摘要
采用信息熵进行DDoS特征表示,再采用K-means算法分析熵值,通过分析正常网络的分布规律,确定DDoS攻击检测的阈值,并根据阈值来更新正常行为的特征训练集或做出攻击响应。实验结果显示,这种方法可以快速完成训练与测试工作,能够有效检测DDoS攻击。
The entropy is used to represent the feature of DDoS, and the entropy is clustered by K-means algorithm. The threshold of DDoS detection is gotten from analyzing statistical normal network packets, then the normal characteristics training set is updated, and the DDoS is recognized on the basis of threshold. The experiments show that the measure can implement trainings and testing processes rapidly, and it can detect existence of DDoS effectively.
出处
《计算机系统应用》
2010年第12期164-167,共4页
Computer Systems & Applications
