36 results about "Flooding attack" patented technology

Systems and techniques are described for wireless communication. For example, a process can include obtaining a wireless communication message associated with a source identifier (ID); determining that the source ID is associated with a flooding attack. The process can include filtering, based on determining that the source ID is associated with a flooding attack, wireless communication messages associated with the source ID. Filtering the wireless communication messages includes alternating between a first filtering state and a second filtering state. The first filtering state and the second filtering state are associated with different amounts of filtering.

The invention provides a link flooding attack detection and defense method and system based on reputation and a clustering algorithm, and the method comprises the steps: constructing an IP reputation model, detecting a newly-added route tracking behavior of an IP, and updating a reputation score value of the newly-added route tracking behavior according to the IP reputation model; detecting the access destination IP entropy of the IP in the untrusted IP set so as to judge the occurrence of an LFA attack and locate a victim link; sampling the flow of the switch at the inlet end of the victim link and performing flow feature extraction; training a first-stage self-organizing graph clustering model so as to carry out preliminary detection on the sampling flow; training a second-stage Gaussian hybrid clustering model so as to carry out secondary detection on the sampling flow; and issuing a flow table rule, and performing flow banning on the malicious IP identified by clustering. The method can improve the detection accuracy, and has better robustness.

A network monitoring device can include one or more memory devices that can store executable instructions thereon that, when executed by one or more processors, cause the one or more processors to monitor network traffic transmitted across a communications network, detect at least one first data packet corresponding to a request to establish a communication session, ingest first information associated with the at least one first data packet into a probabilistic data structure, identify at least one second data packet corresponding to a response, determine that the response does not correspond to either (i) the request or (ii) a plurality of requests, and drop the at least one second data packet from the communications network.

The present invention discloses a synchronous adaptive link flood attack defense method for a multi-dimensional identification heterogeneous network, comprising the following steps: S1, sampling the packet loss rate and link utilization of the network topology link to obtain the current state of the link; S2, extracting the key traffic features of the current state through the Honey Badger optimization algorithm; S3, inputting the key traffic features of the current state into a prediction model based on a spatiotemporal graph convolutional neural network to obtain a DDoS attack traffic prediction value; S4, identifying the attack action of the DDoS attack traffic prediction value, and selecting the optimal defense action through a partially observable Markov decision process model and a reward mechanism; S5, adjusting the defense strategy based on the optimal defense action selected in the current state. The present invention can accurately predict attack behavior and dynamically learn the optimal mitigation strategy in a novel multi-dimensional identification fusion network scenario to maximize normal traffic transmission and minimize the impact of attack traffic on bottleneck links.

A method and system are provided for detecting an application layer flood denial of service (DDoS) attack initiated by an attacker using an advanced application layer flood attack tool. The method processes application layer transactions received during a current time window to detect rate-based anomalies in traffic directed to a protected entity; processing the received application layer transaction to determine a rate-independent anomaly based on a plurality of application attributes (AppAttached) observed in the application layer transaction received during a current time window, where the rate-independent anomaly is determined based on a consecutive update baseline of AppAttached, where the AppAttached represents an application behavior of a protected entity modeled based on the application layer transaction; determining whether an application layer flood DDoS exists in the current time window based on the detected rate-based anomaly and the detected rate-independent anomaly; and triggering a mitigation action when the application layer flood DDoS exists.

The invention discloses a link flooding attack detection method based on artificial intelligence, and the method comprises the steps: obtaining a plurality of flow attributes of a to-be-detected data stream in a network in a continuous time period, and constructing a time sequence attribute matrix corresponding to the flow attributes; performing multi-scale sparse sampling processing on the time sequence attribute matrix to generate a corresponding observation feature vector under each scale; inputting the observation feature vector under each scale into a preset reconstruction model for restoration, and obtaining reconstruction attribute data of each flow attribute under each scale; on the basis of the difference between the reconstructed attribute data and the original time sequence attribute matrix, abnormal scores of each flow attribute under different scales are calculated, and a comprehensive abnormal score value of each flow attribute is obtained through fusion; and identifying a suspicious node corresponding to each flow attribute according to the comprehensive abnormal score value, and performing topology co-occurrence analysis on the suspicious nodes of the plurality of flow attributes to determine a final link flooding attack target.

