关键词: 分布式拒绝服务攻击, 单边连接密度, 距离测度

Abstract: It is a challenge to detect DDoS attack with low false positive and false negative.The key is to find the essential difference between normal stream and attack stream and identify it with simple algorithm.In term of the features of DDoS attack,a new conception of One-Way Connection Density（OWCD） is presented.Meanwhile,a DDoS detecting algorithm following distance measure is described.A cumulative Euclidean distance would be computed to indicate the deviation degree of the DDoS attack.As shown in the experiments,OWCD can more clearly mark DDoS attack than another conception,Flow Connection Density（FCD）.This detection measure can also overcome the shortage of two-classification detecting means and efficiently and simply identify the DDoS attack of various attacking intensity.

Key words: distributed denial of service attack, one-way connection density, distance measure