基于卡尔曼滤波的LDDoS攻击检测方法

Detection of LDDoS Attack Based on Kalman Filtering

低速率分布式拒绝服务LDDoS(Low-rate Distributed Denial of Service)攻击是一种新型的DDoS攻击.它利用TCP协议超时重传RTO(Retransmission Time Out)机制,向受害者发送周期性的脉冲(Pulse)攻击.LDDoS平均攻击速率较低,因此它能躲避传统的检测方法.本文针对LDDoS攻击提出了一种基于卡尔曼(Kalman)滤波的检测方法,采用一步预测与最优估算的误差值作为检测依据.通过模拟仿真和在实际网络环境中测试,得到89.6%的检测率.实验结果表明本文方法能有效地检测出LDDoS攻击.

LDDoS （Low-rate Distributed Denial of Service） attack is a new class of DDoS, which exploits TCP＇s RTO （Retransmission Time Out） mechanism.An LDDoS attack can elude the monitor of traditional detection approach by sending lowrate packets in the way of periodic pulse to a victim. This paper proposes an approach of detecting LDDoS attack based on kalman filter. The error between one step prediction and the optimal estimation is used as the detection criterion. Experiments in simulation environment and practical network are conducted to test the detect performance and about 89.6% detect probability is achieved.Resalts show that this approach has an expected effect in detecting LDDoS attack.