基于序贯变化检测的DDoS攻击检测方法

DDoS Attacks Detection Based on Sequential Change Detection

给出了一种有效的DDoS攻击检测方法,将DDoS攻击的检测作为序贯变化检测的一个具体实例来分析,采用序贯变化检测算法——非参数CUSUM算法进行检测。方法具有计算量小、检测迅速准确、适用于不同网络环境和攻击模式的优点,有一定的实用价值。文章最后对两种典型的攻击模式进行了实际检测,全面评估了检测算法在不同DDoS攻击场景下的性能。

This paper presents an effective method to detect DDoS attack by formulating and solving the task as a sequential change point detection problem. It uses non-parametric CUSUM algorithm to complete the detection task of DDoS attacks. The method has several attractive features. First, it has manageable computational complexity. Second, it minimizes the average delay of detection for a given false alarm rate. Third, it is effective in various network conditions. At the end, it demonstrates the efficiency and robustness of the method in various attack scenarios by using simulations.