关键词: CC攻击, 分布式拒绝服务（DDoS）, 攻击检测, 神经网络

Abstract: CC（Challenge Collapsar） attack uses proxy servers or zombie hosts to send a large number of http requests to the server by simulating the user’s normal access to the page, causing server resources to be exhausted and implementing application layer DDoS. Some progress has been made in the detection of CC attacks. However, since the CC attack simulates the normal access of the user, the characteristics of the normal web page access are similar, which makes the attack identification difficult and high false positive rate. According to the characteristics of CC attack, combining packet rate, URL information entropy and URL conditional entropy, a CC attack detection algorithm based on BP neural network is put forward. Experimental results in the real network environment prove that the model can accurately identify normal traffic and CC attack traffic for small and medium-sized websites, and has relatively accurate detection results for large websites.

Key words: Challenge Collapsar（CC） attack, Distributed Denial-of-Service（DDoS）, attack detection, neural network