Abstract: Compared with the volume or feature based approaches, detecting Distributed Denial of Service (DDoS) attacks based on entropy has the following advantages: simple calculation, high sensitivity, low false positive rate, no need of additional network traffic and device. For the purpose of getting higher precision and lower false positive rate in contrast to traditional entropybased approaches, a Modified Entropy-Based (MEB) scheme was proposed in this paper, which divided DDoS attacks into different threat levels and treated each threat level with according method. The effeciency of this scheme was validated with simulation in NS-2.

Key words: Distributed Denial of Service (DDoS), entropy, attacking detection

摘要： 基于熵的分布式拒绝服务攻击(DDoS)攻击的检测方法相比其他基于流量或特征的检测方法，具有计算简便、灵敏度高、误报率低、不增加额外网络流量、不增加额外硬件成本等特点。为了进一步提高了DDoS攻击检测的准确率，并降低误报率，提出一种改进的基于熵的DDoS攻击检测方法。该方法将DDoS攻击细分为不同的威胁等级，对每个威胁等级的攻击进行不同次数的检测。NS-2模拟实验结果验证了其有效性。

关键词: 分布式拒绝服务, 熵, 攻击检测