首页 | 本学科首页   官方微博 | 高级检索  
相似文献
 共查询到17条相似文献,搜索用时 204 毫秒
1.
一种基于主动探测机制的SYN Flooding攻击检测方法   总被引:1,自引:0,他引:1  
SYN Flood给网络正常运行带来极大危害,而已有广泛研究的基于流量自相似性的检测方式对这种小包攻击可能会失效。通过对DAG卡捕获高精度流量样本进行分析,提出一种基于主动探测机制的SYN攻击检测方法。该方法将包对测量背景流量技术应用于异常流量检测中,用夹入背景流长度变化来检测攻击。实验表明,该算法对SYN攻击检测率可达88%。这种基于端到端的检测方法,具有良好的灵活性和可控制性等优点。  相似文献   

2.
针对现行分布式拒绝服务(DDoS)攻击检测方法存在检测效率低、适用范围小等缺陷,在分析DDoS攻击对网络流量大小和IP地址相关性影响的基础上,提出基于网络流相关性的DDoS攻击检测方法。对流量大小特性进行相关性分析,定义Hurst指数方差变化率为测度,用以区分正常流量与引起流量显著变化的异常性流量。研究IP地址相关性,定义并计算IP地址相似度作为突发业务流和DDoS攻击的区分测度。实验结果表明,对网络流中流量大小和IP地址2个属性进行相关性分析,能准确地区分出网络中存在的正常流量、突发业务流和DDoS攻击,达到提高DDoS攻击检测效率的目的。  相似文献   

3.
基于特征参数相关性的DDoS攻击检测算法   总被引:1,自引:1,他引:0  
针对传统方法难以实时有效地检测分布式拒绝服务攻击(DDoS)的问题,通过DDoS攻击的基本特征分析,从理论上严格区分了DDoS攻击流和正常突发流,并且在此基础上提出了一种基于特征参数相关性的DDoS攻击检测算法.该算法能在早期检测出DDoS攻击流,而这时的DDoS攻击包特征并不明显,并且该算法能有效地区分DDoS攻击流和正常的突发流.实验结果表明了该算法的有效性和精确性.  相似文献   

4.
移动Ad Hoc网络中针对拥塞的RoQ DDoS攻击及其防御   总被引:1,自引:0,他引:1  
根据网络容量理论,移动Ad Hoc网络中存在针对拥塞的RoQ分布式拒绝服务攻击,其攻击模式包括脉冲攻击、循环攻击、自消耗攻击和泛洪攻击.防御机制包括检测和响应,检测信号包括RTS/CTS包频率、信号干涉频率以及包重传次数,响应机制依靠ECN标记和通知.NS2模拟结果显示,复杂拓扑结构将更容易受到攻击,攻击节点的分散将加大攻击效果.脉冲攻击产生明显的吞吐率和延迟抖动。当同速率攻击流增加到5个时,受害流吞吐率下降到77.42%,延迟增加110倍.  相似文献   

5.
提出了一种实时检测网络是否受到DDoS攻击的新模型,解决了传统检测方法难以区分突变正常流量与异常流量的问题.结合网络正常流量的特点,提出了检测DDoS攻击的新度量和检测算法.该算法不仅结构简洁、运算速度快;而且能够充分利用已知信息,具有较强的抗干扰能力.实际检测结果表明,本模型可实现时DDoS攻击的实时检测.  相似文献   

6.
低速率分布式拒绝服务攻击针对网络协议自适应机制中的漏洞实施攻击,对网络服务质量造成了巨大威胁,具有隐蔽性强、攻击速率低和周期性的特点。现有检测方法存在检测类型单一和识别精度低的问题,因此提出了一种基于混合深度学习的多类型低速率 DDoS 攻击检测方法。模拟不同类型的低速率DDoS 攻击和 5G 环境下不同场景的正常流量,在网络入口处收集流量并提取其流特征信息,得到多类型低速率DDoS攻击数据集;从统计阈值和特征工程的角度,分别分析了不同类型低速率DDoS攻击的特征,得到了40维的低速率DDoS攻击有效特征集;基于该有效特征集采用CNN-RF混合深度学习算法进行离线训练,并对比该算法与LSTM-LightGBM和LSTM-RF算法的性能;在网关处部署CNN-RF检测模型,实现了多类型低速率DDoS攻击的在线检测,并使用新定义的错误拦截率和恶意流量检测率指标进行了性能评估。结果显示,在120 s的时间窗口下,所提方法能够在线检测出4种类型的低速率DDoS攻击,包括Slow Headers攻击、Slow Body 攻击、Slow Read 攻击和 Shrew 攻击,错误拦截率达到 11.03%,恶意流量检测率达到 96.22%。结果表明,所提方法能够显著降低网络入口处的低速率DDoS攻击流量强度,并在实际环境中部署和应用。  相似文献   

