计算机应用 ›› 2013, Vol. 33 ›› Issue (10): 2838-2841.

• 信息安全 • 上一篇    下一篇

基于流量行为特征的DoS&DDoS攻击检测与异常流识别

周颖杰1,2,焦程波3,陈慧楠2,马力2,胡光岷2   

  1. 1. 四川大学 计算机学院, 成都 610065
    2. 电子科技大学 光纤传感与通信教育部重点实验室,成都 611731
    3. 北京信息技术研究所,北京100093
  • 收稿日期:2013-04-10 修回日期:2013-05-17 出版日期:2013-10-01 发布日期:2013-11-01
  • 通讯作者: 周颖杰
  • 作者简介:周颖杰(1984-),男,四川成都人,博士,主要研究方向:网络异常检测与识别;焦程波(1982-),男,河南郑州人,工程师,博士,主要研究方向:网络测量与安全;陈慧楠(1986-),女,四川眉山人,硕士,主要研究方向:网络异常检测;马力(1987-),男,四川成都人,硕士,主要研究方向:网络异常检测; 胡光岷(1966-),男,四川眉山人,教授,博士生导师,博士,主要研究方向:网络行为学、网络安全。
  • 基金资助:
    国家自然科学基金资助项目

Traffic behavior feature based DoS&DDoS attack detection and abnormal flow identification for backbone networks

ZHOU Yingjie1,2,JIAO Chengbo3,CHEN Huinan2,MA Li2,HU Guangmin2   

  1. 1. College of Computer Science, Sichuan University, Chengdu Sichuan 610065, China;
    2. Laboratory of Optical Fiber Sensing and Communications, Ministry of Education,University of Electronic Science and Technology of China, Chengdu Sichuan 611731, China;
    3. Beijing Information Technology Institute, Beijing 100093, China
  • Received:2013-04-10 Revised:2013-05-17 Online:2013-11-01 Published:2013-10-01
  • Contact: ZHOU Yingjie

摘要: 针对现有方法仅分析粗粒度的网络流量特征参数,无法在保证检测实时性的前提下识别出拒绝服务(DoS)和分布式拒绝服务(DDoS)的攻击流这一问题,提出一种骨干网络DoS&DDoS攻击检测与异常流识别方法。首先,通过粗粒度的流量行为特征参数确定流量异常行为发生的时间点;然后,在每个流量异常行为发生的时间点对细粒度的流量行为特征参数进行分析,以找出异常行为对应的目的IP地址;最后,提取出与异常行为相关的流量进行综合分析,以判断异常行为是否为DoS攻击或者DDoS攻击。仿真实验的结果表明,基于流量行为特征的DoS&DDoS攻击检测与异常流识别方法能有效检测出骨干网络中的DoS攻击和DDoS攻击,并且在保证检测实时性的同时,准确地识别出与攻击相关的网络流量

关键词: 异常检测, 异常流识别, 骨干网络, 信息熵, 流量分析

Abstract: The existing methods for backbone networks only analyze coarse-grained network traffic characteristic parameters. Thus, they cannot guarantee both the premise of abnormal flow identification and the real-time detection for DoS (Denial of Service) & DDoS (Distributed Denial of Service, DDoS) attacks. Concerning this problem, a DoS&DDoS attack detection and abnormal flow identification method for backbone networks was proposed. First, it analyzed coarse-grained network traffic characteristic parameters to determine the time points that abnormal behaviors occur; then, fine-grained traffic behavior characteristic parameters were analyzed in these time points to find the destination IP addresses that correspond to abnormal behaviors; finally, comprehensive analysis was conducted for extracted traffic that correspond to abnormal behaviors to determine DoS and DDoS attacks. The simulation results show that, the proposed method can effectively detect DoS attacks and DDoS attacks in backbone networks. Meanwhile, it could accurately identify the abnormal traffic, while real-time detection is ensured.

Key words: anomaly detection, abnormal flow identification, backbone network, entropy, traffic analysis

中图分类号: