A DDoS Attack Detection Method Based on Hidden Markov Model
Zunguo Huang · Microelectronics & Computer · 2006
On the basis of the inherent feature of distributed denial of service (DDoS) attacks, a novel approach of detection of DDoS attacks based on hidden Markov model (HMM) is proposed. We first build an IP addresses database, which keeps all the legitimate IP addresses which have previously appeared in the network, and then established HMM, which is based on the new IP addresses of normal network data packet. HMM and IP address database is trained separately though off-line training. The model is then used to detect the DDoS attacks by processing the network traffic and the edge router is used to decide whether to admit an incoming IP packet. Experimental results show that this method works very well on the DDoS attacks in adaptability and detection accuracy.