CN117675381A - Reflection attack detection method and system based on port data and electronic equipment - Google Patents

Abstract

The invention discloses a reflection attack detection method, system and electronic equipment based on port data, and relates to the technical field of computer network security. The method includes: constructing a training set based on public network traffic; public network traffic is port data; using the training set to train a machine learning model to obtain a reflection attack detection model; obtaining the feature vector of the public network real-time traffic as a real-time feature vector; inputting the real-time feature vector Go to the reflection attack detection model to obtain the reflection attack detection results. The present invention builds a data set based on port data to train a reflection attack detection model, which can improve the detection accuracy of reflection attacks.

Description

A reflection attack detection method, system and electronic device based on port data

Technical field

The invention relates to the technical field of computer network security, and in particular to a reflection attack detection method, system and electronic equipment based on port data.

Background technique

In recent years, Internet attacks have increased significantly, and attack traffic has also increased significantly. Attack traffic exceeding 1Gb has frequently appeared, seriously endangering Internet security. Distributed Denial of Service (DDoS) attacks have always been a focus of network security research. hot topics in. User Datagram Protocol (UDP) reflection DDoS attack (hereinafter referred to as UDP reflection attack) is a major type of attack in DDoS attacks. UDP reflection attacks are DDoS attacks initiated by exploiting vulnerable application layer service protocols (hereinafter referred to as service protocols). These services all use UDP as the transmission protocol. According to the 2017 "China Internet Network Security Situation Review", the number of high-traffic DDoS attacks continued to increase throughout the year in 2017. The number of attacks above 10Gbps reached an average of 133 per day throughout the year, accounting for 29.4% of the average daily attack events. In addition, the number of attacks above 100Gbps The average number of attacks per day reaches more than 6. In terms of attack methods, reflection attacks still dominate. Therefore, feature extraction and identification technology of reflection attacks are crucial to maintaining Internet security.

The existing packet feature extraction method for DDoS intrusion detection divides DDoS attacks into five categories: spoofing attacks, traffic attacks, reflection attacks, slow connection attacks and connection exhaustion attacks according to the message protocol, and extracts them for different types. Feature vectors increase the dimension and expressiveness of attack message features and complete the identification of DDoS attack messages. However, this method uses data sets obtained through self-attacks in the experimental environment for feature extraction, and its detection accuracy is limited in practical applications. dropped.

Contents of the invention

The purpose of the present invention is to provide a reflection attack detection method, system and electronic device based on port data, which can improve the detection accuracy of reflection attacks.

In order to achieve the above objects, the present invention provides the following solutions:

A reflection attack detection method based on port data, including:

Construct a training set based on public network traffic; the public network traffic is port data;

Use the training set to train a machine learning model to obtain a reflection attack detection model;

Obtaining the feature vector of real-time traffic on the public network is a real-time feature vector; the feature vector includes the protocol type, the number of packets received per unit time, the length of the packet, the standard deviation of the source port number per unit time, and the target port number per unit time. standard deviation;

The real-time feature vector is input into the reflection attack detection model to obtain a reflection attack detection result; the reflection attack detection result is whether the public network real-time traffic is reflection attack traffic.

Optionally, build a training set based on public network traffic, including:

Construct an empty set as a data set;

Get the current public network traffic;

Preprocess the current public network traffic to obtain the preprocessed current public network traffic;

According to the preprocessed current public network traffic, determine the bandwidth amplification factor and message amplification factor of the current public network traffic;

Determine the traffic type of the current public network traffic according to the bandwidth amplification factor and the message amplification factor; the traffic type includes normal traffic and reflection attack traffic;

When the traffic type of the current public network traffic is reflection attack traffic, extract the feature vector of the current public network traffic;

Add the feature vector of the current public network traffic to the data set;

Update the current public network traffic, and return to the step "Preprocess the current public network traffic to obtain the preprocessed current public network traffic" until the number of feature vectors in the data set reaches the quantity threshold, and determine the data set is the training set.

Optionally, the bandwidth amplification factor is:

Among them, BAF is the bandwidth amplification factor; len(UDP payload)atv is the UDP payload length of the amplifier reply message within unit time Δt; len(UDP payload)ata is the UDP payload length of the request message received by the amplifier within unit time Δt.

Optionally, the message amplification factor is:

Among them, PAF is the message amplification factor; Num _atv is the number of reply messages from the amplifier in unit time Δt; Num _ata is the number of request messages received by the amplifier in unit time Δt.

