CN111988340A - Small sample DDoS attack detection method based on deep migration learning - Google Patents

Abstract

The invention provides a small sample DDoS attack detection method based on deep migration learning. The method comprises the following steps: selecting a sample data space of DDoS attack with sufficient marked samples as a source domain

In the source domain

Trained neural network cluster

Selecting a sample data space of small sample DDoS attack as a target domain

Clustering neural networks

In the target domain

Performing a mobility comparison experiment; calculating the migratability value, selecting the network N with the highest migratability value_maxIn the target domain

Carrying out migration to obtain a migration network N_T(ii) a Fine adjustment of parameters is carried out by utilizing a fine-tuning technology; using a migration network N_TIn the target domain

And carrying out new small sample DDoS attack detection. According to the invention, by means of deep migration learning, the DDoS attack detection network parameters with sufficient marked samples are migrated to the small sample DDoS attack detection, and fine tuning is carried out by combining with the fine-tuning technology, so that the migration network can better utilize source domain knowledge to detect the novel small sample attack, and the problem of performance deterioration caused by few marked samples in the novel DDoS attack detection is improved.

Description

Small sample DDoS attack detection method based on deep transfer learning

technical field

The invention relates to the field of DDoS (Distributed Denial of Service, distributed denial of service) attack detection, in particular to a small sample DDoS attack detection method based on deep migration learning.

Background technique

DDoS attacks generally refer to distributed denial-of-service attacks, which rely on a large number of controlled zombie devices to initiate frequent requests to the attack target, thereby exhausting their resources and eventually crashing the server. Although the means and costs for maintaining network security are increasing, the methods of DDoS attacks are gradually evolving, and their damage to the network ecosystem is also gradually increasing. On the one hand, the peak traffic of traditional congestion-based DDoS attacks increases year by year; on the other hand, new DDoS attacks are no longer satisfied with high-cost, low-efficiency flooding attacks. It can avoid traditional detection techniques including Deep Packet Inspection (DPI) by means of signature or small sample attack. For example, SYN Flood attack is the main method of DDoS attack. However, with the platformization of Internet black production, the launch carrier of SYN Flood attack has also changed from massive zombie machines to charter machines, which has also changed the characteristics of the attack. In addition to flooding attacks, there are a large number of protocol-based attacks in DDoS attacks, such as HttpFlood attacks, UDP flood attacks, and TCP flood attacks.

Existing DDoS attack detection techniques include two types: misuse-based detection techniques and anomaly-based detection techniques. Misuse-based detection is also known as rule-based detection technology. This method has high detection accuracy and low false detection rate for known attacks, but the disadvantage of this method is that the establishment of rules needs to be completed by humans, and it cannot be 0day attacks are effectively detected. Anomaly-based detection technology is a method that can detect unknown DDoS attacks. This method can detect zero-day attacks, but it has a certain false alarm rate and relies too much on the features extracted by expert experience.

In recent years, researchers have used the good end-to-end characteristics of deep learning technology to detect DDoS attacks with increasing data volumes. However, there are few labeled data samples for new DDoS attacks, which deteriorates the detection performance of deep learning methods that rely on labeled data. Therefore, the present invention proposes a small-sample DDoS attack detection method based on deep transfer learning, which can not only take advantage of the end-to-end advantages of deep learning, but also overcome the problem of detection performance deterioration. value.

SUMMARY OF THE INVENTION

Aiming at the problems that the new DDoS attack detection has few labeled samples and the performance deteriorates when detecting based on the deep learning method, the present invention proposes a small sample DDoS attack detection method based on deep migration learning, and the specific technical scheme is as follows:

Contains the following steps:

在所述源域

上训练m个性能达标的基础神经网络以形成神经网络簇

Select network packets marked with sufficient samples of DDoS attacks as the source domain

in the source domain

Train m basic neural networks with satisfactory performance to form a neural network cluster

