CN112242973A - DDoS attack detection method, device, computing equipment and computer storage medium - Google Patents
DDoS attack detection method, device, computing equipment and computer storage medium Download PDFInfo
- Publication number
- CN112242973A CN112242973A CN201910642020.1A CN201910642020A CN112242973A CN 112242973 A CN112242973 A CN 112242973A CN 201910642020 A CN201910642020 A CN 201910642020A CN 112242973 A CN112242973 A CN 112242973A
- Authority
- CN
- China
- Prior art keywords
- tcp
- header information
- output
- ddos attack
- gate
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 42
- 239000013598 vector Substances 0.000 claims abstract description 60
- 230000015654 memory Effects 0.000 claims abstract description 46
- 238000000034 method Methods 0.000 claims abstract description 31
- 230000006870 function Effects 0.000 claims description 23
- 239000011159 matrix material Substances 0.000 claims description 21
- 238000009826 distribution Methods 0.000 claims description 19
- 238000004891 communication Methods 0.000 claims description 16
- 230000004913 activation Effects 0.000 claims description 14
- 230000005284 excitation Effects 0.000 claims description 9
- 238000012163 sequencing technique Methods 0.000 claims description 7
- 238000000605 extraction Methods 0.000 claims description 6
- 238000005516 engineering process Methods 0.000 abstract description 8
- 238000013135 deep learning Methods 0.000 abstract description 7
- 230000006403 short-term memory Effects 0.000 description 13
- 230000007787 long-term memory Effects 0.000 description 12
- 238000010586 diagram Methods 0.000 description 8
- 238000013459 approach Methods 0.000 description 6
- 239000000284 extract Substances 0.000 description 6
- 238000004590 computer program Methods 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 230000008569 process Effects 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 230000006399 behavior Effects 0.000 description 2
- 230000007547 defect Effects 0.000 description 2
- 230000000306 recurrent effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 125000004122 cyclic group Chemical group 0.000 description 1
- 230000001934 delay Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000012886 linear function Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000003062 neural network model Methods 0.000 description 1
- 238000011022 operating instruction Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the invention relates to the technical field of network security, and discloses a DDoS attack detection method, a device, a computing device and a computer storage medium, wherein the method comprises the following steps: extracting header information of a message from network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs. Through the mode, the embodiment of the invention models the historical flow through the deep learning technology, and simultaneously comprises the macroscopic level data and the microscopic level data, thereby reducing the occurrence of missing report and false report, and improving the accuracy and stability of DDoS detection.
Description
Technical Field
The embodiment of the invention relates to the technical field of network security, in particular to a DDoS attack detection method, a DDoS attack detection device, a computing device and a computer storage medium.
Background
A Distributed Denial of Service (DDoS) attack is a form of attack in which a computer or network cannot provide normal services by sending a large number of data packets. The method can exhaust network resources or system resources of an attacked object in a short time, so that legal user requests cannot respond, and huge harm is brought to the attacked object and even the network. The existing DDoS attack detection method is divided into three categories, one category is a method based on information entropy, and the other category is a detection method based on flow characteristics, artificial characteristics are extracted from network flow, normal flow is modeled, and a threshold value is set. And comparing the detected flow characteristics with the normal flow characteristics, and judging that the change exceeds the threshold range to be attack flow.
The information entropy-based method is used for counting the traffic distribution in each time window, and specifically, the probability distributions of the accessed target Internet Protocol Address (IP Address), the target port and the like can be counted, so that the information entropy of the accessed target IP and the target port is obtained. Since this method assumes that the destination IP distribution of access within each time slice is uniform, the information entropy should be small. When a DDoS attack occurs, since a large number of accesses are usually made to a specific IP, the accessed IPs in certain time slices are relatively concentrated, and thus the information entropy of the IP distribution is increased.
The detection method based on the flow characteristics is to extract artificial characteristics from normal flow, establish characteristic base lines of the normal flow and set a threshold value. An attack is detected when the access traffic characteristics exceed the baseline by a certain threshold. The flow characteristics are created artificially, and can be various artificial statistics such as the total flow size in a period of time, the number of TCP packets and the like. The threshold value is set depending on personal experience, for example, a certain percentage of the normal level is exceeded before a human attack occurs.
In the process of implementing the embodiment of the present invention, the inventors found that: the disadvantage of attack detection by information entropy is that false alarm or false alarm can be caused when the network environment does not meet the assumption. For example, in a normal situation, the visited destination IP itself is relatively centralized, for example, when a certain service suddenly populates in a large scale, the system may cause misjudgment. Or the attacked objects are scattered when the DDoS occurs, so that the total information entropy is still very low even if the attack occurs, and the report is missed. The main disadvantage of the detection method based on the flow characteristics and the manual threshold is that the method is dependent on human intervention and experience and is formed by a large number of rules in nature. Due to the limitation of artificial features, only shallow features can be extracted, and complex and hidden rules cannot be expressed, so that complex attack behaviors or novel attack mode restraints cannot be treated. In addition, due to the introduction of manual threshold, how to determine the threshold is also a problem which is difficult to solve, and how to accept or reject false alarm and missed alarm is directly influenced.
