Detecting ddos attacks based on multistream fused hmm in source-end network

Abstract. DDoS (Distributed Denial-of-Service) attacks detection sys-tem deployed in source-end network is superior in detection and pre-vention than that in victim network, because it can perceive and throt-tle attacks before data flow to Internet. However, the current existed works in source-end network lead to a high false-positive rate and false-negative rate for the reason that they are based on single-feature, and they couldn’t synthesize multi-features simultaneously. This paper pro-poses a novel approach using Multi-stream Fused Hidden Markov Model (MF-HMM) on source-end DDoS detection for integrating multi-features simultaneously. The multi-features include the S-D-P feature, TCP header Flags, and IP header ID field. Through experiments, we compared our original approach based on multiple detection feature with other main algorithms (such as CUSUM and HMM) based on single-feature. The results present that our approach effectively reduces false-positive rate and false-negative rate, and improve the precision of detection.