多类支持向量机的DDoS攻击检测的方法.pdfVIP

第37 卷 第2 期 电 子 科 技 大 学 学 报 Vol.37 No.2 2008年3月 Journal of University of Electronic Science and Technology of China Mar. 2008 多类支持向量机的DDoS攻击检测的方法 徐 图，罗 瑜，何大可 (西南交通大学信息科学与技术学院 成都 610031) 【摘要】为了利用SVM准确的检测DDoS ，需要找到区分正常流和攻击流的特征向量，根据DDoS攻击的特点，提出了独 立于流量的相对值特征向量。为了在指示攻击存在的同时，也指示攻击强度，多类支持向量机(MCSVM)被引入到DDoS检测 中。实验表明，RLT特征与MCSVM相结合，可以有效检测到不同类型的DDoS攻击，并且能准确地指示攻击强度，优于目前 已有的检测方法。使用RLT特征进行DDoS检测，比使用单一攻击特征进行识别的方法，包含更多的攻击信息，可以得到较高 的检测精度。 关 键 词 分布式拒绝服务攻击; 多类支持向量机; 相对值特征向量; 支持向量机 中图分类号 TP393 文献标识码 A Detecting DDoS Attack Based on Multi-Class SVM XU Tu, LUO Yu, and HE Da-ke (School of Information Science and Technology, Southwest Jiaotong University Chengdu 610031) Abstract In order to detect distributed denial of service (DDoS) attacks with support vector machine (SVM) measures, the feature vectors that can distinguish normal stream from attack stream are required. According to the characters of DDoS attacks, a group of relative value features are proposed. For indicating the existence and attack intensity of DDoS attack simultaneously, multi-class SVM (MCSVM) is introduced to detecting DDoS Attacks. As shown in our numeric experiments, the combination of RLT features and MCSVM can detect several kinds of DDoS attacks effectively and indicate attack intensity precisely. The detection results are better than other detection measures. Because the RLT features include more attack information than the detection measures using single attack character, a better detection result is available. Key words distributed denial of service attack; multi-class SVM; relative value feature vector; support vector machine 近年来，分布式拒绝服务(distributed