Real-time DDoS attack detection based on deep learning

Chuanhuang LI; Zhengjun SUN; Xiaoyong YUAN; Xiaolin LI; Liang GONG; Weiming WANG

doi:10.11959/j.issn.1000−0801.2017191

您当前的位置：

首页 >

文章列表页 >

Real-time DDoS attack detection based on deep learning

research and development | 更新时间：2024-06-05

- Real-time DDoS attack detection based on deep learning
- Telecommunications Science Vol. 33, Issue 7, Pages: 53-65(2017)
- 作者机构：
  
  1. 浙江工商大学信息与电子工程学院，浙江杭州310018
  2. 美国佛罗里达大学大规模智能系统实验室，美国佛罗里达州盖恩斯维尔32611
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.1000−0801.2017191
  CLC： TP393
- Published Online：2017-07，
  
  Published：20 July 2017
- 稿件说明：
移动端阅览
Chuanhuang LI, Zhengjun SUN, Xiaoyong YUAN, et al. Real-time DDoS attack detection based on deep learning[J]. Telecommunications science, 2017, 33(7): 53-65.
DOI：

Chuanhuang LI, Zhengjun SUN, Xiaoyong YUAN, et al. Real-time DDoS attack detection based on deep learning[J]. Telecommunications science, 2017, 33(7): 53-65. DOI： 10.11959/j.issn.1000−0801.2017191.

摘要

分布式拒绝服务（DDoS）攻击是一种分布式、协作式的大规模网络攻击方式，提出了一种基于深度学习的 DDoS 攻击检测方法，该方法包含特征处理和模型检测两个阶段：特征处理阶段对输入的数据分组进行特征提取、格式转换和维度重构；模型检测阶段将处理后的特征输入深度学习网络模型进行检测，判断输入的数据分组是否为DDoS攻击分组。通过ISCX2012数据集训练模型，并通过实时的DDoS攻击对模型进行验证。结果表明，基于深度学习的 DDoS 攻击检测方法具有高检测精度、对软硬件设备依赖小、深度学习网络模型易于更新等优点。

Abstract

Distributed denial of service (DDoS) is a special form of denial of service (DoS) attack based on denial of service(DoS).It is a distributed

collaborative large-scale network attack.A DDoS detection method based on deep learning was presented.The method included two stages:feature processing and model detection:feature extraction

format conversion and dimension reconstruction of the input data packet was performed in feature processing stage;in the model detection stage

the processed features were input to the depth learning network model to detect whether the input data packets was DDoS attack packet.The model was trained by the ISCX2012 dataset

and the model was validated by real-time DDoS attack.The experimental results show that DDoS attack detection method based on deep learning has high detection precision

little dependency on hardware and software equipment

and the model of depth learning network is easy to update.

关键词

Keywords

references

PENG T , LECKIE C , RAMAMOHANARAO K . Survey of network-based defense mechanisms countering the DoS and DDoS problems [J ] . ACM Computing Surveys , 2007 , 39 ( 1 ):3.

MIRKOVIC J , MARTIN J , REIHER P . A taxonomy of DDoS attacks and DDoS defense mechanisms [J ] . ACM Sigcomm Computer Communication Review , 2001 , 34 ( 2 ): 39 - 53 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . ImageNet classification with deep convolutional neural networks [J ] . Advances in Neural Information Processing Systems , 2012 , 25 ( 2 ): 1097 - 1105 .

GRAVES A , SCHMIDHUBER J . Framewise phoneme classification with bidirectional LSTM and other neural network architectures [J ] . Neural Networks , 2005 , 18 ( 5 ): 602 - 610 .

DEY R , FATHI M . Gate-variants of gated recurrent unit (GRU) neural networks [EB/OL ] . (2017-01-28)[2017-03-14].http:// xueshu.baidu.com/s?wd=Gate-Variants+of+Gated+Recurrent+Unit+%28GRU%29+Neural+Networks＆rsv_bp=0＆tn=SE_baiduxue shu_c1gjeupa＆rsv_spt=3＆ie=utf-8＆f=8＆rsv_sug2=1＆sc_f_par a=sc_tasktype%3D%7BfirstSimpleSearch%7D＆rsv_n=2 (2017-01-28)[2017-03-14].http:// xueshu.baidu.com/s?wd=Gate-Variants+of+Gated+Recurrent+Unit+%28GRU%29+Neural+Networks＆rsv_bp=0＆tn=SE_baiduxue shu_c1gjeupa＆rsv_spt=3＆ie=utf-8＆f=8＆rsv_sug2=1＆sc_f_par a=sc_tasktype%3D%7BfirstSimpleSearch%7D＆rsv_n=2 .