Select the sample data space of small sample DDoS attacks as the target domain

在所述目标域

中进行可迁移性对比实验,随后计算各个基础神经网络N_i，i∈[1，m]，m≥2的可迁移性能值；the neural network cluster

in the target domain

Carry out the transferability comparison experiment in , and then calculate the transferability performance value of each basic neural network N _i , i∈[1, m], m≥2;

进行迁移实验，得到迁移网络N_T；Comparing the transferable performance values, select the network N _max with the largest transferable performance value

Carry out a migration experiment to obtain a migration network _NT ;

Use fine-tuning technology to fine-tune the parameters of the migration network _NT ;

上训练所述迁移网络N_T；in the target domain

training the transfer network _NT on the above;

A new small-sample DDoS attack is detected by using the migration network _NT , and the detected performance value is obtained.

Further, the criterion for evaluating the performance of the basic neural network is whether it reaches a relevant performance threshold, and the performance threshold is set to 95%; the calculation formula of the performance threshold is as follows:

Among them, F1 represents the performance threshold; Pr represents the accuracy rate of the basic neural network _Ni in the target task detection; Re represents the recall rate of the basic neural network _Ni in the target task detection.

的可迁移性能值计算公式：Further, the basic neural network N _i , i ∈ [1, m], m ≥ 2 in the target domain

The calculation formula of the transferable performance value of :

表示基础神经网络N_i迁移到目标域

中的可迁移性能值；F1_j表示j次epoch训练后所得F1性能值，w_j表示每次训练所得性能值所赋的权重值；Pr_j表示j次epoch训练结束后的准确率，Re_j表示j次epoch训练结束后的召回率；E代表最后一次epoch训练。in

represents the transfer of the base neural network _Ni to the target domain

The transferable performance value in ; F1 _j represents the F1 performance value obtained after j epoch training, w _j represents the weight value assigned to the performance value obtained by each training; Pr _j represents the accuracy after j epoch training, Re _j Represents the recall rate after j epoch training; E represents the last epoch training.

Further, the specific operations of the migration experiment are:

其中

表示所述迁移网络N_T的总层数，

表示网络N_max的总层数。The parameters contained in the first layer of the network _Nmax are assigned to the first layer of the migration network _NT , which

in

represents the total number of layers of the migration network _NT ,

Represents the total number of layers in the network N _max .

Further, using the fine-tuning technology to fine-tune the parameters of the transfer network _NT is specifically: fine-tuning the parameters of the first layer of the transfer network _NT with a learning rate 1 to 2 orders of magnitude lower than the normal learning rate, and the rest of the parameters are fine-tuned. The layer parameters are updated according to the normal learning rate, which is set to 0.01.

LDAP型DDoS攻击样本数据空间作为目标域

应用效果最好的基础神经网络N_i的神经网络总层数为5，每层神经网络的神经元个数为800，迁移层数l为3。Preferably, the network packet of the SYN DDoS attack is selected as the source domain

LDAP-type DDoS attack sample data space as target domain

The basic neural network Ni with the best application effect has a total number of neural network layers of 5, the number of neurons in each _layer of neural network is 800, and the number of migration layers l is 3.

Further, the total number of neural network layers of the basic neural network Ni is 5-8 layers, the number of neurons in each layer of the neural network is _100-800 , and the migration depth is 1-4 layers.

The present invention also provides a small sample DDoS attack detection device, including:

one or more processors;

memory for storing one or more programs;

When the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned small sample DDoS attack detection method.

In another aspect, the present invention also provides a computer storage medium, where computer program instructions are stored thereon, and when the computer program instructions are executed by a processor, the above-mentioned small-sample DDoS attack detection method is implemented.

