论文部分内容阅读
DoS攻击检测是入侵检测系统中的重要课题,针对这一亟待解决的问题,综合数据挖掘技术、分形技术和通信流分类技术,分析现有基于网络的DoS攻击检测方法的不足,提出基于熵的属性分类挖掘方法和基于分形维的DoS攻击检测算法FDD DoS,FDD DoS算法分为训练和检测两个阶段,在训练阶段,首先获取到达服务器的通信流,通过计算得到分类后通信流的分形维数值和偏差阈值。在检测阶段,FDD DoS实时计算通信流的分形维,如果偏差小于训练阶段得到的阈值,则修改分形维值(学习进化的过程),否则,可判定发生了DoS攻击。在实际网络环境cs.scu.edu.cn上对FDD DoS算法进行了连续8周的测试,利用训练结果,并模拟DoS攻击,试验证明该算法能有效检测DoS攻击。
DoS attack detection is an important issue in intrusion detection system. According to the problem to be solved, comprehensive data mining technology, fractal technology and traffic flow classification technology, this paper analyzes the deficiencies of existing network-based DoS attack detection methods. Attribute classification mining method and DoS attack detection algorithm based on fractal dimension FDD DoS, FDD DoS algorithm is divided into two stages of training and detection. During the training phase, the communication flow to the server is obtained first, and the fractal dimension of the classified communication flow is calculated Value and deviation threshold. In the detection phase, the FDD DoS real-time calculates the fractal dimension of the communication flow. If the deviation is smaller than the threshold obtained in the training phase, the fractal dimension value is modified to learn the evolution process. Otherwise, a DoS attack may be determined. In real network environment cs.scu.edu.cn FDD DoS algorithm for eight weeks of continuous testing, the use of training results and simulation DoS attacks, experiments show that the algorithm can effectively detect DoS attacks.