UNB ISCX intrusion detection evaluation DataSet [EB/OL ] .(2014-05-08)[2017-03-14 ] . http://www.unb.ca/research/iscx/dataset/iscx-IDS-dataset.html http://www.unb.ca/research/iscx/dataset/iscx-IDS-dataset.html .

BHUYAN M H , BHATTACHARYYA D K , KALITA J K . Information metrics for low-rate DDoS attack detection:a comparative evaluation [C ] // International Conference on Contemporary Computing,August 7-9 ,2014,Noida,India . New Jersey:IEEE Press , 2014 : 80 - 84 .

CHEN Y , KAI H . Collaborative change detection of DDoS attacks on community and ISP networks [C ] // International Symposium on Collaborative Technologies and Systems,May 14-17,2006,Las Vegas,NV,USA . New Jersey:IEEE Press , 2006 : 401 - 410 .

YUAN J , MILLS K . Monitoring the macroscopic effect of DDoS flooding attacks [J ] . IEEE Transactions on Dependable ＆Secure Computing , 2005 , 2 ( 4 ): 324 - 335 .

BHUYAN M H , BHATTACHARYYA D K , KALITA J K . An empirical evaluation of information metrics for low-rate and high-rate DDoS attack detection [J ] . Pattern Recognition Letters , 2015 , 51 ( C ): 1 - 7 .

CHEN C L . A new detection method for distributed denial-of-service attack traffic based on statistical test [J ] . Journal of Computer Science , 2009 , 15 ( 2 ): 488 - 504 .

SINGH K J , DE T . An approach of DDoS attack detection using classifiers [M ] . Berlin : SpringerPress , 2015 : 429 - 437 .

LECUN Y , BOTTOU L , BENGIO Y , et al . Gradient-based learning applied to document recognition [J ] . Proceedings of the IEEE , 1998 , 86 ( 11 ): 2278 - 2324 .

KAMIJO K , TANIGAWA T . Stock price pattern recognition-a recurrent neural network approach [C ] // International Joint Conference on Neural Networks,June 17-21,1990,San Diego,CA,USA . New Jersey:IEEE Press , 1990 : 215 - 221 .

HOCHREITER S , SCHMIDHUBER J . Long short-term memory [J ] . Neural Computation , 1997 , 9 ( 8 ): 1735 - 1780 .

邬江兴 . 拟态计算与拟态安全防御的原意和愿景 [J ] . 电信科学 , 2014 , 30 ( 7 ): 2 - 7 .

WU J X . Meaning and vision of mimic computing and mimic secu-rity defense [J ] . Telecommunications Science , 2014 , 30 ( 7 ): 2 - 7 .

柳毅 , 洪俊斌 . 基于网络爬虫与页面代码行为的XSS漏洞动态检测方法 [J ] . 电信科学 , 2016 , 32 ( 3 ): 87 - 91 .

LIU Y , HONG J B . A dynamic detection method based on Web crawler and page code behavior for XSS vulnerability [J ] . Tele-communications Science , 2016 , 32 ( 3 ): 87 - 91 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

GMTBLC: a deep learning-based bi-modal network traffic classification method

Research on antenna dip angle recognition method based on improved YOLOv5

Mixed signal modulation recognition method based on temporal depth residual shrinkage network

Research on fault prediction of computer network nodes driven by log information

Deep learning-based prediction of multi-level just noticeable distortion

Related Author

WEI Debin

JIANG Qinlong

WEN Jinglong

WANG Xinrui

ZHANG Ning

PAN Feng

GENG Lujing

CHEN Zuhao

Related Institution

School of Information Engineering, Dalian University

China Mobile Group Design Institute Co., Ltd.

China Mobile Group Co., Ltd.

The 63rd Research Institute, National University of Defense Technology

School of Electronic and Information Engineering, Nanjing University of Information Science and Technology

⁰