Method for defending ndn attacks and related hardware

Abstract

The present application relates to the technical field of NDN security, in particular to a NDN attack defense method and related hardware, which are used to provide a defense scheme for DoS attacks (such as cache pollution attacks, interest packet flooding attacks, etc.). The method comprises the following steps: judging whether the target node is subjected to a NDN denial of service attack according to the numerical relationship between the cache hit rate of the target node in one or continuous multiple detection periods and the normal cache hit rate range, and / or the numerical relationship between the PIT occupancy rate of the target node in one or continuous multiple detection periods and the normal PIT occupancy rate range; if it is determined that the target node is subjected to a NDN denial of service attack, a defense operation is performed; wherein the normal cache hit rate range is determined according to the node attribute of the target node and the cache hit rate of the target node in at least one reference monitoring period; and the normal PIT occupancy rate range is determined according to the node attribute of the target node and the PIT occupancy rate of the target node in at least one reference monitoring period.

Description

Technical Field

[0001] This invention relates to the field of Named Data Network (NDN) network security technology, and more particularly to an NDN attack defense method and related hardware. Background Technology

[0002] With the development of network technology and the rapid increase in internet users, the main focus of network applications is gradually evolving towards content acquisition and information services. The early architecture based on Transmission Control Protocol (TCP) / Internet Protocol (IP), designed to solve end-to-end communication problems, limited computer network performance, making it difficult for the traditional internet to meet the demands of massive network data processing. This has spurred a rethinking and research into future network architecture design. Information-Centric Networking (ICN), as a revolutionary architecture, seamlessly aligns with future network development trends due to its content-centric nature, thus attracting widespread attention from researchers.

[0003] Among the many deployment schemes in the ICN system, Named Data Networks (NDN) has become a research hotspot in ICN due to its advanced design concept, flexible routing and forwarding mechanism, and distributed intranet caching method.

[0004] To meet the demands of efficient content distribution and retrieval, NDN incorporates an in-network caching mechanism in its design to reduce unnecessary network data transmission, thereby improving data transmission efficiency and enhancing network scalability. For example... Figure 1 As shown, in NDN, each network transport node (i.e., content router) has a content store (CS) to cache data packets passing through the local node, thereby providing path caching services for subsequent requests, such as... Figure 2 As shown, the same Interest Packet request will be responded to directly by the content repository with the corresponding packet, without needing to obtain the corresponding file from the original source.

[0005] However, NDN's data transmission mechanism, which is based on filenames rather than device IP addresses, also introduces vulnerabilities to Denial-of-Service (DoS) attacks, including cache poisoning and packet flooding attacks. Therefore, how to defend against NDN DoS attacks, including cache poisoning and packet flooding attacks, is a pressing issue that needs to be addressed. Summary of the Invention

[0006] This invention provides an NDN attack defense method and related hardware, which provides a defense scheme against NDN DoS attacks (such as cache pollution attacks, interest packet flooding attacks, etc.).

[0007] In a first aspect, embodiments of the present invention provide an NDN attack defense method, applied to a target node in an NDN, comprising: Based on the numerical relationship between the cache hit rate of the target node and the normal cache hit rate range in one or more consecutive detection periods, and / or the numerical relationship between the PIT occupancy rate of the target node and the normal PIT occupancy rate range in one or more consecutive detection periods, it is determined whether the target node is subjected to an NDN denial-of-service attack. If it is determined that the target node is under an NDN denial-of-service attack, then defensive operations are performed; The normal cache hit rate range is determined based on the node attributes of the target node and the cache hit rate of the target node in at least one baseline monitoring period. The normal PIT occupancy range is determined based on the node attributes of the target node and the PIT occupancy of the target node in at least one of the baseline monitoring periods.

[0008] Optionally, determining whether the target node is under an NDN denial-of-service attack based on the numerical relationship between the target node's cache hit rate and the normal cache hit rate range over one or more consecutive detection periods includes at least one of the following: If continuous N If the cache hit rate of the target node is higher than the upper limit of the normal cache hit rate range for a monitoring period, and the target node is not a node in the preset node whitelist, then the target node is determined to be under NDN denial-of-service attack. If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range in both monitoring periods, and in the continuous period... N If the rate of change of the cache hit rate of the target node is lower than the preset first rate of change threshold in any two adjacent monitoring periods, then the target node is determined to be under NDN denial-of-service attack. The step of determining whether the target node is under NDN denial-of-service attack based on the numerical relationship between the target node's PIT occupancy rate and the normal PIT occupancy rate range during one or more consecutive detection periods includes at least one of the following: If continuous N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range in all three monitoring periods, then the target node is determined to be under NDN denial-of-service attack. If continuous N The PIT occupancy rate of the target node was lower than the lower limit of the normal PIT occupancy rate range in all four monitoring periods, and the continuous N If all four monitoring periods belong to the target monitoring period, then the target node is determined to be under an NDN denial-of-service attack; wherein, the target monitoring period is a monitoring period that meets at least one of the following conditions: the PIT occupancy rate change rate relative to the adjacent monitoring period is lower than a preset second change rate threshold, and the network speed is within a preset network speed range; The step of determining whether the target node is under NDN denial-of-service attack based on the numerical relationship between the cache hit rate and the normal cache hit rate range of the target node in one or more consecutive detection periods, and based on the numerical relationship between the PIT occupancy rate and the normal PIT occupancy rate range of the target node in one or more consecutive detection periods, includes: If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range for five consecutive monitoring periods. N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range during the five monitoring periods, then the target node is determined to be under NDN denial-of-service attack. N 1. N 2. N 3. N 4. N 5 are all preset quantity thresholds.

[0009] Optionally, the node attributes include the node's importance level, where the importance level characterizes the extent of the impact on NDN network transmission when a node fails.

[0010] Alternatively, the boundary value of the normal cache hit rate range is positively correlated with the importance level of the target node.

[0011] Alternatively, the boundary value of the normal PIT occupancy range is negatively correlated with the importance level of the target node.

[0012] Furthermore, alternatively, N 1.N 2. N 3. N 4. N At least one of 5 is positively correlated with the importance level of the target node.

[0013] Optionally, the defense operation includes at least one of the following: Send a node anomaly notification message to other network transmission nodes in the NDN to indicate that the target node is under NDN denial-of-service attack; so that the other network transmission nodes in the NDN, based on the node anomaly notification message, suspend or reduce communication with the target node for a preset first time period from the date of receiving the node anomaly notification message, or for a preset second time period from the date of discovery of the target node being under NDN denial-of-service attack indicated by the node anomaly notification message; Clear all cached data from the target node; Clear all abnormal cached data from the target node's cached data; wherein, abnormal cached data is cached data that satisfies at least one of the following conditions: The source of the cached data is not a device in the preset device whitelist; During the first specified detection period, the access frequency of cached data exceeds the preset access frequency threshold. During the second specified detection period, the access time interval of the cached data does not follow a normal distribution; During the third specified detection period, the total number of accesses to the cached data exceeds the preset access threshold.

