A layered mitigation method for ldo s attack in rdma network

Abstract

The application discloses a layered mitigation method for LDoS attack in RDMA network, and belongs to the field of computer network security. The method comprises the following steps: firstly, collecting the current queue depth, queue change trend and PFC event occurrence number on the switch port side, calculating the port pressure index and judging the port risk state; then, the global control layer collects candidate risk port information and high risk port information, constructs a path-dependent graph combined with the active flow path, and judges whether there is a risk propagation chain structure, a persistent risk structure or a strongly connected risk structure; finally, according to the port pressure state and the path-level risk judgment result, the local dynamic speed limit, the global micro-speed limit and the global strong intervention are executed. The application can realize layered mitigation for LDoS attack in RDMA network, reduce the influence of PFC back pressure diffusion caused by attack, reduce the influence on normal business flow, and improve the stability and reliability of RDMA network in LDoS attack scene.

Description

Technical Field

[0001] This invention belongs to the field of computer network security, specifically relating to a layered mitigation method for LDoS attacks applied in RDMA networks. Background Technology

[0002] With the continuous development of cloud computing, distributed storage, high-performance computing, and large-scale machine learning training, the scale of east-west traffic within data centers is constantly increasing, placing higher demands on network communication for low latency, high throughput, and low processing overhead. Remote Direct Memory Access (RDMA) technology can bypass the operating system kernel protocol stack, enabling data to be transferred directly between the memory of the communicating parties, thereby reducing the number of memory copies and the involvement of the central processing unit. It has become one of the important technologies for high-performance communication in data centers.

[0003] RoCEv2 is an implementation that carries RDMA over Ethernet. To reduce packet loss, retransmission, and performance jitter, RoCEv2 lossless networks typically combine mechanisms such as Priority Flow Control (PFC) and Data Center Quantized Congestion Notification (DCQCN). PFC performs hop-by-hop pause control on specific priority queues; when a switch port queue reaches a set threshold, it sends a PFC pause signal to upstream devices. DCQCN controls network congestion through switch congestion marking, receiver feedback, and transmitter rate adjustment.

[0004] While providing a near-lossless transmission environment, Priority Control (PFC) can also trigger backpressure propagation issues. Because PFC controls priority queues rather than specific abnormal flows, when attack flows share priority queues or forwarding paths with normal traffic flows, queue backlogs on local ports can simultaneously disrupt normal traffic flows. Low-rate Denial of Service (LDoS) attacks can repeatedly induce port queue spikes using low-average-rate, short-duration bursts of RDMA traffic, triggering PFC backpressure and congestion control feedback, slowing down normal traffic flows, and causing local pressure to propagate upstream along active flow paths.

[0005] Currently, existing detection and mitigation methods for addressing queue backlog and PFC backpressure propagation issues caused by LDoS attacks in RDMA networks still suffer from problems such as insufficient port risk characterization, inadequate path-level risk assessment capabilities, and low adaptability of mitigation actions.

[0006] Port risk characterization is insufficient. Existing detection methods mostly rely on traffic volume, link utilization, or single queue thresholds for risk assessment. However, LDoS attacks typically exhibit low average rates and short bursts, with their impact primarily manifested as rapid queue growth, increased PFC events, and a decrease in normal service flow rates. Therefore, relying solely on queue depth at a single moment or fixed traffic thresholds is insufficient to accurately characterize port risk status and fails to adequately differentiate between early attack risk identification and normal burst traffic, easily leading to missed or false positives.

[0007] The ability to assess path-level risks is insufficient. Existing detection methods typically focus on the local state of a single port or flow, lacking a unified modeling of port dependencies formed by the forwarding direction of active flows and the backpressure propagation direction of PFC. However, PFC exhibits hop-by-hop backpressure propagation characteristics, meaning that the pause effects generated by downstream ports can spread upstream along the active flow path, creating continuous, persistent, or cyclically dependent risks among multiple ports. Therefore, existing methods struggle to identify risk propagation chain structures, persistent risk structures, or strongly connected risk structures in a timely manner, and cannot effectively determine whether the risk has extended to the path level.

[0008] The adaptability of mitigation actions is low. Existing response strategies typically employ single rate limiting or centralized strong control methods. However, when the risk is limited to a single port, overly strong global control may unnecessarily impact normal business throughput; when the risk has already spread along the path, relying solely on local control is insufficient to promptly block backpressure propagation. Therefore, existing methods struggle to select layered mitigation actions that match the degree of risk based on changes in local port pressure and global path-level risk.

