基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法  

Application Layer DDoS Attack Detection Method Based on Multimodal Neural Network Traffic Characteristics

作　　者：王小宇[1,2] 贺鸿鹏 马成龙 陈欢颐 WANG Xiaoyu;HE Hongpeng;MA Chenglong;CHEN Huanyi(School of Electrical Engineering,Xi´an University of Technology,Xi´an 710048,China;State Grid East Inner Mongolia Electric Power Supply Co.,Ltd.,Hohhot 010010,China)

机构地区：[1]西安理工大学电气工程学院,西安710048 [2]国网内蒙古东部电力有限公司,呼和浩特010010

出　　处：《沈阳农业大学学报》2024年第3期354-362,共9页Journal of Shenyang Agricultural University

基　　金：国网内蒙古东部电力有限公司科技项目(SGMD0000DDJS2200049)。

摘　　要：农业设备、传感器和监控系统与网络的连接日益紧密,给农村配电网带来了新的网络安全挑战。其中,分布式拒绝服务(DDoS)攻击是一种常见的网络威胁,对农村配电网的安全性构成了严重威胁。针对农村配电网的特殊需求,提出一种基于多模态神经网络流量特征的网络应用层DDoS攻击检测方法。通过制定网络应用层流量数据包捕获流程并构建多模态神经网络模型,成功提取并分析了网络应用层DDoS攻击流量的特征。在加载DDoS攻击背景下的异常流量特征后,计算相关系数并设计相应的DDoS攻击检测规则,以实现对DDoS攻击的有效检测。经试验分析,所提出的方法在提取DDoS攻击相关特征上表现出色,最大提取完整度可达95%,效果明显优于对比试验中基于EEMD-LSTM的检测方法和基于条件熵与决策树的检测方法。The increasing connectivity of agricultural equipment,sensors and monitoring systems to the network poses new cybersecurity challenges to rural distribution grids.Among them,distributed denial-of-service(DDoS)attacks are a common cyber threat that poses a serious threat to the security of rural power distribution networks.This study is dedicated to propose a network application layer DDoS attack detection method based on multimodal neural network traffic features for the special needs of rural power distribution networks.By formulating the web application layer traffic packet capture process and constructing a multimodal neural network model,the features of web application layer DDoS attack traffic are successfully extracted and analyzed.After loading the abnormal traffic features in the context of DDoS attack,the correlation coefficient is calculated and the corresponding DDoS attack detection rules are designed to achieve effective detection of DDoS attack.After experimental analysis,the proposed method performs well in extracting DDoS attack related features,with a maximum extraction completeness of up to 95%,which is significantly better than that of the DDoS attack detection methods based on EEMD-LSTM and those based on conditional entropy and decision tree in the comparison experiments.

关 键 词：农村配电网 流量特征提取 DDOS攻击 网络应用层 多模态神经网络 攻击行为检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]