WO2022099966A1 - 基于区块链的DDoS攻击联合防御系统及方法 - Google Patents

基于区块链的DDoS攻击联合防御系统及方法 Download PDF

Info

Publication number
WO2022099966A1
WO2022099966A1 PCT/CN2021/082097 CN2021082097W WO2022099966A1 WO 2022099966 A1 WO2022099966 A1 WO 2022099966A1 CN 2021082097 W CN2021082097 W CN 2021082097W WO 2022099966 A1 WO2022099966 A1 WO 2022099966A1
Authority
WO
WIPO (PCT)
Prior art keywords
ddos
information
abnormal
blockchain
traffic
Prior art date
Application number
PCT/CN2021/082097
Other languages
English (en)
French (fr)
Inventor
禹继国
王越
闫碧薇
王桂娟
董安明
Original Assignee
齐鲁工业大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 齐鲁工业大学 filed Critical 齐鲁工业大学
Publication of WO2022099966A1 publication Critical patent/WO2022099966A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Definitions

  • the invention relates to the technical field of DDoS attack defense, in particular to a blockchain-based DDoS attack joint defense system and method.
  • the traditional method is to defend from the attacked target, but the high-frequency packet arrival rate and the lack of connection context make the deployment scheme at the attacked target only limited statistical analysis, resulting in an error rate of analysis results higher.
  • the defect of detecting DDoS at the attack target it can be considered to detect abnormal DDoS traffic information at the source of the DDoS attack.
  • the IoT terminal devices under its jurisdiction can be controlled by the edge node to communicate. Therefore, we can specify that edge nodes perform traffic anomaly detection and filtering of IoT devices under their jurisdiction.
  • the Software Defined Networking (Software Defined Networking) architecture is developed to overcome the shortcomings of the existing traditional network architecture.
  • the SDN architecture separates the network control from the forwarding equipment, and the controller can obtain a global view of the network with high reliability and simplicity. and flexibility, it can effectively solve the communication problem between domains.
  • the centralized network control in SDN has the risk of single-point attack, which is always a hidden danger of the system.
  • the technical task of the present invention is to provide a blockchain-based DDoS attack joint defense system and method to solve the technical problem of how to achieve safe, fast and effective defense against DDoS attacks.
  • the present invention provides a blockchain-based DDoS attack joint defense system, including:
  • a terminal device, at least one of the terminal devices, and the origin of the DDoS attack is the terminal device
  • Edge device at least one of the edge devices is deployed with an Ethereum client. After the edge device verifies the legitimacy, it joins the blockchain network as an edge node, and broadcasts the terminal devices under the edge node to the block chain chain network;
  • a blockchain in which a device information sharing smart contract and a device filtering smart contract are deployed, and the blockchain is used to realize information sharing among edge nodes based on a blockchain consensus mechanism;
  • the edge device is used for abnormal DDoS detection, obtains abnormal DDoS traffic information, stores the abnormal DDoS traffic information through local data, and uploads the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract;
  • the blockchain is used to send the DDoS attack device filtering information to the edge node through the device filtering smart contract;
  • the edge node is used to filter the DDoS attack device based on the DDoS attack device filtering information, and provide points for rewarding the provider of the DDoS attack device filtering information;
  • the edge node is used to train the DDoS anomaly detection model based on the DDoS anomaly traffic information and optimize the parameters of the DDoS anomaly detection model, and the points are used to support the provider of the DDoS attack device filtering information to trade on the blockchain.
  • the above-mentioned optimized parameters are obtained from the edge node in a manner.
  • the edge node uploads the information summary of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain transmits the abnormal DDoS traffic based on the blockchain consensus mechanism.
  • the information summary of the information is synchronized to other edge nodes;
  • the edge node When there is no DDoS attack in the network environment, the edge node uploads the details of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain uploads the abnormal DDoS traffic information based on the blockchain consensus mechanism. Details are synchronized to other edge nodes.
  • the blockchain is configured with an information sharing model
  • the information sharing model is the S-Chain information sharing model, including:
  • a device filter chain the device filter chain is used to store the information summary of the abnormal DDoS traffic information, and is used to synchronize the information summary of the abnormal DDoS traffic information to other edge nodes based on the blockchain consensus mechanism;
  • the device information chain which is used to store the detailed information of the abnormal DDoS traffic information, is used to synchronize the detailed information of the abnormal DDoS traffic information to other edge nodes based on the blockchain consensus mechanism, and the detailed information of the abnormal DDoS traffic information is used for for training DDoS anomaly detection models.
  • the edge node detects and classifies network traffic based on a DDoS anomaly detection model
  • the DDoS anomaly detection model identifies DDoS attack traffic and normal traffic through the RF algorithm, including the following steps:
  • the construction method of the random forest is:
  • the device filtering smart contract is configured with attack device filtering rules
  • the blockchain is used to send DDoS attack device filtering information to edge nodes through the device filtering smart contract based on the attack device filtering rules and DDoS abnormal traffic information;
  • the attack device filtering rule is: according to the characteristics of the DDoS attack, the abnormal devices are classified into levels, the filtering order of the devices is arranged according to the danger level, and the DDoS danger level is calculated by the following formula, and the formula is:
  • N represents the number of consecutive times
  • T represents the connection period
  • t represents the continuous duration
  • F represents the frequency of sending packets
  • B represents the byte calculation from source to destination.
  • the edge node filters the attackers through a defense model
  • the defense model includes:
  • the gratuitous defense model is applied to the scenario where the attacker and the victim belong to the same edge node.
  • the edge node queries the attacker's corresponding IP address and address according to the abnormal DDoS traffic information.
  • MAC address in the process of DDoS abnormal device filtering, the edge node filters the attacker's IP address and the MAC address of the attacker's subordinate terminal equipment;
  • the paid defense model is applied to the scenario where the attacker and the victim belong to different edge nodes.
  • the edge node broadcasts the abnormal DDoS traffic information to the district based on the device information sharing smart contract.
  • other edge nodes query the IP address and MAC address corresponding to the attacker according to the abnormal DDoS traffic information. If there are attackers or victims in the device, the other edge nodes filter the attackers or pretenders, and provide points to the edge nodes that provide the abnormal DDoS traffic information; There is no attacker or victim on the device.
  • the DDoS traffic information needs to be queried. If the abnormal DDoS traffic is published
  • the abnormal DDoS traffic information shared by the edge nodes of the information helps the other edge nodes to filter the access of malicious devices, and the other edge nodes provide points for the edge nodes that provide the abnormal DDoS traffic information.
  • the blockchain consists of a creation block and a common block
  • the genesis block is the first block in the blockchain, and the block serial number is 0.
  • Two peer edge nodes in the blockchain network have the same block, and the two peer edge nodes have the same block. pair and sync blocks with each other;
  • the common block is composed of a block header and a block body, and the block header includes three groups of metadata, which are respectively a first metadata group, a second metadata group and a third metadata group.
  • the group includes index data
  • the second metadata group includes mining difficulty, a random number and a timestamp
  • the third metadata group includes Merkel number root data
  • the index data is used to connect the hash value of the previous block and the parent block
  • the mining difficulty, nonce and timestamp are used for proof of work
  • the Merkle tree root data is used to summarize and summarize all transaction data in the verification block
  • the block body includes transaction data, and the transaction data includes but is not limited to abnormal DDoS traffic information and points.
  • the present invention provides a blockchain-based DDoS attack joint defense method, which implements the filtering of DDoS attack initiating devices through the blockchain-based DDoS attack joint defense system described in any one of the first aspects.
  • the method includes the following steps:
  • the edge device performs DDoS anomaly detection, obtains DDoS abnormal traffic information, stores the DDoS abnormal traffic information through the local data of the edge device, and uploads the DDoS abnormal traffic information to the blockchain based on the device information sharing smart contract.
  • the blockchain is based on the blockchain consensus mechanism Realize information sharing between edge nodes;
  • the blockchain Based on the attack device filtering rules and DDoS abnormal traffic information, the blockchain sends DDoS attack device filtering information to edge nodes through the device filtering smart contract;
  • the edge node filters the DDoS attack device based on the DDoS attack device filtering information, and provides points for reward to the provider of the DDoS attack device filtering information;
  • the edge node trains the DDoS anomaly detection model based on the DDoS anomaly traffic information and optimizes the parameters of the DDoS anomaly detection model, and the provider of the filtering information of the DDoS attack device obtains the above-mentioned information from the edge node in a blockchain transaction based on points. optimized parameters.
  • the edge node uploads the information summary of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain uploads the abnormal DDoS traffic information based on the blockchain consensus mechanism.
  • the information digest is synchronized to other edge nodes;
  • the edge node When there is no DDoS attack in the network environment, the edge node uploads the detailed information of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain uploads the detailed information of the abnormal DDoS traffic information based on the blockchain consensus mechanism. Synchronize to other edge nodes;
  • the blockchain is configured with an information sharing model, and the information sharing model is the S-Chain information sharing model, including:
  • a device filter chain the device filter chain is used to store the information summary of the abnormal DDoS traffic information, and is used to synchronize the information summary of the abnormal DDoS traffic information to other edge nodes based on the blockchain consensus mechanism;
  • the device information chain which is used to store the detailed information of the abnormal DDoS traffic information, is used to synchronize the detailed information of the abnormal DDoS traffic information to other edge nodes based on the blockchain consensus mechanism, and the detailed information of the abnormal DDoS traffic information is used for for training DDoS anomaly detection models.
  • the DDoS anomaly detection model identifies DDoS attack traffic and normal traffic through the RF algorithm, including the following steps:
  • the construction method of the random forest is:
  • the device filtering smart contract is configured with attack device filtering rules, and the blockchain sends DDoS attack device filtering information to edge nodes through the device filtering smart contract based on the attack device filtering rules and DDoS abnormal traffic information;
  • the attack device filtering rule is: according to the characteristics of the DDoS attack, the abnormal devices are classified into levels, the filtering order of the devices is arranged according to the danger level, and the DDoS danger level is calculated by the following formula, and the formula is:
  • N represents the number of consecutive times
