Low-rate denial of service attack detection method, apparatus and device

Abstract

This application discloses a method, apparatus, and device for detecting low-rate denial-of-service (DRD) attacks. The method includes: acquiring N sets of network traffic data for a target service; performing feature extraction and vectorization on each set of network traffic data to obtain N traffic feature vectors, and arranging the N traffic feature vectors in chronological order to generate a traffic feature vector sequence; inputting the traffic feature vector sequence into an attack detection model to output a predicted probability value of the target service being subjected to a DRD attack, wherein the attack detection model is a Kolmogorov-Arnold network-based model; and determining whether to output an indication that the target service is subjected to a DRD attack based on a comparison between the predicted probability value and a preset threshold. Using the scheme of this application can improve the detection rate and accuracy of DRD attacks, while having low computational overhead and high applicability.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a method, apparatus and device for detecting low-rate denial-of-service attacks. Background Technology

[0002] With the rapid development of network technology, network attack methods are also constantly evolving and upgrading. Denial of service (DoS) attacks, in particular, involve an attacker sending a large number of communication requests to a target service, causing temporary or indefinite service interruption, or even system crashes. Therefore, DoS attack detection is crucial for ensuring the stability of target services. Low-rate denial of service (LDoS) attacks are an advanced variant of traditional DoS attacks. LDoS exploits vulnerabilities in the congestion control mechanisms of network protocols such as the Transmission Control Protocol (TCP), periodically sending short, high-speed pulses of traffic to precisely trigger frequent congestion control responses from the target service, leading to a continuous decline in the throughput of legitimate TCP connections. Traditional DoS detection systems typically set a fixed traffic threshold; when the network traffic rate of the target service exceeds this threshold, it is considered a DoS attack. However, the average traffic rate of an LDoS attack is only 3%–5% of normal traffic, making it highly stealthy and difficult for traditional DoS detection systems to effectively identify low-rate attacks like LDoS, resulting in a high false positive rate. Summary of the Invention

[0003] This application discloses a method, apparatus, and device for detecting low-rate denial-of-service attacks, which can improve the detection rate and accuracy of LDoS attacks. It also uses an attack detection model including Kolmogorov-Arnold networks (KAN) for detection, which has a simple model structure, high parameter efficiency, low computational overhead, and high applicability.

[0004] In a first aspect, this application provides a method for detecting low-rate denial-of-service attacks. The method includes: acquiring a set of network traffic data for a target service within each of N consecutive time periods of equal duration, to obtain N sets of network traffic data corresponding to the N time periods, wherein each set of network traffic data includes statistical information of each data stream received by the target service within a time period, where N is a positive integer; performing feature extraction on each set of network traffic data in the N sets of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data; performing vectorization processing on the at least one traffic feature to generate a traffic feature vector corresponding to each set of network traffic data, to obtain N traffic feature vectors corresponding to the N sets of network traffic data; and then arranging the N traffic feature vectors according to... The traffic feature vector sequence is generated by arranging the data in chronological order; wherein at least one traffic feature includes at least one of time-domain features, frequency-domain features, and information-theoretic features; the time-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the time dimension, the frequency-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the frequency dimension, and the information-theoretic features characterize the random variation characteristics of the network traffic of the target service; the traffic feature vector sequence is input into an attack detection model to output a probability prediction value of the target service being subjected to a low-rate denial-of-service attack, wherein the attack detection model is a model based on a Kolmogorov-Arnold network (KAN); based on the comparison result of the probability prediction value and a preset threshold, it is determined whether to output an indication information that the target service is subjected to the low-rate denial-of-service attack. In this application, by using traffic features of multiple dimensions as input to the attack detection model, the attack detection model can effectively distinguish between normal traffic of the target service and low-rate denial-of-service attack traffic, thereby improving the detection rate and accuracy of LDoS attacks. At the same time, the attack detection model, including KAN, is used to make probabilistic predictions on traffic features of multiple dimensions. The model has a simple structure, high parameter efficiency, low computational overhead, and high applicability.

[0005] In one possible implementation, the aforementioned time-domain features include at least one of packet arrival time interval distribution skewness, packet arrival time interval distribution kurtosis, TCP duplicate ACK packet ratio, round-trip time standard deviation, packet rate coefficient of variation, and flow duration; the aforementioned frequency-domain features include at least one of the spectral dominant frequency energy ratio and wavelet high-frequency detail energy ratio; and the aforementioned information-theoretic features include at least one of the destination port distribution entropy and packet count sequence sample entropy. In this application, by extracting traffic features from multiple dimensions—time-domain, frequency-domain, or information-theoretic—as input to the attack detection model, network traffic anomalies in target services caused by low-rate attack pulses can be accurately captured, improving the detection rate and accuracy of LDoS.

[0006] In one possible implementation, the aforementioned at least one traffic feature includes time-domain features, frequency-domain features, and information-theoretic features. In this application, by extracting traffic features from multiple different dimensions—time-domain, frequency-domain, and information-theoretic—as input for attack detection, network traffic anomalies in target services caused by low-rate attack pulses can be accurately captured, improving the detection rate and accuracy of LDoS.

[0007] In one possible implementation, the above-mentioned acquisition of a set of network traffic data for the target service within each of N consecutive time periods of equal duration, to obtain N sets of network traffic data corresponding to the N time periods, includes: setting a sampling time window with a first preset window length; collecting raw network traffic data within the time period covered by the sampling time window as a set of network traffic data corresponding to the sampling time window; updating the time period covered by the sampling time window according to a first preset sliding step size; collecting raw network traffic data within the updated time period covered by the sampling time window as a set of network traffic data corresponding to the updated sampling time window; until N sets of network traffic data are obtained as N sets of network traffic data corresponding to the N time periods, wherein the first preset window length is equal to the duration of the time period, and the first preset sliding step size is less than the first preset window length. In this application, the original network traffic data of the target service can be sampled by a sliding sampling time window to obtain N sets of network traffic data. The first preset sliding step size is smaller than the first preset window length, so that the sampling time windows before and after the sliding have overlapping durations. This can reduce the loss of traffic features caused by window boundaries, improve the completeness of traffic feature capture and the detection rate of attack detection.

[0008] In one possible implementation, before inputting the traffic feature vector sequence into the attack detection model, the method further includes: setting a smoothing window with a second preset window length; obtaining multiple consecutive traffic feature vectors in the traffic feature vector sequence within the location range covered by the smoothing window as a set of traffic feature vectors corresponding to the smoothing window; averaging the feature values ​​of the set of traffic feature vectors corresponding to the smoothing window in the same dimension to obtain a smoothed traffic feature vector corresponding to the smoothing window, wherein the second preset window length is an odd number; updating the location range covered by the smoothing window according to a second preset sliding step size, and obtaining the traffic feature vectors within the location range covered by the updated smoothing window. Multiple consecutive traffic feature vectors in the traffic feature vector sequence are used as a set of traffic feature vectors corresponding to the updated smoothing window. The average value of the feature values ​​of this set of traffic feature vectors corresponding to the updated smoothing window in the same dimension is calculated to obtain a smoothed traffic feature vector corresponding to the updated smoothing window. This process is repeated until N smoothed traffic feature vectors are obtained. The second preset sliding step size is 1, and each traffic feature vector in the traffic feature vector sequence corresponds to one smoothed traffic feature vector. Each traffic feature vector in the traffic feature vector sequence is updated to the smoothed traffic feature vector corresponding to each traffic feature vector to smooth the traffic feature vector sequence. In this application, by smoothing the traffic feature vector sequence and using the smoothed traffic feature vector sequence as input to the attack detection model, the high-frequency noise of the traffic feature vector sequence can be effectively reduced while retaining the long-term trend traffic features caused by low-rate denial-of-service attacks. This improves the stability of the input features of the attack detection model, thereby enhancing the attack detection accuracy and anti-interference capability.

[0009] In one possible implementation, the attack detection model includes a convolutional network, a flattening network, and the KAN connected in sequence. The step of inputting the traffic feature vector sequence into the attack detection model to output a predicted probability value of the target service being subjected to a low-rate denial-of-service attack includes: inputting the traffic feature vector sequence into the convolutional network in the attack detection model to extract convolutional features from the traffic feature vector sequence and outputting convolutional traffic features to the flattening network; flattening the convolutional traffic features into a one-dimensional feature vector through the flattening network and outputting the one-dimensional feature vector to the KAN; performing a nonlinear mapping on the one-dimensional feature vector using a B-spline function on each connection edge in the KAN to output a nonlinear mapping result; and summing the nonlinear mapping results output by each connection edge through each node in the KAN to output a predicted probability value of the target service being subjected to the low-rate denial-of-service attack. The KAN includes multiple KAN layers connected in sequence, and the connection edge is the connection edge between two adjacent KAN layers in the multiple sequentially connected KAN layers. In this application, convolutional traffic features are obtained by inputting traffic feature vectors into a convolutional network for feature extraction, and then the convolutional traffic features are flattened into a one-dimensional feature vector by a flattening network. Subsequently, the one-dimensional feature vector is nonlinearly mapped by KAN and the probability prediction value is output. This can achieve probability prediction of whether the target service is subject to LDoS attack. The model has a simple structure, a small number of parameters, low computational cost, and high applicability.