Compared with the prior art, the beneficial effects of the present invention are:

Using deep transfer learning, the DDoS attack detection network with sufficient labeled samples is applied to the detection of small-sample DDoS attacks, and the fine-tuning technology is used to fine-tune the parameters, so that the migrated network can better use the source domain knowledge to detect new small-sample attacks. test. Compared with the conventional method for detecting DDoS attacks by using deep learning technology, experiments show that the present invention can well improve the performance deterioration problem caused by less labeled samples in the detection of new DDoS attacks. In addition, the present invention directly detects the network message, the detection granularity is fine, and the identification accuracy is high.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, under the premise of no creative work, other drawings can also be obtained from these drawings, wherein:

1 is a flowchart of a small sample DDoS attack detection method based on deep transfer learning proposed by the present invention;

Fig. 2 is the schematic diagram of the deep migration of the basic neural network;

Fig. 3 is a schematic diagram of the transferable performance comparison of different neural network clusters calculated in the simulation experiment under the target domain;

Figure 4 is a schematic diagram showing the comparison of the small sample DDoS attack detection performance of the migration network calculated in the simulation experiment combined with the fine-tuning technology.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments.

In the present invention, the meaning of sufficient labeled samples means that the labeled sample data features are evenly distributed and the data volume is large, which can support the constructed neural network cluster to complete a sufficient number of trainings (usually 20 epochs), and enable the neural network cluster to complete enough training. The performance changes little after the last few epochs of training. Small samples are the opposite. Usually, due to the small amount of labeled sample data, the distribution of sample features is uneven, and the neural network cluster cannot be fully trained. N _i , i∈[1, m], m≥2, represents the neural network trained on the source domain, that is, the basic neural network that reaches the performance threshold; N _max represents that in the transferability comparison experiment, the transferable performance value is the largest The network; N _T represents the network obtained by N _max migration in the migration experiment.

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a flowchart of a small sample DDoS attack detection method based on deep transfer learning provided by the present invention. Specific steps include:

在所述源域

上构建并训练m个性能达标的基础神经网络以形成神经网络簇

Step1: Select a representative DDoS attack with sufficient labeled samples as the source domain

in the source domain

Build and train m basic neural networks with satisfactory performance to form a neural network cluster

因为该型在DDoS攻击中具有代表性，出现时间早且对网络危害性大,同时该攻击的标注样本充足，作为源域数据十分合适。对于每个性能达标的基础神经网络N_i，i∈[1，m]，m≥2，表示在源域上训练好的基础神经网络。所述基础神经网络N_i的目标函数可以利用下式表示：In a specific embodiment, a SYN-type DDoS attack can be selected as the source domain

Because this type is representative in DDoS attacks, it appears early and is very harmful to the network. At the same time, there are enough labeled samples for this attack, so it is very suitable as the source domain data. For each basic neural network N _i , i∈[1, m], m ≥ 2, which means that the basic neural network has been trained on the source domain. The objective function of the basic _neural network Ni can be expressed by the following formula:

表示基础神经网络N_i的目标函数；parameters^l表示该基础神经网络第l层的参数集；h^l表示该基础神经网络第l层隐藏层；L表示该基础神经网络的总层数；x表示输入到该基础神经网络的训练数据；σ(·)表示该基础神经网络所用的激活函数。上两式表示输入的样本x与该基础神经网络第一层的权重相乘，再通过激化函数后输出作为第二层的输入。当输入最终传递到最后一层后，通过softmax(·)函数得到目标函数值。In the above formula,

Represents the objective function of the basic neural network Ni; parameters ^l represents the parameter set of the _lth layer of the basic neural network; h ^l represents the lth hidden layer of the basic neural network; L represents the total number of layers of the basic neural network; x represents The training data input to the basic neural network; σ(·) represents the activation function used by the basic neural network. The above two formulas indicate that the input sample x is multiplied by the weight of the first layer of the basic neural network, and then the output is used as the input of the second layer after passing through the excitation function. When the input is finally passed to the last layer, the objective function value is obtained through the softmax( ) function.

