基于深度学习的实时DDoS攻击检测

李传煌; 孙正君; 袁小雍; 李晓林; 龚梁; 王伟明

doi:10.11959/j.issn.1000−0801.2017191

您当前的位置：

首页 >

文章列表页 >

基于深度学习的实时DDoS攻击检测

研究与开发 | 更新时间：2024-06-05

- 基于深度学习的实时DDoS攻击检测
- Real-time DDoS attack detection based on deep learning
- 电信科学 2017年33卷第7期页码：53-65
- 作者机构：
  
  1. 浙江工商大学信息与电子工程学院，浙江杭州310018
  2. 美国佛罗里达大学大规模智能系统实验室，美国佛罗里达州盖恩斯维尔32611
- 作者简介：
  
  [ "李传煌（1980−），男，博士，浙江工商大学信息与电气工程学院副教授，2016年佛罗里达大学访问学者，主要研究方向为软件定义网络、深度学习、开放可编程网络、系统性能预测和分析模型，发表EI/SCI检索论文40余篇，申请专利15项。" ]
  [ "孙正君（1993−），男，浙江工商大学信息与电气工程学院硕士生，主要研究方向为软件定义网络、深度学习。" ]
  [ "袁小雍（1990−），男，美国佛罗里达大学博士生，主要研究方向为网络安全、深度学习、云计算和分布式系统。" ]
  [ "李晓林（1976−），男，美国佛罗里达大学副教授，大规模智能系统实验室（Large-Scale Intelligent Systems Laboratory，Li lab）的创始人，美国NSF I/UCRC CBL中心（Center for Big Learning，CBL）主任，主要研究方向为云计算、大数据、深度学习、SDN、健康及精准医药学、CPS/IoT 等，获得美国国家科学基金（NSF）、国家卫生研究院（NIH）、国土安全部（DHS）等的大力资助，发表期刊和会议论文100余篇，出版专著4部，申请4项美国发明专利（3项被授权）。" ]
  [ "龚梁（1992−），男，浙江工商大学信息与电气工程学院硕士生，主要研究方向为网络安全、深度学习、软件定义网络。" ]
  [ "王伟明（1964−），男，博士，浙江工商大学信息与电子工程学院教授，主要研究方向为新一代网络架构、开放可编程网络，特别是IETF ForCES、SDN及可重构网络等方面的协议、模型和算法。" ]
- 基金信息：
  
  国家高技术研究发展计划（“863”计划）基金资助项目;The National High Technology Research and Development Program (863 Program)(2015AA011901);国家自然科学基金资助项目;The National Natural Science Foundation of China(61402408);国家自然科学基金资助项目;The National Natural Science Foundation of China(61379120);浙江省重点研发计划项目;Zhejiang Province Key Research and Development Program(2017C03058)
- DOI：10.11959/j.issn.1000−0801.2017191
  中图分类号： TP393
- 网络出版日期：2017-07，
  
  纸质出版日期：2017-07-20
- 稿件说明：
移动端阅览
李传煌, 孙正君, 袁小雍, 等. 基于深度学习的实时DDoS攻击检测[J]. 电信科学, 2017,33(7):53-65.

Chuanhuang LI, Zhengjun SUN, Xiaoyong YUAN, et al. Real-time DDoS attack detection based on deep learning[J]. Telecommunications science, 2017, 33(7): 53-65.
李传煌, 孙正君, 袁小雍, 等. 基于深度学习的实时DDoS攻击检测[J]. 电信科学, 2017,33(7):53-65. DOI： 10.11959/j.issn.1000−0801.2017191.

Chuanhuang LI, Zhengjun SUN, Xiaoyong YUAN, et al. Real-time DDoS attack detection based on deep learning[J]. Telecommunications science, 2017, 33(7): 53-65. DOI： 10.11959/j.issn.1000−0801.2017191.

摘要

分布式拒绝服务（DDoS）攻击是一种分布式、协作式的大规模网络攻击方式，提出了一种基于深度学习的 DDoS 攻击检测方法，该方法包含特征处理和模型检测两个阶段：特征处理阶段对输入的数据分组进行特征提取、格式转换和维度重构；模型检测阶段将处理后的特征输入深度学习网络模型进行检测，判断输入的数据分组是否为DDoS攻击分组。通过ISCX2012数据集训练模型，并通过实时的DDoS攻击对模型进行验证。结果表明，基于深度学习的 DDoS 攻击检测方法具有高检测精度、对软硬件设备依赖小、深度学习网络模型易于更新等优点。

Abstract

Distributed denial of service (DDoS) is a special form of denial of service (DoS) attack based on denial of service(DoS).It is a distributed

collaborative large-scale network attack.A DDoS detection method based on deep learning was presented.The method included two stages:feature processing and model detection:feature extraction

format conversion and dimension reconstruction of the input data packet was performed in feature processing stage;in the model detection stage

the processed features were input to the depth learning network model to detect whether the input data packets was DDoS attack packet.The model was trained by the ISCX2012 dataset

and the model was validated by real-time DDoS attack.The experimental results show that DDoS attack detection method based on deep learning has high detection precision

little dependency on hardware and software equipment

and the model of depth learning network is easy to update.

