基于词袋模型的分布式拒绝服务攻击检测

发布时间：2018-05-14 10:30

本文选题：词袋 + 机器学习　；参考：《计算机应用》2017年06期

【摘要】：针对分布式拒绝服务(DDo S)攻击有效荷载快速变化,人工干预需要依赖经验设定预警阈值以及异常流量特征码更新不及时等问题,提出一种基于二进制流量关键点词袋(BSP-Bo W)模型的DDo S攻击检测算法。该算法可以自动从当前网络的流量数据中训练得到流量关键点(SP),针对不同拓扑网络进行自适应异常检测,减少频繁更新特征集带来的人工成本。首先,对已有的攻击流量和正常流量进行均值聚类,寻找网络流量中的SP;然后,将原有的流量转化映射到相应SP上使用直方图进行形式化表达;最后,通过欧氏距离进行DDo S攻击的分类检测。在公开数据库DARPA LLDOS1.0上的实验结果表明,所提算法的异常网络流量识别率优于现有的局部加权学习(LWL)、支持向量机(SVM)、随机树(Random Tree)、logistic回归分析(logistic)、贝叶斯(NB)等方法。所提的基于词袋聚类模型算法在拒绝服务攻击的异常流量识别中有很好的识别效果和泛化能力,适合部署在中小企业(SME)网络流量设备上。
[Abstract]:Aiming at the fast change of effective load in distributed denial of service (DDo S) attack, artificial intervention needs to rely on experience setting early warning threshold and untimely update of abnormal traffic characteristic code. A DDo S attack detection algorithm based on BSP-Bo W model of binary flow key point is proposed. This algorithm can automatically flow from current network flow. The traffic key point (SP) is trained in the volume data. Adaptive anomaly detection is carried out for different topology networks to reduce the artificial cost of frequent update feature sets. First, the existing attack traffic and normal traffic are clustered to find the SP in the network traffic. Then, the original flow conversion is mapped to the corresponding SP to use direct. The square graph is formally expressed; finally, the DDo S attack is classified by Euclidean distance. The experimental results on the open database DARPA LLDOS1.0 show that the proposed algorithm is superior to the existing local weighted learning (LWL), the support vector machine (SVM), the random tree (Random Tree), and logistic regression analysis (logistic). Bias (NB) and other methods. The proposed algorithm based on the word bag clustering model has good recognition effect and generalization ability in the abnormal traffic identification of denial of service attack. It is suitable for deploying the network traffic equipment of small and medium enterprise (SME).

【作者单位】：贵州大学计算机科学与技术学院;贵州大学计算机软件与理论研究所;
【基金】：贵州省科学基金资助项目(黔科合LH字[2014]7634号,黔科合J字[2011]2328号)~~
【分类号】：TP393.08

【相似文献】