【摘要】 应用层拒绝服务攻击与传统的拒绝服务相比,其破坏性更大,也更难被检测和防御。对此,基于用户浏览行为的分析,提出了一种采用自回归模型来检测应用层DDoS攻击的方法。通过AR模型和卡尔曼滤波,学习和预测正常用户的访问并判断异常;当定位异常访问源后,反馈给前端路由器进行限流或过滤。在电信IDC实际网络环境中,测试结果表明该方法是有效的。更多还原

【Abstract】 Compared with traditional DDoS attack,application-layer DDoS attack has more destructiveness and becomes harder to be detected and defense.Based on user browsing behavior analysis,this paper presented a method for detecting application layer DDoS attacks using auto-regression model.It adopted AR model and Kalman filtering to learn and predict normal user access,the results of which were advancedly used to judge abnormal.The routers were capable of limiting or blocking the attack traffic after locating the attack source accurately.The test result in China Telecom Internet Data Center shows that the method is effective.更多还原