基于数据预处理的DDoS攻击检测方法研究

摘要

利用小波分解网络流量的方法,提出了一种基于数据预处理的分布式拒绝服务DDoS攻击检测算法.通过对小尺度流量数据进行预处理,使得短相关的网络流量体现出长相关性并保持小尺度模型的时间敏感度,满足了Hurst指数刻画多分形模型的条件,解决了现有小尺度网络异常实时检测方法的缺陷,如Holder指数检测算法误报率高、VTP检测法检测率不足等问题.%In this paper, a new algorithm detecting distributed denial of service (DDoS) attack is put forward based on wavelet decomposition of network traffic. Having preprocessed the small-scale traffic data, short related network traffic reflects long correlation and keeps time sensitivity of small scale model.The new method provides the conditions for the Hurst index to depict the multi-fractal models, but also solve the existing small scale network defections of real-time detection, such as the high distorting rate of Holder index detection algorithm and the inadequate detection rates of VTP method.