The detection of low-rate DoS attacks using the SADBSCAN algorithm
The detection of low-rate DoS attacks using the SADBSCAN algorithm
复制标题
使用 SADBSCAN 算法检测低速率 DoS 攻击
DOI：
10.1016/j.ins.2021.02.038
复制
发表时间：
2021
影响因子：
8.1
通讯作者：
Wang Xiyin
中科院分区：
文献类型：
--
作者：
Tang Dan;Zhang Siqi;Chen Jingwen;Wang Xiyin
低速率拒绝服务（DoS）攻击是DoS攻击的变种，它可以利用Internet协议中的漏洞来降低服务质量。由于低速率拒绝服务攻击的低攻击率和隐蔽性，使用传统的拒绝服务防御机制来识别低速率拒绝服务攻击具有挑战性。现有的攻击检测技术大多是基于统计分析和信号处理的。它们通常表现出很高的假阴性率，并且仅适用于小规模数据。提出了一种基于自适应带噪声应用空间聚类算法的低速率拒绝服务攻击检测方案。SADBSCAN算法提供了一种解决方案，以自适应地识别聚类在多密度数据集。我们使用SADBSCAN算法分组网络流量根据网络流量的特点受到低速率的拒绝服务攻击。然后，我们使用余弦相似度来确定是否包含低速率的拒绝服务攻击的组。为了评估性能，我们进行了实验，并与其他检测解决方案的结果进行了比较。实验数据包括NS-2和TestBed模拟生成的数据以及WIDE公共数据集。实验结果表明，该方案提高了检测精度，降低了漏报率，能够适应大规模复杂网络环境。
Low-rate denial-of-service (DoS) attacks, which can exploit vulnerabilities in Internet protocols to deteriorate the quality of service, are variants of DoS attacks. It is challenging to identify low-rate DoS attacks using traditional DoS defence mechanisms due to their low attack rate and stealthy nature. Most of the existing attack detection techniques are based on statistical analysis and signal processing. They usually show a high false negative rate and are only applicable to small-scale data. We propose a new low-rate DoS attack detection scheme based on the self-adaptive density-based spatial clustering of applications with noise (SADBSCAN) algorithm. The SADBSCAN algorithm provides a solution to adaptively identify clusters in multidensity datasets. We use the SADBSCAN algorithm to group network traffic according to the characteristics of the network traffic subject to low-rate DoS attacks. Then, we use cosine similarity to determine whether the groups contain low-rate DoS attacks. To evaluate performance, we conducted experiments and compared the results with those of other detection solutions. The experimental data include data generated by the NS-2 and TestBed simulations and the WIDE public dataset. The results show that our scheme improves the detection accuracy, reduces the false negative rate, and can be adapted to large-scale complex network environments.