Application layer distributed denial of service (DDoS) attack detection method and defensive system aimed at website

Abstract

The invention relates to an application layer distributed denial of service (DDoS) attack detection method and defensive system and relates to network safety, in particular to application layer DDoS attack detection and defend. The invention provides a detection method and the defensive system based on user click sequence forecasting. Firstly, a page table uniform resource locator (URL) of a website is extracted, a clustering algorithm is utilized to conduct clustering, page table classification Vj and a user click sequence of the website are obtained, then the user click sequence is utilized to construct a random wandering image, a next observation period click sequence of a user is calculated through a process of random wandering, at last, similarity of a predict sequence and a click sequence is calculated, and abnormity of the user click sequence is judged through training threshold. The application layer DDoS attack detection method and defensive system can effectively detect attacking of an application layer, particularly stimulate an attack request of normal user behavior, and can be widely applied to safe defend of a data center website server.

Description

technical field [0001] The invention relates to the field of network security, in particular to an application layer DDoS attack detection method and defense system for websites. Background technique [0002] Distributed Denial of Service attack (Distributed Denial of Service, DDoS) has always been one of the most serious threats faced by the Internet service provider-Web server. Traditional DDoS attack methods based on the network layer or transport layer have been well detected by increasingly mature network protection technologies (firewall, intrusion detection technology, etc.). The DDoS attack method develops to the application layer. DDoS attacks at the application layer usually use the real IP address as the attack node, and use the loopholes in the application layer protocol to send a large number of attack requests based on the legal HTTP protocol to the target server, which can easily pass through the network protection system, which undoubtedly makes it the curre...

AI Technical Summary

Problems solved by technology

According to the characteristics of asymmetric attacks, this method classifies resource consumption by HTTP requests for the first time; however, it uses the statistical characteristics of HTTP requests in the session to train the normal model, which still reflects the characteristics of traffic, but is not The traffic characteristics of symmetric attackers are consistent with those of normal users, and the unified model adopted cannot describe the access characteristics of all types of users

Images