一种针对LDoS攻击的分布式协同检测方法

Distributed Collaborative Detection Method for LDoS Attacks

针对近年来提出的一类新型攻击——低速率拒绝服务攻击(LDoS:Low-rate Denial of Service),提出一种位于中间网络的分布式协同检测方法DCLD(Distributed Collaborative Ldos Detection).该方法运用小波分析从多角度对LDoS攻击进行特征提取,并根据D-S证据理论,组合各种特征证据对攻击进行综合判决.各检测节点之间采用分布式协同算法实现信息交互.模拟实验结果表明,DCLD能够以较高精确度检测LDoS攻击及其分布式形式,并于靠近攻击源处对其进行响应,有效减小了攻击及防范机制本身对合法流量的影响.

Low-rate Denial-of-Service, very different form traditional flooding DoS attacks, is a new kind of attacks. A distributed collaborative detection method DCLD（Distributed Collaborative LDoS Detection）which is deployed in the middle network defending against this kind of attacks and their distributed forms is presented. Attack traffic features are extracted using multi-scale wavelet analysis. Then, the feature-evidences are combined to make integrating judgement based on the D-S evidence theory. A distributed collaborative algorithm is also proposed, detection nodes exchange their information to realize collaborative detection through it. Simulation experiments show that DCLD can reach high detection accuracy and defenses the attacks near the sources, consequently mitigates the impacts of both attacks and defense mechanism on legitimate traffics.