采用数据挖掘的拒绝服务攻击防御模型  

A DoS Attack Defense Model Adopting Data Mining

作　　者：童彬[1] 秦志光[1] 贾伟峰[1] 宋健伟[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,成都610054

出　　处：《电子科技大学学报》2008年第4期586-589,共4页Journal of University of Electronic Science and Technology of China

基　　金：电子信息产业发展基金(信部运[2005]555)

摘　　要：针对拒绝服务攻击的特点,提出了一种采用数据挖掘技术的防御模型。该模型以实时抽样流量作为数据来源,采用关联分析法提取可信IP列表用于数据包的过滤,并利用贝叶斯分类算法对数据包的危险等级进行评估。该模型弥补了传统的基于可信IP列表过滤的不足,并在防御攻击时能有效区分正常流量与异常流量。实验证明该模型能够对拒绝服务攻击进行有效、实时的防御。According to the characteristics of DoS/DDoS attack, a defense model adopting data-mining technology is proposed. Based on real-time sample traffic, this model extracts trusted IP list by association analysis to filter, and evaluates packets＇ danger degree by adopting bayes algorithm. This model makes up disadvantages of traditional filtering based on trusted source IP, and effectively differentiates normal traffic and abnormal traffic. Experimental datum proves this model can launch real-time and effective defense against DoS/DDoS attack.

关 键 词：关联分析 贝叶斯分类 数据挖掘 拒绝服务 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]