[0009] This invention proposes a layered mitigation method for LDoS attacks in RDMA networks. The method first collects current queue depth, queue change trends, and the number of PFC events at the switch port side, calculates the port pressure index, and determines the port risk status. Then, the global control layer aggregates candidate risk port information and high-risk port information, constructs a path dependency graph based on active flow paths, and performs path-level risk assessment to identify the existence of risk propagation chains, persistent risk structures, or strongly connected risk structures. Finally, based on the port pressure index and path-level risk assessment results, local dynamic rate limiting, global micro-rate limiting, and global strong intervention are executed respectively to achieve layered mitigation of LDoS attacks in RDMA networks, reducing the spread of PFC backpressure caused by the attack and the performance degradation of normal service flows. Summary of the Invention

[0010] To address the shortcomings of existing LDoS attack detection and mitigation methods in RDMA networks, such as insufficient port risk awareness, inadequate path-level risk assessment capabilities, and low adaptability of response strategies, this invention proposes a layered mitigation method for LDoS attacks in RDMA networks. This method senses the switch port status, determines path-level risks based on path dependencies, and executes layered mitigation actions according to different path-level risks, thereby reducing the impact of PFC backpressure propagation caused by LDoS attacks on the performance of normal service flows.

[0011] The technical method adopted by the present invention to achieve the above objectives is a hierarchical mitigation method for LDoS attacks in RDMA networks, which includes three steps: port pressure perception, path-level risk judgment, and hierarchical mitigation action execution.

[0012] 1. Port Pressure Awareness. The port operating status is collected at the switch port side according to a preset sampling period. This port operating status includes the current queue depth, queue change trend, and the number of PFC events. The port pressure index is calculated using this status information, including three steps: port pressure feature normalization, port pressure index calculation, and port risk status assessment.

[0013] 1.1 Port pressure feature normalization: The collected current queue depth, queue change trend, and number of PFC events are normalized to obtain the queue depth normalized value Q(p,t), queue growth trend normalized value G(p,t), and PFC event frequency normalized value P(p,t). Where p represents the switch port number, t represents the current time window index, Q(p,t) is calculated based on the ratio of the current queue depth to the port queue capacity, G(p,t) is calculated based on the difference in queue depth between the current sampling period and the previous sampling period (zero when the difference is negative), and P(p,t) is obtained by normalizing the number of PFC events within the current time window.

[0014] 1.2 Port Pressure Index Calculation: The normalized port state characteristics are weighted and summed to calculate the port pressure index PS(p,t), which is calculated using the following formula: , in, , , Preset weighting coefficients are used to represent the weights of queue depth, queue change trend, and PFC event frequency in the port pressure index, respectively, and satisfy the following conditions: The port pressure index, calculated using the formula, can comprehensively reflect the current port cache pressure, pressure growth trend, and PFC backpressure trigger status.

[0015] 1.3 Port Risk Status Assessment: Based on the comparison between the port stress index and preset low-risk and high-risk thresholds, ports are classified into normal, candidate-risk, and high-risk states. A low-risk threshold is set. and high risk threshold ,when The time marker is set to normal state, when When marked as a candidate risk state, The time stamp is marked as a high-risk state; and the candidate risk port information and high-risk port information are reported to the global control layer.

[0016] 2. Path-level risk assessment. The global control layer aggregates candidate risk port information and high-risk port information reported by each local switch, and constructs a path dependency graph based on the current active flow paths. This includes two steps: path dependency graph construction and risk propagation structure assessment.

[0017] 2.1 Path dependency graph construction: The path dependency graph uses switch ports as nodes and the dependencies between ports as edges. Assume an active flow passes through a sequence of switch ports. ,in, This indicates the i-th port that the flow passes through on the forwarding path, based on the active flow forwarding direction. Establish positive dependency edges between ports, and determine the direction of PFC backpressure propagation. Establish reverse pressure dependency edges; the nodes in the path dependency graph are marked with the risk status of the corresponding ports; the global control layer dynamically updates the path dependency graph based on the current active flow paths and port risk status.

[0018] 2.2 Risk propagation structure judgment: Detect the risk propagation structure on the constructed path dependency graph, including risk propagation chain structure, persistent risk structure and strongly connected risk structure; when any of the above risk structures exist, the global control layer determines that there is a path-level risk in the current network.

