一種基于改進(jìn)的滑動(dòng)平均濾波器的DDoS攻擊檢測(cè)方法

本文通過(guò)對(duì)網(wǎng)絡(luò)流量統(tǒng)計(jì)的分析，提出了一種基于滑動(dòng)平均濾波器的DDoS 攻擊檢測(cè)
方法。該方法不同于以往單一根據(jù)網(wǎng)絡(luò)流量的突變或根據(jù)攻擊對(duì)流量分布的影響來(lái)分析
DDOS 攻擊的方法，而是通過(guò)運(yùn)用滑動(dòng)平均濾波技術(shù)將兩者綜合考慮。該方法即適合引起網(wǎng)絡(luò)流量突變的攻擊，又適合發(fā)現(xiàn)大流量背景下攻擊流量并沒(méi)有引起整個(gè)網(wǎng)絡(luò)流量顯著變化的攻擊。因此適合于各種規(guī)模的網(wǎng)絡(luò)流量的異常檢測(cè)。另外，詳細(xì)給出了對(duì)檢測(cè)成功率和誤報(bào)率起著至關(guān)重要作用的閥值范圍。
關(guān)鍵字：滑動(dòng)平均濾波器；分布式拒絕服務(wù)攻擊；檢測(cè)率；誤報(bào)率
【Abstract】In this paper we proposes a DDoS intrusion detection method based improved slip average fliter through analyzing statistical characteristics of network traffic. Our method is
different from not noly that based on burst net flow singly but also that based on impact of the traffic distribution singly. We consider both of them. So it can find out the DDos attack both which can burst net flow and which does not arouse the quick changes of network traffic against the large scale network traffic. In addition ,we also give out arrange of threshold value which is very
important to helping us to get high identification probability and low false alarm probability.
【Keywords】slip average filter ,distributed denial of service, identification probability, false
alarm probability