一种拒绝服务攻击识别算法

分析了DoS(Denial of Service)拒绝服务攻击的攻击行为以及受攻击方的表现，并提出了解决方案。对拒绝服务攻击的原理、危害，常见工具、常见防御手段作了论述，用图表分析了受攻击方的网络流量情况，最后提出了基于流量分析的攻击识别算法。该算法能有效地降低识别的误报率。

An Algorithm for Recognizing Denial of Service (DoS) Attack

DoS attacks have become increasingly serious in China. We offer an algorithm for recognizing DoS attack, if not at the beginning of the attack, at least as soon as serious denial of service occurs. Section 2 discusses in much detail our algorithm for recognizing DoS attack based on the increase of incoming network bandwidth. As the incoming network bandwidth increases, the bandwidth available for service decreases. Our algorithm calculates the slope of the change of incoming network bandwidth; when this slope exceeds a previously set limit, we know that a DoS attack occurs. At the end of section 2, we give four aspects in detail that need to be paid careful attention when implementing our algorithm. Section 3 describes our testing environment under which the recognizing capabilities of various tools were examined; the false positive rate of our algorithm is only 10% whereas that of Snort, the best of other tools, is about 40%.