A Novel Method for Detecting Reduction of Quality (RoQ) Attack Based on Fast Independent Component Analysis
Rong Hong Wang Hui-mei Xian Ming Shi Jiang-yong
State Key Laboratory of Complex Electromagnetic Environment Effects on Electronics and Information System, National University of Defense Technology, Changsha 410073, China
Abstract：RoQ (Reduction of Quality) attack is more stealthy and changeable than traditional DoS (Denial of Service) attack, which makes detection of RoQ extremely difficult. In order to improve detection accuracy and locate attack sources in time, this paper turns modeling attack flow extraction into a process of blind sources separation. A method is proposed based on fast ICA (Independent Component Analysis) to detach RoQ flow from several observation network devices and terminals. Then, some features’ parameters that represent attack flow are extracted. After that, a system of collaborative detection system is designed on the basis of SVM (Support Vector Machine), using marked attack and no-attack samples to train the SVM classifier in order to detect RoQ attack finally. Simulation results illustrate that this method can detect IP spoofed RoQ attack as well as locate the attacker, accuracy of which reaches up to 90%. Moreover, choosing appropriate ICA parameters will improve results to some extent.
荣宏, 王会梅, 鲜明, 施江勇. 基于快速独立成分分析的RoQ攻击检测方法[J]. 电子与信息学报, 2013, 35(10): 2307-2313.
Rong Hong, Wang Hui-Mei, Xian Ming, Shi Jiang-Yong. A Novel Method for Detecting Reduction of Quality (RoQ) Attack Based on Fast Independent Component Analysis. , 2013, 35(10): 2307-2313.
2013, Vol. 35 
