基于粗糙集算法的DDoS攻击威胁评估

Threat Assessment of DDoS Attacks based on Rough Set Algorithm

DDoS攻击具有发起容易、防御难的特点,一直是网络安全防御的难点和热点之一。针对常见的洪水式DDoS攻击,提出基于粗糙集理论的安全评估方法,实现安全威胁的实时定量评估。该方法通过测量攻击发起前后相关的网络和系统指标变化,确定用于衡量DDoS攻击影响的一系列指标。然后,进一步利用粗糙集算法分析DDoS安全威胁程度的样本决策表,计算属性重要性并进行归一化处理,得出各指标的权重。最后,对约简后的指标进行加权求和,得到安全态势值。实验证明,该方法能够有效地量化攻击发生前后的系统安全状态变化。与现有的安全评估方法相比,利用粗糙集理论的安全评估方法可以在不依赖先验知识的前提下确定指标权重,客观地对DDoS攻击做出评估和预测。

DDoS attack, with easy launch and hard defence, is always a matter of concern in network security. Aiming at common in-flood DDoS attacks（cc attack）, the security assessment method based on rough set algorithms is proposed, thus to achieve real-time quantitative assessment of security threats. By measuring changes in related indices of network and system performance before and after attack, a series of indices for evaluating DDoS attacks, are determined, then further with rough set algorithm the sample decision table of DDoS attacks, is analyzed, the normalized importance of each index calculated,and the weight of each index acguired. Finally the security situation value is obtained by weighted summation of the chosen indices. Experiments show that this method can effectively quantify the changes of system security state before and after attack. Compared with the existing security assessment methods, the security evaluation method based on rough set theory can determine the weight of indices without any reliance on prior knowledge, and objectively evaluate and predict the DDoS attack.