC cells. This invention considers the attributes of different MEC cells, using task latency and blocking rate as the main optimization metrics, and employs Stackelberg game theory to minimize the destructiveness of DDoS attacks while ensuring fairness.
[0021] In a B5G MEC federated network with SDN as the controller, the DDoS attack defense method provided by this invention can be applied to the 5GC Policy Control Function (PCF). When a DDoS attacker launches an attack on the MEC servers of each cell, the PCF will calculate the optimal defense strategy and schedule the SDN controller and MECO to execute the response. This invention employs a mathematical model of the utility function that affects latency and blocking rate between the attacker and defender, and considers the interaction of strategies between the two parties through game theory, providing the best defense strategy for the B5G MEC federated network when subjected to DDoS attacks.
[0022] Figure 2 This is a high-level information flow diagram of the MEC federated DDoS defense architecture provided by this invention. Combined with... Figure 2 It is known that, in the absence of attacks, IoT applications prioritize using local MEC services. When a DDoS attack is detected, the defense architecture mitigates the attack through a combination of firewall detection and traffic offloading: the SDN controller uploads TCP header information (including source / destination IP, SYN / ACK flags, and flow identifier) via the packet_in message of the OpenFlow switch to determine whether a DDoS attack exists. The DDoS attack defense method for B5G MEC federated networks is shown below.
[0023] like Figure 4 As shown, this invention provides a method for defending against DDoS attacks on federated networks. Specifically, it includes the following steps:
[0024] Step 1: Obtain the operating status information of each MEC cell and the attacker's attack constraints information.
[0025] The operational status information includes task arrival rate, average business value, inter-cell offloading latency, raw CPU service rate of each MEC host, CPU ratio coefficient, memory buffer capacity, and memory equivalent connections. The attacker's attack constraint information includes the attacker's total attack resource limit and unit attack cost.
[0026] Initialization and resource registration. The MEC host registers its CPU service rate vector μ and memory buffer capacity vector N with the MECO. The SDN controller obtains the MEC topology information and inter-cell latency matrix t, and initializes the mapping of virtual IP address vir_ip and MEC MAC address src.mac.
[0027] Traffic monitoring and attack detection. The SDN controller collects the task arrival rate of each MEC cell in real time via packet_in messages. If the total task arrival rate is lower than a preset threshold, the SDN controller routes tasks according to the minimum inter-cell delay; if DDoS attack characteristics are detected (such as SYN floods, abnormally high traffic), it switches to defense mode.
[0028] Step 2: Assign the attacker and defender in the federated network as the leader and follower, respectively, generate the policy interaction between the attacker and the defender, and obtain the current policy; wherein, the attack resource vector allocated by the attacker to each MEC cell is used as the attack policy, and the detection rate vector and offload matrix of the defender are used as the defense policy.
[0029] This step involves establishing a Stackelberg attack-defense game model. The attacker is treated as the leader, and the defender as the follower, creating a two-stage, fully informed dynamic Stackelberg game. This involves using the Stackelberg game model to illustrate the strategic interactions between the attacker and defender.
[0030] The attacker's strategy is to allocate attack resources to vectors. ,satisfy , The defender's strategy includes a detection rate vector. ( ) and unloading matrix ^{n×n}_+ (satisfies) , ),in This represents the proportion of tasks offloaded from the i-th MEC cell to the j-th MEC cell.
[0031] Step 3: Based on the M / M / 1 / N queuing theory, determine the remaining service capacity and effective concurrent capacity acquisition task blocking rate of each MEC cell according to the current strategy's consumption of CPU and memory resources.
[0032] System performance is modeled based on M / M / 1 / N queuing theory. In the B5G IoT scenario, task arrival rates follow a Poisson distribution, and service times follow an exponential distribution. The M / M / 1 / N model is used to describe the task processing. The single-task utility function (with respect to delay t) is:
[0033] (1); The single-task utility function (with respect to the blocking rate L) is: (2); Where t represents task latency (in seconds) and L represents task request blocking rate. When t < 10 ms and L < 1%, both have minimal impact on utility; when t > 100 ms or L > 5%, utility approaches zero.
[0034] Firewall detection of CPU resources consumed and memory resources (Proportional to the number of detection tasks) are as follows: , .in, The firewall detects the CPU consumption ratio for each task. To detect the memory consumption of each task for the firewall, This is a local task. Considering firewall resource consumption, the effective strength is obtained by weighting the task arrival rate and attack resource vectors using an offload matrix. The service rate of the j-th MEC cell is determined by the coupling relationship between the effective strength and the remaining service capacity adjusted by the CPU scaling factor. for:
[0035] (3); For the j-th MEC cell, obtain the memory buffer capacity and the equivalent number of memory connections occupied by firewall detection. Calculate the effective concurrent capacity based on the difference between the memory buffer capacity and the equivalent number of memory connections. Determine the normalization term using the service rate and the effective concurrent capacity, and use the service rate raised to the power of the effective concurrent capacity as a factor term. The nominal maximum service rate of the j-th MEC cell; the task request blocking rate is obtained by the product of the normalization term and the factor term; task request blocking rate for: (4); in, Let be the memory buffer capacity (maximum number of concurrent connections) of the j-th MEC cell. Detects the memory-equivalent number of connections used by the firewall.
