Traffic behavior feature based DoS&DDoS attack detection and abnormal flow identification for backbone networks
Zhou Ying-ji · Journal of Computer Applications · 2013
The existing methods for backbone networks only analyze coarse-grained network traffic characteristic parameters.Thus,they cannot guarantee both the premise of abnormal flow identification and the real-time detection for DoS(Denial of Service) DDoS(Distributed Denial of Service,DDoS) attacks.Concerning this problem,a DoSDDoS attack detection and abnormal flow identification method for backbone networks was proposed.First,it analyzed coarse-grained network traffic characteristic parameters to determine the time points that abnormal behaviors occur;then,fine-grained traffic behavior characteristic parameters were analyzed in these time points to find the destination IP addresses that correspond to abnormal behaviors;finally,comprehensive analysis was conducted for extracted traffic that correspond to abnormal behaviors to determine DoS and DDoS attacks.The simulation results show that,the proposed method can effectively detect DoS attacks and DDoS attacks in backbone networks.Meanwhile,it could accurately identify the abnormal traffic,while real-time detection is ensured.