Method for detecting and filtering application layer DDoS (Distributed Denial of Service) attack on basis of access marking

Abstract

The invention discloses a method for detecting and filtering an application layer DDoS (Distributed Denial of Service) attack on the basis of access marking. The method comprises the following steps of: on the training phase, carrying out non-strategy marking on access behaviors of normal users; carrying out marking processing by adopting a marking strategy; extracting detection features by adopting a feature extraction strategy and representing access users as feature vectors; acquiring SVDD (Support Vector Data Description) supraspheres of the normal users and storing the SVDD supraspheres into a training database; carrying out marking on the basis of the marking strategy on access behaviors of users who enter a server and are to be detected; extracting effective detection features and expressing the access users into a feature vector form; and according to the SVDD supraspheres, carrying out detection classification and abnormity judgment on the feature vectors and when the access users are abnormal users, carrying out synchronous filtering. Implementation of the technical scheme adopted by the invention has the following beneficial effects that access marking and extraction of abnormal features are not limited to the specific server; synchronous filtering on attacking users can be implemented in the detecting process; and capability that the server resists to application layer DDoS attack is improved.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method for detecting and filtering DDoS attacks at the application layer based on access marks. Background technique [0002] As the Internet is widely used in all aspects of work and life, such as business, government, enterprise, entertainment, etc., the corresponding network security becomes more and more important. Among many network attacks, distributed denial-of-service attacks, since their first occurrence in August 1999, have become a hidden danger factor that cannot be ignored affecting network security due to their simple launch and powerful destructive attack characteristics. In recent years, with the continuous improvement of low-level detection and defense methods, an application-layer DDoS attack that combines with high-level services and uses normal protocols and server connections to transmit data has emerged as the times require. Since it is different ...

AI Technical Summary

Problems solved by technology

[0004] Analyzing the above detection methods, it can be found that: 1) The differences in application layer services and protocols enable application layer DDoS attacks to have many different forms, while most of the above detection methods only consider the detection of Web server attacks, and the transparency of detection algorithms 2) The detection and filtering are not well combined, especially the synchronous combination of the two, so even if a high detection effect is achieved, the delay in attack filtering also makes the server fall into the attack

Images