摘要
针对新网络环境下近两年新出现的应用层分布式拒绝服务攻击,本文将详细剖析其原理与特点,并分析现有检测机制在处理这种攻击上的不足。最后,本文提出一种基于用户行为的检测机制,它利用Web挖掘的方法通过Web访问行为与正常用户浏览行为的偏离程度检测与过滤恶意的攻击请求,并通过应用层与传输层的协作实现对攻击源的隔离。
Distributed denial of service （DDoS） attacks bring a very serious threat to the stability of Intemet. DDoS attack methods and tools are becoming more sophisticated, effective and also more difficult to be traced. New forms of DDoS attacks on application layer cause current defense technologies working on TCP or IP level unable to withstand them, which makes a new challenge to the traditional anomaly detection techniques. In this paper, we discuss the rationale of application layer DDoS attacks and the disadvantages of current DDoS detection schemes in dealing with such attacks. At last, a new detection scheme focusing on application layer DDoS attacks defense based on user behavior is proposed. Filtering and blocking are also carried out for the malicious HTTP requests over the application level and TCP level.
出处
《电信科学》
北大核心
2007年第1期89-93,共5页
Telecommunications Science
基金
国家自然科学基金资助项目(No.90304011)
广东省自然科学基金资助项目(No.04009747)
高等学校博士学科点专项科研基金资助项目(No.20040558043)
珠海市科技计划资助项目(No.PC20041100)
