基于抽样流长与完全抽样阈值的异常流自适应抽样算法

高速IP网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计精度偏低,对异常流量筛选能力较差的缺陷,该文提出一种基于业务流已抽样长度与完全抽样阈值S的自适应流抽样算法(AFPT)。AFPT算法根据完全抽样阈值S筛选对异常流量敏感相关的小流,同时根据业务流已抽样长度自适应调整抽样概率。仿真和实验结果表明,AFPT算法的估计误差与理论上界相符,具有较强的异常流量筛选能力,能够有效提高异常检测算法的准确率。     

SDN环境下基于条件熵的DDoS攻击检测研究

随着软件定义网络(SDN)研究的发展,其安全性越来越受到重视。由于集中控制和软件可编程的特点,使得SDN容易遭受分布式拒绝服务攻击(DDo S)攻击的威胁。针对基于信息熵的DDo S攻击检测方法的改进,文章提取了流表项中的TTL和源IP地址,得到相同TTL值下源IP地址的条件熵,进一步使用滑动窗口非参数CUSUM算法来分析熵值变化以检测DDo S攻击,最后运用仿真实验验证了其有效性。该方法拥有更低的误报率和更高的敏感度,占用资源少,检测速度快,非常适合SDN环境。     

基于异常流量攻击的特征识别和防御系统

异常流量攻击一直是互联网防御中的一个软肋.随着科技的日新月异,数据流量越来越廉价,网络带宽在逐渐增加,而异常流量攻击也在不断的发展,规模在不断扩大,方式上也层出不穷.异常流量攻击的特征识别和防御系统的研究主要提出在特征识别上判断异常流量攻击的数据包和源IP,使用新IP地址的方法进行特征识别,基于CDN来进行流量清洗,对其实现防御.     

高速网络中入侵检测的抽样方法

提出了一个面向主干网入侵检测,以内存瓶颈消耗量为测度的动态自适应抽样方法IDSampling.通过分析攻击流量的流长和熵聚类信息特征指导抽样,过滤掉攻击可疑性低的报文,采取"节流"方法解决万兆网络入侵检测存在的性能和精度不平衡问题.在大规模异常发生时采用基于单报文属性熵的单一抽样策略,其他情况下采用带反馈指导的混合抽样策略,试图用尽可能小的检测代价来取得同样的检测效果.实验结果表明①IDSampling可以大幅减低IDS处理输入,同时保证对主干网人规模攻击趋势性信息的检测精度;②相较于随机报文抽样和随机流抽样方法,IDSampling凭借流长、熵聚类信息和后期检测结果等启发式信息的指导,其抽取攻击报文的准确性高于前2种方法,尤其是在大规模、高强度攻击情况下IDSampling抽中攻击报文的数目甚至高于其他2种方法一个数量级.     

面向带宽碎片最小化和QoS保障的数据中心网络流量调度算法

随着数据中心网络流量的迅速增长,如何提高数据中心网络性能和服务质量成为了研究热点。然而现有的流量调度算法在网络负载加大时,一方面会导致网络带宽碎片化从而使得网络吞吐量降低,另一方面忽视了流量应用需求导致网络服务质量较差。为此,该文提出一种面向带宽碎片最小化和QoS保障的动态流量调度算法,算法综合考虑了带宽敏感的大流、时延与丢包敏感的小流的不同需求,首先根据待调度流的源地址和目的地址建立最短路径集,其次从中筛选出满足待调度流的带宽需求的所有路径,然后根据路径剩余带宽信息和小流应用需求情况为每条路径建立权重函数,最后根据权重函数值利用轮盘赌算法选择转发路径。实验仿真结果显示,与其它算法相比,所提算法降低了小流的丢包率和时延,同时在网络负载较大时提升了网络吞吐量。     

一种基于大小流区分计数的公平抽样算法

针对一种草图指导公平抽样(SGS)算法对小流估计误差大的问题,该文提出一种基于大小流区分计数的包公平抽样算法(DCMFS),并给出哈希冲突对SGS算法估计误差影响的定量分析结果。DCMFS采用大小流区分计数器,对小流采用逐流精确计数,对大流采用哈希计数。理论分析及实际的数据仿真结果均表明,DCMFS算法对小流能够实现逐流精确统计,对大流的估计标准差接近公平抽样估计标准差理论值上限。算法采用不等长位宽计数器结构,保证其空间复杂度较SGS和自适应非线性抽样方法(ANLS)没有增加;引入计数器置换使得算法时间复杂度略有提高,但仍能满足10 Gbps线速处理要求。     

