基于流量行为特征的DoS&DDoS攻击检测与异常流识别

针对现有方法仅分析粗粒度的网络流量特征参数，无法在保证检测实时性的前提下识别出拒绝服务(DoS)和分布式拒绝服务(DDoS)的攻击流这一问题，提出一种骨干网络DoS&DDoS攻击检测与异常流识别方法。首先，通过粗粒度的流量行为特征参数确定流量异常行为发生的时间点；然后，在每个流量异常行为发生的时间点对细粒度的流量行为特征参数进行分析，以找出异常行为对应的目的IP地址；最后，提取出与异常行为相关的流量进行综合分析，以判断异常行为是否为DoS攻击或者DDoS攻击。仿真实验的结果表明，基于流量行为特征的DoS&DDoS攻击检测与异常流识别方法能有效检测出骨干网络中的DoS攻击和DDoS攻击，并且在保证检测实时性的同时，准确地识别出与攻击相关的网络流量

Traffic behavior feature based DoS&DDoS attack detection and abnormal flow identification for backbone networks

The existing methods for backbone networks only analyze coarse-grained network traffic characteristic parameters. Thus, they cannot guarantee both the premise of abnormal flow identification and the real-time detection for DoS (Denial of Service) & DDoS (Distributed Denial of Service, DDoS) attacks. Concerning this problem, a DoS&DDoS attack detection and abnormal flow identification method for backbone networks was proposed. First, it analyzed coarse-grained network traffic characteristic parameters to determine the time points that abnormal behaviors occur; then, fine-grained traffic behavior characteristic parameters were analyzed in these time points to find the destination IP addresses that correspond to abnormal behaviors; finally, comprehensive analysis was conducted for extracted traffic that correspond to abnormal behaviors to determine DoS and DDoS attacks. The simulation results show that, the proposed method can effectively detect DoS attacks and DDoS attacks in backbone networks. Meanwhile, it could accurately identify the abnormal traffic, while real-time detection is ensured.