基于流量矩阵和Kalman滤波的DDoS攻击检测方法  

DDoS Attacks Detection Method Based on Traffic Matrix and Kalman Filter

作　　者：颜若愚[1] 

机构地区：[1]河南财经政法大学计算机与信息工程学院,郑州450002

出　　处：《计算机科学》2014年第3期176-180,共5页Computer Science

基　　金：国家自然科学基金项目(61101211;61202285);湖南省自然科学基金项目(11JJ9010);河南省自然科学基金项目(132300410337);河南省教育厅项目(13B520901)资助

摘　　要：针对分布式拒绝服务(DDoS)攻击产生的流量往往对路由器造成难以承受的负担的问题,提出一种既能减轻路由器负荷又能快速准确检测DDoS攻击的方法。该方法首先在路由器中构造端口对之间的流量矩阵来准确描述DDoS攻击的流量汇聚特性,然后利用Kalman滤波对流量矩阵进行估计,接着使用GLR统计测试进行异常检测,进而判断路由器端口是否受到DDoS攻击。最后,基于实际数据进行了仿真实验,结果表明,所提方法相比主成分分析(PCA)方法具有更高的检测率、更低的误检率和更小的检测延迟。Distributed Denial of Service （DDoS） attack traffic often is an unbearable burden on router,so a new DDoS attack detection method was proposed to release the burden and to detect the attack fast and accurately.In this method,traffic matrix between ports on the router is first constructed to precisely describe DDoS attack traffic aggregation characteristics.Then Generalized Likelihood Ratio （GLR） statistical test is used to detect traffic anomaly after Kalman filter is applied to estimate traffic matrix.After that whether each router port is attacked by DDoS is judged.Finally,a simulation experiment with actual data was conducted to compare the method with PCA method,which shows that the proposed method has higher detection rate,lower false alarm rate and smaller detection lag time.

关 键 词：分布式拒绝服务 卡尔曼滤波 异常检测 流量分析 流量矩阵 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]