[0019] 3. Layered mitigation actions. Based on the port pressure index and path-level risk assessment results, corresponding control actions are executed by the local layer and the global layer respectively, thereby achieving layered mitigation against LDoS attacks. These control actions include three types: local dynamic rate limiting, global micro-rate limiting, and global strong intervention. Local dynamic rate limiting: When the port pressure index reaches or exceeds the high-risk threshold, the local layer identifies the corresponding high-risk port and obtains the active flow information forwarded through the high-risk port. The active flow is regarded as a risk-associated flow, and smooth rate limiting is performed on the sending rate of the risk-associated flow or the sending scheduling rate of the high-risk port. The smooth rate limiting adopts a gradual adjustment method, that is, when the port pressure index continues to rise, the sending rate of the risk-associated flow or the port sending rate is gradually reduced, and the rate limiting is gradually released when the port pressure index returns to the normal range, so as to avoid the performance fluctuation of normal service flow caused by sudden rate changes. Global micro-rate limiting: When any of the following exists in the path dependency graph: risk propagation chain structure, persistent risk structure, or strongly connected risk structure, the global control layer determines the key ports on the risk propagation path based on the path dependency graph, obtains the set of active flows passing through the key ports, and identifies the set of active flows as risk-related flows; subsequently, the global control layer performs global micro-rate limiting on the risk-related flows corresponding to the key ports on the risk propagation path, thereby reducing the data transmission rate on the risk propagation path and suppressing the further spread of PFC backpressure induced by LDoS attacks. Global Strong Intervention: When the global control layer determines that there is a persistent risk structure or a strongly connected risk structure, and the virtual credit pool balance is not less than the preset limit, the key port with the highest port pressure index is selected from the risk propagation path, and queue recovery control is executed based on the virtual credit limit; the queue recovery control reduces the queue pressure corresponding to the key port by adjusting the queue recovery amount corresponding to the virtual credit limit, thereby alleviating the risk of continuous back pressure and cyclic waiting. Beneficial effects

[0020] This invention proposes a layered mitigation method for LDoS attacks in RDMA networks. Through port pressure sensing, path-level risk assessment, and layered mitigation action execution, it achieves layered mitigation of LDoS attacks in RDMA networks. This reduces the impact of PFC backpressure propagation while minimizing disruption to normal service flows, thereby improving the stability and reliability of RDMA networks under LDoS attack scenarios. This invention is a proactive mitigation method for the PFC risk propagation process triggered by LDoS attacks. It can dynamically select control strategies of different strengths based on the risk status, effectively improving the network's congestion control and anomaly recovery capabilities under attack scenarios. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the overall process of a layered mitigation method for LDoS attacks in an RDMA network proposed in this invention.

[0022] Figure 2 This is a schematic diagram of the port pressure sensing and risk status judgment process in this invention.

[0023] Figure 3 This is a schematic diagram of the path dependency graph construction in this invention.

[0024] Figure 4 This is a schematic diagram of the risk propagation chain structure, persistent risk structure, and strongly connected risk structure in this invention.

[0025] Figure 5 This is a schematic diagram of the global, strongly intervened virtual credit pool control process in this invention. Detailed Implementation

[0026] The invention will be further described below with reference to the accompanying drawings.

[0027] like Figure 1 As shown, the layered mitigation method for LDoS attacks in RDMA networks proposed in this invention includes three stages: port pressure awareness, path-level risk assessment, and layered mitigation action execution. First, port operating status information is collected at the switch port level to calculate the port pressure index and determine the port risk status. Then, the global control layer constructs a path dependency graph based on the reported risky port information and active flow paths, and performs path-level risk assessment. Finally, corresponding mitigation actions are executed based on the port pressure status and the path-level risk assessment results.

[0028] 1. During the port pressure sensing phase, the switch ports collect port operating status information according to a preset sampling period. This information includes the current queue depth, queue change trend, and the number of PFC events. By processing this status information, a port pressure index is calculated. Based on the comparison between the port pressure index and a preset threshold, ports are classified into normal, candidate risk, and high-risk states. For ports in the candidate risk and high-risk states, the corresponding risk port information is sent to the global control layer to provide input for subsequent path-level risk assessment.

[0029] 2. In the path-level risk assessment phase, the global control layer aggregates the candidate risk port information and high-risk port information reported by each switch, and constructs a path dependency graph based on the active flow paths in the current network. The global control layer detects risk propagation structures based on this path dependency graph, including risk propagation chain structures, persistent risk structures, and strongly connected risk structures. When any of these risk structures is detected, it is determined that a path-level risk exists in the current network.

[0030] 3. During the layered mitigation action execution phase, based on the port pressure status and path-level risk assessment results, the local layer and the global layer respectively execute local dynamic rate limiting, global micro-rate limiting, and global strong intervention, thereby achieving layered mitigation of LDoS attacks in RDMA networks.

