大流量下一种基于活跃熵的DDoS攻击检测方法

为了提高在大流量背景下DDoS攻击检测的实时性。本文提出一种在大流量背景下基于活跃熵的DDoS攻击检测方法。在IP流层面通过分析系统活跃熵值来对整个流量进行初探，剔除正常流量。利用多特征广泛权重最小二乘孪生支持向量机算法（WWLSTSVM）对攻击威胁进行攻击确认。通过实验验证方法的可行性，实验表明在合适场景下本方法可以在保证时效性的同时减少系统误报率。大流量背景下该检测方法比一般的机器学习算法具有更好的检测性能。

A DDoS attack detection method based on alive entropy under the background of large flow

To improve the real-time performance of DDoS attacks detection under the background of large flow. This paper present a DDoS attack detection method based on active entropy under the background of large flow. In the aspect of IP flow through analysis system active entropy values to make a preliminary study of the entire flow excluding normal traffic. Using the multi-feature weighted least squares wide twin SVM (WWLSTSVM) to confirm the threat of attack. Experimental verification the method is feasible, experimental results show that under the right scenario this method can reduce the false alarm rate while ensuring the timeliness. The approach has a better survivability than the general machine learning algorithms under the background of large flow.