Real-Time Method for DDoS Attacks Detection Based on Self-Similarity and Wavelet Analysis  

作　　者：REN Xunyi WANG Ruchuan Qi Zhenghua 

机构地区：[1]College of Computer, Nanjing University of Posts and Telecommunications, Nanjing 210003, China [2]State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing 210093, China

出　　处：《Chinese Journal of Electronics》2008年第1期90-94,共5页电子学报（英文版）

基　　金：This work is supported by the National Natural Science Foundation of China （No.60573141, No.70271050）, National 863 High Technology Research Program of China （No.2006AA01Z201, No.2006AA01Z219, No.2006AA01Z439）, the Natural Science Foundation of Jiangsu Province （No.BK2005146）, High Technology Research Programme of Jiangsu Provinc （No.BG2004004, No.BG2005037, No.BG2005038, No.BG2006001）, High Technology Research Programme of Nanjing （No.2006RZ105）, Foundation of National Laboratory for Modern Communications （No.9140Cl101010603） and Key Laboratory of Infor- mation Technology Processing of Jiangsu Province （No.kjs05001, No.kjs06006）.

摘　　要：Traditional wavelet methods are not efficient to detect the real-time traffic anomaly. To address this drawback, on the basis of self-similarity and wavelet analysis, this paper proposes one real-time method for DDoS attacks detection. Firstly, to effectively analyze new network state, we extracted data packets from network monitor in backward time direction. Secondly, for reducing admissible computing time, we applied time scale selfadjust according to last packets arrival speed. Finally, we adopted three parallel computing strategies to improve real-time performance. Experimental results show that proposed method can quickly and accurately detect DDoS attacks.

关 键 词：DDoS （Distributed denial of service） SELF-SIMILARITY Wavelet analysis Real-time detection Hurst parameter. 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]