的性能评判指标；如，设定性能阈值F1为90％，以是否达到性能阈值F1来判断网络的检测能力是否合格，检测能力不达标的网络则丢弃。在本发明的最优具体实施例中，设定性能阈值F1为95％。性能阈值F1可用以下公式进行计算：Under normal circumstances, the most common performance indicators of the basic neural network are the detection accuracy and recall rate in the target task. The precision rate refers to how many of the identified results are correct; the recall rate refers to how many correct results are there. been identified. However, in the case of uneven sample distribution, the two indicators may contradict each other. In the present invention, in order to comprehensively evaluate the detection performance, the performance threshold F1 related to the accuracy rate and the recall rate is used as the neural network cluster

For example, set the performance threshold F1 to 90%, and judge whether the detection capability of the network is qualified based on whether the performance threshold F1 is reached, and the network whose detection capability does not meet the standard is discarded. In the most preferred embodiment of the present invention, the performance threshold F1 is set to be 95%. The performance threshold F1 can be calculated using the following formula:

中构建多个基础神经网络形成神经网络簇以供迁移实验选择。Among them, F1 represents the performance threshold; Pr represents the accuracy of the neural network in the target task detection; Re represents the recall rate of the neural network in the target task detection. TP means predicting the positive class as the number of positive classes; FP means predicting the negative class as the number of false positives; FN means predicting the positive class as the number of negative classes. Since different basic neural network structures have different effects of migration, it can be used in the source domain.

Multiple basic neural networks are constructed in the neural network cluster to form a neural network cluster for selection in migration experiments.

将所述神经网络簇

在目标域

进行可迁移性对比实验并计算可迁移性能值。Step2: Select the sample data space of the small sample DDoS attack as the target domain

the neural network cluster

in the target domain

Conduct transferability comparison experiments and calculate transferability performance values.

上训练好的神经网络簇

的各个基础神经网络N_i各自迁移到目标域

具体的，所述迁移可理解为将训练好的基础神经网络N_i的权重值赋给新的网络。例如，如果利用基础神经网络N_i，i∈[1，m](源域

上训练好的网络)进行迁移，就是将基础神经网络N_i前L-1层所包含的参数固定，只让最后的输出层进行更新。本发明的可迁移性对比实验中，需固定基础神经网络N_i，i∈[1，m]除输出层以外的所有参数，即

为可量化的比较不同基础神经网络在目标域

的迁移效果，我们随后计算每个基础神经网络N_i的可迁移性能值

因为可迁移性能值能够综合的表示某一网络在目标域

的迁移效果；且可迁移性能值越大，表示迁移效果越好。基础神经网络N_i的可迁移性能值

利用下式计算：The transferability comparison experiment is: will be in the source domain

trained neural network cluster

Each basic neural network N _i of , each migrates to the target domain

Specifically, the migration can be understood as _assigning the weight value of the trained basic neural network Ni to the new network. For example, if using the base neural network N _i , i ∈ [1, m] (source domain

The trained network) for migration is to fix the parameters contained in the first L- ₁ layer of the basic neural network Ni, and only let the last output layer be updated. In the transferability comparison experiment of the present invention, all parameters of the basic neural network N _i , i∈[1, m] except the output layer need to be fixed, namely

For quantifiable comparison of different underlying neural networks in the target domain

The transfer effect of , we then calculate the transferable performance value of each _underlying neural network Ni

Because the transferable performance value can comprehensively represent a network in the target domain

The migration effect is higher; and the larger the migration performance value, the better the migration effect. The transferable performance value of the underlying neural network _Ni

Calculate using the following formula:

表示基础神经网络N_i迁移到目标域

中的可迁移性能值。F1_j表示j次epoch训练结束后的性能值，w_j表示给每次性能值赋的一个权重。Pr_j表示j次epoch训练结束后的准确率，Re_j表示j次epoch训练结束后的召回率，E代表最后一次epoch训练。in

represents the transfer of the base neural network _Ni to the target domain

The transferable performance value in . F1 _j represents the performance value after j times of epoch training, and w _j represents a weight assigned to each performance value. Pr _j represents the accuracy after j epoch training, Re _j represents the recall rate after j epoch training, and E represents the last epoch training.

上选择可迁移性能值

最大的网络N_max，将网络N_max在目标域

进行迁移，得到迁移网络N_T。Step3: in the target domain

select the migrateable performance value on

the largest network N _max , place the network N _max in the target domain

The migration is performed to obtain the migration network _NT .

