A network attack automatic blocking method and system based on traffic feature recognition

Abstract

The application relates to the technical field of network security, and discloses a network attack automatic blocking method and system based on traffic feature recognition, which comprises the following steps: collecting transmission control protocol (TCP) messages to map source IP addresses, extracting statistical quantities to calculate state asymmetry ratio and physical time delay parameters; constructing a cooperative pulse matrix to extract frequency domain parameters and output a suspected source IP address set; executing route redirection to establish a bidirectional traffic visible path, combining frequency domain and physical time delay parameters to calculate a timestamp and send a probe message sequence; capturing a response to generate a fingerprint vector, combining the fingerprint vector with the cooperative pulse matrix to generate a three-dimensional state tensor, executing spatial clustering to separate a malicious source IP address set, and delivering a blocking rule. The application converts network connection behavior into the frequency domain for analysis and fuses terminal inherent system features, eliminates an asymmetric route blind area, accurately distinguishes real business users from source address forgery attacks, and realizes a closed-loop management and control of adaptive punishment cycles and automatic unlocking.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for automatically blocking network attacks based on traffic feature recognition. Background Technology

[0002] With the development of network technology, network attack methods are constantly evolving. Existing network security management mechanisms rely on network layer traffic threshold statistics to detect abnormal behavior. However, this method, which relies on single traffic statistics, is difficult to detect slow state exhaustion attacks. Abnormal connection states are easily interfered with and masked by normal background traffic, making it impossible for the system to accurately extract and locate the periodic rhythm characteristics of distributed coordinated attacks, resulting in low accuracy in identifying covert network attacks.

[0003] At the traffic monitoring and verification level, due to the prevalence of asymmetric routing in real-world networks, existing defense mechanisms typically only capture unidirectional data flows, creating blind spots in response message monitoring and limiting them to a passive monitoring perspective. To compensate for the shortcomings of passive analysis, some technologies attempt to introduce active probing, but conventional probing messages often incur additional overhead for business data transmission. Furthermore, existing probing methods lack precise calculation and integration of network physical latency, resulting in timing discrepancies in probing message delivery and failing to guarantee a deterministic response from the target terminal's underlying protocol stack.

[0004] During the blocking phase, existing technologies rely on network behavior characteristics to issue blocking rules, lacking the ability to perform high-dimensional comparisons between network behavior and the inherent system characteristics of the terminal. When faced with numerous source address spoofing attacks, this single-dimensional judgment method can easily misidentify requests from genuine business users as attacks, leading to the wrongful blocking of normal services. Furthermore, existing blocking rules are statically issued, lacking a mechanism to dynamically calculate aging timestamps based on historical violation counts, making it impossible to directly implement closed-loop management of adaptive penalty cycles and automatic unlocking at the hardware level. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an automatic network attack blocking method and system based on traffic feature identification. It solves the problems of existing technologies, such as difficulty in identifying slow coordinated attacks by relying on single traffic statistics, passive monitoring blind spots caused by asymmetric routing, and the tendency of single-dimensional judgment to lead to false blocking of normal services under source address spoofing attacks, as well as the lack of adaptive closed-loop management of blocking rules.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] The first aspect of this invention provides a method for automatically blocking network attacks based on traffic feature recognition, the method comprising the following steps:

[0008] Collect Transmission Control Protocol (TCP) messages, map the source IP addresses of the TCP messages, extract connection state statistics, and calculate the state asymmetry ratio and physical delay parameters.

[0009] The state asymmetry ratio is cached and a cooperative pulse matrix is ​​constructed. Frequency domain parameters are extracted from the cooperative pulse matrix, and a set of suspected source IP addresses is output based on the frequency domain parameters.

[0010] Based on the set of suspected source IP addresses, a zero-window probe packet is constructed, and route redirection is performed to establish a bidirectional traffic visibility path;

[0011] The frequency domain parameters and physical delay parameters are obtained. The absolute prediction timestamp is calculated based on the discrete frequency index and initial phase angle in the frequency domain parameters. The absolute delivery timestamp is calculated based on the absolute prediction timestamp, the average round-trip time in the physical delay parameters, and the protocol stack processing compensation constant. The hardware trigger timestamp is then calculated based on the absolute delivery timestamp and the delay jitter deviation in the physical delay parameters.

[0012] The zero-window probe message is modulated to generate a probe message sequence, and the probe message sequence is sent at the hardware-triggered timestamp; zero-window probe message

[0013] Capture response messages to the probe message sequence to generate a protocol stack fingerprint vector, combine the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and perform spatial clustering to separate the list of legitimate source IP addresses and the set of malicious source IP addresses;

[0014] Data plane blocking is performed based on the set of malicious source IP addresses, and the route redirection is revoked based on the list of legitimate source IP addresses.

[0015] Furthermore, the steps of mapping the source IP address of the Transmission Control Protocol (TCP) message and extracting connection state statistics to calculate the state asymmetry ratio include:

[0016] The source IP address is mapped to a preset set of virtual hash buckets using a consistent hashing algorithm;

[0017] The total number of sessions in the half-connection state, the total number of sessions in the established state but whose receiver notification sliding window remains zero, and the total number of sessions that transmit data in one direction and have not received an acknowledgment message after exceeding the preset retransmission timeout threshold are extracted from the preset virtual hash bucket set within the discrete time window as the connection state statistics.

[0018] The total number of sessions in the half-connection state and the total number of sessions in the established state but whose receiver notification sliding window remains zero are summed together with the abnormal protocol state penalty weight coefficient to obtain an accumulated value. The total number of sessions that transmit data in one direction and do not receive an acknowledgment message after exceeding the preset retransmission timeout threshold is added to the accumulated value as the numerator. The sum of the total number of sessions that have completed the normal closed state transition and the constant limit factor is used as the denominator. The ratio is then used to calculate the state asymmetry ratio.

[0019] Furthermore, the steps for extracting connection state statistics to calculate the state asymmetry ratio and physical delay parameters, including the step of calculating the physical delay parameters, are as follows:

[0020] The calculation of physical delay parameters includes calculating the average round-trip time delay and delay jitter deviation, specifically including:

[0021] Extract the effective connection round-trip time measurement value, combine the effective connection round-trip time measurement value with the average round-trip delay of the previous discrete time window and the delay smoothing factor, and update the average round-trip delay using the exponential weighted moving average algorithm;

[0022] The absolute deviation between the effective connection round-trip time measurement and the average round-trip delay of the previous discrete time window is extracted, and the delay jitter deviation is obtained by iteratively updating the jitter deviation by combining the jitter smoothing factor with the delay jitter deviation of the previous discrete time window.

[0023] Furthermore, the step of extracting frequency domain parameters from the cooperative pulse matrix and outputting a set of suspected source IP addresses based on the frequency domain parameters includes:

[0024] Perform a discrete Fourier transform on the time-domain sequence of the co-pulse matrix, which is associated with the spatial and temporal dimensions, to generate a complex sequence;

[0025] The frequency domain amplitude and initial phase angle are calculated using the real and imaginary parts of the complex number sequence, and the maximum frequency domain amplitude and the corresponding initial phase angle are extracted as the frequency domain parameters within the effective frequency range.

[0026] By comparing the largest frequency domain amplitude with the white noise tolerance baseline, when it is determined that the largest frequency domain amplitude exceeds the white noise tolerance baseline, the set of suspected source IP addresses that trigger the decision is output.

[0027] Furthermore, the steps of constructing zero-window probe packets based on the suspected source IP address set and performing route redirection to establish a bidirectional traffic visual path include:

[0028] Extract the five-tuple information of active connections associated with the suspected source IP address set, swap the address and port, and set the sliding window field of the Transmission Control Protocol header to zero.

[0029] The zero-window probe message is generated by embedding a custom probe identifier based on a one-way cryptographic hash function in the Transmission Control Protocol Options field, which is calculated according to the suspected source IP address, the current discrete time window index, and the system preset random salt value.

[0030] The suspected source IP address set is encapsulated as a source address prefix in a Border Gateway Protocol (BGP) flow specification message and sent to the upstream core router. An extended community attribute is encapsulated in the route update message to modify the default next-hop network address to complete the route redirection. A lifetime threshold is set for the route redirection, wherein the lifetime threshold is determined based on the sum of the average round-trip time and the compensation buffer time constant in the physical delay parameters.

[0031] Further, the steps of calculating the absolute prediction timestamp based on the discrete frequency index and initial phase angle in the frequency domain parameters, calculating the absolute delivery timestamp based on the absolute prediction timestamp, the average round-trip time in the physical delay parameters, and the protocol stack processing compensation constant, and then calculating the hardware trigger timestamp based on the delay jitter deviation between the absolute delivery timestamp and the physical delay parameters include:

[0032] The physical time period is calculated based on the discrete frequency index and discrete time window physical step size in the frequency domain parameters. The phase offset is calculated by combining the initial phase angle in the frequency domain parameters and an absolute prediction timestamp is generated.

[0033] The absolute delivery timestamp is generated by subtracting the average round-trip time from the physical delay parameter and the protocol stack processing compensation constant from the absolute predicted timestamp.

[0034] The hardware trigger timestamp is generated by subtracting the product of the delay jitter deviation and the jitter compensation coefficient in the physical delay parameter from the absolute delivery timestamp.

[0035] Furthermore, the step of modulating the zero-window probe message to generate a probe message sequence includes:

[0036] The modulation value is obtained by calculating the ratio of the frequency domain amplitude in the frequency domain parameters to the white noise tolerance baseline and multiplying it by the modulation gain factor. The minimum value between the modulation value and the maximum burst message limit for a single perturbation injection is selected as the total number of messages.

[0037] When the total number of messages is greater than 1, the zero-window probe message is copied to the total number of messages, the acknowledgment number of the copied message is fixed to the sequence number of the latest message sent by the target terminal, and the probe message sequence containing consecutive repeated acknowledgment messages is generated.

[0038] Furthermore, the step of combining the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and performing spatial clustering to separate the list of legitimate source IP addresses from the set of malicious source IP addresses, includes:

[0039] The normalized protocol stack fingerprint vector is converted into a spatial discrete dimension using tensor outer product operation, and then orthogonally projected and expanded with the co-pulse matrix to generate the three-dimensional state tensor.

