采用符号动力学方法检测低速率拒绝服务攻击

doi:10.3969/j.issn.1001-2400.2018.01.025

摘要/Abstract

摘要：

针对低速率拒绝服务攻击引起的网络安全问题，提出采用符号动力学方法对其进行检测通过将采样得到的数据包数量信号转化为对应的符号序列，并计算符号序列的熵值，发现低速率拒绝服务攻击具有令数据包数量信号信息复杂度激增的特点，从而能够结合预先设定的熵阈值进行比较识别．分别在仿真环境和实际测试服务器上进行了算法验证，实验结果表明，文中所提算法对低速率拒绝服务攻击辨识平均准确度超过92％．

关键词: 低速拒绝服务攻击, 符号动力学, 熵, 信息复杂度, 阈值, 网络安全

Abstract:

In terms of the network security problem caused by Low-rate-Denial-of-Service attack, this paper proposes a symbolic dynamics method to detect such attacks. The number of packets sampled signals is transferred into the symbol sequence and the calculate the entropy corresponding to the symbol sequence. There is a significant increase in packets number signal information complexity caused by Low-rate-Denial-of-Service attack arrival, which can be compared with a default entropy threshold for recognition. We verify the algorithm in the simulation environment and the actual test servers respectively and the experimental results show that the proposed algorithm has an average accuracy of 92％ to achieve the Low-rate-Denial-of-Service attack recognition.

Key words: low-rate-denial-of-service attack, symbolic dynamics, entropy, information complexity, threshold, network security

杨宝旺. 采用符号动力学方法检测低速率拒绝服务攻击[J]. 西安电子科技大学学报, 2018, 45(1): 140-144.

YANG Baowang. Low-rate-denial-of-service attack detection by symbolic dynamics method[J]. Journal of Xidian University, 2018, 45(1): 140-144.

参考文献

［1］ WOOD A D, STANKOVIC J A. Denial of Service in Sensor Networks［J］. Computer, 2002, 35(10): 54-62.
［2］ ZHANG H, CHENG P, SHI L, et al. Optimal Denial-of-service Attack Scheduling with Energy Constraint［J］. IEEE Transactions on Automatic Control, 2015, 60(11): 3023-3028.
［3］ MAHIMKAR A, DANGE J, SHMATIKOV V, et al. Dfence: Transparent Network-based Denial of Service Mitigation［C］//Proceedings of the 4th USENIX Conference on Networked Systems Design ＆ Implementation. Berkeley: USENIX Association, 2007: 24.
［4］梁洪泉, 吴巍. 利用节点可信度的安全链路状态路由协议［J］. 西安电子科技大学学报, 2016, 43(5): 121-127.
LIANG Hongquanl, WU Wei. Secure Link Status Routing Protocol Based on Node Trustworthiness［J］. Journal of Xidian University, 2016, 43(5): 121-127.
［5］ YAN Q, YU F R, GONG Q, et al. Software-defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: a Survey, Some Research Issues, and Challenges［J］. IEEE Communications Surveys and Tutorials, 2016, 18(1): 602-622.
［6］ ZHANG C W, YIN J P, CAI Z P, et al. RRED: Robust RED Algorithm to Counter Low-rate Denial-of-service Attacks［J］. IEEE Communications Letters, 2010, 14(5): 489-491.
［7］ BAI Y, XIE C Y, QIN J C. Research of Three-level Detection Algorithm Against Low-rate Denial of Service Attacks［J］. Advanced Materials Research, 2012, 403/404/405/406/407/408: 2325-2328.
［8］ ARAVIND B, NARAYANA M L. Detecting Constant Low-frequency Appilication Layer DDOS Attacks Using, Collaborative Algorithms［J］. International Journal of Computer Trends ＆ Technology, 2013, 4(10): 1132-1139.
［9］ YU C, KAI H, YU-KWONG K. Collaborative Defense Against Periodic Shrew DDoS Attacks in Frequency Domain［J］. ACM Transactions on Information and System Security, 2005(3): 59-67.
［10］吴志军, 岳猛. 基于卡尔曼滤波的LDDoS攻击检测方法［J］. 电子学报, 2008, 36(8): 1590-1594.
WU Zhijun, YUE Meng. Detection of LDDoS Attack Based on Kalman Filtering［J］. Acta Electronica Sinica, 2008, 36(8): 1590-1594.
［11］ ZHANG X Y, WU Z J, CHEN J S, et al. An Adaptive KPCA Approach for Detecting LDoS Attack［J］. International Journal of Communication Systems, 2017, 30(4): e2993.
［12］ WU Z J, JIANG J, YUE M. A Particle Filter-based Approach for Effectively Detecting Low-rate Denial of Service Attacks［C］//Proceedings of the 2016 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery. Piscataway: IEEE, 2017: 86-90.
［13］ KANG J, YANG M, ZHANG J Y. Accurately Identifying New QoS Violation Driven by High-distributed Low-rate Denial of Service Attacks Based on Multiple Observed Features［J］. Journal of Sensors, 2015, 2015(2015): 465402.
［14］ WU Z J, ZHANG L Y, YUE M. Low-rate DoS Attacks Detection Based on Network Multifractal［J］. IEEE Transactions on Dependable and Secure Computing, 2016, 13(5): 559-567.
［15］ AIN A, BHUYAN M H, BHATTACHARYYA D K, et al. Rank Correlation for Low-rate DDoS Attack Detection: an Empirical Evaluation［J］. International Journal of Network Security, 2016, 18(3): 474-480.
［16］ SIMSEK M. A New Metric for Flow-level Filtering of Low-rate DDoS Attacks［J］. Security and Communication Networks, 2015, 8(18): 3815-3825.
［17］ CORDOVA J, NAVARRO G. Practical Dynamic Entropy-compressed Bitvectors with Applications［C］//Lecture Notes in Computer Science: 9685. Heidelberg: Springer Verlag, 2016: 105-117.
［18］李青茹. 网络蠕虫的传播模型及其检测技术研究［D］. 西安: 西安电子科技大学, 2016.

