CN1658576A - Detection and defence method for data flous of large network station - Google Patents
Detection and defence method for data flous of large network station Download PDFInfo
- Publication number
- CN1658576A CN1658576A CN 200510033423 CN200510033423A CN1658576A CN 1658576 A CN1658576 A CN 1658576A CN 200510033423 CN200510033423 CN 200510033423 CN 200510033423 A CN200510033423 A CN 200510033423A CN 1658576 A CN1658576 A CN 1658576A
- Authority
- CN
- China
- Prior art keywords
- sigma
- model
- detection
- probability
- data flow
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 43
- 238000000034 method Methods 0.000 title claims abstract description 27
- 238000012549 training Methods 0.000 claims abstract description 22
- 230000007704 transition Effects 0.000 claims description 9
- 230000008569 process Effects 0.000 claims description 6
- 238000000205 computational method Methods 0.000 claims description 2
- 239000011159 matrix material Substances 0.000 claims description 2
- 238000012546 transfer Methods 0.000 claims description 2
- 230000005856 abnormality Effects 0.000 abstract description 5
- 238000004364 calculation method Methods 0.000 abstract description 2
- 235000014510 cooky Nutrition 0.000 description 6
- 230000008859 change Effects 0.000 description 4
- 230000015572 biosynthetic process Effects 0.000 description 3
- 230000004069 differentiation Effects 0.000 description 3
- 239000002244 precipitate Substances 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000001914 filtration Methods 0.000 description 2
- 108091028043 Nucleic acid sequence Proteins 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 230000007123 defense Effects 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000003780 insertion Methods 0.000 description 1
- 230000037431 insertion Effects 0.000 description 1
- 230000009545 invasion Effects 0.000 description 1
- 238000012804 iterative process Methods 0.000 description 1
- 230000001314 paroxysmal effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
This invention discloses a statistical abnormality detection and anti-attack method applied to large scale of network station. It includes founding module method of posting latent semi-Markov model of accident current, highly efficient model training and normal detecting calculation of the current, and the corresponding priority alignment service and current amount control measure. This invention is suitable for establishing a statistical abnormality detection and defending system that provides normal service to the normal current and filters the DDoS flood-type attacking current, and fits to the large network stations such as sports, news, entertainment, business networks.
Description
Technical field
The invention belongs to the network security technology field, particularly relate to a kind of detection and defence method of data flous of large network station.
The safety of technical background large-scale website has and the different characteristics in general website.The peak traffic of large-scale website is very huge, attacks in the easiest flood formula that suffers of peak value period.So the flood formula that the most direct effective attack to large-scale website will be DDoS (the distributed denial of service of Distributed Denial-of-Service) is attacked.The traffic carrying capacity of large-scale website also has paroxysmal characteristics, and than the traffic carrying capacity of general website, its easier attack with the flood formula is obscured mutually.The common statistics method for detecting abnormality of resisting invasion for the foundation of general website might be attack stream to normal, precipitate stream erroneous judgement, thereby become inapplicable.Therefore, the safety problem of large-scale website is a kind of new technological challenge.
The security strategy that existing large-scale website adopts mainly is by the server array that adopts vast capacity, the network insertion and distributed multistage, the multipoint configuration of super large bandwidth, with reliability that improves the website and the attack of dissolving flood formula flow.The subject matter of this security strategy is that people can not unfailingly increase power system capacity, to resist the ddos attack of any degree; Excessive power system capacity also might can not get actual utilization.So, take effective the detection and the measure of resisting ddos attack, under rational input and configuration condition, the safety that improves large-scale website is very important.
The variation of large-scale website traffic carrying capacity is an astable random process.The user of common website is subjected to the influence of user's daily schedule bigger to the visit of website, thereby the traffic carrying capacity on the server, and having is the variation in cycle with day, week significantly.Macroscopical variation characteristic of this traffic carrying capacity is used to carry out the dynamic load leveling of traffic carrying capacity between the different time zone server, to the classification of website with to the prediction of flow.This macroscopic properties of common website can remain unchanged in a few hours, thereby common website traffic model often is confined to the model peak value period, that be assumed to steady-state process.The influence that the user behavior of large-scale website is arranged by large-scale activity is bigger, flow peak before and after activity is held and during carrying out (continuing tens to dozens of minutes).Variation on this macroscopic view makes the peak value stream of large-scale website have the unstable state variation characteristic.