[0040] A spatial distance matrix is ​​generated by using the Frobenius norm to measure the spatial distance between two-dimensional slices of the tensor corresponding to different addresses in the three-dimensional state tensor.

[0041] A density-based spatial clustering algorithm is invoked to search for high-density connected regions in the spatial distance matrix based on the spatial distribution characteristics of the three-dimensional state tensor, the preset clustering neighborhood radius threshold, and the minimum number of core objects. The results are compared with the operating system fingerprint baseline cluster constructed in advance by collecting standard response features of various known types of operating systems in the three-dimensional state tensor space. The list of legitimate source IP addresses is then separated, and the remaining isolated objects and abnormal clusters are aggregated and output as the set of malicious source IP addresses.

[0042] Furthermore, the steps of performing data plane blocking based on the malicious source IP address set and canceling the route redirection based on the legitimate source IP address list include:

[0043] The system queries its internal violation history database to obtain the cumulative number of violations for each address in the malicious source IP address set. The violation history database is used to record the address that is identified as a malicious source IP address each time and the corresponding identification timestamp.

[0044] Combining the basic blocking duration constant with the current physical system timestamp, the exponential backoff algorithm is used to calculate the blocking aging timestamp based on the cumulative number of violations;

[0045] The malicious source IP address set and the blocking aging timestamp are compiled together by calling the syntax template library into a network hardware access control list rule with discard action and timeout expiration attribute. The network hardware access control list rule is encapsulated in network management protocol message and sent to execute the data plane blocking.

[0046] Based on the list of legitimate source IP addresses, a route cancellation message is sent to the upstream core router to restore the default route forwarding path, and the associated virtual hash bucket is located and zeroed out.

[0047] A second aspect of the present invention provides an automatic network attack blocking system based on traffic feature recognition, the system comprising:

[0048] The data processing module is used to collect transmission control protocol messages, map the source IP addresses of the transmission control protocol messages, extract connection state statistics, and calculate the state asymmetry ratio and physical delay parameters.

[0049] The feature conversion module is used to cache the state asymmetry ratio to construct a cooperative pulse matrix, extract frequency domain parameters from the cooperative pulse matrix, and output a set of suspected source IP addresses based on the frequency domain parameters.

[0050] The detection control module is used to construct a zero-window detection packet based on the suspected source IP address set, perform route redirection to establish a bidirectional traffic visible path, obtain the frequency domain parameters and the physical delay parameters to calculate the hardware trigger timestamp, modulate the zero-window detection packet to generate a detection packet sequence, and send the detection packet sequence at the hardware trigger timestamp; the feature analysis module is used to capture the response packet to the detection packet sequence to generate a protocol stack fingerprint vector, combine the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and perform spatial clustering to separate the list of legitimate source IP addresses and the set of malicious source IP addresses;

[0051] The policy execution module is used to perform data plane blocking based on the set of malicious source IP addresses and send control signaling containing the list of legitimate source IP addresses to the routing control module;

[0052] The routing control module is used to, upon receiving the control signaling, cancel the route redirection according to the list of legitimate source IP addresses synchronized by the policy execution module.

[0053] The present invention provides an automatic network attack blocking method and system based on traffic feature recognition, which has the following beneficial effects:

[0054] 1. This invention constructs a cooperative pulse matrix by extracting connection state statistics to calculate the state asymmetry ratio and extracting frequency domain parameters to output a set of suspected source IP addresses. Addressing the deficiency that single traffic statistics are insufficient to detect slow attacks, this invention transforms connection state data to frequency domain space analysis to remove background traffic interference, accurately locates the periodic rhythm characteristics of cooperative attacks, and effectively improves the identification accuracy of covert network attacks.

[0055] 2. This invention establishes a bidirectional traffic visibility path by performing route redirection based on the suspected source IP address set, and calculates hardware trigger timestamps by combining frequency domain and physical delay parameters to send a zero-window probe message sequence that sets the sliding window to zero. The control plane forcibly pulls traffic to eliminate the monitoring blind spot caused by asymmetric routing. The zero-window mechanism in this zero-window probe message avoids additional business data transmission, and the accurate timestamps ensure that the probe message effectively triggers the terminal's underlying protocol stack response, overcoming the limitations of the passive monitoring perspective.

[0056] 3. This invention fuses protocol stack fingerprint vectors with co-pulse matrices to generate a three-dimensional state tensor for execution space clustering to separate malicious source IP address sets. It then calculates blocking aging timestamps based on the number of violations and issues interception rules accordingly. By performing high-dimensional comparison between network behavior and terminal system characteristics, it effectively distinguishes between genuine users and address spoofing attacks to avoid false blocking. The dynamically calculated aging timestamps are directly downloaded to the hardware forwarding plane, achieving closed-loop management with adaptive penalty cycles and automatic unlocking. Attached Figure Description

[0057] Figure 1 This is a system architecture diagram of an automatic network attack blocking system based on traffic feature recognition according to the present invention;

[0058] Figure 2 This is a flowchart illustrating the overall process of an automatic network attack blocking method based on traffic feature recognition according to the present invention.

[0059] Figure 3 This is a flowchart of the data stream dimensionality reduction and latency calculation of the present invention;

[0060] Figure 4 This is a flowchart of the pulse matrix construction and frequency domain anomaly detection of the present invention;

[0061] Figure 5 This is a flowchart of the detection message construction and micro-channel redirection process of the present invention;

[0062] Figure 6 This is a flowchart of the detection message parameter modulation and precise scheduling of the present invention;

[0063] Figure 7 This is a flowchart of fingerprint feature extraction and legitimate source separation according to the present invention;

[0064] Figure 8 This is a flowchart of the data plane blocking and routing recovery process of the present invention;

[0065] Figure 9 This is a comparison diagram of the time-domain state characteristics of the virtual hash bucket in this invention;

[0066] Figure 10 This is the discrete Fourier transform feature extraction and baseline determination diagram of the present invention. Detailed Implementation

[0067] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] See attached document Figure 1 This invention provides an automatic network attack blocking system based on traffic feature recognition, including a data processing module, a feature conversion module, a routing control module, a detection control module, a feature analysis module, and a policy execution module.

[0069] The network attack blocking system based on traffic feature identification is deployed at network boundary nodes. In terms of physical topology, the system data plane connects to the physical link between the boundary router and the internal core switch via a bypass splitter or switch port mirroring mechanism to acquire bidirectional full network traffic. The system control plane connects to various network forwarding devices within the network boundary via an out-of-band management network to issue routing protocol messages and access control list commands.

[0070] The data processing module receives Transmission Control Protocol (TCP) messages via the network bypass mirroring interface. After parsing the five-tuple data in the message, it uses a consistent hashing algorithm to map the source IP address to a preset set of virtual hash buckets. Subsequently, it extracts the connection state statistics of each virtual hash bucket within a discrete time window to calculate the state asymmetry ratio. At the same time, based on the network message sequence timestamp information, it calculates the average round-trip time and delay jitter deviation of the corresponding network path.

[0071] The feature conversion module communicates with the data processing module, generating a co-pulse matrix with temporal and spatial dimensions by caching the state asymmetry ratio within a continuous time window. Then, a discrete Fourier transform is performed on the matrix row vectors to extract the low-frequency dominant frequency component and its corresponding frequency domain amplitude and initial phase angle. When the determined frequency domain amplitude exceeds the white noise tolerance baseline, the virtual hash bucket index that triggers the decision and the associated set of suspected source IP addresses are output.

[0072] The routing control module communicates with the policy enforcement module and the upstream core router. After receiving control signaling containing a list of legitimate source IP addresses, it extracts the IP addresses as the routing target prefix and retrieves the Border Gateway Protocol Flow Specification entry from the internal routing state table. It then constructs a standard route revocation message and sends it to the upstream core router to clear the traffic traction entry and restore the default routing forwarding path for the misjudged legitimate source IP address.

[0073] After receiving the set of suspected source IP addresses, the probe control module constructs a zero-window probe packet by forcibly setting the sliding window field of the Transmission Control Protocol (TCP) header to zero and embedding a custom probe identifier. During this period, the probe control module establishes a Border Gateway Protocol (BGP) flow specification peer connection with the upstream core router at the network boundary, and performs micro-redirection by modifying the next-hop attribute of the route pointing to the set of suspected source IP addresses. Subsequently, it obtains the frequency domain parameters output by the feature conversion module and the network path delay parameters output by the data processing module, calculates the absolute prediction timestamp using the initial phase angle and discrete frequency index, and calculates the absolute delivery timestamp and hardware trigger timestamp by combining the average round-trip time delay and delay jitter deviation. Then, it generates the total number of packets contained in the probe packet sequence based on the frequency domain amplitude modulation. When the underlying hardware clock reaches the hardware trigger timestamp, the modulated probe packet sequence is sent to the physical link.

[0074] The feature analysis module operates after establishing a bidirectional visible traffic path. It captures the underlying protocol stack response messages of the suspected source IP address set to the probe packets, extracting the Time-to-Live (TTL) field, IP identifier generation rules, and Transmission Control Protocol (TCP) option sequences to generate a protocol stack fingerprint vector. This vector is then converted into a spatially discrete dimension and combined with a co-pulse matrix to generate a three-dimensional state tensor. The spatial distance between two-dimensional slices of this tensor is calculated along with a density-based spatial clustering algorithm to separate legitimate source IP addresses that conform to the network stack response characteristics of a normal operating system kernel. The list of legitimate source IP addresses and the set of malicious source IP addresses that did not generate a standard state machine response are then synchronously output to the policy execution module.

[0075] After receiving the list of legitimate source IP addresses and the set of malicious source IP addresses output by the feature analysis module, the policy execution module compiles them into access control list rules recognizable by the underlying network hardware. Then, it sends a data plane drop command to downstream network forwarding devices via the network configuration protocol. After the data plane blocking takes effect, it immediately sends a control signaling message to the routing control module, triggering the routing control module to construct a route revocation message. This restores the default routing path for the misjudged legitimate source IP addresses and simultaneously sends an internal cleanup command to the data processing module and the feature conversion module to reset the execution status.

