基于隐半马尔可夫模型的SWIM应用层DDoS攻击的检测方法

doi:10.11772/j.issn.1001-9081.2019010017

计算机应用 ›› 2019, Vol. 39 ›› Issue (7): 1973-1978.DOI: 10.11772/j.issn.1001-9081.2019010017

基于隐半马尔可夫模型的SWIM应用层DDoS攻击的检测方法

马兰¹, 崔博花², 刘轩², 岳猛², 吴志军²

1. 中国民航大学空中交通管理学院, 天津 300300;
2. 中国民航大学电子信息与自动化学院, 天津 300300

收稿日期:2019-01-07 修回日期:2019-03-05 出版日期:2019-07-10 发布日期:2019-04-15
通讯作者: 马兰
作者简介:马兰(1966-),女,甘肃武威人,教授,博士,主要研究方向:空中交通管理信息与控制;崔博花(1992-),女,河北保定人,硕士研究生,主要研究方向:空中交通管理信息安全;刘轩(1992-),男,山东临沂人,硕士,主要研究方向:空中交通管理信息安全;岳猛(1984-),男,河北沧州人,副教授,博士,主要研究方向:云安全;吴志军(1965-),男,新疆库尔勒人,教授,博士,主要研究方向:网络与信息安全。
基金资助:
国家自然科学基金青年基金资助项目（61601467）；天津市自然科学基金重点项目（17JCZDJC30900）；中央高校基本科研业务费专项资金资助项目（3122018D007）。

Hidden semi-Markov model-based approach to detect DDoS attacks in application layer of SWIM system

MA Lan1, CUI Bohua2, LIU Xuan2, YUE Meng2, WU Zhijun2

1. School of Air Traffic Management, Civil Aviation University of China, Tianjin 300300, China;
2. School of Electronic Information and Automation, Civil Aviation University of China, Tianjin 300300, China

Received:2019-01-07 Revised:2019-03-05 Online:2019-07-10 Published:2019-04-15
Supported by:
This work is partially supported by the National Science Foundation for Young Scientists of China (61601467), the Major Program of Natural Science Foundation of Tianjin (17JCZDJC30900), the Fundamental Research Funds for the Central Universities (3122018D007).

摘要/Abstract

摘要：

针对广域信息管理（SWIM）系统受到应用层分布式拒绝服务（DDoS）攻击的问题，提出了一种基于隐半马尔可夫模型（HSMM）的SWIM应用层DDoS攻击的检测方法。首先采用改进后的前向后向算法，利用HSMM建立动态异常检测模型动态地追踪正常SWIM用户的浏览行为；然后通过学习和预测正常SWIM用户行为得出正常检测区间；最后选取访问包的大小和请求时间间隔为特征进行建模，并训练模型进行异常检测。实验结果表明，所提方法在攻击1和攻击2情况下检测率分别为99.95%和91.89%，与快速前向后向算法构建的HSMM相比，检测率提升了0.9%。测试结果表明所提方法可以有效地检测SWIM系统应用层DDoS攻击。

关键词: 广域信息管理系统, 应用层分布式拒绝服务, 隐半马尔可夫模型, SWIM用户行为, 安全性分析

Abstract:

Aiming at the problem that System Wide Information Management (SWIM) system is affected by Distributed Denial of Service (DDoS) attacks in the application layer, a detection approach of SWIM application layer DDoS attack based on Hidden Semi-Markov Model (HSMM) was proposed. Firstly, an improved forward-backward algorithm was adopted, and HSMM was used to establish dynamic anomaly detection model to dynamically track the browsing behaviors of normal SWIM users. Then, normal detection interval was obtained by learning and predicting normal SWIM user behaviors. Finally, access packet size and request time interval were extracted as features for modeling, and the model was trained to realize anomaly detection. The experimental results show that the detection rate of the proposed approach is 99.95% and 91.89% in the case of attack 1 and attack 2 respectively. Compared with the HSMM constructed by fast forward-backward algorithm, the detection rate is improved by 0.9%. It can be seen that the proposed approach can effectively detect the application layer DDoS attacks of SWIM system.

Key words: System Wide Information Management (SWIM), application-layer Distributed Denial of Service (DDoS), Hidden Semi-Markov Model (HSMM), SWIM user behavior, security analysis

中图分类号:

马兰, 崔博花, 刘轩, 岳猛, 吴志军. 基于隐半马尔可夫模型的SWIM应用层DDoS攻击的检测方法[J]. 计算机应用, 2019, 39(7): 1973-1978.

MA Lan, CUI Bohua, LIU Xuan, YUE Meng, WU Zhijun. Hidden semi-Markov model-based approach to detect DDoS attacks in application layer of SWIM system[J]. Journal of Computer Applications, 2019, 39(7): 1973-1978.