The invention provides a link flooding attack defense method and system based on a data plane programmable SDN (Software Defined Network), and relates to the technical field of network security defense. The method comprises the following steps: carrying out real-time clustering analysis on a Traceroute data packet passing through a switch by adopting an online clustering algorithm based on a weighted Manhattan distance, positioning a suspicious link and sending alarm information to a controller; establishing a link attribute graph sequence by collecting link state data based on the alarm information, and performing abnormal link identification by using a space-time double-attention detection model based on GAT-Seq2Seq to obtain an attack path; and identifying a link flooding attack flow by adopting an attack flow identification method based on reinforcement learning, and discarding the link flooding attack flow at a source end switch of an attack path. According to the method, the link flooding attack defense system with high accuracy, low resource overhead and quick response capability is constructed, so that efficient defense of attacks is realized.

This application relates to the field of network measurement technology, and specifically relates to a method for detecting abnormal traffic of DDoS attacks for network security services. The method includes: calculating a flooding coefficient according to the correlation between the number of access requests, the network protocol distribution, and the change in the target IP address distribution, and combining the packet length corresponding to the access request and the source IP address distribution characteristics; calculating an abnormal response coefficient according to the change trend of the request response time and combining the flooding coefficient; performing clustering based on the flooding coefficient and the abnormal response coefficient, and performing detection of abnormal traffic of DDoS attacks based on the clustering result, which enhances the accuracy and sensitivity of abnormal traffic detection and differentiation, improves the accuracy of detecting abnormal traffic of flooding attacks, reduces the occurrence of misjudgment of FE events, and enhances the ability to identify low-speed and slow attacks, thereby realizing high-sensitivity and high-precision detection of DDoS abnormal traffic.

The present invention discloses a method for detecting collusion interest flooding attack in named data network. The method extracts multi-dimensional network traffic features of all routers in an NDN network at the same time as the input of an RBF neural network model, uses a Gaussian function as the radial basis function of a hidden layer of the RBF neural network model to input all input samples in a training set into the RBF neural network model, uses a K-means algorithm to select h input samples from all input samples in the training set as clustering centers of the K-means algorithm, and determines the center of the radial basis function of the RBF neural network model according to the clustering centers; the present invention uses the RBF neural network algorithm to identify the differences between multi-dimensional network traffic features in different network states and classify them, thereby judging the state of the NDN network at each moment, and can more accurately distinguish normal network behavior from collusion interest flooding attack, so as to detect collusion interest flooding attack.

The invention belongs to the field of network space, and relates to a link flooding attack detection method and system based on SDN (Software Defined Network) service priority. The method comprises the following steps: target link selection: acquiring actual routing paths from other switches in a network to a switch where a target service is located, and selecting a link with a high influence degree from the actual routing paths as a target link; monitoring a target link and judging whether the link is congested or not; when it is detected that the link is congested, the attack detection and mitigation module receives the congestion position information of the link sent by the SDN controller module, acquires flow table information forwarded to the congested link by a switch where the congested link is located, and integrates and extracts the acquired host behavior information as features of a machine learning model; and judging whether the host belongs to a malicious host or not, and then performing link congestion relief. According to the method, the malicious hosts can be quickly identified, and meanwhile, the method has relatively high detection accuracy and recall rate and relatively low false positive rate.

This invention provides a method and system for penetrating spaceborne computers, comprising: identifying and parsing the physical layer, link layer, transport layer, and application layer protocols involved in the target spaceborne computer, completing communication link connectivity and protocol field mapping; designing and generating multiple types of attack payloads based on protocol and functional models, injecting various attack data packets including internal network penetration, lateral movement, flooding attacks, and command replay; real-time collection of multiple operational indicators, status parameters, and abnormal events of the spaceborne computer, performing data processing and feature extraction; setting multi-dimensional anomaly criteria and scoring models, identifying and quantifying abnormal indicators, and outputting risk levels; and performing graded risk assessment based on attack input, abnormal responses, and scoring results, outputting security vulnerabilities and rectification suggestions. This invention is applicable to ground testing, on-orbit evaluation, and related security protection fields of spaceborne computers, improving the security assurance capabilities of satellite systems.

