WEDMS: An advanced mean shift clustering algorithm for LDoS attacks detection
WEDMS: An advanced mean shift clustering algorithm for LDoS attacks detection
复制标题
WEDMS：一种用于 LDoS 攻击检测的高级均值漂移聚类算法
DOI：
10.1016/j.adhoc.2020.102145
复制
发表时间：
2020-05-01
期刊：
影响因子：
4.8
通讯作者：
Yang, Qiuwei
中科院分区：
文献类型：
--
作者：
Tang, Dan;Man, Jianping;Yang, Qiuwei
网络和通信安全是人们关注的焦点。低速率拒绝服务（LDoS）攻击利用TCP协议的缺陷，通过周期性地发送脉冲序列来抑制TCP吞吐量和网络链路质量。由于LDoS攻击的平均攻击率低，隐蔽性大，现有的检测方法难以对LDoS攻击进行有效的防御，严重威胁着网络的安全。提出了一种基于改进的加权欧氏距离均值漂移聚类算法（WEDMS）的LDoS攻击检测方法。基于遭受LDoS攻击的网络流量的离散性比合法流量的离散性更明显这一特点，利用WEDMS算法对网络流量进行聚类。聚类分析后，根据聚类结果的决策特征，可以验证LDoS攻击的存在。在NS-2、测试平台和公共数据集（如LBNL、WIDE 2006和WIDE 2018）上进行了检测性能实验。实验结果表明，该方法能够以较高的TPR和较低的FPR识别出LDoS攻击的存在。(C)2020 Elsevier B. V.保留所有权利。
Network and communication security are the focus of attention. Low-rate denial of service (LDoS) attacks exploit deficiencies of TCP protocol to restrain TCP throughput and network quality of links, by sending pulse sequences periodically. It is difficult for the defense against LDoS attacks by the available DoS attacks detection methods, due to the low average rate and prodigious concealment of LDoS attacks, which threats on the network security seriously. In this paper, a new approach for LDoS attacks detection based on the advanced Mean Shift clustering algorithm with weighted Euclidean distance (WEDMS) is proposed. Based on the distinction that the discreteness of network traffic suffering LDoS attacks is more obvious than that of legitimate traffic, network traffic can be clustered by the WEDMS algorithm. After cluster analysis, the existence of LDoS attacks can be validated according to the decision feature of the clustering results. Experiments on detection performance are carried out in NS-2, test-bed, and public datasets such as LBNL, WIDE2006, and WIDE2018. The experimental results illustrate that the presence of LDoS attacks can be identified by the proposed method with higher TPR and lower FPR. (C) 2020 Elsevier B.V. All rights reserved.