d-SVDD：新型异常检测算法在App-DDoS攻击防御中的应用

4星 · 超过85%的资源需积分: 50 147 浏览量更新于2024-09-13 5 收藏 626KB PDF 举报

"d-SVDD算法在DDoS攻击检测中的应用" 新型SVDD（Support Vector Data Description）算法，即d-SVDD，是一种基于支持向量机（SVM）的异常检测方法，它旨在最大化分类间隔，从而有效地识别异常样本。在传统的SVDD算法中，目标是构建一个最小的球形边界来包围正常数据点，任何远离这个边界的点都被认为可能是异常。d-SVDD则对这一思想进行了扩展，尤其适用于网络流量分析和安全领域的应用，例如检测App-DDoS（Application Layer Distributed Denial of Service）攻击。 App-DDoS攻击是一种针对应用层的分布式拒绝服务攻击，它不同于传统的网络层DDoS攻击，主要通过大量合法请求淹没服务器，使其无法正常处理合法用户的请求。针对App-DDoS的检测手段通常需要高效、可扩展并且能够适应不断变化的攻击策略。文章"Detecting App-DDoS Attacks Based on Marking Access and d-SVDD"由LI Jin-ling和WANG Bin-qiang提出，他们创新性地提出了一种基于标记访问的特征提取方法和名为d-SVDD的新检测算法。该方法首先通过标记访问策略将各种App-DDoS攻击表示为特征向量，然后利用d-SVDD算法对决策边界附近的预设区域进行二次分类和检测。通过标记访问，可以更准确地捕捉到异常流量模式，因为这种策略可以记录和分析网络行为的关键特征。d-SVDD在这一过程中起到了关键作用，它能识别出与正常访问模式显著不同的行为，即潜在的攻击行为。实验结果显示，该提出的特征提取和d-SVDD检测方法对于多种App-DDoS攻击具有有效的检测能力，同时在时间效率、空间效率和可扩展性方面表现良好。关键词：App-DDoS攻击；标记访问；d-SVDD；异常检测总结来说，d-SVDD算法在DDoS攻击检测中的应用展示了其在网络安全领域的强大潜力。通过结合特征提取和异常检测技术，d-SVDD能够及时发现并应对复杂多变的App-DDoS攻击，这对于维护网络安全和保障服务的正常运行至关重要。此外，该方法的高效性和可扩展性也使得它在应对未来可能出现的新型攻击时具有很高的实用性。

Detecting App-DDoS Attacks Based on Marking Access and d-SVDD

LI Jin-ling, WANG Bin-qiang

National Digital Switching System Engineering & Technological R&D Center

Zhengzhou , China

zifenglingsworld@163.com

Abstract---In order to enhance the extensibility of current

attack feature extracted and detection means for

App-DDoS(Application Layer Distributed Denial of Service,

App-DDoS)attacks, a novel feature extracted method based

on marking access and a new detection algorithm named

d-SVDD are proposed. After expressing kinds of App-DDoS

attacks as characteristic vectors by access marked strategy

and feature extracted strategy, d-SVDD algorithm is used

for secondary classification and detection of pre-set area

around decision boundary based on SVDD. It is proved by

experiments that the proposed feature extracted and

detection means can realize effective detection for kinds of

App-DDoS attacks, both have satisfying time, space and

extensibility performance.

Keywords-App-DDoS attack; Marking access; d-SVDD;

Anomaly detection

I. INTRODUCTION

Being different only in purpose from normal behavior,

App-DDoS attacks can easily cross the low-level defense

systems for traditional DDoS attacks, along with the fact

that dealing with a high-level application request is much

more complex, finding out effective detection and defense

means for App-DDoS attacks becomes more and more

important

[1]

Currently, most detection methods for App-DDoS

attacks are mainly based on behavior analysis

[2]

and log

analysis

[3]

. One typical detection method based on users’

browsing information detects HTTP flooding attacks

according to users’ browsing order and the relationship

between view time and page information

[4]

. Another

detection method proposed by Xie Yi and Yu Shunzheng

introduces HsMM model to detection algorithm

[5][6]

. In

literature [7], App-DDoS attacks are divided into three

categories by session parameter: request flooding attacks,

asymmetric workload attacks and repeated one-shot

attacks. According to this classification, a session

suspicious degree model is proposed for anomaly

detection and filtering.

After analyzing the detection methods above, we can

conclude: 1) App-DDoS attacks have lots of different

types because of the differences among application layer

services and protocols, while means based on behavior

analysis and log analysis only consider Web server mostly,

the extracted characters have poor extensibility; 2)

Anomaly detection methods deeply depend on extracted

characters, so the poor extensibility of characters directly

affects the extensibility of detection methods.

In order to enhance the extensibility of extracted

characters and corresponding detection algorithms,

achieve effective detection for various attacks, a novel

feature extracted method based on marking access and a

new detection algorithm named d-SVDD are proposed in

this paper. The flow chart of such detection algorithm is

shown in Figure 1.

dR<

Figure 1. The flow chart of detection algorithm

The detection algorithm is divided into training and

detection phases in detail. In training phase, mark normal

users’ access behavior with no marking strategy firstly,

and then set marking period

t and average interval

between consecutive access stamps

according to the

initial marked results. After that process the initial access

stamps with marking strategy. When all of these are

completed, feature extracted method is applied to obtain

effective detection characters, and SVDD algorithm is

used to get normal users’ SVDD hypersphere. All of the

results will be saved in training database and get fully

prepared for the next detection phase.

II. FEATURE EXTRACTED METHOD BASED ON

MARKING ACCESS

In detection phase, every user accessing to the server

will be marked with marking strategy, including marking

access time and access page. According to different

servers, different requests will be selected to mark. For

example, HTTP GET requests will be marked in attacks

against Web server, while DNS requests will be marked

during attacks against DNS server.

Take attacks against Web server for example, access

time marked method adopts strategy as follow: if the

current stamp interval

t is less than

, 1 will be assigned

to current stamp, otherwise 0 will be assigned. Access

page is marked using the following strategy: if the page

requested by current user doesn’t exist in protected Web

Proceedings of the 2nd International Symposium on Computer, Communication, Control and Automation (ISCCCA-13)

Published by Atlantis Press, Paris, France.

0728

下载后可阅读完整内容，剩余4页未读，立即下载

zjshen2007

粉丝: 2
资源: 4

d-SVDD：新型异常检测算法在App-DDoS攻击防御中的应用

蚁群优化SVDD与DBI-K均值聚类的旋转机械故障诊断

MATLAB实现SVDD算法：无需额外工具包

SVDD算法数据分类Matlab仿真教程与操作演示

基于信息理论学习的SVDD选择性集成

PCA-SVDD在化工故障检测与自学习辨识中的应用

递归SVM与SVDD在人体部位外观模型中的应用

PS-PCA方法处理工业过程的非高斯特征：检测率分析

加权SVDD算法在人体姿态估计中的改进与应用

PaddleTS 是一个易用的深度时序建模的Python库，它基于飞桨深度学习框架PaddlePaddle，专注业界领先的深度模型，旨在为领域专家和行业用户提供可扩展的时序建模能力和便捷易用的用户体验

白色大气风格的乐器爱好者网站模板下载.zip

最新资源