基于流连接密度的分布式拒绝服务攻击检测  

Detection of Distributed Denial of Service Attacks Based on Flow Connection Density

作　　者：孙钦东[1] 张德运[1] 孙朝晖[1] 张晓[1] 

机构地区：[1]西安交通大学电子与信息工程学院,西安710049

出　　处：《西安交通大学学报》2004年第10期1048-1052,共5页Journal of Xi'an Jiaotong University

基　　金：国家信息化计算机网络与信息安全基金资助项目 (2 0 0 1 -研 1 - 0 1 0 )

摘　　要：分析了分布式拒绝服务(DDoS)攻击的特点,定义了能够反映DDoS攻击所引起的网络流量变化特点的流连接密度(FCD)概念,并证明了FCD时间序列的非平稳特性.据此,提出了一种基于FCD的DDoS攻击检测方法,该方法通过拟合FCD时间序列的自适应自回归模型,将FCD序列转换为多维空间的向量序列,然后使用经过样本训练的K最近邻分类器进行攻击识别.实验结果及分析显示,该检测方法能够有效检测DDoS攻击,误报率低于4 3%,并能够对流量数据进行在线处理,实现DDoS攻击的在线检测.The features of distributed denial of service (DDoS) attacks are analyzed. The concept of the flow connection density (FCD) which reflects the variation of network flow caused by DDoS attacks is defined, then the characteristics of non-stationary of FCD time series is proved. A new method to detect DDoS attacks is proposed by fitting the adaptive autoregression model of the FCD time series to transform it into the vector sequence in multi-dimensional space, and identifying DDoS attacks by using the K-nearest neighbor classifier trained by samples. The experimental results and analysis show that the developed approach can detect DDoS attacks effectively, and the error detection rate is lower than 4.3%. The approach also can deal with the new flow information and detect DDoS attacks online.

关 键 词：分布式拒绝服务 自适应自回归 K最近邻 DDOS 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]