Abstract: After analyzing the detection algorithm of D-WARD, a representative source-end DDoS detection system, improved D-WARD with nonparametric recursive CUSUM algorithm. Meanwhile, by drawing on the experience of Load-Shedding in the load balance , used Kaufman algorithm to adjust and upgrade threshold value dynamically and compared their respective performance. Experiments proved that the improved system is lower in false-positive rate and false-negative rate, which is more accurate and could adapt to more complex network environments.

摘要： 深入分析了具有代表性的DDoS源端检测系统D-WARD的检测算法，在使用非参数化递归CUSUM算法改进D-WARD的基础上，借鉴负载平衡中Load-Shedding的思想，应用Kaufman算法动态调整和更新阈值Threshold,并对检测性能进行详细比较。经实验验证，改进的系统具有更低的误报率和漏报率，能够适应更复杂的网络检测环境。