期刊
COMPUTER NETWORKS
卷 186, 期 -, 页码 -出版社
ELSEVIER
DOI: 10.1016/j.comnet.2020.107792
关键词
DDoS attack; Low-rate DDoS attack; Reduction-of-Quality DDoS attack; Fuzzy logic; Machine learning algorithms
类别
资金
- Portuguese FCT/MCTES
- EU [UIDB/50008/2020]
- FCT/COMPETE/FEDER under the project SECURIoTESIGN [POCI-01-0145-FEDER-030657]
- Centro de Competencias em Cloud Computing [Centro-010145-FEDER-000019 - C4]
- European Regional Development Fund (ERDF) through the Programa Operacional Regional do Centro (Centro 2020)
- Brazilian CAPES Foundation [BEX 9095/13-6]
This paper investigates a technique called RoQ attack and successfully detects this type of attack using machine learning algorithms and fuzzy logic methods, showing good classification performance in both simulated and real traffic. However, the better performance of the approach based on FL, MLP and ED comes at the cost of longer execution time.
Distributed Denial of Service (DDoS) attacks are still among the most dangerous attacks on the Internet. With the advance of methods for detecting and mitigating these attacks, crackers have improved their skills in creating new DDoS attack types with the aim of mimicking normal traffic behavior therefore becoming silently powerful. Among these advanced DDoS attack types, the so-called low-rate DoS attacks aim at keeping a low level of network traffic. In this paper, we study one of these techniques, called Reduction of Quality (RoQ) attack. To investigate the detection of this type of attack, we evaluate and compare the use of four machine learning algorithms: Multi-Layer Perceptron (MLP) neural network with backpropagation, K-Nearest Neighbors (K-NN), Support Vector Machine (SVM) and Multinomial Naive Bayes (MNB). We also propose an approach for detecting this kind of attack based on three methods: Fuzzy Logic (FL), MLP and Euclidean Distance (ED). We evaluate and compare the approach based on FL, MLP and ED to the above machine learning algorithms using both emulated and real traffic traces. We show that among the four Machine Learning algorithms, the best classification results are obtained with MLP, which, for emulated traffic, leads to a F1-score of 98.04% for attack traffic and 99.30% for legitimate traffic, while, for real traffic, it leads to a F1-score of 99.87% for attack traffic and 99.95% for legitimate traffic. Regarding the approach using FL, MLP and EC, for classification of emulated traffic, we obtained a F1-score of 98.80% for attack traffic and 99.60% for legitimate traffic, while, for real traffic, we obtained a F1-score of 100% for attack traffic and 100% for legitimate traffic. However, the better performance of the approach based on FL, MLP and ED is obtained at the cost of larger execution time, since MLP required 0.74 ms and 0.87 ms for classification of the emulated and real traffic datasets, respectively, where as the approach using FL, MLP and ED required 11'46 '' and 46'48 '' to classify the emulated and real traffic datasets, respectively.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据