LDoS attack detection and mitigation scheme based on ensemble learning and peak searching algorithm

Abstract

The invention discloses an LDoS attack detection and mitigation scheme based on ensemble learning and a peak searching algorithm, and belongs to the field of computer network security. The method comprises the following steps: acquiring flow flowing through a bottleneck link in a period of time by using an SDN controller as training data; using a sliding window to divide training data into a plurality of detection windows and mark the windows; dividing the marks into normal (without LDoS attack) and abnormal (with LDoS attack); calculating an average value, a variable coefficient, an average absolute time derivative and a waveform cumulative length of the TCP flow of the detection window as characteristics; inputting the marks and the features into an ensemble learning algorithm to train a classifier; classifying the test data acquired in real time by using a classifier to obtain class marks; if yes, positioning an attacker based on a peak searching algorithm, and discarding the attack flow; otherwise, continuing real-time sampling. According to the LDoS attack detection and mitigation scheme provided by the invention, the LDoS attack can be effectively detected, and the influence caused by the attack can be quickly mitigated.

Description

technical field [0001] The invention belongs to the field of computer network security, in particular to an LDoS attack detection and mitigation scheme based on integrated learning and peak-seeking algorithms. Background technique [0002] LDoS (Low-rate Denial of Service, low-rate denial of service) attack, as a variant of denial of service attack, is an attack launched against the vulnerability of the adaptive mechanism in the network protocol. It severely degrades the quality of service by sending periodic high-speed attack pulses, causing normal users to be unable to effectively access the server. [0003] The current real-time detection and mitigation solutions for LDoS attacks have the following problems: First, the network traffic when an LDoS attack occurs is very similar to the network traffic when a large number of legitimate users access the network at the same time, which is extremely concealed and difficult to be detected by traditional firewalls. Or anti-denia...

AI Technical Summary

Problems solved by technology

It severely degrades the quality of service by sending periodic high-speed attack pulses, causing normal users to be unable to effectively access the server

[0003] The current real-time detection and mitigation solutions for LDoS attacks have the following problems: First, the network traffic when an LDoS attack occurs is very similar to the network traffic when a large number of legitimate users access the network at the same time, which is extremely concealed and difficult to be detected by traditional firewalls. Or anti-denial of service attack mechanism identification; secondly, the existing real-time detection methods of LDoS attacks have certain defects, such as high cost, poor scalability, low detection accuracy, not suitable for big data, weak real-time performance, etc.; The third is that under the traditional network architecture, the deployment of mitigation solutions requires additional equipment or changes to existing protocols, which is costly and difficult to implement

Images