[0010] In one possible implementation, determining whether to output an indication that the target service is under a low-rate denial-of-service (LDOS) attack based on the comparison result between the predicted probability value and a preset threshold includes: if the predicted probability value is greater than the preset threshold, then outputting an indication that the target service is under a LDOS attack; if the predicted probability value is not greater than the preset threshold, then not outputting an indication that the target service is under a LDOS attack. In this application, by comparing the predicted probability value with a preset threshold and determining whether to output an indication based on the comparison result, automated alerting for LDOS attacks can be achieved. Furthermore, the severity of the detection alert can be flexibly adjusted by changing the size of the preset threshold, thereby improving the security of network operation and maintenance.

[0011] Secondly, this application provides a low-rate denial-of-service attack detection device, which includes a module or unit for performing the low-rate denial-of-service attack detection method provided in the first aspect or any possible implementation of the first aspect.

[0012] For example, the low-rate denial-of-service attack detection device described above includes: The data acquisition module is used to acquire a set of network traffic data of the target service in each of the above-mentioned time periods of N consecutive time periods of the same duration, so as to acquire N sets of the above-mentioned network traffic data corresponding to the N above-mentioned time periods. A set of the above-mentioned network traffic data includes the statistical information of each of the above-mentioned data streams of all data streams received by the target service in one of the above-mentioned time periods, where N is a positive integer. The feature extraction module is used to extract features from each of the N sets of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data. The at least one traffic feature is then vectorized to generate a traffic feature vector corresponding to each set of network traffic data, resulting in N traffic feature vectors corresponding to the N sets of network traffic data. These N traffic feature vectors are then arranged in chronological order to generate a traffic feature vector sequence. The at least one traffic feature includes at least one of time-domain features, frequency-domain features, and information-theoretic features. The time-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the time dimension, the frequency-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the frequency dimension, and the information-theoretic features characterize the random variation characteristics of the network traffic of the target service. The attack detection module is used to input the above traffic feature vector sequence into the attack detection model, so as to output the probability prediction value of the target service being subjected to low-rate denial-of-service attack through the attack detection model. The attack detection model is a model based on Kolmogorov-Arnold Network (KAN). The output module is used to determine whether to output an indication that the target service is under the low-rate denial-of-service attack based on the comparison result between the above probability prediction value and the preset threshold.

[0013] Thirdly, this application provides a terminal device, which includes a processor and a memory. The memory stores a computer program, and the processor executes the computer program to implement the low-rate denial-of-service attack detection method provided in the first aspect or any possible implementation of the first aspect.

[0014] Fourthly, this application provides a computer program product, which includes computer instructions that, when executed by a processor, implement the low-rate denial-of-service attack detection method provided in the first aspect or any possible implementation thereof.

[0015] Fifthly, this application provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the low-rate denial-of-service attack detection method provided in the first aspect or any possible implementation thereof.

[0016] The technical effects of the second, third, fourth, and fifth aspects can be referred to the technical effects of the first aspect and any possible implementation of the first aspect, and will not be repeated here. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A schematic diagram illustrating the attack mode of a low-rate denial-of-service attack provided in an embodiment of this application; Figure 2 A schematic diagram illustrating an application scenario of the low-rate denial-of-service attack detection method provided in this application embodiment; Figure 3 A schematic diagram of the system architecture for a low-rate denial-of-service attack detection method provided in an embodiment of this application; Figure 4 This is a schematic diagram of data flow processing for a low-rate denial-of-service attack detection method provided in an embodiment of this application. Figure 5 A flowchart illustrating the low-rate denial-of-service attack detection method provided in this application embodiment; Figure 6 This is a schematic diagram of the data flow processing of the attack detection model provided in the embodiments of this application; Figure 7 A schematic diagram of the low-rate denial-of-service attack detection device provided in the embodiments of this application; Figure 8 A schematic diagram of the structure of the terminal device provided in this application.

[0019] Explanation of reference numerals in the attached figures: 10 - SDN controller; 11 - Terminal equipment; 70 - Low-rate denial-of-service attack detection device; 701 - Data Acquisition Module; 702 - Feature Extraction Module; 703 - Feature Smoothing Module; 704 - Attack Detection Module; 705 - Output Module; 110 - Processor; 111 - Memory; 112 - User interface; 113 - Network interface; 114 - Communication bus. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] To facilitate understanding, the following brief explanations are provided for some of the terms: 1. Kolmogorov-Arnold Networks (KAN): KAN is a novel neural network architecture based on the Kalmogorov representation theorem. The Kalmogorov representation theorem states that any multivariate continuous function over a bounded domain can be decomposed into a finite number of univariate continuous functions and addition operations. The core design concept of KAN is to place learnable activation functions on the edges (weights) of the network, rather than on the nodes of a traditional multi-layer perceptron (MLP), where nodes only perform addition operations.

[0022] Example 1: With the rapid development of network technology, network attack methods are also constantly evolving and upgrading. LDoS attacks are a new type of denial-of-service attack that exploits security vulnerabilities in the adaptive mechanisms of network protocols or application service protocols. By periodically sending high-speed pulse attack packets, it aims to reduce the service performance of the victim's end. For easier understanding, please refer to... Figure 1 , Figure 1 This diagram illustrates a low-rate denial-of-service attack pattern provided in an embodiment of this application. Figure 1 As shown, Figure 1 The horizontal axis represents time, and the vertical axis represents the attack rate, which is the rate at which the attacker sends attack packets to the target service. Figure 1 As can be seen, LDoS attacks are periodic and pulse-like. The attacking end does not send attack traffic between two pulses, but rather periodically sends short, high-speed attack traffic. Therefore, over a longer statistical timeframe, the average attack rate of LDoS is significantly lower than the bottleneck link bandwidth, easily bypassing traditional DoS detection systems. Simultaneously, during the duration of each attack pulse, the LDoS attack rate (i.e., the attack pulse amplitude) exceeds the bottleneck link bandwidth, thus periodically triggering frequent congestion control responses from the target service, ultimately leading to response delays or even service interruptions.

[0023] Software-defined networking (SDN) is an emerging network architecture that decouples the control plane from the data plane of network devices. It uses a centralized SDN controller to manage all forwarding devices in the network, making it more vulnerable to LDoS attacks. Attackers can exhaust SDN controller resources or switch flow table space through periodic bursts of traffic, causing network paralysis.

[0024] In traditional attack detection methods based on fixed traffic thresholds, fixed thresholds are set for network traffic parameters (such as traffic rate, number of packets, or number of connections), and attack alarms are output when the corresponding network traffic parameters exceed the fixed thresholds. However, the setting of fixed thresholds is highly sensitive. When the fixed threshold is set too low, normal burst traffic may be misjudged as attack traffic, resulting in a high false alarm rate; when the fixed threshold is set too high, LDoS with a low average traffic rate may fail to trigger alarms, leading to missed attack detections. This approach is ill-suited to the characteristic that LDoS attack traffic has an average rate similar to normal traffic.

[0025] In traditional machine learning-based attack detection methods, statistical features (such as mean and variance) of network traffic data can be manually extracted from the network traffic data. These extracted features are then classified using vector machines, decision trees, or other traditional machine learning classifiers to determine the presence of LDoS attacks. However, the feature design of this detection method relies heavily on prior knowledge and struggles to capture the nonlinear patterns and periodic attack characteristics of LDoS traffic features.

[0026] The low-rate denial-of-service attack detection method provided in this application can acquire traffic characteristics of the target service in multiple dimensions. By using the traffic characteristics of multiple dimensions as input to the attack detection model, the attack detection model can effectively distinguish between normal traffic and low-rate denial-of-service attack traffic of the target service, thereby improving the detection rate and accuracy of LDoS attacks. At the same time, the attack detection model, including KAN, is used to predict the probability of traffic characteristics in multiple dimensions. The model has a simple structure, high parameter efficiency, low computational overhead, and high applicability.