  • T represents the connection period
  • t represents the continuous duration
  • F represents the frequency of sending packets
  • B represents the byte calculation from source to destination.
  • the system consists of many edge nodes, and there is no centralized central node, which effectively avoids single-point attacks. It has strong anti-attack ability;
  • Information storage is divided into three forms: local storage, device filter chain storage, and device information storage.
  • Edge nodes detect abnormal DDoS traffic information
  • the device summary information sharing smart contract deployed on the blockchain transfers DDoS abnormal traffic information to the smart contract.
  • the information summary is uploaded to the device filtering chain.
  • the device information sharing smart contract deployed on the blockchain uploads the abnormal DDoS traffic information to the device information chain.
  • the data in the blockchain can be downloaded at any time for maintenance, thus ensuring the integrity of the data;
  • a new edge node applying to join the blockchain network needs to be authenticated by any edge node in the blockchain to join, which reduces the time consumed by all nodes for joint verification to a certain extent.
  • the speed of node verification is improved.
  • the existing edge nodes in the blockchain first verify the legitimacy of the node number of the newly added edge node. After the verification is passed, the newly added edge node will broadcast its subordinate terminal equipment to the network for other edge nodes to own.
  • the edge node and its subordinate terminal equipment ensure the smooth progress of DDoS attack defense.
  • the device expansion is mainly verified by the integration method deployed in the Ethereum client of the edge node. There is no external interference during the verification process, ensuring security. .
  • Embodiment 1 is a network architecture diagram of the blockchain-based DDoS attack joint defense system in Embodiment 1;
  • FIG. 2 is a schematic block diagram of a defense model in the blockchain-based DDoS attack joint defense system of Embodiment 1;
  • Embodiment 3 is a block diagram of the working principle of the blockchain-based DDoS attack joint defense system in Embodiment 1;
  • FIG. 4 is a flow chart of the blockchain-based joint defense method for DDoS attacks in Embodiment 2.
  • FIG. 4 is a flow chart of the blockchain-based joint defense method for DDoS attacks in Embodiment 2.
  • Embodiments of the present invention provide a blockchain-based DDoS attack joint defense system and method, which are used to solve the technical problem of how to implement safe, fast, and effective defense against DDoS attacks.
  • a blockchain-based DDoS attack joint defense system of the present invention includes terminal equipment, edge equipment and blockchain, at least one terminal equipment, and the origin of the DDoS attack is the terminal equipment; the edge equipment at least One and both are deployed with an Ethereum client, and edge devices are added to the blockchain network as edge nodes; device information sharing smart contracts and device filtering smart contracts are deployed in the blockchain, and the blockchain is used for implementation based on the blockchain consensus mechanism. Information sharing among various edge nodes.
  • Edge devices are used for DDoS anomaly detection, obtain DDoS abnormal traffic information, store DDoS abnormal traffic information through local data, and upload the DDoS abnormal traffic information to the blockchain based on the device information sharing smart contract; filter rules based on attacking devices and DDoS abnormal traffic information, the blockchain is used to send the DDoS attack device filtering information to the edge node through the device filtering smart contract; the edge node is used to filter the DDoS attack device based on the DDoS attack device filtering information, and provide the provider of the DDoS attack device filtering information. Points are rewarded; edge nodes conduct DDoS anomaly detection model training based on DDoS abnormal traffic information and points.
  • the terminal devices include terminal devices such as smart traffic lights, computers, and smart cameras that are common in human life. Usually, the origin of DDoS attacks is these end devices.
  • the above-mentioned multiple terminal devices form a terminal layer.
  • the edge device is the main target of the DDoS attack initiator. After the edge device verifies the legitimacy, it joins the blockchain network as an edge node, and broadcasts the terminal devices under the edge node to the blockchain network.
  • the existing edge nodes in the blockchain first verify the legitimacy of the node number of the newly added edge node. After the verification is passed, the newly added edge node broadcasts its subordinate terminal equipment to the network so that other edge nodes own the edge node and its subordinates.
  • the terminal device ensures the smooth progress of DDoS attack defense. Device scaling is primarily validated by an integrated approach deployed in the Ethereum client of edge nodes.
  • the edge device is mainly responsible for DDoS anomaly detection, DDoS anomaly detection model training, and DDoS anomaly device filtering.
  • the blockchain consists of the Ethereum client deployed on the edge device, and the blockchain mainly realizes the information sharing among the edge nodes through the blockchain consensus mechanism.
  • the edge devices deployed with the Ethereum client can join the blockchain network after passing the verification.
  • the edge devices newly added to the blockchain network achieve data consistency with the original edge devices in the network through the consensus mechanism of the blockchain.
  • Edge nodes detect and classify network traffic based on the DDoS anomaly detection model.
  • the DDoS anomaly detection model identifies DDoS attack traffic and normal traffic through the RF algorithm.
  • the DDoS anomaly detection model identifies DDoS attack traffic and normal traffic through the RF algorithm, including the following steps:
  • Random decision forest was proposed by He Tianqin of Bell Labs, and then developed into the algorithm of random forest. This algorithmic approach combines Breimans' Bootstrap aggregating idea with Ho's random subspace method idea to build an ensemble of decision trees. Random forest is a classifier that contains multiple decision trees, and its output category is counted by the output results of all decision trees, and the result with the most votes is determined as the final output result of random forest.
  • Each bootstrapping sampling is repeated n times, and only 63.2% of the samples will be sampled.
  • the random forest implementation process is as follows:
  • the bootstrapping method is used to resample and select n DDoS abnormal traffic samples, that is, the training data set of each tree is different, which contains repeated DDoS abnormal traffic training sample.
  • the m decision trees form a random forest, and the classification results are voted to determine which category the test data belongs to.
  • the edge node When there is a DDoS attack in the network environment, the edge node uploads the information summary of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain synchronizes the above information summary of the abnormal DDoS traffic information to the blockchain consensus mechanism other edge nodes.
  • Information sharing between edge nodes includes terminal device information sharing, information summary sharing of DDoS abnormal traffic information, and detailed information sharing of DDoS abnormal traffic information.
  • the device information sharing smart contract is written, and the information sharing model of the double-chain mode (Strong-Chain) is designed since the POW consensus mechanism of the Ethereum blockchain platform works together to realize information sharing between edge nodes.
  • the information sharing model is the S-Chain information sharing model, which consists of two private chains, namely the device filtering chain and the device information chain.
  • the device filtering chain mainly stores the information summary of abnormal DDoS traffic information.
  • the information summary of the abnormal DDoS traffic information includes the attacker's IP address, the attacker's MAC address, and the victim's IP address; the main purpose of the device filter chain is to synchronize the abnormal DDoS traffic information detected by the edge node to other edge nodes at the first time. Help the attacked edge node to accurately and quickly filter the initiating device of the DDoS attack.
  • the device information chain mainly stores the detailed information of DDoS abnormal traffic information, which is used to synchronize the detailed information of DDoS abnormal traffic information to other edge nodes based on the blockchain consensus mechanism. Provide the latest DDoS abnormal traffic information for the model to train the model, so that the DDoS attack detection model always maintains a high recognition rate.
  • the S-Chain information sharing model realizes the DDoS abnormal traffic information sharing between edge nodes through the following process.
  • the edge node When there is no DDoS attack in the network environment, the edge node uploads the details of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain uploads the details of the abnormal DDoS traffic information based on the blockchain consensus mechanism. Information is synchronized to other edge nodes;
  • the blockchain consists of two types of genesis blocks and ordinary blocks, a chain data structure formed by sequentially connecting data blocks in chronological order;
  • edge nodes After receiving the synchronization information, other edge nodes first verify the identity of the information sender and the legitimacy of the information sent. After both information are verified, the local DDoS abnormal traffic information information summary database and DDoS abnormal traffic information detailed information database are updated.
  • the genesis block is the first block in the blockchain, and its block number is 0. It is the only block in the blockchain that does not point to the previous block, and at the same time, it does not contain any transaction information.
  • the information synchronization between edge nodes is determined by the genesis block. If two peer edge nodes in the network have the same genesis block, then the edge nodes will pair with each other and synchronize the block, otherwise they will reject each other.
  • Ordinary blocks all blocks in the blockchain except the genesis block are ordinary blocks.
  • Each block consists of a block header (Block Header) and a block body (Block).
  • the block header includes three sets of metadata, namely the first metadata group, the second metadata group and the third metadata group, and the first metadata group includes an index used to connect the previous block and the hash value of the parent block Data
  • the second metadata group includes mining difficulty, nonce and timestamp for proof-of-work
  • the nonce (Nonce) is used as a counter for the proof-of-work algorithm
  • the third metadata group includes verification that can be summarized and quickly summarized Merkle tree root data for all transaction data in the block.
  • the block body mainly contains transaction data (Transaction, TX).
  • the transaction data includes abnormal DDoS traffic information and points.
  • the device filtering smart contract After the information summary of abnormal DDoS traffic information is successfully added, the device filtering smart contract will be automatically triggered.
  • the device filtering smart contract will calculate according to the preset rules, and finally send the filtering information to the corresponding edge node Ethereum client, and then use the edge node to detect the abnormality.
  • the edge nodes that are filtered by the device and protected from damage provide points rewards to the edge nodes that publish abnormal DDoS traffic information.
  • the device filtering smart contract is configured with attack device filtering rules
  • the blockchain sends DDoS attack device filtering information to edge nodes through the device filtering smart contract based on the attack device filtering rules and DDoS abnormal traffic information.
  • the filtering rules for attacking devices are: According to the characteristics of DDoS attacks, the abnormal devices are classified into levels, and then the filtering order of the devices is arranged according to the danger level. As shown in Table 1, the scoring rules and weights of DDoS attacks, and the DDoS Danger Level (DL) is formulated through the rules. Calculated as follows:
  • edge nodes filter attackers through defense models, which include free defense models and paid defense models.
  • the gratuitous defense model is applied to the scenario where the attacker and the victim belong to the same edge node.
