DDoS攻击的全局异常相关检测方法

DDoS攻击的全局异常相关检测方法
李宗林;胡光岷;杨丹;姚兴苗
【期刊名称】《计算机应用》
【年(卷),期】2009(029)011
【摘要】DDoS attack is hard to detect in backbone network, for the reason that attack flows are distributed in multiple links and prone to be masked by tremendous amounts of background traffic. To solve this problem, a detection method based on global abnormal correlation analysis was proposed. The change of correlation between traffic caused by attack flows was exploited for attack detection, the correlation between potentially anomalous traffic was extracted by principle component analysis, and its change degree was used as an indicator of attack. Evaluation shows effectiveness of the proposed method, and proves that it overcomes the difficulties in detecting relatively low volume of DDoS attack transiting in backbone network. Compared with the existing network-wide detection method, it achieves higher detection rate.%骨干网中存在的DDoS攻击,由于背景流量巨大,且分布式指向受害者的多个攻击流尚未汇聚,因此难以进行有效的检测.为了解决该问题,提出一种基于全局流量异常相关分析的检测方法.根据攻击流引起流量之间相关性的变化,采用主成分分析提取多条流量中潜在异常部分之间的相关性,并将相关性变化程度作为攻击检测测度.实验结果证明了该测度的可用性,能够克服骨干网中DDoS攻击流幅值相对低且不易检测的困难,同现有的全局流量检测方法相比,所提出的方法能够取得更高的检测率.
【总页数】6页(P2952-2956,2959)
【作者】李宗林;胡光岷;杨丹;姚兴苗
【作者单位】电子科技大学,宽带光纤传输与通信网技术教育部重点实验室,成都,611731;电子科技大学,宽带光纤传输与通信网技术教育部重点实验室,成
都,611731;电子科技大学,宽带光纤传输与通信网技术教育部重点实验室,成
都,611731;电子科技大学,宽带光纤传输与通信网技术教育部重点实验室,成
都,611731
【正文语种】中文
【中图分类】TP393.08
【相关文献】
1.结合多属性的视频中全局异常事件检测方法 [J], 盖杰;陈华华;郭春生
2.基于网络全局流量异常特征的DDoS攻击检测 [J], 罗华;胡光岷;姚兴苗
3.基于全局网络PCA的DDoS攻击检测方法 [J], 柳祎;付枫;孙鑫
4.基于组合相关度的随机森林DDoS攻击检测方法 [J], 李梦洋;唐湘滟;程杰仁;刘译夫
5.基于全局和局部判别对抗自编码器的异常检测方法 [J], 邢红杰;郝忠
因版权原因，仅展示原文概要，查看原文内容请购买。