摘要
针对传统方法在检测DDoS攻击时的不足,提出了一种新的IP流交互行为特征算法(IFF),该方法利用IP地址和端口表示IP流的交互性。采用IFF特征,将网络流定义为三种状态,即健康、亚健康和异常,提出了基于IFF特征的三态模型检测方法(DASA),该方法采用了基于滑动平均方法的自适应双阈值算法和报警评估机制,提高了检测DDoS攻击的准确度。仿真实验结果表明,该方法不但能快速、有效地检测DDoS攻击,而且具有较低漏报率和误报率。
Aiming at lack using traditional methods in DDoS detection,this paper proposed a novel IP flow interaction behavior feature（IFF） algorithm based on IP flow interaction via IP addresses and ports.It defined the network flow states into three states as the health state,quasi health state,and abnormal state by using IFF,then presented a simple and efficient DDoS attack detection method based on three-state partition of IFF,and the proposed algorithm exploited self-adapting dual threshold and alarm evaluation mechanism（DASA）,and it could increase accuracy of DDoS attack detection.The simulation results show that the method not only can effectively detect abnormal flows containing DDoS attack flow,but also detect it more accuracy and lower false alarm rate.
出处
《计算机应用研究》
CSCD
北大核心
2012年第4期1445-1448,共4页
Application Research of Computers
基金
国家自然科学基金资金项目(60603062
61100194)
湖南省教育科学"十二五"规划课题(XJK011BXJ004)
湖南省教育厅科研项目(11C1184)
关键词
分布式拒绝服务
IP流交互
报警评估机制
三态模型
distributed denial of service
IP flow interaction
alarm evaluation mechanism
three-state model
