基于SOINN的DDoS攻击检测方法研究

Research on DDoS attack detection methods based on SOINN

分布式拒绝服务(DDoS)攻击是一种分布式、协作式的大规模网络攻击方式。目前很多DDoS攻击检测方法虽然对已知类型攻击具有较高的检测率,但在攻击形式快速变化时,缺乏对新攻击类型的有效检测。因此,本文提出了一种基于SOINN的DDoS攻击检测方法。在对攻击流量进行分析的基础上,抽取出5个重要特征,以此建立SOINN检测模型,通过实验验证表明,该方法对已知攻击流量的检测率高、误判率低,而且SOINN的增量式学习特性有助于发现新的攻击类型。

Distributed denial of service(DDoS)attack is a distributed and cooperative large-scale network attack.Although many DDoS attack detection methods have high detection rate for known types of attacks,they lack of effective detection of newattack types when the attack forms change rapidly.A DDoS attack detection method based on SOINN is proposed.Based on the analysis of attack traffic,five important features are extracted to establish the SOINN detection model.Finally,the effectiveness of the detection method is verified by experiments.Experimental results showthat this method has high detection rate and lowmisjudgment rate for known attack traffic,and the incremental learning feature of SOINN is helpful to detect newattack types.