CUSUM算法在DDoS源端检测中的应用  

Detecting DDoS attacks in source-end network with CUSUM algorithm

作　　者：康健[1] 鞠九滨[1] 

机构地区：[1]吉林大学计算机科学与技术学院,吉林长春130012

出　　处：《计算机应用》2006年第6期1343-1345,共3页journal of Computer Applications

基　　金：国家自然科学基金资助项目(90204014)

摘　　要：在深入分析了DDoS源端检测的特点和难点的基础上,引入统计学中非参数改变点检测方法,应用非参数化递归CUSUM(Cumulative Sum)算法对代表性的源端检测系统D-WARD进行了改进。经实验验证,应用CUSUM算法的检测系统具有更低的误报率和漏报率,能够适应更复杂的网络检测环境。After characteristics and difficult problems in detecting DDoS attacks were analyzed in source-end network, a nonparametric change point detection method in statistics was introduced and D-WARD system, a representative source-end DDoS detection system, was improved with nonparametrie reeursive CUSUM algorithm. Experiments prove that the improved system is lower in false-positive rate and false-negative rate, which is more accurate and could adapt to more complex network environments.

关 键 词：分布式拒绝服务 非参数CUSUM D-WARD 源端检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]