Many studies show that over past ten years, actual stream has second order self-similarity (second orderself-similarity) and long correlation (long-range dependence).So,, still to describe with random process with second order self-similarity or long correlation for the change at random of the traffic carrying capacity of large-scale website.Consider the broad applicability of model and the validity of parameter estimation algorithm, the present invention will adopt hiddensemi-Markov model (HSMM) to describe the change at random process of traffic carrying capacity.Hidden Markovmodel (HMM) has obtained extensive and successful application at many key areas such as speech recognition, handwritten form/literal identification, digital communication encoding and decoding, dna sequence dna classification.Compare with HMM, HSMM is more suitable for distributing in describing unstable state and non-Markovian.HSMM can (but HMM can not) describe the second order self-similarity/long correlation of actual flow and dynamic variation characteristic in time, can estimate to be used to weigh the Hurst parameter of self-similarity.So, utilize HSMM can detect professional quantitative statistics abnormal conditions, determine the size of traffic carrying capacity, or the like.
Summary of the invention
The objective of the invention is to overcome the deficiencies in the prior art, provide the fine differentiation of a kind of energy to arrive the precipitate a large amount of normal flows and the attack stream of large-scale website and shield the detection and the defence method of a kind of data flous of large network station of attack stream.
The technical solution used in the present invention is as follows:
A kind of detection of data flous of large network station and defence method, set up detection model and utilize the normal flow of large-scale website to train described detection model by adopting hidden semi-Markov model, again described detection model is applied in real time detect the data flow that arrives large-scale website, concrete detection method is to calculate the probable probability of the observation sequence of each data flow with respect to detection model, carry out priority queueing according to the distribution and the size of the probable probability of data flow then, the data flow that priority is high more is just preferential more to be obtained serving the then back more acquisition service of the data flow that priority is low more.
The modeling method and the model training method of detection model hidden semi-Markov model of the present invention comprise:
(1) sets up model: establish the data flow that large-scale website detecting and have M discrete state, be expressed as 1,2 respectively, ..., M, and remember that the set of these states is S, the state transitions relation is described with the Markov chain with M state, and matrix A is represented state transition probability, its element a
MnThe transition probability of representative from state m to state n, the transfer between the state are the processes that changes step by step from low to high or from high to low, i.e. a when | m-n|>1
Mn=0;
Adopt b
m(k) expression arrives the probability of k entity for given state m in the unit interval, and it meets the Poisson distribution, promptly
Wherein, k=1,2 ..., ∞, μ
m>0, m ∈ S, μ
1≤ μ
2≤ ...≤μ
M
Make p again
m(d) represent the discrete probability distribution of the duration of state m, it represents that the time difference between former and later two states is the probability of d, and it meets Pareto and distributes, promptly
Wherein, d=1,2 ..., ∞, λ
m>0, m ∈ S,
Use set omega={ A, π, λ, the μ } of parameter to represent hidden semi-Markov model, wherein π=(π then
1, π
2..., π
M), be initial condition probability distribution vector, λ=(λ
1, λ
2..., λ
M), μ=(μ
1, μ
2..., μ
M);
(2) model training: promptly iterate utilization forward direction algorithm, inverse algorithms and parameter estimation algorithm formula as described below, converge to one group of fixing value up to model parameter, form a perfect detection model.
Forward direction-inverse algorithms is as follows:
Make o
tRepresent t observation vector, comprise that the entity that t criticizes arrival counts r
tWith from the time interval q the zero hour to the zero hour that t criticizes that t-1 criticizes
T-1, i.e. o
t=(q
T-1, r
t), o
a bRepresentative is individual to b observation vector sequence from a, o
1 TThen represent whole observation sequence, its length is T, s
tThe state of representative stream when arriving for t batch, 1≤t≤T defines following variable again,
The forward direction algorithm is as follows:
α
1(m)=π
mb
m(r
1),
Inverse algorithms is as follows:
β
T(m)=1,
Parameter estimation algorithm is as follows:
Parameter lambda
mMaximum probable estimation
Or approximate obtaining
Parameter μ
mMaximum probable estimation
Initial condition probability distribution π
mMaximum probable estimation
State transition probability a
MnMaximum probable estimation
But the training off-line of detection model of the present invention carries out, also can onlinely train, off-line training is that off line utilizes normal flow to the detection model training, model after guaranteeing to train can accurately calculate the probable probability of normal flow, described online training is then carried out when concrete work synchronously, earlier the current value of the detection model parameter that can come into operation behind the off-line training as initial value, and collection in real time arrives the data flow of website, when data flow is detected as just often, utilization repeatedly " forward direction-oppositely " algorithm and parameter estimation algorithm, till model parameter converges to one group of fixing value.
