Design And Implementation Of DDoS Detection And Scanning Module Within MONSTER

In recent years, as the network attack becomes more and more abundant, the automation becomes more and more high, the threshold becomes more and more low, its detection and defense has been widespread concern at home and abroad. MONSTER system as deployed in the access network 10G integrated packet filtering work in series, intrusion detection, collaborative intrusion prevention and response systems.The current IDS is still based on rule, it’s difficult to adapt to today’s increasingly complex attack techniques, so it’s necessary to design DDoS and scanning attack detection module for it.After summarized the exist scanning and DDoS attack detection technology, this thesis proposed scanning detection algorithm based on neural network and DDoS attack detection algorithm based on SVM. The main contents are as follows:(1)Based on the theory of neural network,designed and implemented the pre-processing module, pattern recognition module, neural network classification module and scanning alarm module, becoming scanning detection system. (2) Based on the theory of support vector machine, designed and implemented the pre-processing module, feature calculation module, SVM learning module, DDoS determination module and alarm module, becoming DDoS attack detection system.Finally, we reflected the superiority of the selected algorithm through the experimental comparison.Then, we deployed the scanning detection module and the DDoS attack detection module in MONSTER system and made it have stronger ability to defense the attack.