中选出目标域

上可迁移性能值最好的网络N_max，本发明设计一种定量计算可迁移性能的参数

即可迁移性能值，最终只需选择可迁移性能值

最大的网络N_max，就能筛选出目标域

上性能最好的网络。After the transferability comparison experiment, for the neural network cluster

target domain

The network N _max with the best transferable performance value is designed in the present invention, and a parameter for quantitative calculation of transferable performance is designed.

performance values can be migrated, and finally only the migrated performance values need to be selected

The largest network N _max can filter out the target domain

on the best performing network.

进行迁移实验，得到迁移网络N_T，迁移公式为：Then, place the network N _max in the target domain

Carry out the migration experiment to obtain the migration network _NT , and the migration formula is:

表示网络N_max的第k层参数，

表示网络N_T的第k层参数。in

represents the k-th layer parameter of the network N _max ,

represents the k-th layer parameter of the network _NT .

上训练迁移网络N_T。Step4: Use fine-tuning technology to fine-tune the parameters of the transfer network _NT , that is, update the first layer parameters of the transfer network _NT with a small learning rate; then in the target domain

Train the transfer network _NT on it.

Using the fine-tuning technology to fine-tune the parameters of the migration network _NT , the formula is expressed as:

表示网络N_T第k层的参数集；lr′表示fine-tuning中设定的学习率，本发明中该学习率通常比正常的学习率低1到2个数量级，正常的学习率通常设定为0.01。这样不仅保留了迁移后的相关知识，也使得被迁移网络N_T更加适应目标域

in

Represents the parameter set of the k-th layer of the network _NT ; lr' represents the learning rate set in fine-tuning. In the present invention, the learning rate is usually 1 to 2 orders of magnitude lower than the normal learning rate, and the normal learning rate is usually set is 0.01. This not only retains the relevant knowledge after migration, but also makes the migrated network _NT more adaptable to the target domain

上训练迁移网络N_T，得到迁移网络N_T第一次和最后一次训练的性能值

具体公式表示为：in the target domain

Train the transfer network _NT on the network, and get the performance values of the first and last training of the transfer network _NT

The specific formula is expressed as:

表示迁移网络N_T在第i次训练时的性能值，E代表最后一次训练；

表示迁移网络N_T在第i次训练时的准确率；

表示迁移网络N_T在第i次训练时的召回率。in

Represents the performance value of the transfer network _NT at the i-th training, and E represents the last training;

Indicates the accuracy of the transfer network _NT during the i-th training;

Represents the recall rate of the transfer network _NT at the ith training.

You can check the startup speed of the transfer network _NT by comparing the performance values after the first training, and check the final performance of the transfer network _NT by comparing the performance values after the last training.

Step 5: Use the trained migration network _NT to perform new small-sample DDoS attack detection, and obtain the detection performance value.

In the small sample DDoS detection, the performance value of each time is compared using the pure deep learning technology and the deep transfer technology combined with transfer learning. We can see that deep transfer learning can improve the initial performance of the network, and the final detection performance is better, which is verified in the results of the final transfer experiment of the present invention.

和目标域

都是对DDoS攻击检测进行二分类，不需要微调迁移网络的网络结构，所以本发明采用fine-tuning技术中的微调迁移网络的参数进行迁移。Please refer to Figure 2. Figure 2 is a good description of the four ways of transferring from source domain to target domain in deep transfer learning, including: freezing network parameters, fine-tuning network parameters, initializing network parameters and fine-tuning network structure. At the same time, two application methods of fine-tuning technology are also described: one is to fine-tune the parameters of the transferred network; the other is to fine-tune the structure of the transferred network. In transfer learning, if the neural network trained in the old task (source domain) is applied to the new task (target domain) without changing the parameters trained on the network neurons, the network is frozen. parameters, such as the black dotted part of the transfer network in Figure 2. If a small learning rate is used to enable the parameters on the neurons to be updated for new tasks, the network parameters are fine-tuned (this is a type of fine-tuning technique), such as the gray part in the transfer network in Figure 2. If the network neuron parameters are completely randomly initialized, and the parameters trained by the network in the old task are not used, the network parameters are initialized, such as the white dots in the migration network in Figure 2. If the final output of the new task is different from the old task, for example, the old task is a three-class problem and the new task is a four-class problem, you need to fine-tune the network structure (this is another fine-tuning technique) to Completed, for example, the dotted part of the migration network in Figure 2. source domain in the present invention

