An Improvement on Precision in DDoS Source-end Detection with Multi-stream Combined HMM

摘要

DDoS (Distributed Denial-of-Service) attacks detection system deployed in source-end network is superior in perceiving and throttling attacks before data flows enter Internet,comparing with that in victim network.However,the current existed works in sourceend network are so fragile,lead to a high false-positive rate and false-negative rate.This paper proposes a novel approach using Multi-stream combined Hidden Markov Model (MC-HMM) on source-end DDoS detection for integrating multi-features simultaneously.The multi-features include the S-D-P three-tuple,TCP header Flags,and IP header ID field.Through experiments,we compared our original approach based on multiple detection features with other algorithms (such as CUSUM and HMM).The results present that our approach effectively reduces falsepositive rate and false-negative rate,and improves the precision of detection.