State switching based dl dos attack defense method in rocev2 network

Abstract

The application discloses a DLDoS attack defense method based on state switching in a RoCEv2 network. The method records original traffic data based on a time window, and obtains traffic characteristics through further calculation; switches the switch to a working state or a resting state based on the flow rate of the export port, and only performs attack detection and mitigation in the working state; uses the XGBoost algorithm to train a detection model, and changes the output from the default label 0 or 1 to a probability in the interval [0, 1]; the detection cycle of the switch is the length of the detection window, the flow characteristics are input into the model to update the black and white lists, the attack flow is detected based on the white list, and the attack is mitigated based on the black list. In the DLDoS attack detection, the flow to be detected is filtered through the white list, and the probability output by the detection model is determined according to the set two thresholds to update the black and white lists. In the DLDoS attack mitigation, the data packets matched with the black list are discarded, and the idle timeout and the hard timeout are set in the black list to delete the flow entries at regular intervals.

Description

Technical Field

[0001] This invention belongs to the field of computer network security, specifically relating to a DLDoS attack defense method based on state switching in RoCEv2 networks. Background Technology

[0002] Remote Direct Memory Access (RDMA) technology allows computers to directly read from or write to memory, bypassing the kernel for transmission. This design significantly reduces transmission latency and CPU overhead, increasing throughput. RoCEv2 is a widely used RDMA protocol that requires Priority-based Flow Control (PFC) to build a lossless RoCEv2 network. PFC divides a port into eight virtual queues, and in case of congestion, it can send a PAUSE frame upstream to pause one of the queues. This brings significant performance improvements but also increases security risks.

[0003] Low-rate Denial of Service (LDoS) attacks are highly damaging network attacks. In TCP / UDP networks, the attack logic is to continuously consume the bandwidth of bottleneck links, causing network congestion. Attackers periodically send short, high-speed pulses of traffic to the target link, exploiting vulnerabilities in flow control mechanisms to create congestion. In RDMA networks, it utilizes the PFC backpressure phenomenon, sending periodic high-speed pulses to specific ports, causing the PFC PAUSE frames on those ports to propagate upstream, thus spreading congestion from a localized area to the entire network.

[0004] Distributed Low-rate Denial of Service (DLDoS) attacks in RoCEv2 lossless networks are a distributed extension of LDoS attacks, combining the stealth advantages of LDoS attacks with the multi-source advantage of DDoS attacks. Attackers utilize multiple attack nodes to coordinate synchronous or asynchronous LDoS attack pulses. In synchronous mode, the pulses arrive at the target almost simultaneously, converging into a concentrated short-term flow; in asynchronous mode, the attack pulses arrive at the target interleaved, preventing the traffic from concentrating at the same time. The pulsed traffic converges at the target port, causing congestion and suspending traffic transmission, and then exerting back pressure upstream, spreading the congestion effect. This attack does not aim to instantly paralyze servers, but rather to gradually reduce network throughput, increase latency, and cause service disruptions over a long period, achieving a progressive denial of service.

[0005] Extreme Gradient Boosting (XGBoost) is a highly efficient gradient-boosting decision tree algorithm. It progressively trains multiple weak learners, each step focusing on correcting the errors of the previous model, ultimately combining them into a strong learner. This results in higher prediction accuracy and the ability to detect attacks. During model training, the XGBoost algorithm is trained by inputting normal flow features labeled 0 and attack flow features labeled 1, and parameters are adjusted so that the model outputs a probability of [0,1] instead of labels 0 or 1. During attack detection, the XGBoost model uses the input flow features to determine the probability that the current flow is an attack flow. This invention constructs an attack detection model based on the XGBoost algorithm for detecting DLDoS attacks in the RoCEv2 lossless network.

