一种低通信开销的DDoS异常检测模型

A Communication Efficient Model for DDoS Detection

在分布式 DDoS 检测中,相互协作的检测节点间存在一定规模的通信开销,当通信操作频繁发生时,这种开销会加重网络负担。针对分布式 DDoS 检测,提出一种低通信开销的检测模型:选择具有最大全局值的对象作为代表,通过"监控参数"和"补偿参数"使得代表对象调整后的局部值在每个节点上看来都是最大,只要代表对象没有超出阚值则可以保证 DDoS 没有发生。将多个对象的持续监控变为对代表对象的监控和对局部约束条件的维护操作,从而降低检测操作的通信开销。通过理论分析和实验测试,证明了该方法的有效性。

In the situation of DDoS detection,there are considerable communications among detection nodes.Frequent communications will consume much network resources,we propose a model with low communication cost,where the object with largest value is chosen as the representative object,and adjustment factors are used to guarantee that the local value of the representative object is also the largest one in each remote node.Therefore,only the representative object needs to be monitored continuously as long as all the local constrains are valid.When the local constrain is violated,communication is needed among the coordinator and remote nodes to rebuild the constrain.Analytical analysis and experimental evidences show the efficiency of this model.