The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and...The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(展开更多
为了对泛洪DoS/DDoS(Denial of Service/Distributed Denial of Service)攻击做出准确判断,在对泛洪DoS/DDoS攻击发生时网络流量变化特性进行分析的基础上,给出一种基于网络异常流量判断泛洪DoS/DDoS攻击的检测算法。该算法通过对流量...为了对泛洪DoS/DDoS(Denial of Service/Distributed Denial of Service)攻击做出准确判断,在对泛洪DoS/DDoS攻击发生时网络流量变化特性进行分析的基础上,给出一种基于网络异常流量判断泛洪DoS/DDoS攻击的检测算法。该算法通过对流量大小和波动趋势的判断,对泛洪DoS/DDoS攻击的发生进行检测。实验结果表明,在不失一般性的基础上,判断泛洪DoS/DDoS攻击的成功率为100%。展开更多
随着车联网(IoV)的日益普及和发展,其可靠性和安全性保障变得尤为重要。然而,在开放访问的环境中进行通信让智能交通系统的道路安全、通信安全和隐私问题面临巨大挑战。此外,对安全问题的快速响应要求使得实时检测成为越来越重要的研究...随着车联网(IoV)的日益普及和发展,其可靠性和安全性保障变得尤为重要。然而,在开放访问的环境中进行通信让智能交通系统的道路安全、通信安全和隐私问题面临巨大挑战。此外,对安全问题的快速响应要求使得实时检测成为越来越重要的研究课题。分布式拒绝服务(DDoS)攻击可能导致车辆失速或故障、干扰自动驾驶、造成交通拥堵和事故,是所有车联网安全挑战中对自动驾驶安全最为严重的威胁之一。针对车联网环境下的这种安全需求,设计并验证一个分布式拒绝服务攻击实时检测系统,使用信息熵理论来量化车辆流量信息分布,在逐元素滑动时间窗和偏差计算的基础上,提出一种时间复杂度为O(n)的采用“累计时间窗”的算法,结合高斯分布的概率分布模型来实时检测并告警DDoS攻击行为,并通过增加二次确认环节实现算法的改进。使用开源框架Framework For Misbehavior Detection进行的模拟实验结果表明,在VeReMi数据集中,该实时检测系统能够检测包括传统分布式拒绝服务攻击、破坏性女巫攻击和持续速率拒绝服务攻击等多种类型的DDoS攻击,检测准确率达100%,DDoS攻击检测时延达到8 s以内。研究结果能够为未来智能交通系统中分布式拒绝服务攻击的检测提供理论和实践参考。展开更多
分布式拒绝服务(distributed denial of service,DDoS)攻击自出现以来一直是全球互联网网络安全的重要威胁之一。目前很多DDoS攻击检测方法虽然对已知类型攻击具有较高的检测率,但是不能有效识别新的攻击类型,无法应对DDoS攻击形式变化...分布式拒绝服务(distributed denial of service,DDoS)攻击自出现以来一直是全球互联网网络安全的重要威胁之一。目前很多DDoS攻击检测方法虽然对已知类型攻击具有较高的检测率,但是不能有效识别新的攻击类型,无法应对DDoS攻击形式变化多和快的特点。为了准确检测出DDoS攻击,同时使检测模型具有良好的自适应性、扩展性和较低的更新代价,以应对层出不穷的DDoS攻击,提出了一种综合考虑网络流量双向特征、固定特征和统计特征,采用增量式GHSOM(Growing Hierarchical Self-Organizing Maps)神经网络算法的DDoS攻击检测方法。首先,根据DDoS攻击流量的特点提取流量特征,组成流量八元组联合特征,然后利用增量式GHSOM神经网络算法进行异常流量分析,最后,通过实验验证检测方法的有效性。实验结果表明,提出的DDoS攻击检测方法不仅能够有效检测出已知类型的DDoS攻击,而且能够实现对检测模型的在线动态更新,对于新出现的DDoS攻击类型,具有相同的检测率。展开更多
Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,t...Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.展开更多
