非参数PCUSUM算法DDoS攻击检测

计算机工程与应用 ›› 2011, Vol. 47 ›› Issue (22): 96-98.

非参数PCUSUM算法DDoS攻击检测

莫家庆1，胡忠望1，林瑜华2

1.广东肇庆学院计算机学院，广东肇庆 526061
2.广东肇庆学院教育技术与计算机中心，广东肇庆 526061

收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2011-08-01 发布日期:2011-08-01

DDoS attack detection based on non-parameter PCUSUM algorithm

MO Jiaqing1，HU Zhongwang1，LIN Yuhua2

1.College of Computer，Zhaoqing University，Zhaoqing，Guangdong 526061，China
2.Center of Education and Computer，Zhaoqing University，Zhaoqing，Guangdong 526061，China

Received:1900-01-01 Revised:1900-01-01 Online:2011-08-01 Published:2011-08-01

摘要/Abstract

摘要： 针对DDoS攻击时受害端中报文段未确认率急剧变化的特点，提出一种有效的DDoS攻击检测方法，以达到在保证告警正确性的前提下缩短检测时间的目的。在受害端对TCP网络流进行检测，在每个时间间隔内统计未确认的报文段数量与总报文段的比率，并在下一时间间隔内对上一时间间隔的序列值进行修正，得到更准确的检测序列值，再运用非参数递归PCUSUM算法检测DDoS攻击。实验结果表明，该方法与CUSUM算法相比，具有更高的检测准确性和更快的检测速度。

关键词: DDoS攻击, PCUSUM算法, 受害端检测, 未确认报文段

Abstract: The paper aims at the sharp change of ratio of unacknowledged packets in victim end，presents an effective method of DDoS attack detection which can shorten the detection time on the premise of guarantee alarm correctness.Detecting TCP network flow at the victim end，in every time intervals the ratio of unacknowledged packets quantity and total packets is caculated，and in next time intervals the sequence value of last time intervalis is revised，and more accurate detecting sequence value is gotten.The non-parameter recursion PCUSUM algorithm is used to detect DDoS attack.Simulation experiment shows that the method has higher detection accuracy and can improve the rate of detection.

Key words: DDoS attack, PCUSUM algorithm, detection in victim end, unacknowledged packets

莫家庆1，胡忠望1，林瑜华2. 非参数PCUSUM算法DDoS攻击检测[J]. 计算机工程与应用, 2011, 47(22): 96-98.

MO Jiaqing1，HU Zhongwang1，LIN Yuhua2. DDoS attack detection based on non-parameter PCUSUM algorithm[J]. Computer Engineering and Applications, 2011, 47(22): 96-98.

[1]	李丽娟1，2，李少东1. 自适应聚类算法在DDoS攻击检测中的应用[J]. 计算机工程与应用, 2012, 48(2): 86-89.
[2]	厉章忠，王以刚. 基于漫游蜜罐的DDoS防御模型设计[J]. 计算机工程与应用, 2009, 45(33): 93-95.
[3]	李珂^1，3，连一峰^1，2，3. 一种面向DDoS攻击的网络安全态势评估方法[J]. 计算机工程与应用, 2009, 45(27): 88-91.
[4]	王慧莹,周宁,陈秀真,李建华. 网络态势分析中服务可用性评估方法[J]. 计算机工程与应用, 2008, 44(14): 130-133.