基于请求关键词的应用层DDoS攻击检测方法

Application-layer DDoS Attack Detection Based on Request Key words

目前应用层DDoS攻击严重危害互联网的安全。现有的检测方法只针对某种特定的应用层DDoS攻击,而不能识别应用层上其它的DDoS攻击。为了能快速有效地识别出多种应用层DDoS攻击,提出一种基于请求关键词的应用层DDoS攻击检测方法,该方法以单位时间内请求关键词的频率分布差和个数作为输入,采用隐马尔可夫模型来检测应用层DDoS攻击。实验结果表明,该方法对应用层上的多种DDoS攻击都具有很高的检测率和较低的误报率。

Today, the application-layer DDoS attacks may cause great harm to the security of the Internet. Existing de- tection methods lack the versatility, i. e., an approach only focuses on one particular application-layer DDoS attack. In order to quickly and effectively identify several different application-layer DDoS attacks, this paper presented a detection method based on request keywords. In this method, the input is the number and frequency distribution distance of re- quest keywords per unit time. Then, the hidden markov model is used to detect application-layer DDoS attacks. The ex- perimental results show that the proposed method is valid to discover several different application-layer DDoS attacks with relatively high detection ratio and low false positive ratio.