文献类型：期刊文献

中文题名：基于网络连接分析的DDoS攻击检测模型

英文题名：A Detection Model for Distributed Denial of Service Attacks Based on Network Connection Analysis

作者：吴庆涛[1];邵志清[1];钱夕元[2]

机构：[1]华东理工大学计算机科学与工程系,上海200237;[2]华东理工大学理学院,上海200237

年份：2006

卷号：32

期号：10

起止页码：135

中文期刊名：计算机工程

外文期刊名：Computer Engineering

收录：CSTPCD;;Scopus;北大核心:【北大核心2004】；CSCD:【CSCD2011_2012】；

基金：上海科技发展基金资助项目(045115006)

语种：中文

中文关键词：分布式拒绝服务;统计分析;攻击检测

外文关键词：Distributed denial of service; Statistical analysis; Attack detection

摘要：分布式拒绝服务(DistributedDenialofService,DDoS)攻击是当前网络安全的主要威胁之一。通过对网络连接特征的分析,提出了一种DDoS攻击检测模型。该模型利用DDoS早期攻击阶段的固有特性,从网络连接数据的统计分析中探寻系统正常行为的分布规律并确定DDoS攻击检测阈值。最后,通过模拟攻击实验验证了检测模型的有效性。实验结果表明,该模型能快速有效地实现对早期DDoS攻击的检测,并对其他网络安全检测研究具有一定的指导意义。
Distributed denial of service （DDoS） attacks are major threats to availability of computer network. A detection model for early DDoS attacks is presented, which involves with probability distributions of normal behavior on computer network and DDoS attacks detection threshold. The model employs statistical analysis of data from network connections to find the probability distributions of normal behavior. Based on the probability distributions, the threshold is set for detecting attacks. Also, the feasibility of the scheme is validated through the simulated test. The experimental results show the effectiveness of the model in detecting DDoS attacks. Furthermore, this model provides some directed sense for other network security detection research.