  • the edge node queries the attacker's corresponding IP address and MAC address according to the abnormal DDoS traffic information.
  • the edge node filters the attacker's IP address and the MAC address of the attacker's subordinate terminal equipment;
  • the paid defense model is applied to scenarios where the attacker and the victim belong to different edge nodes.
  • the edge node After the paid defense model detects abnormal DDoS traffic information, the edge node broadcasts the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and other edge nodes After receiving the abnormal DDoS traffic information, query the IP address and MAC address corresponding to the attacker according to the abnormal DDoS traffic information.
  • the other edge nodes filter attackers or pretenders, and at the same time provide points to the edge nodes that provide the abnormal DDoS traffic information;
  • the victim when a new terminal device is added to the other edge node under the other edge node that receives the DDoS abnormal traffic information, needs to query the DDoS traffic information, if the edge node that publishes the above DDoS abnormal traffic information shares
  • the abnormal DDoS traffic information of the other edge nodes helps the other edge nodes filter the access of malicious devices, and the other edge nodes provide points for the edge nodes that provide the abnormal DDoS traffic information.
  • a blockchain-based DDoS attack joint defense system proposed by the present invention is jointly completed by all IoT devices such as edge devices and terminal devices.
  • Edge node A (the edge node where the victim exists), as shown by the dashed line in Figure 3, when the terminal device A1, as a DDoS attacker, launches an attack on the terminal device D1 (the victim), the edge node A will detect After the terminal device A1 has abnormal communication behavior, the information of the terminal device A1 (such as IP address, MAC address, connection times per second and the IP of the attacker) is used to share the abnormal DDoS traffic information through the S-Chain information sharing model.
  • Edge node B, edge node C, and edge node D update the local abnormal device information table respectively after receiving the shared information, and query whether there is a counterfeiter in their subordinate terminal devices through the MAC address of terminal device A1 (as indicated by the dense dotted line in Figure 3). It shows that the edge device A1 forges the IP address of the edge device B2 to launch a continuous attack on the edge device D1, which in turn affects the excessive consumption of the resources of the IoT device) or the victim.
  • Edge node B (edge node with a forger): By querying the MAC address in the local abnormal device information table and the IP address of the victim, it finds that its subordinate terminal device B2 is a forger (no victim), and the edge node B sends the terminal The information of device B2 is shared into the network. Since edge node B filters counterfeiters through the abnormal DDoS traffic information provided by edge node A, edge node B needs to provide edge node A with information sharing points.
  • Edge node C (normal edge node): By querying the MAC address and the victim's IP address in the local abnormal device information table, it is found that there are no counterfeiters and victims in its subordinate terminal devices. Edge node C does not need to provide edge node A for the time being. Information sharing credits. When a new terminal device is added to edge node C, edge node C will automatically detect whether the MAC address of the terminal device is in the local abnormal device information table. Offers information sharing credits.
  • the edge node D finds that there is a victim (no forger) in its subordinate terminal device by querying the MAC and the IP address of the victim in the local abnormal device information table.
  • Edge device B provides information sharing credits. When edge node A and edge node B receive the information sharing points provided by edge node D, they filter their subordinate terminal equipment A1 and terminal equipment B2 respectively.
  • the blockchain-based DDoS attack joint defense system of the present invention assumes that there is a DDoS attack initiating device to initiate a DDoS attack on a terminal device in the blockchain network, and the workflow is:
  • the DDoS attack detection model deployed on edge nodes will automatically identify abnormal traffic of DDoS attacks
  • the edge node uploads the information summary of the abnormal DDoS traffic information to the device filtering chain through the device filtering information sharing smart contract, and other edge nodes realize the information summary synchronization of the abnormal DDoS traffic information between the edge nodes according to the consensus mechanism of the blockchain ( When there is no DDoS attack in the network environment, the edge device uploads the details of the last detected DDoS abnormal traffic information to the device information chain through the device information sharing smart contract. Detailed information synchronization of DDoS abnormal traffic information between edge nodes;
  • the edge node filters the attacking device according to the received attacking device filtering information, and provides point rewards to the provider of the attacking device filtering information (the edge device that provides DDoS abnormal information), and other edge nodes that obtain points can pass the points. Prioritize the update of the DDoS attack detection model to keep the DDoS detection model able to detect the latest DDoS attack information.
  • the edge node can train the local DDos anomaly detection model according to the detected DDos abnormal traffic information to optimize its parameters, and other edge nodes that obtain points obtain their optimized parameters from the edge node through blockchain transactions. Taking the points and the optimized parameters as the transaction objects, the optimized parameters are obtained through blockchain transactions based on the points, and the existing public blockchain transaction methods are selected.
  • the blockchain-based DDoS attack joint defense method of the present invention realizes the filtering of DDoS attack initiating devices through the blockchain-based DDoS attack joint defense system disclosed in Embodiment 1.
  • the method includes the following steps:
  • the edge device performs DDoS anomaly detection, obtains DDoS abnormal traffic information, stores the DDoS abnormal traffic information through the local data of the edge device, and uploads the DDoS abnormal traffic information to the blockchain based on the device information sharing smart contract, and the blockchain is based on the blockchain Consensus mechanism realizes information sharing among edge nodes;
  • the blockchain Based on the attack device filtering rules and DDoS abnormal traffic information, the blockchain sends the DDoS attack device filtering information to the edge node through the device filtering smart contract;
  • the DDoS anomaly detection model identifies DDoS attack traffic and normal traffic through the RF algorithm, including the following steps:
  • Random decision forest was proposed by He Tianqin of Bell Labs, and then developed into the algorithm of random forest. This algorithmic approach combines Breimans' Bootstrap aggregating idea with Ho's random subspace method idea to build an ensemble of decision trees. Random forest is a classifier that contains multiple decision trees, and its output category is counted by the output results of all decision trees, and the result with the most votes is determined as the final output result of random forest.
  • Each bootstrapping sampling is repeated n times, and only 63.2% of the samples will be sampled.
  • the random forest implementation process is as follows:
  • the bootstrapping method is used to resample and select n DDoS abnormal traffic samples, that is, the training data set of each tree is different, which contains repeated DDoS abnormal traffic training sample.
  • the m decision trees form a random forest, and the classification results are voted to determine which category the test data belongs to.
  • the edge node When there is a DDoS attack in the network environment, the edge node uploads the information summary of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain synchronizes the information summary of the abnormal DDoS traffic information based on the blockchain consensus mechanism to other edge nodes.
  • Information sharing between edge nodes includes terminal device information sharing, information summary sharing of DDoS abnormal traffic information, and detailed information sharing of DDoS abnormal traffic information.
  • the device information sharing smart contract is written, and the information sharing model of the double-chain mode (Strong-Chain) is designed since the POW consensus mechanism of the Ethereum blockchain platform works together to realize information sharing between edge nodes.
  • the information sharing model is the S-Chain information sharing model, which consists of two private chains, namely the device filtering chain and the device information chain.
  • the device filtering chain mainly stores the information summary of abnormal DDoS traffic information and the information of abnormal DDoS traffic information.
  • the summary includes the attacker's IP address, the attacker's MAC address, and the victim's IP address; the main purpose of the device filter chain is to synchronize the abnormal DDoS traffic information detected by the edge node to other edge nodes at the first time, helping the attacked edge nodes. It can accurately and quickly filter the initiating device of DDoS attack.
  • the device information chain mainly stores the detailed information of DDoS abnormal traffic information, which is used to synchronize the detailed information of DDoS abnormal traffic information to other edge nodes based on the blockchain consensus mechanism. Provide the latest DDoS abnormal traffic information for the model to train the model, so that the DDoS attack detection model always maintains a high recognition rate.
  • the S-Chain information sharing model realizes the sharing of DDoS abnormal traffic information between edge nodes through the following process.
  • the edge node When there is no DDoS attack in the network environment, the edge node uploads the details of the abnormal DDoS traffic information to the blockchain based on the device information sharing smart contract, and the blockchain uploads the details of the abnormal DDoS traffic information based on the blockchain consensus mechanism. Information is synchronized to other edge nodes;
  • the blockchain consists of two types of genesis blocks and ordinary blocks, a chain data structure formed by sequentially connecting data blocks in chronological order;
  • edge nodes After receiving the synchronization information, other edge nodes first verify the identity of the information sender and the legitimacy of the information sent. After both information are verified, the local DDoS abnormal traffic information information summary database and DDoS abnormal traffic information detailed information database are updated.
  • the device filtering smart contract After the information summary of abnormal DDoS traffic information is added successfully, the device filtering smart contract will be automatically triggered.
  • the device filtering smart contract will calculate according to the preset rules, and finally send the filtering information to the corresponding edge node Ethereum client, and then use the edge node to detect the abnormality.
  • the edge nodes that are filtered by the device and protected from damage provide points rewards to the edge nodes that publish abnormal DDoS traffic information.
  • the device filtering smart contract is configured with attack device filtering rules. Based on the attack device filtering rules and DDoS abnormal traffic information, the blockchain sends DDoS attack device filtering information to edge nodes through the device filtering smart contract.
  • the filtering rule for attacking devices in this embodiment is: according to the characteristics of the DDoS attack, the abnormal devices are classified into levels, and then the filtering order of the devices is arranged according to the danger level.
  • the scoring rules and weights of DDoS attacks, and the DDoS Danger Level (DL) is formulated through the rules. Calculated as follows:
  • N represents the number of consecutive times
  • T represents the connection period
  • t represents the continuous duration
  • F represents the frequency of sending packets
  • B represents the byte calculation from source to destination.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了基于区块链的DDoS攻击联合防御系统及方法，属于DDoS攻击防御技术领域，要解决的技术问题为如何实现安全、快速、有效的对DDoS攻击进行防御。系统，包括：终端设备，至少一个；边缘设备，至少一个并均部署有以太坊客户端；区块链，部署有设备信息共享智能合约和设备过滤智能合约，区块链用于基于区块链共识机制实现各个边缘节点之间的信息共享；边缘设备用于进行DDoS异常检测，得到DDoS异常流量信息，通过本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链。