Disclosure of Invention
In view of the foregoing, embodiments of the present invention provide a DDoS attack detection method, apparatus, computing device and computer storage medium, which overcome the foregoing problems or at least partially solve the foregoing problems.
According to an aspect of the embodiments of the present invention, a DDoS attack detection method is provided, where the method includes: extracting header information of a message from network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs.
In an optional manner, the extracting header information of the packet from the network traffic includes: acquiring network flow from a mirror image at a network inlet in a bypass mode; and extracting header information of the message from the network flow, wherein the header information comprises IP, TCP, UDP and ICMP messages.
In an optional manner, the extracting a plurality of statistical features according to the header information of the packet at every preset time unit, and abstracting the statistical features into a serialized numerical feature vector includes: performing abstract statistics on a plurality of statistical characteristics every other preset time unit according to header information of the message; each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
In an alternative approach, the statistical features include: the method comprises the steps of TCP packet number, UDP packet number, ICMP packet number, TCP packet proportion, UDP packet proportion, ICMP packet proportion, destination ip count, destination port count, destination ip distribution information entropy, destination port distribution information entropy, TCP SYN packet proportion, TCP ACK packet proportion, TCP RST packet proportion, TCP newly-built link number, TCP closed link number, TCP holding link number, TCP connection duration and UDP packet size.
In an optional manner, the applying a long-short term memory network model to perform modeling classification output on the feature vectors, and determining whether a DDoS attack occurs includes: inputting the feature vectors in N continuous time units into the long-short term memory network model, wherein N is a positive integer; modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model; carrying out weighted nonlinear excitation output on the external state through a full connection layer; and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
In an alternative mode, the long-term and short-term memory network model comprises a forgetting gate, an input gate, an output gate, a state unit and an output result, and the long-term and short-term memory network model is obtained by calculating according to the following formulas:
ft＝σ(Wfxt+Ufht-1+bf)
it＝σ(Wixt+Uiht-1+bi)
ot＝σ(Woxt+Uoht-1+bo)
ht＝ot⊙tanh(ct)
wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs a weight matrix of the input gate, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs the weight of the output gateMatrix, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
In an optional manner, the method further comprises: when DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times; and extracting source IPs corresponding to the first k target IPs as DDoS sources.
According to another aspect of the embodiments of the present invention, there is provided a DDoS attack detection apparatus, including: a header information obtaining unit, configured to extract header information of a packet for network traffic; the characteristic extraction unit is used for extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the modeling unit is used for performing modeling classification output on the characteristic vectors by applying a long-short term memory network model and judging whether DDoS attack occurs or not.
According to another aspect of embodiments of the present invention, there is provided a computing device including: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;
the memory is used for storing at least one executable instruction, and the executable instruction enables the processor to execute the steps of the DDoS attack detection method.
According to another aspect of the embodiments of the present invention, a computer storage medium is provided, where at least one executable instruction is stored in the storage medium, and the executable instruction causes the processor to execute the steps of the DDoS attack detection method.
The embodiment of the invention extracts the header information of the message by the network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the long-short term memory network model is applied to model and classify the characteristic vectors to output, whether DDoS attack occurs is judged, historical flow is modeled through a deep learning technology, macroscopic level data and microscopic level data are contained, the occurrence of missing report and false report is reduced, and the DDoS detection accuracy and stability are improved.
The foregoing description is only an overview of the technical solutions of the embodiments of the present invention, and the embodiments of the present invention can be implemented according to the content of the description in order to make the technical means of the embodiments of the present invention more clearly understood, and the detailed description of the present invention is provided below in order to make the foregoing and other objects, features, and advantages of the embodiments of the present invention more clearly understandable.
Drawings
Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to refer to like parts throughout the drawings. In the drawings:
fig. 1 shows a schematic flow diagram of a DDoS attack detection method provided by an embodiment of the present invention;
FIG. 2 shows an LSTM model diagram of a DDoS attack detection method provided by the embodiment of the present invention;
fig. 3 shows a schematic diagram of unit computation of an LSTM model of a DDoS attack detection method provided by an embodiment of the present invention;
fig. 4 shows a schematic structural diagram of a DDoS attack detection apparatus provided in an embodiment of the present invention;
fig. 5 is a schematic structural diagram of a computing device provided by an embodiment of the present invention.
Detailed Description
Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.