参考文献

[1] MESEROLE J S, MOORE J W. What is System Wide Information Management (SWIM)[J]. Aerospace and Electronic Systems Magazine, 2007, 22(5):13-19.
[2] 李琴,黄海清,陈强.空管新技术-SWIM[J].数字通信世界,2010(5):50-53.(LI Q, HUANG H Q, CHEN Q. Air traffic control technology-SWIM[J]. Digital Communication World, 2010(5):50-53.)
[3] MOALLEMI M, CASTRO-PENA C A, TOWHIDNEJAD M, et al. Information security in the aircraft access to system wide information management infrastructure[C]//ICNS 2016:Proceedings of the 2016 Integrated Communications Navigation and Surveillance. Piscataway, NJ:IEEE, 2016:1A3-1-1A3-7.
[4] WU Z J, CUI Z H, WANG C Y, et al. Access control scheme with attribute revocation for SWIM[J]. China Universities of Posts and Telecommunications, 2017, 24(6):49-54.
[5] 吴志军,赵婷,雷缙.基于改进的Diameter/EAP-MD5的SWIM认证方法[J].通信学报,2014,35(8):1-7.(WU Z J, ZHAO T, LEI J. SWIM authentication method based on improved Diameter/EAP-MD5[J]. Journal on Communications, 2014, 35(8):1-7.)
[6] SMITH T. Quality of service requirements for System Wide Information Management (SWIM)[C]//Proceedings of the 24th Digital Avionics Systems Conference. Piscataway, NJ:IEEE, 2005:1.A.2-1.1-8.
[7] STEPHENS B. System-Wide Information Management (SWIM) demonstration security architecture[C]//Proceedings of the 2nd Digital Avionics Systems Conference. Piscataway, NJ:IEEE, 2006:1-12.
[8] 罗喜伶,王珺珺.民航广域信息管理技术[M].北京:电子工业出版社,2017:55-56.(LUO X L, WANG J J. Civil Aviation Wide Area Information Management Technology[M]. Beijing:Publishing House of Electronics Industry, 2017:55-56.)
[9] FUH C-D, TARTAKOVSKY A G. Asymptotic Bayesian theory of quickest change detection for hidden Markov models[J]. IEEE Transactions on Information Theory, 2019, 65(1):511-529.
[10] TANG K S, ZHU S F, XU Y Q, et al. Modeling drivers' dynamic decision-making behavior during the phase transition period:an analytical approach based on hidden Markov model theory[J]. IEEE Transactions on Intelligent Transportation Systems, 2016, 17(1):206-214.
[11] 谢逸,余顺争.基于Web用户浏览行为的统计异常检测[J].软件学报,2007,18(4):967-977.(XIE Y, YU S Z. Statistical anomaly detection based on Web user browsing behavior[J]. Journal of Software, 2007, 18(4):967-977.)
[12] QI M, LU S T. Overview of system wide information management and security analysis[C]//ISADS 2017:Proceeding of the 13th International Symposium on Autonomous Decentralized System. Piscataway, NJ:IEEE, 2017:191-194.
[13] 赵汨龙,罗喜伶,王忠波.基于SOA的民航广域信息管理架构的研究与设计[J].计算机技术与发展,2016,26(2):95-100.(ZHAO M L, LUO X L, WANG Z B. Research and design of civil aviation wide area information management architecture based on SOA[J]. Computer Technology and Development, 2016, 26(2):95-100.)
[14] TSAI W T, PAUL R, WANG Y M, et al. Extending WSDL to facilitate Web services testing[C]//Proceedings of the 7th IEEE International Symposium on High Assurance Systems Engineering. Piscataway, NJ:IEEE, 2002:171-172.
[15] 尚波涛,祝跃飞,陈嘉勇.一种应用层分布式拒绝服务攻击快速检测方法[J].信息工程大学学报,2012,13(5):601-609.(SHANG B T, ZHU Y F, CHEN J Y. Method for quickly detecting application layer distributed denial of service attack[J]. Journal of Information Engineering University, 2012, 13(5):601-609.)

基于隐半马尔可夫模型的SWIM应用层DDoS攻击的检测方法

Hidden semi-Markov model-based approach to detect DDoS attacks in application layer of SWIM system

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 11

编辑推荐

Metrics

[1]	沈子懿, 王卫亚, 蒋东华, 荣宪伟. 基于Hopfield混沌神经网络和压缩感知的可视化图像加密算法[J]. 计算机应用, 2021, 41(10): 2893-2899.
[2]	吴志军, 王航. 基于订阅/发布服务的广域信息管理系统应急响应机制[J]. 计算机应用, 2020, 40(5): 1340-1347.
[3]	王众, 韩益亮. 基于改进版Niederreiter的双公钥密码方案[J]. 计算机应用, 2019, 39(7): 1997-2000.
[4]	马兰, 王京杰, 陈焕. 基于内容挖掘的广域信息管理系统业务数据安全[J]. 计算机应用, 2019, 39(2): 488-493.
[5]	叶春晓余一丰. 带有委托功能的UCONpreA模型安全性分析及DBRM0表达[J]. 计算机应用, 2012, 32(12): 3426-3429.
[6]	王昌达宫婷婷周从华. 基于使用控制的数字版权管理系统安全性分析[J]. 计算机应用, 2012, 32(10): 2771-2775.
[7]	张龙翔. 一种基于不可复制功能的RFID认证协议的安全性分析[J]. 计算机应用, 2012, 32(08): 2280-2282.
[8]	胡学刚王月. 基于复合混沌系统的图像加密新算法[J]. 计算机应用, 2010, 30(05): 1209-1211.
[9]	胡宇王世伦. 基于混合体制的Kerberos身份认证协议的研究[J]. 计算机应用, 2009, 29(06): 1659-1661.
[10]	王高丽. 对缩减杂凑函数HAVAL的原根攻击[J]. 计算机应用, 2009, 29(05): 1327-1329.
[11]	徐青慧谢琪. 基于身份的无可信私钥产生中心的代理签名方案的改进[J]. 计算机应用, 2008, 28(12): 3208-3210.