基于云平台的分布式拒绝服务（DDoS）攻击检测技术研究

发布时间：2018-11-17 06:36

【摘要】：随着互联网规模的迅速扩大,不同协议的网络流量充斥网络,网络变得越来越复杂。在大量涌入的流量中,就包括网络攻击等异常行为,如何快速、准确地甄别网络流量中的异常行为,减少异常行为对相关网络平台和业务造成影响——保障网络的有效运行,对提高整个网络的可用性和可靠性具有重要意义,同时也是学术界和工业界共同关注的前沿课题。本文分析和讨论了现有的异常流量检测算法,着重对词袋模型(Bag of words model,BoW)进行改进,并通过在公开数据库上的实验来进行比较。论文主要工作内容及创新之处如下:(1)针对现有的检测算法人工干预需要依赖经验设定预警阈值以及异常流量特征码更新不及时等问题,提出了一种基于流量关键点词袋模型(Stream Point Bag of word,SP-BoW)的检测算法。该算法改进词袋模型并将其应用到网络流量的异常检测中,能自动进行模型训练,可以实现对异常流量的攻击分类与实时检测等。(2)为了更好检测分布式拒绝服务(Distributed Denial of Service,DDoS)攻击,在原有算法基础上,提出了一种基于二进制流量关键点词袋模型(Binary Stream Point Bag of Word,BSP-BoW)的检测算法。该算法直接从二进制流量中训练得到流量关键点(Stream Point,SP),能针对不同拓扑网络进行自适应异常检测,可以识别攻击的阶段为攻击防御阶段提供依据等。(3)提出了一种可以部署在云平台上的异常流量检测框架。该框架核心思想是基于BSP-BoW检测算法,部署在各个服务或平台的网络流量入口处。该框架从异常样本中训练得到异常流量关键点特征,然后将训练好的特征分发到各个检测节点。该框架可以快速地分析和检测当前拓扑网络下的异常流量。
[Abstract]:With the rapid expansion of the scale of the Internet, the network traffic of different protocols is flooding the network, and the network becomes more and more complex. In the mass influx of traffic, including network attacks and other abnormal behavior, how to quickly and accurately identify abnormal behavior in network traffic, reduce the impact of abnormal behavior on the relevant network platforms and services-to ensure the effective operation of the network. It is of great significance to improve the usability and reliability of the whole network, and it is also a leading issue that academia and industry pay attention to. In this paper, we analyze and discuss the existing abnormal traffic detection algorithms, focusing on the improvement of the word packet model (Bag of words model,BoW), and compare it with the experiments on the open database. The main contents and innovations of this paper are as follows: (1) aiming at the existing detection algorithms which need to rely on experience to set a warning threshold and the abnormal traffic signature update is not timely. This paper presents a detection algorithm based on (Stream Point Bag of word,SP-BoW). The algorithm improves the word packet model and applies it to the anomaly detection of network traffic, which can train the model automatically. Attack classification and real-time detection of abnormal traffic can be realized. (2) in order to better detect distributed denial of service (Distributed Denial of Service,DDoS) attacks, based on the original algorithm, This paper presents a detection algorithm based on binary traffic key point packet model (Binary Stream Point Bag of Word,BSP-BoW). The algorithm can directly train the traffic key points (Stream Point,SP) from binary traffic and can detect adaptive anomalies for different topological networks. The phase that can identify the attack provides the basis for the defense phase of the attack. (3) an anomaly traffic detection framework which can be deployed on the cloud platform is proposed. The core idea of the framework is based on BSP-BoW detection algorithm, deployed at the network traffic entrance of each service or platform. In this framework, the key features of abnormal traffic are obtained from the abnormal samples, and then the trained features are distributed to each detection node. The framework can quickly analyze and detect abnormal traffic in the current topological network.
【学位授予单位】：贵州大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】