The Detection and Orientation Method to DRDoS Attack Based on Fuzzy Association Rules

DDoS (Distributed Denial of Service) attack is being the most extensive danger and difficulty to defense. A new kind of DDoS attack named DRDoS (Distributed Reflector Denial of Service) appears in recent years, which is more dangerous than DDoS attack because it is in stronger disguise. In this paper, the principle of DRDoS attack is studied and the network traffic is analyzed by fuzzy association rules with path restricted when DRDoS attack happens. And the association rules about spoofed network traffic and attack network traffic are mined. Also the DRDoS Attack Defensive Architecture based on Multi-Agent (DAMA) is set up in order to realize the detection, orientation and defensive function. DAMA is validated by NS-2 platform. It can detect and orient the attack source in a short time, realize screening the attack source and stop transmitting attack traffic. The experimental result proves that DAMA can find out the attack, orient the attack source and hold out the attack effectively.