基于流量和IP熵特性的DDoS攻击检测方法

DDoS attack detection method based on network traffic and IP entropy

针对现有DDo S(distributed deny of service)攻击检测率低、误报率较高等问题进行了深入研究。根据DDo S攻击发生时网络中的流量特性和IP熵特性,建立了相应的流量隶属函数和IP熵隶属函数,隶属函数的上下限参数通过对真实网络环境仿真得到。提出了基于流量和IP熵特性的DDo S攻击检测算法,先判断流量是否异常,再判断熵是否异常,进而判断是否发生了DDo S攻击。由仿真结果可以看出,单独依靠流量或IP熵都不能很好地检测出DDo S攻击。该算法将流量和IP熵特性综合考虑,准确地检测出了DDo S攻击,降低了误报率,提高了检测率。

In-depth research on the low true positive rate and high false positive rate of existing DDo S attack,this paper analyzed the characteristics of network traffic and IP entropy when DDo S attack occured,established the membership function of traffic and IP entropy. It obtained the lower limit parameter and utilization limit parameters of membership function by the real network environment simulation,and proposed a DDo S attack detection algorithm based on the characteristics of network traffic and IP entropy. The method first judged whether the network traffic was abnormal,and then judged whether the entropy was abnormal,then judged whether a DDo S attack was happened. The simulation results show that the separate flow or IP entropy can＇t well detect the DDo S attack. The algorithm comprehensively consider of network traffic and IP entropy characteristics,has accurately detected the DDo S attack and decrease false positive rate and improved true positive rate.