Distributed denial-of-service attack detection method based on external connection behaviors of Web communication group

Abstract

The invention discloses a distributed denial-of-service attack detection method based on the external connection behaviors of a Web communication group. The method comprises the following steps of: 1) setting a port mirror image on network equipment, and copying and transmitting all network messages passing through the equipment to an attach detection front-end processor; 2) extracting the communication group of a given Web server and the external connection behaviors of the communication group, and transmitting the communication group and the external connection behaviors thereof to an attack detection server by using the attack detection front-end processor; 3) counting external connection behavior parameters comprising the number CN_MLN of clients connected with a plurality of external connection nodes and a total client number CN of the Web communication group, and monitoring the offset of ratio of the two parameters by using an improved cumulative sum (CUSUM) algorithm to judge the occurrence of an application layer distributed denial-of-service (DDoS) attack according to the offset by using the attack detection server; and 4) reporting whether the application layer DDoS attack occurs to the given Web server or not to a network monitoring terminal at the end of each time period.

Description

technical field [0001] The invention relates to a network security technology, in particular to a denial of service attack detection method based on the outreach behavior of a Web communication group. Background technique [0002] Web service is the most widely used application type in the Internet. However, due to its important social and commercial value, Web server has also become the most important attack target in the Internet. Denial-of-Service attack (Distributed Denial-of-Service attack, DDoS) is one of the most important threats faced by web servers. DDoS attack means that attackers use puppet hosts to consume the computing resources of the target and prevent the target from providing legitimate users with Serve. Consumable computing resources can be CPU, memory, bandwidth, database server, etc. In recent years, DDoS attacks have emerged one after another [1-5]. Amazon, eBay, Yahoo, Sina, Baidu and other well-known domestic and foreign websites have been attacked ...

AI Technical Summary

Problems solved by technology

Although application-layer DDoS attacks will increase traffic rapidly, unfortunately, Flash Crowd generated by concentrated access by a large number of users has similar traffic characteristics, and it is difficult to distinguish between the two

At present, researchers have carried out some research on application-layer DDoS attack detection and filtering, but these detection methods are mostly suitable for deployment on the attacked end, and cannot avoid the impact of application-layer DDoS attacks on basic network bandwidth.

Images