[0027] Please see Figure 2 , Figure 2 This diagram illustrates an application scenario for the low-rate denial-of-service attack detection method provided in this embodiment. The low-rate denial-of-service attack detection method provided in this embodiment can be applied to, for example... Figure 2 In the SDN network architecture shown, as Figure 2As shown, an SDN network architecture can include a data plane, a control plane, and an application plane. The data plane can include one or more network devices. These network devices can be physical switches, virtual switches, routers, gateway devices, or software switching devices; the specific type can be determined based on the actual application scenario and is not limited here. The control plane can include an SDN controller. The SDN controller can be a centralized controller or a distributed controller composed of multiple control nodes, depending on the actual application scenario and is not limited here. When the SDN controller includes multiple control nodes, these nodes can manage different network devices in the data plane respectively, and logically form a unified SDN controller through data interaction; the specific type can be determined based on the actual application scenario and is not limited here. The application plane can include one or more network applications. These network applications can include, but are not limited to, firewall applications, load balancing applications, traffic analysis applications, network performance monitoring applications, network topology management applications, and access control applications, depending on the actual application scenario and is not limited here. The SDN controller and network devices can interact via a southbound interface. The aforementioned southbound interface can be an OpenFlow-based communication interface or an interface based on other southbound communication protocols, depending on the actual application scenario; no restrictions are placed here. The SDN controller and network applications can interact via the northbound interface. This northbound interface can include, but is not limited to, application programming interfaces (APIs), remote procedure call interfaces, message queues, data buses, or shared data storage interfaces. The communication connection method is not limited; it can be directly or indirectly connected via wired or wireless communication, depending on the actual application scenario; no restrictions are placed here. Here, the SDN controller is used for centralized control and management of one or more network devices in the data plane. The SDN controller can obtain network topology and network status information of the SDN network, calculate and optimize forwarding paths based on the network topology, network status, or service requirements issued by the network application, generate corresponding flow table rules, and distribute the generated flow table rules to the corresponding network devices. Network devices in the data plane are used to match and forward received data packets according to the flow table rules issued by the control plane. Network devices can also record flow statistics information corresponding to each data flow during the forwarding process. The aforementioned flow statistics may include, but are not limited to, the number of data packets, the number of bytes, the duration, the source network address, the destination network address, the source port, the destination port, the transport protocol, and the number of flow table matches for each data flow. The specific details can be determined based on the actual application scenario and are not limited here.The SDN controller can periodically retrieve flow statistics (i.e., SDN traffic data) from network devices in the data plane. It can also correlate, filter, aggregate, and converge flow statistics from different network devices, data flows, network services, or time slices. The specific approach depends on the actual application scenario and is not limited here. Network applications in the application plane can obtain SDN network traffic data from the SDN controller.

[0028] It should be understood that the low-rate denial-of-service attack detection method (hereinafter referred to as the method for ease of description) provided in this application embodiment can be deployed as a network application on the physical device where the SDN controller resides, with the SDN controller acting as the execution entity of the method provided in this application embodiment. The method provided in this application embodiment can also be deployed as an independent network application on other physical devices besides the SDN controller, interacting with the SDN controller via a northbound interface, with the physical device acting as the execution entity to execute the method provided in this application embodiment. The method provided in this application embodiment can also be executed collaboratively by the SDN controller and the aforementioned physical devices, depending on the actual application scenario, and is not limited here. For ease of understanding and explanation, the following examples will use the method provided in this application embodiment as a physical application deployed on other physical devices besides the SDN controller, i.e., a terminal device as the execution entity of the method provided in this application embodiment.

[0029] For easier understanding, please refer to Figure 3 , Figure 3 This is a schematic diagram of the system architecture for a low-rate denial-of-service attack detection method provided in an embodiment of this application. Figure 3As shown, the system architecture includes an SDN controller 10 and a terminal device 11. The terminal device 11 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, a cloud server, an edge computing device, a laptop, a desktop computer, or a tablet, etc., depending on the actual application scenario and is not limited here. The terminal device 11 can include an operating system, hardware, and application software. The hardware can include, but is not limited to, a central processing unit (CPU), memory (such as RAM, hard disks), and peripherals, providing core capabilities for computing, storage, and input / output. The operating system acts as the hardware management and abstraction layer, scheduling CPU resources, managing memory space, and controlling peripheral operations through the kernel and drivers. It encapsulates complex hardware details into unified system calls and service interfaces, providing a stable, efficient, and secure operating environment for upper-layer application software. Application software is built on the operating system and can use hardware resources through the interfaces provided by the operating system, such as reading component source code stored in memory to provide users with usable services. The application software may include, but is not limited to, denial-of-service attack detection software, used to execute the low-rate denial-of-service attack detection method provided in the embodiments of this application.

[0030] The terminal device 11 and the SDN controller 10 can establish a communication connection. This communication connection is not limited to a specific method; it can be established directly or indirectly via wired communication or wireless communication, depending on the actual application scenario. This embodiment of the application does not impose any limitations on this method.

[0031] It should be understood that, such as Figure 3 The aforementioned terminal device 11 can be equipped with a denial-of-service (DoS) attack detection application client. This DoS attack detection software can perform LDoS attack detection based on the raw network traffic data of the target service and output detection results, alarm information, or attack indication information to the user. The specific details can be determined according to the actual application scenario and are not limited here. When this application client runs on terminal device 11, it can interact with… Figure 3 The SDN controllers 10 shown interact with each other, enabling the terminal device 11 to receive raw network traffic data from the SDN controllers. The application client can be an application program, a webpage, or a website, etc., depending on the actual application scenario, and is not limited here. The application client can be a standalone client or an embedded sub-client integrated into a client (such as a network security detection client), depending on the actual application scenario, and is not limited here. The method provided in this application embodiment can be performed by, for example... Figure 3 The SDN controller 10 shown can execute the command, or it can be executed by the terminal device 11, or it can be executed by both the terminal device 11 and the SDN controller 10. The specific execution method can be determined according to the actual application scenario, and no restrictions are imposed here.

[0032] For ease of subsequent understanding and explanation, in the embodiments of this application, the following will be used as... Figure 3 The terminal device 11 shown serves as the execution subject of the low-rate denial-of-service attack detection method (which can be simply referred to as the method for ease of description) provided in this application embodiment, combined with Figure 4 The data stream processing procedure of the low-rate denial-of-service attack detection method provided in the embodiments of this application is described.

[0033] See Figure 4 , Figure 4 This is a schematic diagram of the data flow processing for a low-rate denial-of-service attack detection method provided in an embodiment of this application. For example... Figure 4As shown, the denial-of-service attack detection software running on the terminal device 11 may include, but is not limited to, logical functional modules such as a data acquisition module, a feature extraction module, an attack detection module, and an output module. In some feasible implementations, the terminal device 11 may send a network traffic data acquisition request to the SDN controller 10. This request may carry the service identifier, network address, port number, transmission protocol, collection time range, or other information used to identify the target service. Here, the target service may be a network service running on a server, server cluster, cloud server, virtual machine, container, edge computing device, or other business device. The target service may include, but is not limited to, web services, database services, file transfer services, video services, messaging services, or industrial control services, which can be determined according to the actual application scenario and are not limited here. The SDN controller 10 may respond to the above-mentioned network traffic data acquisition request, determine the original network traffic data corresponding to the target service from the traffic data of the SDN network it stores based on the information carried in the request, and send it to the data acquisition module in the terminal device 11. Furthermore, the data acquisition module can collect a set of network traffic data for the target service within each of N consecutive time periods of equal duration from the aforementioned raw network traffic data, thereby obtaining N sets of network traffic data corresponding to the N time periods. Each set of network traffic data includes statistical information for each data stream received by the target service within a time period. Further, the data acquisition module can output the obtained N sets of network traffic data to the feature extraction module. The feature extraction module can perform feature extraction on each set of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data. Then, it performs vectorization processing on the at least one traffic feature to generate a traffic feature vector corresponding to each set of network traffic data, obtaining N traffic feature vectors corresponding to the N sets of network traffic data. The N traffic feature vectors are then arranged in chronological order to generate a traffic feature vector sequence. Here, traffic features can include time-domain features, frequency-domain features, and information-theoretic features, etc., as detailed in subsequent embodiments, which will not be elaborated upon here. Furthermore, the feature extraction module inputs the generated traffic feature vector sequence into the attack detection model, which outputs a predicted probability value of the target service being subjected to a low-rate denial-of-service attack. The attack detection model is based on a Kolmogorov-Arnold Network (KAN). The attack detection module can then output the predicted probability value to the output module. The output module receives the predicted probability value from the attack detection module and, based on a comparison with a preset threshold, determines whether to output an indication that the target service is under a low-rate denial-of-service attack. This indication information may include, but is not limited to, alarm information, attack type identifiers, attack time, attack source information, predicted probability value, and preset thresholds. The specific details can be determined according to the actual application scenario and are not limited here.Furthermore, the output module can send the indication information to the display to visualize the indication information, making it easier for maintenance personnel to promptly determine whether the target service is under LDoS attack.