[0006] This invention addresses the issue that existing DLDoS attack detection and mitigation methods perform well in traditional networks but are not suitable for RDMA networks. It proposes a state-switching-based DLDoS attack defense method for RoCEv2 networks. This method collects raw traffic data on the switch based on time windows, extracts traffic features, and selects features based on feature importance and model training performance. The switch monitors the traffic of all egress ports in real time. If the flow rate of a port exceeds a threshold, it enters an active state; if the flow rate does not exceed the threshold for a continuous period, it enters a resting state. In the resting state, the switch does not perform attack detection or mitigation. When training the XGBoost model, the model parameters are adjusted from the default output label of 0 or 1 to output the probability p in the [0,1] interval. The model is trained using traffic features labeled 0 or 1, and the trained model is fed into the switch. The switch periodically detects attacks, inputting reference features from all time windows during detection, while ignoring flows in the whitelist. The blacklist and whitelist are updated based on the detection results. During attack mitigation, packets matching the blacklist are discarded to alleviate the attack. This method can be deployed on switches to detect and mitigate DLDoS attacks in RoCEv2 lossless networks with high accuracy. Summary of the Invention

[0007] This invention proposes a state-switching-based DLDoS attack defense method for RoCEv2 networks, targeting the RoCEv2 protocol and DLDoS attacks. This method can be deployed on switches and effectively detects and mitigates DLDoS attacks in RoCEv2 lossless networks with high accuracy.

[0008] The technical solution adopted by this invention to achieve the above objectives is a DLDoS attack defense method based on state switching in RoCEv2 networks, which mainly includes four steps: feature extraction, state switching, model training, and attack detection and mitigation.

[0009] 1. Feature extraction. The switch has a detection window composed of n time windows, which collects raw traffic data in real time based on the time windows, slides the detection window to calculate traffic features, and records the raw traffic data and traffic features of all time windows.

[0010] 2. State switching. The switch has a rest state and a working state, and monitors the traffic rate of all egress ports in real time to switch states. If the rate of any egress port is greater than 90% of the bandwidth, the switch switches to the working state; if no port has a rate greater than 90% for a consecutive period of time, the switch switches to the rest state. When in the rest state, the switch does not perform attack detection and mitigation.

[0011] 3. Model training. Collect feature data, select reference features through the feature importance score of the random forest model and the training effect of the XGBoost model, and finally train the detection model through the XGBoost algorithm. During training, normal flows marked as 0 and attack flows marked as 1 are used, and model parameters are adjusted so that the model output is changed from the default label 0 or 1 to a probability value in the interval [0, 1].

[0012] 4. Attack detection and mitigation. The switch periodically detects attack flows based on the whitelist. If a flow entry matches the whitelist, no detection is required; otherwise, normal detection is performed. If the model output p is less than TH1, the flow is added to the whitelist, and if p is greater than TH2, the flow is added to the blacklist. The switch sets an idle timeout and a hard timeout for the blacklist, and discards packets matching the blacklist to mitigate attacks. Beneficial effects

[0013] The present invention proposes a state switching-based DLDoS attack defense method in a RoCEv2 network, which adopts the PFC weight of IP as an important reference feature based on the PFC characteristic, the switch switches states based on the traffic rate of egress ports, inputs flow features into the XGBoost detection model to update the blacklist and whitelist, detects attack flows based on the whitelist, and mitigates attacks based on the blacklist. In the detection and mitigation of DLDoS attacks, this method extracts flow features of time windows in real time for detection, sets two thresholds to judge detection results, the detection period is the duration of the detection window, and discards packets in the blacklist to mitigate attacks. Experiments are carried out on an experimental platform built based on NS-3, and the method can accurately mitigate DLDoS attacks in RoCEv2 networks with high accuracy, which is an effective DLDoS attack defense method. Brief Description of the Drawings

[0014] Figure 1This diagram illustrates the impact of a DLDoS attack on a RoCEv2 lossless network. This type of DLDoS attack, based on the RoCEv2 protocol, involves multiple attack sources sending malicious data streams to a target port synchronously or asynchronously. The attack streams cause network congestion at the target port, leading to abnormal port traffic transmission. When the port queue's buffer reaches a threshold, a PFC PAUSE frame is sent to the corresponding port queue of the upstream device to pause it, causing upstream port congestion. The PAUSE frame can further propagate, affecting innocent, normal traffic transmission and spreading congestion throughout the entire network.

[0015] Figure 2 This is a framework diagram of a state-switching-based DLDoS attack defense method in RoCEv2 networks. Detailed Implementation

[0016] The invention will be further described below with reference to the accompanying drawings.

[0017] like Figure 2 As shown, the DLDoS attack defense method based on state switching mainly includes four steps: feature extraction, state switching, model training, attack detection and mitigation.

[0018] 1. Feature Extraction. The switch's time window duration is 10 milliseconds. The detection window consists of n consecutive time windows, and every 10 milliseconds, the detection window slides forward by one time window. Within each time window, the switch statistically analyzes the raw traffic data in real time, and then calculates and processes the data to obtain traffic features.

