Web服務(wù)器的DDoS攻擊檢測方法研究
發(fā)布時(shí)間：2018-11-05 11:59
【摘要】：在互聯(lián)網(wǎng)不斷發(fā)展壯大的今天，Web技術(shù)正在改變著人們的日常生活。一方面，Web技術(shù)讓我們的生活更加便捷，另一方面，隨之而來的安全問題也日益突出，，尤其是作為互聯(lián)網(wǎng)基礎(chǔ)設(shè)施的Web服務(wù)器安全。近幾年來，一些政府機(jī)構(gòu)、銀行網(wǎng)站等遭遇分布式拒絕服務(wù)攻擊的案例層出不窮，其Web服務(wù)器因受到攻擊而導(dǎo)致網(wǎng)站癱瘓，損失巨大�；诖�，如何檢測Web服務(wù)器的DDoS攻擊便成為當(dāng)務(wù)之急，這同時(shí)也是網(wǎng)絡(luò)安全領(lǐng)域內(nèi)的重要研究方向。 針對Web服務(wù)器的DDoS攻擊，本文提出了一種粒子群優(yōu)化的K均值聚類算法（PSO-KM）的DDoS攻擊檢測方法。本文的主要工作可以概括如下： 首先選取數(shù)據(jù)挖掘方法中的K-Means算法作為異常檢測方法的基礎(chǔ)，后用粒子群算法對其進(jìn)行優(yōu)化，即PSO-KM算法，并以此算法來建立異常檢測機(jī)制。其次，利用libpcap開發(fā)庫來捕獲Web服務(wù)器端網(wǎng)絡(luò)數(shù)據(jù)流量，根據(jù)Web服務(wù)器遭受DDoS攻擊時(shí)表現(xiàn)出來的異常情況，從中選取5個(gè)流量特征屬性組成流量特征向量。最后，利用建立的異常檢測機(jī)制對DDoS攻擊行為進(jìn)行檢測。 經(jīng)實(shí)驗(yàn)證明，與K-Means算法建立的檢測方法做對比，該方法具有更好的學(xué)習(xí)效率，檢測率平均提高5個(gè)百分點(diǎn)，誤警率平均降低1個(gè)百分點(diǎn)，可以有效地識(shí)別出DDoS攻擊行為，為日后進(jìn)一步研究Web服務(wù)器的防范工作奠定了基礎(chǔ)。
[Abstract]:With the development of Internet, Web technology is changing people's daily life. On the one hand, Web technology makes our life more convenient, on the other hand, the security problems are increasingly prominent, especially the security of Web server as the Internet infrastructure. In recent years, some government agencies, bank websites and other cases of distributed denial-of-service attacks emerge in endlessly. The Web server is paralyzed by attacks, resulting in huge losses. Based on this, how to detect the DDoS attack of Web server becomes an urgent task, which is also an important research direction in the field of network security. Aiming at DDoS attack of Web server, this paper presents a DDoS attack detection method based on K-means clustering algorithm (PSO-KM) based on particle swarm optimization (PSO). The main work of this paper can be summarized as follows: firstly, the K-Means algorithm of data mining method is selected as the basis of anomaly detection method, and then the particle swarm optimization algorithm is used to optimize it, that is, PSO-KM algorithm. And this algorithm to establish the anomaly detection mechanism. Secondly, the libpcap development library is used to capture the network data traffic on the Web server. According to the abnormal situation that the Web server is attacked by DDoS, five traffic characteristic attributes are selected to form the traffic feature vector. Finally, the DDoS attack behavior is detected by using the established anomaly detection mechanism. The experiments show that compared with the detection method established by K-Means algorithm, the method has better learning efficiency, the detection rate increases by an average of 5 percentage points, the false alarm rate decreases by an average of 1 percentage point, and the DDoS attack behavior can be effectively recognized. For the further study of Web server prevention work laid a foundation.
【學(xué)位授予單位】：鄭州大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2014
【分類號(hào)】：TP393.08
本文編號(hào)：2312019
[Abstract]:With the development of Internet, Web technology is changing people's daily life. On the one hand, Web technology makes our life more convenient, on the other hand, the security problems are increasingly prominent, especially the security of Web server as the Internet infrastructure. In recent years, some government agencies, bank websites and other cases of distributed denial-of-service attacks emerge in endlessly. The Web server is paralyzed by attacks, resulting in huge losses. Based on this, how to detect the DDoS attack of Web server becomes an urgent task, which is also an important research direction in the field of network security. Aiming at DDoS attack of Web server, this paper presents a DDoS attack detection method based on K-means clustering algorithm (PSO-KM) based on particle swarm optimization (PSO). The main work of this paper can be summarized as follows: firstly, the K-Means algorithm of data mining method is selected as the basis of anomaly detection method, and then the particle swarm optimization algorithm is used to optimize it, that is, PSO-KM algorithm. And this algorithm to establish the anomaly detection mechanism. Secondly, the libpcap development library is used to capture the network data traffic on the Web server. According to the abnormal situation that the Web server is attacked by DDoS, five traffic characteristic attributes are selected to form the traffic feature vector. Finally, the DDoS attack behavior is detected by using the established anomaly detection mechanism. The experiments show that compared with the detection method established by K-Means algorithm, the method has better learning efficiency, the detection rate increases by an average of 5 percentage points, the false alarm rate decreases by an average of 1 percentage point, and the DDoS attack behavior can be effectively recognized. For the further study of Web server prevention work laid a foundation.
【學(xué)位授予單位】：鄭州大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2014
【分類號(hào)】：TP393.08
【參考文獻(xiàn)】
相關(guān)期刊論文 前5條
1 高能;馮登國;向繼;;一種基于數(shù)據(jù)挖掘的拒絕服務(wù)攻擊檢測技術(shù)[J];計(jì)算機(jī)學(xué)報(bào);2006年06期
2 趙國鋒;喻守成;文晟;;基于用戶行為分析的應(yīng)用層DDoS攻擊檢測方法[J];計(jì)算機(jī)應(yīng)用研究;2011年02期
3 吳鵬;汪健;;基于AIS的DDoS攻擊檢測策略[J];制造業(yè)自動(dòng)化;2011年20期
4 謝柏林;蔣盛益;張倩生;;基于請求關(guān)鍵詞的應(yīng)用層DDoS攻擊檢測方法[J];計(jì)算機(jī)科學(xué);2013年07期
5 韓秋鳳;;基于流量預(yù)測和相關(guān)系數(shù)的異常檢測[J];微計(jì)算機(jī)信息;2010年01期
本文編號(hào)：2312019
本文鏈接：http://sikaile.net/guanlilunwen/ydhl/2312019.html
最近更新
教材專著