7.
针对当今网络甚至下一代网络IPv6中最严重的威胁DDoS攻击流,提出应用Whittle MLE方法对Hurst指数估值,采用二次差分法对相邻的3组数据进行相关性分析,以此实现高精度的判定攻击发生的时刻.模拟实验证明,此方法能降低误判率和漏判率,实现更快更高效的检测DDoS攻击.  相似文献   

8.
一种基于小波求解的DDoS攻击检测模型   总被引:1,自引:0,他引:1  
分析了小波求解检测DDoS攻击的方法,提出了一种基于小波求解的DDoS检测模型。通过实时监控网络的数据流量,形成实时流量序列,动态的更新分解尺度,对网络流量序列的长相关性的特征值Hurst指数实时监控,以此来检测DDoS攻击。实验证明,该模型能实时有效地检测到DDoS攻击的发生,检测率和误检率都较好,耗时较短。  相似文献   

9.
针对无线传感网络攻击流量阻断存在攻击流量检测准确率较低、阻断效果较差的问题,构建了一种基于随机森林算法的无线传感网络攻击流量阻断模型。基于字符(单词)的词频矩阵,利用TF-IDF算法将有效载荷的特征自动提取出来;根据特征结果使用随机森林算法通过词频矩阵对网络流量实行分类,基于分类结果对网络中的流量攻击实现溯源,完成异常无线传感网络检测;利用流表的报文过滤实现无线传感攻击流量的阻断。实验结果表明,该模型在检测攻击流量时,准确率最高可达100%,调和平均数最高为99.18%,错误率最高仅为7.3%,假阳性率最高仅为5.5%,同时能够有效阻断网络攻击流量,在较短时间内将网络恢复至正常,具有良好的攻击流量检测效果和攻击流量阻断效果。  相似文献   

10.
根据应用层DDoS攻击和正常网络流量在特征上的不同,提出一种基于流量分析的应用层DDoS攻击检测方法,通过对源IP地址进行分析,能够有效地识别应用层DDoS攻击.同时,针对DDoS攻击流量和突发流量的相似性,在识别DDoS攻击的同时,能够正确区分突发流量,减少误报和漏报.  相似文献   

11.
随着检测底层DDoS攻击的技术不断成熟和完善,应用层DDoS攻击越来越多。由于应用层协议的复杂性,应用层DDoS攻击更具隐蔽性和破坏性,检测难度更大。通过研究正常用户访问的网络流量特征和应用层DDoS攻击的流量特征,采用固定时间窗口内的请求时间间隔以及页面作为特征。通过正常用户和僵尸程序访问表现出不同的特点,对会话进行聚类分析,从而检测出攻击,经过实验,表明本检测算法具有较好的检测性能。  相似文献   

12.
In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.  相似文献   

13.
Web servers are usually located in a well-organized data center where these servers connect with the outside Internet directly through backbones. Meanwhile, the application-layer distributed denials of service (AL-DDoS) attacks are critical threats to the Internet, particularly to those business web servers. Currently, there are some methods designed to handle the AL-DDoS attacks, but most of them cannot be used in heavy backbones. In this paper, we propose a new method to detect AL-DDoS attacks. Our work distinguishes itself from previous methods by considering AL-DDoS attack detection in heavy backbone traffic. Besides, the detection of AL-DDoS attacks is easily misled by flash crowd traffic. In order to overcome this problem, our proposed method constructs a Real-time Frequency Vector (RFV) and real-timely characterizes the traffic as a set of models. By examining the entropy of AL-DDoS attacks and flash crowds, these models can be used to recognize the real AL-DDoS attacks. We integrate the above detection principles into a modularized defense architecture, which consists of a head-end sensor, a detection module and a traffic filter. With a swift AL-DDoS detection speed, the filter is capable of letting the legitimate requests through but the attack traffic is stopped. In the experiment, we adopt certain episodes of real traffic from Sina and Taobao to evaluate our AL-DDoS detection method and architecture. Compared with previous methods, the results show that our approach is very effective in defending AL-DDoS attacks at backbones.  相似文献   