[0014] Optionally, the baseline monitoring period is the fourth designated monitoring period in the previous monitoring cycle in which it was determined that the target node was not subjected to an NDN denial-of-service attack; wherein, each monitoring cycle includes multiple monitoring periods.

[0015] Secondly, based on the same inventive concept, embodiments of the present invention also provide a target node in an NDN, comprising: The rule determination module M1 is used to determine the normal cache hit rate range based on the node attributes of the target node and the cache hit rate of the target node in at least one baseline monitoring period; and / or determine the normal PIT occupancy rate range based on the node attributes of the target node and the PIT occupancy rate of the target node in at least one baseline monitoring period. The monitoring module M2 is used to determine whether the target node is subjected to an NDN denial-of-service attack based on the numerical relationship between the cache hit rate of the target node and the normal cache hit rate range in one or more consecutive detection periods, and / or the numerical relationship between the PIT occupancy rate of the target node and the normal PIT occupancy rate range in one or more consecutive detection periods. Defense module M3 is used to perform defense operations if it is determined that the target node is under NDN denial-of-service attack.

[0016] Thirdly, based on the same inventive concept, embodiments of the present invention also provide an electronic device, including: a processor and a memory for storing processor-executable instructions; The processor is configured to execute the instructions to implement the NDN attack defense method as described in the first aspect.

[0017] Fourthly, based on the same inventive concept, embodiments of the present invention also provide a readable storage medium storing computer program code, which, when run on a computer, causes the computer to execute the NDN attack defense method as described in the first aspect.

[0018] Fifthly, based on the same inventive concept, embodiments of the present invention also provide a computer program product, the computer program product comprising: computer program code, which, when the computer program code is run on a computer, causes the computer to execute the NDN attack defense method as described in the first aspect.

[0019] The beneficial effects of this invention are as follows: The NDN attack defense method and related hardware provided in this invention, through a detection mechanism based on cache hit rate and / or PIT occupancy, can accurately identify network transmission nodes subjected to NDN DoS attacks. Upon identifying these nodes, timely execution of corresponding defense measures can quickly curb the spread of the attack and significantly reduce the damage caused by NDN DoS attacks to NDN. Attached Figure Description

[0020] Figure 1 This is a network architecture diagram for NDN. Figure 2 A schematic diagram of the caching mechanism for network transmission nodes; Figure 3 This is one of the flowcharts for the NDN attack defense method provided in the embodiments of the present invention; Figure 4 The second flowchart of the NDN attack defense method provided in the embodiments of the present invention; Figure 5 This is one of the flowcharts of the NDN attack defense method provided in the embodiments of the present invention; Figure 6 This is the second flowchart of the NDN attack defense method provided in the embodiments of the present invention; Figure 7 This is a schematic diagram of the structure of a target node in an NDN provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0021] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described below in conjunction with the accompanying drawings and embodiments. However, the exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided to make the present invention more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the figures denote the same or similar structures, and therefore repeated descriptions of them will be omitted. Terms describing position and direction in the present invention are illustrative based on the accompanying drawings, but changes can be made as needed, and all such changes are included within the scope of protection of the present invention. The accompanying drawings of the present invention are for illustrative purposes only and do not represent actual proportions.

[0022] It should be noted that specific details are set forth in the following description to provide a full understanding of the invention. However, the invention can be practiced in many ways other than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below. The following description is a preferred embodiment for carrying out the present application; however, the description is for the purpose of illustrating the general principles of the application and is not intended to limit the scope of the application. The scope of protection of this application shall be determined by the appended claims.

[0023] NDN's data transmission mechanism, which is based on file names rather than device IP addresses, introduces DoS vulnerabilities such as cache poisoning attacks and packet flooding attacks.

[0024] For example, attackers can use cache poisoning attacks to make a large number of requests for unpopular files to network transmission nodes. This causes the unpopular files to occupy the space in the network transmission node's content repository that was originally used to cache popular files (such as videos and documents with high access rates). As a result, the network transmission node is unable to directly provide corresponding data packet responses for subsequent requests for popular files by normal users, thus wasting the hardware and network resources of the network transmission node and interfering with the network transmission node's ability to process normal requests from legitimate users.

[0025] For example, an attacker could employ an interest packet flooding attack, sending a large number of interest packet requests for files not cached by the network transmission node (e.g., if the attacker has not launched a cache poisoning attack, the interest packet flooding attack requests unpopular or falsely non-existent files; or if the attacker has launched a cache poisoning attack, the interest packet flooding attack requests popular files not cached by the network transmission node). This causes these interest packet requests to wait in the Pending Interest Table (PIT) for an extended period, eventually exhausting the network transmission node's PIT entry resources, straining the network transmission node's hardware resources, and preventing the network transmission node from processing legitimate requests from normal users, thus causing service interruption.

[0026] Based on the above-mentioned DoS attack scenarios, this invention proposes an NDN attack defense method to detect and determine the defense scheme after receiving cache pollution attacks and interest packet flooding attacks, effectively reducing the negative impact of NDNDoS on network transmission nodes.

[0027] The NDN attack defense method and related hardware provided in the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0028] Firstly, embodiments of the present invention provide an NDN attack defense method, applied to target nodes in an NDN. In these embodiments, the target node is any network transmission node employing the NDN attack defense method provided by the present invention. For example, some network transmission nodes in the NDN may implement the technical solution provided by the present invention, meaning the target node is any network transmission node in the NDN that implements the technical solution of the present invention; or, for example, all network transmission nodes in the NDN may implement the technical solution provided by the present invention, meaning the target node is any network transmission node in the NDN; the present invention does not impose further limitations here. Preferably, the technical solution provided by the present invention is implemented on all network transmission nodes in the NDN.

[0029] like Figures 3-4 As shown, the NDN attack defense method specifically includes the following steps: S200. Obtain the monitoring metrics of the target node during one or more consecutive monitoring periods. The monitoring metrics include at least one of the following: node cache hit rate, node PIT occupancy rate.

[0030] In the specific implementation process, the target node's logging function can be used to collect relevant data based on the log data and determine the node's cache hit rate and PIT occupancy rate.

[0031] In the specific implementation process, in order to avoid misjudgment of NDN DoS attack monitoring due to occasional low-probability events, it is preferable to obtain the monitoring indicators of the target node in multiple consecutive monitoring periods.