[0036] Step 4: Construct the defender's utility based on the unloading delay, task blocking rate, and average business value in the running status information, and construct the attacker's utility based on the attack cost in the attack constraint information; with the attacker's utility maximization as the outer objective and the defender's utility maximization as the inner objective, iteratively solve the subgame perfect Nash equilibrium for the outer and inner objectives, and output the optimal detection rate vector and the optimal unloading matrix.
[0037] Construct the utility function. The defender's total utility function (which needs to be maximized) is:
[0038] (5); in, Let i be the average service value of the i-th MEC cell. The offloading delay from cell i to cell j; It is the latency of a single task. Compared with the average packet loss rate The utility function, whose analytical expression is: ; ; Based on the defender utility, the offloading latency is reduced to zero to obtain the defender utility, which is the defender utility when there is no attack (t=0, i.e., local processing with no latency is prioritized). for: (6); Subtracting the attack cost from the defender's utility under no-attack conditions yields the attacker's utility function; where the attack cost is the sum of the attacker's cost of sending each malicious task under different attacker strategies and the defender's utility function under different offloading delays. The attacker's utility function (which needs to be maximized, i.e., the defender's utility loss minus the attack cost) is:
[0039] (7); in, The cost of sending each malicious task to the attacker.
[0040] A two-layer genetic algorithm is used to solve the subgame perfect Nash equilibrium (SPNE). The attacker's optimization problem (outer layer) is:
[0041] (8); The defender optimization problem (inner layer, given attack vector Ā) is: (9); The two-stage game described above constitutes a finite-time domain complete information extended game. The existence of SPNE is proven by backward induction: strategy space compactness (Heine-Borel theorem) + utility function continuity (continuity of the sigmoid composite function) + Weierstrass extremum theorem + Berge maximum theorem, which guarantees the existence of SPNE(Ā*, D*, d̄*).
[0042] A two-layer genetic algorithm (GA) framework is used to solve the problem: the outer layer optimizes the attack strategy for the target, and iterates through the set of candidate attacker strategies. Specifically:
[0043] In the traversal of attacker strategies, the attacker selects the attack strategy with the highest probability as the outer layer. The inner layer optimizes the defense strategy (D, d̄) for each attack strategy using a genetic algorithm (adaptive grid search initialization - tournament selection - single-point crossover - integer mutation). This iteration continues until convergence, yielding the defender's optimal response. The optimal response of the defender, which includes the output of the optimal detection rate vector and the optimal offloading matrix, where D* is the optimal offloading matrix and d̄* is the optimal detection rate.
[0044] Step 5: Deploy firewalls on each MEC host based on the optimal detection rate vector, and update the OPF switch flow table based on the optimal offload matrix as the task offload scheduling result.
[0045] The optimal detection rate vector is sent to the MEC orchestrator, which instructs the MEC hosts to deploy firewalls. The optimal offload matrix is sent to the SDN controller, which updates the flow tables of the switches to obtain the optimal load for tasks across different MEC cells. Specifically:
[0046] Policy execution and dynamic updates. The PCF sends the optimal detection rate d̄* to the MECO, which instructs the MEC host to deploy an NFV firewall via NFVI. The PCF sends the optimal offload matrix D* to the SDN controller, which updates the OPF switch flow table (setting arp.sha=src.mac⊗D*, where ⊗ is the tensor product). The firewall identifies malicious IPs and reports them to the SDN controller for blacklisting. Steps S2 to S6 are repeated periodically to achieve dynamic adaptive defense.
[0047] in, Figure 3 This is a schematic diagram of the MEC federated DDoS attack and defense system in the IoT scenario provided by this invention. Combined with... Figure 3 It can be seen that when the attack occurs, the attacker sends malicious task requests to each MEC cell. Defenders use NFV firewalls (detection rate) ( ) and SDN traffic offloading matrix D for collaborative defense.
[0048] Figure 1 This is a schematic diagram of the system architecture for DDoS attacks in a B5G SDN MEC federated network provided by this invention. (Combined with...) Figure 1 As can be seen, the B5G MEC federation comprises multiple MEC cells, supported by the 5GC and SDN controller. The control plane consists of the 5GC network and the MEC orchestrator (MECO), while the user plane consists of multiple MEC cells. Each MEC cell contains IoT devices, base stations, OpenFlow switches (OPF), and MEC hosts. The MEC hosts deploy DDoS detection firewalls using Network Functions Virtualization Infrastructure (NFVI) technology.
