基于VTP方法的DDoS攻击实时检测技术研究

被引:18
作者
李金明
王汝传
机构
[1] 南京邮电大学计算机学院
关键词
网络安全; 分布式拒绝服务攻击; 实时检测; Hurst参数; 方差-时间图;
D O I
暂无
中图分类号
TP393.08 [];
学科分类号
0839 ; 1402 ;
摘要
为了能及时准确检测DDoS攻击的发生,在对方差-时间图(VTP,Variance-Time Plots)方法分析的基础上,对基于VTP的实时在线计算Hurst参数技术进行了性能分析,得出了其具有高效性的结论,并利用这种技术,对MIT的林肯实验室数据进行了分析,总结出了DDoS攻击过程中,网络流量的自相似模型的Hurst参数变化规律,即DDoS攻击刚开始时,Hurst参数具有较快的上升趋势,然后在参数值很高水平的基础上具有缓慢下降趋势,直到计算Hurst参数的网络流量全部是DDoS攻击流量时,有一个突然下降的现象(从0.95以上降至0.45左右),并由此总结出一种基于Hurst参数实时检测DDoS攻击发生的技术.
引用
收藏
页码:791 / 796
页数:6
相关论文
共 10 条
[1]  
Wide area traffic:the failure of poissonmodeling. Paxson V,Floyd S. Proc ACM Sigcomm’94 . 1994
[2]  
On self-similar traffic in ATMqueues:definitions,overflow probability bound,and cell delaydistribution. B Tsybakov,N D Georganas. IEEE ACM Transactions on Networking . 1997
[3]  
Self-similarity in World Wide Webtraffic-evidence and possible cause. Crovella M E,Bestavros A. Proceedings of ACMSigmetrics’ .
[4]  
Long range de-pendence in variable bit rate video traffic. J Beran,R Sherman,M S Traqqu,W Willinger. IEEE Trans onCommunication . 1995
[5]  
Contribution toward real-time service on packetswitched networks. M Garrett. . 1993
[6]  
Self-simi-larity through high-variability:statistical analysis of EthernetLAN traffic at the source level. W Willinger,M S Taqqu,R Sherman,D V Wilson. IEEE/ACM Transactions onNetworking . 1997
[7]  
Fractal traffic:Measurements,modeling and per-formance evaluation. Addie R,et al. In:Proc of INFOCOM’95 . 1995
[8]  
Analysis,modeling and generationof self-similar VBR video traffic. M W Garrett,W Willinger. Proc ACM Sigcomm’94 . 1994
[9]  
On theself-similar nature of Ethernet traffic(extended version). W E Leland,M S Taqqu,W Willinger,D V Wilson. IEEE ACM Transactions on Networking . 1994
[10]  
Estimation of fractal signalsfrom noisy measurements using wavelets. G W Wornell,A V Oppenheim. IEEE Transactions on Signal Processing . 1992