一种低通信开销的DDoS异常检测模型  

Communication Efficient Model for DDoS Detection

作　　者：奠石镁[1] 

机构地区：[1]云南医学高等专科学校信息中心,云南昆明350031

出　　处：《计算机安全》2008年第6期7-10,共4页Network & Computer Security

摘　　要：在分布式DDoS检测中,相互协作的检测节点间存在一定规模的通信开销,当通信操作频繁发生时,这种开销会加重网络负担。针对分布式DDoS检测,提出一种低通信开销的检测模型:选择具有最大全局值的对象作为代表,通过"监控参数"和"补偿参数",使得代表对象调整后的局部值在每个节点上看起来都是最大,只要代表对象没有超出阈值,则可以保证DDos没有发生。将多个对象的持续监控变为对代表对象的监控和对局部约束条件的维护操作,从而降低检测操作的通信开销。通过理论分析和实验测试,证明了该方法的有效性。In the situation of DDoS detection, there are considerable communications among detection nodes . Frequent communications will consume much network resources. We propose a model with low communication cost, where the object with largest value is chose as the representative object, and adjustment factors are used to guarantee that local value of representative object is also the largest one in each remote node. Therefore, only the representative object needs to be monitored continuously as long as all the local constrains are valid. When local constrain is violated, communication is needed among the coordinator and remote nodes to rebuild the constrain. Analytical analysis and experimental evidences show the efficiency of this model.

关 键 词：分布式拒绝访问攻击 通信开销 全局检测 局部检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP338[自动化与计算机技术—计算机科学与技术]