Detection method and device for DDoS attack

Abstract

The invention relates to network technology, discloses a DDoS attack detecting method and a device thereof, wherein the DDoS attack detecting method comprises: acquiring a signal flow matrix which describes a signal flow of a path to a destination node; decomposing the signal flow matrix to acquire an abnormal space flow matrix; according to the abnormal space flow matrix, calculating the average frequency domain correlation coefficient of a path signal flow on a frequency domain; matching the average time domain correlation coefficient with the presetting time domain condition; matching the average frequency domain correlation coefficient with the presetting frequency domain condition; if the average time domain correlation coefficient accords with the presetting time domain condition, and / or the average frequency domain correlation coefficient accords with the presetting frequency domain condition, detecting DDoS attack with a attack destination node. The technical proposal provided by the embodiment of the invention can detect DDoS attack according to abnormal flows of a plurality of paths.

Description

technical field [0001] The invention relates to network technology, in particular to a distributed denial of service (DDoS: Distributed Denial of Service) attack detection method and device. Background technique [0002] A DDoS attack refers to an attacker using multiple hired computers to launch a Denial of Service (DoS: Denial of Service) attack on one or more targets. Using the client / server model, an attacker can multiply the effect of a denial of service attack by using many unwitting computers as attack platforms. Under the attack of high-speed data packets, the key resources of the victim's host, such as bandwidth, buffer, CPU resources, etc., are quickly exhausted, and the victim either crashes, or spends a lot of time processing the attack packets and cannot serve normally. Cause serious economic losses, so effectively detecting and defending against DDoS attacks is an important part of building a secure network. [0003] An existing DDoS attack detection method i...

AI Technical Summary

Problems solved by technology

[0007] It can be seen from the above that DDoS attacks can be detected using the above technical solution, but this solution only uses the traffic of multiple links for PCA decomposition. The magnitude of the abnormal traffic, because there are not only abnormal traffic of DDoS attacks on the link, but also other normal traffic, when the abnormal traffic is relatively small, the abnormal traffic will be "submerged" by the normal traffic, so only when Abnormal traffic can only be detected when the magnitude of the abnormal traffic is large; while a DDoS attack consists of a large number of employed hosts sending attack traffic to the victim along multiple paths at the same time, so the abnormal traffic on a link is usually small, while in the communication network The background traffic and its normal traffic vary greatly, so it is easy to miss the detection by only relying on the abnormal traffic amplitude of a single link

Images