一种自适应的异常流量检测方法  

A Method of Adaptive Abnormal Network Traffic Detection

作　　者：张新跃[1] 胡安磊[1] 李炬嵘[1] 冯燕春 ZHANG Xinyue;HU Anlei;LI Jurong;FENG Yanchun(China Internet Network Information Center,Beijing 100190,China;National Research Center for Information Technology Security,Beijing 100044,China)

机构地区：[1]中国互联网络信息中心,北京100190 [2]国家信息技术安全研究中心,北京100044

出　　处：《信息网络安全》2020年第12期28-32,共5页Netinfo Security

基　　金：科技部重点研发[2019YFB1804501]。

摘　　要：文章针对DDoS异常流量攻击提出一种自适应攻击检测方法,该方法基于网络访问行为特征进行快速学习建模,再通过一个流量TOP-N排序表来实现异常流量的动态过滤。TOP-N排序表的样本模板采用自适应收敛算法来快速自学习更新,可以快速、准确地识别出异常流量和攻击行为,大大提升异常流量攻击行为检测的准确率,特别适用于慢速的应用型DDoS攻击检测和防护领域。In this paper, we propose a new adaptive attack detection method for DDoS abnormal traffic attacks. The method is based on the characteristics of network access behavior for rapid learning modeling, and then through a traffic TOP-N ranking table to achieve dynamic filtering of abnormal traffic. The sample template of TOP-N table adopts adaptive convergence algorithm to quickly self-learning update. This method can quickly and accurately identify abnormal traffic and attack behavior, and greatly improve the accuracy of abnormal traffic attack detection. It is especially suitable for the detection and protection of slow application DDoS attacks.

关 键 词：DDOS TOP-N 自适应 训练模板 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]