[论文解读] Dynamic and Auto Responsive Solution for Distributed Denial-of-Service Attacks Detection in ISP Network

Brij B. Gupta, R. C. Joshi+1 more|arXiv (Cornell University)|Apr 25, 2012

Network Security and Intrusion Detection参考文献 23被引用 11

一句话总结

本文提出了一种动态、自动响应的框架，用于在ISP网络中检测洪水型DDoS攻击，采用基于流量体积的方法（FVBA）对正常流量进行建模，并通过实时监控突发流量变化来检测异常。利用六西格玛方法确定阈值，系统实现了高检测准确率，且误报率显著降低，该方法在KDD 99数据集上通过ROC曲线分析得到验证。

ABSTRACT

Denial of service (DoS) attacks and more particularly the distributed ones (DDoS) are one of the latest threat and pose a grave danger to users, organizations and infrastructures of the Internet. Several schemes have been proposed on how to detect some of these attacks, but they suffer from a range of problems, some of them being impractical and others not being effective against these attacks. This paper reports the design principles and evaluation results of our proposed framework that autonomously detects and accurately characterizes a wide range of flooding DDoS attacks in ISP network. Attacks are detected by the constant monitoring of propagation of abrupt traffic changes inside ISP network. For this, a newly designed flow-volume based approach (FVBA) is used to construct profile of the traffic normally seen in the network, and identify anomalies whenever traffic goes out of profile. Consideration of varying tolerance factors make proposed detection system scalable to the varying network conditions and attack loads in real time. Six-sigma method is used to identify threshold values accurately for malicious flows characterization. FVBA has been extensively evaluated in a controlled test-bed environment. Detection thresholds and efficiency is justified using receiver operating characteristics (ROC) curve. For validation, KDD 99, a publicly available benchmark dataset is used. The results show that our proposed system gives a drastic improvement in terms of detection and false alarm rate.

研究动机与目标

• 解决现有DDoS检测方案在真实网络环境下不切实际或无效的局限性。
• 设计一种可扩展的实时检测系统，能够识别ISP网络中多种类型的洪水型DDoS攻击。
• 通过自适应阈值设定，最大限度降低误报率，同时保持高检测准确率。
• 利用标准化基准（如KDD 99数据集）验证系统性能。
• 通过动态容差因子，确保系统能够响应不同网络负载和攻击动态。

提出的方法

• 该框架采用基于流量体积的方法（FVBA），根据流量体积测量值构建正常网络流量的特征模型。
• 持续监控ISP网络内突发流量变化，以检测潜在的DDoS异常。
• 应用六西格玛方法，确定准确的阈值，以区分恶意流量与正常流量。
• 集成动态容差因子，实时适应不同的网络状况和攻击负载。
• 使用受试者工作特征（ROC）曲线评估检测效率并优化阈值选择。
• 利用公开的KDD 99基准数据集对系统进行验证，以评估检测率和误报率。

实验结果

研究问题

• RQ1 如何使DDoS检测系统在保持可扩展性的同时，对实时网络动态具有响应能力？
• RQ2 何种方法可确保准确的阈值设定，以区分恶意流量与正常网络流量？
• RQ3 所提出的基于FVBA的框架在保持高检测准确率的同时，能在多大程度上降低误报率？
• RQ4 该系统在不同攻击模式和变化的网络负载下表现如何？
• RQ5 六西格玛方法的集成能否提高ISP网络中异常检测的可靠性？

主要发现

• 所提出的基于FVBA的检测系统相比传统方法，显著降低了误报率。
• ROC曲线分析证实了高检测效率，表明系统在正常流量与恶意流量之间具有优异的区分能力。
• 六西格玛方法的应用实现了准确且自适应的阈值设定，增强了系统的鲁棒性。
• 由于采用了动态容差因子，该框架在不同网络条件下均表现出良好的可扩展性。
• 在KDD 99数据集上的验证结果证实了该系统在检测各类洪水型DDoS攻击方面的有效性。
• 整体检测性能相比现有方案，在检测率和误报率方面均有显著提升。