[0076] See attached document Figure 2 This invention provides an automatic blocking method for network attacks based on traffic feature recognition, comprising the following steps:

[0077] S100 bypasses the acquisition of Transmission Control Protocol (TCP) messages entering the network boundary, uses a consistent hashing algorithm to perform dimensionality reduction mapping on the source IP address of the message, extracts the connection state asymmetry ratio within a discrete time window, and calculates the average round-trip time and delay jitter deviation of the network path.

[0078] S200: The state asymmetry ratio within the cached continuous time window is used to construct a co-pulse matrix. The discrete Fourier transform of the row vectors of the co-pulse matrix is ​​performed to extract frequency domain parameters. When the frequency domain amplitude exceeds the white noise tolerance baseline, the set of suspected source IP addresses is output.

[0079] S300 constructs a zero-window probe message with the sliding window field of the Transmission Control Protocol header set to zero, encapsulates the suspected source IP address set into a Border Gateway Protocol Flow Specification message and sends it to the upstream core router, and modifies the next-hop attribute of the route to establish a bidirectional traffic visibility path for the suspected source IP address set.

[0080] S400 calculates the absolute prediction timestamp and hardware trigger timestamp based on frequency domain parameters and the average round-trip delay and delay jitter deviation of the network path. It calculates the total number of packets based on the frequency domain amplitude and modulates and generates a probe packet sequence. At the hardware trigger timestamp, it sends a probe packet sequence with a forged status and a specific acknowledgment number to the set of suspected source IP addresses.

[0081] S500 captures the response messages of the suspected source IP address set to the transmission control protocol probe message, generates a protocol stack fingerprint vector, combines the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and separates the legitimate source IP addresses and outputs the malicious source IP address set through distance calculation in three-dimensional space and spatial clustering algorithm.

[0082] S600 converts the set of malicious source IP addresses into network hardware access control list rules for data plane blocking, triggers the control plane to revoke the redirection routes of legitimate source IP addresses, and simultaneously performs memory cleanup of internal data states.

[0083] The steps in the above method will be described in detail below with reference to specific implementation methods.

[0084] See attached document Figure 3 The method provided by the present invention mainly performs extraction, dimensionality reduction and compression, and abnormal state quantification calculation of the underlying network packets through the data processing module in step S100.

[0085] S101, the data processing module acquires the raw network data stream through the mirror port configured at the network boundary device. It then performs protocol stack decoding on the acquired network data stream, extracting a five-tuple containing the source IP address, destination IP address, source port, destination port, and transport layer protocol type. After parsing, it performs filtering and discarding operations on packets that are not Transmission Control Protocol (TCP) types, retaining only TCP packets for subsequent processing. Regarding the technical implementation details of bypass packet capture at the underlying network interface, those skilled in the art can use mature frameworks such as data plane development kits to achieve line-rate acquisition; the specific mechanisms are well-known in the field and will not be elaborated here.

[0086] S102, the data processing module performs stateless dimensionality reduction mapping based on the source IP addresses in the aforementioned quintuple data. Using the built-in consistent hashing algorithm, it maps the discretely distributed massive source IP address space to a fixed number of virtual hash buckets. The number of virtual hash buckets is set to... The index of a single virtual hash bucket is denoted as ,and This hash mapping mechanism avoids the risk of memory exhaustion caused by creating separate tracking entries for a single source IP address. Under normal network topology conditions, the number of virtual hash buckets... The value is statically configured based on the upper limit of the underlying hardware device's memory capacity, and is usually set to 10. 4 Up to 10 6 between.

[0087] S103, after completing the dimensionality reduction mapping, the data processing module continuously aggregates and statistically analyzes the connection states associated with each virtual hash bucket and calculates the state asymmetry ratio within a set discrete time window. The system divides the time axis into consecutive discrete time windows of equal length, and the index of the discrete time window is denoted as... During this period, corresponding connection state machine entries are maintained within each virtual hash bucket in accordance with the Transmission Control Protocol (TCP) specifications to monitor message interaction status.

[0088] Furthermore, in the The index is calculated within each discrete-time window. The virtual hash bucket state asymmetry ratio. This ratio is a mathematical quantification of the incomplete interaction response characteristics between network communication nodes. Specifically, it involves extracting the number of sessions in different protocol state stages within the discrete time window and substituting them into the following formula to complete the calculation: ;

[0089] in, For index The virtual hash bucket in the first The ratio of state asymmetry within a discrete time window; The total number of sessions in the half-connection state, including the number of connection records in the Transmission Control Protocol state machine that are in the Synchronized Send or Synchronized Receive state. This represents the total number of sessions that are in an established state but whose receiver notification sliding window remains at zero. The total number of sessions where unidirectional data transmission has not received an acknowledgment message after exceeding the preset retransmission timeout threshold; The total number of sessions that complete a normal closed state transition includes the number of connection records that are closed via a standard four-way handshake or a forced closure via a receive reset flag. and This is the penalty weighting coefficient for abnormal protocol states, used to adjust the weight of specific protocol violations in the judgment calculation. The value range is set between 1.0 and 5.0, and it is pre-configured by network administrators according to the strictness of the security policy. The constant limit factor, which prevents the denominator from being zero and causing a system overflow exception, is configured in the range of 0.01 to 0.1.

[0090] The preset retransmission timeout threshold is used to determine whether network packets have suffered physical transmission loss or have been intentionally and silently discarded by malicious packet-sending tools. This threshold is determined with reference to the default timeout and retransmission specifications of the underlying operating system's transmission control protocol stack. In actual system deployment, administrators assign a static value based on the actual cross-regional communication latency of the protected network. The preset retransmission timeout threshold is set between 200ms and 3000ms. If no acknowledgment sequence number update is received from the peer after this threshold, the data processing module determines that the session is in an abnormal one-way transmission state and records it. In the statistics.

[0091] Through this quantization formula, the discrete and complex underlying message states are converted into continuous numerical variables and output to the feature conversion module.

[0092] In step S100 of the method provided by the present invention, the data processing module performs passive extraction of network physical delay parameters in parallel while calculating the state asymmetry ratio.

[0093] S104, the data processing module extracts the timestamp information of messages from normally established Transmission Control Protocol (TCP) connections within the virtual hash bucket. Specifically, it extracts the physical time difference between the server sending a synchronization acknowledgment message and receiving the client's final acknowledgment message. In some network traffic where the timestamp extension option is enabled, it can also extract the round-trip time difference between data packets carrying timestamp options and their corresponding acknowledgment messages.

[0094] The data processing module uses the calculated time difference as the newly acquired valid round-trip time measurement value within the current time window, denoted as... For the technical implementation of matching and tracking Transmission Control Protocol (TCP) sequence numbers and acknowledgment numbers, those skilled in the art can use mature network session reassembly mechanisms. The message association matching mechanism is a well-known technology in this field and will not be elaborated here.

[0095] S105, to eliminate the drastic fluctuations caused by instantaneous network congestion in a single measurement, the data processing module uses an exponentially weighted moving average algorithm to calculate the average round-trip time of the network path associated with the virtual hash bucket. In the... Within the discrete time window, retrieve the first... The average round-trip time for each discrete time window. Combined with the currently acquired effective connection round-trip time measurements. Substitute the following smoothing formula into the calculation: ;

[0096] in, For index The virtual hash bucket in the first Average round-trip time within a discrete time window; The time delay smoothing factor controls the weight of the latest measurement in the overall mean assessment. It balances the sensitivity and stability of the time delay assessment. The value range is set between 0.125 and 0.25; This represents the newly acquired valid round-trip time measurement value within the current time window; For index The virtual hash bucket in the first Average round-trip time within a discrete time window.

[0097] S106, the dynamic fluctuation characteristics of the network path are also a key compensation parameter for calculating the timing of subsequent perturbation message transmission. After calculating the average round-trip time, the data processing module continues to calculate the delay jitter deviation of the physical network path. Effective connection round-trip time measurements are extracted. With the The absolute deviation of the average round-trip delay for each discrete time window is calculated, and a jitter smoothing factor is introduced for iterative updating. The specific formula is as follows: ;

[0098] in, For index The virtual hash bucket in the first Delay jitter deviation within a discrete time window; This is a jitter smoothing factor used to filter out occasional extreme network latency spikes that interfere with the overall jitter assessment. The value range is set between 0.2 and 0.3; This represents the newly acquired valid round-trip time measurement value within the current time window; For index The virtual hash bucket in the first Average round-trip time within a discrete time window; For index The virtual hash bucket in the first Delay jitter deviation within a discrete time window.

[0099] After completing the above calculations, the data processing module will use the generated average round-trip time delay and delay jitter deviation as dynamic compensation parameters for the physical communication path, and output them synchronously to the detection and control module for subsequent calculations.

[0100] See attached document Figure 4 In step S200 of the method provided by the present invention, the feature conversion module receives the calculation results output by the data processing module and constructs the basic data structure for subsequent frequency domain analysis.

[0101] S201, the feature conversion module and the data processing module maintain synchronous communication, receiving the state asymmetry ratio of each virtual hash bucket. To extract the periodic rhythmic features of network traffic over time, a cache space based on a sliding window mechanism is allocated in memory. The observation length of the sliding window is set to... A continuous discrete-time window. Considering the alignment requirements of the Fast Fourier Transform algorithm when performing the Discrete Fourier Transform subsequently, the observation length... The value is set to an integer power of 2, and can be 64, 128, or 256.

[0102] S202, the feature conversion module utilizes cached historical sequence data to perform the current sequence... A co-pulse matrix with two dimensions (space and time) is constructed using discrete-time windows. The spatial dimension of this matrix consists of all virtual hash buckets, corresponding to the matrix's row vectors; the temporal dimension consists of consecutive discrete-time windows within the sliding window, corresponding to the matrix's column vectors. The state asymmetry ratios in the corresponding time and spatial coordinates are then filled into the matrix elements, resulting in the following co-pulse matrix: ;

[0103] in, In the first A cooperative pulse matrix constructed from discrete time windows; This represents the observation length of the sliding window, i.e., the number of discrete-time windows contained in the matrix; This represents the number of virtual hash buckets, corresponding to the total number of rows in the matrix. For the index of the virtual hash bucket, and ; For index The virtual hash bucket in the first The ratio of state asymmetry within a discrete time window.