关键词

Keywords

references

PENG T , LECKIE C , RAMAMOHANARAO K . Survey of network-based defense mechanisms countering the DoS and DDoS problems [J ] . ACM Computing Surveys , 2007 , 39 ( 1 ):3.

MIRKOVIC J , MARTIN J , REIHER P . A taxonomy of DDoS attacks and DDoS defense mechanisms [J ] . ACM Sigcomm Computer Communication Review , 2001 , 34 ( 2 ): 39 - 53 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . ImageNet classification with deep convolutional neural networks [J ] . Advances in Neural Information Processing Systems , 2012 , 25 ( 2 ): 1097 - 1105 .

GRAVES A , SCHMIDHUBER J . Framewise phoneme classification with bidirectional LSTM and other neural network architectures [J ] . Neural Networks , 2005 , 18 ( 5 ): 602 - 610 .

DEY R , FATHI M . Gate-variants of gated recurrent unit (GRU) neural networks [EB/OL ] . (2017-01-28)[2017-03-14].http:// xueshu.baidu.com/s?wd=Gate-Variants+of+Gated+Recurrent+Unit+%28GRU%29+Neural+Networks＆rsv_bp=0＆tn=SE_baiduxue shu_c1gjeupa＆rsv_spt=3＆ie=utf-8＆f=8＆rsv_sug2=1＆sc_f_par a=sc_tasktype%3D%7BfirstSimpleSearch%7D＆rsv_n=2 (2017-01-28)[2017-03-14].http:// xueshu.baidu.com/s?wd=Gate-Variants+of+Gated+Recurrent+Unit+%28GRU%29+Neural+Networks＆rsv_bp=0＆tn=SE_baiduxue shu_c1gjeupa＆rsv_spt=3＆ie=utf-8＆f=8＆rsv_sug2=1＆sc_f_par a=sc_tasktype%3D%7BfirstSimpleSearch%7D＆rsv_n=2 .

UNB ISCX intrusion detection evaluation DataSet [EB/OL ] .(2014-05-08)[2017-03-14 ] . http://www.unb.ca/research/iscx/dataset/iscx-IDS-dataset.html http://www.unb.ca/research/iscx/dataset/iscx-IDS-dataset.html .

BHUYAN M H , BHATTACHARYYA D K , KALITA J K . Information metrics for low-rate DDoS attack detection:a comparative evaluation [C ] // International Conference on Contemporary Computing,August 7-9 ,2014,Noida,India . New Jersey:IEEE Press , 2014 : 80 - 84 .

CHEN Y , KAI H . Collaborative change detection of DDoS attacks on community and ISP networks [C ] // International Symposium on Collaborative Technologies and Systems,May 14-17,2006,Las Vegas,NV,USA . New Jersey:IEEE Press , 2006 : 401 - 410 .

YUAN J , MILLS K . Monitoring the macroscopic effect of DDoS flooding attacks [J ] . IEEE Transactions on Dependable ＆Secure Computing , 2005 , 2 ( 4 ): 324 - 335 .

BHUYAN M H , BHATTACHARYYA D K , KALITA J K . An empirical evaluation of information metrics for low-rate and high-rate DDoS attack detection [J ] . Pattern Recognition Letters , 2015 , 51 ( C ): 1 - 7 .

CHEN C L . A new detection method for distributed denial-of-service attack traffic based on statistical test [J ] . Journal of Computer Science , 2009 , 15 ( 2 ): 488 - 504 .

SINGH K J , DE T . An approach of DDoS attack detection using classifiers [M ] . Berlin : SpringerPress , 2015 : 429 - 437 .

LECUN Y , BOTTOU L , BENGIO Y , et al . Gradient-based learning applied to document recognition [J ] . Proceedings of the IEEE , 1998 , 86 ( 11 ): 2278 - 2324 .

KAMIJO K , TANIGAWA T . Stock price pattern recognition-a recurrent neural network approach [C ] // International Joint Conference on Neural Networks,June 17-21,1990,San Diego,CA,USA . New Jersey:IEEE Press , 1990 : 215 - 221 .

HOCHREITER S , SCHMIDHUBER J . Long short-term memory [J ] . Neural Computation , 1997 , 9 ( 8 ): 1735 - 1780 .

邬江兴 . 拟态计算与拟态安全防御的原意和愿景 [J ] . 电信科学 , 2014 , 30 ( 7 ): 2 - 7 .

WU J X . Meaning and vision of mimic computing and mimic secu-rity defense [J ] . Telecommunications Science , 2014 , 30 ( 7 ): 2 - 7 .

柳毅 , 洪俊斌 . 基于网络爬虫与页面代码行为的XSS漏洞动态检测方法 [J ] . 电信科学 , 2016 , 32 ( 3 ): 87 - 91 .

LIU Y , HONG J B . A dynamic detection method based on Web crawler and page code behavior for XSS vulnerability [J ] . Tele-communications Science , 2016 , 32 ( 3 ): 87 - 91 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

GMTBLC：基于深度学习的双模态网络流量分类

基于改进YOLOv5的天线下倾角识别方法研究

基于时序深度残差收缩网络的混叠信号调制识别方法

日志信息驱动的计算机网络节点故障预测研究

基于深度学习的多层级恰可察觉失真预测