The application provides an agent identity verification method based on a trust mechanism, belongs to the technical field of artificial intelligence and network security, and is used for solving the problems that in related technologies, external credentials cannot distinguish real agents from fake requests and are vulnerable to prompt injection attacks. In the application, a natural language semantic task is issued by a verification direction request party as a verification task, the request party generates a high-cost natural language response meeting a preset quality constraint, the verification party performs lightweight verification with a lower computing resource than the generation cost, and if the verification is passed, the request party is determined to be an agent with a legal semantic generation capability. The application realizes identity verification based on the endogenous semantic capability of the agent as the trust basis, naturally resists fake and flooding attacks through a cost asymmetry mechanism, and is immune to prompt injection at the protocol level through an output locking mechanism, and can be widely applied to trusted communication scenarios of an agent network.

Systems and techniques are described for wireless communication. For example, a process can include obtaining a wireless communication message associated with a source identifier (ID); determining that the source ID is associated with a flooding attack. The process can include filtering, based on determining that the source ID is associated with a flooding attack, wireless communication messages associated with the source ID. Filtering the wireless communication messages includes alternating between a first filtering state and a second filtering state. The first filtering state and the second filtering state are associated with different amounts of filtering.

The present application discloses a DNS security protection method, device and server device, which solves the problems of slow protection response and easy protection failure in the prior art. The present application adds a specific handshake authentication process to DNS queries from the client, in which tags are embedded in the packets, and normal users are triggered to perform secondary DNS queries through CNAME records; in this way, the secondary DNS requests of normal users can be successfully matched, and after the embedded tags are stripped, subsequent processing can be carried out according to the normal DNS query processing mechanism; while if the client is an attacker, it will directly discard the received response packet, which is equivalent to blocking the attacker's packet, so that most of the DNS flood attack traffic will be cleaned up, and the recognition and blocking of attack protection can achieve a millisecond-level response.

The application discloses a kind of link flooding attack under the identification method and device of persistent routing, the method is first collected traffic data from SDN data plane, and the flow characteristics of each link are extracted by SDN controller, to construct flow characteristic dataset and training set;Then construct LSTM classification model and carry out offline training;Again in the flow characteristics of each link under the link flooding attack in SDN controller is input to the LSTM classification model trained, to obtain the flow class of the flow characteristics of each link, to construct flow characteristic class dataset;Finally, flow characteristic class dataset is traversed, and the flood proportion of each link is obtained, further identified and positioned to link flooding attack under persistent routing.The application can accurately identify persistent routing under link flooding attack under the mixed flow including link flooding attack attack flow and benign flow, and is conducive to enhancing the effectiveness and accuracy of persistent routing identification.

An attack prevention method includes: receiving an authentication request frame; and in response to receiving the authentication request frame, replying with an authentication response frame that is sent to a non-access-point (non-AP) station (STA), wherein the authentication request frame includes a timeout interval element that carries Authentication Comeback time. Another attack prevention method includes: ignoring each specific request frame that is received within a period in which a connected non-AP STA operates under a power saving mode, wherein each specific request frame includes one of an authentication request frame, an association request frame, and a reassociation request frame.

Various disclosed embodiments include methods and systems for generating application layer signatures that characterize advanced application layer attacks. The method includes determining a baseline distribution of applicability of attributes included in a transaction for a protected entity during a peace period; determining an attack distribution of applicability attributes included in the transactions for the protected entity during the ongoing application layer attack; based on the application baseline distribution and the attack distribution of the application attributes, determining a probability that an attacker executes an ongoing application layer attack to generate an attack using at least one attribute; and generating an application layer signature specifying an applicability attribute determined to be qualified based on their respective probabilities, where the application layer signature characterizes a behavior of an attacker performing the ongoing application layer attack.

The invention discloses a CAN bus attack detection method, device and equipment, and relates to the technical field of computers. The method comprises the steps of obtaining a plurality of CAN message messages on a CAN bus within a target duration, and determining a CAN identifier and a message type of each CAN message message; mapping the CAN identifier and the message type corresponding to each CAN message to obtain a symbolized representation corresponding to each CAN message; based on the symbolization representation corresponding to each CAN message, determining the information entropy of each CAN message in the target duration, and based on the multiple information entropies, determining the target information entropy of the CAN bus; and determining an attack detection result for the CAN bus based on the target information entropy, a first reference entropy value corresponding to the CAN bus and a first preset entropy threshold value. By adopting the method, flooding attacks and a small number of replay attacks which disguise high-priority CAN IDs can be detected.