Description

基于区块链的DDoS攻击联合防御系统及方法 技术领域
本发明涉及DDoS攻击防御技术领域，具体地说是基于区块链的DDoS攻击联合防御系统及方法。
背景技术
近年来随着5G和物联网(Internet of Things，IoT)的飞速的发展，万物互联已成为不可改变的大趋势。在大多数的物联网设备的系统设计中会忽略安全问题，黑客可以轻易将物联网设备的安全漏洞作为传统网络攻击的新工具(如Mirai、Aidra等恶意代码感染智能设备)发动DDoS(Distributed denial of service)攻击，造成目标拒绝服务和相关服务下线等严重后果。
针对DDoS攻击，传统的方式是从被攻击目标处进行防御，但是高频率的数据包到达速率和连接上下文的缺失使得在被攻击目标处的部署方案只能进行有限的统计分析导致分析结果错误率较高。为了克服在攻击目标处检测DDoS的缺陷可以考虑在DDoS攻击发起的源头处对DDoS异常流量信息进行检测。在边缘节点网络中可以通过边缘节点控制其下辖的物联网终端设备进行通信。因此，我们可以规定边缘节点对其下辖的物联网设备进行流量的异常检测和过滤。
在边缘节点环境中，大多数情况下攻击者和受害者不在同一个网络域内，单纯的域内防御并不能取得最佳的效果，因此应当将域内的检测扩展到域间的协作使整个网络中所有的边缘节点都参与到整个网络DDoS攻击防御中去。软件定义网络(Software Defined Networking)架构是为了克服现有传统网络架构存在的缺陷而开发的，SDN体系结构将网络控制与转发设备分离，控制器可以获得网络的全局视图具有高可靠性、简单性和灵活性的特点，能够有效的解决域间的通信问题。但是，SDN中集中式的网络控制存在单点攻击的风险，始终是系统的一个隐患。
基于上述，如何实现安全、快速、有效的对DDoS攻击进行防御，是需要解决的技术问题。
发明内容
本发明的技术任务是针对以上不足，提供一种基于区块链的DDoS攻击联合防御系统及方法，来解决如何实现安全、快速、有效的对DDoS攻击进行防御的技术问题。
第一方面，本发明提供一种基于区块链的DDoS攻击联合防御系统，包括：
终端设备，所述终端设备至少一个，DDoS攻击的发起源头为终端设备；
边缘设备，所述边缘设备至少一个并均部署有以太坊客户端，所述边缘设备验证合法性后，加入区块链网络作为边缘节点，并将所述边缘节点下属的终端设备广播至区块链网络；；
区块链，所述区块链中部署有设备信息共享智能合约和设备过滤智能合约，所述区块链用于基于区块链共识机制实现各个边缘节点之间的信息共享；
所述边缘设备用于进行DDoS异常检测，得到DDoS异常流量信息，通过本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链；
基于攻击设备过滤规则和DDoS异常流量信息，所述区块链用于通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
所述边缘节点用于基于DDoS攻击设备过滤信息对DDoS攻击设备进行过滤，并向DDoS攻击设备过滤信息的提供者提供积分进行奖励；
所述边缘节点用于基于DDoS异常流量信息进行DDoS异常检测模型训练并优化所述DDoS异常检测模型的参数，所述积分用于支持所述DDoS攻击设备过滤信息的提供者以区块链交易的方式向所述边缘节点获取上述优化后的参数。
作为优选，网络环境存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的信息摘要上传区块链，所述区块链基于区块链共识机制将所述DDoS异常流量信息的信息摘要同步至其它边缘节点；
网络环境不存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的详细信息上传区块链，所述区块链基于区块链共识机制将所述DDoS异常流量信息的详细信息同步至其它边缘节点。
作为优选，所述区块链配置有信息共享模型，所述信息共享模型为S-Chain信息共享模型，包括：
设备过滤链，所述设备过滤链用于存储DDoS异常流量信息的信息摘要，并用于基于区块链共识机制将DDoS异常流量信息的信息摘要同步至其它边缘节点；
设备信息链，所述设备信息链用于存储DDoS异常流量信息的详细信息，用于基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点，DDoS异常流量信息的详细信息用于训练DDoS异常检测模型。
作为优选，所述边缘节点基于DDoS异常检测模型对网络流量进行检测分类；
DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量，包括如下步骤：
(1)对待检测的网络流量进行流量包提取；
(2)按照设备和时间进行特征包分组；
(3)对特征包进行特征向量提取；
(4)以提取的特征向量为测试数据，将测试数据输入随机森林，通过投票表决分类结果，决定测试数据的类别；
所述随机森林的构建方法为：
(1)从训练DDoS异常流量样本集中采用bootstrapping的方法有放回的重采样选出n个DDoS异常流量样本；
(2)从DDoS异常流量的所有属性中有选择地选出K个属性，选择最佳属性作为节点建立决策树；
(3)重复上述步骤m次，建立m棵决策树；
(4)上述m个决策树形成决策森林。
作为优选，所述设备过滤智能合约中配置有攻击设备过滤规则，区块链用于基于所述攻击设备过滤规则和DDoS异常流量信息，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
所述攻击设备过滤规则为：按照DDoS攻击的特性，将异常设备进行等级划分，按照危险等级对设备的过滤顺序进行排列，并通过如下公式计算DDoS危险等级，所述公式为：
DL＝N·5％+T·5％+t·20％+F·40％+B·30％
其中，N表示连续次数，T表示连接周期，t表示连续持续时间，F表示发送数据包频率，B表示源到目标的字节计算。
作为优选，所述边缘节点通过防御模型对攻击者进行过滤，所述防御模型包括：
无偿防御模型，所述无偿防御模型应用于攻击者和受害者属于同一个边缘节点的场景，无偿防御模型检测到DDoS异常流量信息后，边缘节点根据DDoS异常流量信息查询攻击者对应的IP地址和MAC地址，在DDoS异常设备过滤过程中，边缘节点对攻击者的IP地址以及攻击者下属终端设备的MAC地址进行过滤；
有偿防御模型，所述有偿防御模型应用于攻击者和受害者属于不同边缘节点的场景，有偿防御模型检测到DDoS异常流量信息后，边缘节点基于设备信息共享智能合约将DDoS异常流量信息广播至区块链，其它边缘节点接收到所述DDoS异常流量信息后，根据所述DDoS异常流量信息查询攻击者对应的IP地址和MAC地址，如果收到所述DDoS异常流量信息的其它边缘节点下属的终端设备存在攻击者或受害者，所述其它边缘节点将攻击者或伪装者过滤，同时向提供所述DDoS异常流量信息的边缘节点提供积分；如果收到DDoS异常流量信息的其它边缘节点下属的终端设备不存在攻击者或受害者，当收到DDoS异常流量信息的其它边缘节点下存在新的终端设备加入到所述其它边缘节点时，需要查询所述DDoS流量信息，若发布所述DDoS异常流量信息的边缘节点共享的DDoS异常流量信息帮助所述其它边缘节点过滤恶意设备的接入，所述其它边缘节点为提供所述DDoS异常流量信息的边缘节点提供积分。
作为优选，所述区块链由创世区块和普通区块组成；
所述创世区块为区块链中第一个区块，区块序号为0，区块链网络中两个对等的边缘节点具有相同的区块，所述两个对等的边缘节点彼此之间配对并同步区块；
所述普通区块由区块头和区块体组成，所述区块头包括三组元数据，分别为第一元数据组、第二元数据组和第三元数据组，所述第一元数据组包括索引数据，所述第二元数据组包括挖矿难度、随机数和时间戳，所述第三元数据组包括默克尔数根数据；
所述索引数据用于连接前面的区块和父区块的哈希值；
所述挖矿难度、随机数和时间戳用于工作量证明；
所述默克尔树根数据用于总结并归纳校验区块中所有交易数据；
所述区块体包括交易数据，所述交易数据包括但不限于DDoS的异常流量信息以及积分。
第二方面，本发明提供一种基于区块链的DDoS攻击联合防御方法，通过如第一方面任一项所述的基于区块链的DDoS攻击联合防御系统实现DDoS攻击发起设备的过滤，所述方法包括如下步骤：
边缘设备进行DDoS异常检测，得到DDoS异常流量信息，通过边缘设备本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链，区块链基于区块链共识机制实现各个边缘节点之间的信息共享；
基于攻击设备过滤规则和DDoS异常流量信息，区块链通过设备过滤智能合约向边 缘节点发送DDoS攻击设备过滤信息；
边缘节点基于DDoS攻击设备过滤信息对DDoS攻击设备进行过滤，并向DDoS攻击设备过滤信息的提供者提供积分进行奖励；
边缘节点基于DDoS异常流量信息进行DDoS异常检测模型训练并优化所述DDoS异常检测模型的参数，所述DDoS攻击设备过滤信息的提供者基于积分以区块链交易的方式向所述边缘节点获取上述优化后的参数。
作为优选，网络环境存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的信息摘要上传区块链，区块链基于区块链共识机制将所述DDoS异常流量信息的信息摘要同步至其它边缘节点；
网络环境不存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的详细信息上传区块链，区块链基于区块链共识机制将所述DDoS异常流量信息的详细信息同步至其它边缘节点；
区块链配置有信息共享模型，所述信息共享模型为S-Chain信息共享模型，包括：
设备过滤链，所述设备过滤链用于存储DDoS异常流量信息的信息摘要，并用于基于区块链共识机制将DDoS异常流量信息的信息摘要同步至其它边缘节点；
设备信息链，所述设备信息链用于存储DDoS异常流量信息的详细信息，用于基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点，DDoS异常流量信息的详细信息用于训练DDoS异常检测模型。
作为优选，DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量，包括如下步骤：
(1)对待检测的网络流量进行流量包提取；
(2)按照设备和时间进行特征包分组；
(3)对特征包进行特征向量提取；
(4)以提取的特征向量为测试数据，将测试数据输入随机森林，通过投票表决分类结果，决定测试数据的类别；
所述随机森林的构建方法为：
(1)从训练DDoS异常流量样本集中采用bootstrapping的方法有放回的重采样选出n个DDoS异常流量样本；
(2)从DDoS异常流量的所有属性中有选择地选出K个属性，选择最佳属性作为节点建立决策树；
(3)重复上述步骤m次，建立m棵决策树；
(4)上述m个决策树形成决策森林；
所述设备过滤智能合约中配置有攻击设备过滤规则，区块链基于所述攻击设备过滤规则和DDoS异常流量信息，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
所述攻击设备过滤规则为：按照DDoS攻击的特性，将异常设备进行等级划分，按照危险等级对设备的过滤顺序进行排列，并通过如下公式计算DDoS危险等级，所述公式为：
DL＝N·5％+T·5％+t·20％+F·40％+B·30％
其中，N表示连续次数，T表示连接周期，t表示连续持续时间，F表示发送数据包频率，B表示源到目标的字节计算。
