Identifying High-Distributed Low-Rate QoS Violation Based on Multi-Stream Fused HMM

Abstract:

In order to maintain high network QoS (quality of service) against new high-distributed low-rate QoS violation, this paper proposes a novel recognition scheme with the consideration of multiple network features in both macro and micro side. This scheme uses Multi-stream Fused Hidden Markov Model (MF-HMM) in automatic low-rate QoS violation recognition for integrating multi-features simultaneously. The multi-features include the I-I-P triple and TCP header control Flag in a data packet at a micro level, and R feature in network flow at a macro level. In addition, based on the successful experience of Load-Shedding, Kaufman algorithm is used to adjust and upgrade threshold value dynamically. Our experiments show that our approach effectively reduces false-positive rate and false-negative rate. Moreover, it has a high recognition rate specifically for new QoS violation by High-Distributed Low-rate Denial of Service attacks.

• Periodical: Applied Mechanics and Materials (Volumes 519-520)
• Pages: 245-249
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.519-520.245
• Online since: February 2014
• Authors: Mei Yang, Jian Kang*
• Keywords: Kaufman Algorithm, Multi-Stream Fused HMM, Network QoS

References

[1] A. Kuzmanovic, E. W. Knightly. Low-rate TCP-targeted denial of service attacks: the shrew vs. the mice and elephants. In: Proceedings of Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. Karlsruhe, Germany: IEEE, 2003. 75-86.

DOI: 10.1145/863955.863966

[2] M. Guirguis, A. Bestavros, I. Matta. Exploiting the transients of adaptation for RoQ attacks on internet resources. In: Proceedings of 12th IEEE International Conference on Network Protocols. Berlin, Germany: IEEE, 2004. 184-195.

DOI: 10.1109/icnp.2004.1348109

[3] X. Luo,R. K. C. Chang. On a new class of pulsing denial-of-service attacks and the defense. In: Proceedings of Network and Distributed System Security Symposium. San Diego, USA: IEEE, 2005. 1-19.

[4] A. Shevtekar, K. Anantharam, N. Ansari. Low rate TCP denial-of-service attack detection at edge routers. IEEE Communications Letters, 2005, 9(4): 363-365.

DOI: 10.1109/lcomm.2005.1413635

[5] Y. Chen , K. Hwang. Collaborative detection and filtering of shrew DDoS attacks using spectral analysis. Journal of Parallel and Distributed Computing, 2006, 66(9): 1137-1151.

DOI: 10.1016/j.jpdc.2006.04.007

[6] Zhu Lina , Zhu Dongzhao. A Router-based Technique to Detect and Defend against Low-rate Denial of Service. In: Proceedings of 2009 International Symposium on Web Information Systems and Applications. Nanchang, P. R. China: IEEE, 2009. 257-260.

[7] Sun ZX, Li QD. Defending DDos attacks based on the source and destination IP address database. Journal of Software, 2007, 18(10): 2613-2623.

DOI: 10.1360/jos182613

[8] Zeng Z, Tu J, Pianfetti. Audio-visual affect recognition through multi-stream fused HMM for HCI. In: Proceedings of IEEE Computer Society Conference on Computer Vision and Pattern Recognition. San Diego, USA: IEEE, 2005. 967- 972.

DOI: 10.1109/cvpr.2005.77

[9] Rabiner L R. A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition. In: Proceedings of IEEE. USA: IEEE, 1989. 77(2): 257-286.

DOI: 10.1109/5.18626

[10] Dongqing Zhou, Haifeng Zhang. A DDoS Attack Detection Method Based on Hidden Markov Model. Journal of Computer Research and Development, 2005, 42(9): 1594-1599.

DOI: 10.1360/crad20050921

[11] Mirkovic J, Reiher P. D-WARD: a source-end defense against flooding denial-of-service attacks. IEEE Transactions on Dependable and Secure Computing, 2005, 2(3): 216-232.

DOI: 10.1109/tdsc.2005.35

[12] S Kasera, J Pinheiro, C Loader, M Karaul, A Hari, T LaPorta. Fast and robust signaling overload control. In: Proceedings of Ninth International Conference on Network Protocols, Riverside, USA: IEEE, 2001. 323-331.

DOI: 10.1109/icnp.2001.992913