A large scale hidden semi-markov model for anomaly detection on user browsing behaviors
1. 2020 – 2021
#13/ 19, 1st Floor, Municipal Colony, Kangayanellore Road, Gandhi Nagar, Vellore – 6.
Off: 0416-2247353 Mo: +91 9500218218 / +91 8220150373
Website: www.shakastech.com, Email - id: shakastech@gmail.com, info@shakastech.com
A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User
Browsing Behaviors
Abstract :
Many methods designed to create defenses against distributed denial of service (DDoS) attacks are
focused on the IP and TCP layers instead of the high layer. They are not suitable for handling the
new type of attack which is based on the application layer. In this paper, we introduce a new
scheme to achieve early attack detection and filtering for the application-layer-based DDoS attack.
An extended hidden semi-Markov model is proposed to describe the browsing behaviors of web
surfers. In order to reduce the computational amount introduced by the model's large state space,
a novel forward algorithm is derived for the online implementation of the model based on the M-
algorithm. Entropy of the user's HTTP request sequence fitting to the model is used as a criterion
to measure the user's normality. Finally, experiments are conducted to validate our model and
algorithm.