基于协作的网络协议异常检测算法  

Algorithm of Anomaly Detection of Network Protocol Based on Collaboration

作　　者：邓军[1] 薛辉[2] 

机构地区：[1]湖南科技职业学院,中国长沙410004 [2]湖南涉外经济学院,中国长沙410205

出　　处：《湖南师范大学自然科学学报》2015年第1期58-63,共6页Journal of Natural Science of Hunan Normal University

基　　金：湖南省科技厅专项基金资助项目(2013FJ6066);湖南省教育厅一般基金资助项目(14C0651);湖南科技职业学院青年基金资助项目(KJ13205)

摘　　要：最近跟踪发现目前现有网络协议异常检测技术只是对常见的协议进行检测,具有一定的片面性,对Do S攻击中的SYN Flooding攻击无法检测到.为了提高检测性能的实用性和实时性,应用协作式方法将基于马尔可夫链检测法和均值评估法共同实现了协议异常检测建模,分析了模型建立的过程并提出了模型系统架构.论述了在马尔可夫链的基础上建立异常检测子模型以及如何使用均值评估法建立检测模型.结果表明该模型对应用层的多种协议和传输层TCP协议进行异常检测以及对SYN Flooding攻击检测效果明显.该算法不仅具有一定的理论创新,还具有较强的实用价值.The recent tracking found that the current anomaly detection technology for network protocols is only on the common protocol testing. It has certain one sidedness, and SYN Flooding attacks on DoS attacks were not detected. Collaborative method was used to detection method based on Markov chain and evaluation method of mean estimates organization together to realize protocol anomaly detection model. The modelling process was analyzed and the system architecture model was proposed, and the design process of anomaly detection model based on Markov chain protocol and evaluation of mean estimates was mainly introduced. The results show that the detection effect of multiple protocols in the application layer and the transport layer TCP protocol anomaly detection and SYN Flooding attack check is obvious in the model. The algorithm not only has a certain theoretical innovation, but also a strong practical value.

关 键 词：入侵检测 拒绝服务攻击 SYN Flooding攻击 协议异常检测 马尔可夫链 数据包 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]