基于CUSUM算法提高D-WARD系统检测精度  

An Improvement on Precision in D-WARD Detection System with CUSUM Algorithm

作　　者：康健[1] 张喆[1] 鞠九滨[1] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012

出　　处：《仪器仪表学报》2006年第5期456-460,共5页Chinese Journal of Scientific Instrument

基　　金：国家自然科学基金(90204014)资助项目

摘　　要：在深入分析了具有代表性的DD oS源端检测系统D-W ARD检测算法的基础上,引入统计学中非参数改变点检测方法,使用非参数化递归CU SUM算法对D-W ARD进行了改进。同时,借鉴负载平衡中Load-Shedd ing的思想,应用K au fm an算法动态调整和更新阈值T hresho ld,并对检测性能进行详细比较。实验证明,改进的系统具有更低的误报率和漏报率,能够适应更复杂的网络检测环境。After analyzed the detection algorithm of D WARD for a representative source end DDoS detection system,a nonparametric change point detection method in statistics is introduced and the D-WARD is improved with nonparametric recursive CUSUM algorithm. Meanwhile,by drawing on the experience of Load-Shedding in the load balance the Kaufman algorithm is used to adjust and upgrade threshold value dynamically and the respective performances are compared. Experiments prove that the improved system is lower in false-positive rate and false-negative rate,which is more accurate and could adapt to more complex network environments.

关 键 词：DDOS 非参数CUSUM D-WARD 源端检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]