基于CNN-BiLSTM的ICMPv6 DDoS攻击检测方法  

Attack Detection Method of ICMPv6 DDoS Based on CNN-BiLSTM

作　　者：郭峰[1] 王春兰[1] 刘晋州 王明华[3] 韩宝安[4] GUO Feng;WANG Chunlan;LIU Jinzhou;WANG Minghua;HAN Baoan(Xijing College,Xi’an 710123,China;Chengdu Polytechnic,Chengdu 610041,China;Air Traffic Control and Navigation College,Air Force Engineering University,Xi’an 710051,China;Sichuan Vocational and Technical College of Communications,Chengdu 611137,China)

机构地区：[1]西京学院,西安710123 [2]成都职业技术学院,成都610041 [3]空军工程大学空管领航学院,西安710051 [4]四川交通职业技术学院,成都611137

出　　处：《火力与指挥控制》2024年第9期122-129,共8页Fire Control & Command Control

摘　　要：针对ICMPv6网络中DDoS攻击检测问题,提出一种基于CNN-BiLSTM网络的检测算法。通过将带有注意力机制、DropConnect和Dropout混合使用加入到CNN-BiLSTM算法中,防止在训练过程中产生的过拟合问题,同时更准确地提取数据的特性数据。通过实验表明:提出的算法在多次实验中的检测准确率、误报率与漏报率平均值分别为92.84%、4.49%和10.54%,检测算法泛化性较强,性能由于其他算法,能够有效处理ICMPv6 DDoS攻击检测问题。Aiming at the problem of DDoS attack detection in ICMPv6 network,a detection algorithm based on CNN-BiLSTM network is proposed.By adding the mixed use of attention mechanism,DropCon⁃nect and Dropout into the CNN-BiLSTM algorithm,the overfitting problems generated during training pro⁃cess are prevented and characteristic data of data is extracted more accurately.The experiments show that the average values of the detection accuracy rate,false alarm rate and missing alarm rate of the proposed algorithm are 92.84%,4.49%and 10.54%respectively in multiple experiments.The detection algorithm has strong generalization and can effectively handle the detection problem of ICMPv6 DDoS attack with its performance superior to other algorithms.

关 键 词：分布式拒绝服务攻击 攻击检测 ICMPV6 CNN BiLSTM 

分 类 号：O235[理学—运筹学与控制论] TN915.08[理学—数学]