[0032] In the specific implementation process, in order to achieve real-time monitoring of NDN DoS attacks on target nodes, preferably, if only the monitoring indicators of the target node are obtained in one monitoring period, then that monitoring period is the current monitoring period; if the monitoring indicators of the target node are obtained in multiple consecutive monitoring periods, then the multiple consecutive monitoring periods corresponding to the obtained monitoring indicators are multiple consecutive monitoring periods with the current monitoring period as the last monitoring period.

[0033] S300. For any monitoring indicator, based on the numerical relationship between the monitoring indicator and the normal range corresponding to the monitoring indicator in one or more consecutive monitoring periods, determine whether the target node is subjected to an NDN DoS attack.

[0034] If it is determined that the target node is under an NDN DoS attack, proceed to step S400; otherwise, continue monitoring the target node's metrics.

[0035] If the monitoring metric includes the cache hit rate of a node, then the value relationship between the cache hit rate of the target node and the normal cache hit rate range during one or more consecutive detection periods is used to determine whether the target node is under NDN DoS attack.

[0036] Among them, cache hit rate refers to the proportion of interest packets that a node directly responds to through its local content cache out of the total interest packet requests. That is:

[0037] The normal cache hit rate range is determined based on the node attributes of the target node and the cache hit rate of the target node in at least one baseline monitoring period.

[0038] If the monitoring indicators include the node's PIT occupancy rate, then based on the numerical relationship between the target node's PIT occupancy rate and the normal PIT occupancy rate range during one or more consecutive detection periods, it can be determined whether the target node is under NDN DoS attack.

[0039] The Pit occupancy rate is the ratio of the number of entries recorded in the current Pit of a node to the capacity of the node's Pit. That is:

[0040] The normal PIT occupancy rate range is determined based on the node attributes of the target node and the PIT occupancy rate of the target node in at least one baseline monitoring period.

[0041] In practical implementation, node attributes can include indicators such as the node's importance level and performance level. The importance level characterizes the extent of the impact of a node failure on NDN network transmission; the greater the impact, the higher the importance level. For example, the importance levels, from highest to lowest, include backbone node level, ordinary node level, edge node level, and backup node level. The performance level characterizes the node's processing performance for NDN network transmission requests; the stronger the node's processing performance (e.g., the more NDN network transmission requests it can handle simultaneously), the higher its performance level. For example, the performance levels, from highest to lowest, include high-performance level, medium-performance level, and low-performance level.

[0042] Alternatively, if the node attribute includes the node's importance level, then: The magnitude of the boundary value of the normal cache hit rate range is positively correlated with the importance level of the target node.

[0043] The boundary values ​​of the normal PIT occupancy range are negatively correlated with the importance level of the target node.

[0044] In practice, the upper and lower limits of the normal cache hit rate range / normal PIT occupancy range can be positively / negatively correlated with the importance level of the target node; alternatively, one boundary value of the normal cache hit rate range / normal PIT occupancy range can be positively / negatively correlated with the importance level of the target node, while the other boundary value can be set as a constant.

[0045] Considering that under normal circumstances, for nodes with lower importance levels, the number of interest packet requests from normal users is less, and the probability of missing some popular files in the cached files is higher. Therefore, the interest packet requests from normal users exhibit a lower normal cache hit rate and a higher normal PIT occupancy rate. Conversely, for nodes with higher importance levels, the number of interest packet requests from normal users is more, the number of popular files in the cached files is more complete, and the probability of missing some popular files is lower. Therefore, the interest packet requests from normal users exhibit a higher normal cache hit rate and a lower normal PIT occupancy rate. Thus, by making the boundary values ​​of the normal cache hit rate range (which determines whether the monitoring indicators are abnormal) in the NDN DoS attack behavior judgment rules positively correlated with the importance level of the target node, and the boundary values ​​of the normal PIT occupancy rate range negatively correlated with the importance level of the target node, we can better align with the characteristics of monitoring indicators for nodes of different importance levels and improve the accuracy of the judgment.

[0046] Alternatively, if the node attribute includes the node's performance level, then: The magnitude of the boundary value of the normal cache hit rate range is positively correlated with the performance level of the target node.

[0047] The magnitude of the boundary value of the normal PIT occupancy range is negatively correlated with the performance level of the target node.

[0048] In practice, the upper and lower limits of the normal cache hit rate range / normal PIT occupancy range can be positively / negatively correlated with the performance level of the target node; alternatively, one boundary value of the normal cache hit rate range / normal PIT occupancy range can be positively / negatively correlated with the performance level of the target node, while the other boundary value can be set as a constant.

[0049] Considering that under normal circumstances, for nodes with lower performance levels, the number of interest packet requests from normal users is less, and the probability of missing some popular files in the cached files is higher. Therefore, normal user interest packet requests exhibit a lower normal cache hit rate and a higher normal PIT occupancy rate. Conversely, for nodes with higher performance levels, the number of interest packet requests from normal users is greater, the number of popular files in the cached files is more complete, and the probability of missing some popular files is lower. Therefore, normal user interest packet requests exhibit a higher normal cache hit rate and a lower normal PIT occupancy rate. Thus, by making the boundary values ​​of the normal cache hit rate range (which determines whether the monitoring indicators are abnormal) in the NDN DoS attack behavior judgment rules positively correlated with the target node's performance level, and the boundary values ​​of the normal PIT occupancy rate range negatively correlated with the target node's performance level, we can better align with the characteristics of monitoring indicators for nodes with different performance levels and improve the accuracy of the judgment.

[0050] One possible implementation, such as Figure 5 As shown, the boundary values ​​of the normal cache hit rate range are determined as follows: S111. Determine the first adjustment coefficient based on the node attributes of the target node.

[0051] In practice, the upper and lower limits of the normal cache hit rate range each correspond to a first adjustment coefficient. The first adjustment coefficient can be determined based on the different node attributes corresponding to the upper and lower limits of the normal cache hit rate range; alternatively, it can be determined based on the different node attributes corresponding to one of the boundary values ​​(e.g., the lower limit) of the normal cache hit rate range.

[0052] In the specific implementation process, for dynamically determined boundary values, please refer to the previous content and set the relationship between the first adjustment coefficient and the node attributes to satisfy: the first adjustment coefficient is positively correlated with the importance level of the target node, and / or the first adjustment coefficient is positively correlated with the performance level of the target node.

[0053] S112. Determine the boundary value factor of the normal cache hit rate range based on the cache hit rate of the target node in at least one benchmark monitoring period.

[0054] Optionally, if there are multiple benchmark monitoring periods, the average or median cache hit rate of the target node in each benchmark monitoring period can be used as the boundary value factor of the normal cache hit rate range.

[0055] S113. Determine the boundary value of the normal cache hit rate range based on the first adjustment coefficient and the boundary value factor of the normal cache hit rate range.

