一种基于熵的DDoS攻击实时检测算法  

A real-time DDoS attacks detection method based on entropy

作　　者：王佳佳[1] 严芬[1,2] 殷新春[1] 

机构地区：[1]扬州大学信息工程学院,江苏扬州225009 [2]南京大学计算机软件新技术国家重点实验室,南京210093

出　　处：《扬州大学学报（自然科学版）》2009年第1期56-60,共5页Journal of Yangzhou University：Natural Science Edition

基　　金：国家高技术研究发展计划项目(863-2003AA142010);国家自然科学基金资助项目(60473093);江苏省高技术研究计划项目(BG2004030)

摘　　要：提出一种轻量级的DDoS(distributed denial of service)攻击检测的有效方法.首先基于滑动窗口技术的熵算法实时检测网络数据包中目的IP地址出现的随机性,然后使用VTP(variance-time plot)方法进行异常检测.实验结果表明,该方法能够实时检测出各种DDoS攻击的存在,特别是能够发现大流量背景下攻击流量没有引起整个网络流量显著变化的DDoS攻击.An efficient light-weight method for defending against DDoS attacks is designed in this paper. The entropy method based on a sliding window is used to compute the randomness of destination IP address of network packets in time. Then, VTP technology is used to detect abnormity. This method can detect the existence of DDoS attacks on line. According to experiments, the method in this paper can find out the DDoS intrusion against the large scale network, which does not arouse the sharp changes of the network traffic.

关 键 词：DDOS 熵算法 实时检测 HURST参数 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]