[0019] 1.1 Collect raw traffic data. The switch collects raw traffic data in real time within the current time window, including flow duration, number and bytes of forward and reverse packets, number of ACK packets, RDMA queue depth, number of packets in the PAUSE state, and packet sequence number. The number of packets in the PAUSE state indicates the number of times the current flow is in the PAUSE state while forwarding packets.

[0020] 1.2 Calculating Traffic Characteristics. The switch calculates and processes the raw traffic data to obtain traffic characteristics, including forward and reverse packet rates and flow rates, ACK rates, IP PFC weights, and maximum and minimum sequence numbers. Specifically, the IP PFC weights are calculated by the switch by uploading data such as the number of packets in the PAUSE state to the server, which then analyzes and calculates the data before sending it back to the switch. All characteristic datasets consist of raw traffic data and traffic characteristics.

[0021] 2. State Switching. The switch monitors the traffic rate of all outgoing ports in real time and sets thresholds to switch to either an active or idle state. In idle state, the switch does not perform attack detection or mitigation.

[0022] 2.1 Monitoring the egress port rate. The switch monitors the traffic rate of all egress ports in real time. If the traffic rate of any egress is greater than 90% of the bandwidth, the switch switches to the working state to detect and mitigate attacks. If no port exceeds 90% for a consecutive period of time, the switch switches to the resting state.

[0023] 2.2 Switching the switch state. When the switch is in the resting state, it does not perform attack detection and mitigation. When the switch is in the working state, it starts to detect and mitigate attacks, performs packet loss mitigation based on the blacklist, filters the flows to be detected based on the whitelist, and updates the blacklist and whitelist according to the detection result.

[0024] 3. Model training. The switch performs multiple simulations, collects the traffic dataset within the detection window and marks it as normal flow or attack flow, then performs feature selection, trains the XGBoost model with appropriate reference features, and adjusts the output of the model to a probability p.

[0025] 3.1 Collecting and selecting features. Multiple simulations are carried out by changing attack parameters and traffic rates, and the collected feature dataset is marked as 0 or 1 to indicate whether it is an attack flow. Then, the random forest model is used to calculate the importance scores of all features and sort them in descending order, the top k features are selected to train the XGBoost model, the training effects of the model when k takes different values are compared, and the top k features with the best effect are selected as reference features to detect attack flows.

[0026] 3.2 Training the XGBoost model. When training the model with the XGBoost algorithm, it is necessary to adjust the parameters of the model, and adjust the model output from the label 0 or 1 to the probability p∈[0,1]. Finally, the trained XGBoost model is configured in the switch to detect attack flows.

[0027] 4. Attack detection and mitigation. When the switch is in the working state, it needs to detect and mitigate attacks. The detection period is the duration of the detection window. For each detection, the data of all time windows in the detection window are input into the model, and the blacklist and whitelist are updated according to the detection result. The attack mitigation method is packet loss.

[0028] 4.1 Detecting attack flows according to the whitelist. During detection, the switch filters the flows in the whitelist, inputs the reference features of the remaining flows into the detection model, and the model outputs a probability p∈[0,1]. Two thresholds TH1 and TH2 are set, satisfying TH1<TH2: if p<TH1, the flow is added to the whitelist, in which case the false negative rate is the lowest and the probability of attack flows being contained in the whitelist is the smallest; if p>TH2, the flow is added to the blacklist, in which case the false positive rate is the lowest and the probability of normal flows being contained in the blacklist is the smallest; if p∈[TH1,TH2], the current flow is not processed.

[0029] 4.2 Mitigating Attacks Based on Blacklists. When forwarding data packets, the switch discards packets that match the blacklist to mitigate attacks. Simultaneously, hard timeouts and idle timeouts are set for each flow in the blacklist to delete invalid entries and prevent erroneous entries from affecting the network for too long, thus implementing a state-switching-based DLDoS attack defense method in RoCEv2 networks.

