一种基于Holder指数的DDoS攻击检测方法  

DDoS attack detection method based on Holder exponent

作　　者：任义龙[1] 刘渊[1,2] 

机构地区：[1]江南大学物联网工程学院,江苏无锡214062 [2]江南大学数字媒体学院,江苏无锡214062

出　　处：《计算机应用研究》2011年第2期724-727,共4页Application Research of Computers

基　　金：国家自然科学基金资助项目(60875036);高等学校科技创新工程重大项目培育资金资助项目(v200704)

摘　　要：基于宏观网络流量汇聚的分形结构,从流量的全局标度指数和局部标度指数出发,对网络流量的分形特性进行分析。利用这一特性对网络异常流量的分形参数进行分析,试图找出这些参数的变化与DDoS攻击的对应关系。实验结果表明,真实的网络流量在大尺度上是渐进自相似的,在小尺度上表现出多重分形的特性。于是提出了基于Holder指数的变化来检测DDoS攻击,对DARPA 2000年数据的实验表明,这种方法能够快速、准确地检测到攻击。对于间歇式DDoS攻击,此方法比传统方法有效。Based on the fractal structure of the large-scale network traffic aggregation,analyzed the fractal feature of network traffic from the perspective of the global and local scaling exponents.It used this feature to analyze the fractal parameters of abnomal network traffic,trying to identify the relationship between changes of these parameters and the emergence of DDoS.Experimental results show that network traffic have the self-similar phenomena over large-scale and the multi-fractal phenomena over-small scale.It presented a method of DDoS attack detection based on Holder exponent.On the DARPA/Lincoln laboratory intrusion detection evaluation data set 2000,the experimental result shows that this method can detect the attack quickly and accurately.When the intermittent DDoS attack happen,this method is more effective than the traditional method.

关 键 词：分布式拒绝服务 自相似性 多重分形 HURST参数 Holder指数 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]