DDOS洪水攻击检测方法  

DDOS Flood Attack Detection Method

作　　者：张旭华 任蔚[1] Zhang Xuhua;Ren Wei(Department of Scientific Research and Information,Shaanxi Energy Institute,Xianyang Shaanxi 712000,China)

机构地区：[1]陕西能源职业技术学院科研信息处,陕西咸阳712000

出　　处：《信息与电脑》2018年第12期52-53,共2页Information & Computer

摘　　要：洪水攻击是主流的DDOS攻击手段,传统的检测方法是设定流量阈值,当网络中流量超过阈值时判断检测到攻击。这种方法对网络中流量波动误报率较高。为了解决此问题,笔者提出了一种基于流量方差的检测方法,当网络中流量大于设定流量阈值时,计算当前流量和上一个时间段流量的方差,当连续几个计算周期内的方差都大于方差阈值时,则判断检测到洪水攻击。实验结果表明,此方法能够正确检测到攻击,并会过滤因流量波动产生的误报。Flood attack is the main means of DDOS attack. The traditional detection method is to set the threshold of traffic, and detect attacks ,when the traffic exceeds the threshold. This method has higher false positive rate for network traffic fluctuation. In order to solve this problem, a detection method based on flow variance is proposed. When the network flow is greater than the set flow threshold, the variance of current flow and the flow rate of the last time period is calculated. When the variance in several consecutive calculation periods is greater than the variance threshold, the flood attack is detected. Experimental results show that this method can detect attacks correctly and filter false positives caused by traffic fluctuations.

关 键 词：洪水攻击 流量阈值 方差阈值 检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]