Fig. 1 shows a flow diagram of a DDoS attack detection method provided by an embodiment of the present invention. As shown in fig. 1, the DDoS attack detection method includes:
step S11: and extracting the header information of the message from the network flow.
In order to avoid affecting normal service, DDoS attack detection is carried out in a bypass mode, and incoming network flow is directly mirrored to analysis equipment from a network entrance. In step S11, network traffic is obtained from the mirror image at the network entry in a bypass manner; extracting header information of the packet from the network traffic, including header information of an IP, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) packet.
And obtaining the source IP, the destination IP, the source port, the destination port, the protocol Type, the data size, the Time To Live (TTL), the TCP flag and the TCP state of the flow according To the header information of each message, wherein the information comprises various information such as newly-built connection, connection maintenance, connection closing, ICMP Type and the like.
Step S12: and extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector.
Since various information extracted from the flow data cannot be directly used for modeling, the original data needs to be preliminarily processed, i.e., preprocessed, to extract necessary features. Specifically, a plurality of statistical characteristics are abstractly counted every other preset time unit according to header information of the message; each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
In the embodiment of the present invention, the original traffic data is divided by using time units of the same time interval, for example, every 5 seconds as a time unit, and the original traffic data is divided into many small blocks. The statistical features are abstracted for one source IP. Wherein, the statistical characteristics include: the Number of TCP packets, the Number of UDP packets, the Number of ICMP packets, the TCP packet ratio, the UDP packet ratio, the ICMP packet ratio, the destination IP count, the destination port count, the destination IP distribution information entropy, the destination port distribution information entropy, the proportion of TCP synchronization Sequence Number (SYN) packets, the proportion of TCP Acknowledgement (ACK) packets, the proportion of TCP Reset connection (RST) packets, the TCP new link Number, the TCP close link Number, the TCP hold link Number, the TCP connection duration, and the UDP packet size. The statistical characteristics comprise macroscopic characteristics such as protocol types, protocol subtypes and request response duration, microscopic characteristics such as protocol marks and the like, and macroscopic states and microscopic details are considered.
Each time unit is a sample, such as a source IP, and the communication behavior within a time unit, such as 5 minutes, a plurality of statistical features of each sample d (i) e { d0, d1, … …, dn } are abstracted into a feature vector of a serialized numerical type [ [ d11, d12, … d1m ], [ d21, d22, … …, d2m ], … …, [ dn1, dn2, … …, dnm ] ] to form a feature vector of size n × m, wherein n is the length of the time series and m is the number of features. For example, statistics for the first 10s every 10 seconds include: the number of TCP packets, the proportion of TCP packets, the distribution information entropy of source IP, destination IP, source port and destination port, the proportion of SYN packets, the proportion of ACK packets, etc. The statistical indexes in the first N continuous time units are preprocessed and then input into a Long Short-Term Memory network (LSTM) model.
Step S13: and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs.
Aiming at the statistical characteristics of the flow data of the time sequence, the embodiment of the invention adopts an LSTM recurrent neural network model to model the time sequence, so as to solve the long-term and short-term dependence problem in the time sequence problem. The LSTM introduces a new internal state (internal state) c by improving a Recurrent Neural Network (RNN) unit (cell) structuretSpecially for linear cyclic information transfer, while using non-linear excitation function to output information to the external state h of hidden layert. The LSTM model can solve and predict important events with very long intervals and delays in time sequence and can capture the front of trafficLater correlation, and extraction of deep features.
In step S13, inputting the feature vectors in N consecutive time units into the long-short term memory network model, where N is a positive integer; modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model; carrying out weighted nonlinear excitation output on the external state through a full connection layer; and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
The LSTM model is specifically seen in fig. 2 and 3, including an input layer, a hidden layer, a fully connected layer, and a Softmax classifier layer. The long and short term memory network model comprises a forgetting gate, an input gate, an output gate, a state unit and an output result, xtFor feature vector input at the t-th moment, wherein the gate f is forgottentControlling the internal state c of the last momentt-1How much information needs to be forgotten; input door itControlling candidate states at the current time
How much information needs to be saved; output gate otControlling the internal state c at the present momenttHow much information needs to be output to the external state ht. Specifically, the method is obtained by the following formula:
forget the door: f. oft＝σ(Wfxt+Ufht-1+bf)
An input gate: i.e. it＝σ(Wixt+Uiht-1+bi)
An output gate: ot＝σ(Woxt+Uoht-1+bo)
Outputting an external state ht：ht＝ot⊙tanh(ct)
Wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs a weight matrix of the input gate, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs a weight matrix of output gates, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
The output external state is weighted nonlinear excitation output through a full connection layer, and the calculation formula of the full connection layer is as follows: ft＝σ(wht+Fb) Where w is the weight matrix of the full connection layer, FbIs the bias term for the fully connected layer.
