中文摘要：

应用层分布式拒绝服务攻击严重威胁承载网络应用与服务的服务器．传统服务器端检测方法的主要问题是难以刻画非稳态网站的用户访问行为，也无法动态跟踪正常用户的行为变化，导致误检率随时间推移逐渐增高．提出一种动态的用户行为模型，并应用于诊断基于HTTP协议的分布式拒绝服务攻击．该方法采用半马尔可夫链描述正常用户行为．模型通过有监督的前后向算法获得初始化参数，利用动态参数递推算法使模型可以根据用户群体行为的变化实时调整自身参数．从而精确地实现对用户行为的跟踪及诊断可能存在的异常行为．实验结果证明了本文所提方法的有效性．

英文摘要：

Application-layer DDoS attack is a main threat to most of modem network service providers. The main drawback of con- ventionai detection methods is that they are hard to describe the non-stationary and time-varying user behavior and cannot automatical- ly adjust the model parameters according to the evolution of normal user behavior. In this paper, a new dynamic application-layer DDoS detection approach is proposed. The proposed scheme utilizes semi-Markov chain to describe the profile of normal behavior. A new dynamic recursive algorithm is introduced to adjust the model＇s parameters. The model is applied to detect the Application-layer DDoS attacks. Experiments based on a real trace are implemented to validate the proposal.