Optionally, determine the traffic type of the current public network traffic based on the bandwidth amplification factor and the message amplification factor, including:

Determine whether the current public network traffic meets the normal traffic conditions according to the bandwidth amplification factor and the message amplification factor, and obtain a judgment result; the normal traffic condition is that the bandwidth amplification factor is less than the bandwidth amplification factor threshold, and the message The amplification factor is less than the message amplification factor threshold;

If the judgment result is yes, it is determined that the traffic type of the current public network traffic is normal traffic;

If the judgment result is no, it is determined that the traffic type of the current public network traffic is reflection attack traffic.

Optionally, use the training set to train a machine learning model to obtain a reflection attack detection model, including:

Using the feature vector as input and whether the public network traffic is reflection attack traffic as the output, the machine learning model is trained to obtain a reflection attack detection model.

Optionally, after inputting the real-time feature vector into the reflection attack detection model and obtaining the reflection attack detection result, it also includes:

When the reflection attack detection result is reflection attack traffic, add the real-time feature vector to the training set, and return to the step of "using the training set to train a machine learning model to obtain a reflection attack detection model."

A reflection attack detection system based on port data, including:

A training set construction module, used to construct a training set based on public network traffic; the public network traffic is port data;

A reflection attack detection model training module, used to train a machine learning model using the training set to obtain a reflection attack detection model;

The real-time feature vector determination module is used to obtain the feature vector of real-time public network traffic as a real-time feature vector; the feature vector includes standards for protocol type, number of messages received per unit time, message length, and source port number per unit time. difference and the standard deviation of the target port number per unit time;

A reflection attack detection module is used to input the real-time feature vector into the reflection attack detection model to obtain a reflection attack detection result; the reflection attack detection result is whether the real-time traffic on the public network is reflection attack traffic.

An electronic device, optionally, including a memory and a processor. The memory is used to store a computer program. The processor runs the computer program to cause the electronic device to perform the port data-based reflection. Attack detection methods.

Optionally, the memory is a readable storage medium.

According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

The invention provides a reflection attack detection method, system and electronic equipment based on port data. Based on the attack process and combined with the characteristics of the UDP protocol itself, the message feature value is extracted and the feature vector of the reflection attack is established. Through threshold determination and feature matching, The method detects traffic, can detect traffic attacks and payload amplification attacks in real time, and can improve the detection accuracy of amplified DDos attack traffic.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the drawings needed to be used in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some of the drawings of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without exerting creative efforts.

Figure 1 is a flow chart of a reflection attack detection method based on port data in Embodiment 1 of the present invention;

Figure 2 is an operation flow chart of the reflection attack detection system based on port data in Embodiment 2 of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

The purpose of the present invention is to provide a reflection attack detection method, system and electronic device based on port data, which can improve the detection accuracy of reflection attacks.

In order to make the above objects, features and advantages of the present invention more obvious and understandable, the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

Example 1

As shown in Figure 1, this embodiment provides a reflection attack detection method based on port data, including:

Step 101: Construct a training set based on public network traffic. Public network traffic is port data.

Step 102: Use the training set to train the machine learning model to obtain a reflection attack detection model. Step 102 includes using the feature vector as an input and using whether the public network traffic is reflection attack traffic as an output to train the machine learning model to obtain a reflection attack detection model.

Step 103: Obtain the feature vector of the real-time traffic on the public network as a real-time feature vector. The feature vector includes protocol type, number of packets received per unit time, packet length, standard deviation of the source port number per unit time and standard deviation of the destination port number per unit time.

Step 104: Input the real-time feature vector into the reflection attack detection model to obtain the reflection attack detection result. The reflection attack detection result is whether the real-time traffic on the public network is reflection attack traffic.

Step 101 includes:

Step 101-1: Construct the empty set as a data set.

Step 101-2: Obtain the current public network traffic.

Step 101-3: Preprocess the current public network traffic to obtain the preprocessed current public network traffic.

Step 101-4: Determine the bandwidth amplification factor and packet amplification factor of the current public network traffic based on the preprocessed current public network traffic.

Among them, the bandwidth amplification factor is:

Among them, BAF is the bandwidth amplification factor. len(UDP payload)atv is the UDP payload length of the amplifier reply message within unit time Δt. len(UDP payload)ata is the UDP payload length of the request message received by the amplifier within unit time Δt.

The message amplification factor is:

Among them, PAF is the packet amplification factor. Num _atv is the number of messages replied by the amplifier within unit time Δt. Num _ata is the number of request messages received by the amplifier within unit time Δt.