[0034] The following will combine Figures 5 to 7 The low-rate denial-of-service attack detection method and apparatus provided in the embodiments of this application will be described in detail.

[0035] Example 2: Please see Figure 5 , Figure 5 This is a flowchart illustrating the low-rate denial-of-service attack detection method provided in an embodiment of this application. Figure 5 As shown, the low-rate denial-of-service attack detection method may include at least the following steps S501 to S504.

[0036] S501, obtain a set of network traffic data for the target service in each of N consecutive time periods of equal duration, so as to obtain N sets of network traffic data corresponding to N time periods. A set of network traffic data includes statistical information of each data stream of all data streams received by the target service in a time period, where N is a positive integer.

[0037] In some feasible implementations, the terminal device can obtain a set of network traffic data for the target service within each of N consecutive time periods of equal duration, to obtain N sets of network traffic data corresponding to the N time periods. Each set of network traffic data includes statistical information for each of the data streams received by the target service within a given time period, where N is a positive integer. Here, the target service can be a network service running on the terminal device, or a network service running on other physical devices or virtual machines, depending on the actual application scenario and not limited here. The target service can include, but is not limited to, web services, database services, file transfer services, video services, messaging services, or industrial control services, depending on the actual application scenario and not limited here. The terminal device can obtain the raw network traffic data corresponding to the target service from the SDN controller or network device. For example, terminal devices can query raw network traffic data collected by the SDN controller by calling the northbound interface provided by the SDN controller. They can also actively read or receive raw network traffic data reported by network devices through traffic statistics interfaces, network telemetry interfaces, port mirroring, packet capture, or traffic reporting protocols (such as NetFlow, sFlow, or IPFIX). The specific approach depends on the actual application scenario and is not limited here. The aforementioned raw network traffic data may include, but is not limited to, the number of packets, the number of bytes, the flow duration, the packet arrival timestamp, the source network address, the destination network address, the source port, the destination port, and the transport protocol for each data flow corresponding to the target service. The specific approach depends on the actual application scenario and is not limited here. Raw network traffic data can be stored in the terminal device's memory cache, log files, traffic database, time-series database, or message queue in the form of packet capture (PCAP) files, structured text, database tables, or message data. The specific approach depends on the actual application scenario and is not limited here. After acquiring the raw network traffic data, the terminal device can use methods such as batch querying, periodic collection, or streaming processing to divide the raw network traffic data into corresponding time periods according to the timestamps. Then, based on a data stream identifier consisting of at least one of the following: source network address, destination network address, source port, destination port, and transport protocol, the raw network traffic data within each time period is merged and statistically analyzed to obtain N sets of network traffic data for the target service across N time periods. It can be understood that the number N, the duration of each time period, and the interval between adjacent time periods can be determined according to the specific application scenario and are not limited here.

[0038] In some feasible implementations, the terminal device can set a sampling time window with a first preset window length, and collect raw network traffic data within the time period covered by the sampling time window as a set of network traffic data corresponding to the sampling time window. Further, the terminal device can update the time period covered by the sampling time window according to a first preset sliding step, and collect raw network traffic data within the updated time period covered by the sampling time window as a set of network traffic data corresponding to the updated sampling time window, until N sets of network traffic data are obtained, which are then used as N sets of network traffic data corresponding to the N time periods. Here, the first preset window length is equal to the duration of the time period, and the first preset sliding step is less than the first preset window length. For example, the terminal device can set the first preset window length to 5 seconds, the first preset sliding step to 1 second, and N to 4. The terminal device can use the sampling start time t0 as a reference, so the initial sampling time window covers the period from t0 to t0+5 seconds, collecting the original network traffic data corresponding to this period to obtain the first set of network traffic data. Then, the terminal device moves the sampling time window forward by 1 second, and the updated sampling time window covers the period from t0+1 seconds to t0+6 seconds, collecting the second set of network traffic data. This process is repeated, collecting the original network traffic data corresponding to the periods from t0+2 seconds to t0+7 ​​seconds and from t0+3 seconds to t0+8 seconds respectively, to serve as the third and fourth sets of network traffic data. There is a 4-second overlap between adjacent sampling time windows, which can avoid the loss of traffic characteristics in the original network traffic data due to window boundary cutting attack pulses. It can be understood that the number N, the duration of each time period (i.e., the first preset window length), and the interval between adjacent time periods (i.e., the first preset sliding step size) can all be determined according to the specific application scenario and are not limited here. In this embodiment, the original network traffic data of the target service can be sampled by a sliding sampling time window to obtain N sets of network traffic data. The first preset sliding step size is smaller than the first preset window length, so that the sampling time windows before and after the sliding have overlapping durations. This can reduce the loss of traffic features caused by window boundaries, improve the completeness of traffic feature capture and the detection rate of attack detection.

[0039] S502, feature extraction is performed on each group of network traffic data in N groups of network traffic data to obtain at least one traffic feature corresponding to each group of network traffic data. The at least one traffic feature is vectorized to generate a traffic feature vector corresponding to each group of network traffic data, so as to obtain N traffic feature vectors corresponding to N groups of network traffic data. The N traffic feature vectors are arranged in chronological order to generate a traffic feature vector sequence.

[0040] In some feasible implementations, the terminal device can extract features from each of the N sets of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data. The at least one traffic feature is then vectorized to generate a traffic feature vector corresponding to each set of network traffic data, resulting in N traffic feature vectors corresponding to the N sets of network traffic data. These N traffic feature vectors are then arranged in chronological order to generate a traffic feature vector sequence. The at least one traffic feature includes at least one of time-domain features, frequency-domain features, and information-theoretic features. The time-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the time dimension, the frequency-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the frequency dimension, and the information-theoretic features characterize the random variation characteristics of the network traffic of the target service.

[0041] Optionally, in some feasible implementations, the aforementioned time-domain features include at least one of packet arrival time interval distribution skewness, packet arrival time interval distribution kurtosis, TCP duplicate acknowledgment (ACK) packet ratio, round-trip time standard deviation, packet rate coefficient of variation, and flow duration; the aforementioned frequency-domain features include at least one of the spectral dominant frequency energy ratio and wavelet high-frequency detail energy ratio; the aforementioned information-theoretic features include at least one of the destination port distribution entropy and packet count sequence sample entropy. Here, the terminal device can calculate the specific values ​​of each traffic feature one by one according to preset calculation rules based on the statistical information of each data stream contained in each set of network traffic data to obtain at least one traffic feature. Then, the terminal device can vectorize the aforementioned at least one traffic feature to generate a corresponding traffic feature vector. For example, the terminal device can perform feature standardization processing (e.g., normalization processing) on ​​each traffic feature, and then combine the feature values ​​of each traffic feature obtained after standardization processing into a multi-dimensional vector according to a preset feature order. Thus, each dimension value of the vector corresponds to a traffic feature.

[0042] To facilitate understanding of the various traffic characteristics provided in the embodiments of this application, please refer to the following table:

[0043] As shown in the table above, time-domain features characterize the statistical distribution characteristics of network traffic of the target service in the time dimension, reflecting the distortion of packet arrival patterns, increased rate fluctuations, and transmission anomalies caused by LDoS attack pulses. Frequency-domain features characterize the energy distribution characteristics of network traffic of the target service in the frequency dimension, reflecting the dominant frequency component and local mutations generated by the periodic pulses of LDoS attacks in the frequency domain. Information-theoretic features characterize the random variation characteristics of network traffic of the target service, reflecting the simplification effect of the periodic behavior of LDoS attacks on traffic timing patterns. Thus, traffic features of different dimensions can reflect the impact of LDoS on network traffic from different aspects, jointly characterizing the traffic behavior of LDoS attacks. In the embodiments of this application, by extracting traffic features of multiple different dimensions such as time domain, frequency domain, or information theory as input to the attack detection model, the network traffic anomalies of the target service caused by low-rate attack pulses can be accurately captured, improving the detection rate and accuracy of LDoS.

[0044] Furthermore, the terminal device can perform the aforementioned feature extraction and vectorization processing operations on each set of network traffic data to obtain N traffic feature vectors. The terminal device can then arrange these N traffic feature vectors in chronological order. For example, the traffic feature vector corresponding to the first time period can be used as the first element of the sequence, the traffic feature vector corresponding to the second time period as the second element, and so on, generating a sequence of traffic feature vectors. This sequence of traffic feature vectors can be represented by an N×D two-dimensional matrix, where N represents the number of time periods and D represents the number of traffic features contained in each traffic feature vector. The rows of this two-dimensional matrix correspond to the chronological order, meaning each row corresponds to one traffic feature vector, and the columns correspond to the order in which the traffic features are arranged, meaning each column corresponds to one traffic feature.

