基于时间序列分析的应用层DDoS攻击检测

根据正常用户和攻击者在访问行为上的差异,提出一种基于IP请求熵(SRE)时间序列分析的应用层分布式拒绝服务(DDoS)攻击检测方法。该方法通过拟合SRE时间序列的自适应自回归(AAR)模型,获得描述当前用户访问行为特征的多维参数向量,并使用支持向量机(SVM)对参数向量进行分类来识别攻击。仿真实验表明,该方法能够准确区分正常流量和DDoS攻击流量,适用于大流量背景下攻击流量没有引起整个网络流量显著变化的DDoS攻击的检测。     

基于DCT的自适应盲数字水印

目前应用层DDoS攻击严重危害互联网的安全。现有的检测方法只针对某种特定的应用层DDoS攻击,而不能识别应用层上其它的DDoS攻击。为了能快速有效地识别出多种应用层DDoS攻击,提出一种基于请求关键词的应用层DDoS攻击检测方法,该方法以单位时间内请求关键词的频率分布差和个数作为输入,采用隐马尔可夫模型来检测应用层DDoS攻击。实验结果表明,该方法对应用层上的多种DDoS攻击都具有很高的检测率和较低的误报率。     

勘误启事

本刊2014年9月,第30卷第9期第17页上的代昆玉、胡滨、雷浩的论文——《基于网络流量的应用层DDoS攻击检测方法研究》一文中的关键词有两行,现更正为:“关键词:攻击检测;应用层DDoS;网络流量;突发流量”,特此勘误。     

一种基于Web 群体外联行为的应用层DDoS 检测方法

由于攻击者采用各种技术手段隐藏攻击行为,DDoS攻击变得越发难以发现,应用层DDoS成为Web服务器所面临的最主要威胁之一。从通信群体的层面分析 Web 通信的外联行为特征的稳定性,并提出了一种应用层DDoS检测方法。该方法用CUSUM算法检测Web群体外联行为参数的偏移,据此来判断DDoS攻击行为的发生。由于外联行为模型刻画的是Web通信群体与外界的交互,并非用户个体行为,所以攻击者难以通过模仿正常访问行为规避检测。该方法不仅能够发现用户群体访问行为的异常,而且能够有效区分突发访问和应用层DDoS攻击。模拟实验结果表明,该方法能够有效检测针对Web 服务器的不同类型的DDoS攻击。     

基于聚类的应用层DDoS攻击检测方法

提出了一种基于聚类的应用层DDoS攻击检测方法,该方法首先采集Web服务器端网络流量,经过数据预处理后从中选取4个属性组成流量特征向量,后利用粒子群算法优化的K-Means聚类算法建立检测模型,并通过该模型识别攻击行为.实验结果表明,该方法与K-Means算法建立的检测方法相比,能有效地识别应用层DDoS攻击行为,且具...     

基于集成学习的多类型应用层DDoS攻击检测方法

针对应用层分布式拒绝服务（DDoS）攻击类型多、难以同时检测的问题,提出了一种基于集成学习的应用层DDoS攻击检测方法,用于检测多类型的应用层DDoS攻击。首先,数据集生成模块模拟正常和攻击流量,筛选并提取对应的特征信息,并生成表征挑战黑洞（CC）、HTTP Flood、HTTP Post及HTTP Get攻击的47维特征信息;其次,离线训练模块将处理后的有效特征信息输入集成后的Stacking检测模型进行训练,从而得到可检测多类型应用层DDoS攻击的检测模型;最后,在线检测模块通过在线部署检测模型来判断待检测流量的具体流量类型。实验结果显示,与Bagging、Adaboost和XGBoost构建的分类模型相比,Stacking集成模型在准确率方面分别提高了0.18个百分点、0.21个百分点和0.19个百分点,且在最优时间窗口下的恶意流量检测率达到了98%。验证了所提方法对多类型应用层DDoS攻击检测的有效性。     