And the Softmax classifier layer outputs results, maximizes the output probability of each output, judges malicious flow and normal flow and further judges whether the DDoS attack occurs. If the traffic is malicious, DDoS attack is generated; if the flow is normal, the DDoS attack does not occur.
And predicting whether the current flow is abnormal or not by the LSTM model according to the flow statistical characteristics of the time units of a sequence, and extracting specific DDoS flow from the current time unit when the current flow is abnormal. Specifically, the LSTM model is classified, the output result is whether DDoS occurs, if DDoS attack does not occur, the initial state is returned, the LSTM model is continuously applied to model subsequent flow data, and otherwise, the detection result is output. When DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times; and extracting source IPs corresponding to the first k target IPs as DDoS sources, wherein k is a positive integer.
The embodiment of the invention starts from data completely, gives consideration to the fact that macroscopic level and microscopic level data depend on artificial intelligence technology and uses the LSTM model to carry out time sequence modeling on the flow, makes up the assumption that the IP of DDoS attack is randomly distributed in the existing method, reduces the occurrence of missing report and false report, and simultaneously makes up the defect of insufficient detection capability caused by simple rules and artificial threshold given by the existing baseline detection method. For a traditional machine learning mode, the defect that certain special DDoS is missed due to the fact that only microscopic data are modeled is overcome, and the DDoS detection accuracy and stability are improved.
The embodiment of the invention extracts the header information of the message by the network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the long-short term memory network model is applied to model and classify the characteristic vectors to output, whether DDoS attack occurs is judged, historical flow is modeled through a deep learning technology, macroscopic level data and microscopic level data are contained, the occurrence of missing report and false report is reduced, and the DDoS detection accuracy and stability are improved.
Fig. 4 shows a schematic structural diagram of a DDoS attack detection apparatus according to an embodiment of the present invention. As shown in fig. 2, the DDoS attack detection apparatus includes: a header information acquisition unit 401, a feature extraction unit 402, and a modeling unit 403. Wherein:
the header information obtaining unit 401 is configured to extract header information of a packet for network traffic; the feature extraction unit 402 is configured to extract a plurality of statistical features according to header information of the packet every preset time unit, and abstract the statistical features into a serialized numerical feature vector; the attack determination unit 403 is configured to apply a long-term and short-term memory network model to perform modeling classification output on the feature vectors, and determine whether a DDoS attack occurs.
In an optional manner, the header information obtaining unit 401 is further configured to: acquiring network flow from a mirror image at a network inlet in a bypass mode; and extracting header information of the message from the network flow, wherein the header information comprises IP, TCP, UDP and ICMP messages.
In an alternative manner, the feature extraction unit 402 is configured to: performing abstract statistics on a plurality of statistical characteristics every other preset time unit according to header information of the message; each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
In an alternative approach, the statistical features include: the method comprises the steps of TCP packet number, UDP packet number, ICMP packet number, TCP packet proportion, UDP packet proportion, ICMP packet proportion, destination ip count, destination port count, destination ip distribution information entropy, destination port distribution information entropy, TCP SYN packet proportion, TCP ACK packet proportion, TCP RST packet proportion, TCP newly-built link number, TCP closed link number, TCP holding link number, TCP connection duration and UDP packet size.
In an alternative approach, the modeling unit 403 is configured to: inputting the feature vectors in N continuous time units into the long-short term memory network model, wherein N is a positive integer; modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model; carrying out weighted nonlinear excitation output on the external state through a full connection layer; and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
In an alternative mode, the long-term and short-term memory network model comprises a forgetting gate, an input gate, an output gate, a state unit and an output result, and the long-term and short-term memory network model is obtained by calculating according to the following formulas:
ft＝σ(Wfxt+Ufht-1+bf)
it＝σ(Wixt+Uiht-1+bi)
ot＝σ(Woxt+Uoht-1+bo)
ht＝ot⊙tanh(ct)
wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs a weight matrix of the input gate, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs a weight matrix of output gates, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
In an alternative approach, the modeling unit 403 is configured to: when DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times; and extracting source IPs corresponding to the first k target IPs as DDoS sources.
The embodiment of the invention extracts the header information of the message by the network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the long-short term memory network model is applied to model and classify the characteristic vectors to output, whether DDoS attack occurs is judged, historical flow is modeled through a deep learning technology, macroscopic level data and microscopic level data are contained, the occurrence of missing report and false report is reduced, and the DDoS detection accuracy and stability are improved.
The embodiment of the invention provides a nonvolatile computer storage medium, wherein at least one executable instruction is stored in the computer storage medium, and the computer executable instruction can execute the DDoS attack detection method in any method embodiment.
The executable instructions may be specifically configured to cause the processor to:
extracting header information of a message from network flow;
extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector;
and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs.