and target domain

DDoS attack detection is both classified into two, and it is not necessary to fine-tune the network structure of the migration network, so the present invention uses the fine-tuning technology to fine-tune the parameters of the migration network for migration.

Please refer to Figure 3 and Figure 4. Figure 3 is a schematic diagram of the migration performance comparison of the neural network cluster calculated in the simulation experiment under four target domains; Figure 4 is the migration network calculated in the simulation experiment combined with fine-tuning technology. DDoS attack detection performance diagram.

中，数据集为SYN型DDoS攻击；目标域

中，数据集为LDAP型DDoS攻击。The simulation experiment system is configured as follows: the operating system is Ubuntu 16.0 464-bit with 64GB memory, the software framework is Pytorch, and the GPU accelerator is Nvidia RTX2080Ti. The basic parameters of the simulation experiment are set as follows: the training batch size is 500, and the loss function is the cross-entropy loss function. The optimization function uses the stochastic gradient descent optimizer built into Pytorch. The training learning rate is set to 0.01, and the learning rate during fine-tuning is set to 0.001. 80% of the data in the dataset are training datasets and the rest are validation datasets. source domain

, the dataset is a SYN-type DDoS attack; the target domain

, the dataset is an LDAP-type DDoS attack.

Please refer to Figure 3 again. Figure 3 shows that after the 16 basic neural networks are trained in the source domain SYN DDoS attack detection, the respective first N-1 layers (except the output layer) of the 16 basic neural networks are migrated to Detection performance in DDoS attacks with small samples of target domains. In this experiment, LDAP-type DDoS attack was selected as the target domain data, because this type of DDoS attack appeared late, and the amount of labeled sample data was small, which met the requirements of small samples. In Figure 3, the abscissa is the number of epochs trained by the basic neural network, and the ordinate is the performance score of the network after the current epoch training. In Figure 3, the training performance of 16 basic neural networks in the target domain is shown. H5, H6, H7 and H8 indicate that the total number of neural network layers is 5, 6, 7 and 8 layers, respectively. W100, W200, W400 and W800 represent four kinds of neural networks with different numbers of neurons in each layer, and the number of neurons in each layer is 100, 200, 400 and 800 respectively. From Figure 3, we can see that in the target domain of LDAP-type DDoS attack, the number of network layers is 5 and the number of neurons in each layer of the network is 800, which has the best transferability; the highest, and its final detection performance value is also the best.

Please refer to Figure 4 again, which shows the training effect of migrating different layers of W800H5 network with or without fine-tuning after the sample data of LDAP-type DDoS attack is reduced by 10 times. The ordinate is the performance value of DDoS attack detection, the abscissa x represents the first layer of the W800H5 network with the best migration mobility, and each abscissa point (except 0 point) in the figure has 10 circles. point and 10 triangle points. The 10 circle points represent the performance values of 10 epoch trainings after the first l layer of the W800H5 network without fine-tuning, and the 10 triangle points are the case with fine-tuning technology added. To avoid overlapping, we offset the circle and triangle points to the left and right respectively. Comparing the performance curves represented by W800H5 in Figure 4 and Figure 3, we can see that when the number of training samples for DDoS attacks is reduced, the detection performance of all networks decreases to varying degrees. This is consistent with the fact that the detection accuracy of DDoS with few attack samples is low in reality. The final detection performance drops from 96.8% to 75% for the network where all the parameters of all layers are randomly initialized. It can be seen from the triangular points in Figure 4 that by combining the fine-tuning technology, the network performance on the target domain is better than that of the migration network without fine-tuning. Moreover, when the number of migration layers l is 3, the highest detection performance is 85.8%, and the performance when the number of migration layers is 4 is 81.4% higher than that before fine-tuning. Therefore, the present invention can better improve the detection performance deterioration caused by insufficient new attack samples by using the deep migration network method combined with the fine-tuning technology.

