基于自相似检测DDoS攻击的小波分析方法

针对传统检测方法不能有效检测弱DDoS攻击和区分繁忙业务和攻击的问题,在研究 DDOS攻击对网络流量自相似性影响的基础上,提出了小波分析检测DDoS攻击的方法,并设计了采用该方法检测DDoS攻击的模型,解决了方法实现过程中小波选择、求解Hurst参数的一些关键问题,实验表明,提出的方法能够识别繁忙业务、检测到弱DDoS攻击引起的Hurst参数值的变化,比传统的检测方法准确灵敏.     

基于聚集算法的DDoS数据流检测和处理

提出了一种应用于路由器的嵌入式DDoS（分布式拒绝服务攻击）防御算法.针对DDoS攻击的本质特征,对IP数据流进行轻量级协议分析,把IP数据流分为TCP、UDP和ICMP（网间控制报文协议）数据流,分别建立相应的聚集模式,根据该模式来检测DDoS聚集所占资源,采取相应的抑制措施过滤攻击数据包,从而保证合法数据流的正常转发.仿真试验证明该方法能准确地检测到DDoS攻击,处理效果很好.     

基于SNMP和神经网络的DDoS攻击检测

DDoS（Distributed Denial of Service）已经严重威胁计算机网络安全。对DDoS攻击检测的关键是找到能反映攻击流和正常流区别的特征,设计简单高效的算法,实时检测。通过对攻击特点的分析,总结出15个基于SNMP（Simple Network Management Protocol）的检测特征。利用BP神经网络高效的计算性能,设计了基于SNMP和神经网络的DDoS攻击检测模型,提高了检测实时性和准确性。实验表明：该检测模型对多种DDoS攻击都具有很好的检测效果。     

基于OpenFlow与sFlow的DDoS攻击防御方法

分布式拒绝服务(DDoS)攻击是目前比较流行的网络攻击,其破坏力大并且难以防范追踪,对互联网安全造成了极大的威胁。针对此问题提出了一种基于OpenFlow与sFlow的入侵检测方法,通过sFlow采样技术实时检测网络流量,依据网络正常流量设定流量阈值,并通过对超过阈值的异常流量进行攻击检测、判断攻击流,最终使用OpenFlow协议阻断攻击源。该方法可以在几秒内自动检测、处理多种DDoS攻击。实验结果表明,与现有方案对比,该方法能够实时检测并阻止DDoS攻击,有效降低网络资源消耗。     

DDoS攻击原理与防御

分布式拒绝服务攻击(Distributed Denial of Serviece Attack)是目前黑客用的比较多的攻击手段,这种攻击对网络造成的危害性越来越大.为了更好地了解这种攻击的特点,从而避免产生更大的损失,这里从DoS和DDoS的攻击原理进行探讨研究,研究常见的DDOS攻击的类型如Smurf攻击、Trinoo攻击等.根据这些攻击的特点,提出DDoS攻击的检测方法即基于特征的攻击检测和基于异常的攻击检测.这两种检测技术各有所长,在实际使用中往往需要将两者结合起来,共同提高DDoS检测的准确性.     

DDoS攻击从检测到流量识别总体防御方案研究

分布式拒绝服务（DDoS）攻击是互联网安全的严重威胁,攻击发生时会有大规模流量淹没目标网络和主机。能够准确快速地检测到攻击,区分合法拥塞流量和攻击流量,对攻击流量加以清洗,对于DDoS攻击的防御来说十分重要。采用信息熵对流量参数进行实时统计来检测攻击,用累积和（CUSUM）算法控制熵值连续变化情况。检测到攻击后,依据目的IP数量前后增长情况找出受害者,对流向受害者处的流量进行重点观察。由于大规模的攻击流量与合法的拥塞流量非常相似,难以识别,在此对流本身的相似性进行考察,使用流相关系数算法辨别攻击流量和合法拥塞流量,为流量清洗工作提供依据。     

基于深度学习的实时DDoS攻击检测

分布式拒绝服务(DDoS)攻击是一种分布式、协作式的大规模网络攻击方式,提出了一种基于深度学习的DDoS攻击检测方法,该方法包含特征处理和模型检测两个阶段:特征处理阶段对输入的数据分组进行特征提取、格式转换和维度重构;模型检测阶段将处理后的特征输入深度学习网络模型进行检测,判断输入的数据分组是否为DDoS攻击分组.通过ISCX2012数据集训练模型,并通过实时的DDoS攻击对模型进行验证.结果表明,基于深度学习的DDoS攻击检测方法具有高检测精度、对软硬件设备依赖小、深度学习网络模型易于更新等优点.     