[0049] When the SDN controller detects a DDoS attack, it sends a defense request carrying traffic statistics to the PCF via the northbound interface. The PCF solves for the optimal defense strategy based on a game theory model, including the detection rate vector d and the offload matrix D, and distributes them to the MECO and the SDN controller, respectively. The MECO instructs the MEC hosts to deploy NFV firewalls to filter malicious traffic according to the detection rate d; the SDN controller updates the flow tables of the OpenFlow switches according to the offload matrix D to achieve load balancing of tasks among different MEC cells.
[0050] The beneficial effects of this invention are as follows: (1) Improved defense effectiveness: By predicting the attacker's strategy through the Stackelberg game model, proactive and dynamic DDoS defense is achieved. Compared with existing technologies, the utility of MEC federation is significantly improved.
[0051] (2) Reduce resource costs: Incorporate CPU and memory consumption into the utility function to reduce resource consumption by more than 25% on average while ensuring the defense effect.
[0052] (3) Achieve collaborative defense: For the first time, task offloading and malicious traffic detection are jointly optimized in the MEC federation, forming a unified DDoS defense framework.
[0053] (4) Cross-plane collaborative deployment: Based on 5GC and SDN, unified deployment and dynamic execution of policies in the control plane and user plane are realized, supporting large-scale distributed MEC federation scenarios.
[0054] (5) Differentiated protection: The defense strategy is dynamically adjusted according to the business value of MEC, and high-value, high-volume nodes are prioritized to improve the overall service revenue.
[0055] Based on the above method, this invention proposes a federated network DDoS attack defense system, comprising: The system comprises several modules: a data acquisition module to obtain operational status information of each MEC cell and attacker's attack constraints; a policy interaction module to generate policy interactions between attackers and defenders, with attackers and defenders acting as leaders and followers respectively, to obtain the current policy; where the attack resource vector allocated by the attacker to each MEC cell is used as the attack policy, and the defender's detection rate vector and offload matrix are used as the defense policy; and a blocking rate acquisition module to determine the remaining service capacity and effective concurrency of each MEC cell based on M / M / 1 / N queuing theory and the consumption of CPU and memory resources according to the current policy. The capacity acquisition module obtains the task blocking rate; the defense strategy generation module constructs the defender's utility based on the offloading latency, task blocking rate, and average business value in the running status information, and constructs the attacker's utility based on the attack cost in the attack constraint information; with the attacker's utility maximization as the outer goal and the defender's utility maximization as the inner goal, iteratively solves the subgame perfect Nash equilibrium with respect to the outer and inner goals, and outputs the optimal detection rate vector and the optimal offloading matrix; the defense module deploys firewalls on each MEC host based on the optimal detection rate vector and updates the OPF switch flow table based on the optimal offloading matrix as the task offloading scheduling result.
[0056] The present invention provides a computer device, including a memory and a processor. The memory stores a program, and when the program is executed by the processor, the processor performs the steps of the above-described federated network DDoS attack defense method.
[0057] According to the disclosed embodiments, the computer device can communicate with one or more external devices (e.g., keyboard, pointing device, Bluetooth communication, etc.) or with any device that enables the computing device to communicate with one or more other computing devices (e.g., router, demodulator, etc.).
[0058] The present invention provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the above-described federated network DDoS attack defense method.
[0059] According to the disclosed embodiments, the storage medium can be a non-volatile computer-readable storage medium, such as, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, the storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.
[0060] The above description, in conjunction with specific preferred embodiments, provides a more detailed explanation of the present invention. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered to fall within the scope of protection of the present invention.
Claims
1. A method for defending against DDoS attacks on federated networks, characterized in that, Includes the following steps: Obtain the operational status information of each MEC cell and the attacker's attack constraints information; The attacker and defender in the federated network are respectively designated as leader and follower. The strategy interaction between the attacker and defender is generated to obtain the current strategy. The attack resource vector allocated by the attacker to each MEC cell is used as the attack strategy, and the detection rate vector and offload matrix of the defender are used as the defense strategy. Based on the M / M / 1 / N queuing theory, and according to the current strategy's consumption of CPU and memory resources, the remaining service capacity and effective concurrent capacity acquisition task blocking rate of each MEC cell are determined. The defender's utility is constructed based on the unloading delay, task blocking rate, and average business value in the running status information, and the attacker's utility is constructed based on the attack cost in the attack constraint information. With maximizing the attacker's utility as the outer goal and maximizing the defender's utility as the inner goal, the subgame perfect Nash equilibrium with respect to the outer and inner goals is iteratively solved, and the optimal detection rate vector and the optimal unloading matrix are output. Firewalls are deployed on each MEC host according to the optimal detection rate vector, and the OPF switch flow table is updated according to the optimal offload matrix as the task offload scheduling result.