[1]	谢丽霞,白宇. 一种信息系统业务波及影响评估方法[J]. 西安电子科技大学学报, 2021, 48(4): 184-191.
[2]	韩卓茜,王锋,陈沛,李卓伦. 一种历史特征辅助的模糊数据关联算法[J]. 西安电子科技大学学报, 2021, 48(2): 92-98.
[3]	刘华渊,苏云飞,李瑞林,唐朝京. 结构状态覆盖导向的灰盒模糊测试技术[J]. 西安电子科技大学学报, 2021, 48(1): 117-123.
[4]	李腾,曹世杰,尹思薇,魏大卫,马鑫迪,马建峰. 应用Q学习决策的最优攻击路径生成方法[J]. 西安电子科技大学学报, 2021, 48(1): 160-167.
[5]	杨宏宇,曾仁韵. 一种深度学习的网络安全态势评估方法[J]. 西安电子科技大学学报, 2021, 48(1): 183-190.
[6]	郑献春,李晖,王瑞,闫皓楠,戴睿,萧明炽. 匿名网络应用及仿真平台研究综述[J]. 西安电子科技大学学报, 2021, 48(1): 22-38.
[7]	杨宏宇,张旭高. 一种网络安全态势自适应预测模型[J]. 西安电子科技大学学报, 2020, 47(3): 14-22.
[8]	贾海蓉,王卫梅,吉慧芳. 信噪比信息与时频特征修正相位的语音增强[J]. 西安电子科技大学学报, 2019, 46(5): 162-170.
[9]	齐小刚,胡秋秋,姚旭清,刘立芳. 一种有效的通信网络告警分析方法[J]. 西安电子科技大学学报, 2019, 46(4): 1-8.
[10]	刘道华, 胡秀云, 赵岩松, 崔玉爽. 一种动态分群带熵权的粒子群优化方法[J]. 西安电子科技大学学报, 2018, 45(6): 69-74.
[11]	赵季红;谢志勇;曲桦;王明欣;刘熙. 一种简化鲁棒的传感网络节点三维估计算法[J]. 西安电子科技大学学报, 2018, 45(5): 108-114.
[12]	续拓;李洁;王颖. 叠加信息熵游走数据聚类算法[J]. 西安电子科技大学学报, 2018, 45(4): 75-79+154.
[13]	汪星;黄小瑜;刘瑄璞;孔宪光;牛萌. 面向工业大数据的多层增量特征提取方法[J]. 西安电子科技大学学报, 2018, 45(4): 106-111.
[14]	唐兴;权义宁;董泽;苗启广. 一种融合信息熵的个人网络主题圈子发现算法[J]. 西安电子科技大学学报, 2017, 44(3): 43-48.
[15]	黄伟华;马中;戴新发;徐明迪;高毅;刘利民. 一种特征加权模糊聚类的负载均衡算法[J]. 西安电子科技大学学报, 2017, 44(2): 127-132.