基于Multi-stream Combined隐马尔柯夫模型源端检测DDoS攻击

提出了一种新颖的综合考虑多维观测特征的DDoS攻击源端检测方法。该方法引入S-D-P特征概念，并抽取TCP/IP包头中的标志位和ID字段构成多维观测特征，采用Multi-stream Combined隐马尔可夫模型（MC-HMM）在源端网络检测DDoS攻击。大量实验表明,MC-HMM方法克服了基于一维观测特征的检测算法信息量过小的固有缺陷，能够有效降低检测的误报率和漏报率，提高DDoS攻击源端检测精度。

Detecting DDoS attacks based on multi-stream combined HMM in source-end network

A new approach for DDoS attacks detection was proposed in source-end network. This approach used Multi-stream Combined Hidden Markov Model (MC HMM) for integrating multi-features simultaneously. The multi-features included the S-D-P feature, TCP header control flags, and IP header ID field. Experiments show that the approach effectively reduces false positive rate and false negative rate, and detection precision of MC-HMM based on multiple detection features is clearly higher than that of the algorithms based on single-feature.