非平稳动态行为模型及其在DDoS检测中的应用

发布时间：2018-02-21 17:50

本文关键词： 隐半马尔可夫模型非平稳用户行为动态 DDoS检测　出处：《小型微型计算机系统》2013年09期 　论文类型：期刊论文

【摘要】：应用层分布式拒绝服务攻击严重威胁承载网络应用与服务的服务器.传统服务器端检测方法的主要问题是难以刻画非稳态网站的用户访问行为,也无法动态跟踪正常用户的行为变化,导致误检率随时间推移逐渐增高.提出一种动态的用户行为模型,并应用于诊断基于HTTP协议的分布式拒绝服务攻击.该方法采用半马尔可夫链描述正常用户行为.模型通过有监督的前后向算法获得初始化参数,利用动态参数递推算法使模型可以根据用户群体行为的变化实时调整自身参数.从而精确地实现对用户行为的跟踪及诊断可能存在的异常行为.实验结果证明了本文所提方法的有效性.
[Abstract]:Distributed denial-of-service attacks in the application layer seriously threaten the servers carrying network applications and services. The main problem of traditional server-side detection methods is that it is difficult to describe the user access behavior of unsteady-state websites. It is also unable to track the behavior changes of normal users dynamically, which leads to the increase of false detection rate over time. A dynamic user behavior model is proposed. It is applied to diagnose distributed denial-of-service attacks based on HTTP protocol. The semi-Markov chain is used to describe the normal user behavior. The model obtains initialization parameters by a supervised forward and backward algorithm. By using dynamic parameter recursive algorithm, the model can adjust its parameters in real time according to the change of user group behavior. Thus, the tracking of user behavior and the diagnosis of possible abnormal behavior can be realized accurately. The experimental results prove that the model can adjust its parameters in real time. The effectiveness of the proposed method.
【作者单位】：中山大学信息科学与技术学院;桂林电子科技大学计算机科学与技术学院;中山大学网络与信息技术中心;
【基金】：国家自然科学基金项目(60970146)资助高等学校博士学科点专项科研基金项目(20090171120001)资助中央高校基本科研业务费专项资金项目(11lgpy38)资助
【分类号】：TP393.08

【参考文献】