[0056] In practice, the boundary value of the normal cache hit rate range can be obtained by multiplying the first adjustment coefficient by the boundary value factor of the normal cache hit rate range. For example, the lower limit of the normal cache hit rate range is rule_hit_ratio = α ×base_hit_ratio, where α `base_hit_ratio` is the first adjustment factor corresponding to the lower limit of the normal cache hit rate range, and `base_hit_ratio` is the boundary value factor of the normal cache hit rate range.

[0057] One possible implementation, such as Figure 6 As shown, the boundary values ​​of the normal PIT occupancy range are determined as follows: S121. Determine the second adjustment coefficient based on the node attributes of the target node.

[0058] In the specific implementation process, the upper and lower limits of the normal PIT occupancy range each correspond to a second adjustment coefficient. The corresponding second adjustment coefficient can be determined according to the upper and lower limits of the normal PIT occupancy range for different node attributes; or the corresponding second adjustment coefficient can be determined according to one of the boundary values ​​(e.g., the upper limit) of the normal PIT occupancy range for different node attributes, and the second adjustment coefficient corresponding to the other boundary value (e.g., the lower limit) for different node attributes takes the same value (e.g., the second adjustment coefficient for the lower limit is set to 0).

[0059] In the specific implementation process, for dynamically determined boundary values, please refer to the previous content and set the relationship between the second adjustment coefficient and the node attributes to satisfy: the second adjustment coefficient is negatively correlated with the importance level of the target node, and / or the first adjustment coefficient is negatively correlated with the performance level of the target node.

[0060] S122. Determine the boundary value factor of the normal PIT occupancy range based on the PIT occupancy rate of the target node in at least one benchmark monitoring period.

[0061] Optionally, if there are multiple benchmark monitoring periods, the average or median PIT occupancy rate of the target node in each benchmark monitoring period can be used as the boundary value factor of the normal PIT occupancy rate range.

[0062] S123. Determine the boundary value of the normal PIT occupancy range based on the first adjustment coefficient and the boundary value factor of the normal PIT occupancy range.

[0063] In practice, the boundary value of the normal cache hit rate range can be obtained by multiplying the first adjustment coefficient by the boundary value factor of the normal cache hit rate range. For example, the upper limit of the normal PIT occupancy range is rule_pit_usage= β ×base_pit_usage, where β The second adjustment coefficient corresponds to the upper limit of the normal PIT occupancy range, and base_pit_usage is the boundary value factor of the normal PIT occupancy range.

[0064] Specifically, the implementation of step S300 may include at least one of the following: (1) If continuous N If the cache hit rate of the target node is higher than the upper limit of the normal cache hit rate range for a monitoring period, and the target node is not a node in the preset node whitelist, then the target node is determined to be under NDN DoS attack. N 1 represents the preset quantity threshold.

[0065] In practice, the node whitelist can be set according to node attributes such as importance level and performance level. For example, backbone nodes, high-performance nodes, and other network transmission nodes that normally cache a lot of popular files can be added to the preset node whitelist.

[0066] Since ordinary nodes, edge nodes, and low-to-medium performance nodes that are not in the preset node whitelist typically do not cache a large number of popular files, target nodes that are not in the preset node whitelist will not cache a large number of popular files. N If the cache hit rate is abnormally high during a monitoring period, it is highly likely that an attacker is launching an interest packet flooding attack on the target node to interfere with the target node's access mechanism, preventing the target node from responding to interest packet requests from normal users.

[0067] (2) If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range in both monitoring periods, and in the continuous period...N If the rate of change of the cache hit rate of the target node is lower than the preset first rate of change threshold in any two adjacent monitoring periods, then the target node is determined to be under NDN DoS attack. N 2 represents the preset quantity threshold.

[0068] In practice, the rate of change in cache hit rate can be measured by the ratio of the change in cache hit rate between two adjacent monitoring periods to the duration of a monitoring period.

[0069] If the cache hit rate of the target node remains abnormally low and shows no significant upward trend over multiple monitoring periods, it is highly likely that an attacker is conducting an interest packet flooding attack on the target node, requesting uncacheable or non-existent files to interfere with the target node's access mechanism, preventing it from responding to legitimate users' interest packet requests. Alternatively, it is highly likely that the attacker is conducting a cache poisoning attack, expelling popular files from the target node's content repository, leaving the cached files as useless and unpopular files. This prevents the target node from directly providing corresponding data packet responses to legitimate users' interest packet requests for popular files, wasting the target node's hardware and network resources and interfering with its ability to process legitimate users' requests.

[0070] (3) If continuous N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range in all three monitoring periods, then the target node is determined to be under NDN DoS attack. N 3 represents the preset quantity threshold.

[0071] If the target node's PIT occupancy is abnormally high, it is highly likely that an attacker is conducting an interest packet flooding attack, requesting uncacheable or non-existent files from the target node to interfere with its access mechanism, preventing it from responding to legitimate users' interest packet requests. Alternatively, it is highly likely that the attacker is conducting a cache poisoning attack, evicting popular files from the target node's content repository, leaving only useless, unpopular files cached. This prevents the target node from directly providing corresponding data packets to legitimate users' interest packet requests for popular files, wasting the target node's hardware and network resources and interfering with its ability to process legitimate users' requests.

[0072] (4) If continuous N The PIT occupancy rate of the target node in all four monitoring periods was lower than the lower limit of the normal PIT occupancy rate range, and the continuous NIf all four monitoring periods fall within the target monitoring period, the target node is determined to be under an NDN DoS attack. The target monitoring period is defined as a monitoring period that meets at least one of the following conditions: the PIT occupancy rate change rate relative to adjacent monitoring periods is lower than a preset second change rate threshold, and the network speed falls within a preset range. N 4 represents the preset quantity threshold.

[0073] In specific implementation, if the target monitoring period is divided based on whether the PIT occupancy rate change rate relative to adjacent monitoring periods is lower than a preset second change rate threshold, then the PIT occupancy rate change rate of the target monitoring period relative to adjacent monitoring periods can be the PIT occupancy rate change rate of the target monitoring period relative to its preceding monitoring period, or it can be the PIT occupancy rate change rate of the target monitoring period relative to its following monitoring period. This embodiment of the invention does not impose further limitations here. The cache hit rate change rate can be measured as the ratio of the change in cache hit rate between two adjacent monitoring periods to the duration of one monitoring period.

[0074] Under normal circumstances, regular users have a need to access both popular and unpopular files. Therefore, the PIT occupancy rate of network transmission nodes in NDN is generally in a middle state, neither too high nor too low. Therefore, when the PIT occupancy rate of a target node is consistently abnormally low, and the monitoring period during which the abnormally low PIT occupancy rate occurs coincides with a monitoring period where other indicators suggest the target node's network status is normal (e.g., the PIT occupancy rate change rate relative to adjacent monitoring periods is lower than a preset second change rate threshold, and the network speed is within a preset range), it is highly likely that an attacker is abnormally launching an interest packet flooding attack targeting a few popular files cached by the target node. This attack aims to disrupt the target node's access mechanism, preventing the target node from receiving and responding to interest packet requests from normal users.

