基于流交互三态模型的DDoS攻击检测*

针对传统方法在检测DDoS攻击时的不足,提出了一种新的IP流交互行为特征算法(IFF),该方法利用IP地址和端口表示IP流的交互性。采用IFF特征,将网络流定义为三种状态,即健康、亚健康和异常,提出了基于IFF特征的三态模型检测方法(DASA),该方法采用了基于滑动平均方法的自适应双阈值算法和报警评估机制,提高了检测DDoS攻击的准确度。仿真实验结果表明,该方法不但能快速、有效地检测DDoS攻击,而且具有较低漏报率和误报率。

DDoS attack detection using three-state model based on IP flow interaction

Aiming at lack using traditional methods in DDoS detection, this paper proposed a novel IP flow interaction behavior feature (IFF) algorithm based on IP flow interaction via IP addresses and ports. It defined the network flow states into three states as the health state, quasi health state, and abnormal state by using IFF, then presented a simple and efficient DDoS attack detection method based on three-state partition of IFF, and the proposed algorithm exploited self-adapting dual threshold and alarm evaluation mechanism(DASA), and it could increase accuracy of DDoS attack detection. The simulation results show that the method not only can effectively detect abnormal flows containing DDoS attack flow, but also detect it more accuracy and lower false alarm rate.