利用希尔伯特黄变换检测DDoS攻击英文

De t e c t in g DDo S At t a c k Wit hHilb e r t-Hu a n g Tr a n s fo r m a t io nZheng Ka ngfe ng1,Wa ng Xiujua n2,Y ang Y ixian1,Guo Shize11Key Laboratory of Network and Information Attack&Defense T echnology of MOE,Beijing University of Postsand Telecommunications,Beijing100876,P.R.China2College of Computer Sciences,Beijing Univers ity of T echnology,Beijing100124,P.R.ChinaAbstr act:DDoS detection has been the research focus in the eld of information security.Existing detecting method s such as Hur st parameter method and Markov model must ensure that the network traffic signal f(t)is a stationary signal. But its stability is just a regular assumption and has no strict math ematical pr oof.Ther ef ore meth od s m entio ned abo ve lack of reliable theoretical support.This article introduces Hilbert-HuangTtransformation(HHT).HHT does not need to be based on signal stability,but it monitors the similarity between Hilbert marginal spectrums of adjacent observation sequences so as to realize DDoS detection.The method is experim ented on DAR PA1999d ata and s imu latin g data respectively.Experimental results show that the method behaves better than existing Hurst par ameter method in distinguishing both the normal and the attacked traf c.Key wor d s:HHT;similarity;DDoS detection; marginal hilbert spectrumI.INTRODUCTIONDDoS attack has become one of the main threats on I nter net.How to realize eff ective DDoS detection has been the research focus in the eld of information security.Various methods have been put forward by researchers currently to detect DDos attack,including:(1)Feature matching meth od[1]which is based on mathching the characteristics of network packets(2)statistical methods,such as inspecting the self-similarity of network traf c[2-4]or inspecting the ow connect density[5]based on wavelet transformation[6].(3)Detection on application layer.Making use of a Hidden Markov Model(HMM)to describe the user’s access behavior,so as to get the normal probability of one access[7],etc.One important part in DDoS detection is based on Hurst parameter and the method behaves well in detection.This method is based on the premise that network traf c in any time from millisecond to hour is strictly or progressive self-similar process[8].The similarity extent is measured by the Hurst parameter(H). Higher H represents higher self-similarity.When DDoS attack occurs,H will change greatly[9].So the variety of Hurst parameter can be taken as the basis of detection.It should be noted that the premise of many methods,such as wavelet transform,markov122011.0633论文集锦2011.012731282011.03论文集锦2011.012933curves of +S and S can be drawn,from which the distinguishing ability on positive and negative samples can be concluded,so as to verify the effectiveness of the proposed method.Step 7Similarly,calculating Hurst variety set +H between )(m in,t f T t iand )(min,t f T t t i+in step 2and H between )('m in,t f T t iand )('min,t f T t t i+in step 3according to definition 6.The probability distribution curves of +H and H can be drawn,from which the distinguishing ability between SMHS method and Hur st parameter method can be compared.IV .EXPERIMENTS AND ANALYSISA.Exper imental DataThe paper utilizes DARPA 1999evaluation data provided by Lincoln LAB.The data is currently the most comprehensive one which has covered 58kinds of typical attack mode of 5categories,including Probe,DoS,R2L,U2R and Data.The paper conducts experiments based on the data les named as “outside.tcpdump ”of 4weeks,including the rst week ,the third week,the forth week and the fifth week.Wherein,the former two weeks contain no attack and the latter two weeks contain attack data.Due to the absence of starting time of Tuesday in the forth week,the whole access data of that day is discarded in experiments.I n a dd i ti o n ,b eca u se m an y at tac k s i n DARPA1999ar e sh ort,it will not cau se the sig nif icant v ar iatio n in tr aff ic.The pap er also adopts the simulating data to v erify the effectiveness of the proposed method.Constructing method is to apply high frequency processing to normal data of DARPA1999.In this paper,the entire pure data hourly basis and the data during next ve minutes are expanded 15times.B.Exper imental Resu ltsExp er im ent 1:Choosing T .Considering the features of real network access,T will be selected from following values including 100,300,600,1200,1800and 3600in this paper.This experimentfocuses on the SMHS and