VTP检测算法的改进和基于模糊逻辑的DDoS攻击自适应判断  

VTP detection algorithm improvement and the self-adaptability judgment of DDoS

作　　者：王江涛[1] 杨庚[1] 

机构地区：[1]南京邮电大学计算机学院,南京210003

出　　处：《仪器仪表学报》2008年第2期342-348,共7页Chinese Journal of Scientific Instrument

基　　金：江苏省自然科学基金(BK2004218);江苏省“六大人才高峰”项目(06-E-044)资助

摘　　要：传统DDoS判断方法主要是借助已知的Hurst值和经验进行人工判断,判断缺乏自适应性,且带有很大主观性。考虑到DDoS攻击是一个动态多变的过程,本文在研究DDoS攻击对网络流量自相似性影响的基础上,提出采用滑动窗口机制的方差时间图法估算Hurst值,实时检测DDoS攻击,结合实验数据,采用模糊逻辑技术设计了一个智能的DDoS判断机制,解决了该方法实现过程中参数选择、求解Hurst值等关键问题。通过DARPA1999年IDS基准评测数据的实验评测表明,新方法能够识别不同强度DDoS攻击引起的Hurst值的变化,实时检测DDoS攻击,增强了DDoS判断的灵活性,智能实现对DDoS攻击过程的在线实时自适应判断。Traditional DDoS judgment mainly depends on the known Hurst parameter and experience to make artificial judgment. It lacks self-adaptability and has great subjectivity. Considering that DDoS attack is a process that changes dynamically and frequently, this paper first put forward a Variance-time plots method adapting slide-window mechanism to estimate Hurst parameter to detect DDoS attack in real time based on the study of how DDoS attack influence the self-similar traffic of network, then by adapting fuzzy logic technology, the paper designs a intelligent DDoS judgment mechanism, and thus solved many key problems in the implementation of the method such as the choosing of parameter, the solution of Hurst parameter. We apply the 1999 DARPA offline intrusion detection evaluation to carry out simulation. The experiment indicates that the new method can identify the change of Hurst parameter caused by different strength DDoS attack, can detect DDoS attack in re.al time, and can improve flexibility of DDoS attack judgment, thus achieve the goal of making on- line and real-time judgment of DDoS attack self-adaptively and intelligently.

关 键 词：异常检测 分布式拒绝服务 自相似 实时检测 方差时间图 智能决策 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]