基于自相似检测DDoS攻击的小波分析方法

针对传统检测方法不能有效检测弱DDoS攻击和区分繁忙业务和攻击的问题,在研究 DDOS攻击对网络流量自相似性影响的基础上,提出了小波分析检测DDoS攻击的方法,并设计了采用该方法检测DDoS攻击的模型,解决了方法实现过程中小波选择、求解Hurst参数的一些关键问题,实验表明,提出的方法能够识别繁忙业务、检测到弱DDoS攻击引起的Hurst参数值的变化,比传统的检测方法准确灵敏.     

基于小波和分形原理的DDoS攻击检测方法

提出一种基于离散小波变换和分形原理的DDoS攻击检测方法.该方法通过高散小波变换的多分辩率分析突现DDoS攻击特征,对小波变换系数进行盒分形维计算,将经实验确定的关键盒维数作为多维空间的向量序列,最后使用经过样本训练的K-nn（K最近邻）分类器进行攻击识别.实验结果表明分形与小波相结合取得了较好的检测效果,与离散小波检测方法相比,该方法提高了检测精确度.     

基于小波分析的网络低速率DDoS攻击检测方法

为减少网络DDoS（分布式拒绝服务）攻击检测误报率,实现对网络DDoS攻击的精准检测,有针对性地调节网络的运行速率,文章设计一种基于小波分析的网络低速率DDoS攻击检测方法。提取DDoS攻击特征,布设异常攻击定位节点,识别异常波段进行同步处理,构建小波分析DDoS攻击检测模型。最终的测试结果表明,对比于传统攻击检测小组,文章设计的小波分析DDoS攻击检测小组误差较小,检测效率较高,具有一定的应用价值。     

基于聚集算法的DDoS数据流检测和处理

提出了一种应用于路由器的嵌入式DDoS（分布式拒绝服务攻击）防御算法.针对DDoS攻击的本质特征,对IP数据流进行轻量级协议分析,把IP数据流分为TCP、UDP和ICMP（网间控制报文协议）数据流,分别建立相应的聚集模式,根据该模式来检测DDoS聚集所占资源,采取相应的抑制措施过滤攻击数据包,从而保证合法数据流的正常转发.仿真试验证明该方法能准确地检测到DDoS攻击,处理效果很好.     

基于隐马尔可夫模型的医院通信网络DDoS攻击检测方法

常规的医院通信网络DDoS攻击检测矩阵结构一般设定为独立形式,致使攻击检测范围的扩大受到限制,进而一定程度上导致DDoS攻击检测召回率下降。针对上述问题,文章提出了一种基于隐马尔可夫模型的医院通信网络DDoS攻击检测方法。该方法根据当前的测定需求及标准对DDoS攻击进行特征提取,采用多目标的方式设计检测矩阵,解析DDoS攻击方向具体位置以及攻击的范围。在此基础上,构建隐马尔可夫医院通信网络DDoS攻击检测模型,采用多元识别+组合处理的方式来实现DDoS攻击的检测目标。测试结果表明：采用本文所设计的方法,DDoS攻击检测召回率可以达到80%以上,对于医院通信网络的攻击检测效率更高,泛化能力明显提升,具有实际的应用价值。     

一种新的分布式拒绝服务攻击检测方法

检测分布式拒绝服务(Di stributed Denial-of-Service,DDoS)攻击,需要将攻击流与正常流区分开来,特别是与繁忙业务流区分.检测方法需要高效的实现,使在线实时监测成为可能.在研究DDoS攻击对网络流量自相似性影响,加之对攻击流包特征分析的基础上,采用了一种联合小波分析与特征分析的检测DDoS攻击的方法.实验表明,这种新型检测方法比传统的检测方法准确.     

