论文部分内容阅读
分布式拒绝服务(Distributed Denial of Service,DDo S)的破坏性大、危害广,对目前的互联网安全构成了巨大威胁。本文分析了国内外现有的DDo S攻击检测方法,针对已有检测方法的不足之处提出了基于时间序列预测模型的DDo S检测方法。该方法提取正常网络流时间序列特征,并对时间序列进行平稳性和白噪声检验,根据检验结果确定模型参数以建立预测模型,基于预测模型对待测流进行预测,最后通过对正常流设置自适应阈值和可信报警模型来识别异常流量并检测DDo S攻击。实验结果与分析表明,该方法能够较为准确区分正常流与异常流,有效地检测分布式拒绝服务攻击,降低了误报率和漏报率。
Distributed Denial of Service (DDoS) is devastating and harmful. It poses a great threat to the current Internet security. This paper analyzes the existing DDoS attack detection methods at home and abroad, and proposes a DDo S detection method based on the time series prediction model in view of the shortcomings of the existing detection methods. The method extracts the features of normal network flow time series and tests the stationary and white noise of the time series. The model parameters are determined according to the test results to establish the predictive model. The predictive model is used to predict the measured flow. Finally, Threshold and Trusted Alarm Model to identify abnormal traffic and detect DDo S attacks. Experimental results and analysis show that this method can distinguish normal flow from abnormal flow more accurately, and can effectively detect distributed denial of service attacks and reduce the false alarm rate and false alarm rate.