基于用户行为分析的应用层DDoS攻击检测方法  

Detecting application-layer DDoS attack based on analysis of users' behaviors

作　　者：赵国锋[1] 喻守成[2] 文晟[3] 

机构地区：[1]重庆邮电大学通信与信息工程学院,重庆400065 [2]重庆邮电大学计算机学院,重庆400065 [3]中南大学信息科学与工程学院,长沙410083

出　　处：《计算机应用研究》2011年第2期717-719,共3页Application Research of Computers

基　　金：重庆市自然科学基金重点资助项目(CSTC2009BA2089);重庆市高校优秀成果转化项目(KJzh08209)

摘　　要：应用层拒绝服务攻击与传统的拒绝服务相比,其破坏性更大,也更难被检测和防御。对此,基于用户浏览行为的分析,提出了一种采用自回归模型来检测应用层DDoS攻击的方法。通过AR模型和卡尔曼滤波,学习和预测正常用户的访问并判断异常;当定位异常访问源后,反馈给前端路由器进行限流或过滤。在电信IDC实际网络环境中,测试结果表明该方法是有效的。Compared with traditional DDoS attack,application-layer DDoS attack has more destructiveness and becomes harder to be detected and defense.Based on user browsing behavior analysis,this paper presented a method for detecting application layer DDoS attacks using auto-regression model.It adopted AR model and Kalman filtering to learn and predict normal user access,the results of which were advancedly used to judge abnormal.The routers were capable of limiting or blocking the attack traffic after locating the attack source accurately.The test result in China Telecom Internet Data Center shows that the method is effective.

关 键 词：拒绝服务攻击 应用层 用户行为 自回归模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]