隐马尔科夫模型检测LDoS攻击方法的研究

针对低速率拒绝服务LDoS （Low-Rate Denial of Service）攻击具有平均速率低、隐蔽性强的特点，提出了一种基于隐马尔科夫模型的LDoS攻击检测方法。首先对网络状态建立隐马尔科夫模型，将归一化累计功率谱密度NCPSD（Normalized Cumulative Power Spectrum Density）方法的检测结果作为隐马尔科夫模型的观测值。利用前向算法得到不同观测值序列在该模型下的相似度作为检测依据。在NS 2中对本检测方法进行测试，实验结果表明本方法能够有效的检测LDoS攻击，与其他方法相比也具有更好的检测性能。通过假设检验得出检测率为99.96%。 

The Research of Detecting Low-Rate DoS attacks Based onHidden Markov Model

An HMM-based (Hidden Markov Model) approach is proposed to detect LDoS attacks which have the characteristics of low average rate and strong concealment. The HMM of network state is established, and then the detection results of NCPSD (Normalized Cumulative Power Spectrum Density) approach are treated as the observe values of HMM. The similarity of observation sequence is obtained by forward algorithm, and is applied as the measurement for detecting LDoS attacks. Test results of NS-2 simulation experiments indicate that the proposed detection approach can detect LDoS attacks effectively, and outperforms other detection approaches in terms of better detection performance. Finally, 99.96% detection probability is obtained by hypothesis testing.