分布式拒绝服务(Distributed Denial of Service,DDoS)攻击在网络中较为常见,但普通的DDos攻击检测方法难以对其追踪和防范,无法充分地考虑算法误差调整参数,导致检测精度较低。为此,提出基于反向传播(Back Propagation,BP)神经网络的D...分布式拒绝服务(Distributed Denial of Service,DDoS)攻击在网络中较为常见,但普通的DDos攻击检测方法难以对其追踪和防范,无法充分地考虑算法误差调整参数,导致检测精度较低。为此,提出基于反向传播(Back Propagation,BP)神经网络的DDos攻击自主检测方法,分析DDos攻击特点,采用信源地址、目标地址、包协议等数据包信息,提取DDoS攻击网络特征。采用误差BP算法进行参数训练,采用梯度下降法对各参数进行更新,利用BP神经网络进行DDos攻击自主检测。实验结果表明,通过对DDoS攻击的检测,该方法的检测准确率达到93.87%,并且具有良好的泛化性能。展开更多
文摘The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(
文摘为了对泛洪DoS/DDoS(Denial of Service/Distributed Denial of Service)攻击做出准确判断,在对泛洪DoS/DDoS攻击发生时网络流量变化特性进行分析的基础上,给出一种基于网络异常流量判断泛洪DoS/DDoS攻击的检测算法。该算法通过对流量大小和波动趋势的判断,对泛洪DoS/DDoS攻击的发生进行检测。实验结果表明,在不失一般性的基础上,判断泛洪DoS/DDoS攻击的成功率为100%。
文摘随着车联网(IoV)的日益普及和发展,其可靠性和安全性保障变得尤为重要。然而,在开放访问的环境中进行通信让智能交通系统的道路安全、通信安全和隐私问题面临巨大挑战。此外,对安全问题的快速响应要求使得实时检测成为越来越重要的研究课题。分布式拒绝服务(DDoS)攻击可能导致车辆失速或故障、干扰自动驾驶、造成交通拥堵和事故,是所有车联网安全挑战中对自动驾驶安全最为严重的威胁之一。针对车联网环境下的这种安全需求,设计并验证一个分布式拒绝服务攻击实时检测系统,使用信息熵理论来量化车辆流量信息分布,在逐元素滑动时间窗和偏差计算的基础上,提出一种时间复杂度为O(n)的采用“累计时间窗”的算法,结合高斯分布的概率分布模型来实时检测并告警DDoS攻击行为,并通过增加二次确认环节实现算法的改进。使用开源框架Framework For Misbehavior Detection进行的模拟实验结果表明,在VeReMi数据集中,该实时检测系统能够检测包括传统分布式拒绝服务攻击、破坏性女巫攻击和持续速率拒绝服务攻击等多种类型的DDoS攻击,检测准确率达100%,DDoS攻击检测时延达到8 s以内。研究结果能够为未来智能交通系统中分布式拒绝服务攻击的检测提供理论和实践参考。
基金supported in part by the National Key R&D Program of China under Grant 2018YFA0701601in part by the National Natural Science Foundation of China(Grant No.62201605,62341110,U22A2002)in part by Tsinghua University-China Mobile Communications Group Co.,Ltd.Joint Institute。
文摘Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.
文摘分布式拒绝服务(Distributed Denial of Service,DDoS)攻击在网络中较为常见,但普通的DDos攻击检测方法难以对其追踪和防范,无法充分地考虑算法误差调整参数,导致检测精度较低。为此,提出基于反向传播(Back Propagation,BP)神经网络的DDos攻击自主检测方法,分析DDos攻击特点,采用信源地址、目标地址、包协议等数据包信息,提取DDoS攻击网络特征。采用误差BP算法进行参数训练,采用梯度下降法对各参数进行更新,利用BP神经网络进行DDos攻击自主检测。实验结果表明,通过对DDoS攻击的检测,该方法的检测准确率达到93.87%,并且具有良好的泛化性能。
