针对网络信息审计系统的DoS攻击检测  

Detection of DoS Attacks Against Network Information Audit System

作　　者：孙钦东[1] 张德运[1] 傅鹏[1] 胡国栋[1] 

机构地区：[1]西安交通大学网络研究所,陕西西安710049

出　　处：《微电子学与计算机》2005年第6期149-151,共3页Microelectronics & Computer

基　　金：国家信息化计算机网络与信息安全基金(2001-研1-010)

摘　　要：提出了一种针对网络信息审计系统的拒绝服务攻击(DoS)的检测算法,该算法通过分析系统告警的频率与分散度提取能够标示系统状态变化的两维特征向量,然后使用经过样本训练的K最近邻分类器检测DoS攻击。实验结果表明,该算法能够及时发现、防御DoS攻击,有效地阻止DoS攻击对网络信息审计系统的破坏。Network information audit system (NIAS) plays an important role in the information security, and it may be attacked firstly by smart attackers. A algorithm is proposed to detect and defense denial of service attacks implemented to NIAS. By analyzing the frequency and dispersion of alerts, the two-dimensional characteristic vector is obtained, and the K-nearest neighbor classifier trained by samples is used to identify DoS attacks. Experimental result show that the algorithm can discover the DoS attacks in time and effectively protecting the audit system.

关 键 词：网络信息审计 拒绝服务 状态检测 K最近邻 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]