基于多模态深度神经网络的应用层DDoS攻击检测模型

为进一步提升应用层DDoS攻击检测准确率,提出一种将流量与用户行为特征相结合且模型参数可高效更新的应用层DDoS攻击检测模型.为统一处理流量与用户行为特征的异源数据,利用多模态深度(Multimodal Deep Learning,MDL)神经网络从数据流量与网页日志中提取流量与用户行为深层特征后输入汇聚深度神经网络进...     

基于 K 均值多重主成分分析的 App-DDoS 检测方法

针对应用层分布式拒绝服务攻击,利用Web日志的数据挖掘方法提出一种K均值多重主成分分析算法和基于该算法的App-DDoS检测方法。首先,通过分析正常用户和攻击者的访问行为区别,给出提取统计属性特征的方法;其次,根据主成分分析法的数据降维特性并利用最大距离划分法,提出一种K均值多重主成分分析算法,构建基于该算法的检测模型。最后,采用CTI-DATA数据集及模拟攻击获取的数据集,进行与模糊综合评判、隐半马尔科夫模型、D-S证据理论3种检测方法的App-DDoS攻击检测对比实验,实验结果证明 KMPCAA检测算法具有较好的检测性能。     

Web应用防火墙的设计与实现

大部分Web应用都存在安全漏洞从而为攻击者提供了一扇攻击的大门,并且传统安全设备如网络防火墙、入侵检测系统只能保护开放系统互连（OSI）参考模型的较低层,并不能有效防御应用层的攻击。在分析了主流的Web应用层的攻击方法后提出一个Web应用防火墙的整个实现架构和一些过滤策略。Web应用防火墙用Python实现,经测试,可以有效地阻止各种恶意的攻击,如SQL注入、跨站脚本攻击和应用层拒绝服务攻击。     

基于用户浏览行为相似度的HTTP-Get Flood检测方法

基于页面请求的DDOS攻击比传统的海量报文攻击更具杀伤性且检测困难。传统的检测方法包括：特征检测,利用隐马尔科夫模型分析Web页面访问行为。相比明文解析与数学估计,提出了分析用户浏览行为相似性界定HTTP-GetFlood攻击,将用户浏览页面切换与浏览时间的比值表示用户浏览行为,不同用户利用这个表达式计算的浏览行为值很难相等。DDOS攻击爆发时,肉机行为高度一致,导致浏览行为值重复率偏高,当高于一定阀值时判断遭受DDOS攻击。     

基于网络爬虫与页面代码行为的XSS漏洞动态检测方法

XSS漏洞是攻击Web应用程序、获取用户隐私数据的常见漏洞.传统的XSS漏洞检测工具并没有对AJAX Web应用程序进行针对性的检测,在检测精度方面与实际情况存在巨大差距.针对这种情况,对AJAX技术下XSS漏洞的特点进行了分析,提出了一种基于网络爬虫与页面代码行为的动态检测方法.实验结果表明,提出的方法在节省人力、时间成本与漏洞检测方面有较好的表现.     

基于Shell命令和多阶Markov链模型的用户伪装攻击检测

伪装攻击是指非授权用户通过伪装成合法用户来获得访问关键数据或更高层访问权限的行为.提出一种新的用户伪装攻击检测方法.该方法针对伪装攻击用户行为的多变性和审计数据shell命令的相关性,利用特殊的多阶齐次narkov链模型对合法用户的正常行为进行建模,并通过双重阶梯式归并shell命令来确定状态,提高了用户行为轮廓描述的...     

基于Libra爬虫技术的Web漏洞检测方法研究

在互联网时代,Web服务涉及到用户生活、工作及学习等各个领域,如果不能够有效检测和修补漏洞,广大用户将面临多类潜在安全威胁。在讨论Libra爬虫技术优点的基础上,对如何运用该技术检测Web漏洞进行分析,结果表明:通过构建完善URL列表以及攻击向量生成库,爬取效率和准确率都可得到保障;Libra爬虫技术可以对Web操作行为进行动态抓取,从而改善漏洞检测效果。对改善Web漏洞修补效率、提升Web产品用户体验有一定参考价值。     

Web应用风险扫描的研究与应用

面对信息安全攻击从网络层和系统层向应用层的转变,Web应用系统作为组织对外服务门户,面临巨大威胁。Web应用漏洞扫描技术是一类重要的信息安全技术,与防火墙、入侵检测系统互相配合,能够有效提高信息系统Web应用层的安全性。通过对Web应用的深度扫描,Web应用的管理员或开发商可以快速了解Web应用存在的安全漏洞,客观评估Web应用的风险等级,在黑客攻击前进行有效防范。     

