The invention discloses an enhanced
fingerprint-based DDoS
attack recognition, pattern clustering and tracing method and
system, and the method comprises the steps: extracting multi-dimensional features, including basic features,
application layer behavior features, load entropy features and
time sequence statistical features, from network traffic, and calculating derivative features, including
time sequence features and rate features; carrying out normalization
processing on the multi-dimensional features and the derivative features, and carrying out weighted fusion to form an enhanced multi-dimensional traffic
fingerprint vector; performing DDoS
attack traffic preliminary screening on the enhanced multi-dimensional traffic
fingerprint vector through a dual-threshold preliminary screening logic, performing secondary
verification through a trained Bi-LSTM, and performing classification; clustering is carried out on the identified DDoS
attack traffic; and tracing the identified DDoS attack traffic according to the
network topology information and the traffic log. According to the method and the
system, accurate identification, classification and
traceability of the DDoS attack are realized.