Abstract— Distributed Denial of Service (DDoS) remains a serious problem in cyber security. Some recent DDoS incidents show that such attacks continue to cause serious threats to the Internet. It does not allow the legitimate users to access the resources provided by the servers. With the growth in technology, the DDoS attackers have improved their sophistication, by automating the attacks. The attackers exploit the protocol vulnerabilities to create these kinds of DDoS attacks. The detection of DDoS attack is complicated, since they mix with the legitimate packet traffic. Later separation of DDoS attack packets from legitimate packet is highly difficult, since false DDoS alarm may lead to blocking a legitimate packet. The rate of arrival of the packets is very high in the case of DDoS attack; it’s the same in the case of the flash crowd. This makes the detection of DDoS even more difficult. The proposed model uses the Hidden Semi-Markov model (HSMM) which is an extension of the Hidden Markov model (HMM) deals with explicit state duration. In this model using HSMM observations are performed in milliseconds for the analysis of network traffic flow packets, this result in optimal detection and mitigation of DDoS attack.

Index Terms— DDoS, flooding attack, TCP SYN flooding, HSMM, TCP retransmission, stochastic finite state machine.

L. Kavisankar, C. Chellappan, and R. Vaishnavi are with the Department of Computer Science and Engineering, Anna University, Chennai 600025, India (e-mail: kavisankaar@gmail.com, drcc@annauniv.edu, vaishnavigpl35@gmail.com).

Cite: L. Kavisankar, C. Chellappan, and R. Vaishnavi, " Network Layer DDoS Mitigation Model Using Hidden Semi-Markov Model," International Journal of e-Education, e-Business, e-Management and e-Learning vol. 4, no. 1, pp. 42-46, 2014.