Method for detecting network flood attack behaviors

Abstract

The invention discloses a method for detecting network flood attack behaviors. The method comprises the following steps of 1, counting a difference value between SYN + ACK and ACK messages received ina certain time period by adopting a counting type Bloom Filter-based message counting method; 2, judging whether an abnormal behavior occurs or not by adopting a non-parameter-based CUSUM algorithm;3, adjusting the sampling window by adopting a self-adaptive adjustment method; 4, determining an attacked target according to address division. The problems that in the prior art, due to the basic characteristics that the scale of a communication network is continuously increased and the data size is overlarge, the running time of a traditional detection method is multiplied, the cost expenditureof the method is increased, and the real-time efficiency of the method is reduced are solved; an existing abnormal behavior recognition method is large in recognition effect false detection rate andfalse recognition rate.

Description

technical field [0001] The invention belongs to network anomaly detection technology, and in particular relates to a network flood attack behavior detection method. Background technique [0002] With the rapid development of information technology, the frequency of abnormal network incidents on the Internet is getting higher and higher, and the negative impact on people's daily Internet activities is also becoming more and more significant. With the continuous emergence of abnormal network events, abnormal network behaviors such as distributed denial of service attacks, worm propagation, and port scanning are particularly prominent. While the Internet is developing at a high speed, it is also suffering from the impact of abnormal network events. With the continuous updating of network technology and applications, the development direction of communication networks is becoming more and more multidirectional, and the types of services carried are becoming more and more compreh...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to provide a method for detecting network flooding attack behaviors to solve the basic characteristics of the existing communication network in which the scale continues to increase and the amount of data is extremely large, which will cause the running time of the traditional detection method to be reduced. doubled, the cost of the method is increased and the real-time efficiency of the method is reduced; the recognition effect of the existing abnormal behavior recognition method has technical problems such as high false detection rate and false recognition rate

Images