Adaptive DDoS Detector Design Using Fast Entropy Computation Method
Adaptive DDoS Detector Design Using Fast Entropy Computation Method
复制标题
DOI：
10.1109/imis.2011.82
复制
发表时间：
2011-06
期刊：
影响因子：
--
通讯作者：
Giseop No;Ilkyeun Ra
中科院分区：
文献类型：
--
作者：
Giseop No;Ilkyeun Ra
近年来，分布式拒绝服务(DDoS)攻击的威胁持续增长，通过互联网获取攻击工具变得越来越容易。其中一项研究介绍了一种基于修正信息熵的快速检测攻击的方法(即快速熵)。与传统的熵计算相比，快速熵在保持检测精度的同时，显著减少了计算时间。然而，快速熵在检测过程中需要手动设置阈值，这在实际检测设备中是不现实的。我们引入了动态检测窗口大小和基于快速熵的自适应阈值移位的自适应检测方法，称为AFEA(自适应DDoS攻击检测方法)。我们的自适应DDoS检测器成功地证明，在保持快速熵检测方案相同计算时间的情况下，快速熵检测方案的最佳结果可以在不需要人工设置门限和系统训练的情况下提高其DDoS检测性能。此外，我们还发现动态AFEA在引入快速熵的情况下，比固定的(非动态)AFEA能够更好地提高检测水平
Recently, the threat of DDoS (Distributed Denial-of-Service) attacks is growing continuously and acquiring attacking tools via Internet is getting easy. One of the researches introduced a fast method to detect attacks using modified information entropy (so called Fast Entropy). Fast Entropy shows the significant reduce of computational time compared to conventional entropy computation while it maintains detection accuracy. However, Fast Entropy needs the manual threshold settings during detection process which is not realistic in real detection facility. We introduce adaptive detector with dynamic detection window size and adaptive threshold shifting using Fast Entropy, called AFEA (Adaptive DDoS attack detection using Fast Entropy Approach). Our adaptive DDoS detector successfully demonstrates that its performance of the DDoS detection can be enhanced by the best result of Fast Entropy detection scheme without manual threshold setting and system training while it maintains the same computational time of Fast Entropy detection scheme. In addition, we found that Dynamic AFEA can enhance detection level more than fixed (non-dynamic) one when it is equipped with Fast Entropy