Abstract: The Distributed Denial of Service(DDoS) attack developing from Denial of Service(DoS) attack has become one of the major threats to network security. This paper starts from the analysis of TCP backlog, and proposes an algorithm based on TCP Backlog detection. Algorithm analyzes TCP backlog combing with historical connected records, generates features vectors, detects abnormal level of TCP backlog using BP neural networks, determines whether attack happens according to the abnormal level. Experimental result shows that the algorithm can detect DDoS attack quickly and accurately, and prevent the occurrence of DDoS attack effectively.

Key words: Distributed Denial of Service(DDoS) attack, TCP backlog, BP neural networks

摘要：

由拒绝服务攻击(DoS)发展而来的分布式拒绝服务攻击(DDoS)已成为目前网络安全的主要威胁之一。从分析TCP缓存入手，提出一种基于缓冲区检测的DDoS检测算法。结合历史连接记录来对TCP缓存进行分析，生成特征向量，通过BP神经网络检测TCP缓存异常程度，根据异常程度判断是否发生攻击。实验结果表明，该算法能迅速准确地检测出DDoS攻击，有效阻止DDoS攻击的发生。

关键词: 分布式拒绝服务攻击, TCP缓存, BP神经网络

CLC Number: 

• TP393.08