基于用户浏览行为相似度的HTTP-Get Flood检测

摘要

For the growing proliferation of HTTP-Get Flood Attack, the user browsing behavior similarity is used to define HTTP-Get Flood attacks. The similar formulation of the users' browsing actions and the structure of the detection algorithm are decribed in detail. By downloading the public Trace on the detection algorithm for the simulation and verification, the results show that the algorithm can accurately detect all types of HTTP-Get Flood attacks, Well reveal attack behavior time, and has good application in the HTTP-Get Flood attack detection.%针对日益泛滥的HTTP-Get Flood攻击,提出了利用用户浏览行为相似性界定HTTP-Get Flood攻击.详细阐述了用户浏览行为相似性的表述方法和检测算法的结构,通过下载公开的Trace对检测算法进行仿真及验证,结果表明,本算法能准确地检测出各种类型的HTTP-Get Flood攻击,很好地揭示攻击行为爆发的时间段,在HTTP-Get Flood攻击检测中有良好的应用.