Internet security and quality-of-service provision via machine-learning theory
C.‐C. Jay Kuo, Jeung Hun Park · 2006
To detect DoS (Denial-of-Service) attacks, two mechanisms based on traffic pattern monitoring using HMMs (Hidden Markov Model) and multiple Markov models are proposed in this research. To effectively design a detector against the TCP SYN flooding attack, we first analyze the dynamic behavior of real world attacks and then propose a stateful HMM detector to achieve early detection with high accuracy. Multiple HMMs can achieve the advantages of misuse detection and anomaly detection by training them differently. With the stateful mechanism, the impact of background noise due to the protocol behavior can be mitigated. We compare the proposed HMM detector with the stateless Cumulative Sum (CUSUM) and the stateful CUSUM detector using trace-driven simulations. Simulation results show that the proposed HMM detector provides earlier detection time and a higher detection rate under the same false alarm rate. Furthermore, we develop a detector using multiple Markov models to detect the UDP flooding attack in wireless networks. The high-rate attack using UDP can be detected easily since there are few legitimate users using UDP in the network. However, it is difficult to detect subtle UDP flooding attacks since there are many UDP-based applications with a dynamic traffic rate. A Markov model is used to characterize the traffic pattern. Multiple Markov models are trained with normal traffic and some deviations from the normal traffic, and they are integrated into a single detector. The proposed detector is compared with the batch-sequential detection algorithm in terms of the false alarm rate and detection latency. Finally, to support various Internet services such as QoS, security, and accounting, the Internet traffic classification problem is studied. The proposed classification process consists of two steps: feature selection and classification. Candidate features that can be easily obtained by ISPs are considered. Then, we perform feature reduction to balance the performance and complexity. Decision trees are adopted as classifiers. It is demonstrated by simulations with real data that the proposed classification scheme outperforms existing techniques.