本发明的基于区块链的DDoS攻击联合防御系统及方法具有以下优点：
1、区块链和智能合约的出现不但可以用于跨多个域间的信息交互还可以消除单点攻击的风险，通过使用基于区块链的交互方案具有灵活性的同时在一定程度上可以简化现有信息共享方法；
2、当存在攻击者试图攻击系统时需要控制网络中超过51％的边缘节点才能对网络造成破坏，该系统由众多的边缘节点组成，不存在集中式的中心节点，有效地避免了单点攻击的风险，具有强大的抗攻击能力；
3、信息存储分为三种形式：本地存储、设备过滤链存储以及设备信息存储，边缘节点检测到DDoS异常流量信息，部署在区块链上的设备摘要信息共享智能合约将DDoS异常流量信息的信息摘要上传至设备过滤链，当DDoS异常流量信息的信息摘要上传结束，并且网络中不存在DDoS攻击时，部署在区块链上的设备信息共享智能合约将DDoS异常流量信息上传至设备信息链，当本地存储的数据受到破坏时，可以随时下载区块链中的数据进行维护，从而保证了数据的完整性；
4、由于区块链中的数据是以默克尔树(Merkle Tree)的形式存储的，信息被修改后会立即暴露，同时，区块链的共识机制会做到将被修改过的区块执行数据一致性操作使恶意修改变得无效，确保了信息存储的安全性；
5、在区块链共识机制的作用下，新的边缘节点申请加入区块链网络需要得到区块链中任意边缘节点认证即可加入，一定程度上降低了所有节点共同验证所消耗的时间，提高了节点验证的速度，区块链中现有边缘节点首先验证新加入边缘节点的节点号的合法性，验证通过后新加入边缘节点将及下属的终端设备广播到网络中让其它边缘节点拥有该边缘节点及其下属的终端设备保证DDoS攻击防御顺利进行，设备扩展主要由部署在边缘节点的以太坊客户端中的集成方法进行验证，在验证过程中不存在外力的干扰，确保了安全性。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
下面结合附图对本发明进一步说明。
图1为实施例1基于区块链的DDoS攻击联合防御系统的网络架构图；
图2为实施例1基于区块链的DDoS攻击联合防御系统中防御模型的原理框图；
图3为实施例1基于区块链的DDoS攻击联合防御系统的工作原理框图；
图4为实施例2基于区块链的DDoS攻击联合防御方法的流程框图。
具体实施方式
下面结合附图和具体实施例对本发明作进一步说明，以使本领域的技术人员可以更好地理解本发明并能予以实施，但所举实施例不作为对本发明的限定，在不冲突的情况下，本发 明实施例以及实施例中的技术特征可以相互结合。
需要理解的是，
本发明实施例提供基于区块链的DDoS攻击联合防御系统及方法，用于解决如何实现安全、快速、有效的对DDoS攻击进行防御的技术问题。
实施例1：
如图1所示，本发明的一种基于区块链的DDoS攻击联合防御系统，包括终端设备、边缘设备和区块链，终端设备至少一个，DDoS攻击的发起源头为终端设备；边缘设备至少一个并均部署有以太坊客户端，边缘设备加入区块链网络作为边缘节点；区块链中部署有设备信息共享智能合约和设备过滤智能合约，区块链用于基于区块链共识机制实现各个边缘节点之间的信息共享。边缘设备用于进行DDoS异常检测，得到DDoS异常流量信息，通过本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链；基于攻击设备过滤规则和DDoS异常流量信息，区块链用于通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；边缘节点用于基于DDoS攻击设备过滤信息对DDoS攻击设备进行过滤，并向DDoS攻击设备过滤信息的提供者提供积分进行奖励；边缘节点基于DDoS异常流量信息以及积分进行DDoS异常检测模型训练。
本实施例中，终端设备包含人类生活中常见的智能交通灯，计算机以及智能摄像头等终端设备。通常情况下，DDoS攻击的发起源头为这些终端设备。上述多个终端设备组成终端层。
边缘设备为DDoS攻击发起者的主要攻击目标，边缘设备验证合法性后，加入区块链网络作为边缘节点，并将边缘节点下属的终端设备广播至区块链网络。区块链中现有边缘节点首先验证新加入边缘节点的节点号的合法性，验证通过后新加入边缘节点将及下属的终端设备广播到网络中让其它边缘节点拥有该边缘节点及其下属的终端设备保证DDoS攻击防御顺利进行。设备扩展主要由部署在边缘节点的以太坊客户端中的集成方法进行验证。
在本实施例中边缘设备主要承担DDoS异常检测、DDoS异常检测模型训练以及DDoS异常设备过滤的责任。
区块链由部署在边缘设备上的以太坊客户端构成，区块链主要通过区块链共识机制实现各边缘节点间的信息共享。部署以太坊客户端的边缘设备在验证通过后可以加入到区块链网络，新加入区块链网络的边缘设备通过区块链的共识机制实现与网络中原有边缘设备的数据一致性。
边缘节点基于DDoS异常检测模型对网络流量进行检测分类，DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量。
DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量，包括如下步骤：
(1)对待检测的网络流量进行流量包提取；
(2)按照设备和时间进行特征包分组；
(3)对特征包进行特征向量提取；
(4)以提取的特征向量为测试数据，将测试数据输入随机森林，通过投票表决分类结果，决定测试数据的类别。
随机决策森林由贝尔实验室的何天琴所提出，随后发展成随机森林的算法。该算法方法结合Breimans的Bootstrap aggregating想法和Ho的random subspace method 想法以建造决策树的集合。随机森林是一个包含多个决策树的分类器，并且其输出的类别是由所有决策树的输出结果进行统计，取票数最多的结果作为随机森林的最终输出结果而定。
原理为：从n个DDoS异常流量样本中有放回抽取n次，肯定会选择到相同DDoS异常流量样本的可能性。我们假设U(k)表示第k次抽取DDoS异常流量样本抽取到不同样本的概率。那么U(k-1)则表示第k-1次抽样抽取到DDoS异常流量不同样本的概率。
第k-1次抽样到DDoS异常流量不同样本的概率：U(k-1)，同时有nU(k-1)个DDoS异常流量样本还没有被抽取。第k次抽样时，还有nU(k-1)-U(k-1)的DDoS异常流量样本没有被抽取。因此
Figure PCTCN2021082097-appb-000001
其中，U(1)＝1。因此k次放回抽样的不同DDoS异常流量样本的期望值为：
Figure PCTCN2021082097-appb-000002
利用等比数列的性质，得到：
Figure PCTCN2021082097-appb-000003
当n足够大，并且k＝n的情况下：
Figure PCTCN2021082097-appb-000004
每一次bootstrapping采样重复抽取n次，只有63.2％的样本会被采样到。
随机森林实现流程为：
(1)从训练DDoS异常流量样本集中采用bootstrapping的方法有放回地重采样选出n个DDoS异常流量样本，即每棵树的训练数据集都是不同的，里面包含重复的DDoS异常流量训练样本。
(2)从DDoS异常流量的所有属性中有选择地选出K个属性，选择最佳属性作为节点建立决策树。
(3)重复以上步骤m次，即建立了m棵决策树。
(4)这m个决策树形成随机森林，通过投票表决分类结果，决定测试数据是属于哪一类。
网络环境存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的信息摘要上传区块链，区块链基于区块链共识机制将上述DDoS异常流量信息的信息摘要同步至其它边缘节点。
边缘节点间信息共享包括终端设备信息共享、DDoS异常流量信息的信息摘要共享和DDoS异常流量信息的详细信息共享。本实施例中编写设备信息共享智能合约，设计双链模式(Strong-Chain)的信息共享模型以来以太坊区块链平台的POW共识机制共同作用实现各边缘节点之间信息共享。
如图3所示，信息共享模型为S-Chain信息共享模型，该信息共享模型由两条私有链组成，即设备过滤链和设备信息链，设备过滤链主要存储DDoS异常流量信息的信息摘要，DDoS异常流量信息的信息摘要包括攻击者IP地址，攻击者MAC地址，受害者IP地址；设备过滤链的主要目的是将边缘节点检测到的DDoS异常流量信息在第一时间同步到其它边缘节点，帮助被攻击的边缘节点能够准确、快速的过滤DDoS攻击的发起设备。设备信息链主要存储DDoS异常流量信息的详细信息，用于基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点，其主要目的是当DDoS攻击检测模型无法准确检测DDoS异常流量信息时为模型提供最新的DDoS异常流量信息对模型进行训练，使DDoS攻击检测模型始终保持较高的识别率。
在设备信息共享智能合约作用的区块链网络环境中S-Chain信息共享模型通过以下过程实现边缘节点间的DDoS异常流量信息共享。
(1)网络环境不存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的详细信息上传区块链，区块链基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点；
(2)区块链由创世区块和普通区块两类组成，按照时间顺序将数据区块以顺序相连的方式组合成的一种链式数据结构；
(3)其它边缘节点收到同步信息后首先验证信息发送方的身份和发送信息的合法性。当两者信息均验证通过后更新本地的DDoS异常流量信息的信息摘要库和DDoS异常流量信息详细信息库。
创世区块是区块链中的第一个区块，其区块序号是0。它是区块链中唯一一个不指向前一个区块的区块，同时，它也不包含任何交易信息。各边缘节点间的信息同步是由创世区块决定的，如果网络中的两个对等的边缘节点有相同的创世区块，那么边缘节点彼此间进行配对并同步区块，否则它们将彼此拒绝。
普通区块，在区块链中除创世区块外其它的区块都是普通区块。每个区块由区块头(Block Header)和区块体(Block)组成。区块头包括三组元数据，分别为第一元数据组、第二元数据组和第三元数据组，第一元数据组包括用于连接前面的区块、父区块哈希值的索引数据，第二元数据组包括用于工作量证明的挖矿难度、随机数和时间戳，随机数(Nonce)作为工作量证明算法的计数器，第三元数据组包括能够总结并快速归纳校验区块中所有交易数据的Merkle(默克尔)树根数据。区块体主要是包含交易数据(Transaction，TX)，交易数据包括DDoS的异常流量信息以及积分等。
DDoS异常流量信息的信息摘要添加成功后会自动触发设备过滤智能合约，设备过滤智能合约根据预设的规则进行计算，最后将过滤信息发送给对应边缘节点以太坊客户端，进而通过边缘节点对异常设备进行过滤同时免受损害的边缘节点向DDoS异常流量信息发布边缘节点提供积分奖励。
本实施例中，设备过滤智能合约中配置有攻击设备过滤规则，区块链基于攻击设备过滤规则和DDoS异常流量信息，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息。攻击设备过滤规则为：按照DDoS攻击的特性，将异常设备进行等级的划分，然后按照危险等级对设备的过滤顺序进行排列。如表1所示，DDoS攻击的评分规则和权重，通过规则制定DDoS危险等级(DL)。计算公式如下：
DL＝N·5％+T·5％+t·20％+F·40％+B·30％
表1评分及权值分布：
评分规则 权重(％)
连接次数(N) 5
连接周期(T) 5
