高速网络环境下DoS攻击的异常检测与协同防御控制研究

Research on Anomaly Detection and Collaborative Defense Control of DoS Attacks in High Speed Network Environment

摘要:

为应对高速网络环境下因万兆级骨干链路、多源异构终端泛在接入以及端-雾-云协同架构动态流量调度所导致的DoS攻击流量隐匿性强、攻击脉冲短时高带宽、传统熵基检测参数静态固化且响应滞后的问题,提出高速网络环境下DoS攻击的异常检测与协同防御控制方法。首先通过双阶段校准的Renyi熵分析实现毫秒级异常感知；进而采用熵加权改进的模糊ISODATA聚类对可疑流量进行深度识别与精确分类；最后结合贝叶斯决策机制与“端?雾?云”协同架构,完成攻击流量的智能拦截与全局协同防御。实验表明,正常流量熵值稳定在5bit左右,波动小；不同攻击下熵值变化各异。此算法检测到的攻击峰值流量2500Gbps,与实际相符,100次仿真攻击中非法访问次数始终低于100次且稳定,具备较高的检测精度与实时性。

Abstract:

To address the issues of strong hidden DoS attack traffic, short-term high bandwidth attack pulses, static solidification of traditional entropy based detection parameters, and delayed response caused by 10G backbone links, ubiquitous access of multi-source heterogeneous terminals, and dynamic traffic scheduling of end fog cloud collaborative architecture in high-speed network environments, an anomaly detection and collaborative defense control method for DoS attacks in high-speed network environments is proposed. Firstly, millisecond level anomaly perception is achieved through Renyi entropy analysis with two-stage calibration; Furthermore, entropy weighted fuzzy ISODATA clustering is used to deeply identify and accurately classify suspicious traffic; Finally, by combining Bayesian decision mechanism with the collaborative architecture of "End Fog Cloud", intelligent interception and global collaborative defense of attack traffic are achieved. Experiments have shown that the entropy value of normal traffic remains stable at around 5 bits with minimal fluctuations; The entropy changes differently under different attacks. The peak attack traffic detected by this algorithm is 2500Gbps, which is consistent with reality. In 100 simulated attacks, the number of illegal accesses is always below 100 and stable, with high detection accuracy and real-time performance.