DDoS (distributed denial of service) detection method

Abstract

The present invention provides a DDoS detection method, which relates to the field of network intrusion detection. Aiming at the huge characteristics of the current DDoS attack traffic and the amplification attack of UDP data flow, it distinguishes the traditional DDoS detection that pays more attention to TCP, and utilizes the current Spark Streaming technology. The platform applies multi-measurement factors to quickly parallelize the analysis of time series streams obtained by stream sampling, and gives indicators of DDoS attacks. The present invention is based on the abnormality detection method of the current flow sampling, is also based on the business dynamics and advanced technology, has the characteristics of low delay detection, can effectively detect the current reflection amplification attack, and can detect the new type of DDoS. Compared with the prior art, the DDoS detection method based on flow sampling provided by the present invention has the following beneficial effects: scalable cloud detection framework; real-time low-latency detection based on Spark Streaming; adaptive detection of current emerging DDoS attacks Type; effectively detect the current reflection amplification attack.

Description

technical field [0001] The invention relates to the field of network intrusion detection, in particular to a DDoS detection method. Background technique [0002] Network intrusion detection is an important security protection point for enterprises and campus networks. Based on the intrusion detection system, network attacks can be effectively identified to protect the security of enterprises and campus networks. However, in recent years, effective network intrusion detection has become more and more difficult. The main reason is that the network bandwidth continues to increase, and there is a performance bottleneck in real-time detection of huge amounts of data. The existing mainstream products, one is Suricata and Snort, which use multi-threading to improve performance, but they are based on classic flow signatures and do not have flexible programmable rules; the other is Bro, which has Turing-Complete (Fig. Flexible and complete) scripting language, which can flexibly cu...

AI Technical Summary

Problems solved by technology

Haraldsson, Emil found abnormal attacks through statistical information such as the number of ports and TCP connections, but it was a detection with a relatively large delay