Hierarchical network threat situation assessment method for DDoS based on D-S evidence theory

In order to effectively evaluate the impact on network situation under DDoS attacks, this paper proposes a hierarchical network threat situation assessment method based on D-S evidence theory for DDoS. It is divided into the basic data acquisition layer, the metric indexes extraction layer, the device threat assessment layer and the threat situation assessment layer. Firstly, we calculate indexes that represent degrees of host resources consumption and qualities of network from the basic running data. Next, the D-S evidence theory is used to fuse above indexes, which assesses impact on the network of each device caused by DDoS attacks. Then, on the basis of service importance principle, we calculate the weight value of each device in the network. Furthermore, the threat situation value is obtained through weighted algorithm. Finally, experimental results show that the proposed method can vividly reflect the impact of DDoS attacks on the network security threat situation. Keywords-component; DDoS attack; hierarchical; threat situation assessment; D-S theory; service importance principle