连接持续时间(t) 20
发送数据包频率(F) 40
源到目标的字节计数(B) 30
如图2所示，边缘节点通过防御模型对攻击者进行过滤，防御模型包括无偿防御模型和有偿防御模型。
无偿防御模型应用于攻击者和受害者属于同一个边缘节点的场景，无偿防御模型检测到DDoS异常流量信息后，边缘节点根据DDOS异常流量信息查询攻击者对应的IP地址和MAC地址，在DDoS异常设备过滤过程中，边缘节点对攻击者的IP地址以及攻击者下属终端设备的MAC地址进行过滤；
有偿防御模型应用于攻击者和受害者属于不同边缘节点的场景，有偿防御模型检测到DDoS异常流量信息后，边缘节点基于设备信息共享智能合约将DDoS异常流量信息广播至区块链，其它边缘节点接收到所述DDoS异常流量信息后，根据所述DDoS异常流量信息查询攻击者对应的IP地址和MAC地址，如果收到所述DDoS异常流量信息的其它边缘节点下属的终端设备存在攻击者或受害者，所述其它边缘节点将攻击者或伪装者过滤，同时向提供所述DDoS异常流量信息的边缘节点提供积分；如果收到DDoS异常流量信息的其它边缘节点下属的终端设备不存在攻击者或受害者，当收到DDoS异常流量信息的其它边缘节点下存在新的终端设备加入到所述其它边缘节点时，需要查询所述DDoS流量信息，若发布所述上述DDoS异常流量信息的边缘节点共享的DDoS异常流量信息帮助所述其它边缘节点过滤恶意设备的接入，所述其它边缘节点为提供所述DDoS异常流量信息的边缘节点提供积分。
如图3所示，本发明基提出的一种基于区块链的DDoS攻击联合防御系统，在系统由所有的物联网设备如边缘设备和终端设备共同参与完成。
边缘节点A(存在受害者的边缘节点)，如附图3中疏虚线所示，当终端设备A1作为DDoS发起的攻击者对终端设备D1(受害者)发起攻击时边缘节点A将会检测到终端设备A1存在异常通信行为后将终端设备A1的信息(如：IP地址，MAC地址，每秒钟的连接次数以及被攻击者IP)通过S-Chain信息共享模型实现DDoS异常流量信息共享。边缘节点B、边缘节点C以及边缘节点D收到共享后信息后分别更新本地异常设备信息表，并且通过终端设备A1的MAC地址查询其下属终端设备是否存在伪造者(如图3中密虚线所示边缘设备A1伪造边缘设备B2的IP地址向边缘设备D1发起持续攻击，进而对物联网设备资源过度消耗的影响)或受害者。
边缘节点B(存在伪造者的边缘节点)：通过查询本地异常设备信息表中的MAC地址和受害者的IP地址发现其下属终端设备B2为伪造者(不存在受害者)，边缘节点B将终端设备B2的信息共享到网络中。由于边缘节点B通过边缘节点A提供的DDoS异常流量信息过滤了伪造者，因此边缘节点B需要向边缘节点A提供信息共享积分。
边缘节点C(正常的边缘节点)：通过查询本地异常设备信息表中的MAC地址和受害者的IP地址发现其下属终端设备不存在伪造者和受害者，边缘节点C暂时不用为边 缘节点A提供信息共享积分。当新的终端设备加入到边缘节点C时，边缘节点C会自动检测该终端设备的MAC地址是否在本地异常设备信息表中，如果存在则禁止该设备加入到边缘节点C，同时向边缘节点A提供信息共享积分。
边缘节点D(存在受害者的边缘节点)通过查询本地异常设备信息表中的MAC和受害者的IP地址发现其下属终端设备存在受害者(不存在伪造者)，边缘节点D向边缘设备A和边缘设备B提供信息共享积分。当边缘节点A，边缘节点B收到边缘节点D提供的信息共享积分后分别过滤其下属的终端设备A1和终端设备B2。
本发明的基于区块链的DDoS攻击联合防御系统，假定存在DDoS攻击发起设备对区块链网络中某一终端设备发起DDoS攻击，工作流程为：
(1)部署边缘节点的DDoS攻击检测模型将自动识别DDoS攻击异常流量；
(2)边缘节点通过设备过滤信息共享智能合约将DDoS异常流量信息的信息摘要上传至设备过滤链，其它边缘节点根据区块链的共识机制实现各边缘节点间DDoS异常流量信息的信息摘要同步(在网络环境不存在DDoS攻击的情况下，边缘设备将上一次检测到的DDoS异常流量信息的详细信息通过设备信息共享智能合约上传至设备信息链，其它边缘节点根据区块链的共识机制实现各边缘节点间DDoS异常流量信息的详细信息同步；
(3)根据共享的DDoS异常流量信息和攻击设备过滤规则，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
(4)边缘节点根据接收到的攻击设备过滤信息对攻击设备进行过滤，并向该攻击设备过滤信息的提供者(DDoS异常信息提供边缘设备)提供积分奖励，获得积分的其它边缘节点可以通过积分优先进行DDoS攻击检测模型的更新以保持DDoS检测模型能够检测最新的DDoS攻击信息。
边缘节点可以根据其检测到的DDos异常流量信息对本地的DDos异常检测模型进行训练，以优化其参数，获得积分的其它边缘节点通过区块链交易的方式向边缘节点获取其优化后的参数。以积分和优化后的参数作为交易对象，基于积分通过区块链交易的方式获取优化后的参数，选用现有已公开的区块链交易方式。
实施例2：
本发明的基于区块链的DDoS攻击联合防御方法，通过实施例1公开的基于区块链的DDoS攻击联合防御系统实现DDoS攻击发起设备的过滤。
如图4所示，该方法包括如下步骤：
S100、边缘设备进行DDoS异常检测，得到DDoS异常流量信息，通过边缘设备本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链，区块链基于区块链共识机制实现各个边缘节点之间的信息共享；
S200、基于攻击设备过滤规则和DDoS异常流量信息，区块链通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
S300、。
DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量，包括如下步骤：
(1)对待检测的网络流量进行流量包提取；
(2)按照设备和时间进行特征包分组；
(3)对特征包进行特征向量提取；
(4)以提取的特征向量为测试数据，将测试数据输入随机森林，通过投票表决分类结果，决定测试数据的类别。
随机决策森林由贝尔实验室的何天琴所提出，随后发展成随机森林的算法。该算法方法结合Breimans的Bootstrap aggregating想法和Ho的random subspace method想法以建造决策树的集合。随机森林是一个包含多个决策树的分类器，并且其输出的类别是由所有决策树的输出结果进行统计，取票数最多的结果作为随机森林的最终输出结果而定。
原理为：从n个DDoS异常流量样本中有放回抽取n次，肯定会选择到相同DDoS异常流量样本的可能性。我们假设U(k)表示第k次抽取DDoS异常流量样本抽取到不同样本的概率。那么U(k-1)则表示第k-1次抽样抽取到DDoS异常流量不同样本的概率。
第k-1次抽样到DDoS异常流量不同样本的概率：U(k-1)，同时有nU(k-1)个DDoS异常流量样本还没有被抽取。第k次抽样时，还有nU(k-1)-U(k-1)的DDoS异常流量样本没有被抽取。因此
Figure PCTCN2021082097-appb-000005
其中，U(1)＝1。因此k次放回抽样的不同DDoS异常流量样本的期望值为：
Figure PCTCN2021082097-appb-000006
利用等比数列的性质，得到：
Figure PCTCN2021082097-appb-000007
当n足够大，并且k＝n的情况下：
Figure PCTCN2021082097-appb-000008
每一次bootstrapping采样重复抽取n次，只有63.2％的样本会被采样到。
随机森林实现流程为：
(1)从训练DDoS异常流量样本集中采用bootstrapping的方法有放回地重采样选出n个DDoS异常流量样本，即每棵树的训练数据集都是不同的，里面包含重复的DDoS异常流量训练样本。
(2)从DDoS异常流量的所有属性中有选择地选出K个属性，选择最佳属性作为节点建立决策树。
(3)重复以上步骤m次，即建立了m棵决策树。
(4)这m个决策树形成随机森林，通过投票表决分类结果，决定测试数据是属于哪一类。
网络环境存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的信息摘要上传区块链，区块链基于区块链共识机制将所述DDoS异常流量信息的信息摘要同步至其它边缘节点。
边缘节点间信息共享包括终端设备信息共享、DDoS异常流量信息的信息摘要共享和DDoS异常流量信息的详细信息共享。本实施例中编写设备信息共享智能合约，设计双链模式(Strong-Chain)的信息共享模型以来以太坊区块链平台的POW共识机制共同作用实现各边缘节点之间信息共享。
信息共享模型为S-Chain信息共享模型，该信息共享模型由两条私有链组成，即设备过滤链和设备信息链，设备过滤链主要存储DDoS异常流量信息的信息摘要，DDoS异常流量信息的信息摘要包括攻击者IP地址，攻击者MAC地址，受害者IP地址；设备过滤链的主要目的是将边缘节点检测到的DDoS异常流量信息在第一时间同步到其它边缘节点，帮助被攻击的边缘节点能够准确、快速的过滤DDoS攻击的发起设备。设备信息链主要存储DDoS异常流量信息的详细信息，用于基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点，其主要目的是当DDoS攻击检测模型无法准确检测DDoS异常流量信息时为模型提供最新的DDoS异常流量信息对模型进行训练，使DDoS攻击检测模型始终保持较高的识别率。
在设备信息共享智能合约作用的区块链网络环境中S-Chain信息共享模型通过以下过程实现边缘节点间的DDoS异常流量信息共享。
(1)网络环境不存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的详细信息上传区块链，区块链基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点；
(2)区块链由创世区块和普通区块两类组成，按照时间顺序将数据区块以顺序相连的方式组合成的一种链式数据结构；
(3)其它边缘节点收到同步信息后首先验证信息发送方的身份和发送信息的合法性。当两者信息均验证通过后更新本地的DDoS异常流量信息的信息摘要库和DDoS异常流量信息详细信息库。
DDoS异常流量信息的信息摘要添加成功后会自动触发设备过滤智能合约，设备过滤智能合约根据预设的规则进行计算，最后将过滤信息发送给对应边缘节点以太坊客户端，进而通过边缘节点对异常设备进行过滤同时免受损害的边缘节点向DDoS异常流量信息发布边缘节点提供积分奖励。
设备过滤智能合约中配置有攻击设备过滤规则，区块链基于攻击设备过滤规则和DDoS异常流量信息，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息。本实施例攻击设备过滤规则为：按照DDoS攻击的特性，将异常设备进行等级的划分，然后按照危险等级对设备的过滤顺序进行排列。DDoS攻击的评分规则和权重，通过规则制定DDoS危险等级(DL)。计算公式如下：
DL＝N·5％+T·5％+t·20％+F·40％+B·30％
其中，N表示连续次数，T表示连接周期，t表示连续持续时间，F表示发送数据包频率，B表示源到目标的字节计算。
上文通过附图和优选实施例对本发明进行了详细展示和说明，然而本发明不限于这些已揭示的实施例，基与上述多个实施例本领域技术人员可以知晓，可以组合上述不同实施例中的代码审核手段得到本发明更多的实施例，这些实施例也在本发明的保护范围之内。

