关键词: 分布式拒绝服务, 自相似性, 多重分形, Hurst参数, Holder指数, 多窗口小波分析

Abstract: On the basis of analyzing the fractal property of network traffic and the features of Distributed Denial of Service（DDoS） attacks, a method of DDoS attack detection based on wavelet analysis is presented, and the attack detection model is designed. It judges the fractal features of network traffic, then adopts a method of variance of Hurst exponent based on wavelet analysis detect attack when it is self-similar or a method of Holder exponent based on multi-window wavelet analysis detect attack when it is multi-fractal. On the DARPA/Lincoln laboratory intrusion detection evaluation data set 2000, the experimental results show that this method is effective, and detection rate is high on the big background traffic DDoS attack, low-rate DDoS attack, and reflection DDoS attack, which is better than the traditional method.

Key words: Distributed Denial of Service（DDoS）, self-similar, multi-fractal, Hurst parameter, Holder exponent, multi-window wavelet analysis