A wireless communication process can include obtaining a wireless communication message associated with a source identifier (ID); determining that the source ID is associated with a flooding attack. The process can include filtering, based on determining that the source ID is associated with a flooding attack, wireless communication messages associated with the source ID. Filtering the wireless communication messages includes alternating between a first filtering state and a second filtering state. The first filtering state and the second filtering state are associated with different amounts of filtering.

The application provides a security communication method for agent interaction, belongs to the technical field of artificial intelligence and network communication, and is used for solving the problems that the agent identity authentication is unreliable, vulnerable to prompt word injection and flooding attack in the related art. The method comprises the following steps: a verification party generates a semantic challenge and issues it to a request party; the request party generates a natural language semantic response by using a large language model, and embeds API information in the response in a semantic steganography manner; the verification party receives the semantic response and performs legality verification, which comprises whether the semantic correlation and the generation cost are higher than a threshold value; after the verification is passed, the API information is extracted and an invocation is performed, and a structured result is output. The application takes semantic capability as a trust root, realizes integrated identity authentication and secure API invocation through asymmetric cost semantic challenge and semantic steganography, is immune to injection attack from the protocol level, and naturally resists flooding attack.

The present application discloses a method and device for defending against flooding attacks on a MANET network, including pre-initializing the MANET; within each update time interval Δt, any node in the MANET counts the total number of RREQ message packets received; if the total number of RREQ message packets exceeds a normal message number threshold, the node calculates its adaptive dynamic threshold; if the number of RREQ message packets sent to the node by any neighboring node of the node exceeds the adaptive dynamic threshold, the node refuses to receive all packets from the neighboring node. The method of the present application reduces the additional packet communication load in the link, solving the problems of the lack of flexibility of existing malicious node detection methods based on static thresholds and the high communication cost and computational overhead of malicious node detection methods based on dynamic thresholds.

Embodiments of the present application provide a link flooding attack processing method, device and equipment and a storage medium, comprising: obtaining an ICMP message and calculating an information entropy value of the ICMP message; in the case that the information entropy value is less than a preset early warning threshold, locating a congestion link according to the information entropy value; obtaining current state information of the congestion link and inputting the current state information into a deep reinforcement learning model trained by a convolutional neural network and a Q-learning algorithm through historical state information and historical routing strategies to obtain a current routing strategy; and performing routing processing on the link flooding attack according to the routing strategy. Embodiments of the present application can detect the link flooding attack without increasing additional detection points and can improve the detection accuracy of the link flooding attack. Furthermore, embodiments of the present application can learn strategies from historical traffic and perform traffic engineering on data streams through deep reinforcement learning, thereby more efficiently coping with LFA attacks and improving the service quality of the system.

An MCP flooding attack detection method based on behavior characteristics comprises the following steps: collecting and learning a large amount of legal MCP traffic, extracting parameter length, request interval, nesting depth and response time characteristics, and constructing four-dimensional normal distribution as a legal traffic model based on the parameters, the request interval, the nesting depth and the response time characteristics; the probability density of the feature vector of each new request under the legal model is calculated to judge the abnormal request and the attack type thereof, finally, an SIR infectious disease dynamic model and an ARIMA time sequence model are further innovatively integrated to predict the zombie node scale and the attack trend, and the prediction result is used as input to automatically trigger and adjust a defense strategy; according to the method, botnet attack detection is carried out on the large language model integrated with the MCP protocol by utilizing the multi-dimensional behavior characteristics, so that attack detection and an adaptive defense strategy are effectively realized, and a security protection capability is also provided for a complex network environment in which the large language model is integrated with the MCP protocol; the invention further comprises a system, equipment and a storage medium for implementing the method.

