关键词: 漫游蜜罐, DDoS攻击, 秩和检验, 防御模型

Abstract: This paper proposes a two-phase model using roaming honeypot to prevent DDoS attacks due to the deficiency of present detection algorithms.In the first phase，in order to detect the attacks earlier and evoke the next phase，a simple and efficient statistical model is made in the probing stage of DDoS attacks.Then in the second phase，a set of effective detection characteristics is automatically chosen，using rank sum test，to compute distances from barycenter，which is able to differentiate between legal and illegal flows and prepare for roaming the legitimate flows timely.The experimental results show the effectiveness of the model in detecting and responding DDoS attacks.

Key words: roaming honeypot, DDoS attacks, rank sum test, defense model