doi: 10.4304/jsw.9.4.985-990
Mining Web User Behaviors to Detect Application Layer DDoS Attacks
- 1 Department of Automation, USTC Key laboratory of network communication system and control Hefei, China
- 2 Institute of Acoustics, Chinese Academy of Sciences National Network New Media Engineering Research Center Beijing, China
Abstract
Distributed Denial of Service (DDoS) attacks have caused continuous critical threats to the Internet services. DDoS attacks are generally conducted at the network layer. Many DDoS attack detection methods are focused on the IP and TCP layers. However, they are not suitable for detecting the application layer DDoS attacks. In this paper, we propose a scheme based on web user browsing behaviors to detect the application layer DDoS attacks (app-DDoS). A clustering method is applied to extract the access features of the web objects. Based on the access features, an extended hidden semi-Markov model is proposed to describe the browsing behaviors of web user. The deviation from the entropy of the training data set fitting to the hidden semi-Markov model can be considered as the abnormality of the observed data set. Finally experiments are conducted to demonstrate the effectiveness of our model and algorithm.
Keywords
- HsMM
- web user behaviors
- DDoS
- DDoS Att
How to Cite
Chuibi Huang, Jinlin Wang, Gang Wu, and Jun Chen, "Mining Web User Behaviors to Detect Application Layer DDoS Attacks," Journal of Software, vol. 9, no. 4, pp. 985-990, 2014. https://doi.org/ 10.4304/jsw.9.4.985-990
Copyright & License
Copyright © 2014 by the authors. This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited (CC BY 4.0).