Abstract: Based on the simple response packet confirmation mechanism proposed by Hiroshima Tsunoda etc，this paper presents a novel model which adds a monitor to Hiroshima Tsunoda’s model in order to response normal connection well and to increase the speed of service，moreover detecting abnormal packet once again in comparator ensure the detection rate.Suppose the total response packet is n，when the rate of abnormal package is less than[1-1/(20n)]，the time complexity of this model is less than that of Hiroshima Tsunoda’s model.

Key words: DRDoS, attack detection, response packet quantity, time complexity

摘要： 基于Hiroshima Tsunoda等人的简单回应包确认机制模型提出一个改进模型，增加了监视器，有利于对正常连接的响应，从而提高服务速度，匹配器的二次检测确保了异常包的检测率不变。假设回应包总数为n，当异常包的概率p<1-1/(20n)时该模型的时间复杂度优于原模型。

关键词: DRDoS, 攻击检测, 响应包数量, 时间复杂度