SD distr ibution of normal data when T varies.Experimental result is shown in Figure 4:It can be seen from the graph that similarity distribution has no relationship with T in SD method.On the other hand,when using SMHS method,the larger T is,the higher the marginal Hilbert spectrum similarity concentration is and the bigger the values are.But when T increases,the computational complexity of HHT transformation also increased dramatically.Therefore,T=600is taking compromise.It is supposed to t contain all access data of the same one attack as many as possible so as to avoid multiple access of single attack locating at different observation sequence.In this case,interference due to the similarity between attacked d ata can b e reduced.Most o f th e attacking durations in DARPA 1999are less than half an hour.Therefore,t takes 300in the following experiments.-1-0.500.5100.20.40.60.8Sim ila rity Po s s i b i l i t y SMHS dis tr ibute100300600120018003600-1-0.500.5100.10.20.30.40.5Sim ila rityPo s s i b i l i t y SD distribu te100300600120018003600Fig.4Probability distribution of SMHS and SDExperiment 2:Let T be 600and t be 300.102011.033论文集锦Generating observation sequences in the DA-RPA data o f 4weeks,calculating +S and S acco rd ing t o the detecting alg or ithm.The probability distribution curving of +S and S are drawn in Figure 5.-1-0.8-0.6-0.4-0.200.20.40.60.8100.050.10.150.2Similarity Po s s i b i l i t y S M HS m e thodn orma l da ta abnorma l d a ta-1-0.8-0.6-0.4-0.200.20.40.60.8100.20.40.60.8SimilarityP o s s i b i l i t y S D m e thodn orma l da ta abnorma l d a taFig.5Detecting result on DARPA dataIt can see f rom Fig.,the m arginal Hilbert spectrum similarity of normal traffic has some difference with that of the abnormal one,which means that SMHS method can distinguish normal data and abnormal data to a certain extent.But th e distin guish ing ability is r elatively weak.On the contr ary,the data ’s similarities of the normal traffic and abnormal one have almost the same distribution,which means that SD method cannot identify attack basically.As is mentioned above,the result is due to the short attack data in DARPA1999,i.e.,the method behaves weak performance when detecting DDoS of short-term.With the same settings,calculate +H and H according to the detecting algorithm.The probability distribution curving of +H and H are drawn in Figure 6.-0.2-0.10.10.20.30.40.50.60.20.40.6Hurs t v arietyPo s s i b i l i t y Hurs t m etho dnor m al data abnor m al dataFig.6Distribution of Hurst variety on DARPA dataIt can be seen from figure,the Hurst varietiesbetween the normal traf c and the abnormal traffic,compared to their respective neighbor sequence,have almost the same distribution,which means that traditional Hurst parameter method cannot identify attack basically under said environment.Exp er iment 3:Let T be 600and t b e 300.Take the data of the first week and third week in DARPA1999as the normal data.And the simulating data based on them are taken as abnormal data.Calculate +S and S according to the said detecting algorithm and dr aw th e probability distribution curves in Figure 7:-0.20.20.40.60.810.10.20.3S imilarityP o s s i b i l i t y S MHS m ethodnorma l data abnorm al data-0.2-0.10.10.20.30.20.4H u r s t v arietyPo s s i b i l i t y Hurs t m ethodnormal da ta abnormal dataFig.7Detecting result on simulating dataIn the graph,the marginal Hilbert spectrumsimilarities of attacked data concentrate in about 0.75and normal data concentrate in about 0.9.Their probability distribution curves have a better distinction,which means that the SMHS method can detect DDoS attack.The Hurst param eter method is unable to identify DDoS due to the basically sam e distr ibution o f Hur st var iety between the normal data and attack data compared to their neighbor observation sequence.V .CONCLUSIONS AND PROBLEMSIt can be concluded from the experimental results that DDoS attacking tr af fic can be detected validly by monitoring the similarity of the Hilbert2011.011marginal spectrum between adjacent sequences based on HHT.And the time of attack can also be positioned roughly according to the dislocation relationship between adjacent sequences.These experiments can prove that this method is better than the Hurst parameter method.But there are still several problems which should be settled in this method.Endpoint effect is inevitable in HHT,which will decrease the accuracy of the margin spectrum and further influence