2. The method for defending against DDoS attacks on a federated network as described in claim 1, characterized in that, The method based on M / M / 1 / N queuing theory determines the remaining service capacity and effective concurrent capacity acquisition task blocking rate of each MEC cell according to the current strategy's consumption of CPU and memory resources. Specifically: Considering firewall resource consumption, the effective strength is obtained by weighting the task arrival rate and attack resource vector through the offload matrix. The service rate of the j-th MEC cell is determined by the coupling relationship between the effective strength and the remaining service capacity after adjustment by the CPU scaling factor. For the j-th MEC cell, the memory buffer capacity and the equivalent number of memory connections occupied by the firewall detection are obtained. The effective concurrent capacity is obtained based on the difference between the memory buffer capacity and the equivalent number of memory connections. The normalization term is determined by the service rate and the effective concurrent capacity, and the effective concurrent capacity is used as the factor term. The task request blocking rate is obtained by the product of the normalization term and the factor term.
3. The method for defending against DDoS attacks on a federated network as described in claim 1, characterized in that, The attacker's utility is constructed based on the attack cost in the attack constraint information, specifically as follows: Based on the defender utility, the offloading delay is reduced to zero to obtain the defender utility; The attacker's utility function is obtained by subtracting the attack cost from the defender's utility when there is no attack; wherein the attack cost is the sum of the cost of the attacker sending each malicious task under different attacker strategies and the defender's utility function under different offloading delays.
4. A federal network DDoS attack defense method as described in claim 3, characterized in that, The process involves iteratively solving for the subgame perfect Nash equilibrium with respect to the outer and inner objectives, using the attacker's utility maximization as the outer objective and the defender's utility maximization as the inner objective. The output is the optimal detection rate vector and the optimal unloading matrix. Specifically: The outer layer is the target-optimized attack strategy, which is used to traverse the set of candidate attacker strategies. The outer layer selects the attack vector that maximizes the attacker's utility as the optimal attack strategy. The corresponding (D*, d̄*) is the optimal defense strategy, where D* is the optimal unloading matrix and d̄* is the optimal detection rate. Among the attacker strategies selected during the traversal, the attacker chooses the attack strategy with the highest probability as the outer layer, and the inner layer optimizes the defense strategy (D, d̄) through a genetic algorithm to obtain the defender's optimal response; the defender's optimal response includes outputting the optimal detection rate vector and the optimal unloading matrix.
5. A federal network DDoS attack defense method as described in claim 1, characterized in that, Firewalls are deployed on each MEC host based on the optimal detection rate vector, specifically as follows: The optimal detection rate vector is sent to the MEC orchestrator, which instructs the MEC hosts to deploy firewalls.
6. A federal network DDoS attack defense method as described in claim 1, characterized in that, The OPF switch flow table is updated based on the optimal offload matrix, specifically as follows: The optimal offload matrix is sent to the SDN controller, which updates the flow table of the switch to obtain the optimal load of the task across different MEC cells.
7. A federal network DDoS attack defense method as described in claim 1, characterized in that, When the attacker and defender in the federated network are respectively regarded as the leader and the follower, the strategy interaction between the attacker and the defender is carried out through the Stackelberg game model.
8. A federal network DDoS attack defense system, characterized in that, include: The data acquisition module is used to obtain the operating status information of each MEC cell and the attacker's attack constraints information; The strategy interaction module is used to generate strategy interaction between attackers and defenders in the federated network, with attackers and defenders as leaders and followers respectively, to obtain the current strategy. The attack strategy is based on the attack resource vector allocated by the attacker to each MEC cell, and the defense strategy is based on the detection rate vector and offload matrix of the defender. The blocking rate acquisition module is used to determine the remaining service capacity and effective concurrent capacity of each MEC cell and obtain the task blocking rate based on the M / M / 1 / N queuing theory and the consumption of CPU and memory resources according to the current strategy. The defense strategy generation module is used to construct the defender's utility based on the unloading delay, task blocking rate and average business value in the running status information, and to construct the attacker's utility based on the attack cost in the attack constraint information; with the attacker's utility maximization as the outer goal and the defender's utility maximization as the inner goal, iteratively solves the subgame perfect Nash equilibrium with respect to the outer goal and the inner goal, and outputs the optimal detection rate vector and the optimal unloading matrix. The defense module is used to deploy firewalls on each MEC host according to the optimal detection rate vector and update the OPF switch flow table according to the optimal offload matrix as the task offload scheduling result.
9. A computer device, characterized in that, The method includes a memory and a processor, wherein the memory stores a program that, when executed by the processor, causes the processor to perform the steps of a federated network DDoS attack defense method as described in any one of claims 1 to 7.
10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of a federal network DDoS attack defense method according to any one of claims 1 to 7.