[0104] S203, the cooperative impulse matrix is ​​dynamically updated as the network time progresses. When the... After calculating the state asymmetry ratio for each discrete-time window, the feature transformation module performs a shift operation on the matrix column vectors in memory. Specifically, this involves removing the oldest column vector in the matrix. The data columns corresponding to the discrete time windows, and the latest generated data column. The data columns of each discrete time window are appended to the rightmost side of the matrix. For the technical implementation of column-wise translation and overlay of two-dimensional arrays or matrices in memory, those skilled in the art can use methods such as circular queues or memory blocks moving byte by byte. The underlying memory reuse mechanism is a well-known technology in the field and will not be described in detail here.

[0105] Through the matrix construction process within the sliding window described above, the originally scattered one-dimensional state indicators are integrated into a structured time series matrix, providing a standardized data source for subsequent identification of the fixed frequency characteristics of automated packet sending tools.

[0106] In step S200 of the method provided by the present invention, after generating the cooperative pulse matrix, the feature conversion module further identifies potential periodic rhythmic features in network traffic through frequency domain analysis.

[0107] S204, the feature transformation module reads the data of the co-pulse matrix line by line. For index... The virtual hash bucket is used to extract data from the observed length of the data. The state asymmetry ratio sequence within the sliding window. The feature transformation module performs a Discrete Fourier Transform on this one-dimensional time-domain sequence, transforming the time-based discrete state sequence to the frequency domain. The specific calculation process of the Discrete Fourier Transform is expressed as follows: ;

[0108] in, For index The virtual hash bucket at the discrete frequency index is The frequency domain complex value at that location; This is a discrete frequency index, with values ​​ranging from 0 to... ; Indicates to From 0 to Perform a summation operation; This is the time offset index, with a value range of 0 to... ; For index The ratio of the state asymmetry of the virtual hash bucket at the corresponding offset time; This represents the observation length of the sliding window; is the base of the natural logarithm; The imaginary unit; Pi is the mathematical constant of a circle.

[0109] For the implementation of reducing the time complexity of Discrete Fourier Transform using the Fast Fourier Transform algorithm in computer systems, those skilled in the art can call standard mathematical computing libraries to complete it. Its underlying butterfly operation logic is a well-known technology in this field and will not be described in detail here.

[0110] S205, the Discrete Fourier Transform output is a complex sequence. Due to limitations in computational resources and stealth requirements, automated attack tools often exhibit low-frequency periodic pulses in their packet transmission behavior. The feature conversion module extracts the dominant frequency component of the low-frequency band based on the complex sequence. To quantify this periodic characteristic, the feature conversion module calculates the frequency domain amplitude and initial phase angle corresponding to each frequency component. The frequency domain amplitude characterizes the intensity of the specific periodic pattern, and the initial phase angle characterizes the initial offset position of the periodic rhythm on the time axis. The specific calculation formula is as follows:

[0111] ;

[0112] ;

[0113] in, For index The virtual hash bucket in the corresponding discrete frequency index Frequency domain amplitude at that point; For index The virtual hash bucket in the corresponding discrete frequency index The initial phase angle at the location; It is the arctangent function; For frequency domain complex values The real part; For frequency domain complex values The imaginary part.

[0114] The feature conversion module searches for the maximum frequency domain amplitude within the effective frequency range after removing the DC component, and determines the maximum value and its corresponding initial phase angle as the low-frequency main frequency component feature representing the behavior pattern of the virtual hash bucket.

[0115] S206, after extracting the low-frequency main frequency component, the feature conversion module performs threshold-based anomaly detection. The system internally uses a white noise tolerance baseline as a reference. This white noise tolerance baseline is used to filter spectral noise generated by random fluctuations in normal network background traffic. The value of the white noise tolerance baseline is calculated by statistically analyzing the mean and standard deviation of the frequency domain amplitude of normal traffic over a long period under stable, attack-free network conditions. In actual deployment, the white noise tolerance baseline is configured to be 3 to 5 times the mean of the frequency domain amplitude of normal background traffic.

[0116] The feature conversion module compares the extracted maximum frequency domain amplitude with the white noise tolerance baseline. When the frequency domain amplitude exceeds the white noise tolerance baseline, it indicates that the network traffic aggregated within the virtual hash bucket exhibits highly regular machine packet sending characteristics. The feature conversion module then locks the index of the virtual hash bucket that triggered the decision. Based on the previously reduced-dimensionality mapping entries, the system reverse-parses and extracts all currently active source IP addresses within the virtual hash bucket. These addresses are then combined to generate a set of suspected source IP addresses, which, along with the extracted frequency domain amplitude and initial phase angle, are output to subsequent modules, providing a target basis for micro-traffic diversion and detection blocking.

[0117] See attached document Figure 5 In step S300 of the method provided by the present invention, the detection control module actively sends a detection message to the target node to verify its true protocol stack state based on the abnormal clues output by the front-end module.

[0118] S301, the probe control module receives the set of suspected source IP addresses output by the feature conversion module. For each suspected source IP address in the set, the probe control module retrieves the connection state machine entry maintained in the data processing module, extracts the five-tuple information of the active connection associated with that suspected source IP address, and the sequence number and acknowledgment number of the current Transmission Control Protocol (TCP) connection. This connection context data forms the basis for the subsequent network layer and transport layer addressing of the reverse probe message.

[0119] S302, To verify whether the aforementioned suspected source IP address is controlled by an automated packet sending tool, the detection and control module initiates a micro-traffic redirection detection mechanism. The core of this mechanism lies in constructing and sending zero-window probe packets to forcibly test the protocol stack response integrity of the target terminal. The detection and control module uses the extracted five-tuple information as a template to perform protocol stack packet reconstruction, swapping the source IP address and destination IP address, and the source port and destination port, thereby simulating a protected server sending data to a suspected attack source.

[0120] In S303, during the protocol encapsulation process, the probe control module forcibly sets the sliding window field of the Transmission Control Protocol (TCP) header to zero and clears the payload data, constructing a zero-window probe packet. Upon receiving the zero-window probe packet, the underlying protocol stack of a normal host operating system will enter the zero-window probe state according to the protocol specification and immediately suspend the transmission of subsequent business data. Conversely, most crude automated packet sending tools, in pursuit of attack speed and limited by development costs, often do not implement a complete TCP state machine and will ignore this zero-window announcement and continue to push packets to the server. Modifications to the underlying network packet header fields, address swapping, and checksum recalculation can be accomplished by those skilled in the art using the packet operation interface provided by the data plane development kit. The packet reassembly and protocol encapsulation mechanisms are well-known technologies in the field and will not be elaborated upon here.

[0121] S304, To establish a precise correlation channel between the probe message and the subsequent target response message, the probe control module inserts a custom probe identifier into the Transmission Control Protocol (TCP) option field of the zero-window probe message. This probe identifier is generated using a cryptographic hash algorithm to compress and calculate the current context information. The specific calculation formula is as follows: ;

[0122] in, The generated custom probe identifier is encapsulated in the Transmission Control Protocol's timestamp option or custom extended option field; It is a built-in one-way encrypted hash function, configured as a secure hash algorithm during deployment to ensure a uniform distribution of hash results; This refers to the IP address of the suspected source currently being detected; This indicates a data bit concatenation operation; It serves as an index for discrete time windows, used to ensure the diversity of detection markers within different time periods; The random salt value generated by the detection control module during system initialization has a static length of 64 bits to prevent replay spoofing of the detection identifier; The maximum numerical space allowed for the identifier in the Transmission Control Protocol (TCP) Options field. This maximum numerical space is specified when using a standard timestamp-extended options field. The value is set to 2. 32 .

[0123] After completing the above protocol encapsulation and identifier embedding, the detection control module temporarily stores the generated zero-window probe message in the memory transmission queue, waiting to calculate the optimal timing for perturbation transmission before sending it to the underlying physical network interface.

[0124] In step S300 of the method provided by the present invention, after the probe control module has completed the encapsulation of the zero-window probe message, it performs route optimization to ensure the accurate return of probe response traffic.

[0125] S305, the probe control module analyzes the current network's physical deployment architecture. In bypass mirror deployment mode, the device only receives network data streams in one direction. If a probe packet with a forged source IP address representing a protected server is sent directly to the suspected source IP address, the response packet returned by the target terminal will be forwarded directly to the real protected server according to the upstream device's default routing table, preventing the probe device from intercepting the verification response. To overcome the probe blind spot caused by this physical asymmetric path, the probe control module generates a fine-grained redirection strategy for specific service flows.

[0126] S306, the detection and control module establishes a border gateway protocol flow specification peer connection with the upstream core router at the network boundary through the control plane management interface. The detection and control module extracts addresses from the suspected source IP address set as source address prefixes in the matching conditions, and uses the corresponding protected server IP address as the destination address prefix. Combined with the transport layer protocol type and port number, it constructs fine-grained traffic filtering rules.

[0127] S307, the probe control module encapsulates extended community attributes in the generated route update message, forcibly modifying the next hop of network traffic matching the filtering rule. Specifically, it changes the default next-hop network address to the IP address of the logical network interface bound to the probe control module. Upon receiving this update message, the upstream core router issues a high-priority policy routing table entry in its underlying forwarding table, forcibly redirecting the target response traffic to the probe control module. The construction of the border gateway protocol route update message and the maintenance of the neighbor session state machine can be accomplished by those skilled in the art using mature open-source routing software suites; the underlying protocol interaction mechanism is well-known in the field and will not be elaborated upon here.

[0128] S308. If a large number of discrete micro-redirection strategies remain active for an extended period, it will cause memory overflow and degraded forwarding performance of the upstream core router. The detection and control module assigns a dynamically calculated lifecycle threshold to each redirection strategy. This threshold is adaptively set in conjunction with the physical latency parameters collected in step S100 to ensure that the duration of the redirection channel precisely covers the round-trip and processing cycle of packets. The specific calculation formula is as follows: ;

[0129] in, The lifecycle threshold for the micro-traffic redirection routing strategy; For index The virtual hash bucket in the first Average round-trip time within a discrete time window; A constant buffer time is used to absorb the time consumed by the target terminal's underlying protocol stack in processing packets and sudden latency jitter on the network path. To balance channel integrity and routing table update efficiency, a constant buffer time is also included. The value range is configured to be from 1.5s to 3.0s.

