分布式拒绝服务攻击高速率单点局部异常检测  

HIGH-RATE SINGLE-POINT LOCAL ANOMALY DETECTION FOR DISTRIBUTED DENIAL OF SERVICE ATTACK

作　　者：刘玉宽[1] 苏金树[1] 

机构地区：[1]国防科学技术大学计算机学院,湖南长沙410073

出　　处：《计算机应用与软件》2015年第9期299-302,309,共5页Computer Applications and Software

摘　　要：由于单进程抓包检测分布式拒绝服务攻击(DDoS)方法,检测速度较慢,危害客户端的安全。针对这种情况,提出高速率单点局部异常检查算法。方法首先基于单点多线程抓包,然后,利用Sketch矩阵对网络信息参数(目的 IP)压缩存储,计算压缩存储的信息、得出信息熵[1]和动态阈值,最后对熵值和动态阈值作比较,判断是否有异常发生。实验结果表明,检测系统的检测速度得到明显的提高,降低了攻击对客户端资源的危害性。实验数据表明该方法能够更快更准确地检测出网络信息的异常,为客户端预防攻击争取了时间。Single-process capture detection method for distributed denial of service （DDoS） attacks is slow in detection rate and endangers the safety of clients. For this situation, we proposed the high-rate single-point local anomaly detection algorithm. The method is firstly based on the single-point multi-threaded capture, and then uses Sketch matrix to compress and store the parameters of network information （destination IP）, calculates the compressed and stored information to obtain the information entropy and dynamic threshold, finally the entropy and the dynamic threshold are compared to determine whether the anomaly occurs. Experimental results show that the detection speed of the detection system is significantly improved, and the harmfulness of the attack on client resources is decreased. Experimental data indicates that the method can be faster and more accurate in detecting the anomalies of network information, and this gains the time for clients in preventing attacks.

关 键 词：DDOS攻击 并行检测线程 Sketch矩阵 信息熵 动态阈值 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]