基于HMM时间序列预测和混沌模型的DDoS攻击检测方法

A DDoS attack detection method based on HMM time series prediction and chaos model

分布式拒绝服务(DDoS)攻击是网络环境中最具破坏力的攻击方式之一,现有基于机器学习的攻击检测方法往往直接将某时刻的特征值代入分类器进行分类,没有考虑相邻时刻特征之间的联系,因而导致误报率和漏报率较高。提出一种基于隐马尔科夫模型HMM时间序列预测和混沌模型的DDoS攻击检测方法。针对大规模攻击网络流量的突发性,定义网络流量加权特征NTWF和网络流平均速率NFAR二元组来描述网络流量的特点;然后采用层次聚类算法对训练集进行分类,以获取隐层状态HLS序列,利用NTWF序列和HLS序列对HMM进行监督学习获得状态转移矩阵和混淆矩阵,以预测NTWF序列;最后通过混沌模型分析NTWF序列的预测误差,结合基于NFAR的规则来识别攻击行为。实验结果表明,与同类方法相比,所提方法具有较低的误报率和漏报率。

The distributed denial of service(DDoS)attack is one of the most destructive attacks in the network environment.Existing attack detection algorithms based on machine learning often use the eigenvalues of a time to be classified to perform classification.However,the correlation with the features of its adjacent time is not taken into account.The false positive rate and false negative rate therefore are high.We propose a DDoS attack detection method based on hidden Markov model(HMM)time series prediction and chaos model.Aiming at the burstiness of mass attack traffic,we firstly define the network traffic weighted features(NTWF)and network flow average rate(NFAR)to describe the features of network traffic.Then,we use the hierarchical clustering algorithm to classify training sets to get the hidden layer state(HLS)sequences.We employ the NTWF sequence and HLS sequence to conduct supervised learning of the HMM,and predict the NTWF sequence by the state transition matrix and confusion matrix obtained before.Finally,we analyze the prediction error of NTWF sequences by the chaotic model,which is combined with the NFAR-based rules,to distinguish attack behavior.Experimental results show that compared with similar methods,the propose method has lower false positive rate and false negative rate.