[0130] S309, after sending a route update message, the probe control module synchronously starts its internal lifecycle timer. The timer continues until the lifecycle threshold is exceeded. Within the effective window period, the probe control module injects zero-window probe packets from the sending queue into the physical network and continuously listens for packet responses within the redirection channel. Once the timer reaches this lifecycle threshold, the probe control module immediately sends a route revocation message to the upstream core router, clears the corresponding policy routing table entry, and restores the network's original asymmetric forwarding path. This mechanism enables the on-demand construction and rapid destruction of probe channels, avoiding long-term interference with the normal service forwarding plane.

[0131] See attached document Figure 6 In step S400 of the method provided by the present invention, the detection control module calculates the optimal timing for sending the detection message based on the extracted periodic rhythm and network physical delay parameters, thereby implementing precise dynamic perturbation injection.

[0132] S401, the detection control module receives the main frequency component feature output by the feature conversion module. This feature contains a discrete frequency index characterizing the transmission pattern of the suspected traffic. The detection control module, combined with the discrete time window physical step size configured during system initialization, calculates the physical time period of the suspected target's transmitted packets. The calculation formula is expressed as: ;

[0133] in, The physical time period for sending messages to a suspected target; This represents the observation length of the sliding window; The physical duration of a single discrete time window. The value of this parameter is set according to the statistical granularity of the basic traffic of the protected network, and its value range is configured to be between 100ms and 1000ms. For discrete frequency indexes.

[0134] S402, the detection control module predicts the absolute timestamp of the next wave of data packets from the target terminal arriving at the local detection node based on the physical time period and the initial phase angle output by the feature conversion module. The detection control module reads the hardware clock of the current operating system to obtain the physical time reference for the current moment. It calculates the phase offset within the current packet transmission period using the initial phase angle and maps this phase offset to a relative deviation in physical time. The detection control module adds the current physical time reference to this relative deviation to generate the absolute predicted timestamp of the next wave of suspected packets arriving at the network boundary, denoted as […]. The technical implementation of operating system timer calls and hardware timestamp acquisition can be accomplished by those skilled in the art through the system's underlying clock application programming interface. The clock reading and synchronization mechanisms are well-known technologies in the field and will not be elaborated upon here.

[0135] S403. Signal propagation delays exist in the physical network. If zero-window probe packets are sent solely based on absolute predicted timestamps, by the time the probe packet arrives at the target terminal, the target has already pushed new attack packets into the physical link. The probe control module obtains the network path dynamic compensation parameters provided by the data processing module and performs lead compensation calculations on the timing of packet transmission. This step aims to offset the one-way propagation time of the packet in the network, ensuring that the probe packet is successfully received and parsed before the suspect's underlying protocol stack prepares to assemble the next wave of packets.

[0136] S404, the probe control module retrieves the average round-trip latency record of the currently associated virtual hash bucket and calculates the precise delivery time node by combining it with the terminal processing tolerance. This is based on the absolute predicted timestamp. With the local node as a reference, the actual packet sending action of the target terminal advances the one-way transmission delay. The probe control module also needs to calculate its own one-way transmission time for sending probe packets; the two combined constitute a complete round-trip delay. The specific formula for calculating the absolute timestamp is: ;

[0137] in, The absolute timestamp for the delivery of zero-window probe packets from the probe control module to the underlying network interface card; The absolute predicted timestamp for the next wave of suspicious messages to arrive at the local detection node; For index The virtual hash bucket in the first The average round-trip delay within a discrete time window is used to offset the round-trip transmission time on the communication link; The protocol stack handles compensation constants to allow time for the target host's operating system to parse zero-window probe packets and update its internal state machine. To accommodate differences in interrupt responses across different operating systems, the protocol stack handles compensation constants. The value range is configured to be between 10ms and 50ms.

[0138] After completing the above calculations, the detection control module pushes the zero-window detection message carrying the absolute transmission timestamp into the high-precision transmission scheduling queue, waiting for the hardware timer to trigger the corresponding network transmission event.

[0139] In step S400 of the method provided by the present invention, after calculating the absolute transmission timestamp, the detection control module further combines the frequency domain amplitude and time delay jitter characteristics to perform parameter modulation and high-precision transmission of the detection message.

[0140] S405, the detection control module extracts the frequency domain amplitude output by the feature conversion module. The frequency domain amplitude objectively reflects the periodic intensity of the suspected target's packet-sending behavior. To ensure that the detection behavior sufficiently triggers the target's underlying state response, while avoiding injecting excessive invalid traffic into the network and causing congestion, the detection control module dynamically modulates the number of zero-window detection packets sent based on this frequency domain amplitude. The specific formula for calculating the number is as follows: ;

[0141] in, This represents the total number of messages contained in the probe message sequence generated after amplitude modulation. This is a function that takes the minimum value and is used to limit the upper limit of the output result; This is a floor function to ensure that the number of messages is an integer; This is the modulation gain factor, used to control the rate at which the number of packets increases with the attack intensity. In actual system deployment, administrators assign a static value based on the bandwidth redundancy of the protected network, with the value ranged between 1.5 and 2.5. For index The virtual hash bucket in the corresponding discrete frequency index Frequency domain amplitude at that point; For the index of the virtual hash bucket; The white noise tolerance baseline configured in the feature transformation module; The maximum number of burst messages allowed for a single perturbation injection in the system is set between 3 and 5.

[0142] S406, when the calculated total number of messages When the value is greater than 1, the probe control module copies zero-window probe packets in the sending queue to construct a probe packet sequence. During this process, the probe control module specifically forges the Transmission Control Protocol (TCP) parameters of the copied packets. Specifically, it keeps the source port, destination port, and sequence number in the protocol header unchanged, while uniformly fixing the acknowledgment number to the sequence number of the latest packet sent by the target terminal. This continuous sending of zero-window probe packets with the same acknowledgment number simulates an extreme network congestion state in the real protocol stack, characterized by a full receiver buffer and packet loss. Following TCP specifications, a legitimate operating system receiving consecutive duplicate acknowledgment packets will unconditionally trigger the fast retransmission mechanism. Automated packet sending tools typically lack complete processing logic for such complex network states; this targeted parameter forgery provides a distinguishing dimension for subsequent authenticity verification.

[0143] S407, To eliminate the interference of occasional delay jitter on the physical network path on the accurate arrival time, the detection control module introduces the delay jitter deviation calculated in step S100 to perform a secondary correction on the previously generated absolute transmission timestamp. The delay jitter deviation reflects the uncertain delay in the message transmission process. The detection control module uses this variance to fine-tune the lead time and calculates the final hardware trigger timestamp. The specific formula is as follows: ;

[0144] in, The hardware trigger timestamp for the detection control module to send the detection message sequence to the underlying network interface controller; This is the previously calculated absolute distribution timestamp; The jitter compensation coefficient is used to control the impact of latency fluctuations on transmission timing. It balances the accuracy and fault tolerance of transmission timing. The value range is configured to be between 0.5 and 1.5; For index The virtual hash bucket in the first Delay jitter deviation within a discrete time window.

[0145] S408, the detection control module modulates the detection message sequence and the corresponding hardware trigger timestamp. The data is then sent down to the underlying network interface controller. The network interface controller relies on an internal high-precision hardware crystal oscillator for independent timing. When the hardware time matches the set hardware trigger timestamp, the underlying driver bypasses the operating system's kernel network stack and pushes the probe packet sequence directly into the physical link using direct memory access technology. For the technical implementation of high-speed packet delivery and hardware-timed transmission bypassing the kernel protocol stack, those skilled in the art can use the direct hardware queue operation interface provided by the data plane development kit. Its zero-copy transmission and network card clock synchronization mechanism are well-known technologies in the field and will not be elaborated upon here.

[0146] See attached document Figure 7 In step S500 of the method provided by the present invention, the feature analysis module runs after establishing a bidirectional visible path for traffic, receives the network traffic returned by the micro-redirection of the routing control module, extracts the protocol stack response status of the terminal's underlying layer, and converts it into a structured mathematical vector.

[0147] S501, the feature analysis module continuously monitors the data packets flowing back into the micro-channel via the bound logical network interface. Whenever a new Transmission Control Protocol (TCP) packet is captured, the feature analysis module parses its timestamp option or custom extended option field to extract the probe identifier. The feature analysis module then matches the extracted probe identifier with the sending queue records maintained in system memory. If the probe identifier is completely consistent with the custom probe identifier generated by the probe control module, the packet is determined to be a low-level protocol stack response packet from the suspected target to the probe packet, and is sent to the internal feature extraction process. The high-speed capture and header field parsing of network packets can be achieved using a zero-copy packet capture framework, whose packet interception and filtering mechanisms are well-known in the field and will not be elaborated upon here.

[0148] The S502 automated packet sending tool, in order to reduce computational resource consumption, uses a hard-coded method to generate network packet headers. Upon receiving probe packets, it cannot exhibit the complex state machine response behavior of a complete operating system. The feature analysis module performs multi-dimensional protocol stack fingerprint extraction on the underlying protocol stack response packets. Specifically, the extracted discrete features cover key fields of the network and transport layers, including the Time-to-Live (TTL) field and IP identifier generation rules extracted from the network layer IP header, and the Transmission Control Protocol (TCP) option sequence extracted from the transport layer header. This underlying protocol state data objectively reflects the true operating environment of the packet sender's kernel network stack response characteristics.

[0149] S503, the feature analysis module transforms the extracted unstructured discrete features into a unified numerical format to construct feature components. For the Time-to-Live (TTL) field, the feature analysis module calculates the absolute difference between the received TTL value and the default initial threshold of common operating systems (such as 64, 128, or 255), generating the routing hop count feature component. For the IP identifier generation rules, it analyzes the identifier change trend of consecutively arriving packets, mapping different patterns such as globally increasing, connection-based increasing, completely random, or fixed to preset discrete state codes. For the Transmission Control Protocol (TCP) option sequence, a lightweight hash function is used to map the arrangement of options such as maximum segment length, window scaling factor, timestamp, and selective acknowledgment to discrete integer index values.

