发布时间：2015-01-22 来源：人大经济论坛

计算机专业论文范文 摘 要 拒绝服务攻击(Denial of Service, DoS)是指阻止合法用户使用正常网络服务的攻击。近年来，拒绝服务攻击事件层出不穷，常常中断一些著名站点与服务器的正常服务，扰乱正常网络行为，造成巨大经济损失。 已有的基于统计的DoS攻击检测技术无法适应实时检测要求；基于误用的入侵检测系统如Snort未考虑DoS攻击的特点，无法达到最好的检测性能。 本文提出了一种基于特征匹配的DoS攻击检测技术。通过分析几种典型的DoS攻击例如 Smurf和SYN Flooding与几种流行的DoS攻击工具例如Tribal Flood Network和Trin00，提取DoS攻击特征，并将这些特征表示成与Snort相兼容的形式。本文分析了两种入侵检测中的模式匹配算法：Boyer-Moore 算法与Aho-Corasick算法，并结合DoS攻击的特点，提出了AC 算法的一种改进算法——反向AC算法，实验表明反向AC算法有更高的匹配性能，但需消耗更多内存。 本文设计并实现了DoS攻击检测系统原型，并采用DARPA 2000入侵检测评估数据集对系统进行评估。评估结果表明，原型达到98%的检测率与20%的误警率。本文的未来工作是提取更完整的DoS攻击特征，降低原型的误警率。 关键词: 入侵检测；拒绝服务攻击；特征匹配 A DoS Attack Detection Technology Based on Signature Matching Abstract DoS attacks prevent legitimate user of network from using normal network services. In recent years, DoS attacks emerge in endlessly. They break off the services of some famous sites and network servers; interrupt the normal network behavior, result in great financial loss. Currently, Statistic based DoS attack detection approaches are not adopted for the real-time detection. Misuse based Intrusion Detection Systems such as Snort are designed without considering the characteristic of DoS attack, thus they can not achieve the best performances. This paper develops a DoS attack detection technology based on signature matching. By analyzing different kinds of DoS attacks such as Smurf and SYN Flooding, and various DoS attack tools such as Tribal Flood Network and Trin00, we extract the attack signatures of DoS. Then these signatures are expressed according to the forms compatible with Snort. We analyze two pattern matching algorithms: Boyer-Moore algorithm and Aho-Corasick algorithm. Then, combining with the characteristics of DoS attacks, we propose an improved algorithm on AC algorithm, named Reversed AC algorithm. Our experimental results show that the Reversed AC algorithm has better performance and consumes a bit more memories. We design and implement our system prototype and conduct some experiments with DARPA 2000 intrusion eva luation dataset. Our experimental results show that our prototype has detection rate with 98% and false alarm rate with 20%. Our future work is to extract more complete DoS attack signatures to decrease the false alarm rate of our prototype. Key Words: Intrusion Detection; Denial of Service; Signature Matching Contents 1Introduction1 1.1Background1 1.2Related Work1 1.3Research Content and Scope2 1.4Paper Structure3 2DoS Attacks Overview4 2.1Typical DoS Attacks4 2.1.1ICMP Flooding4 2.1.2TCP Flooding4 2.1.3UDP Flooding5 2.1.4Summary5 2.2Popular DoS Attacks Tools5 2.2.1Tribal Flood Network6 2.2.2Trin006 2.2.3TFN2K6 2.2.4Stacheldraht6 2.3DoS Attack Signature Extracting6 2.3.1Signature Construction6 2.3.2Signature Extracting8 2.3.3Signatures Expression9 3Pattern Matching Algorithms10 3.1Boyer-Moore Algorithm10 3.2Aho-Corasick Algorithm11 3.3Improvement of Aho-Corasick Algorithm12 3.4Performance Analysis15 4System Prototype Design and Implementation17 4.1System Architecture17 4.2System Prototype Design and Implementation18 4.2.1Packet Capture18 4.2.2Packet Decode19 4.2.3Signature Engine20 4.2.4Detection Engine22 4.2.5Visual Alert23 5Experimental eva luation26 5.1Detection Rate26 5.2False Alarm Rate27 5.3Performance28 5.4Summary28 6Conclusion30 Acknowledgements31 References32