基于最大频繁序列模式挖掘的App-DDoS攻击的异常检测  

Detecting App-DDoS Attacks Based on Maximal Frequent Sequential Pattern Mining

作　　者：李锦玲[1] 汪斌强[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《电子与信息学报》2013年第7期1739-1745,共7页Journal of Electronics & Information Technology

基　　金：国家科技支撑计划(2011BAH19B01);国家高技术研究发展计划(2011AA01A103)资助课题

摘　　要：为了动态、准确、高效地描述用户的访问行为,实现对不同应用层分布式拒绝服务(Application-layerDistributed Denial of Service,App-DDoS)攻击行为的透明检测,该文提出基于最大频繁序列模式挖掘的ADA_MFSP(App-DDoS Detection Algorithm based on Maximal Frequent Sequential Pattern mining)检测模型。该模型在对正常Web访问序列数据库(Web Access Sequence Database,WASD)及待检测WASD进行最大频繁序列模式挖掘的基础上,引入序列比对平均异常度,联合浏览时间平均异常度、请求循环平均异常度等有效检测属性,最终实现攻击行为的异常检测。实验证明:ADA_MFSP模型不仅能有效检测各类App-DDoS攻击,且有良好的检测灵敏度。In order to describe the user＇s access behavior dynamically,efficiently and accurately,a novel detection model for Application-layer Distributed Denial of Service（App-DDoS） attack based on maximal frequent sequential pattern mining is proposed,named App-DDoS Detection Algorithm based on Maximal Frequent Sequential Pattern mining（ADA_MFSP）.After mining maximal frequent sequential patterns of trained and detected Web Access Sequence Database（WASD）,the model introduces sequence alignment,view time and request circulation abnormality to describe the behaviour of App-DDoS attacks,finally achieves the purpose of attack detection.It is proved with experiments that the ADA_MFSP model can not only detect kinds of App-DDoS attacks,but also has good detection sensitivity.

关 键 词：应用层分布式拒绝服务攻击 检测模型 频繁序列模式挖掘 异常度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]