基于最大频繁序列模式挖掘的App-DDoS攻击的异常检测

为了动态、准确、高效地描述用户的访问行为,实现对不同应用层分布式拒绝服务(Application-layer Distributed Denial of Service, App-DDoS)攻击行为的透明检测,该文提出基于最大频繁序列模式挖掘的ADA_MFSP(App-DDoS Detection Algorithm based on Maximal Frequent Sequential Pattern mining)检测模型。该模型在对正常Web访问序列数据库(Web Access Sequence Database, WASD)及待检测WASD进行最大频繁序列模式挖掘的基础上,引入序列比对平均异常度,联合浏览时间平均异常度、请求循环平均异常度等有效检测属性,最终实现攻击行为的异常检测。实验证明：ADA_MFSP模型不仅能有效检测各类App-DDoS攻击,且有良好的检测灵敏度。     

CC攻击检测方法研究

本文介绍了目前互联网上比较流行的应用层DDoS攻击--cc攻击的基本原理、攻击方式、攻击特征,总结了3种传统的基于网站代码优化的检测方式,并提出了两种基于运营商网络的CC攻击检测方法.     

基于多层检测的网络安全防范系统

提出了一种基于多层的网络安全防范系统,该系统采用多层检测技术：在IP层采用基于聚集的拥塞控制算法（ABCC）,通过限制拥塞信号的宽度,使间接损害达到最小;然后在TCP和UPD层采用基于人体免疫原理的检测技术AIPT,通过建立规则集,将来自网络访问活动与规则集中的规则匹配,以检测出网络入侵行为。仿真实验结果表明,基于本模型的系统不仅能合理地缓解DoS/DDoS攻击,而且能够解决现有的防范系统中高误报率和漏报率以及实时性差、人工干预多的问题。     

Differentiating Malicious DDoS Attack Traffic from Normal TCP Flows by Proactive Tests

To defend against distributed denial of service (DDoS) attacks, one critical issue is to effectively isolate the attack traffic from the normal ones. A novel DDoS defense scheme based on TCP is hereby contrived because TCP is the dominant traffic for both the normal and lethal flows in the Internet. Unlike most of the previous DDoS defense schemes that are passive in nature, the proposal uses proactive tests to identify and isolate the malicious traffic. Simulation results validate the effectiveness of our proposed scheme     

A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors

Many methods designed to create defenses against distributed denial of service (DDoS) attacks are focused on the IP and TCP layers instead of the high layer. They are not suitable for handling the new type of attack which is based on the application layer. In this paper, we introduce a new scheme to achieve early attack detection and filtering for the application-layer-based DDoS attack. An extended hidden semi-Markov model is proposed to describe the browsing behaviors of web surfers. In order to reduce the computational amount introduced by the model's large state space, a novel forward algorithm is derived for the online implementation of the model based on the M-algorithm. Entropy of the user's HTTP request sequence fitting to the model is used as a criterion to measure the user's normality. Finally, experiments are conducted to validate our model and algorithm.      

ALPi: A DDoS Defense System for High-Speed Networks

Distributed denial-of-service (DDoS) attacks pose a significant threat to the Internet. Most solutions proposed to-date face scalability problems as the size and speed of the network increase, with no widespread DDoS solution deployed in the industry. PacketScore has been proposed as a proactive DDoS defense scheme, which detects DDoS attacks, differentiates attack packets from legitimate ones with the use of packet scoring (where the score of a packet is calculated based on attribute values it possesses), and discards packets whose scores are lower than a dynamic threshold. In this paper, we propose ALPi, a new scheme which extends the packet scoring concept with reduced implementation complexity and enhanced performance. More specifically, a leaky-bucket overflow control scheme simplifies the score computation, and facilitates high-speed implementation. An attribute-value-variation scoring scheme analyzes the deviations of the current traffic attribute values, and increases the accuracy of detecting and differentiating attacks. An enhanced control-theoretic packet discarding method allows both schemes to be more adaptive to challenging attacks such as those with ever-changing signatures and intensities. When combined together, the proposed extensions not only greatly reduce the memory requirement and implementation complexity but also substantially improve the accuracies in attack detection and packet differentiation. This makes ALPi an attractive DDoS defense system amenable for high-speed hardware implementation.     

基于DDoS的TCP SYN攻击与防范

分布式拒绝服务攻击(DDoS)是出现在这几年的一种具有很强攻击力而又缺乏有效防御手段的Internet攻击手段,是目前网络安全界研究的热点.TCP SYN洪流攻击是最常见的DDoS攻击手段之一.文中在对DDoS攻击进行深入研究的基础上,着重对TCP SYN洪流攻击及其防范措施进行了深入研究,提出了一种新的综合攻击检测技术,较好地解决了对此类攻击的防范问题.     