[0045] For example, assuming N is 4 and D is 5, the four traffic feature vectors obtained according to the chronological order of the four sets of network traffic data are (0.81, 0.22, 0.06, 0.31, 0.73), (0.62, 0.71, 0.19, 0.76, 0.39), (0.68, 0.75, 0.24, 0.81, 0.33), and (0.21, 0.25, 0.08, 0.35, 0.68), which can generate the following two-dimensional matrix:

[0046] In some feasible implementations, the aforementioned traffic feature includes time-domain features, frequency-domain features, and information-theoretic features. That is, for each set of network traffic data, the terminal device calculates the time-domain features, frequency-domain features, and information-theoretic features respectively to generate a traffic feature vector corresponding to each set of network traffic data. In the embodiments of this application, by extracting traffic features from multiple different dimensions—time-domain, frequency-domain, and information-theoretic—network traffic anomalies of target services caused by low-rate attack pulses can be accurately captured, improving the detection rate and accuracy of LDoS.

[0047] S503, input the above traffic feature vector sequence into the attack detection model, so as to output the probability prediction value of the target service being subjected to a low-rate denial-of-service attack through the attack detection model. The attack detection model is a model based on Kolmogorov-Arnold Network (KAN).

[0048] In some feasible implementations, the terminal device can input the aforementioned traffic feature vector sequence into an attack detection model to output a predicted probability value of the target service being subjected to a low-rate denial-of-service attack. This attack detection model includes a KAN (Knowledge-Agent Network). Here, the KAN network can be composed of multiple interconnected KAN layers, with adjacent KAN layers connected by edges. The activation function on each edge is a learnable univariate continuous function, typically implemented using a B-spline function. A B-spline function is a piecewise polynomial curve formed by a linear combination of basis functions and control points (or B-spline coefficients). The parameters of the B-spline function (such as control points) can be optimized during training through backpropagation and gradient descent, enabling the function to fit a suitable nonlinear mapping relationship according to the data distribution. Each node in the KAN sums the nonlinear mapping results output by each connected edge, which becomes the output of that node. It is understood that the B-spline function on each connection edge in a KAN has independent learnable parameters. This allows KAN to fit more complex nonlinear mapping relationships with the same parameter scale, while also possessing higher parameter efficiency compared to traditional neural networks (such as MLPs). Therefore, in this embodiment, using KAN as the core network of the attack detection model can more accurately capture the complex patterns exhibited by LDoS attacks in multiple dimensions such as the time domain, frequency domain, and information theory, thereby improving the accuracy and robustness of attack detection. It is understood that the aforementioned attack detection model can be pre-trained. During the training phase, the terminal device can acquire a training sample set, which includes multiple training samples. Each training sample can include a sequence of sample traffic feature vectors and corresponding label information. The label information is used to indicate whether the network traffic corresponding to the sample traffic feature vector sequence is low-rate denial-of-service attack traffic. The terminal device can sequentially input the training samples from the aforementioned training sample set into the attack detection model to be trained, and the attack detection model outputs predicted probability values. The terminal device can calculate the loss value (e.g., using cross-entropy loss function, mean squared error loss function, or other applicable loss function) based on the predicted probability value and the label information. It then calculates the gradients of each learnable parameter in the attack detection model (including the parameters of the B-spline function on each connection edge) using the backpropagation algorithm. The optimizer then updates the learnable parameters based on these gradients. The terminal device can iteratively execute this process until the loss value converges or a preset number of training epochs are reached, resulting in a trained attack detection model. The specific training iteration can be determined based on the actual application scenario and is not limited here. Here, the traffic feature vector sequence serves as the input to the attack detection model, which processes the sequence to output the predicted probability value.The above probability prediction value can be a floating-point number between 0 and 1, used to quantify the probability that the network traffic corresponding to the current traffic feature vector sequence belongs to a low-rate denial-of-service attack. For example, the closer the value is to 1, the higher the probability of an attack occurring, and the closer it is to 0, the higher the probability that the network traffic is normal traffic.

[0049] In some feasible implementations, the attack detection model includes a convolutional network, a flattening network, and a KAN connected in sequence. The terminal device can input the traffic feature vector sequence into the convolutional network of the attack detection model to extract convolutional features from the traffic feature vector sequence and output convolutional traffic features to the flattening network. Furthermore, the terminal device can flatten the convolutional traffic features into a one-dimensional feature vector using the flattening network and output the one-dimensional feature vector to the KAN. Further, the terminal device can perform nonlinear mapping on the one-dimensional feature vector using B-spline functions on each connection edge in the KAN to output a nonlinear mapping result, and sum the nonlinear mapping results output by each connection edge through each node in the KAN to output a predicted probability value of the target service being subjected to the low-rate denial-of-service attack. The KAN includes multiple KAN layers connected in sequence, and the connection edges are the connection edges between two adjacent KAN layers. Here, the traffic feature vector sequence can be a two-dimensional matrix, with each row corresponding to a traffic feature vector and each column corresponding to a traffic feature. Attack detection models can consist of sequentially connected convolutional networks, flattening networks, and KANs to process traffic feature vector sequences and output a predicted probability of the target service being subjected to LDoS. For ease of understanding, let's combine... Figure 6 The above process is illustrated with an example. Figure 6 This is a schematic diagram of the data flow processing of the attack detection model provided in the embodiments of this application. For example... Figure 6As shown, the terminal device can input a sequence of traffic feature vectors (e.g., a 10×10 two-dimensional matrix) into a convolutional network. The convolutional network can include one or more convolutional layers, such as a single 3×3 kernel layer with a stride of 1 and 1 output channel. It performs convolutional feature extraction on the input two-dimensional matrix to extract local correlation patterns between different feature dimensions in adjacent time periods, outputting an 8×8×1 convolutional traffic feature to a flattening network. The flattening network flattens the convolutional traffic feature into a one-dimensional feature vector, specifically, flattening the 8×8×1 convolutional traffic feature into a one-dimensional feature vector of length 64. The KAN receives this one-dimensional feature vector and performs nonlinear mapping using B-spline functions on the connection edges between KAN layers. The nonlinear mapping results are then summed through the nodes in the KAN. For example, the KAN can include a first KAN layer and a second KAN layer. The first KAN layer has an input dimension of 64 and an output dimension of 256, while the second KAN layer has an input dimension of 256 and an output dimension of 1. Each edge in the first and second KAN layers is equipped with a B-spline function to perform a nonlinear mapping on the one-dimensional feature vector to obtain the nonlinear mapping result. Each node is used to sum the nonlinear mapping results output by each connected edge, and finally outputs a predicted probability value of whether the target service is subjected to a low-rate denial-of-service (LDoS) attack. It is understood that the specific structure and parameters of the attack detection model can be determined according to the actual application scenario, and are not limited here. In this embodiment, by inputting the traffic feature vector into a convolutional network for feature extraction to obtain convolutional traffic features, and then flattening the convolutional traffic features into a one-dimensional feature vector through a flattening network, and then performing a nonlinear mapping on the one-dimensional feature vector through KAN to output a probability prediction value, the probability prediction of whether the target service is subjected to an LDoS attack can be realized. The model structure is simple, the number of parameters is small, the computational cost is low, and the applicability is high.

[0050] S504. Based on the comparison between the above probability prediction value and the preset threshold, determine whether to output an indication message that the target service is under low-rate denial-of-service attack.

[0051] In some feasible implementations, the terminal device can determine whether to output an indication that the target service is under a low-rate denial-of-service (LDOS) attack based on a comparison between the predicted probability value and a preset threshold. Here, the terminal device can obtain a preset threshold, which can be user-inputted or a historical threshold. This threshold can be dynamically adjusted according to detection accuracy and false alarm rate requirements, and can be determined based on the actual application scenario; no restrictions are imposed here. Furthermore, the terminal device can compare the predicted probability value with the preset threshold to obtain a comparison result, and based on the comparison result, determine whether the current network traffic belongs to LDOS attack traffic, thereby determining whether to output the corresponding indication information. It is understood that the above comparison results can include three cases: the probability prediction value is greater than the preset threshold, the probability prediction value is equal to the preset threshold, and the probability prediction value is less than the preset threshold. The terminal device can pre-configure the processing strategy corresponding to each comparison result. For example, the terminal device can determine that the current network traffic is LDoS attack traffic if the probability prediction value is greater than the preset threshold, and output an indication that the target service is under a low-rate denial-of-service attack. At the same time, if the probability prediction value is less than or equal to the preset threshold, it can determine that the current network traffic is normal traffic, and determine not to output an indication that the target service is under a low-rate denial-of-service attack. The specific determination can be made according to the actual application scenario, and no restrictions are imposed here.