DDoS攻击的技术分析与防御策略

系统地分析分析了DDoS攻击的实现原理,列举了发动DDoS攻击的常用工具,针对攻击产生的机理,提出了详细可行的DDoS攻击防御策略.最后给出市场上典型DDoS攻击检测与响应系统的主要性能和防御DDoS攻击的研究方向.     

基于隐马尔可夫模型的医院通信网络DDoS攻击检测方法

常规的医院通信网络DDoS攻击检测矩阵结构一般设定为独立形式,致使攻击检测范围的扩大受到限制,进而一定程度上导致DDoS攻击检测召回率下降。针对上述问题,文章提出了一种基于隐马尔可夫模型的医院通信网络DDoS攻击检测方法。该方法根据当前的测定需求及标准对DDoS攻击进行特征提取,采用多目标的方式设计检测矩阵,解析DDoS攻击方向具体位置以及攻击的范围。在此基础上,构建隐马尔可夫医院通信网络DDoS攻击检测模型,采用多元识别+组合处理的方式来实现DDoS攻击的检测目标。测试结果表明：采用本文所设计的方法,DDoS攻击检测召回率可以达到80%以上,对于医院通信网络的攻击检测效率更高,泛化能力明显提升,具有实际的应用价值。     

一种DDoS攻击的检测算法

对于骨干网中存在的DDoS攻击,由于背景流量巨大,且分布式指向受害者的多个攻击流尚未汇聚,因此难以进行有效的检测。为了解决该问题,本文提出一种基于全局流量异常相关分析的检测方法,根据攻击流引起流量之间相关性的变化,采用主成份分析提取多条流量中的潜在异常部分之间的相关性,并将相关性变化程度作为攻击检测测度。实验结果证明了测度的可用性,能够克服骨干网中DDoS攻击流幅值相对低且不易检测的困难,同现有的全局流量检测方法相比,该方法能够取得更高的检测率。     

Research on DDoS detection in multi-tenant cloud based on entropy change

An attacker compromised a number of VMs in the cloud to form his own network to launch a powerful distrib-uted denial of service (DDoS) attack.DDoS attack is a serious threat to multi-tenant cloud.It is difficult to detect which VM in the cloud are compromised and what is the attack target,especially when the VM in the cloud is the victim.A DDoS detection method was presented suitable for multi-tenant cloud environment by identifying the malicious VM at-tack sources first and then the victims.A distributed detection framework was proposed.The distributed agent detects the suspicious VM which generate the potential DDoS attack traffic flows on the source side.A central server confirms the real attack flows.The feasibility and effectiveness of the proposed detection method are verified by experiments in the multi-tenant cloud environment.     

基于信号互相关的低速率拒绝服务攻击检测方法

低速率拒绝服务LDoS（Low-rate Denial of Service）攻击是一种基于TCP/IP协议漏洞,采用密集型周期性脉冲的攻击方式.本文针对分布式LDoS攻击脉冲到达目标端的时序关系,提出基于互相关的LDoS攻击检测方法.该方法通过计算构造的检测序列与采样得到的网络流量序列的相关性,得到相关序列,采用基于循环卷积的互相关算法来计算攻击脉冲经过不同传输通道在特定的攻击目标端的精确时间,利用无周期单脉冲预测技术估计LDoS攻击的周期参数,提取LDoS攻击的脉冲持续时间的相关性特征,并设计判决门限规则.实验结果表明基于信号互相关的LDoS攻击检测方法具有较好的检测性能.     

DDoS attack detection method based on conditional entropy and GHSOM in SDN

Software defined networking (SDN) simplifies the network architecture,while the controller is also faced with a security threat of “single point of failure”.Attackers can send a large number of forged data flows that do not exist in the flow tables of the switches,affecting the normal performance of the network.In order to detect the existence of this kind of attack,the DDoS attack detection method based on conditional entropy and GHSOM in SDN (MBCE&G) was presented.Firstly,according to the phased features of DDoS,the damaged switch in the network was located to find the suspect attack flows.Then,according to the diversity characteristics of the suspected attack flow,the quaternion feature vector was extracted in the form of conditional entropy,as the input features of the neural network for more accurate analysis.Finally,the experimental environment was built to complete the verification.The experimental results show that MBCE&G detection method can effectively detect DDoS attacks in SDN network.     

