随机伪造源地址DDoS攻击下的合法地址识别方法

Identification of legitimate addresses under DDoS attacks withrandom spoofed source addresses

设计了一种用于统计源地址包数的高效数据结构E—CBF，基于此，提出了随机伪造源地址DDoS攻击发生时合法地址识别算法，其时间复杂性为O（1），同时仅需1MB的内存开销。然后在对识别误差分析的基础上，提出了识别参数调整算法，用以根据当前攻击规模，自动调整检测参数来满足检测精度需求。模拟实验和真实网络数据实验结果均表明，该方法在不同规模的攻击下能自动调整检测参数，快速准确地发现合法源地址。

An efficient data structure called Extended Counting Bloom Filter （E-CBF） was designed to count the number of packets from source IP addresses, and then, based on it, an identifying algorithm with the time complexity of O （1） and the memory space of only 1MB, was proposed for finding legitimate addresses under distributed denial of service （DDoS） attacks with random spoofed source addresses. Based on the analysis of identifying errors, an algorithm for adjusting identifying parameters was also proposed, which can automatically adjust the parameters to satisfy the precision requirement according to attack scales. The simulation and real traffic experiments show that the proposed method can automatically adjust the parameters to fast and accurately identify legitimate addresses under different attack scales.