DDoS attack detection based on hidden Markov and Q-learning cooperation

Abstract

The invention discloses a DDoS attack detection based on hidden Markov and Q-learning cooperation. The method comprises the following steps: by combining related theory of the hidden Markov model, proposing a DDoS attack detection based on hidden Markov model and TCP connection state combination on the basis of the existing detection method; firstly capturing different historic data from a networkdata stream, wherein the historic data comprises normal data traffic and the data traffic suffering from the DDoS attack; respectively acquiring TCP connection states of a network transmission unit,an attacker and a target host, and learning model parameters, thereby enabling the Hidden Markov model to accurately describe a state sequence of the network data stream dynamic TCP connection; on thebasis of a single-point detection model, proposing a detection method based on distributed cooperation Q learning for the problem in the distributed detection by combining the related theory of the Qlearning in the reinforcement learning. Through the experiment contrast analysis, the communication quantity among various detection points in the system is reduced, and running efficiency of the system is improved.

Description

technical field [0001] The invention relates to a DDoS attack detection method based on hidden Markov and Q learning cooperation, belongs to the field of machine learning information security, and relates to the combination and use of machine learning classification algorithms and Q learning algorithms in reinforcement learning. Background technique [0002] The traditional denial of service (Denial of Service, DoS) refers to the creation of a large number of data packets flowing into the target host through malicious network access, illegal requests and accesses, malicious occupation of network bandwidth and system resources for the purpose of consuming system resources, and ultimately make the A denial-of-service attack caused by the target system causing congestion so that the target system cannot provide services to its legitimate users. Distributed Denial of Service attack (Distributed Denial of Service, DDoS) consists of four parts, that is, the attack master control p...

AI Technical Summary

Problems solved by technology

[0004] DDoS attacks will cause changes in traffic flow, number distribution of access protocols, proportion of data packets of different types of the same protocol, number and distribution of access source addresses, and data packet header information at the network layer level, and lead to link congestion and data transmission. The delay is greatly increased

There are two main problems in the flow-based detection method: first, the threshold setting, which is set according to the network traffic under long-term monitoring of the normal condition of the network.

Anomaly-based detection methods are often combined with artificial intelligence and automatic control theory to detect unknown types of attacks, but the detection accuracy is relatively low, which is a hot spot in the current intrusion detection system research

In terms of response means, the existing response method is generally to interrupt the suspected network connection, but it is easy to cause incomplete response, reduce the service quality of normal service, etc.

Images