关键词: 网络安全, 分布式拒绝服务, 线性预测, 攻击特征, ARMA模型

Abstract:

The distributed denial of service (DDoS) attack is one of the major threats to the current Internet. We propose a robust scheme to detect the distributed denial of service (DDoS) attack based on the essential DDoS attacks features, such as the abrupt traffic change, flow dissymmetry, distributed source IP addresses and concentrated target IP addresses. This paper proposes a IP Flow feature value (IFFV) algorithm that reflects the DDoS attack features, and uses a simple and efficient ARMA(2,1) IFFV prediction model for normal network flow based on linear prediction techniques. Then a DDoS attack detection scheme, DDDP (DDoS attacks detection based on IFFV Prediction), is designed for network flow. Furthermore, a mechanism evaluating the reliability of alert is developed to reduce the false alerts caused by prediction or flow noise. We have done experiments with the MIT Data Set in order to evaluate our method. The results show that DDDP is an efficient DDoS attacks detection scheme, which can quickly detect DDoS attacks accurately and reduce false alarm rate drastically.

Key words: network security;distributed denial of service;linear prediction;attack features;ARMA model