[0150] S504, after completing the numerical mapping of discrete features, the feature analysis module targets the index as... The suspected source IP address is identified, and all feature components extracted within the current operation cycle are concatenated to generate an initial fingerprint feature vector. To eliminate interference from differences in numerical ranges between different feature components in subsequent tensor space distance calculations, the feature analysis module uses a min-max normalization algorithm to linearly transform the initial vector, scaling the values ​​of each dimension to the range of 0 to 1. The formula for calculating the normalized fingerprint feature vector is expressed as: ;

[0151] in, For index The protocol stack fingerprint vector generated after normalizing the suspected source IP address; For index The initial fingerprint feature vector is generated by concatenating the suspected source IP addresses; This is the index of the suspected source IP address within the set of suspected source IP addresses; The preset feature component theoretical minimum value vector is statically configured by the system according to the lower limit value of each discrete feature mapping rule; The preset feature component theoretical maximum value vector is statically configured by the system according to the upper limit values ​​of each discrete feature mapping rule. The subtraction and division operations in the above formulas represent bit-by-bit calculations between corresponding elements of the vector.

[0152] After the feature analysis module generates the protocol stack fingerprint vector, it temporarily stores the vector in memory as the basis for converting it into spatial discrete dimensions and constructing a three-dimensional state tensor.

[0153] In step S500 of the method provided by the present invention, after generating a one-dimensional protocol stack fingerprint vector, the feature analysis module mathematically fuses it with the matrix data constructed in the previous step, and performs precise stripping of abnormal entities in a high-dimensional space.

[0154] S505, after the feature analysis module extracts the protocol stack fingerprint vectors of all suspected source IP addresses, it retrieves the co-pulse matrix cached by the feature conversion module across modules. This matrix records the state asymmetry ratio of each virtual hash bucket over time. To establish a mathematical model that comprehensively reflects the target time pulse rhythm and the underlying protocol state, the feature analysis module converts the protocol stack fingerprint vectors into spatial discrete dimensions and combines them with the co-pulse matrix to generate a three-dimensional state tensor. In specific implementation, the feature analysis module uses tensor outer product operations to orthogonally project and expand the one-dimensional protocol features and two-dimensional spatiotemporal features. The formula for calculating the elements of the three-dimensional state tensor is expressed as: ;

[0155] in, The tensor element values ​​corresponding to the coordinates in the generated 3D state tensor; This is the index of the currently being processed suspected source IP address within the set of suspected source IP addresses; This is the time offset index, with values ​​ranging from 0 to... ; This represents the observation length of the sliding window; For the index of the discrete-time window; For the index of the suspected source IP address in the coordinated pulse matrix. Virtual hash bucket index of mapping association The matrix element values ​​at the corresponding historical moment; This is the spatial discrete dimension index after the protocol stack fingerprint vector is transformed, with values ​​ranging from 1 to... ; This represents the total number of feature components in the protocol stack fingerprint vector; For index After the suspected source IP address is normalized, the protocol stack fingerprint vector is in the 1st step. Numerical values ​​in discrete dimensions of space.

[0156] S506, after constructing a three-dimensional state tensor encompassing source address indexes, temporal evolution, and protocol space features, the feature analysis module prepares to perform classification matching along the discrete dimensions of this tensor space. To measure the behavioral similarity of different suspected source IP addresses in the multi-dimensional feature space, the feature analysis module calculates the spatial distance between the two-dimensional slices of the tensor corresponding to different addresses. This distance is measured using the Frobenius norm, and its specific calculation formula is as follows: ;

[0157] in, For index The suspected source IP address and index are The Euclidean distance of the suspected source IP address in the tensor slice within the three-dimensional state tensor space; and These represent the time offset indexes of the two suspected source IP addresses. Spatial Discrete Dimension Index The values ​​of the tensor elements below; and These represent the accumulation operations on the time window range and the discrete spatial dimension range, respectively.

[0158] S507, the feature analysis module, based on the spatial distance matrix calculated above, calls a density-based spatial clustering algorithm to cluster the set of suspected source IP addresses. The system presets a clustering neighborhood radius threshold and a minimum number of samples for core objects. The clustering neighborhood radius threshold is used to define the tolerance boundary between adjacent entities; based on the normalized tensor space distribution characteristics, this threshold is configured to range from 0.15 to 0.25. The minimum number of samples for core objects is used to determine whether a valid cluster is formed; its value range is configured from 3 to 5. The feature analysis module searches for high-density connected regions based on these two parameters, aggregating IP addresses with highly consistent behavioral patterns into the same cluster.

[0159] After spatial clustering, the feature analysis module in S508 performs entity identification and stripping on each cluster. In real production networks, normal terminals that are misjudged due to improper configuration or the aggregation of network address translation devices will generate compliant TCP options and identifiers for probe packets in their underlying operating systems. These devices exhibit high compactness in the spatial discrete dimension of the three-dimensional state tensor, thus aggregating into highly dense feature clusters. The feature analysis module separates legitimate source IP addresses that conform to the response characteristics of the normal operating system kernel network stack by comparing them with pre-built operating system fingerprint benchmark clusters. The operating system fingerprint benchmark clusters are pre-built in the following way: during system initialization or periodic maintenance, standard response characteristics of various known types of operating systems (including but not limited to Windows series, Linux series, macOS series, and various mainstream embedded operating systems) in the three-dimensional state tensor space are collected. Cluster analysis is performed on the response characteristics of similar operating systems to generate fingerprint benchmark cluster centers and cluster boundaries corresponding to various operating systems, which are stored in the system configuration database for online matching and retrieval.

[0160] Conversely, automated attack tools, lacking a complete Transmission Control Protocol (TCP) state machine, cannot provide effective protocol negotiation responses to probe perturbations, resulting in scattered, isolated points or distorted clusters in spatial discreteness. The feature analysis module unifies the remaining isolated objects and anomalous clusters after stripping legitimate source IP addresses, generating a set of malicious source IP addresses that do not produce a standard state machine response. This set of malicious source IP addresses, along with the previously separated list of legitimate source IP addresses, is then synchronously output to the policy execution module. This process effectively eliminates false alarm noise caused by relying solely on traffic statistics, providing reliable target data for subsequent accurate strikes and route recovery.

[0161] See attached document Figure 8 In step S600 of the method provided by the present invention, the policy execution module generates a low-level blocking instruction and implements physical isolation of the network data plane based on the final identification result output by the feature analysis module.

[0162] S601, the policy execution module receives the set of malicious source IP addresses and the list of legitimate source IP addresses output by the feature analysis module. For each malicious source IP address in the set, the policy execution module extracts its network address information as the basis for matching the blocking target, and queries the violation history database maintained internally by the system to obtain the cumulative number of times the IP address has been identified as an automatic attack source in the past. The violation history database adopts a key-value pair storage structure, with the source IP address as the key and a structured record containing the timestamp of each violation judgment, the virtual hash bucket index of the judgment, and the cumulative number of violations as the value; when the database storage space reaches a preset threshold, the system evicts the oldest violation record according to the first-in-first-out or least recently used strategy. This cumulative number will be used to dynamically calculate the blocking penalty duration to deal with continuous and repeated attack behaviors.

[0163] In S602, to implement hardware-level blocking on physical network devices, the policy enforcement module converts a set of malicious source IP addresses into network hardware access control list rules. During rule compilation, the policy enforcement module extracts the target device's vendor identifier and operating system version number, and calls the corresponding syntax template library for instruction translation. Specifically, the compilation operation involves configuring the malicious source IP address as the source address matching item of the rule, and configuring the corresponding wildcard mask to precisely match a single host. Simultaneously, the rule's action field is set to a drop action, and the rule is assigned an execution priority higher than the default forwarding policy, thereby generating an underlying network hardware-identifiable access control list rule.

[0164] After completing rule compilation (S603), the policy enforcement module issues a data plane drop instruction to downstream network forwarding devices via the network configuration protocol. The policy enforcement module establishes management connections with one or more downstream core switches and firewalls within the network boundary. In practice, the policy enforcement module encapsulates the compiled access control list rules using a network management protocol message based on Extensible Markup Language (XML) and issues it to the data plane of the target forwarding device. After the underlying forwarding table of the downstream network forwarding device receives and loads the instruction, once a subsequent packet from the aforementioned malicious source IP address is matched, the network hardware's switching chip will directly physically drop the packet at the interface, completing data plane blocking. The technical implementation of the underlying network device configuration interface call and XML model encapsulation can be accomplished by those skilled in the art using standard network management middleware; its device communication and instruction issuance mechanisms are well-known technologies in the field and will not be elaborated upon here.

[0165] S604, access control list forwarding table entries on hardware devices are limited by physical storage resources. To prevent network device memory exhaustion due to long-term rule accumulation, the policy enforcement module configures a dynamic lifecycle for each issued blocking rule. The policy enforcement module combines an exponential backoff algorithm mechanism to calculate the blocking aging timestamp of the rule based on the IP address's violation history. The specific calculation formula is expressed as follows: ;

[0166] in, For index The blocking aging timestamp of the access control list rules corresponding to the malicious source IP address; The timestamp of the current physical system when the policy execution module issues the discard command; The basic blocking duration constant is used to strike a balance between intercepting attacks and releasing network resources. The value range is configured to be from 300s to 600s; For index The cumulative number of times the malicious source IP address has been recorded in the system's violation history database; The maximum backoff index limit configured for the system is used to prevent the duration of a single blocking operation from increasing indefinitely and causing permanent network isolation. The value range is configured to be 3 to 5; This is the index of the malicious source IP address within the set of malicious source IP addresses; This is a function that takes the minimum value and outputs the smaller of the two variables within the parentheses.

