Anomaly Detection for DDoS Attacks via Behavior Profiles Deviation Degree

Distributed Denial-of-Service (DDoS) attacks present a very serious threat to the stability of the Internet. In this paper, an anomaly detection method for DDoS attacks via Behavior Profiles Deviation Degree (BPDD) is proposed. First, the behavior, profiles of normal traffic and real-time traffic are constructed using Markov Chain respectively, and then BPDD is designed to measure the discrepancy of the two profiles. Furthermore, TCM-KNN (Transductive Confidence Machines for K-Nearest Neighbors) algorithm is applied to identify attacks by classifying the BPDD samples. The experimental results demonstrate that the proposed method can effectively distinguish normal traffic from DDoS attacks, and has higher detection ratio and lower false alarm ratio than traditional detection methods.