Step 101-5: Determine the traffic type of the current public network traffic based on the bandwidth amplification factor and the packet amplification factor. Traffic types include normal traffic and reflection attack traffic.

Step 101-6: When the traffic type of the current public network traffic is reflection attack traffic, extract the feature vector of the current public network traffic.

Step 101-7: Add the feature vector of the current public network traffic to the data set.

Step 101-8: Update the current public network traffic and return to step 101-3 until the number of feature vectors in the data set reaches the quantity threshold, and the data set is determined to be a training set.

Step 101-5, including:

Step 101-5-1: Determine whether the current public network traffic meets the normal traffic conditions based on the bandwidth amplification factor and the message amplification factor, and obtain the judgment result. If the judgment result is yes, step 101-5-2 is executed; if the judgment result is no, step 101-5-3 is executed. The normal traffic condition is that the bandwidth amplification factor is smaller than the bandwidth amplification factor threshold, and the packet amplification factor is smaller than the packet amplification factor threshold.

Step 101-5-2: Confirm that the traffic type of the current public network traffic is normal traffic.

Step 101-5-3: Determine the traffic type of the current public network traffic as reflection attack traffic.

After step 104, also include:

Step 105: When the reflection attack detection result is reflection attack traffic, add the real-time feature vector to the training set and return to step 102.

Example 2

In order to perform the method corresponding to the above-mentioned Embodiment 1 and achieve corresponding functions and technical effects, a reflection attack detection system based on port data is provided below, including:

The training set construction module is used to build a training set based on public network traffic. Public network traffic is port data.

The reflection attack detection model training module is used to train the machine learning model using the training set to obtain the reflection attack detection model.

The real-time feature vector determination module is used to obtain the feature vector of real-time traffic on the public network as the real-time feature vector. The feature vector includes protocol type, number of packets received per unit time, packet length, standard deviation of the source port number per unit time and standard deviation of the destination port number per unit time.

The reflection attack detection module is used to input real-time feature vectors into the reflection attack detection model to obtain reflection attack detection results. The reflection attack detection result is whether the real-time traffic on the public network is reflection attack traffic.

As shown in Figure 2, the reflection attack detection system based on port data provided by this embodiment includes:

1) Message collection module.

Packet collection traffic is to automatically send request packets with payload to the corresponding IP and Port through scripts.

2) Data preprocessing module.

Since public network traffic is mixed with a large number of non-UDP packets, the data needs to be processed in advance. Use the scapy library to eliminate non-UDP traffic and extract characteristic information such as source IP, Port, Payload, length and quantity of received/responsed messages per unit time.

3) Traffic threshold detection module.

Calculate the bandwidth amplification factor BAF and packet amplification factor PAF from the data obtained by the data preprocessing module:

Among them, len(UDP payload)atv is the UDP payload length of the amplifier reply message within unit time Δt. len(UDP payload)ata is the UDP payload length of the request message received by the amplifier within unit time Δt.

Among them, len(UDP payload)amp is the number of amplifier reply messages in unit time Δt. len(UDPpayload)ata is the number of request packets received by the amplifier within unit time Δt.

According to the reflection amplification characteristics discovered in recent years, the BAF threshold is set to 3 and the PAF threshold is set to 2. The final results are divided into two different situations: neither BAF nor PAF reaches the threshold, and the flow is allowed; either BAF or PAF coefficient reaches The threshold value means that this traffic meets the reflection amplification characteristics and is determined to be reflection amplification traffic. The traffic is imported into the feature matching module for subsequent detection.

4) Feature matching module.

Based on the attack process and combined with the characteristics of the UDP protocol itself, the message feature values are extracted and the feature vector of the reflection attack is established. Machine learning is used to mark the attack packets through the trained model, so as to detect the reflection attack as soon as possible.

The characteristic vector of a reflection attack can be expressed as v = (p, n, l, σ _sp , σ _dp ), where p is the protocol type, n is the number of messages received per unit time, l is the message length, σ _sp and σ _dp is the standard deviation of the source port number and the target port number in unit time respectively.

5) Attack processing module.

The source IP and Port of the marked attack packet are recorded in the database, and the next match can be directly identified as a reflection attack.

Example 3

This embodiment provides an electronic device, including a memory and a processor. The memory is used to store a computer program. The processor runs the computer program to cause the electronic device to execute the port data-based reflection attack detection method described in Embodiment 1. Among them, the memory is a readable storage medium

Each embodiment in this specification is described in a progressive manner. Each embodiment focuses on its differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. As for the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple. For relevant details, please refer to the description in the method section.