Claims (10)

  1. 基于区块链的DDoS攻击联合防御系统，其特征在于包括：
    终端设备，所述终端设备至少一个，DDoS攻击的发起源头为终端设备；
    边缘设备，所述边缘设备至少一个并均部署有以太坊客户端，所述边缘设备验证合法性后，加入区块链网络作为边缘节点，并将所述边缘节点下属的终端设备广播至区块链网络；
    区块链，所述区块链中部署有设备信息共享智能合约和设备过滤智能合约，所述区块链用于基于区块链共识机制实现各个边缘节点之间的信息共享；
    所述边缘设备用于进行DDoS异常检测，得到DDos异常流量信息，通过本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链；
    基于设备过滤智能合约和DDoS异常流量信息，所述区块链用于通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
    所述边缘节点用于基于DDoS攻击设备过滤信息对DDos攻击设备进行过滤，并向DDoS攻击设备过滤信息的提供者提供积分进行奖励；
    所述边缘节点用于基于DDoS异常流量信息进行DDoS异常检测模型训练并优化所述DDoS异常检测模型的参数，所述积分用于支持所述DDoS攻击设备过滤信息的提供者以区块链交易的方式向所述边缘节点获取上述优化后的参数。
  2. 根据权利要求1所述的基于区块链的DDoS防御系统，其特征在于网络环境存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的信息摘要上传区块链，所述区块链基于区块链共识机制将所述DDoS异常流量信息的信息摘要同步至其它边缘节点；
    网络环境不存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的详细信息上传区块链，所述区块链基于区块链共识机制将所述DDoS异常流量信息的详细信息同步至其它边缘节点。
  3. 根据权利要求2所述的基于区块链的DDoS防御系统，其特征在于所述区块链配置有信息共享模型，所述信息共享模型为S-Chain信息共享模型，包括：
    设备过滤链，所述设备过滤链用于存储DDoS异常流量信息的信息摘要，并用于基于区块链共识机制将DDoS异常流量信息的信息摘要同步至其它边缘节点；
    设备信息链，所述设备信息链用于存储DDoS异常流量信息的详细信息，用于基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点，DDoS异常流量信息的详细信息用于训练DDoS异常检测模型。
  4. 根据权利要求1所述的基于区块链的DDoS防御系统，其特征在于所述边缘节点基于DDoS异常检测模型对网络流量进行检测分类；
    DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量，包括如下步骤：
    (1)对待检测的网络流量进行流量包提取；
    (2)按照设备和时间进行特征包分组；
    (3)对特征包进行特征向量提取；
    (4)以提取的特征向量为测试数据，将测试数据输入随机森林，通过投票表决分类结果，决定测试数据的类别；
    所述随机森林的构建方法为：
    (1)从训练DDoS异常流量样本集中采用bootstrapping的方法有放回的重采样选出n个DDoS异常流量样本；
    (2)从DDoS异常流量的所有属性中有选择地选出K个属性，选择最佳属性作为节点建立决策树；
    (3)重复上述步骤m次，建立m棵决策树；
    (4)上述m个决策树形成决策森林。
  5. 根据权利要求1所述的基于区块链的DDoS防御系统，其特征在于所述设备过滤智能合约中配置有攻击设备过滤规则，区块链用于基于所述攻击设备过滤规则和DDoS异常流量信息，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
    所述攻击设备过滤规则为：按照DDoS攻击的特性，将异常设备进行等级划分，按照危险等级对设备的过滤顺序进行排列，并通过如下公式计算DDoS危险等级，所述公式为：
    DL＝N·5％+T·5％+t·20％+F·40％+B·30％
    其中，N表示连续次数，T表示连接周期，t表示连续持续时间，F表示发送数据包频率，B表示源到目标的字节计算。
  6. 根据权利要求1所述的基于区块链的DDoS防御系统，其特征在于所述边缘节点通过防御模型对攻击者进行过滤，所述防御模型包括：
    无偿防御模型，所述无偿防御模型应用于攻击者和受害者属于同一个边缘节点的场景，无偿防御模型检测到DDoS异常流量信息后，边缘节点根据DDoS异常流量信息查询攻击者对应的IP地址和MAC地址，在DDoS异常设备过滤过程中，边缘节点对攻击者的IP地址以及攻击者下属终端设备的MAC地址进行过滤；
    有偿防御模型，所述有偿防御模型应用于攻击者和受害者属于不同边缘节点的场景，有偿防御模型检测到DDoS异常流量信息后，边缘节点基于设备信息共享智能合约将DDoS异常流量信息广播至区块链，其它边缘节点接收到所述DDoS异常流量信息后，根据所述DDoS异常流量信息查询攻击者对应的IP地址和MAC地址，如果收到所述DDoS异常流量信息的其它边缘节点下属的终端设备存在攻击者或受害者，所述其它边缘节点将攻击者或伪装者过滤，同时向提供所述DDoS异常流量信息的边缘节点提供积分；如果收到DDoS异常流量信息的其它边缘节点下属的终端设备不存在攻击者或受害者，当收到DDoS异常流量信息的其它边缘节点下存在新的终端设备加入到所述其它边缘节点时，需要查询所述DDoS流量信息，若发布所述DDoS异常流量信息的边缘节点共享的DDoS异常流量信息帮助所述其它边缘节点过滤恶意设备的接入，所述其它边缘节点为提供所述DDoS异常流量信息的边缘节点提供积分。
  7. 根据权利要求1所述的基于区块链的DDoS防御系统，其特征在于所述区块链由创世区块和普通区块组成；
    所述创世区块为区块链中第一个区块，区块序号为0，区块链网络中两个对等的边缘节点具有相同的区块，所述两个对等的边缘节点彼此之间配对并同步区块；
    所述普通区块由区块头和区块体组成，所述区块头包括三组元数据，分别为第一元数据组、第二元数据组和第三元数据组，所述第一元数据组包括索引数据，所述第二元数据组包括挖矿难度、随机数和时间戳，所述第三元数据组包括默克尔数根数据；
    所述索引数据用于连接前面的区块和父区块的哈希值；
    所述挖矿难度、随机数和时间戳用于工作量证明；
    所述默克尔树根数据用于总结并归纳校验区块中所有交易数据；
    所述区块体包括交易数据，所述交易数据包括但不限于DDoS的异常流量信息以及积分。
  8. 基于区块链的DDoS攻击联合防御方法，其特征在于通过如权利要求1-7任一项所述的基于区块链的DDoS攻击联合防御系统实现DDoS攻击发起设备的过滤，所述方法包括如下步骤：
    边缘设备进行DDoS异常检测，得到DDoS异常流量信息，通过边缘设备本地数据存储DDoS异常流量信息，并基于设备信息共享智能合约将DDoS异常流量信息上传区块链，区块链基于区块链共识机制实现各个边缘节点之间的信息共享；
    基于攻击设备过滤规则和DDoS异常流量信息，区块链通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
    边缘节点基于DDoS攻击设备过滤信息对DDoS攻击设备进行过滤，并向DDoS攻击设备过滤信息的提供者提供积分进行奖励；
    边缘节点基于DDoS异常流量信息进行DDoS异常检测模型训练并优化所述DDoS异常检测模型的参数，所述DDoS攻击设备过滤信息的提供者基于积分以区块链交易的方式向所述边缘节点获取上述优化后的参数。
  9. 根据权利要求8所述的基于区块链的DDoS攻击联合防御方法，其特征在于网络环境存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的信息摘要上传区块链，区块链基于区块链共识机制将所述DDoS异常流量信息的信息摘要同步至其它边缘节点；
    网络环境不存在DDoS攻击的情况下，边缘节点基于设备信息共享智能合约将DDoS异常流量信息的详细信息上传区块链，区块链基于区块链共识机制将所述DDoS异常流量信息的详细信息同步至其它边缘节点；
    区块链配置有信息共享模型，所述信息共享模型为S-Chain信息共享模型，包括：
    设备过滤链，所述设备过滤链用于存储DDoS异常流量信息的信息摘要，并用于基于区块链共识机制将DDoS异常流量信息的信息摘要同步至其它边缘节点；
    设备信息链，所述设备信息链用于存储DDoS异常流量信息的详细信息，用于基于区块链共识机制将DDoS异常流量信息的详细信息同步至其它边缘节点，DDoS异常流量信息的详细信息用于训练DDoS异常检测模型。
  10. 根据权利要求8或9所述的基于区块链的DDoS攻击联合防御方法，其特征在于DDoS异常检测模型通过RF算法识别DDoS攻击流量和正常流量，包括如下步骤：
    (1)对待检测的网络流量进行流量包提取；
    (2)按照设备和时间进行特征包分组；
    (3)对特征包进行特征向量提取；
    (4)以提取的特征向量为测试数据，将测试数据输入随机森林，通过投票表决分类结果，决定测试数据的类别；
    所述随机森林的构建方法为：
    (1)从训练DDoS异常流量样本集中采用bootstrapping的方法有放回的重采样选 出n个DDoS异常流量样本；
    (2)从DDoS异常流量的所有属性中有选择地选出K个属性，选择最佳属性作为节点建立决策树；
    (3)重复上述步骤m次，建立m棵决策树；
    (4)上述m个决策树形成决策森林；
    所述设备过滤智能合约中配置有攻击设备过滤规则，区块链基于所述攻击设备过滤规则和DDoS异常流量信息，通过设备过滤智能合约向边缘节点发送DDoS攻击设备过滤信息；
    所述攻击设备过滤规则为：按照DDoS攻击的特性，将异常设备进行等级划分，按照危险等级对设备的过滤顺序进行排列，并通过如下公式计算DDoS危险等级，所述公式为：
    DL＝N·5％+T·5％+t·20％+F·40％+B·30％
    其中，N表示连续次数，T表示连接周期，t表示连续持续时间，F表示发送数据包频率，B表示源到目标的字节计算。
PCT/CN2021/082097 2020-11-13 2021-03-22 基于区块链的DDoS攻击联合防御系统及方法 WO2022099966A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011267709.X 2020-11-13
CN202011267709.XA CN112491823B (zh) 2020-11-13 2020-11-13 基于区块链的DDoS攻击联合防御系统及方法