[0075] (5) If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range for five monitoring periods, and the continuous N If the target node's PIT occupancy rate exceeds the upper limit of the normal PIT occupancy rate range for five monitoring periods, then the target node is determined to be under NDN DoS attack. N 5 represents the preset quantity threshold.

[0076] If the target node's cache hit rate is abnormally low and its PIT occupancy is abnormally high, it is highly likely that an attacker is launching an interest packet flooding attack on the target node, requesting uncacheable or non-existent files from the target node to interfere with the target node's access mechanism, preventing the target node from responding to interest packet requests from legitimate users. Alternatively, it is highly likely that the attacker is launching a cache poisoning attack on the target node, expelling popular files from the target node's content repository, leaving the cached files in the target node's content repository as useless, unpopular files. As a result, the target node cannot directly provide corresponding data packet responses to interest packet requests from legitimate users for popular files, wasting the target node's hardware and network resources and interfering with the target node's ability to process normal requests from legitimate users.

[0077] In the specific implementation process N 1. N 2. N 3. N 4. N 5 can be the same preset quantity threshold, or at least partially different preset quantity thresholds; this embodiment of the invention does not impose further limitations. For ease of implementation, the following settings can be configured: N 1. N 2. N 3. N 4. N 5 represents the same preset quantity threshold. It should be noted that... N 1. N 2. N 3. N 4. N The value of 5 should not be set too low or too high. If it is too low, the corresponding monitoring indicators may fluctuate greatly due to accidental factors, which may lead to misjudgments in subsequent steps and affect the accuracy of the conclusions. If it is too high, the monitoring response speed may be too slow, making it impossible to detect NDN DoS attacks in time and delaying the opportunity to detect the attack.

[0078] Furthermore, alternatively, N 1. N 2. N 3. N 4. N At least one of the criteria in rule (5) is positively correlated with the importance level of the target node. For example, if rule (5) is used to determine whether a target node is under NDN DoS attack, then the number of consecutive abnormal monitoring periods corresponding to the backbone node is... N 5 is greater than the number of consecutive anomaly monitoring periods corresponding to edge nodes. N 5. For example, for backbone nodes, N 5=4; for edge nodes, N 5 = 2.

[0079] In this way, by setting the threshold for the number of consecutive abnormal monitoring periods in the NDN DoS attack behavior judgment rules to be positively correlated with the importance level of the target node, nodes with low importance levels can be judged with a smaller threshold for the number of consecutive abnormal monitoring periods, thereby improving the detection sensitivity of nodes with low importance levels; while nodes with high importance levels can be judged with a larger threshold for the number of consecutive abnormal monitoring periods, thereby reducing the false alarm rate of nodes with high importance levels and reducing the occurrence of large-scale negative impacts on business caused by misjudgments.

[0080] S400, Perform defensive operations.

[0081] Optionally, the defensive operation includes at least one of the following: (1) Send node anomaly notification information to other network transmission nodes in the NDN to indicate that the target node is under NDN denial-of-service attack. So that other network transmission nodes in the NDN will suspend or reduce communication with the target node for a preset first time period from the date of receiving the node anomaly notification information, or for a preset second time period from the date of discovery of the target node being under NDN DoS attack indicated by the node anomaly notification information.

[0082] In practice, node anomaly notification information can include the target node's node identifier, the time when the target node was found to be under NDN DoS attack, and the reason for the NDN DoS attack (such as the presence of abnormal monitoring indicator categories). Other network transmission nodes in the NDN can avoid being affected by packet flooding attacks targeting the target node and reduce the processing load on the target node by suspending or reducing communication with the target node for a preset period of time.

[0083] In this way, by suspending or reducing communication with the target node, the target node can effectively clean up invalid records in the PIT caused by the attack, resolve the issue of the PIT being maliciously occupied by the attack and affecting the processing of interest packet requests of normal users, and restore the response to normal interest packet requests as soon as possible.

[0084] (2) Clear all cached data on the target node.

[0085] If the NDN DoS attack on the target node is a cache pollution attack, clearing all cached data on the target node can effectively ensure that all possible abnormal cached data is cleared.

[0086] (3) Clear all abnormal cached data in the target node's cached data.

[0087] Among them, abnormal cached data is cached data that meets at least one of the following conditions: ① The source of the cached data does not belong to the device in the preset device whitelist.

[0088] For specific NDNs such as centralized enterprise intranets and dedicated networks used for entertainment services, popular files are usually provided by centralized publishers. Therefore, devices of centralized publishers can be added to a preset device whitelist, and files published by decentralized publishers can be cleared to remove hidden cached and polluting files.

[0089] ② During the first specified detection period, the access frequency of cached data exceeds the preset access frequency threshold.

[0090] Generally, user demand for specific popular files is limited. Therefore, when the access frequency of a particular popular file is abnormally high, it's highly likely that the file is actually an unpopular file for normal users. However, attackers are using a packet flooding attack on target nodes to mistakenly perceive this unpopular file as a popular file. Furthermore, normal user activity is influenced by time factors. For example, in corporate intranets, cached data is frequently accessed during working hours and rarely accessed during rest periods; for dedicated networks used for entertainment services, cached data is frequently accessed during the day and the first half of the night, and rarely accessed in the second half of the night. Therefore, a large number of packet requests that do not conform to the corresponding time patterns are highly likely to be attack behavior, and the corresponding files are highly likely to be abnormal files related to the attack. Therefore, by setting a reasonable first monitoring period and a preset access frequency threshold, clearing cached data with abnormally high access frequencies during the first specified monitoring period can remove the abnormal files hidden within that cache that are related to the attack.

[0091] ③ During the second specified detection period, the access time interval of cached data does not follow a normal distribution.

[0092] In practice, the access time interval of cached data can be analyzed using methods such as the Shapiro-Wilk test and the Anderson-Darling test to determine whether it follows a normal distribution.

[0093] Generally, different users' access to the same file is influenced by a variety of independent factors. Therefore, overall, within a reasonable timeframe for requesting cached data, the access intervals for the same file are highly likely to follow a normal distribution. Consequently, if, during a specified detection period, the access intervals of cached data do not follow a normal distribution but rather other statistical distributions (such as a uniform distribution), it is highly likely caused by an automated attack program written by an attacker using a periodic attack mechanism. The corresponding files are very likely abnormal files related to the attack. Therefore, by setting a reasonable second monitoring period and a preset access frequency threshold, clearing out cached data access intervals that do not follow a normal distribution during the second specified monitoring period can remove abnormal files hidden within that cache that are related to the attack.

