基于TCP数据流量异常的慢速拒绝服务攻击检测方法-计算机系统结构专业论文.docxVIP

Abstract Denial of service attacks have been a significant impact on the Internet. As a new kind of DoS attack, Low rate denial of service attacks are more efficient and more concealed compared with the traditional DoS attacks. The detection methods for traditional DoS attacks are difficult to work on LDoS attacks. Meanwhile, the existing LDoS attacks detection methods have a variety of defects. Therefore, exploring effective LDoS attacks detection methods is very urgent and significant. Based on the description of the principle of LDoS attacks, the relationship between the parameters and attack effect is analyzed. In addition, the effects of LDoS attacks on network traffic are elaborated. In order to analyze the TCP data traffic characteristics when LDoS attacks occurring, three typical network scenarios are summarized, on which the form of abnormal distribution and abnormal changes of TCP data traffic are characterized. On the basis of the abnormal distribution on TCP data traffic, a judgment criterion is established in accordance with Exponentially Weighted Moving Average algorithm. On the basis of the abnormal changes of TCP data traffic, a judgment criterion is established in accordance with the difference of entropy. On the basis of the abnomal distribution and abnormal changes on TCP data traffic, a LDoS attacks method is proposed. To verify the effectiveness of the LDoS attacks detection method, experiments based on simulation and DARPA99 (Defense Advanced Research Projects Agency 1999) data set have been done. The experimental results have proven that the LDoS attacks detection method can get high detection efficiency and high detection accuracy with a low false and missing detection rate. Key words：Low rate denial of service attack, Attack detection, Attack parameters, Exponentially weighted moving average, Difference of entropy 目 录 摘 要...............................................................................................................