The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and...The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(展开更多
SDN (Software Defined Network) has many security problems, and DDoS attack is undoubtedly the most serious harm to SDN architecture network. How to accurately and effectively detect DDoS attacks has always been a diff...SDN (Software Defined Network) has many security problems, and DDoS attack is undoubtedly the most serious harm to SDN architecture network. How to accurately and effectively detect DDoS attacks has always been a difficult point and focus of SDN security research. Based on the characteristics of SDN, a DDoS attack detection method combining generalized entropy and PSOBP neural network is proposed. The traffic is pre-detected by the generalized entropy method deployed on the switch, and the detection result is divided into normal and abnormal. Locate the switch that issued the abnormal alarm. The controller uses the PSO-BP neural network to detect whether a DDoS attack occurs by further extracting the flow features of the abnormal switch. Experiments show that compared with other methods, the detection accurate rate is guaranteed while the CPU load of the controller is reduced, and the detection capability is better.展开更多
软件定义网络(SDN,software defined network)作为一种新兴的网络架构,其安全问题一直是SDN领域研究的热点,如SDN控制通道安全性、伪造服务部署及外部分布式拒绝服务(DDoS,distributed denial of service)攻击等。针对SDN安全中的外部D...软件定义网络(SDN,software defined network)作为一种新兴的网络架构,其安全问题一直是SDN领域研究的热点,如SDN控制通道安全性、伪造服务部署及外部分布式拒绝服务(DDoS,distributed denial of service)攻击等。针对SDN安全中的外部DDoS攻击问题进行研究,提出了一种基于深度学习混合模型的DDoS攻击检测方法——DCNN-DSAE。该方法在构建深度学习模型时,输入特征除了从数据平面提取的21个不同类型的字段外,同时设计了能够区分流类型的5个额外流表特征。实验结果表明,该方法具有较高的精确度,优于传统的支持向量机和深度神经网络等机器学习方法,同时,该方法还可以缩短分类检测的处理时间。将该检测模型部署于控制器中,利用检测结果产生新的安全策略,下发到Open Flow交换机中,以实现对特定DDoS攻击的防御。展开更多
低速率拒绝服务(LDoS,low-rate denial of service)攻击是一种降质服务(RoQ,reduction of quality)攻击,具有平均速率低和隐蔽性强的特点,它是云计算平台和大数据中心面临的最大安全威胁之一。提取了LDoS攻击流量的3个内在特征,建立基...低速率拒绝服务(LDoS,low-rate denial of service)攻击是一种降质服务(RoQ,reduction of quality)攻击,具有平均速率低和隐蔽性强的特点,它是云计算平台和大数据中心面临的最大安全威胁之一。提取了LDoS攻击流量的3个内在特征,建立基于BP神经网络的LDoS攻击分类器,提出了基于联合特征的LDoS攻击检测方法。该方法将LDoS攻击的3个内在特征组成联合特征作为BP神经网络的输入,通过预先设定的决策指标,达到检测LDoS攻击的目的。采用LDoS攻击流量专用产生工具,在NS2仿真平台和test-bed网络环境中对检测算法进行了测试与验证,实验结果表明通过假设检验得出检测率为96.68%。与现有研究成果比较说明基于联合特征的LDoS攻击检测性优于单个特征,并具有较高的计算效率。展开更多
为了对泛洪DoS/DDoS(Denial of Service/Distributed Denial of Service)攻击做出准确判断,在对泛洪DoS/DDoS攻击发生时网络流量变化特性进行分析的基础上,给出一种基于网络异常流量判断泛洪DoS/DDoS攻击的检测算法。该算法通过对流量...为了对泛洪DoS/DDoS(Denial of Service/Distributed Denial of Service)攻击做出准确判断,在对泛洪DoS/DDoS攻击发生时网络流量变化特性进行分析的基础上,给出一种基于网络异常流量判断泛洪DoS/DDoS攻击的检测算法。该算法通过对流量大小和波动趋势的判断,对泛洪DoS/DDoS攻击的发生进行检测。实验结果表明,在不失一般性的基础上,判断泛洪DoS/DDoS攻击的成功率为100%。展开更多
