【摘要】 提出由TCP连接的唯一性导出的TCP数量平衡性测度及其经验范围可用于检测TCP连接的大规模异常,如DDoS、扫描等.使用带哈希增强算法的BloomFilterReproduction(BFR)方法对TCP连接大规模异常的参数进行快速再现,如IP地址、端口的分布等,使得在检测过程中无须维护TCP五元组的信息.实验结果表明,该方法能够以较少的资源占用和较高的准确性来揭示网络流量中混杂的多种异常现象.更多还原

【Abstract】 The large scaled TCP abnormal behavior, such as DDoS, scanning etc., can be detected by some metrics and their experimental values derived by the uniqueness of TCP connections. An algorithm named Bloom Filter Reproduction (BFR) is proposed to reconstruct the original parameters in large scaled TCP abnormal behaviors pithily by enhanced simple hash functions. Without maintaining the TCP information of 96bits’ 5-tuple, the BFR algorithm can reconstruct the abnormal parameters such as IP address or their aggregation timely during the detection process. The experiments show that BFR can disclose several abnormal behaviors mixed in network traffic at the same time with high precision and low overhead.更多还原