This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method and the core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the present invention There will be changes in the specific implementation methods and application scope of the ideas. In summary, the contents of this description should not be construed as limitations of the present invention.

Claims (10)

1. The reflection attack detection method based on the port data is characterized by comprising the following steps:

constructing a training set based on public network traffic; the public network traffic is port data;

training a machine learning model by using the training set to obtain a reflection attack detection model;

acquiring a feature vector of the real-time traffic of the public network as a real-time feature vector; the feature vector comprises a protocol type, the number of messages received in unit time, the message length, the standard deviation of an endogenous port number in unit time and the standard deviation of a target port number in unit time;

inputting the real-time feature vector into a reflection attack detection model to obtain a reflection attack detection result; and the reflection attack detection result is whether the public network real-time traffic is the reflection attack traffic or not.

2. The method for detecting reflection attack based on port data according to claim 1, wherein constructing the training set based on public network traffic comprises:

constructing an empty set as a data set;

acquiring current public network flow;

preprocessing the current public network flow to obtain preprocessed current public network flow;

determining a bandwidth amplification factor and a message amplification factor of the current public network flow according to the preprocessed current public network flow;

determining the flow type of the current public network flow according to the bandwidth amplification factor and the message amplification factor; the traffic types include normal traffic and reflected attack traffic;

extracting a characteristic vector of the current public network flow when the flow type of the current public network flow is the reflection attack flow;

adding the feature vector of the current public network flow into the data set;

updating the current public network flow, returning to the step of preprocessing the current public network flow to obtain the preprocessed current public network flow until the number of the feature vectors in the data set reaches a number threshold value, and determining the data set as a training set.

3. The method for detecting a reflection attack based on port data according to claim 2, wherein the bandwidth amplification factor is:

wherein BAF is the bandwidth amplification factor; len (UDP payload) atv is the UDP load length of the amplifier reply message within the unit time delta t; len (UDP payload) ata is the UDP load length of the request message received by the amplifier within a unit time deltat.

4. The method for detecting reflection attack based on port data according to claim 2, wherein the message amplification factor is:

wherein PAF is message amplification factor; num (Num) _atv The number of the reply messages of the amplifier in the unit time delta t; num (Num) _ata The number of request messages received by the amplifier per unit time deltat.

5. The method for detecting reflection attack based on port data according to claim 2, wherein determining the traffic type of the current public network traffic according to the bandwidth amplification factor and the message amplification factor comprises:

judging whether the current public network flow accords with a normal flow condition according to the bandwidth amplification factor and the message amplification factor, and obtaining a judging result; the normal flow condition is that the bandwidth amplification factor is smaller than a bandwidth amplification factor threshold value and the message amplification factor is smaller than a message amplification factor threshold value;

if the judgment result is yes, determining that the flow type of the current public network flow is normal flow;

and if the judging result is negative, determining that the flow type of the current public network flow is the reflection attack flow.

6. The method for detecting a reflection attack based on port data according to claim 2, wherein training a machine learning model by using the training set, obtaining a reflection attack detection model, comprises:

and training the machine learning model by taking the feature vector as input and taking whether the public network flow is the reflected attack flow as output to obtain a reflected attack detection model.

7. The method for detecting a reflection attack based on port data according to claim 1, wherein after inputting the real-time feature vector into a reflection attack detection model to obtain a reflection attack detection result, further comprising:

when the reflection attack detection result is the reflection attack flow, adding the real-time feature vector into a training set, and returning to the step of training a machine learning model by using the training set to obtain a reflection attack detection model.

8. A reflection attack detection system based on port data, comprising:

the training set construction module is used for constructing a training set based on the public network traffic; the public network traffic is port data;

the reflection attack detection model training module is used for training the machine learning model by utilizing the training set to obtain a reflection attack detection model;

the real-time feature vector determining module is used for acquiring the feature vector of the public network real-time flow as a real-time feature vector; the feature vector comprises a protocol type, the number of messages received in unit time, the message length, the standard deviation of an endogenous port number in unit time and the standard deviation of a target port number in unit time;

the reflection attack detection module is used for inputting the real-time feature vector into a reflection attack detection model to obtain a reflection attack detection result; and the reflection attack detection result is whether the public network real-time traffic is the reflection attack traffic or not.

9. An electronic device comprising a memory for storing a computer program and a processor that runs the computer program to cause the electronic device to perform a reflection attack detection method based on port data as claimed in any one of claims 1 to 7.

10. The electronic device of claim 9, wherein the memory is a readable storage medium.