...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Information Security, IET >Information fusion-based method for distributed domain name system cache poisoning attack detection and identification
【24h】

Information fusion-based method for distributed domain name system cache poisoning attack detection and identification

机译：基于信息融合的分布式域名系统缓存中毒攻击检测与识别方法

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

In this study, the authors consider the detection and identification problems of distributed domain name system (DNS) cache poisoning attack. In the considered distributed attack, multiple cache servers are invaded simultaneously and the attack intensity for each cache server is slight. It is difficult to detect and identify the distributed attack by the existing local information-based detection methods, as the abnormal features for each cache server are indistinctive under distributed attack. To handle this problem, they propose an information fusion-based detection and identification methods. They find that the entropies of the query Internet protocol (IP) addresses for all cache servers are approximately stationary and statistically independent under normal cases. When distributed attack happens, they show the fact that the correlation of the entropies among all cache servers could increase dramatically. On the basis of this feature, they make use of principal component analysis to design the detection and identification methods. Specifically, attack is true when the maximum eigenvalue of the normalised entropies matrix exceeds a threshold, and the attacked servers are identified by the main loading vector. At last, they take a large-scale DNS in China and a simulation as two examples to show the effectiveness of their methods.
机译：在这项研究中，作者考虑了分布式域名系统（DNS）缓存中毒攻击的检测和识别问题。在所考虑的分布式攻击中，同时入侵了多个缓存服务器，每个缓存服务器的攻击强度很小。现有的基于本地信息的检测方法难以检测和识别分布式攻击，因为每个高速缓存服务器的异常功能在分布式攻击下都难以区分。为了解决这个问题，他们提出了一种基于信息融合的检测和识别方法。他们发现，在正常情况下，所有缓存服务器的查询Internet协议（IP）地址的熵大约是固定的，并且在统计上独立。当发生分布式攻击时，它们表明以下事实：所有缓存服务器之间的熵相关性可能会急剧增加。基于此功能，他们利用主成分分析来设计检测和识别方法。具体地，当归一化熵矩阵的最大特征值超过阈值时，攻击为真，并且通过主加载向量来识别被攻击的服务器。最后，他们以在中国的大规模DNS和模拟作为两个例子来说明其方法的有效性。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号