[0094] ④ During the third specified detection period, the total number of accesses to the cached data is greater than the preset access threshold.

[0095] Normal user activity is influenced by time factors, so a large number of interest package requests that do not conform to the corresponding time pattern are highly likely to be attack behavior, and the corresponding files are highly likely to be abnormal files related to the attack. Therefore, by setting a reasonable third monitoring period and a preset access number threshold, the cached data with abnormally high total access counts in the third specified monitoring period can be cleared, thereby removing the abnormal files hidden within it that are related to the attack behavior.

[0096] In this way, by clearing all or some abnormal cached data in the target node, the cache pollution attack data can reduce the cache space occupied by the target node, enabling the target node to quickly obtain and cache normal data, and restore the cache response function of the target node.

[0097] Thus, the NDN attack defense method provided in this invention, based on the detection mechanism of cache hit rate and / or PIT occupancy, can accurately identify network transmission nodes subjected to NDN DoS attacks. Furthermore, by promptly implementing corresponding defense measures upon identifying the network transmission nodes subjected to NDN DoS attacks, the spread of the attack can be quickly contained, significantly reducing the damage caused by NDN DoS attacks to NDN.

[0098] As an optional implementation, the baseline monitoring period is a pre-defined monitoring period. For example, a specific monitoring period is manually designated as the baseline monitoring period, and the normal range of the corresponding monitoring indicators is determined based on the detection indicators during the baseline monitoring period.

[0099] As another optional implementation, the baseline monitoring period is a periodically updated monitoring period.

[0100] One possible implementation is to divide time into multiple monitoring cycles (e.g., one day as a monitoring cycle), and each monitoring cycle is further divided into multiple monitoring periods. For the latest monitoring cycle, the baseline monitoring period is the fourth designated monitoring period in the previous monitoring cycle where it was determined that the target node was not under NDN DoS attack. For example, if the monitoring cycle starts at midnight each day, and the monitoring periods 8:00-8:59, 9:00-9:59, ..., 18:00-18:59 in each monitoring cycle are set as the fourth designated monitoring period, then if the fourth designated monitoring period in the previous monitoring cycle (i.e., yesterday) determined that the target node was not under NDN DoS attack, then yesterday's fourth designated monitoring period is set as the baseline monitoring period for the latest monitoring cycle (i.e., today). Accordingly, the normal range of today's monitoring indicators is determined based on the target node's monitoring indicators in yesterday's fourth designated monitoring period (e.g., based on the average or median value of the target node's monitoring indicators in yesterday's fourth designated monitoring period, combined with the target node's node attributes). That is, as... Figure 4 As shown, prior to step S200, the method further includes: S100. Upon reaching the start time of the latest monitoring cycle, at least one fourth designated monitoring period in the previous monitoring cycle during which it was determined that the target node was not subjected to an NDN denial-of-service attack is used as the baseline monitoring period for the latest monitoring cycle. The normal range corresponding to the monitoring indicators is determined based on the baseline monitoring period of the latest monitoring cycle.

[0101] In this way, the dynamic update mechanism for the baseline monitoring period described above enables the NDN DoS attack monitoring rules to better fit the actual situation of network transmission nodes, so as to adapt to long-term network changes.

[0102] The following is a specific example applied to a company's intranet to illustrate the above solution: In this example, the NDN contains 6 network transmission nodes, covering areas such as office area, canteen, and dormitory area, and is mainly used to transmit internal business resources, scientific research data and other content.

[0103] The monitoring period lasts for 5 minutes, and the monitoring cycle lasts for 30 minutes. This avoids both inappropriate judgment rules due to large data fluctuations caused by a monitoring cycle that is too short (e.g., 1 minute) and attacks due to untimely updates to judgment rules caused by a monitoring cycle that is too long (e.g., 60 minutes).

[0104] For target nodes deployed in office areas, the first adjustment coefficient corresponds to the lower limit of the normal cache hit rate range. α=0.7, the first adjustment factor corresponding to the upper limit of the normal cache hit rate range is 1. The second adjustment factor corresponding to the lower limit of the normal PIT utilization range is 0, and the second adjustment factor corresponding to the upper limit of the normal PIT utilization range is... β =1.5. If the cache hit rate of the target node is lower than the lower limit of the normal cache hit rate range for three consecutive monitoring periods up to the current monitoring period, and the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range for three consecutive monitoring periods up to the current monitoring period, then the target node is determined to be under NDN denial-of-service attack.

[0105] The target node uses its own logging function to collect cache hit counts and total interest packet requests in real time. During a certain monitoring period A, the target node had 90 cache hits and 300 total interest packet requests, so its cache hit rate during monitoring period A is 90 / 300 = 0.3. The target node's maximum PIT capacity is 500 entries. During the same monitoring period A, the PIT recorded 350 entries, so the target node's PIT occupancy rate during this monitoring period is 350 / 500 = 0.7.

[0106] If it is determined that the target node was not subjected to NDN denial-of-service attacks during any of the fourth specified monitoring periods in the previous monitoring cycle, then each of the fourth specified monitoring periods in the previous monitoring cycle is set as the baseline monitoring period for the latest monitoring cycle. Furthermore, the average cache hit rate and average PIT occupancy rate of the target node during these baseline monitoring periods are determined to be 0.4 and 0.3, respectively. Therefore, the normal cache hit rate range boundary factor base_hit_ratio = 0.4, and the normal PIT occupancy rate range boundary factor base_pit_usage = 0.3. The normal cache hit rate range is (0.28, 1), and the normal PIT occupancy rate range is (0, 0.45).

[0107] In the latest monitoring cycle, during consecutive monitoring periods B, C, and D, if the cache hit rate (hit_ratio) of monitoring period B is 0.25 < 0.28, and the PIT occupancy (pit_usage) of monitoring period B is 0.5 > 0.45, and the anomaly detection period counter (consecutive_abnormal) is 1; if the cache hit rate of monitoring period C is 0.26 < 0.28, and the PIT occupancy (pit_usage) of monitoring period B is 0.48 > 0.45, and the anomaly detection period counter (consecutive_abnormal) is 2; and if the cache hit rate of monitoring period D is 0.24 < 0.28, and the PIT occupancy (pit_usage) of monitoring period B is 0.52 > 0.45, and the anomaly detection period counter (consecutive_abnormal) is 3, then the target node is determined to be under an NDN DoS attack. Subsequently, the target node sends a node anomaly notification message to other network transmission nodes in the NDN, indicating that the target node is under NDN denial-of-service attack. This causes other network transmission nodes in the NDN to reduce communication with the target node for a preset second time period starting from the time the NDN denial-of-service attack is discovered, based on the node anomaly notification message (which includes the target node's node identifier, the time of discovery of the NDN DoS attack, and the category of abnormal monitoring indicators). Furthermore, the target node clears all its cached data, ensuring that all potentially abnormal data is removed to prevent further impact on the NDN. After clearing, the target node restarts caching valid data, restoring normal network service functionality.

