LDoS attack detection method based on FSWT time-frequency distribution

Abstract

The invention discloses an LDoS attack detection method based on FSWT time-frequency distribution, and belongs to the field of computer network security. The method comprises four steps of network flow collection, statistical feature extraction and feature detection model construction, and LDoS attack behavior determination. The method comprises the following steps: firstly, extracting TCP traffic on a router to form original network traffic; processing the original network traffic to obtain effective network traffic, obtaining time-frequency distribution of the effective network traffic by using an FSWT time-frequency transformation technology, and calculating important statistical characteristics as a detection basis; training a decision tree classification model as a feature detection model through statistical features and labels of the training data; and judging whether the LDoS attack occurs according to the output of the trained feature detection model. The LDoS attack detection method provided by the invention has good anti-interference performance for noise and other problems in a complex network environment, can accurately extract the feature information of the network flow in the time-frequency domain, improves the accuracy of the features, and enhances the detection performance of the LDoS attack.

Description

technical field [0001] The invention belongs to the field of computer network security, in particular to an LDoS attack detection method based on FSWT time-frequency distribution. Background technique [0002] Low-rate denial of service (Low-rate Denial of Service, LDoS) attack is a kind of attack with the characteristics of periodicity, concealment, low rate, etc., and it is a kind of denial of service (Denial of Service, DoS) attack. It maliciously preempts and consumes target resources, leading to degradation of target network performance and service quality. It is highly destructive and difficult to detect and defend. Therefore, research on LDoS attack detection methods is of great significance to the development of computer network security. [0003] Existing research on LDoS attack detection methods can be generally divided into three categories according to characteristics, namely LDoS attack detection methods based on time domain, LDoS attack detection methods based...

AI Technical Summary

Problems solved by technology

The disadvantage of this technique is that the frequency-domain-based transformation cannot provide the information of the signal in the time-domain and frequency-domain at the same time. It can only obtain the frequency components contained in a piece of signal as a whole, but it does not know the time when each component appears. ignorance

Existing LDoS attack detection methods based on the time-frequency domain are generally based on traditional time-frequency analysis techniques, such as Short-Time Fourier Transform (Short-Time Fourier Transform, STFT), Hilbert Huang Transform (HilbertHuang Transform, HHT), etc., these time-frequency domain analysis methods have limitations, such as: the window function of STFT limits the time-frequency resolution; the basis of HHT transformation is empirical mode decomposition, which performs adaptive decomposition completely according to the signal itself, but in the decomposition When the local signal contains narrowband interference, the modal aliasing phenomenon will occur, which will affect the accuracy of time-frequency feature extraction

The limitations of these time-frequency analysis methods will directly affect the accuracy of feature extraction, resulting in poor detection performance.

Images