| 隐马尔科夫模型检测LDoS攻击方法的研究 |
| |
| 引用本文： | 岳猛,张才峰,吴志军. 隐马尔科夫模型检测LDoS攻击方法的研究[J]. 信号处理, 2015, 31(11): 1454-1460 |
| |
| 作者姓名： | 岳猛 张才峰 吴志军 |
| |
| 作者单位： | 天津大学电子信息工程学院 |
| |
| 基金项目： | 国家自然科学基金（61170328）；中央高校基本科研基金（3122013D003） |
| |
| 摘 要： | 针对低速率拒绝服务LDoS （Low-Rate Denial of Service）攻击具有平均速率低、隐蔽性强的特点，提出了一种基于隐马尔科夫模型的LDoS攻击检测方法。首先对网络状态建立隐马尔科夫模型，将归一化累计功率谱密度NCPSD（Normalized Cumulative Power Spectrum Density）方法的检测结果作为隐马尔科夫模型的观测值。利用前向算法得到不同观测值序列在该模型下的相似度作为检测依据。在NS 2中对本检测方法进行测试，实验结果表明本方法能够有效的检测LDoS攻击，与其他方法相比也具有更好的检测性能。通过假设检验得出检测率为99.96%。
|
| 关 键 词： | 低速率拒绝服务攻击 隐马尔科夫模型 假设检验 异常检测 |
| 收稿时间： | 2015-05-27 |
The Research of Detecting Low-Rate DoS attacks Based onHidden Markov Model |
| |
| Affiliation: | School of Electronic Information Engineering, Tianjin UniversityTianjin Key Lab for Advanced Signal Processing, Civil Aviation University of China |
| |
| Abstract: | An HMM-based (Hidden Markov Model) approach is proposed to detect LDoS attacks which have the characteristics of low average rate and strong concealment. The HMM of network state is established, and then the detection results of NCPSD (Normalized Cumulative Power Spectrum Density) approach are treated as the observe values of HMM. The similarity of observation sequence is obtained by forward algorithm, and is applied as the measurement for detecting LDoS attacks. Test results of NS-2 simulation experiments indicate that the proposed detection approach can detect LDoS attacks effectively, and outperforms other detection approaches in terms of better detection performance. Finally, 99.96% detection probability is obtained by hypothesis testing. |
| |
| Keywords: | |
|
| 点击此处可从《信号处理》浏览原始摘要信息 |
|
点击此处可从《信号处理》下载免费的PDF全文 |
