基于自适应阈值的DDoS攻击态势预警模型

为了准确识别分布式拒绝服务（DDoS）攻击态势预警级别，研究DDoS攻击态势预警技术，设计DDoS攻击态势预警模型逻辑结构，定义区域网络安全脆弱性因子（SVF）. 基于长短时记忆（LSTM）网络流量预测模型和区域网络安全脆弱性因子，提出基于动态自适应阈值的DDoS攻击态势预警模型. 提取IP数据包统计特征（IPDCF），使用LSTM预测模型对IPDCF序列建模，对正常流进行预测. 根据预测结果和SVF实时动态地计算预警阈值和预警区间，基于预警阈值和预警区间设定态势预警级别. 实验结果表明，利用该模型能够实时、有效地预警DDoS攻击态势，准确地识别DDoS攻击态势安全级别.

Early warning model of DDoS attack situation based on adaptive threshold

The distributed denial of service (DDoS) attack situation warning technology was analyzed in order to accurately identify the DDoS attack situation warning level. The logical structure of DDoS attack situation early warning model was designed, and the regional network security vulnerability factor (SVF) was defined. Then a dynamic adaptive threshold based DDoS attacks situation warning model was proposed based on the long-short-time memory (LSTM) prediction model and SVF. IP-data-counts feature (IPDCF) was extracted, which was modeled by using LSTM prediction model to predict the normal traffic flow. The early warning threshold and the early warning interval were dynamically calculated according to the prediction results and the SVF, and the situation warning level was set based on the early warning threshold and the early warning interval. The experimental results show that the model can be used to predict the DDoS attack situation in real time, and accurately identify the DDoS attack situation security level.