DoS/DDoS attack detecting and filtering method based on light-weight intrusion detection

Abstract

The invention discloses a DoS / DDoS attack detecting and filtering method based on light-weight intrusion detection. The problem that intrusion detection accuracy still needs to be improved in the prior art is solved through the method. The method includes the steps of 1, flow early warning based on a time window; 2, abnormal flow characteristic processing; 3, rapid attack detection based on rule matching; 4, excavation and detection of attacks of unknown types; 5, attack filtering based on an IP list. Compared with the prior art, through the combination of the light-weight intrusion detection technology with characteristic selection, the problem that an original DoS / DDoS attack detection method based on classification detection is poor in instantaneity is basically solved; through the combination of online incremental learning and characteristic selection, the problems existing in detection of attacks of unknown types are solved, wherein pre-built attack modes of the attacks are not matched.

Description

Technical field [0001] The invention relates to a data detection method in the field of computer network security, in particular to a DoS / DDoS attack detection and filtering method based on lightweight intrusion detection. Background technique [0002] Denial of Service (DoS) attack is a network attack that prevents legitimate users from accessing the target service normally. It has two forms of attack. One is to use the software vulnerability of the target system to cause the system to send malformed messages to the target host. Crash, etc.; the other is to continuously send a large number of useless messages to the target to occupy the target's bandwidth resources and host resources. At present, the so-called DoS attack refers to the second type, also known as flooding attack. [0003] In recent years, with the development of computer hardware technology, in order to increase the intensity of attacks, attackers control multiple hosts in different locations in the network to simu...

AI Technical Summary

Problems solved by technology

[0007] It can be seen that there are still some deficiencies in the existing schemes. The method based on classification detection is limited by redundant information, which leads to excessive consumption of detection resources and restricts the real-time performance of detection; while the lightweight intrusion detection combined with feature selection Although the technology has improved the detection processing speed, the problem of unknown attack detection has not been solved accordingly

Images