基于宏观网络流相关性的DDoS攻击检测

针对现行分布式拒绝服务(DDoS)攻击检测方法存在检测效率低、适用范围小等缺陷,在分析DDoS攻击对网络流量大小和IP地址相关性影响的基础上,提出基于网络流相关性的DDoS攻击检测方法。对流量大小特性进行相关性分析,定义Hurst指数方差变化率为测度,用以区分正常流量与引起流量显著变化的异常性流量。研究IP地址相关性,定义并计算IP地址相似度作为突发业务流和DDoS攻击的区分测度。实验结果表明,对网络流中流量大小和IP地址2个属性进行相关性分析,能准确地区分出网络中存在的正常流量、突发业务流和DDoS攻击,达到提高DDoS攻击检测效率的目的。     

DDOS攻击检测和防御模型

提出了基于聚集和协议分析防御分布式拒绝服务攻击(aggregate-based protocol analysis anti-DDoS,简称APA-ANTI-DdoS)模型来检测和防御DDoS攻击.APA-ANTI-DDoS模型包括异常流量聚集、协议分析和流量处理.异常流量聚积把网络流量分为正常流量和异常流量;协议分析寻找异常流量中DDoS攻击流量的特征;流量处理则根据当前的DDoS攻击流量特征,过滤异常流量并测试当前聚积流量的拥塞控制特性,恢复被误判的流量.随后实现了APA-ANTI-DDoS系统.实验结果表明,APA-ANTI-DDoS模型能很好地识别和防御DDoS攻击,能在误判时恢复非攻击流量,保证合法的正常网络通信.     

应用层DDOS攻击检测技术研究

随着检测底层DDoS攻击的技术不断成熟和完善,应用层DDoS攻击越来越多。由于应用层协议的复杂性,应用层DDoS攻击更具隐蔽性和破坏性,检测难度更大。通过研究正常用户访问的网络流量特征和应用层DDoS攻击的流量特征,采用固定时间窗口内的请求时间间隔以及页面作为特征。通过正常用户和僵尸程序访问表现出不同的特点,对会话进行聚类分析,从而检测出攻击,经过实验,表明本检测算法具有较好的检测性能。     

基于会话异常度模型的应用层分布式拒绝服务攻击过滤

大量的网络攻击手段和可利用的网络资源大大增加了抵御分布式拒绝服务(Distributed Denial-of-Service,DDoS)攻击的难度.应用层DDoS建立在正常的网络层行为之上,当前网络层安全设备无法有效抵御攻击.文章提出了一种应用层DDoS攻击过滤模型.基于攻击请求的生成方式,文中将应用层DDoS攻击分为5类,分析了应用层DDoS攻击与正常访问行为的不同,提出了访问行为异常属性和session异常度模型.利用此模型,可以有效区分正常访问session和应用层DDoS攻击session.将First-Come First-Serve (FCFS)、Low Suspicion First (LSF)和Round Robin 3种转发策略与session异常度模型结合,采用真实网络日志,模拟分析合法请求返回时延随时间的变化关系.结果表明,转发速率为合法请求最大速率就可获得较好的转发性能,此外,FCFS和Round Robin比LSF具有更低的合法请求返回时延.     

基于特征参数相关性的DDoS攻击检测算法

针对传统方法难以实时有效地检测分布式拒绝服务攻击(DDoS)的问题,通过DDoS攻击的基本特征分析,从理论上严格区分了DDoS攻击流和正常突发流,并且在此基础上提出了一种基于特征参数相关性的DDoS攻击检测算法.该算法能在早期检测出DDoS攻击流,而这时的DDoS攻击包特征并不明显,并且该算法能有效地区分DDoS攻击流和正常的突发流.实验结果表明了该算法的有效性和精确性.     

Distributed Denial of Service (DDoS) detection by traffic pattern analysis

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.     

