LDoS attack detection method based on EMDR-WE algorithm

Abstract

The invention discloses an LDoS attack detection method based on an EMDR-WE algorithm, and belongs to the field of computer network security. The method comprises the following steps: in view of the characteristic of high complexity of a TCP flow sequence under the LDoS attack, quantifying the TCP flow sequence complexity of an attack window and a normal window by combining four characteristic entropies, namely approximate entropy, sample entropy, fuzzy entropy and permutation entropy; constructing a preprocessing model for empirical mode decomposition and reconstruction of a TCP flow sequence, filtering noise components of the TCP flow sequence through the model, obtaining a sliding window sequence of TCP flow, and extracting four feature entropies of each window; giving a higher weight to the feature entropy with the large information contribution degree by using an entropy weight method to obtain a comprehensive score of the complexity of each TCP flow window. comparing with a threshold value obtained by logistic regression training, and judging that the window with the comprehensive score higher than the threshold value has the LDoS attack. According to the LDoS attack detection method based on the empirical mode decomposition, reconstruction and entropy weight method, the LDoS attack can be accurately detected, and the performance is stable.

Description

technical field [0001] The invention belongs to the field of computer network security, and in particular relates to an EMDR-WE algorithm-based LDoS attack detection method. Background technique [0002] Denial of Service (DoS) attack is a network attack that spreads all over the world. It maliciously invades network resources, so that legitimate users cannot get normal services. Low-rate Denial of Service (LDoS) attack, as a new variant of DoS attack, was discovered and attracted the attention of the network security community. Unlike traditional DoS attacks, which continuously launch high-intensity attack traffic to occupy the bandwidth, LDoS attacks intermittently generate high-speed attack traffic, and use the security loopholes in the network adaptive mechanism to reduce the quality of service of the victim network. By reasonably setting the period of the LDoS attack, a high-intensity pulse attack is launched every time the TCP sender retransmits a data packet, which w...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the shortcomings of low detection rate and unstable performance of the existing LDoS attack detection method, the present invention proposes an LDoS attack detection method based on the EMDR-WE algorithm

Images