DDoS detection has been the research focus in the field of information security. Existing detecting methods such as Hurst parameter method and Markov model must ensure that the network traffic signal f(t) is a stationary signal. But its stability is just a regular assumption and has no strict mathematical proof. Therefore methods mentioned above lack of reliable theoretical support. This article introduces Hilbert-HuangTtransformation(HHT) . HHT does not need to be based on signal stability,but it monitors the similarity between Hilbert marginal spectrums of adjacent observation sequences so as to realize DDoS detection. The method is experimented on DARPA 1999 data and simulating data respectively. Experimental results show that the method behaves better than existing Hurst parameter method in distinguishing both the normal and the attacked traffic.
展开▼
