• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

Computer Engineering & Science

Previous Articles     Next Articles

A DDoS attack detection method based on
HMM time series prediction and chaos model

DONG Zhe1,TANG Xiangyan1,CHENG Jieren1,2,ZHANG Chen1,LIN Fusheng1   

  1. (1.College of Information Science and Technology,Hainan University,Haikou 570228;
    2.State Key Laboratory of Marine Resource Utilization in South China Sea,Hainan University,Haikou 570228,China)
     
  • Received:2018-07-16 Revised:2018-09-10 Online:2018-12-25 Published:2018-12-25

Abstract:

The distributed denial of service (DDoS) attack is one of the most destructive attacks in the network environment. Existing attack detection algorithms based on machine learning often use the eigenvalues of a time to be classified to perform classification. However, the correlation with the features of its adjacent time is not taken into account. The false positive rate and false negative rate therefore are high. We propose a DDoS attack detection method based on hidden Markov model (HMM) time series prediction and chaos model. Aiming at the burstiness of mass attack traffic, we firstly define the network traffic weighted features (NTWF) and network flow average rate (NFAR) to describe the features of network traffic. Then, we use the hierarchical clustering algorithm to classify training sets to get the hidden layer state (HLS) sequences. We employ the NTWF sequence and HLS sequence to conduct supervised learning of the HMM, and predict the NTWF sequence by the state transition matrix and confusion matrix obtained before. Finally, we analyze the prediction error of NTWF sequences by the chaotic model, which is combined with the NFARbased rules, to distinguish attack behavior. Experimental results show that compared with similar methods, the propose method has lower false positive rate and false negative rate.
 

Key words: DDoS, attack detection, hidden Markov model, chaos analysis, time series