面向边缘计算的TCA1C DDoS检测模型

TCA1C DDoS Detection Model for Edge Computing

边缘计算弥补了传统云计算数据传输开销大的不足,但边缘网络中存储和计算资源受限的特殊性限制了其部署复杂安全算法的能力,更易受到分布式拒绝服务(DDoS)攻击。针对目前边缘网络中DDoS攻击检测方法性能不高、未对卸载任务分类处理、对多属性的流量处理能力弱的问题,提出一种基于任务分类的Attention-1D-CNN DDoS检测模型TCA1C,对通信链路中的流量按不同的卸载任务进行分类,使单个任务受到攻击时不会影响整个链路中计算任务卸载的安全性,再对同一任务下的流量提取属性值并进行归一化处理。处理后的数据输入到Attention-1D-CNN,通道Attention和空间Attention学习数据特征对DDoS检测的贡献度,利用筛选函数剔除低于特征阈值的冗余信息,降低模型学习过程的复杂度,使模型快速收敛。仿真结果表明:TCA1C模型在缩短DDoS检测所用时间的情况下,检测准确率高达99.73%,检测性能优于DT、ELM、LSTM和CNN;当多个卸载任务在面临特定攻击概率时,卸载任务分类能有效降低不同任务的相互影响,使终端设备的计算任务在卸载过程中保持较高的安全性。

Edge computing compensates for the traditional cloud computing data transmission overhead.However,limited storage and computing resources in the edge network restrict its ability to deploy complex security algorithms,making it more vulnerable to Distributed Denial of Service(DDoS)attacks.This paper proposes a task classification-based Attention-1D-CNN detection model,TCA1C,aimed at solving problems in current edge networks,such as low performance in detecting DDoS,lack of a task classification mechanism,and weak ability to deal with multi-attribute traffic.First,the model classifies the traffic in the communication link according to different offloading tasks such that the overall offloading security is not affected when some tasks are attacked,and the attribute values of the traffic under the same task are extracted and normalized.Next,the model inputs the processed data into an Attention-1D-CNN.Channel and spatial attention determine the contribution of data features for classification and eliminate redundant information below the feature threshold,thereby reducing the complexity of the model learning process and allowing the model to converge quickly.The simulation results show that the accuracy of the TCA1C model in DDoS detection is as high as 99.73%,and the performance of the TCA1C model is better than those of the DT,ELM,LSTM,and CNN,with reduced detection time.When different offloading tasks face certain attack probabilities,traffic classification can effectively reduce the mutual influence of different tasks such that the computing tasks of the terminal equipment can maintain a high level of security during offloading.