基于快速独立成分分析的RoQ攻击检测方法

降质服务(Reduction of Quality, RoQ)攻击比传统的拒绝服务攻击(Denial of Service, DoS)攻击更具有隐秘性和多变性,这使得检测该攻击十分困难。为提高检测准确率并及时定位攻击源,该文将攻击流量提取建模为一个盲源分离过程,提出了基于快速ICA (Independent Component Analysis)的攻击流特征提取算法,从若干观测网络和终端设备中分离出RoQ攻击流,然后提取表征攻击流的特征参数。接着设计了一种基于支持向量机的协同检测系统和检测算法,通过用已标记的有攻击和无攻击的样本训练SVM分类器,最终实现RoQ攻击的检测。仿真结果表明该方法能够有效检测并定位伪造IP地址的RoQ攻击,检测率达到90%以上,而选取合适的ICA参数会提高检测效果。     

基于同源组合布鲁姆过滤器的早期流量抽样算法

提出一种同源组合布鲁姆过滤器结构,该结构包含流抽样（sample）和分组计数（packet）2个计数器向量组合,2个计数器向量宽度不同,以相同的散列源函数计算散列位置。基于该结构设计的早期流量抽样算法利用2个计数器向量将流抽样判断与分组计数检测分开,避免了早期流量抽样中大量抽样已经结束的流对分组计数过程的影响。分析和实验结果表明,通过调节2个计数器的宽度比α,在不增加内存空间的条件下,该算法有效降低了误判率。     

基于地址分布特征的IP扫描攻击识别技术

IP扫描攻击是一种向某网络区域发送探测报文寻找目标主机的方式。这种方式通常被用于蠕虫病毒传播之前的发现可感染主机。这种攻击方式流量小,并且与正常业务非常类似,因此不易觉察和检出。该方案监控目标主机单位时间内新建流的目的 IP地址的分布特征来识别是否发生了IP扫描攻击。通过将IP地址分为a.b.c.d四个域,分析目标IP地址在这四个域上分别呈现集中分布还是分散,来判断新建流的目标主机是否短时间内集中在某个区域。通过这种方式,将攻击行为与正常业务流进行快速区分。实验结果表明该方法快速有效地辨别攻击主机。     

分布式DNS反射DDoS攻击检测及控制技术

分布式DNS反射DDoS攻击已经成为拒绝服务攻击的主要形式之一,传统的基于网络流量统计分析和网络流量控制技术已经不能满足防护需求。提出了基于生存时间值（TTL）智能研判的DNS反射攻击检测技术,能够准确发现伪造源IP地址分组;基于多系统融合的伪造源地址溯源阻断技术,从源头上阻断攻击流量流入网络。     

Statistical Techniques for Detecting Traffic Anomalies Through Packet Header Data

This paper proposes a traffic anomaly detector, operated in postmortem and in real-time, by passively monitoring packet headers of traffic. The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks, anomalies and to take action to contain the attacks appropriately before they have had time to propagate across the network. In this paper, we suggest a technique for traffic anomaly detection based on analyzing correlation of destination IP addresses in outgoing traffic at an egress router. This address correlation data are transformed using discrete wavelet transform for effective detection of anomalies through statistical analysis. Results from trace-driven evaluation suggest that proposed approach could provide an effective means of detecting anomalies close to the source. We also present a multidimensional indicator using the correlation of port numbers and the number of flows as a means of detecting anomalies.     

Real-time visualization of network attacks on high-speed links

This article shows that malicious traffic flows such as denial-of-service attacks and various scanning activities can be visualized in an intuitive manner. A simple but novel idea of plotting a packet using its source IP address, destination IP address, and the destination port in a 3-dimensional space graphically reveals ongoing attacks. Leveraging this property, combined with the fact that only three header fields per each packet need to be examined, a fast attack detection and classification algorithm can be devised.     

DDoS攻击从检测到流量识别总体防御方案研究

分布式拒绝服务（DDoS）攻击是互联网安全的严重威胁,攻击发生时会有大规模流量淹没目标网络和主机。能够准确快速地检测到攻击,区分合法拥塞流量和攻击流量,对攻击流量加以清洗,对于DDoS攻击的防御来说十分重要。采用信息熵对流量参数进行实时统计来检测攻击,用累积和（CUSUM）算法控制熵值连续变化情况。检测到攻击后,依据目的IP数量前后增长情况找出受害者,对流向受害者处的流量进行重点观察。由于大规模的攻击流量与合法的拥塞流量非常相似,难以识别,在此对流本身的相似性进行考察,使用流相关系数算法辨别攻击流量和合法拥塞流量,为流量清洗工作提供依据。     

Network anomaly detection and classification via opportunistic sampling

Abstract In this article the emphasis is placed on the evaluation of the impact of intelligent flow sampling techniques on the detection and classification of network anomalies. Based on the observation that for specific-purpose applications such as anomaly detection a large fraction of information is contained in a small fraction of flows, we demonstrate that by using sampling techniques that opportunistically and preferentially sample traffic data, we achieve ?magnification? of the appearance of anomalies within the sampled data set and therefore improve their detection. Therefore, the inherently ?lossy? sampling process is transformed to an advantageous feature in the anomaly detection case, allowing the revealing of anomalies that would be otherwise untraceable, and thus becoming the vehicle for efficient anomaly detection and classification. The evaluation of the impact of intelligent sampling techniques on the anomaly detection process is based on the application of an entropy-based anomaly detection method on a packet trace with data that has been collected from a real operational university campus network.     

