基于改进D-S证据理论的DDoS攻击检测算法研究  

Detecting DDoS attacks based on improved D-S evidence theory

作　　者：胡春安[1] 黄江华[1] 

机构地区：[1]江西理工大学信息工程学院,江西赣州341000

出　　处：《计算机工程与设计》2014年第4期1198-1201,1206,共5页Computer Engineering and Design

基　　金：江西省教育厅重点基金项目(赣教技字[12770]号)

摘　　要：针对DDoS攻击存在检测难、可信度低、计算量大等问题,提出添加权值的Dempster-Shafer证据理论的DDoS攻击检测方法。通过部署Snort入侵检测系统对整个网络进行监测,使用改进的Dempster-Shafer证据理论对其产生的警报信息进行处理,通过对证据添加权值,提高了证据的可信度,从而过滤其中的错误警报信息,减小误警率。实验结果表明,该方法能够快速、准确地检测到攻击,较之前的检测方法,性能有较大的提高。Based on the difficulty, low reliability, and huge computation of detecting DDoS attack, an adding weight Dempster- Sharer evidence theory is put forward on detecting DDoS attack. The Snort intrusion detection system is deployed to monitor the entire network, and then the alert information is processed by improved Dempster-Shafer evidence theory, by adding the weight of the evidence, to improve the credibility of the evidence, thus filters the false alert information, reduces the fault alerts. Experi- ments show that, are detected quickly and accarately these attacks; it is greatly improved than the previous.

关 键 词：DIDoS攻击 SNORT入侵检测系统 D-S证据理论 权值 误警率 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]