Of the present invention detection model is applied to detect the data flow that arrives large-scale website in real time, promptly calculates the probable probability of the observation sequence of each data flow with respect to detection model, the concrete computational methods of its probable probability be employing forward direction algorithm earlier,
α
1(m)=π
mb
m(r
1),
Adopt following formula to calculate again:
In the technique scheme, described data flow refers to that per second arrives the request number of website or the data volume of packet count or byte number or linking number or session number or page number or number of users or above-mentioned combination in any, and described data flow comprise the stream that comes from unique user or come from acting server representative the gathering stream or arrive the stream that gathers of large-scale website of a group user's convergence flow or all new users.
The present invention sets up detection model by hidden semi-Markov model; Again by normal flow training detection model; Arrive the data flow of large-scale website again with this detection model real-time testing; Carry out priority queueing by data flow with respect to the size and the distribution of the probable probability of detection model, thereby the probable probability distribution that normal flow will have bigger probable probability and meet normal flow is endowed higher priority, thereby attack stream will not meet the normal flow model and have lower probable probability or exceed outside the probable probability distribution of normal flow and be endowed lower priority.Therefore, normal flow will obtain the normal service that the website provides with high priority, the minimum data flow of priority is when Internet resources are in short supply, to be abandoned, thereby realize well distinguishing precipitate a large amount of normal flows and attack stream, reaching normal stream provides normal service and prevents the purpose that attack stream is attacked large-scale website.
Description of drawings
Fig. 1 is a structural representation of the present invention.
Embodiment
The present invention is described further below in conjunction with accompanying drawing.
Structural representation of the present invention as shown in Figure 1.At first the stream under the normal operating position of network is gathered, through necessary processing, as format transformation and the unwanted information of filtering, after be saved in the normal user data collection 1. in.2. be HSMM model parameter estimation module, it comprises the iteration estimation formulas of HSMM forward direction-inverse algorithms and parameter, and this module is at first given the model parameter initialize according to default value, even a for the first time to the model training time
1,1=a
1,2=a
M, M=a
M, M-1=1/2, a
M, m=a
M, m-1=a
M, m+1=1/3 (1<m<M), π
m=1/M, 1<λ
m=1.5<2, μ
m=max (r
t) * m/M, M=10 carries out forward direction-inverse iteration computing then, and tries to achieve all model parameter estimation values, repeats this iterative process, up to probable probability P r[o
1 T| Ω] no longer increase or increase when very little till.It is standby in 3. that the model parameter that obtains of training and normal flow will be saved in the HSMM model parameter with respect to the distribution of the entropy of this model, 4. the forward direction algoritic module comprises the forward direction algorithm of HSMM, 3. their needed model parameters are taken from the HSMM model parameter, and 4. the forward direction algoritic module will be used for the statistics abnormality detection of the stream of real-time online.
When practical application needed, the present invention also can carry out online updating to model parameter.At this moment normal user data adfluxion data 1. come from the stream of real-time collection, when the data of real-time collection are detected as just often, promptly can be input to the normal user data adfluxion and be used for real-time update in 1. model parameter, the data sequence length that is used for the model parameter real-time update can be limited to dozens of minutes to hour, so that model is suitable for the dynamic change of flow and reduces the required time of training.When carrying out the model parameter real-time update, HSMM model parameter estimation module 2. will be the current value of model parameter as initial value (rather than default value), forward direction-inverse algorithms of utilization HSMM through after the iteration repeatedly, obtains the updating value of model parameter.Upgrade the result be saved in the HSMM model parameter 3. in, 4. call in order to the forward direction algoritic module.
