融合规则的条件随机场DDoS攻击检测方法

DDoS attack detection method based on conditional random field with feature set

基于流量突发性、源IP地址的分散性、流非对称性等单一手段进行DDoS攻击检测,存在准确率低,虚警率高等问题。利用条件随机场不要求严格独立性假设与综合多特征能力的优点,提出了基于CRF模型融合特征规则集实现对DDoS攻击的检测方法,采用单边连接密度OWCD、IP包五元组熵IPE组成多维特征向量,仿真结果表明,在DARPA 2000数据集下,检测准确率达99.82%、虚警率低于0.6%,且在强背景噪声干扰下无明显恶化。

The traditional detection methods for DDoS attacks have low accuracy and high false alarms rate because those means are only based on one of such flow features as burst feature, dispersed source IP address, asymmetry flow and etc. This paper uses conditional random field to integrate many pattern match rules for DDoS attack detection. The feature vector includes one way connection density, source IP entropy, destination IP entropy, destination port entropy and protocol entropy. The simulation results show that the proposed method outperforms other well-known methods such as naive Bayes and SVM. The detection accuracy rate reaches 99.82% and the false alarm rate is less than 0.6%.The method is robustness under strong interference traffic noise.