subsequent attack judging. How to reduce the endpoint effect has become an impor tant research dir ectio n in HHT and researchers have put forward some methods to solve it.Experiments in this paper have used the mainstream method of symmetrical continuation method[13].This method is not perfect and it cannot completely solve the problem.How to further restrain endpoint effect in order to improve the detection accuracy is not settled.The proposed method behaves better in detecting attack compared to the existing network traffic Hurst parameter method.But it also introduces huge computation amount and longer computing time due to the HHT transformation,which increases the dif culty in on-line detection.Acknowledgeme ntsThis work was supported by410010502,9140A15060109 DZ802,9140C1105061005,Chinese National Natural Science Foundation(No:61070204)and Youth Science Research Fund Project of Beijing University of Technology (No.00700054K4008).Reference s[1]PENG Tao,LE CKIE C,RAMAMOHAN ARAO K.Protection from Distributed Denial of Service Attacks Using History-based IP Filtering[C]//IEEE International Conference on Communications,2003:482–486.[2]HE Hui,ZHANG Hongli,ZHANG Weizhe,et al.A DDoSIn trusion Detection Method based on Likeness[J].Journal of China Institute of Communications,2004, 25(7):176–184.[3]XIANG Y,LIN Y,LEI W L,et al.Detecting DDOS Attackbased on Network Self-similarity[J].IEE Proceedings communications,2004:292–295.[4]HUANG N E,SHEN Z,LONG S R,et al.The EmpiricalMode Decomposition and the Hilbert Spectrum for Nonlinear and Non-stationary Time Series Analysis[J].The Royal Society of London,A.1998,454:903–995. [5]SUN Qindong,ZHANG Deyun,GAO Peng.DetectingDistributed Denial of Service Attacks Based on Time Series Analysis[J].Chinese Journal of Computers,2005, 28(5):767–773.[6]YANG M inghui,WANG Ruc huan.DDoS Dete ctionbased on Wavelet Kernel Support Vector Machine[J].T he Journ al of Ch ina Un iversit ies of Post s and Telecommunications,2008,15(3):59–63.[7]XIE Yi,YU Shunzheng.Anomaly Detection based on WebUsers’Browsing Behaviors[J].Journal of Software,2007, 18(4):967977.[8]LELAND W E,T AQQU M S,WILLINGER W,WILSOND V.On the Self-similar Nature of Ethernet Traffic.(Extended Version)[J].IEEE/ACM Transactions on Networking,February1994,2(1):1–15.[9]W ANG Xin,FANG Binxing.An Exploratory Developmenton the Hurst Parameter Variety of Network Traffic Abnormity Signal[J].Journal of Harbin Institute of Technology,2005,37(9):1046–1049.[10]YU Dejie,CHENG Junsheng,YANG Yu.Hilbert_Huang Transformation Method in Mechanical Fault Diagnosis[M].Science Press,2006:24–46.[11]LE I Jiangang,WU Zhou.Research on MeasuringTechnology of Network Performance[J].Fujian Computer.2006,5:59–60.[12]ZHANG Tingzheng,LIN W eiyu,CHEN Shiyu,CHENMeiling.Ascending Grey Prediction Model of Residual Correction-application in the U.S.A NASDAQ Index[C]// Proceedings of the3rd Conference on Applications for Information and Management2004,C4–1–C4–12. [13]HUANG Chengti.Study on Hilbert-Huang Transformand Its Application[D].Southwest jiaotong university, 2006:27–31.122011.033论文集锦Bio grap hiesZheng Kangfeng,received his PhD degree ofInformation and Signal Processing in July2006at Beijing University of Posts and Telecommuni-cations.He is currently an instructor lecturer at school of computer science and technology,Beijing University of Posts and Telecommunications.His research interests include networking and system security,network information processing and network coding.Email:kfzheng@Wang Xiu juan,received her PhD degree ofInformation and Signal Processing in J uly2006a t Be i jing U niv er si ty of P osts a n dTelecommu nicat ions.She i s curren tly an instructor lecturer at College of Computer Sciences,Beijing University of Technology.Her research interests include informaion and signal processing,network security and network coding.Email:xjwang@Y ang Yixian,received his PhD degree of Electronic and Communication System in1988at Beijing College of Posts and Telecommunications.He is currently a professor and PHD supervisor at College of Computer Sciences,Beijing University of Technology.His research interests include informaion security and network security.Guo Sh ize,received his PhD degree in1994at Harbin Institute of Technology.He is currently a senior and PHD supervisor at College of Computer Scienc es,B eijing University of Technology.His research interests include informaion security,network attack and defense and networkevaluation. 2011.01333。