[0031] like Figure 2 As shown, during the port pressure sensing process, the switch port collects port operating status information according to a preset sampling period. The port operating status information includes the current queue depth, queue change trend, and the number of PFC events.

[0032] The current queue depth reflects the current buffer occupancy of the switch port; the queue change trend reflects the direction of port pressure change over time; and the number of PFC events reflects the degree to which the port is affected by PFC backpressure. The system calculates the port pressure index locally based on the above status information and determines the port risk status based on the relationship between the port pressure index and a preset threshold.

[0033] When the port pressure index is within the normal range, the corresponding port is marked as normal; when the port pressure increases but has not yet reached the high-risk condition, the corresponding port is marked as a candidate risk state; when the port pressure reaches the high-risk condition, the corresponding port is marked as a high-risk state. For ports in the candidate risk state and high-risk state, the local system sends the corresponding risk information to the global control layer to provide input for subsequent path-level risk assessment.

[0034] like Figure 3 As shown, the global layer constructs a path dependency graph based on locally reported risk information and current active flow paths. This path dependency graph uses switch ports as nodes and the dependencies between ports as edges. Specifically, forward dependency edges are established based on the active flow forwarding direction to describe the data forwarding relationship of RDMA service flows; reverse pressure dependency edges are established based on the PFC backpressure propagation direction to describe the upstream propagation of congestion effects along the path. By simultaneously recording the active flow forwarding relationship and the PFC backpressure propagation relationship, the path dependency graph can describe the risk propagation dependency relationship induced by LDoS attacks.

[0035] like Figure 4 As shown, the global control layer detects risk propagation structures based on path dependency graphs, including risk propagation chain structures, persistent risk structures, and strongly connected risk structures. Specifically: when multiple candidate risk ports or high-risk ports appear consecutively along the same active flow path, a risk propagation chain structure is determined to exist; when the number of high-risk ports persists within multiple sampling windows and does not decrease significantly, a persistent risk structure is determined to exist; when multiple high-risk ports form directed loops through forward dependency edges and reverse pressure dependency edges, a strongly connected risk structure is determined to exist.

[0036] like Figure 5 As shown, when the global control layer detects a persistent risk structure or a strongly connected risk structure, and the remaining amount in the virtual credit pool is not less than the preset amount, a further global strong intervention is executed.

[0037] The global control layer maintains a virtual credit pool for performing global strong interventions. This virtual credit pool stores dynamically allocable virtual credit limits. The initial capacity of the virtual credit pool is configured based on the number of network ports, port cache size, and preset single-intervention resource requirements, limiting the maximum queue recovery amount that can be performed during a global strong intervention. The virtual credit limit corresponding to a single global strong intervention is determined based on the current queue pressure status of the target port and a preset recovery ratio. When the global strong intervention trigger condition is met, the global control layer determines the key ports in the risk propagation path according to the path dependency graph, selects the key port with the highest port pressure index as the intervention target, allocates the corresponding virtual credit limit from the virtual credit pool, and sends a global strong intervention command to the key port.

[0038] Upon receiving a global strong intervention command, the critical port adjusts the corresponding simulated queue recovery amount according to the allocated virtual credit limit. By reducing the simulated queue occupancy, it simulates the queue recovery process after blocked data gains additional transmission opportunities, thereby reducing the queue pressure on the critical port and mitigating the risks of persistent PFC backpressure propagation and circular waiting. After completing a global strong intervention, the global control layer updates the remaining virtual credit pool quota based on the virtual credit limit consumed in this intervention. When subsequent sampling windows detect network risk recovery, reduced port queue pressure, and no persistent strong risk structures, the virtual credit limit is gradually replenished according to the preset recovery strategy to restore the virtual credit pool to its initial capacity level. If high-risk structures are continuously detected, the current quota status is maintained to avoid frequent triggering of strong interventions.