拒绝服务(Denial of Service,DoS)攻击是阻止或者拒绝合法用户使用网络服务的一种攻击方式。首先介绍DoS攻击的基本原理,然后讨论现有DoS攻击防御方法,最后研究蜜罐技术在防御分布式拒绝服务(Distributed Dos,DDoS)攻击中的应用,并对其...拒绝服务(Denial of Service,DoS)攻击是阻止或者拒绝合法用户使用网络服务的一种攻击方式。首先介绍DoS攻击的基本原理,然后讨论现有DoS攻击防御方法,最后研究蜜罐技术在防御分布式拒绝服务(Distributed Dos,DDoS)攻击中的应用,并对其性能进行了仿真分析,结果表明:提出的蜜罐方案,能明显降低攻击者通过入侵足够数量的主机发起高强度DDoS攻击的概率,并能够有效地降低服务器主机所受到的攻击强度。展开更多
文摘The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(
基金supported by the Hebei Province Innovation Capacity Improvement Program of China under Grant No.179676278Dthe Ministry of Education Fund Project of China under Grant No.2017A20004
文摘SDN (Software Defined Network) has many security problems, and DDoS attack is undoubtedly the most serious harm to SDN architecture network. How to accurately and effectively detect DDoS attacks has always been a difficult point and focus of SDN security research. Based on the characteristics of SDN, a DDoS attack detection method combining generalized entropy and PSOBP neural network is proposed. The traffic is pre-detected by the generalized entropy method deployed on the switch, and the detection result is divided into normal and abnormal. Locate the switch that issued the abnormal alarm. The controller uses the PSO-BP neural network to detect whether a DDoS attack occurs by further extracting the flow features of the abnormal switch. Experiments show that compared with other methods, the detection accurate rate is guaranteed while the CPU load of the controller is reduced, and the detection capability is better.
文摘软件定义网络(SDN,software defined network)作为一种新兴的网络架构,其安全问题一直是SDN领域研究的热点,如SDN控制通道安全性、伪造服务部署及外部分布式拒绝服务(DDoS,distributed denial of service)攻击等。针对SDN安全中的外部DDoS攻击问题进行研究,提出了一种基于深度学习混合模型的DDoS攻击检测方法——DCNN-DSAE。该方法在构建深度学习模型时,输入特征除了从数据平面提取的21个不同类型的字段外,同时设计了能够区分流类型的5个额外流表特征。实验结果表明,该方法具有较高的精确度,优于传统的支持向量机和深度神经网络等机器学习方法,同时,该方法还可以缩短分类检测的处理时间。将该检测模型部署于控制器中,利用检测结果产生新的安全策略,下发到Open Flow交换机中,以实现对特定DDoS攻击的防御。
文摘低速率拒绝服务(LDoS,low-rate denial of service)攻击是一种降质服务(RoQ,reduction of quality)攻击,具有平均速率低和隐蔽性强的特点,它是云计算平台和大数据中心面临的最大安全威胁之一。提取了LDoS攻击流量的3个内在特征,建立基于BP神经网络的LDoS攻击分类器,提出了基于联合特征的LDoS攻击检测方法。该方法将LDoS攻击的3个内在特征组成联合特征作为BP神经网络的输入,通过预先设定的决策指标,达到检测LDoS攻击的目的。采用LDoS攻击流量专用产生工具,在NS2仿真平台和test-bed网络环境中对检测算法进行了测试与验证,实验结果表明通过假设检验得出检测率为96.68%。与现有研究成果比较说明基于联合特征的LDoS攻击检测性优于单个特征,并具有较高的计算效率。
文摘为了对泛洪DoS/DDoS(Denial of Service/Distributed Denial of Service)攻击做出准确判断,在对泛洪DoS/DDoS攻击发生时网络流量变化特性进行分析的基础上,给出一种基于网络异常流量判断泛洪DoS/DDoS攻击的检测算法。该算法通过对流量大小和波动趋势的判断,对泛洪DoS/DDoS攻击的发生进行检测。实验结果表明,在不失一般性的基础上,判断泛洪DoS/DDoS攻击的成功率为100%。
文摘拒绝服务(Denial of Service,DoS)攻击是阻止或者拒绝合法用户使用网络服务的一种攻击方式。首先介绍DoS攻击的基本原理,然后讨论现有DoS攻击防御方法,最后研究蜜罐技术在防御分布式拒绝服务(Distributed Dos,DDoS)攻击中的应用,并对其性能进行了仿真分析,结果表明:提出的蜜罐方案,能明显降低攻击者通过入侵足够数量的主机发起高强度DDoS攻击的概率,并能够有效地降低服务器主机所受到的攻击强度。
