基于流量行为特征的DoS&DDoS攻击检测与异常流识别  

Traffic behavior feature based DoS&DDoS attack detection and abnormal flow identification for backbone networks

作　　者：周颖杰[1,2] 焦程波[3] 陈慧楠[1] 马力[1] 胡光岷[1] 

机构地区：[1]电子科技大学光纤传感与通信教育部重点实验室,成都611731 [2]四川大学计算机学院,成都610065 [3]北京信息技术研究所,北京100093

出　　处：《计算机应用》2013年第10期2838-2841,2845,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60872033,61201127)

摘　　要：针对现有方法仅分析粗粒度的网络流量特征参数,无法在保证检测实时性的前提下识别出拒绝服务(DoS)和分布式拒绝服务(DDoS)的攻击流这一问题,提出一种骨干网络DoS&DDoS攻击检测与异常流识别方法。首先,通过粗粒度的流量行为特征参数确定流量异常行为发生的时间点;然后,在每个流量异常行为发生的时间点对细粒度的流量行为特征参数进行分析,以找出异常行为对应的目的 IP地址;最后,提取出与异常行为相关的流量进行综合分析,以判断异常行为是否为DoS攻击或者DDoS攻击。仿真实验的结果表明,基于流量行为特征的DoS&DDoS攻击检测与异常流识别方法能有效检测出骨干网络中的DoS攻击和DDoS攻击,并且在保证检测实时性的同时,准确地识别出与攻击相关的网络流量。The existing methods for backbone networks only analyze coarse-grained network traffic characteristic parameters. Thus, they cannot guarantee both the premise of abnormal flow identification and the real-time detection for DoS （ Denial of Service） ＆ DDoS （ Distributed Denial of Service, DDoS） attacks. Concerning this problem, a DoS＆DDoS attack detection and abnormal flow identification method for backbone networks was proposed. First, it analyzed coarse-grained network traffic characteristic parameters to determine the time points that abnormal behaviors occur; then, fine-grained traffic behavior characteristic parameters were analyzed in these time points to find the destination IP addresses that correspond to abnormal behaviors; finally, comprehensive analysis was conducted for extracted traffic that correspond to abnormal behaviors to determine DoS and DDoS attacks. The simulation results show that, the proposed method can effectively detect DoS attacks and DDoS attacks in backbone networks. Meanwhile, it could accurately identify the abnormal traffic, while real-time detection is ensured.

关 键 词：异常检测 异常流识别 骨干网络 信息熵 流量分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]