一种针对DDoS flooding攻击的异常检测方案

Anomaly Detection Solution for DDoS Flooding Attack

随着网络用途的不断扩大和Internet互联网络带宽的增加,网络遭受攻击的形式也越来越多,越来越复杂。分布式拒绝服务攻击DDoS是互联网环境下最具有破坏力的一种攻击方式,尤其以TCP flooding和UDP flooding攻击为代表。文中通过分析DDoS flooding的攻击特点和TCP协议的连接过程,利用网络流量的自相似性等特点,设计出一种针对DDoS flooding攻击的异常检测方案。

With the rapid development of the Internet in recent years, network attacks happen frequently and various kinds of attack methods appear ceaselessly. DDoS is the one of the most frequent attacks in the Internet, especially TCP flooding attack and UDP flooding attack. The characteristic of DDoS flooding attack and the connective process of TCP protocol, is analysed, used the self-similar speciality of network flux, and designed a anomaly detection solution for DDoS flooding attack.