5. be the collection and the discriminating module of stream, when this module received a grouping, by the differentiation that its order IP address, source, agreement, port or cookies etc. flow, the entity that this stream that adds up then arrived in the current unit interval was counted r
tWhen the current unit interval finishes, calculate and criticized last time the time difference q between the arrival
T-1, and from database, extract the forward variable value { α of this stream
T-1(m) }, send into the forward direction algoritic module and 4. calculate forward variable { α
t(m) }, calculate entropy ln (Pr[o again
1 t| Ω])/t, the probability that is occurred in the normal flow entropy distributes by this entropy obtains this stream " normally " degree with respect to given model parameter, size according to normal degree, with this flow down the grouping that arrives in the unit interval send into classify and list in order of importance and urgency control module 6. in the corresponding formation service of ranking, normal degree is big more, and then priority is high more; Otherwise then low more, the grouping of lowest priority when Internet resources are not enough, will be filtered.Reach the purpose of protection normal flow and filtering attack stream thus, when monitored stream is total flow or total new number of users, classify and list in order of importance and urgency control module 6. only abnormal conditions to be reported to the police.
Present embodiment: at first by one group of observation sequence, to the model training:
A) provide the initial value of model parameter set omega.Can adopt the way of various suitable initializes.But a kind of method of simple and rational initialize is a writ attitude transition probability is that equiprobability distributes, even a
1,1=a
1,2=a
M, M=a
M, M-1=1/2, a
M, m=a
M, m-1=a
M, m+1=1/3 (1<m<M), π
m=1/M; The duration distribution p of writ attitude
m(d) be heavy-tailed Pareto distribution, i.e. 1<λ
m=1.5<2; Make the arrival rate difference of the entity of different given states, i.e. μ
m=max (r
t) * m/M.M can be the arbitrary integer between 10~30.
B) utilization forward direction algorithm and inverse algorithms interative computation are asked forward variable { α
tAnd { β (m) }
t(m) }.。
C) the utilization parameter estimation algorithm is tried to achieve the estimated value of model parameter set omega.
D) repeating step b) with c) up to probable probability P r[o
1 T| Ω] converge to certain value.
E) entropy with this group observation sequence (is lnPr[o
1 T| Ω]/T) frequency distribution is as the distribution of the entropy of normal flow.
Because model training can carry out by off-line, so can not influence the on-line operation performance of system.In fact the time of model training is not long yet.If practical application needs, this model also can onlinely be trained, and the sequence length that is used to train can be limited to dozens of minutes to hour, so that model is suitable for the dynamic change of flow and reduces the required time of training.The problem that online training may face is how to guarantee that the stream that is used to train is normal flow and do not comprise attack stream.
The statistics abnormality detection that model after will training then is applied to flow, promptly calculate the probable probability of each stream for given model parameter:
A) when detection system is received the entity that comes from certain stream (differentiation of being flowed by order IP address, source, agreement, port or cookies) for the first time, add up the entity number that it arrives in this unit interval (for example 1 second), and calculate the initial value α of forward variable
1(m), m ∈ S; Make t=1, τ
0It is the zero hour of this unit interval.
B) current unit interval (be τ second its zero hour),, then make t=t+1, and add up the entity that this stream arrives and count r in this unit interval if receive the entity of this stream
t, and and criticized time difference q between the arrival last time
T-1=τ-τ
0Make τ then
0=τ
C) calculate forward variable α
t(m), m ∈ S calculates entropy ln (Pr[o again
1 t| Ω])/t.
D) probability that in the normal flow entropy distributes, occurs of this entropy exactly this stream with respect to " normally " degree of given model parameter (having represented all normal users common traits).
E) repeating step b) and d).
In probable probability calculation, the topmost time may be that from memory each stream of search is at the preceding forward variable value { α that once criticizes when arriving
T-1(m), m ∈ S}.This search time can by to the Hash computing of IP address, set up search tree, shunting and handle etc. and to significantly reduce.In addition, utilize the time locality (source IP address that promptly occurred recently has very big probability to occur once more) of the IP grouping that arrives a certain website, pass through storehouse, make the IP address that occurred recently on the storehouse top, thereby make reduce the average time of search address tabulation.In fact, do not need each stream is detected separately, several stream can be gathered together and detect.For example, with the IP address of 32bit be abbreviated as 10bit the sign indicating number, " convergence flow " number that then needs to detect has only 1024.When detection system finds that wherein certain convergence flow is unusual, can carry out finer analysis to this convergence flow, promptly wherein each stream is detected and analyzes, find out and cause those unusual streams.
