基于流量行为的DDoS检测系统

DDoS Detection System Based on Traffic Behavior

针对传统攻击检测算法不能实时识别攻击源和受害者的问题,基于对单用户流量行为的分析,设计实现一种实时的DDoS洪流攻击检测和防御系统。通过周期性地检测每个用户发送和接收的流量,判断其是否满足TCP和UDP协议行为的时间同步性,从而有效识别攻击者、受害者和正常用户,并且实时过滤攻击流量和转发正常流量。测试结果表明,该系统能够在攻击早期实时地检测出攻击者并过滤其流量,防御效果明显。

Because many traditional detection algorithms can not real time inspect the attack source and the victim, based on single-user traffic behavioral analysis, this paper presents a real-time DDoS flooding attack detection and prevention system. Based on the time synchronization of TCP and UDP protocol behavior, through periodically detecting every single IP user＇s sending and receiving traffic and judging whether its traffic behaviors meet the synchronization or not. This system can effectively recognize attackers, victims and normal users, and real time filter attackers＇ traffic and forward normal users＇ packets. Experimental results show that the system can make a real-time detection for DDoS flooding attacks and determine the attacker at the early attacking stage, and the defense effect is obvious.