改进的基于熵的DDoS攻击检测方法  

Modified method of detecting DDoS attacks based on entropy

作　　者：张洁[1] 秦拯[1] 

机构地区：[1]湖南大学软件学院,长沙410082

出　　处：《计算机应用》2010年第7期1778-1781,共4页journal of Computer Applications

基　　金：国家973计划项目(2007CB310702);湖南省自然科学基金资助项目(09JJ3124);广东省自然科学基金资助项目(7007730);广东省科技计划项目(0711020400157);东莞市科技攻关项目(2006D1046;2007108101021)

摘　　要：基于熵的分布式拒绝服务攻击(DDoS)攻击的检测方法相比其他基于流量或特征的检测方法,具有计算简便、灵敏度高、误报率低、不增加额外网络流量、不增加额外硬件成本等特点。为了进一步提高了DDoS攻击检测的准确率,并降低误报率,提出一种改进的基于熵的DDoS攻击检测方法。该方法将DDoS攻击细分为不同的威胁等级,对每个威胁等级的攻击进行不同次数的检测。NS-2模拟实验结果验证了其有效性。Compared with the volume or feature based approaches,detecting Distributed Denial of Service（DDoS） attacks based on entropy has the following advantages： simple calculation,high sensitivity,low false positive rate,no need of additional network traffic and device.For the purpose of getting higher precision and lower false positive rate in contrast to traditional entropy-based approaches,a Modified Entropy-Based（MEB） scheme was proposed in this paper,which divided DDoS attacks into different threat levels and treated each threat level with according method.The effeciency of this scheme was validated with simulation in NS-2.

关 键 词：分布式拒绝服务 熵 攻击检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]