一种面向流量异常检测的概率流抽样方法

针对基于概率抽样的网络流量异常检测数据集构造过程中无法同时兼顾大、小流抽样需求及未区分flash crowd与流量攻击等问题,该文提出一种面向流量异常检测的概率流抽样方法。在对数据流按目的、源IP地址进行分类的基础上,将每类数据流抽样率定义为其目的、源IP地址抽样率的最大值,并在抽样过程中对数据流抽样数目向上取整,保证每类数据流至少被抽样一次,使抽样得到的数据集可有效反映原始流量在大、小流和源、目的IP地址方面的分布性。采用源IP地址熵刻画异常流源IP地址分散度,并基于源IP地址熵阈值设计攻击流抽样算法,降低由flash crowd引起的非攻击异常流抽样概率。仿真结果表明,该方法能同时满足大、小流抽样需求,具有较强的异常流抽样能力,可抽样到所有与异常流相关的可疑源、目的IP地址,并能在抽样过程中过滤非攻击异常流。     

Flow‐oriented detection of low‐rate denial of service attacks

In this paper, an approach of detecting low‐rate denial of service attack is proposed on the basis of principal component analysis algorithm. The proposed approach analyzes low‐rate denial of service attack flows and handles complicated network flows by using principal component analysis algorithm to establish the network traffic matrix model, which is established on the basis of a large number of data acquisitions. Simulation results show that the proposed approach can predigest the high dimension vector, which is composed of networks flows, guarantee the detection precision, and reduce the computation consuming. Copyright © 2014 John Wiley & Sons, Ltd.     

Approach of detecting low-rate DoS attack based on combined features

LDoS (low-rate denial of service) attack is a kind of RoQ (reduction of quality) attack which has the characteristics of low average rate and strong concealment.These characteristics pose great threats to the security of cloud computing platform and big data center.Based on network traffic analysis,three intrinsic characteristics of LDoS attack flow were extracted to be a set of input to BP neural network,which is a classifier for LDoS attack detection.Hence,an approach of detecting LDoS attacks was proposed based on novel combined feature value.The proposed approach can speedily and accurately model the LDoS attack flows by the efficient self-organizing learning process of BP neural network,in which a proper decision-making indicator is set to detect LDoS attack in accuracy at the end of output.The proposed detection approach was tested in NS2 platform and verified in test-bed network environment by using the Linux TCP-kernel source code,which is a widely accepted LDoS attack generation tool.The detection probability derived from hypothesis testing is 96.68%.Compared with available researches,analysis results show that the performance of combined features detection is better than that of single feature,and has high computational efficiency.     

Efficient Mining of the Multidimensional Traffic Cluster Hierarchy for Digesting, Visualization, and Anomaly Identification

Mining traffic to identify the dominant flows sent over a given link, over a specified time interval, is a valuable capability with applications to traffic auditing, simulation, visualization, as well as anomaly detection. Recently, Estan advanced a comprehensive data mining structure tailored for networking data—a parsimonious, multidimensional flow hierarchy, along with an algorithm for its construction. While they primarily targeted offline auditing, use in interactive traffic visualization and anomaly/attack detection will require real-time data mining. We suggest several improvements to Estan 's algorithm that substantially reduce the computational complexity of multidimensional flow mining. We also propose computational and memory-efficient approaches for unidimensional clustering of the IP address spaces. For baseline implementations, evaluated on the New Zealand (NZIX) trace data, our method reduced CPU execution times of the Estan method by a factor of more than eight. We also develop a methodology for anomaly/attack detection based on flow mining, demonstrating the usefulness of this approach on traces from the Slammer and Code Red worms and the MIT Lincoln Laboratories DDoS data.     

一种新型拒绝服务攻击的研究

Shrew DDoS(Distributed Denial of Service)攻击是一种新型的DDoS攻击,也称低速率DDoS攻击。它是利用TCP超时重传机制的漏洞,通过估计合法TCP流的RTO(Retransmission timeout)作为低速率攻击发包的周期T,周期性的发送短脉冲,使得攻击流可以周期性地占用网络带宽,这样就会让合法的TCP流总是认为网络的负担很重,造成所有受其影响的TCP流进入超时重传状态,最终使得受害主机的吞吐量大幅度降低,从而达到攻击目的。由于其攻击速率低,可以躲避传统的高速率攻击防御机制。这种新型拒绝服务攻击具有隐蔽性好、效果明显的特点。