一种针对LDoS攻击的分布式协同检测方法  

Distributed Collaborative Detection Method for LDoS Attacks

作　　者：何炎祥[1,2] 刘陶[1] 韩奕[1] 熊琦[1] 曹强[1] 

机构地区：[1]武汉大学计算机学院,湖北武汉430079 [2]武汉大学软件工程国家重点实验室,湖北武汉430079

出　　处：《小型微型计算机系统》2009年第3期425-430,共6页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(60642006;60773008)资助

摘　　要：针对近年来提出的一类新型攻击——低速率拒绝服务攻击(LDoS:Low-rate Denial of Service),提出一种位于中间网络的分布式协同检测方法DCLD(Distributed Collaborative Ldos Detection).该方法运用小波分析从多角度对LDoS攻击进行特征提取,并根据D-S证据理论,组合各种特征证据对攻击进行综合判决.各检测节点之间采用分布式协同算法实现信息交互.模拟实验结果表明,DCLD能够以较高精确度检测LDoS攻击及其分布式形式,并于靠近攻击源处对其进行响应,有效减小了攻击及防范机制本身对合法流量的影响.Low-rate Denial-of-Service, very different form traditional flooding DoS attacks, is a new kind of attacks. A distributed collaborative detection method DCLD（Distributed Collaborative LDoS Detection）which is deployed in the middle network defending against this kind of attacks and their distributed forms is presented. Attack traffic features are extracted using multi-scale wavelet analysis. Then, the feature-evidences are combined to make integrating judgement based on the D-S evidence theory. A distributed collaborative algorithm is also proposed, detection nodes exchange their information to realize collaborative detection through it. Simulation experiments show that DCLD can reach high detection accuracy and defenses the attacks near the sources, consequently mitigates the impacts of both attacks and defense mechanism on legitimate traffics.

关 键 词：低速率拒绝服务攻击 分布式协同检测 小波分析 D-S证据理论 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]