LDoS attack detection method based on MF-Ada algorithm

Abstract

The invention discloses a low-speed denial of service (LDoS) attack detection method based on multi-flow characteristics and an Adaboost (MF-Ada) algorithm, and belongs to the field of network security. The method comprises the following steps: in unit time, capturing all related data messages in a network key routing node to form a training sample and a test sample; performing feature extractionand feature selection on the training sample and the test sample to obtain optimal feature data of the training sample and optimal feature data of the test sample; training an Adaboost classificationmodel by using the optimal feature data of the training sample, so that the Adaboost classification model learns and memorizes the features of the LDoS attack to obtain a model capable of being used for LDoS attack detection; and detecting the optimal feature data of the test sample by using the trained Adaboost classification model; and judging whether the LDoS attack occurs in the unit time corresponding to the optimal feature data or not according to a judgment criterion. The detection method based on the MF-Ada algorithm provided by the invention has the advantages of relatively low falsealarm rate and missing report rate and self-adaptive parameter adjustment, and is an LDoS attack detection method with relatively good detection performance.

Description

technical field [0001] The invention belongs to the field of computer network security, and in particular relates to a slow denial of service (LDoS) attack detection method based on multi-flow characteristics and an Adaboost (MF-Ada) algorithm. Background technique [0002] Denial of service (DoS) attacks continuously send high-intensity attack traffic to the attack target, exhausting the resources of the attack target, so that normal users cannot receive effective services for a long time. Slow Denial of Service (LDoS) attack is a variant of DoS attack. Different from DoS attacks, LDoS attacks send high-intensity pulses to the attack target in a periodic manner, so that the network is continuously congested, so as to achieve the same attack effect as DoS attacks. Therefore, compared with traditional DoS attacks, LDoS attacks can achieve the same or even greater damage to the attack target at a lower attack cost. [0003] So far, although many people have proposed many met...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the deficiencies of traditional LDoS attack detection methods, such as high false alarm rate, high false negative rate and poor self-adaptive ability, a method for LDoS attack detection is proposed.

Images