DDoS Attack Identification Method Based on Access Rhythm Matrix in Application Layer

Abstract

The invention discloses an application layer DDoS attack identification method based on an access rhythm matrix, which is based on a data structure of the access rhythm matrix, uses a variation anomaly degree to carry out attack detection, and uses an outlier point to identify an attack host IP. The time complexity and space complexity of the method are low, and the actual network condition will not be affected. The detection system integrated with the algorithm can be deployed between the nearest routing and the host. The inbound traffic packets can be obtained by port mirroring technology, and the access rhythm matrix can be constructed to detect DDoS attacks at the application layer and identify the attacking host IP.

Description

technical field [0001] The present disclosure relates to the technical field of computer network security, in particular to an application layer DDoS attack identification method based on an access rhythm matrix. Background technique [0002] DDoS attacks cause great harm to the network, especially DDoS flood attacks against application layer protocols, which may directly cause users to be unable to access normally. Compared with other low-level attack modes, this type of attack is more destructive, and it is difficult to be detected by traditional DDoS detection systems. [0003] Current systems for detecting application-layer DDoS attacks can be roughly divided into two categories: one is misuse detection, and the other is anomaly detection. The former detects attacks by matching input data with pre-defined attack signatures, while the latter uses normal behaviors to build a model of legitimate behavior, and if it deviates from this model, it is judged as anomalous behavi...

AI Technical Summary

Problems solved by technology

In previous studies, packet length or packet arrival time interval were also used as features for DDoS attack detection, such as [L.Zhou, M.Liao, C.Yuan, and H.Zhang, "Low-rate ddos ​​attack detection using expectation of packet size,” Security and Communication Networks, vol.2017, 2017.] and [S.N.Shiaeles, V.Katos, A.S.Karakos, and B.K.Papadopoulos, “Real time DDoSdetection using fuzzy estimators,” Computers&Security, vol.31, no.6 , pp.782–790, Sep 2012], but in these studies, the packet length and packet arrival time interval are not linked to the application layer, making it difficult to detect application layer DDoS attacks

Images