Abstract: The Application Layer Distributed Denial of Service（AL-DDoS） attack has increased gradually as a threat on the security of network. For user access behavior, a new method based on Multi-Exemplar Affinity Propagation（MEAP） clustering algorithm is proposed in the paper to detect AL-DDoS. The method makes the entropy of request sequences as input to obtain the user behavior pattern by MEAP, and calculates the distance between the new coming request sequence and each cluster centers, finally distinguishes the normal and attack traffic. The simulation experiments show that the method can effectively complete the online detection about AL-DDoS.

Key words: Distributed Denial of Service（DDoS）, application layer, affinity propagation, clustering, intrusion detection system

摘要： 目前应用层分布式拒绝服务（Application Layer Distributed Denial of Service，AL-DDoS）攻击对网络安全造成的威胁与日俱增，针对应用层用户访问行为，研究了一种基于多聚类中心近邻传播（Multi-Exemplar Affinity Propagation，MEAP）聚类算法的AL-DDoS攻击检测模型。该方法使用用户请求序列的信息熵作为输入，通过MEAP快速获得能够描述用户浏览行为的特征模型，对新加入的请求序列计算到各个聚类中心的距离，设定阈值从而区别正常与攻击序列。通过模拟实验表明，该方法能够有效地完成在线AL-DDoS攻击准实时检测。

关键词: 分布式拒绝服务攻击, 应用层, 近邻传播, 聚类, 入侵检测系统