DDoS detection method based on stream sampling

Abstract

The invention provides a DDoS detection method based on stream sampling, and relates to the field of network intrusion detection. The DDoS detection method aims at the characteristic of huge DDoS attack streams and amplification attack of UDP data streams at present and is different from the conventional DDoS detection focusing on the TCP, and performs fast parallel analysis on time sequence streams obtained through stream sampling on a cloud platform by applying multi-measure factors through the current Spark Streaming technology so as to give the indicator of DDoS attack. The DDoS detection method is based on the current stream sampling abnormity detection method and also based on the business dynamic and advanced technology and has the characteristic of low delay detection so that the current reflection amplification type attack can be effectively detected and new DDoS can be detected. Compared with the methods in the prior art, the DDoS detection method based on stream sampling has the following beneficial effects that the cloud side detection framework can be extended; real-time low delay detection based on Spark Streaming can be performed; the new DDoS attack type can be adaptively detected; and the current reflection amplification type attack can be effectively detected.

Description

technical field [0001] The invention relates to the field of network intrusion detection, in particular to a DDoS detection method based on flow sampling. Background technique [0002] Network intrusion detection is an important security protection point for enterprises and campus networks. Based on the intrusion detection system, network attacks can be effectively identified to protect the security of enterprises and campus networks. However, in recent years, effective network intrusion detection has become more and more difficult. The main reason is that the network bandwidth continues to increase, and there is a performance bottleneck in real-time detection of huge amounts of data. The existing mainstream products, one is Suricata and Snort, which use multi-threading to improve performance, but they are based on classic flow signatures and do not have flexible programmable rules; the other is Bro, which has Turing-Complete (Fig. Flexible and complete) scripting language...

AI Technical Summary

Problems solved by technology

[0006] Another notable feature of current DDoS is the huge attack traffic

Images