Calculating the entropy ln (Pr[o of a stream
1 t| Ω])/t after, just can the corresponding formation service of ranking be sent in the follow-up grouping of this stream according to the size of this value probability of occurrence in the normal flow entropy distributes.The probability that this value occurs is big more, and then priority is high more; Otherwise it is then low more.The entity of lowest priority when Internet resources are not enough, will be filtered.Reach the protection normal flow thus and dissolve the purpose that ddos attack flows.
In addition, the stream that large-scale website is attacked can be the stream that produces arbitrarily, also can be the normal stream of camouflage, the normal stream of perhaps resetting.Tackling one of the stream of any generation, the stream of camouflage source address, effective way of utilizing the stream of other server reflection and the normal stream of resetting is to adopt cookies.Do not carry the grouping of the instant cookies that produces of server, can be found at an easy rate, thereby be treated with a certain discrimination.For example, for the grouping that does not have cookies,, then can filter out simply if its source IP address or port were visited this website in the recent period.Otherwise, can be used as possible new user, the service (speed that new user occurs only accounts for the very little ratio of total arrival rate of customers usually) of rate-constrained is provided by special formation even special server.So the stream that is difficult to detect and filter is those attack streams with normal address, port and cookies.This attack stream must adopt the flow of super large or coordinate numerous attack streams, thereby show " unusually " on statistical property in order to reach the attack to " flood " formula of website.Thisly can detect by detection technique module proposed by the invention unusually, and filtered out by corresponding defense technique module.
Claims (6)
1, a kind of detection of data flous of large network station and defence method, it is characterized in that adopting hidden semi-Markov model to set up detection model and utilize the normal flow of large-scale website to train described detection model, again described detection model is applied in real time detect the data flow that arrives large-scale website, concrete detection method is to calculate the probable probability of the observation sequence of each data flow with respect to detection model, carry out priority queueing, the back more acquisition service of the data flow that priority is low more according to the distribution and the size of the probable probability of data flow then.
2, the detection of data flous of large network station according to claim 1 and defence method is characterized in that the modeling method of described hidden semi-Markov model and model training method comprise:
(1) sets up model, establish the data flow that large-scale website detecting and have M discrete state, be expressed as 1,2 respectively, ..., M, and remember that the set of these states is S, the state transitions relation is described with the Markov chain with M state, and matrix A is represented state transition probability, its element a
MnThe transition probability of representative from state m to state n, the transfer between the state are the processes that changes step by step from low to high or from high to low, i.e. a when | m-n|>1
Mn=0;
Adopt b
m(k) expression arrives the probability of k entity for given state m in the unit interval, and it meets the Poisson distribution, promptly
Wherein, k=1,2 ..., ∞, μ
m>0, m ∈ S, μ
1≤ μ
2≤ ...≤μ
M
Make p again
m(d) represent the discrete probability distribution of the duration of state m, it represents that the time difference between former and later two states is the probability of d, and it meets Pareto and distributes, promptly
Wherein, d=1,2 ..., ∞, λ
m>0, m ∈ S,
Use set omega={ A, π, λ, the μ } of parameter to represent hidden semi-Markov model, wherein π=(π then
1, π
2..., π
M), be initial condition probability distribution vector, λ=(λ
1, λ
2..., λ
M), μ=(μ
1, μ
2..., μ
M);
(2) model training comprises that main forward direction-inverse algorithms is as follows:
Make o
tRepresent t observation vector, it comprises that the entity that t criticizes arrival counts r
tWith from the time interval q the zero hour to the zero hour that t criticizes that t-1 criticizes
T-1, i.e. o
t=(q
T-1, r
t), o
a bRepresentative is individual to b observation vector sequence from a, o
l TThen represent whole observation sequence, its length is T, s
tThe state of representative stream when arriving for t batch, 1≤t≤T defines following variable again,
The forward direction algorithm is as follows: α
1(m)=π
mb
m(r
1),
Inverse algorithms is as follows: β
T(m)=1,
And then the estimated value by following parameter estimation algorithm computation model parameter: parameter lambda
mMaximum probable estimation
Or approximate obtaining
Parameter μ
mMaximum probable estimation
Initial condition probability distribution π
mMaximum probable estimation
State transition probability a
MnMaximum probable estimation
Last iteration utilization forward direction algorithm, inverse algorithms and parameter estimation algorithm formula converge to one group of fixing value up to model parameter, form a perfect detection model.