Observed Structure of Addresses in IP Traffic

We investigate the structure of addresses contained in IPv4 traffic-specifically, the structural characteristics of destination IP addresses seen on Internet links, considered as a subset of the address space. These characteristics have implications for algorithms that deal with IP address aggregates, such as routing lookups and aggregate-based congestion control. Several example address structures are well modeled by multifractal Cantor-like sets with two parameters. This model may be useful for simulations where realistic IP addresses are preferred. We also develop concise characterizations of address structures, including active aggregate counts and discriminating prefixes. Our structural characterizations are stable over short time scales at a given site, and different sites have visibly different characterizations, so that the characterizations make useful "fingerprints" of the traffic seen at a site. Also, changing traffic conditions, such as worm propagation, significantly alter these fingerprints     

Privacy-Preserving Data Packet Filtering Protocol with Source IP Authentication

Packet filtering allows a network gateway to control the network traffic flows and protect the computer system. Most of the recent research works on the filtering systems mainly concern the performance, reliability and defence against common network attacks. However, since the gateway might be controlled by red an untrusted attacker, who might try to infer the identity privacy of the sender host and mount IP tracking to its data packets. IP spoofing is another problem. To avoid data packets to be filtered in the packet filtering system, the malicious sender host might use a spoofed source IP address. Therefore, to preserve the source IP privacy and provide source IP authentication simultaneously in the filtering system is an interesting and challenging problem. To deal with the problem, we construct a data packet filtering scheme, which is formally proved to be semantic secure against the chosen IP attack and IP guessing attack. Based on this filtering scheme, we propose the first privacy-preserving packet filtering system, where the data packets whose source IP addresses are at risk are filtered, the privacy of the source IP is protected and its correctness can be verified by the recipient host. The analysis shows that our protocol can fulfil the objectives of a data packet filtering system. The performance evaluation demonstrates its applicability in the current network systems. We also presented a packet filtering scheme, where the data packets from one subnet can be filtered with only one filter policy.     

Monitoring the Application-Layer DDoS Attacks for Popular Websites

Distributed denial of service (DDoS) attack is a continuous critical threat to the Internet. Derived from the low layers, new application-layer-based DDoS attacks utilizing legitimate HTTP requests to overwhelm victim resources are more undetectable. The case may be more serious when such attacks mimic or occur during the flash crowd event of a popular Website. Focusing on the detection for such new DDoS attacks, a scheme based on document popularity is introduced. An Access Matrix is defined to capture the spatial-temporal patterns of a normal flash crowd. Principal component analysis and independent component analysis are applied to abstract the multidimensional Access Matrix. A novel anomaly detector based on hidden semi-Markov model is proposed to describe the dynamics of Access Matrix and to detect the attacks. The entropy of document popularity fitting to the model is used to detect the potential application-layer DDoS attacks. Numerical results based on real Web traffic data are presented to demonstrate the effectiveness of the proposed method.      

A parameterizable methodology for Internet traffic flow profiling

We present a parameterizable methodology for profiling Internet traffic flows at a variety of granularities. Our methodology differs from many previous studies that have concentrated on end-point definitions of flows in terms of state derived from observing the explicit opening and closing of TCP connections. Instead, our model defines flows based on traffic satisfying various temporal and spatial locality conditions, as observed at internal points of the network. This approach to flow characterization helps address some central problems in networking based on the Internet model. Among them are route caching, resource reservation at multiple service levels, usage based accounting, and the integration of IP traffic over an ATM fabric. We first define the parameter space and then concentrate on metrics characterizing both individual flows as well as the aggregate flow profile. We consider various granularities of the definition of a flow, such as by destination network, host-pair, or host and port quadruple. We include some measurements based on case studies we undertook, which yield significant insights into some aspects of Internet traffic, including demonstrating (i) the brevity of a significant fraction of IP flows at a variety of traffic aggregation granularities, (ii) that the number of host-pair IP flows is not significantly larger than the number of destination network flows, and (iii) that schemes for caching traffic information could significantly benefit from using application information