隐马尔科夫模型检测LDoS攻击方法的研究  

The Research of Detecting Low-Rate Do S Attacks Based on Hidden Markov Model

作　　者：岳猛[1,2] 张才峰 吴志军[1,2] 

机构地区：[1]天津大学电子信息工程学院,天津300072 [2]中国民航大学天津市智能信号与图像处理重点实验室,天津300300

出　　处：《信号处理》2015年第11期1454-1460,共7页Journal of Signal Processing

基　　金：国家自然科学基金(61170328);中央高校基本科研基金(3122013D003)

摘　　要：针对低速率拒绝服务LDo S(Low-Rate Denial of Service)攻击具有平均速率低、隐蔽性强的特点,提出了一种基于隐马尔科夫模型的LDo S攻击检测方法。首先对网络状态建立隐马尔科夫模型,将归一化累计功率谱密度NCPSD(Normalized Cumulative Power Spectrum Density)方法的检测结果作为隐马尔科夫模型的观测值。利用前向算法得到不同观测值序列在该模型下的相似度作为检测依据。在NS-2中对本检测方法进行测试,实验结果表明本方法能够有效的检测LDo S攻击,与其他方法相比也具有更好的检测性能。通过假设检验得出检测率为99.96%。An HMM-based（ Hidden Markov Model） approach is proposed to detect LDo S attacks which have the characteristics of low average rate and strong concealment. The HMM of network state is established,and then the detection results of NCPSD（ Normalized Cumulative Power Spectrum Density） approach are treated as the observe values of HMM. The similarity of observation sequence is obtained by forward algorithm,and is applied as the measurement for detecting LDo S attacks. Test results of NS-2 simulation experiments indicate that the proposed detection approach can detect LDo S attacks effectively,and outperforms other detection approaches in terms of better detection performance. Finally,99. 96% detection probability is obtained by hypothesis testing.

关 键 词：低速率拒绝服务攻击 隐马尔科夫模型 假设检验 异常检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]