WU Zhi-jun, ZHANG Dong. Attack simulation and signature extraction of low-rate DDoS[J]. 2008, (1): 71-76.DOI：
低速率DDoS攻击的仿真和特征提取
摘要
低速率分布式拒绝服务(LDDoS
low-rate distributed denial of service)攻击是一种新型的DDoS攻击方式。LDDoS具有流量小和隐蔽性强的特点
现有的DDoS攻击检测方法不能正确发现LDDoS攻击流量。根据LDDoS攻击流量呈现周期性的特点
采用缓存队列占有率统计的方法
重点研究了受害目标路由器的缓存队列
分别统计分析了正常和攻击流量的占有率
并在NS-2环境中进行了仿真实验
成功提取了LDDoS攻击流量上的2个特征
提高了LDDoS攻击的检测率。
Abstract
LDDoS （low-rate distributed denial-of-service） was a new type of DDoS attack. It had small traffic and cov- ered by normal network traffic. LDDoS attack was so stealthy that the detection and defense approaches of traditional DDoS could not be effective. Experiments show that LDDoS attack traffic exhibit strong periodicity. Based on the periodical feature of LDDoS attack
the signatures of LDDoS attack are extracted through analyzing the cache queue of target router for the purpose of detection and defense of LDDoS attack. Statistics on the percentage of normal and attack flow in total traffic show that LDDoS attack has two signatures. Experiments on the two signatures in NS-2 platform have been conducted to detect LDDoS attack
tests result show that the extracted two signatures can reduce false positives of LDDoS attack detection schemes.
京公网安备11010802024621