融合稀疏注意力机制在DDoS攻击检测中的应用  

DDoS attack detection model based on sparse attention mechanism

作　　者：王博 万良[1] 叶金贤 刘明盛 孙菡迪 WANG Bo;WAN Liang;YE Jin-xian;LIU Ming-sheng;SUN Han-di(State Key Laboratory of Public Big Data,School of Computer Science and Technology,Guizhou University,Guiyang 550025,China)

机构地区：[1]贵州大学计算机科学与技术学院公共大数据国家重点实验室,贵州贵阳550025

出　　处：《计算机工程与设计》2024年第5期1312-1320,共9页Computer Engineering and Design

基　　金：国家自然科学基金项目(62062020、62262004);贵州省教育厅自然科学研究基金项目(黔教科(2007)015号)。

摘　　要：针对现有的DDoS(distributed denial of service)攻击检测模型面临大量数据时,呈现出检测效率低的问题。为适应当前网络环境,通过研究DDoS攻击检测模型、提取流量特征、计算攻击密度,提出一种基于融合稀疏注意力机制的DDoS攻击检测模型GVBNet(global variable block net),使用攻击密度自适应计算稀疏注意力。利用信息熵以及信息增益分析提取攻击流量的连续字节作为特征向量,通过构建基于GVBNet的网络模型在两种数据集上进行训练。实验结果表明,该方法具有良好的识别效果、检测速度以及抗干扰能力,在不同的环境下具有应用价值。The existing DDoS(distributed denial of service)attack detection model presents the problem of low detection efficiency when facing a large amount of data.To adapt to the current network environment,the DDoS attack detection model GVBNet(global variable block net)based on the fused sparse attention mechanism was proposed by studying the DDoS attack detection model,extracting the traffic features,and calculating the attack density,and the attack density was used to calculate the sparse attention adaptively.The continuous bytes of attack traffic were extracted as feature vectors using information entropy and information gain analysis,and the network model based on GVBNet constructed was trained on two data sets.Results of experiments show that the method has good recognition effects,detection speed,and anti-interference capability,has application value in different environments.

关 键 词：分布式拒绝服务攻击 稀疏注意力机制 攻击密度 信息熵 信息增益 模型优化 攻击检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]