DDoS attack detection method based on HMM and chaos model

Abstract

An embodiment of the invention discloses a DDoS attack detection method based on HMM and chaos model. The method comprises the following steps: acquiring network traffic information as an HMM trainingset; calculating to obtain a network traffic weighting feature observation sequence and a network flow average speed sequence; calculating the optimal number N of implicit strata states according tothe HMM training set; classifying the HMM training set into N types by a hierarchical clustering algorithm to obtain an implicit strata state sequence; performing supervised learning of HMM by use ofthe network traffic weighting feature observation sequence and the implicit strata state sequence, to obtain a state transfer matrix and a confusion matrix; calculating follow-up network traffic weighting features according to the state transfer matrix and the confusion matrix, to obtain a follow-up network traffic weighting feature prediction sequence; calculating a prediction error sequence of the follow-up network traffic weighting feature prediction sequence according to a chaos model; identifying DDoS attack according to the prediction error sequence and the network flow average speed sequence.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to a DDoS attack detection method based on HMM and chaos model. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, DDoS) attack is an attack method often used by hackers and difficult to prevent. In recent years, with the rapid development of electronic encrypted virtual currency and the continuous increase of Internet of Things devices, DDoS attack methods have become more diversified, posing a huge threat to Internet security. [0003] The existing technology of DDoS attack detection based on machine learning is usually regarded as a binary classification problem. Representative features are selected from network traffic, and the feature sequences of attack traffic and normal traffic are respectively abstracted, and the sequence Each feature in is given a mark: attack or normal; then use the feature sequence to train the detection mo...

AI Technical Summary

Problems solved by technology

This type of DDoS attack detection directly infers the mark of the sample based on the current feature value, without considering the relationship between adjacent moments and features on the entire time axis, thus losing part of the information, resulting in low accuracy of DDoS attack detection

Images