一种新型拒绝服务攻击的研究

Shrew DDoS(Distributed Denial of Service)攻击是一种新型的DDoS攻击,也称低速率DDoS攻击。它是利用TCP超时重传机制的漏洞,通过估计合法TCP流的RTO(Retransmission timeout)作为低速率攻击发包的周期T,周期性的发送短脉冲,使得攻击流可以周期性地占用网络带宽,这样就会让合法的TCP流总是认为网络的负担很重,造成所有受其影响的TCP流进入超时重传状态,最终使得受害主机的吞吐量大幅度降低,从而达到攻击目的。由于其攻击速率低,可以躲避传统的高速率攻击防御机制。这种新型拒绝服务攻击具有隐蔽性好、效果明显的特点。     

Shield Techniques for Application Layer DDoS Attack in MANET: A Methodological Review

In today’s world of wireless networks the mobile ad-hoc networks are widely preferred as a communication medium as these are infrastructure less networks. The application layer of these networks is targeted by attackers because it is responsible for actual data exchange with end users. As human dependency on wireless networks is increasing the DDoS attacks i.e. distributed denial of service attack which becomes a nightmare for the researchers. This attack is one of the most devastating attacks that can be executed on web-servers and congest the network keys like socket connections, CPU cycles, and memory database. In this current mobile computing world the necessity of DDOS attack management is significantly increased because this attack can degrade the entire web experience. Further, this DDOS attack is commenced along with the legitimate requests so it is also important to differentiate DDoS attack from other similar Events. This review endeavors to explore with more emphasis on application layer DDoS attack and its management stages like prevention, detection, mitigation and Differentiation along with comparative statement of prominent techniques discovered in each stage. This methodological survey report shall lead the way to researchers and network designers to suit the specific management scheme to provide the complete protection of wireless networks from DDoS attack.

     

Denial of service detection using dynamic time warping

With the rapid growth of security threats in computer networks, the need for developing efficient security-warning systems is substantially increasing. Distributed denial-of-service (DDoS) and DoS attacks are still among the most effective and dreadful attacks that require robust detection. In this work, we propose a new method to detect TCP DoS/DDoS attacks. Since analyzing network traffic is a promising approach, our proposed method utilizes network traffic by decomposing the TCP traffic into control and data planes and exploiting the dynamic time warping (DTW) algorithm for aligning these two planes with respect to the minimum Euclidean distance. By demonstrating that the distance between the control and data planes is considerably small for benign traffic, we exploit this characteristic for detecting attacks as outliers. An adaptive thresholding scheme is implemented by adjusting the value of the threshold in accordance with the local statistics of the median absolute deviation (MAD) of the distances between the two planes. We demonstrate the efficacy of the proposed method for detecting DoS/DDoS attacks by analyzing traffic data obtained from publicly available datasets.     

Research on low-rate DDoS attack of SDN network in cloud environment

Aiming at the problems of low-rate DDoS attack detection accuracy in cloud SDN network and the lack of unified framework for data plane and control plane low-rate DDoS attack detection and defense,a unified framework for low-rate DDoS attack detection was proposed.First of all,the validity of the data plane DDoS attacks in low rate was analyzed,on the basis of combining with low-rate of DDoS attacks in the aspect of communications,frequency characteristics,extract the mean value,maximum value,deviation degree and average deviation,survival time of ten dimensions characteristics of five aspects,to achieve the low-rate of DDoS attack detection based on bayesian networks,issued by the controller after the relevant strategies to block the attack flow.Finally,in OpenStack cloud environment,the detection rate of low-rate DDoS attack reaches 99.3% and the CPU occupation rate is 9.04%.It can effectively detect and defend low-rate DDoS attacks.     

Defending against flooding-based distributed denial-of-service attacks: a tutorial

Flooding-based distributed denial-of-service (DDoS) attack presents a very serious threat to the stability of the Internet. In a typical DDoS attack, a large number of compromised hosts are amassed to send useless packets to jam a victim, or its Internet connection, or both. In the last two years, it was discovered that DDoS attack methods and tools are becoming more sophisticated, effective, and also more difficult to trace to the real attackers. On the defense side, current technologies are still unable to withstand large-scale attacks. The main purpose of this article is therefore twofold. The first one is to describe various DDoS attack methods, and to present a systematic review and evaluation of the existing defense mechanisms. The second is to discuss a longer-term solution, dubbed the Internet-firewall approach, that attempts to intercept attack packets in the Internet core, well before reaching the victim.