Ddos Attack Detection Method Based on HMM and Chaos Model

Abstract

The embodiment of the present invention provides a DDoS attack detection method based on HMM and chaos model, comprising: collecting network traffic information as an HMM training set; calculating the network traffic weighted characteristic observation sequence and network flow average rate sequence; according to the HMM training set, calculating The optimal hidden layer state number N of HMM; The HMM training set is divided into N classes using a hierarchical clustering algorithm to obtain a hidden layer state sequence; using the network traffic weighted feature observation sequence and the hidden layer state sequence, the HMM performs supervised learning to obtain a state transition matrix and a confusion matrix; calculate subsequent network traffic weighted features according to the state transition matrix and the confusion matrix, and obtain a subsequent network traffic weighted feature prediction sequence; calculate the subsequent network through a chaos model A prediction error sequence of the flow weighted feature prediction sequence; identifying a DDoS attack by using the prediction error sequence and the network flow average rate sequence.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to a DDoS attack detection method based on HMM and chaos model. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, DDoS) attack is an attack method often used by hackers and difficult to prevent. In recent years, with the rapid development of electronic encrypted virtual currency and the continuous increase of Internet of Things devices, DDoS attack methods have become more diversified, posing a huge threat to Internet security. [0003] The existing technology of DDoS attack detection based on machine learning is usually regarded as a binary classification problem. Representative features are selected from network traffic, and the feature sequences of attack traffic and normal traffic are respectively abstracted, and the sequence Each feature in is given a mark: attack or normal; then use the feature sequence to train the detection mo...

AI Technical Summary

Problems solved by technology

This type of DDoS attack detection directly infers the mark of the sample based on the current feature value, without considering the relationship between adjacent moments and features on the entire time axis, thus losing part of the information, resulting in low accuracy of DDoS attack detection

Images