The present disclosure relates to a defense method and device for a flooding attack, a storage medium and an electronic device, and relates to the technical field of network and security technology. The method comprises: sampling real-time network card traffic of a network server based on a preset sampling frequency to obtain a to-be-processed sampling packet; calculating a real-time traffic rate of a current data flow according to a first byte number and a first flow time, and determining the current data flow as a target data flow when the real-time traffic rate of the current data flow is greater than a preset traffic threshold; extracting a target flow feature of the target data flow from the to-be-processed sampling packet, and generating an access control list rule corresponding to the target data flow according to the target flow feature; updating a current blacklist by using the access control list rule to obtain a target blacklist, and filtering a submitted packet based on the target blacklist to achieve defense against the flooding attack included in the submitted packet. The present disclosure improves the accuracy and timeliness of the defense.

The application discloses a CAN bus attack detection method, device and equipment, and relates to the technical field of computers. The method comprises the following steps: acquiring a plurality of CAN message messages on a CAN bus within a target time length, and determining the CAN identifier and message type of each CAN message message; mapping the CAN identifier and message type corresponding to each CAN message message to obtain the symbolic representation corresponding to each CAN message message; determining the information entropy of each CAN message message within the target time length based on the symbolic representation corresponding to each CAN message message, and determining the target information entropy of the CAN bus based on the plurality of information entropies; and determining the attack detection result for the CAN bus based on the target information entropy, the first reference entropy value corresponding to the CAN bus and the first preset entropy value threshold. The method can detect flooding attacks and a small number of replay attacks disguised as high-priority CAN IDs.

The present invention discloses a method and device for identifying a decoy host under a link flooding attack, the method comprising: after obtaining global routing information in an SDN controller, selecting key switches and dividing the network into multiple monitoring areas according to their distribution; offline training an improved RF model for traffic classification in each monitoring area, then converting all trained RF models into forwarding rules that comply with P4 switch specifications in the SDN controller, and installing them on key switches; running forwarding rules in the switch to classify traffic at line speed, and reporting the classification results to the SDN controller; identifying the address of the decoy host according to the classification results. The present invention significantly reduces the communication overhead between the controller and the data plane and within the data plane, improves the recognition accuracy and time efficiency of the decoy host under LFA, provides an efficient and resource-saving solution for the security defense of LFA, and improves the efficiency of SDN in dealing with LFA.

The invention discloses a network security protection method and device for pulling and fusing multi-source intelligence data, and relates to the technical field of network security protection, and the method comprises the steps: obtaining message information received by a power system, carrying out the message rationality analysis, and obtaining a message rationality parameter; according to a historical message rationality parameter sequence in a preset time range, processing to obtain a message unreasonable density, and carrying out flooding attack probability analysis to obtain a flooding attack probability; according to the flooding attack probability, carrying out integrated malicious analysis on the message information to obtain a malicious probability; and calculating the attack probability according to the malicious probability and the flooding attack probability, and performing protection processing judgment on the message information. According to the invention, the technical problem of inaccurate network security protection processing in the prior art is solved.

The application provides a target detection backdoor attack system based on a generative model, which is a brand-new backdoor attack model specially for target detection. The application puts the clean sample and the image obtained by superimposing a mask on the clean sample into a poison generator together with a trigger to generate a poisoned data set; then, the generated poisoned image is sent to a victim detector for detection, so that the backdoor attack has high success rate and does not affect the accuracy of the main task. In addition, the application also constructs a total optimization function, which uses two innovative attack schemes: the FLOODING attack can generate a large amount of false recognition to flood the normal output results, so as to damage the performance of the detector; and the HIDDEN attack makes the object unable to be recognized in the detection system, and presents an 'invisible' state. Through experimental verification, the attack system provided by the application can effectively fill the gap of the existing backdoor attack technology in the deeper regression task, so that the attack effect is significantly improved.

This invention provides an attack detection method, apparatus, and electronic device, applied in the field of vehicle network security technology. The invention acquires anchor messages configured with deadlines, collects the number of arbitration failures, queuing time, and actual transmission time during the transmission process, calculates the queuing waiting time, and generates a deadline violation indicator based on the deadline. Multiple transmission samples are aggregated within a specified sliding window, and a fingerprint vector reflecting the bus resource contention status is generated based on the above parameters. This fingerprint vector is compared with a pre-built adaptive baseline to obtain an anomaly score. When the anomaly score exceeds a preset threshold, a disguised high-priority flooding attack is identified. This invention improves the accuracy and robustness of attack detection by monitoring underlying resource contention characteristics and accurately identifying anomalies caused by disguised high-priority attacks.