A method and system for detect LDoS attack data stream in cloud environment

Abstract

The invention discloses a method and a system for detecting LDoS attack data flow in a cloud environment. The method comprises the steps of simulating various attacks with network simulation softwareand extracting corresponding network traffic; sampling and classifying the data packets that arrive and lose on the server; extracting the average number of packets, source IP growth rate, wavelet features and congestion participation in a given period of data stream from the sample; analyzing the eigenvalues and establishing the random forest classification model, testing the established random forest model with normal data stream and abnormal data stream, calculating the corresponding information entropy for each feature classification, adjusting the threshold value of eigenvalues accordingto the information entropy, so as to achieve the best classification effect; according to the stochastic forest classification model, designing and deploying the LDoS attack data flow detection systemon the cloud server to detect and process all kinds of LDoS attack data flow in real time. The invention has the advantages of low energy consumption, high detection rate and low false alarm rate, and has high practical value.

Description

technical field [0001] The invention relates to the security field of cloud environment, in particular to a cloud environment LDoS (Low Rate Denial of Service) attack data stream detection method and system. Background technique [0002] The traditional DoS (Denial of Service, Denial of Service) attack detection method is to detect the characteristics of network data flow and server load increase rapidly in a short period of time, while the LDoS (Low-rate Denial of Service, Low-rate Denial of Service) attack performance There are many different characteristics, such as the average rate of attack data flow is low, and the server load does not change much. Therefore, traditional detection methods are not suitable for detecting LDoS attacks. [0003] According to whether it is necessary to establish the attack pattern feature library in advance, most detection methods can be divided into two categories: feature detection and anomaly detection. Feature detection For known atta...

AI Technical Summary

Problems solved by technology

[0009] Improving network protocols and service protocols is also a way to mitigate LDoS attacks, but the cost of this method is too high, and there is no guarantee that new network protocols can completely resist LDoS attacks, and for existing intact network protocol systems , the cost of implementing a new protocol is too high and the method is not feasible

Images