基于攻击特征的ARMA预测模型的DDoS攻击检测方法

分布式拒绝服务(DDoS)攻击检测是网络安全领域的研究热点。本文提出一个能综合反映DDoS攻击流的流量突发性、流非对称性、源IP地址分布性和目标IP地址集中性等多个本质特征的IP流特征(IFFV)算法,采用线性预测技术,为正常网络流的IFFV时间序列建立了简单高效的ARMA(2,1)预测模型,进而设计了一种基于IFFV预测模型的DDoS攻击检测方法(DDDP)。为了提高方法的检测准确度,提出了一种报警评估机制,减少预测误差或网络流噪声所带来的误报。实验结果表明,DDDP检测方法能够迅速、有效地检测DDoS攻击,降低误报率。

The DDoS Detection Method Based on Attack Features and the ARMA Prediction Model

The distributed denial of service (DDoS) attack is one of the major threats to the current Internet. We propose a robust scheme to detect the distributed denial of service (DDoS) attack based on the essential DDoS attacks features,such as the abrupt traffic change,flow dissymmetry,distributed source IP addresses and concentrated target IP addresses. This paper proposes a IP Flow feature value (IFFV) algorithm that reflects the DDoS attack features,and uses a simple and efficient ARMA(2,1) IFFV prediction mo...