3, the detection of data flous of large network station according to claim 2 and defence method, the concrete computational methods that it is characterized in that described probable probability adopt following formula to calculate for adopting the forward direction algorithm earlier again:
4, according to the detection and the defence method of claim 1 or 2 or 3 described data flous of large network station, it is characterized in that described data flow refers to that per second arrives the request number of website or the data volume of packet count or byte number or linking number or session number or page number or number of users or above-mentioned combination in any, and described data flow comprise the stream that comes from unique user or come from acting server representative the gathering stream or arrive the stream that gathers of large-scale website of a group user's convergence flow or all new users.
5, the detection of data flous of large network station according to claim 4 and defence method, but the training off-line that it is characterized in that described detection model carries out, also can onlinely train, described online training the current value of detection model parameter as initial value, and collection in real time arrives the data flow of website, when data flow is detected as just often, use " forward direction-reverse " algorithm and parameter Estimation formula repeatedly, till model parameter converges to one group of fixing value.
6, the detection of data flous of large network station according to claim 5 and defence method, it is characterized in that carrying out priority queueing according to the distribution and the size of the probable probability of data flow, the stream that priority is high is served normally, the data flow that priority is minimum can be filtered when Internet resources are not enough.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CNB2005100334234A CN100352208C (en) | 2005-03-09 | 2005-03-09 | Detection and defence method for data flous of large network station |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CNB2005100334234A CN100352208C (en) | 2005-03-09 | 2005-03-09 | Detection and defence method for data flous of large network station |
Publications (2)
Publication Number | Publication Date |
---|---|
CN1658576A true CN1658576A (en) | 2005-08-24 |
CN100352208C CN100352208C (en) | 2007-11-28 |
Family
ID=35007841
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CNB2005100334234A Expired - Fee Related CN100352208C (en) | 2005-03-09 | 2005-03-09 | Detection and defence method for data flous of large network station |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN100352208C (en) |
Cited By (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2008131667A1 (en) * | 2007-04-28 | 2008-11-06 | Huawei Technologies Co., Ltd. | Method, device for identifying service flows and method, system for protecting against a denial of service attack |
CN101022403B (en) * | 2006-09-08 | 2010-05-12 | 中山大学 | State application blind identifying method |
CN102438025A (en) * | 2012-01-10 | 2012-05-02 | 中山大学 | Indirect distributed denial of service attack defense method and system based on Web agency |
CN101702720B (en) * | 2009-10-28 | 2012-09-05 | 中国科学院计算技术研究所 | Model training method and detecting method in detection of impersonation attack |
CN101517967B (en) * | 2005-09-19 | 2013-07-10 | 谷歌公司 | Traffic prediction for web sites |
CN104123312A (en) * | 2013-04-28 | 2014-10-29 | 国际商业机器公司 | Data mining method and device |
CN106961444A (en) * | 2017-04-26 | 2017-07-18 | 广东亿荣电子商务有限公司 | A kind of hostile network reptile detection method based on hidden Markov model |
CN108989411A (en) * | 2018-07-05 | 2018-12-11 | 中山大学 | A method of the Web user based on network flow clicks target identification |
CN110012009A (en) * | 2019-04-03 | 2019-07-12 | 华南师范大学 | Internet of Things intrusion detection method based on decision tree and self similarity models coupling |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP3996428B2 (en) * | 2001-12-25 | 2007-10-24 | 松下電器産業株式会社 | Abnormality detection device and abnormality detection system |
US6868325B2 (en) * | 2003-03-07 | 2005-03-15 | Honeywell International Inc. | Transient fault detection system and method using Hidden Markov Models |
-
2005
- 2005-03-09 CN CNB2005100334234A patent/CN100352208C/en not_active Expired - Fee Related
Cited By (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101517967B (en) * | 2005-09-19 | 2013-07-10 | 谷歌公司 | Traffic prediction for web sites |
US8670319B2 (en) | 2005-09-19 | 2014-03-11 | Google, Inc. | Traffic prediction for web sites |