[0052] In some feasible implementations, if the predicted probability value is greater than the preset threshold, the terminal device outputs an indication that the target service is under a low-rate denial-of-service attack; if the predicted probability value is not greater than the preset threshold, the terminal device does not output an indication that the target service is under a low-rate denial-of-service attack. Here, the indication information may include, but is not limited to, alarm information, attack type identifier, attack timestamp, service identifier of the target service, and predicted probability value, etc., which can be determined according to the actual application scenario and is not limited here. The indication information can be displayed visually on the terminal device's human-computer interaction interface, such as in the form of pop-ups, status indicator lights, trend charts, or alarm lists to users or network administrators; the indication information can also be stored in the terminal device's local storage or cloud database for subsequent auditing, tracing, or statistical analysis; the indication information can also be sent to the SDN controller, network management device, or third-party security platform via the northbound interface to trigger protection operations such as traffic scrubbing, flow table updates, black hole routing, or alarm linkage. In this embodiment of the application, by comparing the probability prediction value with a preset threshold and determining whether to output an indication message based on the comparison result, automated alarms for LDoS attacks can be achieved. At the same time, the strictness of the detection alarm can be flexibly adjusted by adjusting the size of the preset threshold, thereby improving the security of network operation and maintenance.

[0053] In some feasible implementations, before step S503, the terminal device can set a smoothing processing window with a second preset window length, obtain multiple consecutive traffic feature vectors in the traffic feature vector sequence within the location range covered by the smoothing processing window, and use them as a set of traffic feature vectors corresponding to the smoothing processing window. The feature values ​​of the set of traffic feature vectors corresponding to the smoothing processing window in the same dimension are averaged to obtain a smooth traffic feature vector corresponding to the smoothing processing window. The second preset window length is an odd number. Furthermore, the terminal device can update the location range covered by the smoothing processing window according to a second preset sliding step size, obtain multiple consecutive traffic feature vectors in the traffic feature vector sequence within the updated location range covered by the smoothing processing window, and use them as a set of traffic feature vectors corresponding to the updated smoothing processing window. The feature values ​​of the set of traffic feature vectors corresponding to the updated smoothing processing window in the same dimension are averaged to obtain a smooth traffic feature vector corresponding to the updated smoothing processing window. This process continues until N smooth traffic feature vectors are obtained, where the second preset sliding step size is 1, and each traffic feature vector in the traffic feature vector sequence corresponds to one smooth traffic feature vector. Furthermore, the terminal device can update each of the aforementioned traffic feature vectors in the traffic feature vector sequence to the corresponding smoothed traffic feature vector, thereby smoothing the traffic feature vector sequence. Here, the smoothing window is a data truncation window that slides across the traffic feature vector sequence, used to extract multiple consecutive traffic feature vectors from the sequence for smoothing. The second preset window length is the number of traffic feature vectors covered by the smoothing window. It can be understood that a larger second preset window length results in a stronger smoothing effect and stronger suppression of high-frequency noise, but may also lead to greater loss of detailed information in the traffic feature vector sequence. Conversely, a smaller second preset window length results in a weaker smoothing effect and a higher degree of preservation of the original data of the traffic feature vector sequence. The second preset window length can be set to an odd number (e.g., 3, 5, 7, or 9) to ensure that the smoothing window has a clear center position in the traffic feature vector sequence, guaranteeing that the smoothing window can symmetrically select the traffic feature vectors before and after it for averaging, centered on the current traffic feature vector to be processed, thus ensuring accurate temporal alignment between the smoothed traffic feature vector and its corresponding traffic feature vector. It can be understood that the second preset sliding step size is the distance the smoothing window moves on the flow feature vector sequence between two adjacent smoothing operations.When the second preset sliding step size is 1, the terminal device can start from the first vector of the traffic feature vector sequence, using each traffic feature vector as the center of the window, and perform smoothing processing on each traffic feature vector in turn to generate a smooth traffic feature vector sequence with the same length as the original traffic feature vector sequence. When the second preset sliding step size is greater than 1, the center position of the smoothing processing window will skip some traffic feature vectors during the update, and the number of smooth traffic feature vectors generated in this case is less than the length of the original traffic feature vector sequence.

[0054] For example, the terminal device can set the second preset window length to L, where L is an odd number (e.g., L=3, 5, 7, or 9). Then, the terminal device can center on the i-th traffic feature vector in the traffic feature vector sequence, placing this traffic feature vector in the middle of the smoothing window. This determines the range covered by the smoothing window from i-(L-1) / 2 to i+(L-1) / 2. The terminal device can then acquire all traffic feature vectors within this range, i.e., from the i-(L-1) / 2-th to the i+(L-1) / 2-th traffic feature vector in the traffic feature vector sequence, as a set of traffic feature vectors corresponding to the smoothing window. Furthermore, the terminal device can average the feature values ​​of this set of traffic feature vectors along the same dimension, calculating the average of all feature values ​​corresponding to each dimension of the traffic feature vectors in the set, to obtain the smoothed traffic feature vector corresponding to the smoothing window. Here, the averaging calculation includes, but is not limited to, the arithmetic mean, geometric mean, or median, etc., which can be determined according to the actual application scenario and is not limited here. It can be understood that the terminal device can start from i=1 and update the center position of the smoothing processing window sequentially according to the second preset sliding step size (i.e., step size of 1). That is, it can repeat the above operation with the 1st, 2nd, 3rd, ..., Nth traffic feature vector as the center until N smoothed traffic feature vectors are obtained. It should be noted that when the coverage of the smoothing processing window exceeds the boundary of the traffic feature vector sequence (for example, when processing the 1st or Nth vector in the traffic feature vector sequence), the terminal device can use the vectors that fall within the sequence range of the smoothing processing window for averaging calculation. That is, the terminal device can obtain the intersection of the position range covered by the smoothing processing window and the index range [1, N] of the traffic feature vector sequence, and use the traffic feature vectors in the traffic feature vector sequence that are within the intersection as a set of traffic feature vectors corresponding to the above smoothing processing window for averaging calculation. In addition, the terminal device can also use methods including but not limited to zero padding, mirror padding, and extended padding to expand the traffic feature vector sequence in order to smooth the boundary vectors in the traffic feature vector sequence. The specific method can be determined according to the actual application scenario and is not limited here. It is understood that, in the embodiments of this application, the terminal device can continuously acquire N sets of network traffic data corresponding to the target service and generate a corresponding traffic feature vector sequence, which can be used as input to the attack detection model for LDoS detection.When smoothing the current traffic feature vector sequence, the terminal device can retrieve one or more historical traffic feature vectors preceding the current traffic feature vector sequence (i.e., those generated earlier than the generation time of the first traffic feature vector in the current traffic feature vector sequence) from its local memory, or one or more subsequent traffic feature vectors following the current traffic feature vector sequence (i.e., those generated later than the generation time of the last traffic feature vector in the current traffic feature vector sequence). Therefore, when the area covered by the smoothing window exceeds the boundary of the current traffic feature vector sequence, the terminal device can retrieve historical or subsequent traffic feature vectors from its local memory that exceed the area covered by the smoothing window to participate in the averaging calculation corresponding to that smoothing window. In this embodiment, by smoothing the traffic feature vector sequence and using the smoothed traffic feature vector sequence as input to the attack detection model, the high-frequency noise of the traffic feature vector sequence can be effectively reduced while preserving the long-term trend traffic characteristics caused by low-rate denial-of-service attacks. This improves the stability of the input features of the attack detection model, thereby enhancing the attack detection accuracy and anti-interference capability.

[0055] In summary, the low-rate denial-of-service (LDOS) attack detection method provided in this application can acquire traffic characteristics of a target service across multiple dimensions. By using these multi-dimensional traffic characteristics as input to an attack detection model, the model can effectively distinguish between normal traffic and low-rate DDoS attack traffic, improving the detection rate and accuracy of LDoS attacks. Furthermore, the use of an attack detection model incorporating KAN for probabilistic prediction of multi-dimensional traffic characteristics results in a simple model structure, high parameter efficiency, low computational overhead, and high applicability. Therefore, the low-rate DDoS attack detection method provided in this application can enhance user experience and strengthen product market competitiveness, offering various enterprises a highly efficient, secure, and accurate solution for low-rate DDoS attack detection.

