本文通過對網絡流量統計的分析，提出了一種基于滑動平均濾波器的DDoS 攻擊檢測
方法。該方法不同于以往單一根據網絡流量的突變或根據攻擊對流量分布的影響來分析
DDOS 攻擊的方法，而是通過運用滑動平均濾波技術將兩者綜合考慮。該方法即適合引起網絡流量突變的攻擊，又適合發現大流量背景下攻擊流量并沒有引起整個網絡流量顯著變化的攻擊。因此適合于各種規模的網絡流量的異常檢測。另外，詳細給出了對檢測成功率和誤報率起著至關重要作用的閥值范圍。
關鍵字：滑動平均濾波器；分布式拒絕服務攻擊；檢測率；誤報率
【Abstract】In this paper we proposes a DDoS intrusion detection method based improved slip average fliter through analyzing statistical characteristics of network traffic. Our method is
different from not noly that based on burst net flow singly but also that based on impact of the traffic distribution singly. We consider both of them. So it can find out the DDos attack both which can burst net flow and which does not arouse the quick changes of network traffic against the large scale network traffic. In addition ,we also give out arrange of threshold value which is very
important to helping us to get high identification probability and low false alarm probability.
【Keywords】slip average filter ,distributed denial of service, identification probability, false
alarm probability