In an alternative, the executable instructions cause the processor to:
acquiring network flow from a mirror image at a network inlet in a bypass mode;
and extracting header information of the message from the network flow, wherein the header information comprises IP, TCP, UDP and ICMP messages.
In an alternative, the executable instructions cause the processor to:
performing abstract statistics on a plurality of statistical characteristics every other preset time unit according to header information of the message;
each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
In an alternative approach, the statistical features include: the method comprises the steps of TCP packet number, UDP packet number, ICMP packet number, TCP packet proportion, UDP packet proportion, ICMP packet proportion, destination ip count, destination port count, destination ip distribution information entropy, destination port distribution information entropy, TCP SYN packet proportion, TCP ACK packet proportion, TCP RST packet proportion, TCP newly-built link number, TCP closed link number, TCP holding link number, TCP connection duration and UDP packet size.
In an alternative, the executable instructions cause the processor to:
inputting the feature vectors in N continuous time units into the long-short term memory network model, wherein N is a positive integer;
modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model;
carrying out weighted nonlinear excitation output on the external state through a full connection layer;
and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
In an alternative mode, the long-term and short-term memory network model comprises a forgetting gate, an input gate, an output gate, a state unit and an output result, and the long-term and short-term memory network model is obtained by calculating according to the following formulas:
ft＝σ(Wfxt+Ufht-1+bf)
it＝σ(Wixt+Uiht-1+bi)
ot＝σ(Woxt+Uoht-1+bo)
ht＝ot⊙tanh(ct)
wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs a weight matrix of the input gate, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs a weight matrix of output gates, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
In an alternative, the executable instructions cause the processor to:
when DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times;
and extracting source IPs corresponding to the first k target IPs as DDoS sources.
The embodiment of the invention extracts the header information of the message by the network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the long-short term memory network model is applied to model and classify the characteristic vectors to output, whether DDoS attack occurs is judged, historical flow is modeled through a deep learning technology, macroscopic level data and microscopic level data are contained, the occurrence of missing report and false report is reduced, and the DDoS detection accuracy and stability are improved.
An embodiment of the present invention provides a computer program product, where the computer program product includes a computer program stored on a computer storage medium, where the computer program includes program instructions, and when the program instructions are executed by a computer, the computer is caused to execute the DDoS attack detection method in any of the above-mentioned method embodiments.
The executable instructions may be specifically configured to cause the processor to:
extracting header information of a message from network flow;
extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector;
and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs.
In an alternative, the executable instructions cause the processor to:
acquiring network flow from a mirror image at a network inlet in a bypass mode;
and extracting header information of the message from the network flow, wherein the header information comprises IP, TCP, UDP and ICMP messages.
In an alternative, the executable instructions cause the processor to:
performing abstract statistics on a plurality of statistical characteristics every other preset time unit according to header information of the message;
each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
In an alternative approach, the statistical features include: the method comprises the steps of TCP packet number, UDP packet number, ICMP packet number, TCP packet proportion, UDP packet proportion, ICMP packet proportion, destination ip count, destination port count, destination ip distribution information entropy, destination port distribution information entropy, TCP SYN packet proportion, TCP ACK packet proportion, TCP RST packet proportion, TCP newly-built link number, TCP closed link number, TCP holding link number, TCP connection duration and UDP packet size.
In an alternative, the executable instructions cause the processor to:
inputting the feature vectors in N continuous time units into the long-short term memory network model, wherein N is a positive integer;
modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model;
carrying out weighted nonlinear excitation output on the external state through a full connection layer;
and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
In an alternative mode, the long-term and short-term memory network model comprises a forgetting gate, an input gate, an output gate, a state unit and an output result, and the long-term and short-term memory network model is obtained by calculating according to the following formulas:
ft＝σ(Wfxt+Ufht-1+bf)
it＝σ(Wixt+Uiht-1+bi)
ot＝σ(Woxt+Uoht-1+bo)
ht＝ot⊙tanh(ct)
wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs a weight matrix of the input gate, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs a weight matrix of output gates, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
In an alternative, the executable instructions cause the processor to:
when DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times;
and extracting source IPs corresponding to the first k target IPs as DDoS sources.
The embodiment of the invention extracts the header information of the message by the network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the long-short term memory network model is applied to model and classify the characteristic vectors to output, whether DDoS attack occurs is judged, historical flow is modeled through a deep learning technology, macroscopic level data and microscopic level data are contained, the occurrence of missing report and false report is reduced, and the DDoS detection accuracy and stability are improved.
Fig. 5 is a schematic structural diagram of an embodiment of the apparatus according to the present invention, and the specific embodiment of the present invention does not limit the specific implementation of the apparatus.
As shown in fig. 5, the apparatus may include: a processor (processor)502, a Communications Interface 504, a memory 506, and a communication bus 508.
