基于随机森林分类模型的DDoS攻击检测方法

发布时间：2018-04-09 01:37

本文选题：随机森林　切入点：数据流信息熵　出处：《计算机应用研究》2017年10期

【摘要】：分布式拒绝服务(distributed denial-of-service,DDoS)是目前常见的网络攻击方式之一。基于机器学习算法(SVM、HMM等)的DDoS攻击检测技术取得一些进展,但还存在着样本数量过多时易发生过拟合和未充分利用上下文信息等不足。为了弥补以上不足,提出一种基于随机森林的DDoS攻击检测方法,将数据流信息熵作为分类标准,令source IP、destination IP、destination Port分别代表数据流的源地址、目的地址、目的端口,采用SIDI(source IP-destination IP)、SIDP(source IP-destination Port)和DPDI(destination Port-destination IP)三个信息熵来分别表征三种多对一的特征,对TCP洪水攻击、UDP洪水攻击、ICMP洪水攻击等三种常见的攻击方式进行特征分析,在此基础上使用基于随机森林分类模型分别对三类DDoS攻击方式进行分类检测,实验结果表明该模型能够较为准确地区分正常流量和攻击流量,与HMM、SVM方法相比,基于RFC模型的DDoS检测方法有较高的检测率和较低的误报率。
[Abstract]:Distributed denial-of-service DDoS (DDoS) is one of the most common network attacks.Some progress has been made in DDoS attack detection technology based on machine learning algorithm. However, there are still some shortcomings such as over-fitting and underutilization of context information when the number of samples is too large.In order to make up for the above deficiency, a DDoS attack detection method based on random forest is proposed. The entropy of data stream information is taken as the classification standard, and the source IP destination Port represents the source address, destination address and destination port of the data stream, respectively.Three kinds of information entropy (SIDI(source IP-destination IP source IP-destination) and DPDI(destination Port-destination (IP) are used to characterize the characteristics of three kinds of multi-to-one respectively. Three common attack methods, such as TCP flood attack, UDP flood attack and ICMP flood attack, are analyzed.On this basis, three types of DDoS attacks are classified and detected by using stochastic forest classification model. The experimental results show that the model can accurately distinguish the normal flow from the attack flow, compared with the HMMS-SVM method.The DDoS detection method based on RFC model has higher detection rate and lower false alarm rate.
【作者单位】：南京理工大学计算机科学与工程学院;
【基金】：国家自然科学基金资助项目(61272419) 中央高校基本科研业务费专项资金资助(30916015104) 江苏省产学研前瞻性基金资助项目(BY2014089)
【分类号】：TP181;TP393.08

【相似文献】