Hu Jiamin, Yang Xiaofan
School of Big Data & Software Engineering, Chongqing University, Chongqing, China.
PLoS One. 2024 Dec 26;19(12):e0301888. doi: 10.1371/journal.pone.0301888. eCollection 2024.
Distributed denial of service (DDoS) is a type of cyberattack in which multiple compromised systems flood the bandwidth or resources of a single system, making the flooded system inaccessible to legitimate users. Since large-scale botnets based on the Internet of Things (IoT) have been hotbeds for launching DDoS attacks, it is crucial to defend against DDoS-capable IoT botnets effectively. In consideration of resource constraints and frequent state changes for IoT devices, they should be equipped with repair measures that are cost-effective and adaptive to mitigate the impact of DDoS attacks. From the mitigation perspective, we refer to the collection of repair costs at all times as a repair strategy. This paper is then devoted to studying the problem of developing a cost-effective and adaptive repair strategy (ARS). First, we establish an IoT botware propagation model that fully captures the state evolution of an IoT network under attack and defense interventions. On this basis, we model the ARS problem as a data-driven optimal control problem, aiming to realize both learning and prediction of propagation parameters based on network traffic data observed at multiple discrete time slots and control of IoT botware propagation to a desired infection level. By leveraging optimal control theory, we propose an iterative algorithm to solve the problem, numerically obtaining the learned time-varying parameters and a repair strategy. Finally, the performance of the learned parameters and the resulting strategy are examined through computer experiments.
分布式拒绝服务（DDoS）是一种网络攻击类型，其中多个受感染的系统会耗尽单个系统的带宽或资源，导致合法用户无法访问被耗尽资源的系统。由于基于物联网（IoT）的大规模僵尸网络一直是发起DDoS攻击的温床，因此有效防御具备DDoS攻击能力的物联网僵尸网络至关重要。考虑到物联网设备的资源限制和频繁的状态变化，它们应配备具有成本效益且适应性强的修复措施，以减轻DDoS攻击的影响。从缓解的角度来看，我们将随时收集修复成本称为一种修复策略。本文致力于研究制定具有成本效益且适应性强的修复策略（ARS）的问题。首先，我们建立了一个物联网僵尸软件传播模型，该模型充分捕捉了在攻击和防御干预下物联网网络的状态演变。在此基础上，我们将ARS问题建模为一个数据驱动的最优控制问题，旨在基于在多个离散时隙观察到的网络流量数据实现传播参数的学习和预测，并将物联网僵尸软件的传播控制到期望的感染水平。通过利用最优控制理论，我们提出了一种迭代算法来解决该问题，通过数值计算得到学习到的时变参数和一种修复策略。最后，通过计算机实验检验学习到的参数和所得策略的性能。
