基于ack流量异常的慢速拒绝服务攻击检测方法-计算机系统结构专业论文.docxVIP

华中科技大学硕士学位论文 华 中 科 技 大 学 硕 士 学 位 论 文 II II Abstract The DoS (Denial of Service) attack is one of the typical network attack methods, especially the new LDoS (Low-rate Denial of Service) attack. It is difficult to be detected and defensed with a revolutionary new way to attack. Presently, the LDoS attack detection methods are lack of accuracy, flexibility, real-time performance and resources consumption. Therefore, it is of great significance to explore the new way to effectively detect the LDoS attack. This will help to increase the network security and prevent network crime. According to the TCP/IP (Transmission Control Protocol/Internet Protocol) con- gestion control strategy, the theory of the LDoS attack and its effects are described, and the ACK (Acknowledgement) traffic characteristics are selected as the checking objects. Based on three different network scenarios, the distribution and fluctuation characteristics of ACK traffic are analyzed and compared through experiments. The results show the great differences in ACK traffic distribution and fluctuation characteristics between the LDoS-attacked scenario and other scenarios, and these two characteristics can be used to detect the LDoS attack. By checking ACK traffic distribution and fluctuation characteristics, the LDoS attack detection methods are brought forward and the criterias are summarized. Mixing the two characteristics in one system, a prototype system is built to detect the LDoS attack. The effectiveness of the prototype system is verified using simulation, the results show that the prototype system can get high detection efficiency and detection accuracy with a low false and missing positive rate. Key words：Low-rate Denial of Service, Attack Detection, Exponentially Weighted Moving Average, Moving Range PAGE IV PAGE IV 目 录 摘 要I HYPERLINK \l _bookmark0 Abstract II HYPERLINK \l _bookmark1 1 绪论 HYPERLINK \l _bookmark2 1.1 研究背景 (1) HYPERLINK \l _bookmark3 1.2 DoS 攻击概述 (2) HYPERLINK \l