基于流量强度的DDoS攻击源追踪快速算法

DDoS攻击以其破坏力大、易实施、难检测、难追踪等特点,而成为网络攻击中难处理的问题之一。攻击源追踪技术是阻断攻击源、追踪相关责任、提供法律证据的必要手段。基于网络拓扑理论和路由器流量特性原理以及可编程式路由器的体系结构,提出了一种追踪DDoS攻击源的分布式快速算法,该算法可以准确、协调、高效地判断路由器的数据流量值,受害者可以根据流量强度推断出恶意攻击数据流的来源,从而快速追溯和定位DDoS攻击源。     

DDoS攻击中傀儡机动态分布策略研究

对DDoS攻击中傀儡机的管理进行研究,提出了DDoS攻击的傀儡机动态分布策略,该策略根据实际需要可以定时随机改变傀儡机在僵尸网络中的层次位置,也可以根据傀儡机配置信息以及当时的性能情况择优确定傀儡机位置,从而增加了DDoS攻击灵活性和攻击效果,也增加了被攻击方追踪检测的难度和DDoS攻击的隐蔽性.     

基于SNMP和神经网络的DDoS攻击检测

DDoS（Distributed Denial of Service）已经严重威胁计算机网络安全。对DDoS攻击检测的关键是找到能反映攻击流和正常流区别的特征,设计简单高效的算法,实时检测。通过对攻击特点的分析,总结出15个基于SNMP（Simple Network Management Protocol）的检测特征。利用BP神经网络高效的计算性能,设计了基于SNMP和神经网络的DDoS攻击检测模型,提高了检测实时性和准确性。实验表明：该检测模型对多种DDoS攻击都具有很好的检测效果。     

一个防御DDoS攻击的入侵检测系统

介绍了一种集成了网络流量数据采集与DDoS攻击检测的入侵检测系统,并嵌入攻击报警机制,其算法核心基于网络流量的自相关函数.该系统可根据用户指定攻击的识别概率,漏报概率与误报概率,而后进行有效检测和报警,并实现基于GUI界面的友好风格及C 类的封装.     

Monitoring the Application-Layer DDoS Attacks for Popular Websites

Distributed denial of service (DDoS) attack is a continuous critical threat to the Internet. Derived from the low layers, new application-layer-based DDoS attacks utilizing legitimate HTTP requests to overwhelm victim resources are more undetectable. The case may be more serious when such attacks mimic or occur during the flash crowd event of a popular Website. Focusing on the detection for such new DDoS attacks, a scheme based on document popularity is introduced. An Access Matrix is defined to capture the spatial-temporal patterns of a normal flash crowd. Principal component analysis and independent component analysis are applied to abstract the multidimensional Access Matrix. A novel anomaly detector based on hidden semi-Markov model is proposed to describe the dynamics of Access Matrix and to detect the attacks. The entropy of document popularity fitting to the model is used to detect the potential application-layer DDoS attacks. Numerical results based on real Web traffic data are presented to demonstrate the effectiveness of the proposed method.      

DDoS attack detection method based on conditional entropy and GHSOM in SDN

Software defined networking (SDN) simplifies the network architecture,while the controller is also faced with a security threat of “single point of failure”.Attackers can send a large number of forged data flows that do not exist in the flow tables of the switches,affecting the normal performance of the network.In order to detect the existence of this kind of attack,the DDoS attack detection method based on conditional entropy and GHSOM in SDN (MBCE&G) was presented.Firstly,according to the phased features of DDoS,the damaged switch in the network was located to find the suspect attack flows.Then,according to the diversity characteristics of the suspected attack flow,the quaternion feature vector was extracted in the form of conditional entropy,as the input features of the neural network for more accurate analysis.Finally,the experimental environment was built to complete the verification.The experimental results show that MBCE&G detection method can effectively detect DDoS attacks in SDN network.     