CN101022403B (en) * | 2006-09-08 | 2010-05-12 | 中山大学 | State application blind identifying method |
WO2008131667A1 (en) * | 2007-04-28 | 2008-11-06 | Huawei Technologies Co., Ltd. | Method, device for identifying service flows and method, system for protecting against a denial of service attack |
CN101702720B (en) * | 2009-10-28 | 2012-09-05 | 中国科学院计算技术研究所 | Model training method and detecting method in detection of impersonation attack |
CN102438025B (en) * | 2012-01-10 | 2015-03-25 | 中山大学 | Indirect distributed denial of service attack defense method and system based on Web agency |
CN102438025A (en) * | 2012-01-10 | 2012-05-02 | 中山大学 | Indirect distributed denial of service attack defense method and system based on Web agency |
CN104123312A (en) * | 2013-04-28 | 2014-10-29 | 国际商业机器公司 | Data mining method and device |
CN104123312B (en) * | 2013-04-28 | 2018-02-16 | 国际商业机器公司 | A kind of data digging method and device |
CN106961444A (en) * | 2017-04-26 | 2017-07-18 | 广东亿荣电子商务有限公司 | A kind of hostile network reptile detection method based on hidden Markov model |
CN108989411A (en) * | 2018-07-05 | 2018-12-11 | 中山大学 | A method of the Web user based on network flow clicks target identification |
CN108989411B (en) * | 2018-07-05 | 2021-10-08 | 中山大学 | Web user click target identification method based on network flow |
CN110012009A (en) * | 2019-04-03 | 2019-07-12 | 华南师范大学 | Internet of Things intrusion detection method based on decision tree and self similarity models coupling |
CN110012009B (en) * | 2019-04-03 | 2021-05-28 | 华南师范大学 | Internet of things intrusion detection method based on combination of decision tree and self-similarity model |
Also Published As
Publication number | Publication date |
---|---|
CN100352208C (en) | 2007-11-28 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN100352208C (en) | Detection and defence method for data flous of large network station | |
CN101686235B (en) | Device and method for analyzing abnormal network flow | |
CN101267313B (en) | Flooding attack detection method and detection device | |
CN111614627B (en) | SDN-oriented cross-plane cooperation DDOS detection and defense method and system | |
CN107770132B (en) | Method and device for detecting algorithmically generated domain name | |
CN111131260B (en) | Mass network malicious domain name identification and classification method and system | |
CN102271091A (en) | Method for classifying network abnormal events | |
CN102271068A (en) | Method for detecting DOS/DDOS (denial of service/distributed denial of service) attack | |
CN104660464B (en) | A kind of network anomaly detection method based on non-extension entropy | |
CN113114694B (en) | DDoS attack detection method oriented to high-speed network packet sampling data acquisition scene | |
CN102882881A (en) | Special data filtering method for eliminating denial-of-service attacks to DNS (domain name system) service | |
US11706114B2 (en) | Network flow measurement method, network measurement device, and control plane device | |
CN111181930A (en) | DDoS attack detection method, device, computer equipment and storage medium | |
Lu et al. | An HTTP flooding detection method based on browser behavior | |
CN111600876A (en) | Slow denial of service attack detection method based on MFOPA algorithm | |
CN113872962B (en) | Low-speed port scanning detection method for high-speed network sampling data acquisition scene | |
CN113162939A (en) | Detection and defense system for DDoS (distributed denial of service) attack under SDN (software defined network) based on improved k-nearest neighbor algorithm | |
CN103139206B (en) | The detection method of a kind of zombie host and device | |
CN110381074B (en) | Distributed attack defense method aiming at DHCP framework based on big data | |
CN115695041B (en) | DDOS attack detection and protection method and application based on SDN | |
CN100589423C (en) | The method and the device of identification data streams in multi-person online role playing game | |
Lu et al. | An unsupervised approach for detecting DDoS attacks based on traffic-based metrics | |
Yang et al. | Botnet detection based on machine learning | |
CN115987599A (en) | Malicious encrypted flow detection method and system based on multi-level attention mechanism | |
CN111447169A (en) | Method and system for identifying malicious webpage in real time on gateway |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C14 | Grant of patent or utility model | ||
GR01 | Patent grant | ||
C17 | Cessation of patent right | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20071128 Termination date: 20140309 |