Claims

1. A layered mitigation method for LDoS attacks in an RDMA network, characterized in that, In an RDMA network scenario where an LDoS attack triggers PFC backpressure propagation, a mitigation method is constructed by combining port pressure awareness, path-level risk assessment, and layered mitigation action execution to achieve layered mitigation of the LDoS attack. This method is deployed in an RDMA network environment that supports PFC and quantized congestion notification, and includes the following three steps: Step 1: Port Pressure Sensing. The port operating status is collected at the switch port according to a preset sampling period. This port operating status includes the current queue depth, queue change trend, and the number of PFC events. The port pressure index is calculated using this status information, and includes the following three steps: Step 1.1: Port pressure feature normalization. The collected current queue depth, queue change trend, and number of PFC events are normalized to obtain the queue depth normalized value Q(p,t), queue growth trend normalized value G(p,t), and PFC event frequency normalized value P(p,t). Where p represents the switch port number, t represents the current time window index, Q(p,t) is calculated based on the ratio of the current queue depth to the port queue capacity, G(p,t) is calculated based on the difference in queue depth between the current sampling period and the previous sampling period (zero when the difference is negative), and P(p,t) is obtained by normalizing the number of PFC events within the current time window. Step 1.2: Calculate the port pressure index. The normalized port state features are weighted and summed to calculate the port pressure index PS(p,t). The calculation formula is as follows: ， in, , , Preset weighting coefficients are used to represent the weights of queue depth, queue change trend, and PFC event frequency in the port pressure index, respectively, and satisfy the following conditions: Through the calculation formula, the port pressure index can comprehensively reflect the current port cache pressure, pressure growth trend, and PFC backpressure trigger status. Step 1.3: Port risk status judgment. Based on the comparison results between the port pressure index and the preset low-risk threshold and high-risk threshold, the port is divided into normal state, candidate risk state and high-risk state; and the candidate risk port information and high-risk port information are reported to the global control layer. Step 2: Path-level risk assessment. The global control layer aggregates the candidate risk port information and high-risk port information reported by each local switch and performs path-level risk assessment, including the following two steps: Step 2.1: Path dependency graph construction. The path dependency graph uses switch ports as nodes and the dependencies between ports as edges. The dependencies are formed by active flow forwarding paths and PFC backpressure propagation relationships. Forward dependency edges between ports are established according to the active flow forwarding direction, and reverse pressure dependency edges are established according to the PFC backpressure propagation direction. Step 2.2: Risk Propagation Structure Judgment. The risk propagation structure is detected on the constructed path dependency graph, including risk propagation chain structure, persistent risk structure, and strongly connected risk structure. Specifically, the risk propagation chain structure refers to a path structure where at least three ports appear consecutively along the same active flow path, and all are in a high-risk or candidate-risk state. The persistent risk structure refers to a state structure in the path dependency graph where the number of high-risk ports does not show a monotonically decreasing trend within at least three consecutive sampling windows. The strongly connected risk structure refers to a topology structure where multiple high-risk ports form directed loops through forward dependency edges and reverse pressure dependency edges. When any of the above risk structures exists, the global control layer determines that the current network has path-level risks. Step 3: Layered mitigation actions are executed. Based on the port pressure index and path-level risk assessment results, the local layer and global layer execute corresponding control actions respectively, thereby completing the layered mitigation against LDoS attacks. The control actions include three types: local dynamic rate limiting, global micro-rate limiting, and global strong intervention. Local dynamic rate limiting: When the port pressure index reaches or exceeds the high-risk threshold, the local layer performs smooth rate limiting on the flow related to the high-risk port or the port itself. The smooth rate limiting adopts a step-by-step adjustment method, that is, when the port pressure increases, the transmission rate is reduced step by step, and the rate limiting is relaxed step by step after the port pressure recovers. Global micro-rate limiting: When any of the following exists in the path dependency graph: risk propagation chain structure, persistent risk structure, or strongly connected risk structure, the global layer performs global micro-rate limiting on the critical ports or related flows on the risk propagation path. Global Strong Intervention: When the global control layer determines that there is a persistent risk structure or a strongly connected risk structure, and the virtual credit pool balance is not less than the preset limit, the key port with the highest port pressure index is selected from the risk propagation path, and queue recovery control is executed based on the virtual credit limit; the queue recovery control reduces the queue pressure corresponding to the key port by adjusting the queue recovery amount corresponding to the virtual credit limit, thereby alleviating the risk of continuous back pressure and cyclic waiting.

2. The method according to claim 1, characterized in that, The method for determining the three port states mentioned in step 1.3 is as follows: Set a low-risk threshold. and high risk threshold ,when The time marker is set to normal state, when When marked as a candidate risk state, The time is marked as a high-risk state.

3. The method according to claim 1, characterized in that, The method for constructing the path dependency graph in step 2.1 is as follows: Assume an active flow passes through a sequence of switch ports. ,in, This indicates the i-th port that the flow passes through on the forwarding path, based on the active flow forwarding direction. Establish positive dependency edges between ports, and determine the direction of PFC backpressure propagation. Establish reverse pressure dependency edges; the nodes in the path dependency graph are marked with the risk status of the corresponding ports; the global control layer dynamically updates the path dependency graph based on the current active flow paths and port risk status.

Images