Publications (1)

Publication Number Publication Date
WO2022099966A1 true WO2022099966A1 (zh) 2022-05-19

Family

ID=74930171

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/082097 WO2022099966A1 (zh) 2020-11-13 2021-03-22 基于区块链的DDoS攻击联合防御系统及方法

Country Status (2)

Country Link
CN (1) CN112491823B (zh)
WO (1) WO2022099966A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115102767A (zh) * 2022-06-24 2022-09-23 天津大学 一种基于分布式协作学习的DDoS主动防御系统及方法
CN116132080A (zh) * 2022-05-29 2023-05-16 北京理工大学长三角研究院(嘉兴) 一种基于移动目标防御技术的联盟链DDoS防御方法
CN116828087A (zh) * 2023-06-25 2023-09-29 北京中科网芯科技有限公司 基于区块链连接的信息安全系统

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491823B (zh) * 2020-11-13 2022-07-19 齐鲁工业大学 基于区块链的DDoS攻击联合防御系统及方法
CN113315752B (zh) * 2021-04-22 2022-02-25 深圳市腾云数据系统有限公司 基于区块链的智慧医疗攻击追溯方法及医疗大数据系统
CN113392429B (zh) * 2021-05-26 2023-12-12 江苏省电力试验研究院有限公司 基于区块链的配电物联网数据安全防护方法、装置
CN114024739B (zh) * 2021-11-03 2024-02-06 中国联合网络通信集团有限公司 抗DDoS攻击协同防御方法、平台、设备及介质
CN114143828A (zh) * 2021-11-09 2022-03-04 中国联合网络通信集团有限公司 一种终端接入管理方法及装置
CN114285606B (zh) * 2021-12-08 2023-08-08 深圳市星华时代科技有限公司 一种针对物联网管理的DDoS多点协作式防御方法
CN114520774B (zh) * 2021-12-28 2024-02-23 武汉虹旭信息技术有限责任公司 基于智能合约的深度报文检测方法及装置
CN114500071B (zh) * 2022-02-10 2024-04-16 江苏大学 一种针对目标网站动态增长的自适应指纹攻击方法和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108616534A (zh) * 2018-04-28 2018-10-02 中国科学院信息工程研究所 一种基于区块链防护物联网设备DDoS攻击的方法及系统
US20200204580A1 (en) * 2018-12-19 2020-06-25 Mcafee, Llc Using a blockchain for distributed denial of service attack mitigation
CN111541704A (zh) * 2020-04-28 2020-08-14 深圳中科国威信息系统技术有限公司 区块链与物联网联合防恶意攻击的方法、设备及存储设备
CN112491823A (zh) * 2020-11-13 2021-03-12 齐鲁工业大学 基于区块链的DDoS攻击联合防御系统及方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11196623B2 (en) * 2016-12-30 2021-12-07 Intel Corporation Data packaging protocols for communications between IoT devices
CN109427012B (zh) * 2017-08-22 2021-06-01 汇链丰(北京)科技有限公司 一种基于区块链的交易和验证方法
CN110113328B (zh) * 2019-04-28 2021-01-15 武汉理工大学 一种基于区块链的软件定义机会网络DDoS防御方法
CN110598446A (zh) * 2019-09-16 2019-12-20 腾讯科技（深圳）有限公司 基于区块链的测试方法、装置、存储介质和计算机设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108616534A (zh) * 2018-04-28 2018-10-02 中国科学院信息工程研究所 一种基于区块链防护物联网设备DDoS攻击的方法及系统
US20200204580A1 (en) * 2018-12-19 2020-06-25 Mcafee, Llc Using a blockchain for distributed denial of service attack mitigation
CN111541704A (zh) * 2020-04-28 2020-08-14 深圳中科国威信息系统技术有限公司 区块链与物联网联合防恶意攻击的方法、设备及存储设备
CN112491823A (zh) * 2020-11-13 2021-03-12 齐鲁工业大学 基于区块链的DDoS攻击联合防御系统及方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116132080A (zh) * 2022-05-29 2023-05-16 北京理工大学长三角研究院(嘉兴) 一种基于移动目标防御技术的联盟链DDoS防御方法
CN115102767A (zh) * 2022-06-24 2022-09-23 天津大学 一种基于分布式协作学习的DDoS主动防御系统及方法
CN115102767B (zh) * 2022-06-24 2023-06-30 天津大学 一种基于分布式协作学习的DDoS主动防御系统及方法
CN116828087A (zh) * 2023-06-25 2023-09-29 北京中科网芯科技有限公司 基于区块链连接的信息安全系统
CN116828087B (zh) * 2023-06-25 2024-01-16 北京中科网芯科技有限公司 基于区块链连接的信息安全系统

Also Published As

Publication number Publication date
CN112491823A (zh) 2021-03-12
CN112491823B (zh) 2022-07-19

Similar Documents

Publication Publication Date Title
WO2022099966A1 (zh) 基于区块链的DDoS攻击联合防御系统及方法
JP7408619B2 (ja) ブロックチェーンネットワークにおいて大規模分散メモリプールを管理するためのコンピュータ実装されたシステム及び方法
CN110113328B (zh) 一种基于区块链的软件定义机会网络DDoS防御方法
US11177939B2 (en) Blockchain system including a distributed network of a plurality of nodes and a method for achieving an agreement between the plurality of nodes executed by processors of the block chain system
CN107888562B (zh) 一种平行链接入互联链的数据验证和收发方法、节点及系统
CN109150972B (zh) 一种双层分片的高效区块链的共识机制的工作方法
JP7154234B6 (ja) ブロックチェーン・ネットワークにおける高速伝搬のための方法及び特殊ネットワーク・ノード
CN108881169B (zh) 基于区块链的时间分发和同步方法及系统、数据处理系统
EP3545665B1 (en) System and method for detecting replay attack
Liberatore et al. Forensic investigation of peer-to-peer file sharing networks
CN109525397B (zh) 一种面向sdn网络流规则安全保障的区块链及方法
CN100413290C (zh) 设置边界网关协议路由选择通知功能的方法
KR102046059B1 (ko) 블록체인의 정보변경장치 및 방법
CN115378604B (zh) 一种基于信誉值机制的边缘计算终端设备的身份认证方法
US11372847B2 (en) Block verification device, block verification method, and program
KR20200081533A (ko) 사물 인터넷 환경을 위한 동적 블라인드 투표기반의 블록체인 합의방법
CN115865378A (zh) 一种基于区块链的流媒体实时存证与校验方法
CN115664682A (zh) 基于联盟链主从多链的医疗数据共享的共识方法
CN115796261A (zh) 一种基于区块链的轻量级分组共识的联邦学习方法
WO2020215269A1 (en) Method and apparatus for distributed ledger
CN111490977B (zh) 一种基于dag区块链的防arp欺骗攻击方法及平台端
TWI596498B (zh) FedMR-based botnet reconnaissance method
Doss et al. Packet integrity defense mechanism in OppNets
Gojka et al. Security in distributed ledger technology: An analysis of vulnerabilities and attack vectors
Kowalski et al. Toward the mutual routing security in wide area networks: A scoping review of current threats and countermeasures

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21890502

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 21890502

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 24/11/2023)