基于FP-tree候选组合模式的低速率拒绝服务攻击检测  

Detecting LDoS Attacks Based on FP-Tree Candidate Combination Pattern

作　　者：王传安[1] 赵生艳[1] 

机构地区：[1]安徽科技学院,安徽凤阳233100

出　　处：《东莞理工学院学报》2011年第3期17-21,共5页Journal of Dongguan University of Technology

基　　金：安徽省自然科学研究项目(KJ2011Z070);安徽科技学院青年科研基金项目(ZRC2011271)

摘　　要：低速率拒绝服务攻击(LDoS)比传统的DDoS攻击更加难以检测与防范,为此,分析了加入LDoS攻击的网络流分布特性,通过设置流信息熵阈值定位出可疑IP流对,并采用基于FP-Tree候选组合频繁模式的挖掘算法,将候选频繁端口模式在FP树路径中进行匹配来发现LDoS攻击及其攻击特性。仿真实验表明,该方法效果显著。Low-rate Denial-of-Service（LDoS） is,as a new kind of attacks,more difficult to detect and defend than traditional flooding DDoS attacks.This paper analyzes the data flow distribution characteristics with added LdoS,locating suspisious IP flow by setting the flow information of the entropy threshold and matching the frequent port mode in the FP tree path to find LdoS attack and its attack characteristics with mining algorithm for Candidate Combination Frequent Pattern.Simulation experiments show that the detection approaches of LDoS can reach high detection accuracy.

关 键 词：低速率拒绝服务攻击 候选组合频繁模式 FP-TREE 

分 类 号：TP393.09[自动化与计算机技术—计算机应用技术]