[0056] Example 3: Based on the above embodiments, this embodiment provides a low-rate denial-of-service attack detection device. This low-rate denial-of-service attack detection device can be applied to... Figures 3 to 6 In any of the embodiments shown in the figure, the steps in the low-rate denial-of-service attack detection method described above are used to perform the steps in the low-rate denial-of-service attack detection method. See also Figure 7 , Figure 7 This is a schematic diagram of the structure of a low-rate denial-of-service attack detection device provided in an embodiment of this application. Figure 7 As shown in this embodiment, the low-rate denial-of-service attack detection device 70 can operate the following modules: The data acquisition module 701 is used to acquire a set of network traffic data of the target service in each of the N consecutive time periods of the same duration, so as to acquire N sets of network traffic data corresponding to the N time periods. A set of network traffic data includes statistical information of each of the data streams received by the target service in a time period, where N is a positive integer. The feature extraction module 702 is used to extract features from each of the N sets of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data, to vectorize the at least one traffic feature to generate a traffic feature vector corresponding to each set of network traffic data, to obtain N traffic feature vectors corresponding to the N sets of network traffic data, and to arrange the N traffic feature vectors in chronological order to generate a traffic feature vector sequence; wherein, the at least one traffic feature includes at least one of time-domain features, frequency-domain features, and information-theoretic features; the time-domain features are used to characterize the statistical distribution characteristics of the network traffic of the target service in the time dimension, the frequency-domain features are used to characterize the statistical distribution characteristics of the network traffic of the target service in the frequency dimension, and the information-theoretic features are used to characterize the random variation characteristics of the network traffic of the target service; The attack detection module 704 is used to input the above-mentioned traffic feature vector sequence into the attack detection model, so as to output the probability prediction value of the target service being subjected to low-rate denial-of-service attack through the attack detection model, wherein the attack detection model includes a KAN network. The output module 705 is used to determine whether to output an indication that the target service is under the low-rate denial-of-service attack based on the comparison result between the above probability prediction value and the preset threshold.

[0057] In some feasible implementations, the data acquisition module 701 described above is used for: Set a sampling time window with a first preset window length, collect the raw network traffic data within the time period covered by the sampling time window, and use it as a set of network traffic data corresponding to the sampling time window. The sampling time window is updated according to the first preset sliding step size, and the original network traffic data within the updated sampling time window is collected as a set of network traffic data corresponding to the updated sampling time window. This process continues until N sets of network traffic data are obtained, which are then used as N sets of network traffic data corresponding to the N time periods. The length of the first preset window is equal to the duration of the time period, and the first preset sliding step size is less than the length of the first preset window.

[0058] In some feasible implementations, the aforementioned low-rate denial-of-service attack detection device further includes: The feature smoothing module 703 is used to set a smoothing processing window with a second preset window length before the attack detection module 704 inputs the above traffic feature vector sequence into the attack detection model, to obtain multiple consecutive traffic feature vectors in the above traffic feature vector sequence within the position range covered by the above smoothing processing window, as a set of traffic feature vectors corresponding to the above smoothing processing window, and to average the feature values ​​of the set of traffic feature vectors corresponding to the above smoothing processing window in the same dimension to obtain a smooth traffic feature vector corresponding to the above smoothing processing window, wherein the second preset window length is an odd number; The aforementioned feature smoothing module 703 is further configured to update the position range covered by the smoothing window according to the second preset sliding step size, obtain multiple consecutive flow feature vectors in the flow feature vector sequence within the position range covered by the updated smoothing window, and use them as a set of flow feature vectors corresponding to the updated smoothing window. The average value of the feature values ​​of the set of flow feature vectors corresponding to the updated smoothing window in the same dimension is calculated to obtain a smoothed flow feature vector corresponding to the updated smoothing window, until N smoothed flow feature vectors are obtained. The second preset sliding step size is 1, and each flow feature vector in the flow feature vector sequence corresponds to a smoothed flow feature vector. The aforementioned feature smoothing module 703 is further configured to update each of the aforementioned traffic feature vectors in the aforementioned traffic feature vector sequence to the aforementioned smoothed traffic feature vector corresponding to each of the aforementioned traffic feature vectors, so as to smooth the aforementioned traffic feature vector sequence.

[0059] In some feasible implementations, the attack detection module 704 described above is used for: The above traffic feature vector sequence is input into the above convolutional network in the above attack detection model, so that the above convolutional network can extract convolutional features from the above traffic feature vector sequence and output convolutional traffic features to the above flattening network. The above-mentioned flattening network flattens the above-mentioned convolutional flow features into a one-dimensional feature vector and outputs the above-mentioned one-dimensional feature vector to the above-mentioned KAN. The one-dimensional feature vector is nonlinearly mapped by the B-spline function on each connecting edge in the KAN to output the nonlinear mapping result. The nonlinear mapping results output by each connecting edge are summed by each node in the KAN to output the probability prediction value of the target service being subjected to the low-rate denial-of-service attack. The KAN includes multiple KAN layers connected in sequence, and the connecting edge is the connecting edge between two adjacent KAN layers in the multiple KAN layers connected in sequence.

[0060] In some feasible implementations, the output module 705 described above is used for: If the predicted probability value is greater than the preset threshold, an indication that the target service is under a low-rate denial-of-service attack will be output; if the predicted probability value is not greater than the preset threshold, no indication that the target service is under a low-rate denial-of-service attack will be output.

[0061] In the embodiments of this application, the modules in the device shown in the figures above can be individually or entirely combined into one or more other modules, or some of the modules can be further divided into multiple functionally smaller modules. This achieves the same operation without affecting the technical effect of the embodiments of this application. The above modules are based on logical function division. In practical applications, the function of one module can be implemented by multiple modules, or the function of multiple modules can be implemented by one module. In other feasible implementations of this application, the device may also include other modules. In practical applications, these functions can also be implemented with the assistance of other modules, and can be implemented collaboratively by multiple modules, without limitation.

[0062] In some feasible implementations, the above Figure 5 The implementation methods provided for each step in the low-rate denial-of-service attack detection method shown can be derived from... Figure 7 The various modules of the illustrated device are executed. For example, the above... Figure 5 In the low-rate denial-of-service attack detection method shown, step S501 can be performed by... Figure 7 The data acquisition module 701 in the device shown executes the steps, and step S502 can be performed by the data acquisition module 701 in the device shown. Figure 7 The feature extraction module 702 in the device shown performs the step S503, which can be performed by the following steps respectively: Figure 7 The attack detection module 704 in the illustrated device is executed. The implementation method of this module can be found in the implementation methods provided in the various steps of the above embodiments, and will not be repeated here.

[0063] In summary, the low-rate denial-of-service (LDOS) attack detection device provided in this application embodiment comprises at least a data acquisition module 701, a feature extraction module 702, an attack detection module 704, and an output module 705. It may also include a feature smoothing module 703 or other functional sub-modules, which are not limited herein. This LDOS detection device can acquire traffic characteristics of the target service across multiple dimensions. By using these multi-dimensional traffic characteristics as input to the attack detection model, the model can effectively distinguish between normal traffic and low-rate denial-of-service (LDOS) attack traffic, improving the detection rate and accuracy of LDOS attacks. Furthermore, it employs an attack detection model including KAN to perform probabilistic prediction of multi-dimensional traffic characteristics, resulting in a simple model structure, high parameter efficiency, low computational overhead, and high applicability. Therefore, the LDOS attack detection device provided in this application embodiment can enhance user experience and strengthen product market competitiveness, providing various enterprises with a highly efficient, secure, and accurate solution for low-rate denial-of-service (LDOS) attack detection.

[0064] See Figure 8 , Figure 8 A schematic diagram of the structure of the terminal device provided in this application. Figure 8 As shown, the terminal device 11 can be the above-mentioned Figures 3 to 6 The terminal device in the corresponding embodiment. The terminal device 11 includes a processor 110, which is coupled to a memory 111. The memory 111 is used to store computer programs or instructions and / or data. The processor 110 is used to execute the computer programs or instructions stored in the memory 111, or to read the data stored in the memory 111, to execute the methods in the above method embodiments. Optionally, there may be one or more processors 110. Optionally, there may be one or more memories 111. Optionally, the memory 111 may be integrated with the processor 110, or may be separately configured.

[0065] In addition, the terminal device 11 may further include: a user interface 112, a network interface 113, and at least one communication bus 114. The communication bus 114 is used to enable communication between these components. The user interface 112 may include a display screen and a keyboard; optionally, the user interface 112 may also include a standard wired interface and a wireless interface. Optionally, the network interface 113 may include a standard wired interface and a wireless interface (such as a Wi-Fi interface). The memory 111 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 111 may also be at least one storage device located remotely from the aforementioned processor 110. Figure 8As shown, the memory 111, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application program. The network interface 113 in the terminal device 11 can also connect to the aforementioned... Figure 3 The SDN controller in the corresponding embodiment establishes a network connection. Figure 8 In the terminal device 11 shown, the network interface 113 provides network communication functionality; the user interface 112 is mainly used to provide an input interface for developers; and the processor 110 can be used to call the device control application stored in the memory 111 to implement the aforementioned... Figure 5 The corresponding embodiment describes a low-rate denial-of-service attack detection method.

