A LDOS Attack Detection Method Based on Queue Distribution

Abstract

The invention discloses an LDoS attack detection method based on queue distribution. The method comprises the steps of analyzing a queue behavior under an LDoS attack, deducing an attack period, and establishing a two-dimensional queue distribution model based on an analysis result; calculating an average Euclidean distance from a sampling point to a central point in the two-dimensional queue distribution model; and comparing the average Euclidean distance with a set threshold value dth to identify the LDoS attack. According to the invention, a low-rate denial of service attack widely exists and is difficult to distinguish from a normal flow direction; attack characteristics are extracted through a two-dimensional queue distribution model composed of an instantaneous queue and an average queue. taking an Euclidean distance from a sample point to a central point in the two-dimensional queue distribution model as a detection feature; the detection threshold is dynamically adjusted by using the EWMA adaptive threshold algorithm, so that the detection method can adapt to various types of traffic in an actual network and can accurately distinguish the LDoS attack traffic from legal burst traffic, thereby enabling network defense to be safer and more effective.

Description

technical field [0001] The invention belongs to the technical field of computer network security, in particular to an LDoS attack detection method based on queue distribution. Background technique [0002] Low-rate Denial of Service (LDoS) attack was first proposed in 2003, and during these 15 years, this attack has developed into many variants, such as quality of quality (RoQ), fraudulent resource consumption (FRC), slow attack, stealth DoS. Generally speaking, LDoS attacks have three characteristics: 1. Utilize the loopholes of specific protocols or systems in the network to cause significant degradation of services in terms of resource utilization, system stability, or service quality. 2. Low cost, a single attack source can launch an attack, and its attack traffic is much smaller than that of a flood DoS (Flood DoS, FDoS) attack. 3. The average attack rate is very low (even lower than the legal flow), and it has strong concealment, which makes detection difficult. In ...

AI Technical Summary

Problems solved by technology

3. The average attack rate is very low (even lower than the legal flow), and it has strong concealment, which makes detection difficult

However, this approach requires additional storage of the feature table

Images