基于动态阈值的可变速率DDoS攻击检测方法  

Variable Rate DDoS Attack Detection Method Based on Dynamic Threshold

作　　者：孙佳奇 谭小波[1] 郭浩然 张忠良 SUN Jiaqi;TAN Xiaobo;Guo Haoran;ZHANG Zhongliang(Schools of Information Science and Engineering,Shenyang Ligong University,Shenyang 110159,Liaoning Province;Shenyang Military Representative Bureau,Shenyang 110015,Liaoning Province)

机构地区：[1]沈阳理工大学信息科学与工程学院,辽宁沈阳110159 [2]陆装驻沈阳地区第一军代室,辽宁沈阳110015

出　　处：《沈阳工程学院学报（自然科学版）》2024年第1期48-54,61,共8页Journal of Shenyang Institute of Engineering:Natural Science

基　　金：辽宁省教育厅2021年度科学研究经费项目(面上项目)(LJKZ0241)。

摘　　要：针对可变速率DDoS攻击检测难的问题,提出了一种基于动态阈值的可变速率DDoS攻击检测方法。该方法根据DDoS攻击流量特征,生成动态阈值,并应用冻结机制防止动态阈值参数被攻击流量污染,同时结合网络流的特征,使用BiLSTM模型双向学习经过时间分割的网络流量,提取更多特征,识别可变速率DDoS攻击。在NSL-KDD数据集上进行实验,召回率达到98%,精度达到95%。实验表明:相比于固定阈值DDoS和传统动态阈值DDoS攻击检测方法,本文提出的方法在检测精度上有所提升,对DDoS攻击的检测能力有了显著提高。Aiming at the problem of variable rate DDoS attack detection,a variable rate DDoS attack detection method based on dynamic threshold is proposed.According to the characteristics of DDoS attack traffic,dynamic threshold is generated and the freezing mechanism is applied to prevent the attack traffic from polluting the dynamic threshold parameters.At the same time,combined with the characteristics of the network flow,the BiLSTM model is used to bidirectionally learn the time-segmented network traffic,extract more features,and identify variable-rate DDoS attacks.Experimented on the NSL-KDD dataset,the recall rate reaches 98%and the precision reaches 95%.Experiments show that compared with the fixed threshold DDoS attack detection method and the traditional dynamic threshold DDoS attack detection method,the detection accuracy of this method is increased,and the detection ability of DDoS attack has been significantly improved.

关 键 词：DDOS攻击检测 动态阈值 冻结机制 双向长短时记忆网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]