DDoS攻击恶意行为知识库构建

针对分布式拒绝服务（distributed denial of service,DDoS）网络攻击知识库研究不足的问题,提出了DDoS攻击恶意行为知识库的构建方法。该知识库基于知识图谱构建,包含恶意流量检测库和网络安全知识库两部分：恶意流量检测库对 DDoS 攻击引发的恶意流量进行检测并分类;网络安全知识库从流量特征和攻击框架对DDoS 攻击恶意行为建模,并对恶意行为进行推理、溯源和反馈。在此基础上基于DDoS 开放威胁信号（DDoS open threat signaling,DOTS）协议搭建分布式知识库,实现分布式节点间的数据传输、DDoS攻击防御与恶意流量缓解功能。实验结果表明,DDoS攻击恶意行为知识库能在多个网关处有效检测和缓解DDoS攻击引发的恶意流量,并具备分布式知识库间的知识更新和推理功能,表现出良好的可扩展性。     

Research on low-rate DDoS attack of SDN network in cloud environment

Aiming at the problems of low-rate DDoS attack detection accuracy in cloud SDN network and the lack of unified framework for data plane and control plane low-rate DDoS attack detection and defense,a unified framework for low-rate DDoS attack detection was proposed.First of all,the validity of the data plane DDoS attacks in low rate was analyzed,on the basis of combining with low-rate of DDoS attacks in the aspect of communications,frequency characteristics,extract the mean value,maximum value,deviation degree and average deviation,survival time of ten dimensions characteristics of five aspects,to achieve the low-rate of DDoS attack detection based on bayesian networks,issued by the controller after the relevant strategies to block the attack flow.Finally,in OpenStack cloud environment,the detection rate of low-rate DDoS attack reaches 99.3% and the CPU occupation rate is 9.04%.It can effectively detect and defend low-rate DDoS attacks.     

Efficient DDoS attack detection and prevention scheme based on SDN in cloud environment

For addressing the problem of two typical types of distributed denial of service (DDoS) attacks in cloud environment,a DDoS attack detection and prevention scheme called SDCC based on software defined network (SDN) architecture was proposed.SDCC used a combination of bandwidth detection and data flow detection,utilized confidence-based filtering (CBF) method to calculate the CBF score of packets,judged the packet of CBF score below the threshold as an attacking packet,added its attribute information to the attack flow feature library,and sent the flow table to intercept it through SDN controller.Simulation results show that SDCC can detect and prevent different types of DDoS attacks effectively,and it has high detection efficiency,reduces the controller’s computation overhead,and achieves a low false positive rate.     

UDM:NFV-based prevention mechanism against DDoS attack on SDN controller

DDoS attack extensively existed have been mortal threats for the software-defined networking (SDN) controllers and there is no any security mechanism which can prevent them yet.Combining SDN and network function virtualization (NFV),a novel preventing mechanism against DDoS attacks on SDN controller called upfront detection middlebox (UDM) was proposed.The upfront detection middlebox was deployed between SDN switch interfaces and user hosts distributed,and DDoS attack packets were detected and denied.An NFV-based method of implementing the upfront middlebox was put forward,which made the UDM mechanism be economical and effective.A prototype system based on this mechanism was implemented and lots experiments were tested.The experimental results show that the UDM mechanism based on NFV can real-time and effectively detect and prevent against DDoS attacks on SDN controllers.     

Compressive Sensing Node Localization Method Using Autonomous Underwater Vehicle Network

This framework attempts to introduce a new Distributed denial-of-service (DDoS) attack detection and mitigation model. It is comprised of two stages, namely DDoS attack detection and mitigation. The first stage consists of three important phases like feature extraction, optimal feature selection, and classification. In order to optimally select the features of obtained feature sets, a new improved algorithm is implanted named Improved Update oriented Rider Optimization Algorithm (IU-ROA), which is the modification of the Rider Optimization Algorithm (ROA) algorithm. The optimal features are subjected to classification using the Deep Convolutional Neural Network (CNN) model, in which the presence of network attacks can be detected. The second stage is the mitigation of the attacker node. For this, a bait detection mechanism is launched, which provides the effective mitigation of malicious nodes having Distributed Denial-of-Service (DDoS) attacks. The experimentation is done on the KDD cup 99 dataset and the experimental analysis proves that the proposed model generates a better result which is 90.06% in mitigation analysis and the overall performance analysis of the proposed model on DDoS Attack Detection is 96% better than conventional methods.