Securing Cloud Computing from Flash Crowd Attack Using Ensemble Intrusion Detection System

Flash Crowd attacks are a form of Distributed Denial of Service (DDoS) attack that is becoming increasingly difficult to detect due to its ability to imitate normal user behavior in Cloud Computing (CC). Botnets are often used by attackers to perform a wide range of DDoS attacks. With advancements in technology, bots are now able to simulate DDoS attacks as flash crowd events, making them difficult to detect. When it comes to application layer DDoS attacks, the Flash Crowd attack that occurs during a Flash Event is viewed as the most intricate issue. This is mainly because it can imitate typical user behavior, leading to a substantial influx of requests that can overwhelm the server by consuming either its network bandwidth or resources. Therefore, identifying these types of attacks on web servers has become crucial, particularly in the CC. In this article, an efficient intrusion detection method is proposed based on White Shark Optimizer and ensemble classifier (Convolutional Neural Network (CNN) and LighGBM). Experiments were conducted using a CICIDS 2017 dataset to evaluate the performance of the proposed method in real-life situations. The proposed IDS achieved superior results, with 95.84% accuracy, 96.15% precision, 95.54% recall, and 95.84% F1 measure. Flash crowd attacks are challenging to detect, but the proposed IDS has proven its effectiveness in identifying such attacks in CC and holds potential for future improvement.     

基于用户行为分析的应用层DDoS攻击检测方法*

应用层拒绝服务攻击与传统的拒绝服务相比,其破坏性更大,也更难被检测和防御。对此,基于用户浏览行为的分析,提出了一种采用自回归模型来检测应用层DDoS攻击的方法。通过AR模型和卡尔曼滤波,学习和预测正常用户的访问并判断异常;当定位异常访问源后,反馈给前端路由器进行限流或过滤。在电信IDC实际网络环境中,测试结果表明该方法是有效的。     

网络DDoS攻击流的小波分析与检测

将小波分析中的小波变换模极大方法用于检测分布式拒绝服务攻击引起的突发流量。在探讨如何运用小波模极大对突发流量进行判定的基础上,设计了一个检测突发攻击流量的方法,并对实际采集到的网络流量和仿真攻击流量的混合流作了计算机模拟验证。结果表明,当攻击流的突变幅度为正常流量的2倍￣3倍时,检测漏判率不超过5%;当攻击流的突变幅度提升为正常流量均值的3倍￣5倍时,检测漏判率不超过1%。攻击越强,检测漏判率越小。     

基于用户浏览行为的HTTP Flood检测方法

与传统的基于低层协议的DDoS攻击相比,应用层DDoS具有更加显著的攻击效果,而且更加难以检测。现有的解决方法包括：特征检测、流量限制、隐半马尔可夫模型等。这些方法在检测应用层DDoS攻击（如,HTTP Get Flood）攻击时检测率不高或者检测速度较慢。提出的基于用户浏览行为的检测方法对HTTPFlood攻击检测效果明显得到改善。     

Detection and defense of application-layer DDoS attacks in backbone web traffic

Web servers are usually located in a well-organized data center where these servers connect with the outside Internet directly through backbones. Meanwhile, the application-layer distributed denials of service (AL-DDoS) attacks are critical threats to the Internet, particularly to those business web servers. Currently, there are some methods designed to handle the AL-DDoS attacks, but most of them cannot be used in heavy backbones. In this paper, we propose a new method to detect AL-DDoS attacks. Our work distinguishes itself from previous methods by considering AL-DDoS attack detection in heavy backbone traffic. Besides, the detection of AL-DDoS attacks is easily misled by flash crowd traffic. In order to overcome this problem, our proposed method constructs a Real-time Frequency Vector (RFV) and real-timely characterizes the traffic as a set of models. By examining the entropy of AL-DDoS attacks and flash crowds, these models can be used to recognize the real AL-DDoS attacks. We integrate the above detection principles into a modularized defense architecture, which consists of a head-end sensor, a detection module and a traffic filter. With a swift AL-DDoS detection speed, the filter is capable of letting the legitimate requests through but the attack traffic is stopped. In the experiment, we adopt certain episodes of real traffic from Sina and Taobao to evaluate our AL-DDoS detection method and architecture. Compared with previous methods, the results show that our approach is very effective in defending AL-DDoS attacks at backbones.