Low-speed denial of service attack detection method based on cloud model

Abstract

The invention discloses a low-speed denial of service attack detection method based on a cloud model and belongs to the field of computer network security. The method comprises four steps of collecting samples, extracting features, establishing an attack detection classifier and carrying out judgment and detection. Sample collection points are set in a bottleneck link; network traffic data is collected; TCP traffic data is extracted from the network traffic data; network traffic is analyzed through utilization of a cloud model theory which can avoid an establishment error resulting from network traffic uncertainty; TCP traffic in the bottleneck link is analyzed through adoption of a reverse cloud generation algorithm, thereby obtaining a numeric feature group; the attack detection classifier is established through utilization of a support vector machine with small sample learning capacity; and output of the attack detection classifier is taken as basis, and whether a low-speed denial of service attack occurs or not is judged. According to the low-speed denial of service attack detection method provided by the invention, the required number of samples is low, and relatively low false alarm rate and missing report rate are realized.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a low-speed denial-of-service attack detection method based on a cloud model. Background technique [0002] Low-speed denial-of-service attack is one of the variants of denial-of-service attack. It mainly uses the TCP / IP congestion control mechanism to periodically send high-rate short-pulse attack streams to the target user, causing the network to be in a state of false congestion, and the quality of service is seriously reduced. . This new type of denial-of-service attack has a low average rate and good concealment, and the traditional denial-of-service attack detection method is difficult to work. [0003] The existing low-speed denial-of-service attack detection methods are divided into two categories according to the detection objects: the low-speed denial-of-service attack detection method based on router queue analysis and the low-speed denial-of-service attack de...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the problem of detection performance degradation caused by network traffic uncertainty in the existing detection algorithm, the present invention proposes a cloud model-based low-speed denial-of-service attack detection method based on the cloud model theory

Images