基于EEMD-LSTM的需求响应终端DDoS攻击检测方法

DDoS Attack Detection Method Based on EEMD-LSTM for Demand Response Terminal

随着需求响应(demand response,DR)业务及“源-网-荷-储”互动调控的发展,越来越多需求响应终端接入电力网络,需要针对需求响应终端受到分布式拒绝服务(distributed denial of service,DDoS)攻击行为进行预测与防御技术研究。针对当前电力系统网络攻击研究,重点考虑攻击流量自相似特征,提出了一种基于集合经验模态分解(ensemble empirical mode decomposition,EEMD)与长短期记忆(long short-term memory,LSTM)网络相结合的双重检测方法。首先通过集合经验模态分解攻击流量提取模态特征;其次基于改进的LSTM神经网络进行攻击检测;最后进行仿真实验及对比分析,EEMD-LSTM神经网络的检测方法与传统LSTM检测方法相比具有更好的动态性能,有效提高了DDoS攻击检测精度。

With the development of demand response(DR)business and interactive regulation of“source-network-load-storage”,as more and more demand response terminals access the power network,it is necessary to carry out the prediction and defense technology research on the distributed denial of service(DDoS)behavior of demand response terminals.Aiming at the current network attack research of power system,this paper focuses on the self-similar characteristics of attack traffic,and proposes a network attack model based on ensemble empirical mode decomposition(EEMD)and long short-term memory(LSTM).The detection method firstly extracts the modal features by ensemble empirical mode decomposition attack traffic,then detects the attack applying the improved LSTM neural network,and finally carries out the simulation experiment and comparative analysis.Compared with the traditional LSTM detection method,the EEMD-LSTM neural network detection method has better dynamic performance and effectively improves the DDoS attack detection accuracy.