A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors

Many methods designed to create defenses against distributed denial of service (DDoS) attacks are focused on the IP and TCP layers instead of the high layer. They are not suitable for handling the new type of attack which is based on the application layer. In this paper, we introduce a new scheme to achieve early attack detection and filtering for the application-layer-based DDoS attack. An extended hidden semi-Markov model is proposed to describe the browsing behaviors of web surfers. In order to reduce the computational amount introduced by the model´s large state space, a novel forward algorithm is derived for the online implementation of the model based on the M-algorithm. Entropy of the user´s HTTP request sequence fitting to the model is used as a criterion to measure the user´s normality. Finally, experiments are conducted to validate our model and algorithm.