Detecting DDoS attacks based on multi-stream combined HMM in source-end network
Yuan Zhang · Journal of Computer Applications · 2007
A new approach for DDoS attacks detection was proposed in source-end network.This approach used Multi-stream Combined Hidden Markov Model(MC-HMM) for integrating multi-features simultaneously.The multi-features included the S-D-P feature,TCP header control flags,and IP header ID field.Experiments show that the approach effectively reduces false-positive rate and false-negative rate, and detection precision of MC-HMM based on multiple detection features is clearly higher than that of the algorithms based on single-feature.