Detecting Distributed Denial of Service Attacks Based on Load Prediction
Changzhen Hu · Keji daobao · 2005
By analyzing of the features of distributed denial of service(DDOS) attacks, a novel approach of detection of DDOS attacks based on host load-concurrent connection time series prediction is proposed. This method has improved the traditional anomaly detection. It predicts concurrent connection time series and adopts prediction results as normal host load estimate of next time range. So the timeliness of normal behavior description is improved; high detection accuracy and low detection latency are acquired. Two key technologies are studied: one is load prediction technology; the other is load anomaly judgment. In order to improve prediction accuracy, a novel wavelet-BP neural network model is established and in order to increase anomaly judgment accuracy, sliding window method is used. Experiment results show that our new method is better than traditional anomaly detection technologies.