基于攻击特征的ARMA预测模型的DDoS攻击检测方法  

The DDoS Detection Method Based on Attack Features and the ARMA Prediction Model

作　　者：程杰仁[1,2] 殷建平[1] 刘运[1] 刘湘辉[1] 蔡志平[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073 [2]湘南学院数学系,湖南郴州423000

出　　处：《计算机工程与科学》2010年第4期1-4,28,共5页Computer Engineering & Science

基　　金：国家自然科学基金资助项目(60603062);湖南省教育厅资助科研项目(07C718);湖南省自然科学基金资助项目(06JJ3035);公安部应用创新计划资助项目(2007YYCXHNST072)

摘　　要：分布式拒绝服务(DDoS)攻击检测是网络安全领域的研究热点。本文提出一个能综合反映DDoS攻击流的流量突发性、流非对称性、源IP地址分布性和目标IP地址集中性等多个本质特征的IP流特征(IFFV)算法,采用线性预测技术,为正常网络流的IFFV时间序列建立了简单高效的ARMA(2,1)预测模型,进而设计了一种基于IFFV预测模型的DDoS攻击检测方法(DDDP)。为了提高方法的检测准确度,提出了一种报警评估机制,减少预测误差或网络流噪声所带来的误报。实验结果表明,DDDP检测方法能够迅速、有效地检测DDoS攻击,降低误报率。The distributed denial of service （DDoS） attack is one of the major threats to the current Internet. We propose a robust scheme to detect the distributed denial of service （DDoS） attack based on the essential DDoS attacks features, such as the abrupt traffic change, flow dissymmetry, distributed source IP addresses and concentrated target IP addresses. This paper proposes a IP Flow feature value （IFFV） algorithm that reflects the DDoS attack features, and uses a simple and efficient ARMA（2,1） IFFV prediction model for normal network flow based on linear prediction techniques. Then a DIDOS attack detection scheme, DDDP （DDoS attacks detection based on IFFV Prediction）, is designed for network flow. Furthermore, a mechanism evaluating the reliability of alert is developed to reduce the false alerts caused by prediction or flow noise. We have done experiments with the MIT Data Set in order to evaluate our method. The results show that DDDP is an efficient DDoS attacks detection scheme, which can quickly detect DDoS attacks accurately and reduce false alarm rate drastically.

关 键 词：网络安全 分布式拒绝服务 线性预测 攻击特征 ARMA模型 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]