Sequential Markov Model Based Change Point Analysis

Distributed denial of service attacks has become a popular attack for deploying internet crimes. Although patterns, labels, training dataset based detection techniques are accurate, they could be useless when high ooding attacks are encountered. Therefore, technical and mathematical approach for Markov model based Internet trace analysis become attractive due to their ability to detect ooding attacks and even heavy unknown oods. In this paper, we propose a Markov model based on internet tra_c analysis. We intend to detect the unusual attack behavior changes by inspecting Serial Markovian.. Our proposed method uses Binomial Distribution (BD) approach to calculate Window Size based on state and transition structures of Markov model. It analyzes the Inter Packet Time (IPT) and Packet Size (PS) and shows the good results in terms of Lognormal Distribution and Binomial Distribution. Performance evaluation results based on simulated tra_c traces shows that the proposed method can reduce more than 85 percentage input raw packet traces and achieve a high detection rate (about 95 percentage) and a low false positive rates (1.08 Percentage).