DDos recognition method and system based on multi-dimensional state transition matrix feature

The invention relates to a DDos recognition method and system based on a multi-dimensional state transition matrix feature. The method comprises the following steps: 1) acquiring network flow metadataand labeling DDos traffic and normal traffic; 2) extracting the multi-dimensional features of DDos based on a state transition matrix by using the acquired and labeled network flow metadata; 3) training a classification model with the extracted multi-dimensional features by a machine learning algorithm; and 4) inputting network flow data to be measured according to the multi-dimensional featuresextracted in the step 2) to obtain a DDos recognition result. According to the method, network behavior features which can effectively depict different DDos attack tactics are extracted, and the machine learning algorithm is adopted for training and learning, so that DDos attacks can be recognized accurately and completely with less prior knowledge of scenes. 本发明涉及种基于多维度状态转移矩阵特征的DDos识别方法和系统。该方法包括：1)采集网络流元数据，并标注DDos流量与正常流量；