Wherein: the processor 502, communication interface 504, and memory 506 communicate with one another via a communication bus 508. A communication interface 504 for communicating with network elements of other devices, such as clients or other servers. The processor 502 is configured to execute the program 510, and may specifically execute relevant steps in the above DDoS attack detection method embodiment.
In particular, program 510 may include program code that includes computer operating instructions.
The processor 502 may be a central processing unit CPU, or an Application Specific Integrated Circuit (ASIC), or one or more Integrated circuits configured to implement an embodiment of the present invention. The device includes one or more processors, which may be the same type of processor, such as one or more CPUs; or may be different types of processors such as one or more CPUs and one or more ASICs.
And a memory 506 for storing a program 510. The memory 506 may comprise high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.
The program 510 may specifically be used to cause the processor 502 to perform the following operations:
extracting header information of a message from network flow;
extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector;
and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs.
In an alternative, the program 510 causes the processor to:
acquiring network flow from a mirror image at a network inlet in a bypass mode;
and extracting header information of the message from the network flow, wherein the header information comprises IP, TCP, UDP and ICMP messages.
In an alternative, the program 510 causes the processor to:
performing abstract statistics on a plurality of statistical characteristics every other preset time unit according to header information of the message;
each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
In an alternative, the program 510 causes the processor to:
the statistical features include: the method comprises the steps of TCP packet number, UDP packet number, ICMP packet number, TCP packet proportion, UDP packet proportion, ICMP packet proportion, destination ip count, destination port count, destination ip distribution information entropy, destination port distribution information entropy, TCP SYN packet proportion, TCP ACK packet proportion, TCP RST packet proportion, TCP newly-built link number, TCP closed link number, TCP holding link number, TCP connection duration and UDP packet size.
In an alternative, the program 510 causes the processor to:
inputting the feature vectors in N continuous time units into the long-short term memory network model, wherein N is a positive integer;
modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model;
carrying out weighted nonlinear excitation output on the external state through a full connection layer;
and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
In an alternative mode, the long-term and short-term memory network model comprises a forgetting gate, an input gate, an output gate, a state unit and an output result, and the long-term and short-term memory network model is obtained by calculating according to the following formulas:
ft＝σ(Wfxt+Ufht-1+bf)
it＝σ(Wixt+Uiht-1+bi)
ot＝σ(Woxt+Uoht-1+bo)
ht＝ot⊙tanh(ct)
wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs a weight matrix of the input gate, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs a weight matrix of output gates, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
In an alternative, the program 510 causes the processor to:
when DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times;
and extracting source IPs corresponding to the first k target IPs as DDoS sources.
The embodiment of the invention extracts the header information of the message by the network flow; extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector; and the long-short term memory network model is applied to model and classify the characteristic vectors to output, whether DDoS attack occurs is judged, historical flow is modeled through a deep learning technology, macroscopic level data and microscopic level data are contained, the occurrence of missing report and false report is reduced, and the DDoS detection accuracy and stability are improved.
The algorithms or displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems may also be used with the teachings herein. The required structure for constructing such a system will be apparent from the description above. In addition, embodiments of the present invention are not directed to any particular programming language. It is appreciated that a variety of programming languages may be used to implement the teachings of the present invention as described herein, and any descriptions of specific languages are provided above to disclose the best mode of the invention.
In the description provided herein, numerous specific details are set forth. It is understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.
Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the invention and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be interpreted as reflecting an intention that: that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.
Those skilled in the art will appreciate that the modules in the device in an embodiment may be adaptively changed and disposed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and furthermore they may be divided into a plurality of sub-modules or sub-units or sub-components. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or elements of any method or apparatus so disclosed, may be combined in any combination, except combinations where at least some of such features and/or processes or elements are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
Furthermore, those skilled in the art will appreciate that while some embodiments herein include some features included in other embodiments, rather than other features, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.
It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The usage of the words first, second and third, etcetera do not indicate any ordering. These words may be interpreted as names. The steps in the above embodiments should not be construed as limiting the order of execution unless specified otherwise.
Claims (10)
1. A DDoS attack detection method is characterized by comprising the following steps:
extracting header information of a message from network flow;
extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit, and abstracting the statistical characteristics into a serialized numerical characteristic vector;
and modeling, classifying and outputting the characteristic vectors by using a long-short term memory network model, and judging whether DDoS attack occurs.
2. The method of claim 1, wherein extracting header information of the packet from the network traffic comprises:
acquiring network flow from a mirror image at a network inlet in a bypass mode;
and extracting header information of the message from the network flow, wherein the header information comprises IP, TCP, UDP and ICMP messages.
