Patent Application
20250097259
The invention is related to the system and method that ensures the timely and accurate detection of the Distributed Denial of Service (DDoS) attack when it occurs in the core networks of an Internet Service Provider (ISP).
Nowadays, it is important for an ISP to exchange data without loss at high speed and without breaking the connection between the content providers and the end users. To this end, it is necessary to constantly monitor the core network and to interfere in a timely manner when necessary. When DDoS attacks occur, the sudden increase in data rates in core networks causes loss of data and disconnection between the core network and the user. Monitoring and network management methods in the literature are not efficient in detecting the DDoS attack and repairing the network after the attack. In addition, these methods are limited to data centers or border networks and do not address the entire network. This situation causes ISPs to not be able to fully manage their networks.
Offline learning methods in the literature cannot produce stable and consistent responses in real time and cannot adapt to the high volume, diverse and variable data that occurs during DDoS attacks. In addition, among the obtained data, the most suitable features to be used in learning are not selected and the data is not modeled in these methods. This situation causes the previous detection methods to work inefficiently.
Some of the available academic references are:
As a result, due to the problems described above and the inadequacy of the existing methods on the subject, it was necessary to make an improvement in the relevant technical field.
The invention aims to propose a system with innovative technical features that brings a new perspective to this field, unlike the structures used in existing systems.
The main purpose of the invention is to create and observe the digital twin of the core network and to detect DDoS attacks autonomously using online learning methods. The invention also enables the processing of high volumes of data obtained by modeling the data and autonomously selecting features. Thanks to the invention, a DDoS attack can be detected quickly and accurately, thus preventing further damage to the core network. This invention also contributes to the autonomous core network concept of the future.
The invention proposes to use an online learning method in order to detect DDoS attacks that occur in core networks. Thus, the proposed learning method can improve its learning capabilities under diverse and high volumes of data caused by the attack, unlike the offline machine learning methods. In addition, the technology of digital twin creation was used to obtain data by interfering with the digital twin of the network to observe the network remotely, instead of directly interfering with the physical network. To this end, the digital twin of all physical assets in the network was created, and the data was collected over these digital twins. Thanks to the proposed method, intervention in the physical network can be carried out through the digital twin, and this makes the management of the network autonomous.
In the invention, the data modeling language YANG (Yet Another Next Generation) was used to model the data to be sent as input to online machine learning management. Thus, data redundancy, which occurs by taking all data from different sensor paths of different routers, and a slowdown in the system is prevented. The data of two performance indicators (Key Performance Indicator (KPI)) were modeled using YANG sensor paths within the scope of the invention and a reduction was achieved in the data to be processed. After this operation, the dynamic feature selection process was applied to these obtained data. For this process, the AutoFS module was created, which dynamically chooses the feature selection method that will give the best result according to the result metrics of the learning algorithm among six different feature selection methods. ANOVA (Analysis of Variance), F-value Selection, Chi-square, BFE (Backward Feature Elimination), Fisher Score, and RFE (Recursive Feature Elimination) were chosen as six different feature selection methods. With the YANG and AutoFS methods, the problem of not considering all the assets in the network was prevented and the system was enabled to work on all routers. In the final step, K-Means and EM algorithms were combined in the invention to make the learning process online. Thus, online machine learning was realized by updating the parameters of the Feature Selection Module used in the system and the MLP (Multilayer Perceptron/Multilayer Perceptron) in the Online Learning Module, according to the network status, thanks to the AutoFS module.
The invention is the system that ensures timely and accurate detection of the problem when a DDoS/distributed denial of service attack occurs in the core/physical networks of each ISP and contains the features listed below:
The structural and characteristic features of the invention and all its advantages will be understood more clearly thanks to the figures given below and the detailed description written with reference to these figures. For this reason, the valuation should be made by taking these figures and detailed explanation into consideration.
Drawings are not necessarily to scale and details not necessary for understanding the present invention may be omitted. Furthermore, features that are at least substantially identical or have at least substantially identical functions are denoted by the same number.
In this detailed description, preferred embodiments of the invention are explained only for a better understanding of the subject and without any limiting effect.
The invention is related to the system and method that ensures the timely and accurate detection of the DDoS attack when it occurs in the physical core networks (1) of an ISP.
The modules and functions used in the system and method of the invention are as follows:
The physical network (1) is owned by the ISP, through which data flow is provided to the users.
The cloud system (2) is the structure that runs the created digital twin of the physical network (1).
The digital twin of a router (3) is the structure that is located in the digital twin of the physical network (1) and performs the machine learning, data modeling, feature selection and data labeling methods in the system.
YANG data models (4) is the structure that prevents the high volume of data that will occur by modeling the key performance indicator data received from the routers.
Feature selection module (5) is the structure that performs feature selection on modeled data to be used during online learning.
Online learning module (6) is the structure that performs the online learning method on the data obtained using the MLP method.
Classification module (7) is the structure that decides whether the traffic change in the network is a DDoS attack or not according to the result obtained from the learning process.
Performance evaluation module (8) is the structure that gives feedback to the feature selection process on the data by looking at the performance metrics obtained as a result of online learning.
The AutoFS module (9) is the structure that determines the most appropriate feature selection method among the specified feature selection methods, according to the feedback from the performance evaluation module (8) and the module that contains the up-to-date feature information (10). This is the module that enables online learning.
The module that contains up-to-date feature information (10) according to the notifications coming from the performance evaluation module (8).
The working principle of the proposed system of the invention, is as follows:
In the proposed method of invention, firstly, the digital twin of the physical core network (1) owned by the ISP is created. The created digital twin is run in the cloud system (2). The information on two performance indicators determined within the scope of the invention is collected from the digital twin of the router (3) using the YANG data model (4). The YANG data model (4) is used to reduce the amount of data and the complexity of the system in these collected data. Based on the data collected through these performance indicators, the best ten features to be used in the online learning module (6) are determined by the feature selection module (5) from the module that contains up-to-date feature information (10). The data, whose features are determined, are labeled in the AutoFS module (9) using the proposed labeling method, before being fed to the online learning module (6). The Ensemble Learning Algorithm, which combines K-Means and EM algorithms, is proposed as a labeling method in the invention. After labeling the data, these labeled data are fed into the online learning module (6) for training and testing. Then, the classification of whether the traffic change occurring in the network is a DDoS attack is made in the classification module (7) using the MLP method trained in the online learning module (6).
In the performance evaluation module (8), performance metrics (sensitivity (recall) and detection time) are checked over the generated classification output. The learning process continues with the determined features and feature selection methods if the determined performance metrics are above certain threshold values in the online learning module (6). However, if the values of the performance metrics are below a certain threshold value, the selected features and MLP parameters are updated using the AutoFS module (9). The feature update process is carried out by determining the best feature selection method that will optimize the performance metrics among the six feature selection methods determined within the scope of the invention. The selected feature selection method chooses the top ten features according to its own algorithm. After the data has been relabeled, it is fed into the MLP learning method in the online learning module (6). The feature selection method and features used by the MLP method are determined by dynamically changing according to the values of the performance metrics in the AutoFS module (9). Thus, the MLP method can adapt to changing conditions in an online manner and continuously improve the learning process.
The process steps of the proposed system which is the subject of the invention are as follows:
| Number | Date | Country | Kind |
|---|---|---|---|
| 2022/014290 | Sep 2022 | TR | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/TR2022/051216 | 11/1/2022 | WO |
