基于一维卷积神经网络的HTTP慢速DoS攻击检测方法  

Slow HTTP DoS attack detection method based on one-dimensional convolutional neural network

作　　者：陈旖 张美璟 许发见[1,2] CHEN Yi;ZHANG Meijing;XU Fajian(Department of Computer and Information Security Management,Fujian Police College,Fuzhou Fujian 350007,China;Institute of Cyber Security and Electronic Material Evidence,Fujian Police College,Fuzhou Fujian 350007,China)

机构地区：[1]福建警察学院计算机与信息安全管理系,福州350007 [2]福建警察学院网络安全与电子物证研究所,福州350007

出　　处：《计算机应用》2020年第10期2973-2979,共7页journal of Computer Applications

基　　金：福建省自然科学基金面上项目(2017J01514);教育部人文社科研究青年基金资助项目(17YJC630213);福建省中青年教师教育科研项目(JAT190440)。

摘　　要：为解决HTTP慢速拒绝服务(SHDoS)攻击流量检测在攻击频率变化时出现的准确率降低的问题,提出一种基于一维卷积神经网络(CNN)的SHDoS攻击流量检测方法。首先,该方法在多种攻击频率下对三种类型的SHDoS攻击流量进行报文采样和数据流提取;之后,设计了一种数据流转换算法,将采集的攻击数据流转换为一维序列并进行去重;最后,使用一维CNN构建分类模型,该模型通过卷积核来提取序列片段,并从片段中学习攻击样本的局部模式,从而使模型对多种攻击频率的数据流都具备检测能力。实验结果显示,与基于循环神经网络(RNN)、长短期记忆(LSTM)网络及双向长短期记忆(Bi-LSTM)网络构建的分类模型相比,该模型对未知攻击频率的样本同样具有较好的检测能力,在验证集上的检测准确率和精确率分别达到了96.76%和94.13%。结果表明所提方法能够满足对不同攻击频率的SHDoS流量进行检测的需求。In order to solve the problem that the accuracy of Slow HTTP Denial of Service(SHDoS)attack traffic detection decreases when the attack frequency changes,a method of SHDoS attack traffic detection method based on onedimensional Convolutional Neural Network(CNN)was proposed.First,the message sampling and data stream extraction were performed on three types of SHDoS attack traffic under multiple attack frequencies by the method.Then,a data stream conversion algorithm was designed to convert the collected attack data streams into one-dimensional sequences and remove the duplicated sequences.Finally,a one-dimensional CNN was used to construct a classification model.The model was used to extract sequence fragments through the convolution kernels,and the local patterns of attack samples were learned from fragments.Therefore,the model would have the ability to detect attack traffic with multiple attack frequencies.Experimental results show that,compared with the classification models based on Recurrent Neural Network(RNN),Long Short-Term Memory(LSTM)network,and Bidirectional LSTM(Bi-LSTM)network respectively,the proposed model has advantages in detection performance on unknown frequency samples,and has the accuracy and precision reached 96.76%and 94.13%respectively on the validation set.It can be seen that the proposed method can meet the needs of detecting SHDoS traffic with different attack frequencies.

关 键 词：慢速HTTP拒绝服务攻击 恶意流量检测 卷积神经网络 深度学习 流量分类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]