[0167] S605, the policy execution module internally starts a status monitoring timer to track the blocking aging timestamps of all issued blocking rules in real time. When the current time of the physical system exceeds the aging timestamp of a certain rule, the policy execution module automatically generates a corresponding rule deletion instruction and notifies the downstream network forwarding devices again via the network configuration protocol to remove the corresponding access control list entry, thus releasing the underlying hardware forwarding table resources. This dynamic aging mechanism ensures the effectiveness of the blocking policy and the reliability of network device resource utilization.

[0168] In step S600 of the method provided by the present invention, after the policy execution module confirms that the data plane blocking is effective, the cooperative routing control module resets the routing state on the network side and restores the forwarding path of normal services.

[0169] S606: After confirming that the underlying network forwarding device has successfully loaded the drop instruction, the policy enforcement module immediately sends a control signaling message to the routing control module. This control signaling message contains a list of legitimate source IP addresses that conform to the response characteristics of a normal operating system kernel network stack, separated by the feature analysis module during the spatial clustering phase. Because these legitimate source IP addresses were misjudged as having periodic packet sending characteristics during the initial statistical analysis phase, their bidirectional traffic has been forcibly redirected to the system's probe nodes by the previous diversion policy. To avoid continuously increasing the performance burden on bypass devices and eliminating unnecessary physical forwarding latency, the control plane must be triggered to revoke the redirection routes for these legitimate source IP addresses.

[0170] S607: After receiving a control signaling message containing a list of legitimate source IP addresses, the routing control module extracts the IP addresses as the route target prefix and retrieves the corresponding Border Gateway Protocol (BGP) flow specification entry from its internally maintained routing state table. Based on the protocol standard, the routing control module extracts the network reachability information previously used when issuing the update and transfers it to the route cancellation field in the new packet header, thus constructing a standard route cancellation message. This construction process does not require modification of any route extension community attributes; it only declares that a specific prefix is ​​unreachable, thereby informing upstream network devices to cancel specific traffic filtering and next-hop tampering rules.

[0171] In S608, the routing control module sends the constructed route revocation message to the upstream core router at the network boundary via the out-of-band management network. After parsing the revocation message, the upstream core router locates and deletes the corresponding traffic redirection entry in its underlying policy forwarding table. With the physical failure of the micro-redirection rule, response traffic returned from the target network area targeting legitimate source IP addresses will be forwarded again following the shortest physical path calculated by the basic interior gateway protocol, thus restoring the default route forwarding path for the misjudged legitimate source IP address. The format encapsulation of the border gateway protocol revocation message and the synchronization update mechanism of the core router's forwarding table can be implemented using standard open-source routing protocol stack suites by those skilled in the art. The state transitions of its internal state machine and its interaction with neighbor messages are well-known technologies in the field and will not be elaborated upon here.

[0172] S609: After resetting the external network physical forwarding path, the system synchronously performs memory cleanup of internal data states. The policy execution module sends internal cleanup instructions to the data processing module and the feature conversion module, locating the associated virtual hash bucket that triggered this security event. Upon receiving the instructions, the feature conversion module clears the corresponding virtual hash bucket within the observation length. The state asymmetry ratio sequence is cached within the sliding window, and the element values ​​of the row containing the associated co-pulse matrix are reset to zero. The specific state reset operation is calculated as follows: ;

[0173] in, For the index of the virtual hash bucket in the co-pulse matrix that is associated with the mapping of the currently processed source IP address. The matrix element values ​​at the corresponding historical moment; For the index of the virtual hash bucket; For the index of the discrete-time window; This represents the observation length of the sliding window; For time offset index; Indicates the index for time offset In 0 to For all integer values ​​within the range, the matrix element is cleared and assigned a new value.

[0174] S610, through the synchronized release of the external network routing table entries and the internal matrix memory space, the system completes a closed loop of a full detection and blocking cycle. The released virtual hash buckets and tensor computation dimension resources will be reinvested in background monitoring and state extraction of network traffic in subsequent discrete time windows, ensuring that the system can continuously and stably resist dynamically changing network attacks under limited hardware computing resources.

[0175] Specific application examples:

[0176] To more clearly illustrate the operating mechanism of the present invention in a real network environment, the following detailed explanation is based on a typical enterprise network boundary defense scenario (e.g., defending against slow, automated, periodic DDoS attacks).

[0177] The system is deployed at a network boundary node of an enterprise. In the... Within a discrete time window, the data processing module extracts a virtual hash bucket (index is...). Session statistics: The total number of sessions in the half-open connection state. The total number of sessions that are in an established state but whose receiver notification sliding window remains at zero. The total number of sessions where unidirectional data transmission has occurred and no acknowledgment message has been received after exceeding the preset retransmission timeout threshold. The total number of sessions that have completed a normal closed state transition. .

[0178] Based on system configuration, the penalty weight coefficient for abnormal protocol states , Constant limiting factor .

[0179] Substitute into the formula: ;

[0180] The state asymmetry ratio within this discrete-time window was calculated as follows:

[0181] .

[0182] The feature transformation module has an observation length of Within the sliding window, the state asymmetry ratio within the aforementioned continuous time window is cached to construct a cooperative impulse matrix. Then, a discrete Fourier transform is performed on the row vectors of the matrix.

[0183] After calculation, the discrete frequency index is extracted. The low-frequency main frequency component at that location, its frequency domain amplitude The white noise tolerance baseline configured within the system. Since the frequency domain amplitude (18.5) exceeds the white noise tolerance baseline (5.0), the system outputs the virtual hash bucket index that triggered the decision and the associated set of suspected source IP addresses.

[0184] The detection and control module calculates the total number of packets based on the extracted parameters. The modulation gain factor is known. Maximum number of burst messages limit .

[0185] Substitute into the formula: ;

[0186] The calculation shows that: .

[0187] Subsequently, the detection control module generates zero-window probe messages with the sliding window fields of the five Transmission Control Protocol headers set to zero, and sends the probe message sequence directly to the set of suspected source IP addresses via the physical link at the calculated hardware trigger timestamp.

[0188] The feature analysis module captures response messages, extracts protocol stack options and time-to-live fields to generate a protocol stack fingerprint vector. It also separates legitimate source IP addresses from malicious source IP addresses within the three-dimensional state tensor space.

[0189] The policy execution module queried the violation history database and found the cumulative number of times a certain malicious source IP address had been identified as an automated attack source. System basic blocking duration constant Maximum retreat index limit .

[0190] Substitute into the formula: ;

[0191] The aging timestamp of the seal was calculated as follows: .

[0192] Subsequently, a data plane drop command was issued to implement physical isolation for up to 1200 seconds, and a control signaling message was sent to the routing control module to construct a route revocation message, restoring the default route forwarding path for the misjudged legitimate source IP address. At the same time, the element values ​​of the row containing the associated two-dimensional cooperative pulse matrix were reset to zero, completing the internal cleanup.

[0193] To verify the effectiveness of this invention, system tests were conducted in a controlled network environment, importing normal background network traffic and attack traffic from automated packet sending tools, respectively. Specific feature extraction and judgment results are illustrated in the accompanying drawings.

[0194] See attached document Figure 9 The horizontal axis of this graph represents the discrete-time window index ( The value ranges from 1 to 64, corresponding to the observation length of the system's sliding window; the vertical axis represents the calculated state asymmetry ratio, ranging from 0 to 25. The figure contains two curves: the lower dashed line represents normal background network traffic, and the upper solid line represents traffic from automated packet sending tools.

[0195] Observing the curve trend, the dashed line representing normal background network traffic is distributed within the range of a state asymmetry ratio of 2 to 4, exhibiting random fluctuations. This is because the transmission control protocol state machine of a normal, legitimate terminal is fully closed, enabling it to complete the connection closure process in a standardized manner. In this state, the total number of sessions that have completed normal closed state transitions in the denominator of the state asymmetry ratio calculation formula remains at a normal value, keeping the overall ratio at a low level.

[0196] In contrast, the solid line representing traffic from automated packet sending tools is in a higher value range, exhibiting periodic fluctuations around a mean of 20.58. Automated packet sending tools typically lack complete kernel network stack processing logic, resulting in a large accumulation of sessions in half-connection states, established sessions with continuously zero receiving end notification sliding windows, and sessions with one-way data transmissions that have exceeded the preset retransmission timeout threshold without receiving acknowledgments. These abnormal protocol state data significantly increase the state asymmetry ratio. Furthermore, the timer-based packet sending mechanism of these tools causes this ratio to exhibit periodic variations over continuous time series.

[0197] See attached document Figure 10 The horizontal axis of this graph represents the discrete frequency index ( The values ​​range from 0 to 31; the vertical axis represents the frequency domain amplitude extracted after performing a discrete Fourier transform on the row vectors of the cooperative pulse matrix, ranging from 0 to 22. The figure contains three reference lines and curves: the black dashed line represents the white noise tolerance baseline configured with a value of 5.0; the blue dotted line represents the normal flow frequency distribution; and the red solid line represents the dominant frequency component of the suspected target.

[0198] Analyzing the curves, the blue dotted line representing the normal traffic frequency distribution shows relatively small amplitude across the entire frequency range, with frequency domain amplitudes ranging from 1.0 to 2.5, all below the white noise tolerance baseline of 5.0. This is because the message exchange time of normal business traffic exhibits randomness and lacks a fixed periodicity. After discrete Fourier transform, the frequency domain amplitudes of each corresponding frequency component are low and discretely distributed.

[0199] The red solid line representing the main frequency component of the suspect target is at the discrete frequency index. The peak value appeared at the location, with a frequency domain amplitude reaching 18.5, exceeding the white noise tolerance baseline. This is because the feature transformation module, when performing a discrete Fourier transform on the row vectors of the copula matrix, converts the periodic characteristics of the automated packet sending tool in the time dimension to the frequency domain. Fixed-frequency packet sending behavior manifests in the frequency domain as a low-frequency dominant component and its corresponding higher-frequency amplitude. The system determines that this frequency domain amplitude exceeds the white noise tolerance baseline, and thus outputs a set of suspected source IP addresses.

[0200] After extracting the set of suspected source IP addresses, the system performs detection control and feature analysis. Then, the policy execution module converts the malicious source IP address set into network hardware access control list rules for data plane blocking, and periodically removes expired rule entries based on calculated aging timestamps. Test data shows that the internal memory cleanup and dynamic aging mechanism of this invention reduces the average occupancy of the underlying network forwarding device's hardware forwarding table and system memory by approximately 78%, verifying the actual effectiveness of the solution in terms of hardware resource consumption.

