A router abnormal traffic detection strategy based on active defense

Abstract

With the rapid development of network attacks, traditional security protection technology is difficult to deal with unknown threats and persistent attacks. Active defense improves the ability to defend against network attacks by building a dynamic, heterogeneous and redundant endogenous security system. Aiming at the problem of single abnormal arbitrament information of routers in mimic defense, a router abnormal traffic detection strategy based on active defense is proposed. By clustering the traffic information of multiple heterogeneous redundant routing function entities and comparing the distance measurement between them, the routing function entities in abnormal state are determined. The experimental results show that the proposed strategy effectively detects the security threats of routing functional entities and expand the method of mimic router arbitrament.

Monitoring and Identification of Abnormal Network Traffic by Different Mathematical Models

“…They found that the technique effectively identified LDDoS. Li et al [12] proposed an active defense-based router anomaly traffic detection strategy for the problem of single router anomaly arbitration information in mimetic defense and found through experiments that the method effectively detected network attacks. Ding et al [13] designed an efficient bi-directional simple recurrent unit (BiSRU) and compressed the original high-dimensional features by stacked sparse autoencoder (sSAE).…”