命名数据网络中基于增强隔离林的Interest包洪泛攻击检测方法  

Extended isolation forest-based method to detection against interest flooding attacks in named data networking

作　　者：邢光林[1] 霍红 侯睿[1] XING Guanglin;HUO Hong;HOU Rui(College of Computer Science,South-Central Minzu University,Wuhan 430074,China)

机构地区：[1]中南民族大学计算机科学学院,武汉430074

出　　处：《中南民族大学学报（自然科学版）》2023年第4期477-481,共5页Journal of South-Central University for Nationalities：Natural Science Edition

基　　金：国家自然科学基金资助项目(61972424);中南民族大学2021年研究生学术创新基金资助项目(3212021sycxjj151)。

摘　　要：IFA是NDN中的恶意攻击之一,危害较大.针对IFA,提出基于增强隔离林的IFA检测方法,通过在构造增强隔离林的过程中区分Interest包所携带的合法前缀与异常前缀,对异常前缀进行进一步判断,从而准确地检测出恶意前缀.所提出的方法将检测出的恶意前缀列入黑名单中,限制携带恶意前缀的Interest包转发.仿真结果表明:该方法能够有效地缓解IFA.Interest Flooding Attacks(IFA)are malicious attacks in Named Data Networking(NDN)and are very harmful.An IFA detection method based on an extended isolation forest is proposed,which distinguishes normal prefixes and abnormal prefixes carried by interest packets in the process of constructing an extended isolation forest.The method makes further determinations about abnormal prefixes to accurately detect malicious prefixes.The method includes the detected malicious prefixes in the blacklist and restricts the forwarding of interest packets carrying malicious prefixes.Simulation results show that the method can effectively mitigate IFA.

关 键 词：命名数据网络 兴趣包洪泛攻击 增强隔离林 异常分数 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]