Method and system for detecting distributed denial of service attack

Abstract

The invention provides a method for detecting a distributed denial of service attack, which comprises the following steps: receiving a network data packet, and extracting detection features which are related to the detection of the distributed denial of the service attack and used for proving the existence of the distributed denial of the service attack from the network data packet; using the detection features as an evidence in a simple reliability model, and calculating the reliability of the evidence; creating knowledge in the simple reliability model according to the detection features and calculating the reliability of the knowledge, wherein in the knowledge of the simple reliability model, an independent feature among the detection features corresponds to independent knowledge, and related detection features among the detection features are in the same knowledge; and calculating the reliability of conclusion events related to the distributed denial of the service attack by introducing the reliability of the evidence and the reliability of the knowledge into a reliability calculation formula of the simple reliability model. The method and the system have high detection capacity, high detection accuracy and excellent processing capacity.

Description

technical field [0001] The invention relates to the field of network security monitoring, in particular to a detection method and system for a distributed denial of service attack. Background technique [0002] In recent years, the global Internet has been frequently attacked by Distributed Denial of Service (DDoS, Distributed Denial of Service), which has paralyzed a large area of ​​the basic operation network, threatened the security of important information systems, and seriously endangered economic development, social stability and even national security. Therefore, the detection and defense of DDoS attacks has become a major problem to be solved in the field of network security. Among them, DDoS attack detection technology, as a technical means and basic work to effectively solve the problem of DDoS attack defense, has attracted widespread attention from all walks of life. [0003] DDoS attack detection techniques can generally be divided into two categories: misuse de...

AI Technical Summary

Problems solved by technology

[0008] The purpose of the present invention is to overcome the defects of poor adaptability and high false alarm rate caused by relying on a single detection feature in the existing distributed denial-of-service attack detection method, thereby providing an attack detection with high adaptability and detection accuracy method

Images