14.
为了提高在大流量背景下DDoS攻击检测的实时性。本文提出一种在大流量背景下基于活跃熵的DDoS攻击检测方法。在IP流层面通过分析系统活跃熵值来对整个流量进行初探,剔除正常流量。利用多特征广泛权重最小二乘孪生支持向量机算法(WWLSTSVM)对攻击威胁进行攻击确认。通过实验验证方法的可行性,实验表明在合适场景下本方法可以在保证时效性的同时减少系统误报率。大流量背景下该检测方法比一般的机器学习算法具有更好的检测性能。  相似文献   

15.
High bandwidth DDoS attacks consume more resources and have direct impact at ISP level in contrast to low rate DDoS attacks which lead to graceful degradation of network and are mostly undetectable. Although an array of detection schemes have been proposed, current requirement is a real time DDoS detection mechanism that adapts itself to varying network conditions to give minimum false alarms. DDoS attacks that disturb the distribution of traffic features in ISP domain are reflected by entropic variations on in stream samples. We propose honeypot detection for attack traffic having statistically similar distribution features as legitimate traffic. Next we propose to calibrate the detection mechanism for minimum false alarm rate by varying tolerance factor in real time. Simulations are carried out in ns-2 at different attack strengths. We also report our experimental results over MIT Lincoln lab dataset and its subset KDD 99 dataset. Results show that the proposed approach is comparable to previously reported approaches with an advantage of variable rate attack detection with minimum false positives and negatives.  相似文献   

16.
Kejie  Dapeng  Jieyan  Sinisa  Antonio 《Computer Networks》2007,51(18):5036-5056
In recent years, distributed denial of service (DDoS) attacks have become a major security threat to Internet services. How to detect and defend against DDoS attacks is currently a hot topic in both industry and academia. In this paper, we propose a novel framework to robustly and efficiently detect DDoS attacks and identify attack packets. The key idea of our framework is to exploit spatial and temporal correlation of DDoS attack traffic. In this framework, we design a perimeter-based anti-DDoS system, in which traffic is analyzed only at the edge routers of an internet service provider (ISP) network. Our framework is able to detect any source-address-spoofed DDoS attack, no matter whether it is a low-volume attack or a high-volume attack. The novelties of our framework are (1) temporal-correlation based feature extraction and (2) spatial-correlation based detection. With these techniques, our scheme can accurately detect DDoS attacks and identify attack packets without modifying existing IP forwarding mechanisms at routers. Our simulation results show that the proposed framework can detect DDoS attacks even if the volume of attack traffic on each link is extremely small. Especially, for the same false alarm probability, our scheme has a detection probability of 0.97, while the existing scheme has a detection probability of 0.17, which demonstrates the superior performance of our scheme.  相似文献   

17.
软件定义网络(SDN)是一种新兴网络架构,通过将转发层和控制层分离,实现网络的集中管控。控制器作为SDN网络的核心,容易成为被攻击的目标,分布式拒绝服务(DDoS)攻击是SDN网络面临的最具威胁的攻击之一。针对这一问题,本文提出一种基于机器学习的DDoS攻击检测模型。首先基于信息熵监控交换机端口流量来判断是否存在异常流量,检测到异常后提取流量特征,使用SVM+K-Means的复合算法检测DDoS攻击,最后控制器下发丢弃流表处理攻击流量。实验结果表明,本文算法在误报率、检测率和准确率指标上均优于SVM算法和K-Means算法。  相似文献   

设为首页 | 免责声明 | 关于勤云 | 加入收藏

Copyright©北京勤云科技发展有限公司  京ICP备09084417号