Claims

1. A DLDoS attack defense method based on state switching in RoCEv2 networks, characterized in that, In RoCEv2 lossless networks, the attack logic of DLDoS is to use PFC (Programmable Frame Congestion) to propagate PAUSE frames upstream, thereby causing congestion propagation. Therefore, PFC-related features are used to detect attack flows in order to defend against DLDoS attacks. The defense method includes the following steps: Step 1, Feature Extraction: The raw traffic data for each time window is extracted from the switch based on the 5-tuple, and then the traffic features are obtained through calculation and processing. This includes two steps: Step 1.1: Collect raw traffic data, set the duration of the switch time window, the detection window consists of multiple time windows, collect raw traffic data in each time window of the detection window, including flow duration, number of forward and reverse data packets and bytes, number of ACK packets, RDMA queue depth, number of data packets in the PAUSE state, and data packet sequence number; Step 1.2: Calculate traffic characteristics. Calculate and process the collected raw traffic data to obtain traffic characteristics within the time window, including forward and reverse packet rates and flow rates, ACK rates, IP PFC weights, maximum and minimum sequence numbers, and finally obtain a feature dataset composed of raw traffic data and traffic characteristics. Step 2, State Switching: When forwarding data packets, the switch switches between resting and operating states based on the traffic rate of the egress port. This involves two steps: Step 2.1: Monitor the egress port rate. The switch monitors all egress ports in real time. If the traffic rate of a port is greater than 90% of the bandwidth, it switches to working mode. If no port has a rate exceeding 90% for a continuous period of time, it switches to rest mode. Step 2.2: Switch the switch state. When the switch is in the rest state, it does not perform attack detection and mitigation. When it is in the working state, the switch will perform periodic attack flow detection and update the blacklist and whitelist according to the detection results. It filters the flow to be detected based on the whitelist and discards matching data packets based on the blacklist. Step 3, Model Training: The switch collects traffic data within the detection window to train the XGBoost model, then feeds the model into the switch to detect attack flows. The threshold and the probability p output by the model are compared to update the blacklist and whitelist. This involves two steps: Step 3.1: Collect and select features, change the attack parameters and traffic rate to perform multiple simulations, mark the features as 0 or 1 to indicate whether they are attack flows, train the random forest model to obtain feature importance scores, sort them in descending order and take out the top k features to train the XGBoost model, compare the training effects under different k values, and select the best performance as the reference feature. Step 3.2: Train the XGBoost model. When training the XGBoost model using reference features, the model parameters need to be adjusted from the default output label 0 or 1 to the output probability p in the [0,1] interval. Finally, configure the trained model in the switch to detect attack flows. Step 4, Attack Detection and Mitigation: During operation, the switch needs to detect and mitigate attacks. The detection cycle is the duration of the detection window and includes two steps: Step 4.1: Detect attacks according to a whitelist. During detection by the switch, if a flow matches the whitelist, no further detection is performed; otherwise, normal detection is carried out. In each detection, all reference features within the detection window are input to the model, and the model outputs a probability p. Two thresholds TH1 and TH2 are set. If p<TH1, the flow is added to the whitelist; if p>TH2, the flow is added to the blacklist; Step 4.2: Mitigate attacks according to a blacklist. The switch first judges whether a data packet matches the blacklist, and discards the data packet if it matches to mitigate the attack; otherwise, the data packet is forwarded normally, thereby implementing the state switching-based DLDoS attack defense method.

2. The DLDoS attack defense method according to claim 1, characterized in that, The PFC weight of the feature IP calculated in step 1.2 can quantify the contribution of the IP to the port PAUSE state, and a larger value indicates a greater contribution. The calculation process is as follows: First, the switch uploads data required for analyzing the congestion graph to the server, including the number of PAUSE state packets of the flow, related ports, and the number of data packets, to represent how the PAUSE state spreads between flows and ports, and between ports; second, the server finds all edges connected to the flow node in the congestion graph, and the PFC weight of the flow node is equal to the sum of the weights of all incoming edges minus the sum of the weights of all outgoing edges; Finally, the server classifies the flow nodes by source IP, sums the PFC weights of all flow nodes under the same source IP to obtain the PFC weight of the IP, and then issues the PFC weight to the switch, and finally the switch writes the weight into the flow feature of the corresponding source IP.

3. The DLDoS attack defense method according to claim 1, characterized in that, In step 4.1, two probability thresholds TH1 and TH2 are set, satisfying TH1<TH2: flows with a detection result p<TH1 are added to the whitelist, where the false negative rate is low and the possibility of attack flows being included in the whitelist is minimized; flows with a detection result p>TH2 are added to the blacklist, where the false positive rate is low and the possibility of normal flows being included in the blacklist is minimized; when the value of the detection result p is in the interval [TH1, TH2], the current flow is not processed.

Images