RoQ (Reduction of Quality) attack is more stealthy and changeable than traditional DoS (Denial of Service) attack, which makes detection of RoQ extremely difficult. In order to improve detection accuracy and locate attack sources in time, this paper turns modeling attack flow extraction into a process of blind sources separation. A method is proposed based on fast ICA (Independent Component Analysis) to detach RoQ flow from several observation network devices and terminals. Then, some features’ parameters that represent attack flow are extracted. After that, a system of collaborative detection system is designed on the basis of SVM (Support Vector Machine), using marked attack and no-attack samples to train the SVM classifier in order to detect RoQ attack finally. Simulation results illustrate that this method can detect IP spoofed RoQ attack as well as locate the attacker, accuracy of which reaches up to 90%. Moreover, choosing appropriate ICA parameters will improve results to some extent.%降质服务(Reduction of Quality, RoQ)攻击比传统的拒绝服务攻击(Denial of Service, DoS)攻击更具有隐秘性和多变性，这使得检测该攻击十分困难。为提高检测准确率并及时定位攻击源，该文将攻击流量提取建模为一个盲源分离过程，提出了基于快速ICA (Independent Component Analysis)的攻击流特征提取算法，从若干观测网络和终端设备中分离出RoQ攻击流，然后提取表征攻击流的特征参数。接着设计了一种基于支持向量机的协同检测系统和检测算法，通过用已标记的有攻击和无攻击的样本训练SVM分类器，最终实现RoQ攻击的检测。仿真结果表明该方法能够有效检测并定位伪造IP地址的RoQ攻击，检测率达到90%以上，而选取合适的ICA参数会提高检测效果。
展开▼
