The Research of Detecting Low-Rate DoS attacks Based onHidden Markov Model

An HMM-based (Hidden Markov Model) approach is proposed to detect LDoS attacks which have the characteristics of low average rate and strong concealment. The HMM of network state is established, and then the detection results of NCPSD (Normalized Cumulative Power Spectrum Density) approach are treated as the observe values of HMM. The similarity of observation sequence is obtained by forward algorithm, and is applied as the measurement for detecting LDoS attacks. Test results of NS-2 simulation experiments indicate that the proposed detection approach can detect LDoS attacks effectively, and outperforms other detection approaches in terms of better detection performance. Finally, 99.96% detection probability is obtained by hypothesis testing.