3. The method according to claim 1, wherein said extracting a plurality of statistical features from header information of said packet every predetermined time unit, and abstracting a serialized numerical feature vector comprises:
performing abstract statistics on a plurality of statistical characteristics every other preset time unit according to header information of the message;
each time unit is a sample, and a plurality of statistical features are abstracted into feature vectors of a serialized numerical type.
4. The method of claim 1, wherein the statistical features comprise: the method comprises the steps of TCP packet number, UDP packet number, ICMP packet number, TCP packet proportion, UDP packet proportion, ICMP packet proportion, destination ip count, destination port count, destination ip distribution information entropy, destination port distribution information entropy, TCP SYN packet proportion, TCP ACK packet proportion, TCP RST packet proportion, TCP newly-built link number, TCP closed link number, TCP holding link number, TCP connection duration and UDP packet size.
5. The method of claim 1, wherein the applying a long-short term memory network model to perform modeling classification output on the feature vectors to determine whether a DDoS attack occurs comprises:
inputting the feature vectors in N continuous time units into the long-short term memory network model, wherein N is a positive integer;
modeling and outputting an external state according to a time sequence by adopting the long-short term memory network model;
carrying out weighted nonlinear excitation output on the external state through a full connection layer;
and performing classification maximization output through a softmax classifier according to the output of the full connection layer, and judging whether the DDoS attack occurs.
6. The method of claim 5, wherein the long-short term memory network model comprises a forgetting gate, an input gate, an output gate, a status unit and an output result, and is calculated by the following formulas:
ft＝σ(Wfxt+Ufht-1+bf)
it＝σ(Wixt+Uiht-1+bi)
ot＝σ(Woxt+Uoht-1+bo)
ht＝ot⊙tanh(ct)
wherein f istIndicating forgetting to remember gate, itDenotes an input gate, otRepresents an output gate, ctRepresents a status unit, htIndicates an external state, WiIs the right of the input gateHeavy matrix, biIs an offset term of the input gate, WfWeight matrix representing forgetting to remember gates, bfIs a biased term of forgetting to remember the gate, WoIs a weight matrix of output gates, boIs the offset term of the output gate, the gate activation function is sigmoid (σ), the value field is (0, 1), the output activation function is tanh function, which indicates the vector element product.
7. The method of claim 1, further comprising:
when DDoS attack is determined to occur, sequencing accessed IPs in the current time unit from high to low according to the access times;
and extracting source IPs corresponding to the first k target IPs as DDoS sources.
8. A DDoS attack detection apparatus, the apparatus comprising:
a header information obtaining unit, configured to extract header information of a packet for network traffic;
the characteristic extraction unit is used for extracting a plurality of statistical characteristics according to the header information of the message every other preset time unit and abstracting the statistical characteristics into a serialized numerical characteristic vector;
and the modeling unit is used for performing modeling classification output on the characteristic vectors by applying a long-short term memory network model and judging whether DDoS attack occurs or not.
9. A computing device, comprising: the system comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete mutual communication through the communication bus;
the memory is configured to store at least one executable instruction that causes the processor to perform the steps of the DDoS attack detection method according to any one of claims 1-7.
10. A computer storage medium having stored therein at least one executable instruction for causing a processor to perform the steps of the DDoS attack detection method according to any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910642020.1A CN112242973A (en) | 2019-07-16 | 2019-07-16 | DDoS attack detection method, device, computing equipment and computer storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910642020.1A CN112242973A (en) | 2019-07-16 | 2019-07-16 | DDoS attack detection method, device, computing equipment and computer storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112242973A true CN112242973A (en) | 2021-01-19 |
Family
ID=74167073
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910642020.1A Pending CN112242973A (en) | 2019-07-16 | 2019-07-16 | DDoS attack detection method, device, computing equipment and computer storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112242973A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112804255A (en) * | 2021-02-09 | 2021-05-14 | 中国人民解放军国防科技大学 | Network abnormal node detection method based on node multidimensional characteristics |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040215976A1 (en) * | 2003-04-22 | 2004-10-28 | Jain Hemant Kumar | Method and apparatus for rate based denial of service attack detection and prevention |
