A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors

被引：152

作者：

Xie, Yi ^{[1
]}

Yu, Shun-Zheng ^{[1
]}

机构：

[1] Sun Yat Sen Univ, Dept Elect & Commun Engn, Guangzhou 510275, Guangdong, Peoples R China

来源：

IEEE-ACM TRANSACTIONS ON NETWORKING | 2009年 / 17卷 / 01期

基金：

国家高技术研究发展计划(863计划);

关键词：

Anomaly detection; browsing behaviors; DDoS; hidden semi-Markov Model; M-algorithm; DDOS ATTACKS;

D O I：

10.1109/TNET.2008.923716

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

Many methods designed to create defenses against distributed denial of service (DDoS) attacks are focused on the IP and TCP layers instead of the high layer. They are not suitable for handling the new type of attack which is based on the application layer. In this paper, we introduce a new scheme to achieve early attack detection and filtering for the application-layer-based DDoS attack. An extended hidden semi-Markov model is proposed to describe the browsing behaviors of web surfers. In order to reduce the computational amount introduced by the model's large state space, a novel forward algorithm is derived for the online implementation of the model based on the M-algorithm. Entropy of the user's HTTP request sequence fitting to the model is used as a criterion to measure the user's normality. Finally, experiments are conducted to validate our model and algorithm.

引用

页码：54 / 65

页数：12

共 26 条

[1] SEQUENTIAL CODING ALGORITHMS - A SURVEY AND COST-ANALYSIS [J].

ANDERSON, JB .

IEEE TRANSACTIONS ON COMMUNICATIONS, 1984, 32 (02) :169-176

[2]

BASU R, 2001, P 2001 IEEE WORKSH I, P5

[3] User centric walk:: An integrated approach for modeling the browsing behavior of users on the Web [J].

Bürklen, S ;

Marrón, PJ ;

Fritsch, S ;

Rothermel, K .

38TH ANNUAL SIMULATION SYMPOSIUM, PROCEEDINGS, 2005, :149-159

[4]

Cabrera J. B. D., 2001, 2001 IEEE/IFIP International Symposium on Integrated Network Management Proceedings. Integrated Network Management VII. Integrated Management Strategies for the New Millennium (Cat. No.01EX470), P609, DOI 10.1109/INM.2001.918069

[5]

CAO J, P IEEE INFOCOM 2004, V3, P1546

[6] Defending against flooding-based distributed denial-of-service attacks: A tutorial [J].

Chang, RKC .

IEEE COMMUNICATIONS MAGAZINE, 2002, 40 (10) :42-51

[7] Modelling and predicting web page accesses using Markov processes [J].

Dhyani, D ;

Bhowmick, SS ;

Ng, WK .

14TH INTERNATIONAL WORKSHOP ON DATABASE AND EXPERT SYSTEMS APPLICATIONS, PROCEEDINGS, 2003, :332-336

[8] DDoS attacks and defense mechanisms: classification and state-of-the-art [J].

Douligeris, C ;

Mitrokotsa, A .

COMPUTER NETWORKS, 2004, 44 (05) :643-666

[9]

Hoang XD, 2003, ICON 2003: 11TH IEEE INTERNATIONAL CONFERENCE ON NETWORKS, P531

[10]

JIN C., 2003, CCS '03, P30

← 1 2 3 →