[0066] It should be understood that the terminal device 11 described in the embodiments of this application can perform the foregoing... Figures 3 to 6 The description of the low-rate denial-of-service attack detection method in any of the embodiments corresponding to the figures will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. In addition, this application also provides a computer-readable storage medium storing computer instructions, which, when executed on a computer, cause the methods in the various method embodiments of this application to be performed.

[0067] This application also provides a computer program product, which includes computer program code or instructions, such that when the computer program code or instructions are run on a computer, the methods in the various method embodiments of this application are executed.

[0068] Furthermore, this application also provides a chip including a processor. A memory for storing a computer program is provided independently of the chip, and the processor is used to execute the computer program stored in the memory, so that the methods in the various method embodiments of this application are performed.

[0069] Furthermore, the chip may also include a communication interface. This communication interface can be an input / output interface or an interface circuit, etc. Furthermore, the chip may also include a memory.

[0070] It should be understood that the processor in the embodiments of this application can be an integrated circuit chip with the ability to process signals. In implementation, each step of the above method embodiments can be completed by the integrated logic circuitry in the processor's hardware or by instructions in software form. The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware encoding processor, or implemented by a combination of hardware and software modules in the encoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0071] The memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), and synchronous link dynamic memory (SLDRAM).

[0072] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory can be integrated into the processor.

[0073] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0074] The term "comprising," and any variations thereof, in the specification, claims, and drawings of this application are intended to cover a non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatus, products, or devices. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the composition and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0075] The methods and related apparatuses provided in this application are described with reference to the method flowcharts and / or structural diagrams provided in this application. Specifically, each block of the method flowchart and / or structural diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to create a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 A process or multiple processes and / or structures illustrate the steps of the functions specified in one or more boxes.

[0076] The above-described preferred embodiments have further illustrated the purpose, technical solutions, and advantages of this application. It should be understood that the above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for detecting low-rate denial-of-service attacks, characterized in that, include: Obtain a set of network traffic data for the target service within each of N consecutive time periods of equal duration, to obtain N sets of network traffic data corresponding to the N time periods. Each set of network traffic data includes statistical information of each of the data streams received by the target service within a time period, where N is a positive integer. Feature extraction is performed on each of the N sets of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data. The at least one traffic feature is then vectorized to generate a traffic feature vector corresponding to each set of network traffic data, resulting in N traffic feature vectors corresponding to the N sets of network traffic data. The N traffic feature vectors are then arranged in chronological order to generate a traffic feature vector sequence. The at least one traffic feature includes at least one of time-domain features, frequency-domain features, and information-theoretic features. The time-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the time dimension, the frequency-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the frequency dimension, and the information-theoretic features characterize the random variation characteristics of the network traffic of the target service. The traffic feature vector sequence is input into the attack detection model to output a predicted probability value of the target service being subjected to a low-rate denial-of-service attack. The attack detection model is a model based on Kolmogorov-Arnold Network (KAN). Based on the comparison between the predicted probability value and the preset threshold, it is determined whether to output an indication that the target service is under a low-rate denial-of-service attack.

2. The method according to claim 1, characterized in that, The time-domain features include at least one of packet arrival time interval distribution skewness, packet arrival time interval distribution kurtosis, TCP duplicate ACK packet ratio, round-trip time standard deviation, packet rate coefficient of variation, and flow duration; the frequency-domain features include at least one of spectrum dominant frequency energy ratio and wavelet high-frequency detail energy ratio; the information-theoretic features include at least one of destination port distribution entropy and packet count sequence sample entropy.

3. The method according to claim 1, characterized in that, The at least one flow characteristic includes time-domain characteristics, frequency-domain characteristics, and information-theoretic characteristics.

4. The method according to any one of claims 1 to 3, characterized in that, The step of obtaining a set of network traffic data for the target service within each of N consecutive time periods of equal duration, to obtain N sets of network traffic data corresponding to the N time periods, includes: Set a sampling time window with a first preset window length, collect raw network traffic data within the time period covered by the sampling time window, and use it as a set of network traffic data corresponding to the sampling time window; The sampling time window is updated according to the first preset sliding step size, and the original network traffic data within the updated sampling time window is collected as a set of network traffic data corresponding to the updated sampling time window. This process continues until N sets of network traffic data are obtained, which are then used as N sets of network traffic data corresponding to the N time periods. The first preset window length is equal to the duration of the time period, and the first preset sliding step size is less than the first preset window length.

5. The method according to any one of claims 1 to 3, characterized in that, Before inputting the traffic feature vector sequence into the attack detection model, the method further includes: A smoothing window with a second preset window length is set. Multiple consecutive traffic feature vectors in the traffic feature vector sequence within the location range covered by the smoothing window are obtained as a set of traffic feature vectors corresponding to the smoothing window. The feature values ​​of the set of traffic feature vectors corresponding to the smoothing window are averaged on the same dimension to obtain a smooth traffic feature vector corresponding to the smoothing window. The second preset window length is an odd number. The position range covered by the smoothing window is updated according to the second preset sliding step size. Multiple consecutive traffic feature vectors in the traffic feature vector sequence within the position range covered by the updated smoothing window are obtained as a set of traffic feature vectors corresponding to the updated smoothing window. The average value of the feature values ​​of the set of traffic feature vectors corresponding to the updated smoothing window in the same dimension is calculated to obtain a smooth traffic feature vector corresponding to the updated smoothing window. This process is repeated until N smooth traffic feature vectors are obtained. The second preset sliding step size is 1, and each traffic feature vector in the traffic feature vector sequence corresponds to a smooth traffic feature vector. Each traffic feature vector in the traffic feature vector sequence is updated to the smoothed traffic feature vector corresponding to each traffic feature vector, so as to smooth the traffic feature vector sequence.

6. The method according to any one of claims 1 to 3, characterized in that, The attack detection model includes a convolutional network, a flattening network, and the KAN connected in sequence; the step of inputting the traffic feature vector sequence into the attack detection model to output a predicted probability value of the target service being subjected to a low-rate denial-of-service attack includes: The traffic feature vector sequence is input into the convolutional network in the attack detection model, so that the convolutional network extracts convolutional features from the traffic feature vector sequence and outputs convolutional traffic features to the flattening network. The flattening network flattens the convolutional flow features into a one-dimensional feature vector and outputs the one-dimensional feature vector to the KAN. The one-dimensional feature vector is nonlinearly mapped by the B-spline function on each connecting edge in the KAN to output the nonlinear mapping result. The nonlinear mapping results output by each connecting edge are summed by each node in the KAN to output the probability prediction value of the target service being subjected to the low-rate denial-of-service attack. The KAN includes multiple KAN layers connected in sequence, and the connecting edge is the connecting edge between two adjacent KAN layers in the multiple sequentially connected KAN layers.

7. The method according to any one of claims 1 to 3, characterized in that, The step of determining whether to output an indication that the target service is under a low-rate denial-of-service attack based on the comparison result between the probability prediction value and the preset threshold includes: If the predicted probability value is greater than the preset threshold, an indication that the target service is under a low-rate denial-of-service attack is output; if the predicted probability value is not greater than the preset threshold, no indication that the target service is under a low-rate denial-of-service attack is output.

8. A low-rate denial-of-service attack detection device, characterized in that, include: The data acquisition module is used to acquire a set of network traffic data of the target service in each of the N consecutive time periods of equal duration, so as to acquire N sets of network traffic data corresponding to the N time periods. A set of network traffic data includes statistical information of each of the data streams received by the target service in a time period, where N is a positive integer. A feature extraction module is used to extract features from each of the N sets of network traffic data to obtain at least one traffic feature corresponding to each set of network traffic data. The at least one traffic feature is then vectorized to generate a traffic feature vector corresponding to each set of network traffic data, resulting in N traffic feature vectors corresponding to the N sets of network traffic data. These N traffic feature vectors are then arranged in chronological order to generate a traffic feature vector sequence. The at least one traffic feature includes at least one of time-domain features, frequency-domain features, and information-theoretic features. The time-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the time dimension, the frequency-domain features characterize the statistical distribution characteristics of the network traffic of the target service in the frequency dimension, and the information-theoretic features characterize the random variation characteristics of the network traffic of the target service. An attack detection module is used to input the traffic feature vector sequence into an attack detection model, so as to output a probability prediction value of the target service being subjected to a low-rate denial-of-service attack through the attack detection model, wherein the attack detection model is a model based on Kolmogorov-Arnold Network (KAN). The output module is used to determine whether to output an indication that the target service is under the low-rate denial-of-service attack based on the comparison result between the probability prediction value and the preset threshold.

9. A terminal device, characterized in that, include: A processor and a memory, the memory storing a computer program, the processor executing the computer program to implement the method of claims 1-7.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the method of claims 1-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method of claims 1-7.

Images