一种基于小波分析的DDoS攻击检测方法  

Detecting method for DDoS attack based on wavelet analysis

作　　者：任义龙[1] 刘渊[1,2] 

机构地区：[1]江南大学物联网工程学院,江苏无锡214062 [2]江南大学数字媒体学院,江苏无锡214062

出　　处：《计算机工程与应用》2012年第31期82-88,共7页Computer Engineering and Applications

基　　金：国家自然科学基金(No.60875036)

摘　　要：通过对网络流量的分形特性和分布式拒绝服务(DDoS)的特点进行研究,提出了一种基于小波分析的DDoS攻击检测方法,并设计了该方法检测攻击的模型。对网络流量的分形特性进行判断,然后对具有自相似特性和多重分形特性的网络流量,分别采用基于小波分析的Hurst指数方差法和基于多窗口小波分析的Holder指数法检测DDoS攻击。通过对DARPA2000年数据的实验表明,该方法能够有效地检测到攻击,对大流量背景攻击、低速率攻击、反射式攻击也都达到了较高的检测率,比传统方法有效。On the basis of analyzing the fractal property of network traffic and the features of Distributed Denial of Service（DDoS） attacks, a method of DDoS attack detection based on wavelet analysis is presented, and the attack detection model is designed. It judges the fractal features of network traffic, then adopts a method of variance of Hurst exponent based on wavelet analysis detect attack when it is self-similar or a method of Holder exponent based on multi-window wavelet analysis detect attack when it is multi-fractal. On the DARPA/Lincoln laboratory intrusion detection evaluation data set 2000, the experimental results show that this method is effective, and detection rate is high on the big background traffic DDoS attack, low-rate DDoS attack, and reflection DDoS attack, which is better than the traditional method.

关 键 词：分布式拒绝服务 自相似性 多重分形 HURST参数 Holder指数 多窗口小波分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]