Claims

1. A method for automatically blocking network attacks based on traffic feature recognition, characterized in that, The method includes the following steps: Collect Transmission Control Protocol (TCP) messages, map the source IP addresses of the TCP messages, extract connection state statistics, and calculate the state asymmetry ratio and physical delay parameters. The state asymmetry ratio is cached and a cooperative pulse matrix is ​​constructed. Frequency domain parameters are extracted from the cooperative pulse matrix, and a set of suspected source IP addresses is output based on the frequency domain parameters. Based on the set of suspected source IP addresses, a zero-window probe packet is constructed, and route redirection is performed to establish a bidirectional traffic visibility path; The frequency domain parameters and physical delay parameters are obtained. The absolute prediction timestamp is calculated based on the discrete frequency index and initial phase angle in the frequency domain parameters. The absolute delivery timestamp is calculated based on the absolute prediction timestamp, the average round-trip time in the physical delay parameters, and the protocol stack processing compensation constant. The hardware trigger timestamp is then calculated based on the absolute delivery timestamp and the delay jitter deviation in the physical delay parameters. The zero-window probe message is modulated to generate a probe message sequence, and the probe message sequence is sent at the hardware-triggered timestamp; zero-window probe message Capture response messages to the probe message sequence to generate a protocol stack fingerprint vector, combine the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and perform spatial clustering to separate the list of legitimate source IP addresses and the set of malicious source IP addresses; Data plane blocking is performed based on the set of malicious source IP addresses, and the route redirection is revoked based on the list of legitimate source IP addresses.

2. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The steps of mapping the source IP address of the Transmission Control Protocol (TCP) message and extracting connection state statistics to calculate the state asymmetry ratio include: The source IP address is mapped to a preset set of virtual hash buckets using a consistent hashing algorithm; The total number of sessions in the half-connection state, the total number of sessions in the established state but whose receiver notification sliding window remains zero, and the total number of sessions that transmit data in one direction and have not received an acknowledgment message after exceeding the preset retransmission timeout threshold are extracted from the preset virtual hash bucket set within the discrete time window as the connection state statistics. The total number of sessions in the half-connection state and the total number of sessions in the established state but whose receiver notification sliding window remains zero are summed together with the abnormal protocol state penalty weight coefficient to obtain an accumulated value. The total number of sessions that transmit data in one direction and do not receive an acknowledgment message after exceeding the preset retransmission timeout threshold is added to the accumulated value as the numerator. The sum of the total number of sessions that have completed the normal closed state transition and the constant limit factor is used as the denominator. The ratio is then used to calculate the state asymmetry ratio.

3. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The steps for extracting connection state statistics and calculating the state asymmetry ratio and physical delay parameters, including the steps for calculating the physical delay parameters, are as follows: The calculation of physical delay parameters includes calculating the average round-trip time delay and delay jitter deviation, specifically including: Extract the effective connection round-trip time measurement value, combine the effective connection round-trip time measurement value with the average round-trip delay of the previous discrete time window and the delay smoothing factor, and update the average round-trip delay using the exponential weighted moving average algorithm; The absolute deviation between the effective connection round-trip time measurement and the average round-trip delay of the previous discrete time window is extracted, and the delay jitter deviation is obtained by iteratively updating the jitter deviation by combining the jitter smoothing factor with the delay jitter deviation of the previous discrete time window.

4. The automatic blocking method for network attacks based on traffic feature recognition according to claim 3, characterized in that, The steps of extracting frequency domain parameters from the cooperative pulse matrix and outputting a set of suspected source IP addresses based on the frequency domain parameters include: Perform a discrete Fourier transform on the time-domain sequence of the co-pulse matrix, which is associated with the spatial and temporal dimensions, to generate a complex sequence; The frequency domain amplitude and initial phase angle are calculated using the real and imaginary parts of the complex number sequence, and the maximum frequency domain amplitude and the corresponding initial phase angle are extracted as the frequency domain parameters within the effective frequency range. By comparing the largest frequency domain amplitude with the white noise tolerance baseline, when it is determined that the largest frequency domain amplitude exceeds the white noise tolerance baseline, the set of suspected source IP addresses that trigger the decision is output.

5. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The steps of constructing a zero-window probe packet based on the set of suspected source IP addresses and performing route redirection to establish a bidirectional traffic visual path include: Extract the five-tuple information of active connections associated with the suspected source IP address set, swap the address and port, and set the sliding window field of the Transmission Control Protocol header to zero. The zero-window probe message is generated by embedding a custom probe identifier based on a one-way cryptographic hash function in the Transmission Control Protocol Options field, which is calculated according to the suspected source IP address, the current discrete time window index, and the system preset random salt value. The suspected source IP address set is encapsulated as a source address prefix in a Border Gateway Protocol (BGP) flow specification message and sent to the upstream core router. An extended community attribute is encapsulated in the route update message to modify the default next-hop network address to complete the route redirection. A lifetime threshold is set for the route redirection, wherein the lifetime threshold is determined based on the sum of the average round-trip time and the compensation buffer time constant in the physical delay parameters.

6. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The steps include: calculating the absolute prediction timestamp based on the discrete frequency index and initial phase angle in the frequency domain parameters; calculating the absolute delivery timestamp based on the absolute prediction timestamp, the average round-trip time in the physical delay parameters, and the protocol stack processing compensation constant; and calculating the hardware trigger timestamp based on the delay jitter deviation between the absolute delivery timestamp and the physical delay parameters. The physical time period is calculated based on the discrete frequency index and discrete time window physical step size in the frequency domain parameters. The phase offset is calculated by combining the initial phase angle in the frequency domain parameters and an absolute prediction timestamp is generated. The absolute delivery timestamp is generated by subtracting the average round-trip time from the physical delay parameter and the protocol stack processing compensation constant from the absolute predicted timestamp. The hardware trigger timestamp is generated by subtracting the product of the delay jitter deviation and the jitter compensation coefficient in the physical delay parameter from the absolute delivery timestamp.

7. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The step of modulating the zero-window probe message to generate a probe message sequence includes: The modulation value is obtained by calculating the ratio of the frequency domain amplitude in the frequency domain parameters to the white noise tolerance baseline and multiplying it by the modulation gain factor. The minimum value between the modulation value and the maximum burst message limit for a single perturbation injection is selected as the total number of messages. When the total number of messages is greater than 1, the zero-window probe message is copied to the total number of messages, the acknowledgment number of the copied message is fixed to the sequence number of the latest message sent by the target terminal, and the probe message sequence containing consecutive repeated acknowledgment messages is generated.

8. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The steps of combining the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and performing spatial clustering to separate the list of legitimate source IP addresses from the set of malicious source IP addresses, include: The normalized protocol stack fingerprint vector is converted into a spatial discrete dimension using tensor outer product operation, and then orthogonally projected and expanded with the co-pulse matrix to generate the three-dimensional state tensor. A spatial distance matrix is ​​generated by using the Frobenius norm to measure the spatial distance between two-dimensional slices of the tensor corresponding to different addresses in the three-dimensional state tensor. A density-based spatial clustering algorithm is invoked to search for high-density connected regions in the spatial distance matrix based on the spatial distribution characteristics of the three-dimensional state tensor, the preset clustering neighborhood radius threshold, and the minimum number of core objects. The results are compared with the operating system fingerprint baseline cluster constructed in advance by collecting standard response features of various known types of operating systems in the three-dimensional state tensor space. The list of legitimate source IP addresses is then separated, and the remaining isolated objects and abnormal clusters are aggregated and output as the set of malicious source IP addresses.

9. The automatic blocking method for network attacks based on traffic feature recognition according to claim 1, characterized in that, The steps of performing data plane blocking based on the malicious source IP address set and revoking the route redirection based on the legitimate source IP address list include: The system queries its internal violation history database to obtain the cumulative number of violations for each address in the malicious source IP address set. The violation history database is used to record the address that is identified as a malicious source IP address each time and the corresponding judgment timestamp. Combining the basic blocking duration constant with the current physical system timestamp, the exponential backoff algorithm is used to calculate the blocking aging timestamp based on the cumulative number of violations; The malicious source IP address set and the blocking aging timestamp are compiled together by calling the syntax template library into a network hardware access control list rule with discard action and timeout expiration attribute. The network hardware access control list rule is encapsulated in network management protocol message and sent to execute the data plane blocking. Based on the list of legitimate source IP addresses, a route cancellation message is sent to the upstream core router to restore the default route forwarding path, and the associated virtual hash bucket is located and zeroed out.

10. An automatic network attack blocking system based on traffic feature recognition, characterized in that, The system, applied to the automatic blocking method for network attacks based on traffic feature identification as described in any one of claims 1-9, comprises: The data processing module is used to collect transmission control protocol messages, map the source IP addresses of the transmission control protocol messages, extract connection state statistics, and calculate the state asymmetry ratio and physical delay parameters. The feature conversion module is used to cache the state asymmetry ratio to construct a cooperative pulse matrix, extract frequency domain parameters from the cooperative pulse matrix, and output a set of suspected source IP addresses based on the frequency domain parameters. The detection control module is used to construct a zero-window detection packet based on the suspected source IP address set, perform route redirection to establish a bidirectional traffic visible path, obtain the frequency domain parameters and the physical delay parameters to calculate the hardware trigger timestamp, modulate the zero-window detection packet to generate a detection packet sequence, and send the detection packet sequence at the hardware trigger timestamp; the feature analysis module is used to capture the response packet to the detection packet sequence to generate a protocol stack fingerprint vector, combine the protocol stack fingerprint vector with the co-pulse matrix to generate a three-dimensional state tensor, and perform spatial clustering to separate the list of legitimate source IP addresses and the set of malicious source IP addresses; The policy execution module is used to perform data plane blocking based on the set of malicious source IP addresses and send control signaling containing the list of legitimate source IP addresses to the routing control module; The routing control module is used to, upon receiving the control signaling, cancel the route redirection according to the list of legitimate source IP addresses synchronized by the policy execution module.

Images