关键词: 分布式拒绝服务攻击, 应用层, 近邻传播, 聚类, 入侵检测系统

Abstract: The Application Layer Distributed Denial of Service（AL-DDoS） attack has increased gradually as a threat on the security of network. For user access behavior, a new method based on Multi-Exemplar Affinity Propagation（MEAP） clustering algorithm is proposed in the paper to detect AL-DDoS. The method makes the entropy of request sequences as input to obtain the user behavior pattern by MEAP, and calculates the distance between the new coming request sequence and each cluster centers, finally distinguishes the normal and attack traffic. The simulation experiments show that the method can effectively complete the online detection about AL-DDoS.

Key words: Distributed Denial of Service（DDoS）, application layer, affinity propagation, clustering, intrusion detection system