Example devices implementing embodiments of the present invention may include one or more central processing units (CPUs) that may be loaded into random access memory (RAM) according to computer program instructions stored in read only memory (ROM) or from storage units computer program instructions in to perform various appropriate actions and processes. In the RAM, various programs and data required for the operation of the device can also be stored. The CPU, ROM, and RAM are connected to each other through a bus. Input/output (I/O) interfaces are also connected to the bus.

Various components in the device are connected to the I/O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as magnetic disks, optical disks, etc.; and communication units, For example, network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information/data with other devices through a computer network such as the Internet and/or various telecommunication networks.

The methods described above may be performed, for example, by a processing unit of a device. For example, in some embodiments, a method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and/or installed on the device via the ROM and/or the communication unit. One or more acts of the methods described above may be performed when a computer program is loaded into RAM and executed by the CPU.

However, those skilled in the art will understand that the execution of the steps of the method is not limited to the order shown in the figures and described above, but may be performed in any other reasonable order, or may be performed in parallel. In addition, the device does not necessarily include all the above-mentioned components, it may only include some of the components necessary to perform the functions described in the present invention, and the connection manners of these components may also be in various forms. For example, in the case where the device is a portable device such as a mobile phone, it may have a different structure than the above.

Using the scheme of the present invention, the DDoS attack detection network with sufficient labeled samples is applied to the detection of small-sample DDoS attacks, and the fine-tuning technology is used to fine-tune the parameters, so that the migration network can better utilize the knowledge of the source domain to detect new small-sample attacks. test. Compared with the conventional method for detecting DDoS attacks by using deep learning technology, experiments show that the present invention can well improve the performance deterioration problem caused by less labeled samples in the detection of new DDoS attacks. In addition, the present invention directly detects the network message, the detection granularity is fine, and the identification accuracy is high.

The present invention may be a method, apparatus, system and/or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for carrying out various aspects of the present invention.

A computer-readable storage medium may be a tangible device that can hold and store instructions for use by the instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of computer readable storage media include: portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM) or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically coded devices, such as printers with instructions stored thereon Hole cards or raised structures in grooves, and any suitable combination of the above. Computer-readable storage media, as used herein, are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (eg, light pulses through fiber optic cables), or through electrical wires transmitted electrical signals.

The computer readable program instructions described herein may be downloaded to various computing/processing devices from a computer readable storage medium, or to an external computer or external storage device over a network such as the Internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer-readable program instructions from a network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing/processing device .

The computer program instructions for carrying out the operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or instructions in one or more programming languages. Source or object code written in any combination, including object-oriented programming languages - such as Smalltalk, C++, etc., and conventional procedural programming languages - such as the "C" language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server implement. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network - including a local area network (LAN) or a wide area network (WAN) - or may be connected to an external computer (eg using an Internet service provider via the Internet connect). In some embodiments, custom electronic circuits, such as programmable logic circuits, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), can be personalized by utilizing state information of computer readable program instructions. Computer readable program instructions are executed to implement various aspects of the present invention.

These computer readable program instructions may be provided to a processing unit of a general purpose computer, special purpose computer or other programmable data processing apparatus to produce a machine that causes the instructions when executed by the processing unit of the computer or other programmable data processing apparatus , resulting in means for implementing the functions/acts specified in one or more blocks of the flowchart and/or block diagrams. These computer readable program instructions can also be stored in a computer readable storage medium, these instructions cause a computer, programmable data processing apparatus and/or other equipment to operate in a specific manner, so that the computer readable medium on which the instructions are stored includes An article of manufacture comprising instructions for implementing various aspects of the functions/acts specified in one or more blocks of the flowchart and/or block diagrams.

Computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other equipment to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other equipment to produce a computer-implemented process , thereby causing instructions executing on a computer, other programmable data processing apparatus, or other device to implement the functions/acts specified in one or more blocks of the flowcharts and/or block diagrams.

The above-mentioned embodiments of the present invention do not constitute a limitation on the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included in the protection scope of the claims of the present invention. Inside.

Claims (9)

1. A small sample DDoS attack detection method based on deep migration learning is characterized in that: comprises the following steps:

selecting network message of DDoS attack with sufficient labeling samples as source domain

In the source domain

Training m characteristic standard-reaching basic neural networks to form neural network cluster

Selecting a sample data space of small sample DDoS attack as a targetBidding field

Clustering the neural network

In the target domain

Carrying out mobility comparison experiments, and then calculating each basic neural network N_i，i∈[1，m]A migratability value of m.gtoreq.2;

comparing the migratable performance values, and selecting the network N with the largest migratable performance value_maxAnd in the target domain

Carrying out migration experiment to obtain a migration network N_T；

Migration network N using fine-tuning technique_TCarrying out parameter fine adjustment;

in the target domain

Training the migration network N_T；

Using said migration network N_TAnd carrying out new small sample DDoS attack detection to obtain a detected performance value.

2. The small-sample DDoS attack detection method based on deep migration learning of claim 1, characterized in that: the judgment standard for the performance of the basic neural network reaching the standard is whether a related performance threshold value is reached, and the performance threshold value is set to be 95%; the calculation formula of the performance threshold is as follows:

wherein F1 represents a performance threshold; pr denotes the basic neural network N_iThe accuracy of the target task detection; re represents the basic neural network N_iRecall rate detected at the target task.

3. The small-sample DDoS attack detection method based on deep migration learning of claim 2, characterized in that: basic neural network N_i，i∈[1，m]M is more than or equal to 2 in the target domain

The migration performance value calculation formula of (a) is as follows:

wherein

Representing a basic neural network N_iMigrating to a target Domain

A migratability performance value of; f1_jDenotes the F1 Performance value, w, obtained after j epoch training_jRepresenting the weight value assigned to the performance value obtained by each training; pr (Pr) of_jIndicates the accuracy, Re, after j epoch training sessions_jRepresenting the recall rate after j epoch training is finished; e represents the last epoch training.

4. The small-sample DDoS attack detection method based on deep migration learning of claim 3, characterized in that: the specific operation of the migration experiment is as follows:

the network N_maxAssigning the parameters contained in the first layer to the migration network N_TThe first layer of (1), which

Wherein

Representing the migration network N_TThe total number of layers of (a) and (b),

representation network N_maxThe total number of layers.

5. The small-sample DDoS attack detection method based on deep migration learning of claim 4, characterized in that: migration network N using fine-tuning technique_TThe parameter fine tuning is specifically as follows: fine-tuning the migration network N with a learning rate 1-2 orders of magnitude lower than the normal learning rate_TThe first layer parameters and the other layer parameters are updated according to the normal learning rate, and the normal learning rate is set to be 0.01.

6. The small-sample DDoS attack detection method based on deep migration learning of claim 5, characterized in that: selecting network message of SYN type DDoS attack as source domain

LDAP type DDoS attack sample data space as target domain

The number of the total layers of the neural network of the basic neural network with the best application effect is 5, the number of the neurons of each layer of the neural network is 800, and the number l of the migration layers is 3.

7. The small-sample DDoS attack detection method based on deep migration learning of claim 5, characterized in that: the basic neural network N_iThe spirit ofThe total number of layers of the neural network is 5-8, the number of neurons of each layer of neural network is 100-800, and the migration depth is 1-4.

8. A small sample DDoS attack detection device is characterized in that: the method comprises the following steps:

one or more processors;

a memory for storing one or more programs;

when executed by the one or more processors, cause the one or more processors to implement the small sample DDoS attack detection method of any one of claims 1-7.

9. A computer storage medium having computer program instructions stored thereon which, when executed by a processor, implement the small-sample DDoS attack detection method of any one of claims 1-7.

Images