A method and device for DDOS attack detection

Abstract

The invention discloses a method and a device for DDOS attack detection. The method includes acquiring a characteristic vector of traffic in a unit time, normalizing the characteristic vector to obtain a dimensionless sample to be detected, and comparing the dimensionless sample to be detected with the detection method. The common central classes in the model are clustered to determine two classes to be detected. The detection model is determined by semi-supervised learning based on feature clustering based on historical traffic samples. If the dimensionless samples to be detected belong to the class to be detected, only If the dimensionless sample to be detected is included, the dimensionless sample to be detected is determined to be a DDOS attack sample. Since the detection model obtained by semi-supervised learning based on feature clustering is used to detect whether the dimensionless sample to be detected is a DDOS attack sample, compared with the existing detection scheme, the false positive rate and false negative rate of DDOS attack detection can be reduced. The resource consumption of the system is reduced, and the detection capability of various DDOS attacks is enhanced.

Description

technical field [0001] Embodiments of the present invention relate to the field of big data technologies, and in particular, to a method and device for detecting a Distributed Denial of Service (DDOS) attack. Background technique [0002] At present, the data required for DDOS detection comes from the Netflow log, which provides various network behavior data, including seven-tuple information (Internet Protocol (IP) between source networks, source port, destination IP, destination port, protocol, number of packets, number of bytes). [0003] On the basis of obtaining Netflow log data, the current detection technical solution is to establish a threshold per minute for the number of packets or packet traffic flowing into a certain IP. When the number of packets or traffic of a certain type is found If it increases abnormally and exceeds the threshold, it is considered to be related to DDOS attack. [0004] However, the current DDOS attack detection scheme has a large number ...

AI Technical Summary

Problems solved by technology

[0004] However, the current DDOS attack detection scheme has a large number of false positives and false negatives in practice. Therefore, a new method for DDOS attack detection is urgently needed

Images