CUSUM算法在DDoS源端检测中的应用

Detecting DDoS attacks in source-end network with CUSUM algorithm

在深入分析了DDoS源端检测的特点和难点的基础上,引入统计学中非参数改变点检测方法,应用非参数化递归CUSUM(Cumulative Sum)算法对代表性的源端检测系统D-WARD进行了改进。经实验验证,应用CUSUM算法的检测系统具有更低的误报率和漏报率,能够适应更复杂的网络检测环境。

After characteristics and difficult problems in detecting DDoS attacks were analyzed in source-end network, a nonparametric change point detection method in statistics was introduced and D-WARD system, a representative source-end DDoS detection system, was improved with nonparametrie reeursive CUSUM algorithm. Experiments prove that the improved system is lower in false-positive rate and false-negative rate, which is more accurate and could adapt to more complex network environments.