[0108] Secondly, based on the same inventive concept, embodiments of the present invention also provide a target node in an NDN, such as... Figure 7 As shown, it includes: The rule determination module M1 is used to determine the normal cache hit rate range based on the node attributes of the target node and the cache hit rate of the target node in at least one baseline monitoring period; and / or determine the normal PIT occupancy rate range based on the node attributes of the target node and the PIT occupancy rate of the target node in at least one baseline monitoring period. The monitoring module M2 is used to determine whether the target node is subjected to an NDN denial-of-service attack based on the numerical relationship between the cache hit rate of the target node and the normal cache hit rate range in one or more consecutive detection periods, and / or the numerical relationship between the PIT occupancy rate of the target node and the normal PIT occupancy rate range in one or more consecutive detection periods. Defense module M3 is used to perform defense operations if it is determined that the target node is under NDN denial-of-service attack.

[0109] Optionally, the monitoring module M2 is specifically used to implement at least one of the following: (1) If continuous N If the cache hit rate of the target node is higher than the upper limit of the normal cache hit rate range for a monitoring period, and the target node is not a node in the preset node whitelist, then the target node is determined to be under NDN denial-of-service attack. (2) If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range in both monitoring periods, and in the continuous period... N If the rate of change of the cache hit rate of the target node is lower than the preset first rate of change threshold in any two adjacent monitoring periods, then the target node is determined to be under NDN denial-of-service attack. (3) If continuous N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range in all three monitoring periods, then the target node is determined to be under NDN denial-of-service attack. (4) If continuous N The PIT occupancy rate of the target node was lower than the lower limit of the normal PIT occupancy rate range in all four monitoring periods, and the continuous N If all four monitoring periods belong to the target monitoring period, then the target node is determined to be under an NDN denial-of-service attack; wherein, the target monitoring period is a monitoring period that meets at least one of the following conditions: the PIT occupancy rate change rate relative to the adjacent monitoring period is lower than a preset second change rate threshold, and the network speed is within a preset network speed range; (5) If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range for five consecutive monitoring periods. N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range during the five monitoring periods, then the target node is determined to be under NDN denial-of-service attack. N 1. N 2. N 3. N 4. N 5 are all preset quantity thresholds.

[0110] Optionally, the node attributes include the node's importance level, wherein the importance level characterizes the extent of the impact on NDN network transmission when a node fails; Alternatively, the boundary value of the normal cache hit rate range is positively correlated with the importance level of the target node.

[0111] Alternatively, the boundary value of the normal PIT occupancy range is negatively correlated with the importance level of the target node.

[0112] Furthermore, alternatively, N 1. N 2. N 3. N 4. N At least one of 5 is positively correlated with the importance level of the target node.

[0113] Alternatively, the defensive operation may include at least one of the following: Send a node anomaly notification message to other network transmission nodes in the NDN to indicate that the target node is under NDN denial-of-service attack; so that the other network transmission nodes in the NDN, based on the node anomaly notification message, suspend or reduce communication with the target node for a preset first time period from the date of receiving the node anomaly notification message, or for a preset second time period from the date of discovery of the target node being under NDN denial-of-service attack indicated by the node anomaly notification message; Clear all cached data from the target node; Clear all abnormal cached data from the target node's cached data; wherein, abnormal cached data is cached data that satisfies at least one of the following conditions: The source of the cached data is not a device in the preset device whitelist; During the first specified detection period, the access frequency of cached data exceeds the preset access frequency threshold. During the second specified detection period, the access time interval of the cached data does not follow a normal distribution; During the third specified detection period, the total number of accesses to the cached data exceeds the preset access threshold.

[0114] Optionally, the baseline monitoring period is the fourth designated monitoring period in the previous monitoring cycle in which it was determined that the target node was not subjected to an NDN denial-of-service attack; wherein, each monitoring cycle includes multiple monitoring periods.

[0115] It should be understood that the above-described embodiments of the target nodes are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0116] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0118] Since the specific methods by which each module of the target node performs its operations have been described in detail in the corresponding NDN attack defense methods described in the first aspect, they will not be repeated here.

[0119] Thirdly, based on the same inventive concept, embodiments of this application also provide an electronic device, such as... Figure 8 As shown, it includes: a processor 110 and a memory 120 for storing executable instructions of the processor 110; wherein the processor 110 is configured to execute the instructions to implement the NDN attack defense method.

[0120] In specific implementations, the device may vary significantly due to differences in configuration or performance. It may include one or more processors 110, memory 120, and computer-readable storage media 130. The memory 120 and / or computer-readable storage media 130 may contain one or more application programs 131 or data 132. The memory 120 and / or computer-readable storage media 130 may also contain one or more operating systems 133, such as Windows, Mac OS, Linux, iOS, Android, Unix, FreeBSD, etc. The memory 120 and computer-readable storage media 130 may be temporary or persistent storage. The application program 131 may include one or more of the aforementioned modules (…). Figure 8 (Not shown in the diagram), each module may include a series of instruction operations. Furthermore, the processor 110 may be configured to communicate with the computer-readable storage medium 130 and execute a series of instruction operations in the computer-readable storage medium 130 on the device. The device may also include one or more power supplies (…). Figure 8(not shown in the image); one or more network interfaces 140, the network interface 140 including a wired network interface 141 and / or a wireless network interface 142; one or more input / output interfaces 143.

[0121] Fourthly, based on the same inventive concept, embodiments of the present invention provide a computer-readable storage medium storing computer program code, which, when executed on a computer, enables the computer to implement the NDN attack defense method described in the first aspect.

[0122] The computer-readable storage medium can be any available medium that a computer can store, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, USB flash drives, magnetic tapes, read-only memory (ROM), random access memory (RAM)), optical media (e.g., high-density digital video discs (DVDs), video compact discs (VCDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0123] Since the principle of the computer-readable storage medium for solving the problem is the same as the NDN attack defense method described in the first aspect above, the implementation of the computer-readable storage medium can be found in the implementation of the method, and the repeated parts will not be described again.

[0124] Fifthly, based on the same inventive concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to implement the NDN attack defense method described in the first aspect.

[0125] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from a website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0126] Since the principle behind the problem-solving of the aforementioned computer program products is consistent with the NDN attack defense method described in the first aspect above, the implementation of the aforementioned computer program products can be found in the implementation of the method, and the repetitive parts will not be repeated.

