网络DDoS攻击流的小波分析与检测

将小波分析中的小波变换模极大方法用于检测分布式拒绝服务攻击引起的突发流量。在探讨如何运用小波模极大对突发流量进行判定的基础上,设计了一个检测突发攻击流量的方法,并对实际采集到的网络流量和仿真攻击流量的混合流作了计算机模拟验证。结果表明,当攻击流的突变幅度为正常流量的2倍￣3倍时,检测漏判率不超过5%;当攻击流的突变幅度提升为正常流量均值的3倍￣5倍时,检测漏判率不超过1%。攻击越强,检测漏判率越小。

Detection of DDoS Attack Flow in Web Traffic Based on Wavelet Analysis

The DDoS(Distributed Denial of Service) flooding attack sends a large number of useless packets to a website to jam or even crash the victim network.Several proposals have been proposed to prevent the DDoS attacks.In fact,this kind of attacks will cause flash crowds in the web traffic.Here we have used WTMM(Wavelet Transform Modulus Maxima) to detect the starting point of the flash crowds made by the DDoS attack flow mixed with the normal web traffic.Then,we have validated and simulated the detection method for a real data set collected from a web server mixed with DDoS attack traffic.The results show that the false positives and negatives is under 5% when the volume of the attack flow is 2~3 times over the normal web traffic,and under 1% when 4~5 times.The stronger the attack flow is,the smaller the ratio of false alert is.