基于地址相关度的分布式拒绝服务攻击检测方法

《基于地址相关度的分布式拒绝服务攻击检测方法》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、万方数据计算机研究与发展ISSN1000—1239／CN1l一1777／TPJournalofComputerResearchandDevelopment46(8)：1334—1340，2009基于地址相关度的分布式拒绝服务攻击检测方法程杰仁1’2殷建平1刘运1蔡志平1李敏11(国防科学技术大学计算机学院长沙410073)2(湘南学院数学系湖南郴州423000)(ejr22@163．eom)DetectingDistributedDenialofServiceAttackBasedonAddressCorrelation

2、ValueChengJierenl“，YinJianpin91，LiuYunl，CaiZhipin91，andLiMinl1(CollegeofComputer，NationalUniversityofDeferiseTechnology，Changsha410073)2(DepartmentofMathematics，XiangnanUniversity，Chenzhou，Hunan423000)AbstractDetectingdistributeddenialofservice(DDoS)attacksiscurr

3、entlyahottopicinthenetworksecurityfield．ThecharacteristicsofDDoSattacksandtheexistingmethodstodetectDDoSattacksareanalyzed。andanoveldetectionschemeforDDoSattacksbasedonaddresscorrelationvalue(ACV)iSproposed．ACVisdesignedtoreflecttheessentialfeaturesofDDoSattacks，

4、suchastheabrupttrafficchange，flowdissymmetry，distributedsourceIPaddressesandconcentratedtargetIPaddresses．Toincreasethedetectionaccuracyinvariousconditions，ACVtimeseriesaretransformedintoamuhidimensionalvector(MV)byestimatingtheautoregressive(AR)modelparametersus

5、ingtheYule-Walkermethod。andthenMViSusedtodescribethestatefeaturesofnetworkflows．Furthermore，asupportvectormachine(SVM)classifier，whichistrainedbyMVofACVtimeseriesfromnormalflowandattackflow，isappliedtoclassifythestateofcurrentnetworkflowandidentifytheDDoSattacks．

6、TheexperimentalresultsshowthatACVtimeseriescanbewellusedtocharacterizethedifferentstatefeaturesbetweenDDoSattackflowsandnormalflows：theschemecanidentifythestatefeaturesoftheabnormalflowduetotheDDoSattackingflows，anddetectDDoSattacksaccuratelyandreducethefalseposi

7、tivedrastically．Keywordsnetworksecurity；distributeddenialofserviceattack；addresscorrelationvalue；autoregressivemodel；supportvectormachine摘要分布式拒绝服务(DDoS)攻击检测是网络安全领域的研究热点．对DDoS攻击的研究进展及其特点进行了详细分析，针对DDoS攻击流的流量突发性、流非对称性、源IP地址分布性和目标IP地址集中性等本质特征提出了网络流的地址相关度(ACV)的概念．为了充分

8、利用ACV，提高方法的检测质量，提出了基于ACV的DDoS攻击检测方法，通过自回归模型的参数拟合将ACV时间序列变换为多维空间内的AR模型参数向量序列来描述网络流状态特征，采用支持向量机分类器对当前网络流状态进行分类以识别DDoS攻击．实验结果表明，该检测方法能够有效地检测DDoS攻击，降低误报率．关键词网络安全；分