[0127] The NDN attack defense method and related hardware provided in this invention, based on a detection mechanism of cache hit rate and / or PIT occupancy, can accurately identify network transmission nodes subjected to NDN DoS attacks. Upon identifying these nodes, timely execution of corresponding defense measures can quickly curb the spread of the attack and significantly reduce the destructive impact of NDN DoS attacks on NDN.

[0128] This invention can be applied to scenarios such as edge computing and 5G / 6G network communication. Lightweight detection modules can be deployed at edge nodes to implement the NDN attack defense method provided in this invention, leveraging the low latency of 5G networks to achieve real-time attack response. For example, in autonomous driving scenarios, Roadside Units (RSUs) can quickly identify fake traffic event data (such as congestion or accidents) fabricated by attackers by monitoring cache hit rate and PIT occupancy rate, combined with a content popularity prediction model. When an anomaly is detected, the system automatically adds the fake content to a dynamic blacklist and triggers a multi-node collaborative detection mechanism. Through the data fusion center (processing server) in the hierarchical topology, the request change rate of each layer of routers is analyzed to accurately locate the attack path. This achieves cache pollution detection and defense within 20 milliseconds.

[0129] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0131] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0132] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0133] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for defending against NDN attacks, characterized in that, Target nodes applied in NDN include: Based on the numerical relationship between the cache hit rate of the target node and the normal cache hit rate range in one or more consecutive detection periods, and / or the numerical relationship between the PIT occupancy rate of the target node and the normal PIT occupancy rate range in one or more consecutive detection periods, it is determined whether the target node is subjected to an NDN denial-of-service attack. If it is determined that the target node is under an NDN denial-of-service attack, then defensive operations are performed; The normal cache hit rate range is determined based on the node attributes of the target node and the cache hit rate of the target node in at least one baseline monitoring period. The normal PIT occupancy range is determined based on the node attributes of the target node and the PIT occupancy of the target node in at least one of the baseline monitoring periods.

2. The method as described in claim 1, characterized in that, The step of determining whether the target node is under NDN denial-of-service attack based on the numerical relationship between the cache hit rate of the target node and the normal cache hit rate range for one or more consecutive detection periods includes at least one of the following: If continuous N If the cache hit rate of the target node is higher than the upper limit of the normal cache hit rate range for a monitoring period, and the target node is not a node in the preset node whitelist, then the target node is determined to be under NDN denial-of-service attack. If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range in both monitoring periods, and in the continuous period... N If the rate of change of the cache hit rate of the target node is lower than the preset first rate of change threshold in any two adjacent monitoring periods, then the target node is determined to be under NDN denial-of-service attack. The step of determining whether the target node is under NDN denial-of-service attack based on the numerical relationship between the target node's PIT occupancy rate and the normal PIT occupancy rate range during one or more consecutive detection periods includes at least one of the following: If continuous N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range in all three monitoring periods, then the target node is determined to be under NDN denial-of-service attack. If continuous N The PIT occupancy rate of the target node was lower than the lower limit of the normal PIT occupancy rate range in all four monitoring periods, and the continuous N If all four monitoring periods belong to the target monitoring period, then the target node is determined to be under an NDN denial-of-service attack; wherein, the target monitoring period is a monitoring period that meets at least one of the following conditions: the PIT occupancy rate change rate relative to the adjacent monitoring period is lower than a preset second change rate threshold, and the network speed is within a preset network speed range; The step of determining whether the target node is under NDN denial-of-service attack based on the numerical relationship between the cache hit rate and the normal cache hit rate range of the target node in one or more consecutive detection periods, and based on the numerical relationship between the PIT occupancy rate and the normal PIT occupancy rate range of the target node in one or more consecutive detection periods, includes: If continuous N The cache hit rate of the target node was lower than the lower limit of the normal cache hit rate range for five consecutive monitoring periods. N If the PIT occupancy rate of the target node is higher than the upper limit of the normal PIT occupancy rate range during the five monitoring periods, then the target node is determined to be under NDN denial-of-service attack. N 1. N 2. N 3. N 4. N 5 are all preset quantity thresholds.

3. The method as described in claim 1, characterized in that, The node attributes include the node's importance level, where the importance level characterizes the extent of the impact on NDN network transmission when a node fails. The magnitude of the boundary value of the normal cache hit rate range is positively correlated with the importance level of the target node; The magnitude of the boundary value of the normal PIT occupancy range is negatively correlated with the importance level of the target node.

4. The method as described in claim 2, characterized in that, N 1. N 2. N 3. N 4. N At least one of 5 is positively correlated with the importance level of the target node.

5. The method as described in claim 1, characterized in that, The defensive operation includes at least one of the following: Send a node anomaly notification message to other network transmission nodes in the NDN to indicate that the target node is under NDN denial-of-service attack; so that the other network transmission nodes in the NDN, based on the node anomaly notification message, suspend or reduce communication with the target node for a preset first time period from the date of receiving the node anomaly notification message, or for a preset second time period from the date of discovery of the target node being under NDN denial-of-service attack indicated by the node anomaly notification message; Clear all cached data from the target node; Clear all abnormal cached data from the target node's cached data; wherein, abnormal cached data is cached data that satisfies at least one of the following conditions: The source of the cached data is not a device in the preset device whitelist; During the first specified detection period, the access frequency of cached data exceeds the preset access frequency threshold. During the second specified detection period, the access time interval of the cached data does not follow a normal distribution; During the third specified detection period, the total number of accesses to the cached data exceeds the preset access threshold.

6. The method as described in claim 1, characterized in that, The baseline monitoring period is the fourth designated monitoring period in the previous monitoring cycle in which it was determined that the target node was not subjected to an NDN denial-of-service attack; wherein, each monitoring cycle includes multiple monitoring periods.

7. A target node in an NDN, characterized in that, include: The rule determination module M1 is used to determine the normal cache hit rate range based on the node attributes of the target node and the cache hit rate of the target node in at least one baseline monitoring period. And / or determine the normal PIT occupancy range based on the node attributes of the target node and the PIT occupancy rate of the target node in at least one of the baseline monitoring periods; The monitoring module M2 is used to determine whether the target node is subjected to an NDN denial-of-service attack based on the numerical relationship between the cache hit rate of the target node and the normal cache hit rate range in one or more consecutive detection periods, and / or the numerical relationship between the PIT occupancy rate of the target node and the normal PIT occupancy rate range in one or more consecutive detection periods. Defense module M3 is used to perform defense operations if it is determined that the target node is under NDN denial-of-service attack.

8. An electronic device, characterized in that, include: A processor and a memory for storing processor-executable instructions; The processor is configured to execute the instructions to implement the NDN attack defense method as described in any one of claims 1-6.

9. A readable storage medium, characterized in that, The readable storage medium stores computer program code that, when executed on a computer, causes the computer to perform the NDN attack defense method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to execute the NDN attack defense method as described in any one of claims 1-6.

Images