International Journal of Network Security & Its Applications (IJNSA) - ERA Listed

International Journal of Network Security & Its Applications (IJNSA) - ERA Listed

ISSN: 0974 - 9330 (Online); 0975 - 2307 (Print)

http://airccse.org/journal/ijnsa.html

Use of MARKOV Chain for Early Detecting DDoS Attacks

Chin-Ling Chen1 and Jian-Ming Chen2, 1National Pingtung University, Taiwan, 2Genesis Technology, Inc., Taiwan

ABSTRACT

DDoS has a variety of types of mixed attacks. Botnet attackers can chain different types of DDoS attacks to confuse cybersecurity defenders. In this article, the attack type can be represented as the state of the model. Considering the attack type, we use this model to calculate the final attack probability. The final attack probability is then converted into one prediction vector, and the incoming attacks can be detected early before IDS issues an alert. The experiment results have shown that the prediction model that can make multi-vector DDoS detection and analysis easier.

KEYWORDS

DDoS, attack detection, Markov chain, TCP SYN flood, ICMP flood, HTTP flood, LAND, UDP flood.

Abstract URL: http://aircconline.com/abstract/ijnsa/v13n4/13421ijnsa01.html

Original Source URL: https://aircconline.com/ijnsa/V13N4/13421ijnsa01.pdf

Volume URL: https://airccse.org/journal/jnsa21_current.html