命名数据网络中基于重构完全随机森林的兴趣包泛洪攻击检测方法  

Interest Flooding Attack detection method base-on reconstruction-based Completely Random Forest in NDN

作　　者：李小奇 肖游 邢光林[1] 黄英 侯睿[1] LI Xiaoqi;XIAO You;XING Guanglin;HUANG Ying;HOU Rui(College of Computer Science,South-Central Minzu University,Wuhan 430074,China;Information&Telecommunication Branch(Data Center)of State Grid Wuhan Electric Power Supply Company,Wuhan 430014,China)

机构地区：[1]中南民族大学计算机科学学院,武汉430074 [2]国网武汉供电公司信息通信分公司(数据中心),武汉430014

出　　处：《中南民族大学学报（自然科学版）》2024年第5期637-641,共5页Journal of South-Central University for Nationalities：Natural Science Edition

基　　金：国家自然科学基金资助项目(61972424)。

摘　　要：Interest泛洪攻击被认为是命名数据网络面临的最大威胁之一.现有的IFA检测方法主要基于PIT过期率,Interest包满足率或Interest包的名称分布,目前所提出的方法容易受到流量波动问题的影响,不能迅速、准确地区分攻击与流量波动.针对这一问题提出了一种基于RecForest的IFA检测方法,该方法收集PIT内的Interest包信息进行重构,限制恶意Interest包的转发来缓解IFA的影响.仿真结果表明:该方法可以降低因流量波动引起的误判问题,并有效地检测IFA.Interest Flooding Attacks are considered to be one of the biggest threats to Named Data Networks.Existing IFA detection methods are mainly based on the PIT expiration rate,interest packet satisfaction rate or the name distribution of interest packets,and the currently proposed methods are vulnerable to the problem of traffic fluctuations and cannot distinguish attacks from traffic fluctuations quickly and accurately.To address this problem,a RecForest based IFA detection method is proposed,which collects the information of interest packets within the PIT for reconstruction and restricts the forwarding of malicious interest packets to mitigate the impact of IFA.Simulation results show that the method can reduce the problem of false positives caused by traffic fluctuations and effectively detect IFA.

关 键 词：命名数据网络 Interest泛洪攻击 攻击检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]