中国邮电高校学报(英文版) ›› 2020, Vol. 27 ›› Issue (1): 51-61.doi: 10.19682/j.cnki.1005-8885.2020.0009

• Networks • 上一篇    下一篇

LDDoS attack detection method based on wavelet decomposition and sliding windows

刘亮1,2,冯文治2,吴志军3,岳猛1,2   

  1. 1.
    2. 中国民航大学
    3. 天津市津北公路2898号 中国民航大学 电子信息工程学院
  • 收稿日期:2019-07-03 修回日期:2019-12-02 出版日期:2020-02-28 发布日期:2020-02-28
  • 通讯作者: 刘亮 E-mail:liul@cauc.edu.cn

LDDoS attack detection method based on wavelet decomposition and sliding windows

  • Received:2019-07-03 Revised:2019-12-02 Online:2020-02-28 Published:2020-02-28
  • Contact: Liang LIU E-mail:liul@cauc.edu.cn

摘要: As a special type of distributed denial of service (DDoS) attacks, the low-rate DDoS (LDDoS) attacks have characteristics of low average rate and strong concealment, thus, it is hard to detect such attacks by traditional approaches. Through signal analysis, a new identification approach based on wavelet decomposition and sliding detecting window is proposed. Wavelet decomposition extracted from the traffic are used for multifractal analysis of traffic over different time scale. The sliding window from flow control technology is designed to identify the normal and abnormal traffic in real-time. Experiment results show that the proposed approach has advantages on detection accuracy and timeliness.

关键词: low-rate distributed denial of service attacks, wavelet analysis, sliding windows, detection

Abstract: As a special type of distributed denial of service (DDoS) attacks, the low-rate DDoS (LDDoS) attacks have characteristics of low average rate and strong concealment, thus, it is hard to detect such attacks by traditional approaches. Through signal analysis, a new identification approach based on wavelet decomposition and sliding detecting window is proposed. Wavelet decomposition extracted from the traffic are used for multifractal analysis of traffic over different time scale. The sliding window from flow control technology is designed to identify the normal and abnormal traffic in real-time. Experiment results show that the proposed approach has advantages on detection accuracy and timeliness.

Key words: low-rate distributed denial of service attacks, wavelet analysis, sliding windows, detection