| CN101640594A (en) * | 2008-07-31 | 2010-02-03 | 北京启明星辰信息技术股份有限公司 | Method and unit for extracting traffic attack message characteristics on network equipment |
| CN102123149A (en) * | 2011-03-04 | 2011-07-13 | 哈尔滨工程大学 | Service-oriented large-scale network security situational assessment device and method |
| US20180063168A1 (en) * | 2016-08-31 | 2018-03-01 | Cisco Technology, Inc. | Automatic detection of network threats based on modeling sequential behavior in network traffic |
| CN108900542A (en) * | 2018-08-10 | 2018-11-27 | 海南大学 | Ddos attack detection method and device based on LSTM prediction model |
| US20190197397A1 (en) * | 2017-12-27 | 2019-06-27 | Cisco Technology, Inc. | Neural network-assisted computer network management |
| CN109981691A (en) * | 2019-04-30 | 2019-07-05 | 山东工商学院 | A kind of real-time ddos attack detection system and method towards SDN controller |
-
2019
- 2019-07-16 CN CN201910642020.1A patent/CN112242973A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20040215976A1 (en) * | 2003-04-22 | 2004-10-28 | Jain Hemant Kumar | Method and apparatus for rate based denial of service attack detection and prevention |
| CN101640594A (en) * | 2008-07-31 | 2010-02-03 | 北京启明星辰信息技术股份有限公司 | Method and unit for extracting traffic attack message characteristics on network equipment |
| CN102123149A (en) * | 2011-03-04 | 2011-07-13 | 哈尔滨工程大学 | Service-oriented large-scale network security situational assessment device and method |
| US20180063168A1 (en) * | 2016-08-31 | 2018-03-01 | Cisco Technology, Inc. | Automatic detection of network threats based on modeling sequential behavior in network traffic |
| US20190197397A1 (en) * | 2017-12-27 | 2019-06-27 | Cisco Technology, Inc. | Neural network-assisted computer network management |
| CN108900542A (en) * | 2018-08-10 | 2018-11-27 | 海南大学 | Ddos attack detection method and device based on LSTM prediction model |
| CN109981691A (en) * | 2019-04-30 | 2019-07-05 | 山东工商学院 | A kind of real-time ddos attack detection system and method towards SDN controller |
Non-Patent Citations (3)
| Title |
|---|
| 何小波: "DDoS攻击防御新思考", 《中国公共安全(学术版)》 * |
| 周东清等: "基于HMM的分布式拒绝服务攻击检测方法", 《计算机研究与发展》 * |
| 李广辉等: "基于聚集算法的DDoS数据流检测和处理", 《南京邮电大学学报(自然科学版)》 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112804255A (en) * | 2021-02-09 | 2021-05-14 | 中国人民解放军国防科技大学 | Network abnormal node detection method based on node multidimensional characteristics |
| CN112804255B (en) * | 2021-02-09 | 2022-10-18 | 中国人民解放军国防科技大学 | Network abnormal node detection method based on node multidimensional characteristics |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Blazek et al. | A novel approach to detection of “denial–of–service” attacks via adaptive sequential and batch–sequential change–point detection methods | |
| Bansal et al. | A comparative analysis of machine learning techniques for botnet detection | |
| CN108900542B (en) | DDoS attack detection method and device based on LSTM prediction model | |
| Peng et al. | Network intrusion detection based on deep learning | |
| CN109194684B (en) | Method and device for simulating denial of service attack and computing equipment | |
| Norouzian et al. | Classifying attacks in a network intrusion detection system based on artificial neural networks | |
| CN113992349B (en) | Malicious traffic identification method, device, equipment and storage medium | |
| US20200112578A1 (en) | System and method for detecting bots based on anomaly detection of javascript or mobile app profile information | |
| CN110351291B (en) | DDoS attack detection method and device based on multi-scale convolutional neural network | |
| Farhan et al. | Performance analysis of intrusion detection for deep learning model based on CSE-CIC-IDS2018 dataset | |
| CN113114618B (en) | Internet of things equipment intrusion detection method based on traffic classification recognition | |
| CN113660196A (en) | Network traffic intrusion detection method and device based on deep learning | |
| CN110162958B (en) | Method, apparatus and recording medium for calculating comprehensive credit score of device | |
| CN115270996A (en) | DGA domain name detection method, detection device and computer storage medium | |
| Callegari et al. | Real time attack detection with deep learning | |
| CN112242973A (en) | DDoS attack detection method, device, computing equipment and computer storage medium | |
| Koniki et al. | An anomaly based network intrusion detection system using LSTM and GRU | |
| Anwer et al. | Intrusion detection using deep learning | |
| Alsumaidaie et al. | An Assessment of Ensemble Voting Approaches, Random Forest, and Decision Tree Techniques in Detecting Distributed Denial of Service (DDoS) Attacks | |
| CN111901324B (en) | Method, device and storage medium for flow identification based on sequence entropy | |
| Premaratne et al. | Evidence theory based decision fusion for masquerade detection in IEC61850 automated substations | |
| Erfan | DDoS attack detection scheme using hybrid ensemble learning and ga algorithm for Internet of Things | |
| Rezaei | Detecting botnet on IoT by using unsupervised learning techniques | |
| CN117614742B (en) | Malicious traffic detection method with enhanced honey point perception | |
| Jose et al. | Prediction of network attacks using supervised machine learning algorithm |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20210119 |
|
| RJ01 | Rejection of invention patent application after publication |