东篱科研大数据发现系统（DRDS）

位置：成果数据库 > 期刊 > 期刊详情页

HTTP-sCAN：Detecting HTTP-Flooding Attack by Modeling Multi-Features of Web Browsing Behavior from Noisy Web-Logs

ISSN号：1673-5447
期刊名称：《中国通信：英文版》
时间：0
分类：TP393.08[自动化与计算机技术—计算机应用技术;自动化与计算机技术—计算机科学与技术] TP393[自动化与计算机技术—计算机应用技术;自动化与计算机技术—计算机科学与技术]
作者机构：[1]School of Computer and Communications Engineering, University of Science and Technology Beijing, Beijing 100083, P. R. China, [2]Research Center for Optical Intemet & Mobile Information Network, School of Communication & Information Engineer,University of Electronic Science & Technology of China, Chengdu 611731, P. R. China, [3]Network Center of Chengdu University, Chengdu 610106, Sichuan Province, P. R. China
相关基金：supported by National Key Basic Research Program of China（973 program）under Grant No.2012CB315905; National Natural Science Foundation of China under grants 61172048,61100184,60932005 and 61201128; the Fundamental Research Funds for the Central Universities under Grant No ZYGX2011J007

作者： WANG Jin[1,3], ZHANG Min[1], YANG Xiaolong[1], LONG Keping[1], XU Jie[2]

关键词： Flooding攻击, Web服务器, 检测性能, HTTP, 网络日志, 浏览行为, 扫描, flooding攻击, IP network DDoS relative entropy cluster algorithm

中文摘要：

HTTP-flooding attack disables the victimized web server by sending a large number of HTTP Get requests.Recent research tends to detect HTTP-flooding with the anomaly-based approaches,which detect the HTTP-flooding by modeling the behavior of normal web surfers.However,most of the existing anomaly-based detection approaches usually cannot filter the web-crawling traces from unknown searching bots mixed in normal web browsing logs.These web-crawling traces can bias the base-line profile of anomaly-based schemes in their training phase,and further degrade their detection performance.This paper proposes a novel web-crawling tracestolerated method to build baseline profile,and designs a new anomaly-based HTTP-flooding detection scheme(abbr.HTTP-sCAN).The simulation results show that HTTP-sCAN is immune to the interferences of unknown webcrawling traces,and can detect all HTTPflooding attacks.

英文摘要：

HTTP-flooding attack disables the victimized web server by sending a large number of HTTP Get requests.Recent research tends to detect HTTP-flooding with the anomaly-based approaches,which detect the HTTP-flooding by modeling the behavior of normal web surfers.However,most of the existing anomaly-based detection approaches usually cannot filter the web-crawling traces from unknown searching bots mixed in normal web browsing logs.These web-crawling traces can bias the base-line profile of anomaly-based schemes in their training phase,and further degrade their detection performance.This paper proposes a novel web-crawling tracestolerated method to build baseline profile,and designs a new anomaly-based HTTP-flooding detection scheme（abbr.HTTP-sCAN）.The simulation results show that HTTP-sCAN is immune to the interferences of unknown webcrawling traces,and can detect all HTTPflooding attacks.

同期刊论文项目