基于流量分析的App-DDoS攻击检测  

Detecting App-DDoS attacks based on flow analysis

作　　者：李锦玲[1] 汪斌强[1] 张震[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《计算机应用研究》2013年第2期487-490,共4页Application Research of Computers

基　　金：国家"863"计划资助项目(2011AA01A103)

摘　　要：针对当前应用层分布式拒绝服务攻击(App-DDoS)检测方法高度依赖于系统日志,且检测攻击类型单一的问题,提出了基于卡尔曼滤波和信息熵的联合检测模型DFM-FA(detection and filtering model against App-DDoSattacks based on flow analysis),将应用层的行为异常检测映射为网络层的流量异常检测,最大限度地保证了合法用户的优先正常访问。实验证明,DFM-FA既不依赖于系统日志,同时又能检测到FTP、DNS等多种App-DDoS攻击。Aiming at the shortcomings of current methods which highly depend on system logs and fail to detect attacks against FTP or DNS servers, this paper proposed a novel model named DFM-FA that based on Kalman filtering and information entro- py. The DFM-FA model mapped behaviour anomaly detection to network anomaly detection, maximizing the priority of legiti- mate users＇ access. This model can also detect attacks against FTP or DNS or other servers with no need for system logs.

关 键 词：应用层分布式拒绝服务攻击 DFM—FA 卡尔曼滤波 信息熵 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]