Method for detecting DOS/DDOS (denial of service/distributed denial of service) attack

Abstract

The invention discloses a DOS / DDOS attack detection method. The method of the present invention firstly extracts the required traffic characteristic parameters from the network flow data, determines the abnormal time point and constructs the historical time window by analyzing the traffic characteristic parameters, and then finds out the top N destination IPs with the largest traffic at the abnormal time point, and analyzes the history The sub-flow containing each selected destination IP in the time window determines the abnormal destination IP, and finally confirms the attack and identifies the abnormal flow. The method of the present invention is different from the traditional packet-by-packet analysis method, adapts to the characteristics of huge backbone network traffic, can meet the real-time requirements of backbone network anomaly detection, and can more accurately detect DoS / DDoS attacks in the backbone network, It can identify the attack flow in the backbone network, so that the network administrator can set up the router in time to filter out the flow sent by the attacker and prevent it from causing harm to the destination host.

Description

technical field [0001] The invention belongs to the field of network technology, and in particular relates to a DOS / DDOS attack detection method. Background technique [0002] A denial of service (DoS) attack is a form of attack that makes a computer or network unable to provide normal services by sending a large number of data packets. It may exhaust all available network resources or the system resources of the attacked object in a short period of time, making legitimate user requests unable to pass or be processed, thus hindering normal communication in the network and bringing huge losses to the attacked person and even the network. harm. [0003] A Distributed Denial of Service (DDoS) attack is a covert denial of service attack in which data packets come from different attack sources. Compared with DoS attacks, DDoS attacks have smaller traffic on a single link and are difficult to be detected by network devices, so they are easier to form. On the other hand, the abn...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the invention is to propose a DOS / DDOS attack detection method in order to solve the problems existing in the existing DoS / DDOS attack detection method

Images