一种改进的DDoS攻击源端快速检测算法  

An Improved Algorithm of Source-End Detection Mechanism Against DDoS Attack

作　　者：毛韶阳[1] 李肯立[1] 

机构地区：[1]湖南大学计算机与通信学院

出　　处：《湖南科技学院学报》2007年第9期84-86,共3页Journal of Hunan University of Science and Engineering

基　　金：教育部重点项目(05128)

摘　　要：从TCP协议的基本原理入手,基于TCP的三次握手原理,提出以统计源端主机发往目标地址的SYN包个数与返回的SYN/ACK包个数的差值来量化目标主机的拥塞程度,为缩短检测延迟将攻击点的个数加到检测方法中,采用改进后的非参数CUSUM方法,将连续攻击效果放大以减小检测的误警率。实验证明:较D-WARD系统,该算法在减小误警率和提高检测速度上均有很大程度的提高。From The basic principle of TCP protocol, based on TCP three handshake principles, put forward an algorithm which considers the amount different between SYN packets and the corresponding SYN/ACK packets as detection factor, in order to abbreviate the delay of detection, an improved CUSUM method is proposed by talking the number of attacker into account. The experimental results show： compare the D-WARD system, this algorithm generates lower false positive and rapider detection speed.

关 键 词：DDOS SYN包 SYN/ACK包 误警率 

分 类 号：TP312[自动化与计算机技术—计算机软件与理论]