基于并行积累排序算法和主动学习的DDoS攻击检测  

DDoS Attack Detection Based on Parallel Accumulation Ranker Algorithm and Active Learning

作　　者：王慧[1] 张学军[2] WANG Hui;ZHANG Xue-jun(School of Art, Liuzhou Vocational and Technical College, Liuzhou Guangxi 545006, China;Beijing Institute of Control and Electronic Technology, Beijing 100038, China)

机构地区：[1]柳州职业技术学院艺术学院,广西柳州545006 [2]北京控制与电子技术研究所,北京100038

出　　处：《西南师范大学学报（自然科学版）》2021年第1期25-31,共7页Journal of Southwest China Normal University(Natural Science Edition)

基　　金：2020广西高校中青年教师科研基础能力提升项目(2020KY31023,2020KY31024).

摘　　要：为了在高速网络环境下对大容量网络流量进行准确和快速的分类,以检测分布式拒绝服务(Distributed Denial of Service,DDoS)攻击,本文提出一种基于并行积累排序算法和主动学习的DDoS攻击检测算法.该技术采用并行积累排序算法对流量特征进行积累排序来选择最佳特征子集,通过专家模块以无监督的方式选择适当的实例来训练用于检测DDoS攻击流量的支持向量机(SVM)二值分类器,从而实现从数据集中选择小批量训练样本来产生高精度的网络流量分类.实验结果表明,与现有方法相比,本文算法在分类准确率和执行速度方面均优于现有方法.To classify accurately and quickly large capacity network traffic in high-speed network environment to detect distributed denial of service(DDoS)attacks,a DDoS attack detection algorithm based on parallel cumulative ranker algorithm and active learning has been proposed in this paper.In this technique,the parallel accumulation ranker algorithm has been used to accumulate and rank the traffic features to select the best feature subset,and the expert module selects the appropriate examples in an unsupervised way to train the support vector machine binary classifier for detecting DDoS attack traffic,so as to select a small number of training samples from the data set to generate high precision network traffic classification.Experiments show that compared with the existing methods,the proposed algorithm is superior to the existing method performance in classification accuracy and execution speed.

关 键 词：并行积累排序 主动学习 支持向量机 DDOS攻击 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]