利用希尔伯特黄变换检测DDoS攻击

• 作 者: 郑康锋 王秀娟 杨义先 郭世泽
• 机 构: Key Laboratory of Network and Information Attack & Defense Technology of MOE, Beijing University of
• 出 处: 中国通信
• 发表日期: 2011年2期
• 关键词: HHT similarity DDoS detection marginal hilbert spectrum

DDoS detection has been the research focus in the field of information security. Existing detecting methods such as Hurst parameter method and Markov model must ensure that the network traffic signal f (t) is a stationary signal. But its stability is just a regular assumption and has no strict mathematical proof. Therefore methods mentioned above lack of reliable theoretical support. This article introduces Hilbert-HuangTtransformation(HHT). HHT does not need to be based on signal stability, but it monitors the similarity between Hilbert marginal spectrums of adjacent observation sequences so as to realize DDoS detection. The method is experimented on DARPA 1999 data and simulating data respectively. Experimental results show that the method behaves better than existing Hurst parameter method in distinguishing both the normal and the attacked traffic.