.png){kind=icon}
Return
A feature selection-based method for DDoS attack flow classification
.png){kind=icon}
PRE
AI
DOI：10.1016/j.future.2022.02.006.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Distributed Denial of Service (DDoS) attacks still be a great threat to the availability of online servers. To defend against attacks, the challenge is not only detecting DDoS attacks as they occur but also identifying, and thus blocking the attack flows. However, existing classification methods cannot accurately and efficiently differentiate between attack flows and benign flows. In this paper, we propose a DDoS attack flow classification system, named SAFE, to accurately and quickly identify attack flows in network layer. First, SAFE chooses the optimal features by removing the redundant features and selecting the most informative features. Second, a threshold tuning method is proposed to identify the best threshold for each feature. Finally, an aggregated feature-based linear classifier is proposed to weight the selected features for classification. Since the proposed method monitors the flows in network layer, it can detect the traditional DDoS attack flows as well as the attack flows launched by Internet of Thing (IoT) devices. Comprehensive experiments are carried out on one IoT and two sophisticated DDoS attacks to evaluate the classification performance of the proposed method. The comparison results show that SAFE can achieve better classification performance than the state-of-the-art methods in terms of classification accuracy and efficiency. (c) 2022 Elsevier B.V. All rights reserved.
Keywords:
DDoS attacks
Flow classification
Machine learning
Feature selection
Journal
F
IF:
6.1
Papers:
6.9K
Citations:
2.3W
Organization
Cited Papers
ICMPv6-Based DoS and DDoS Attacks Detection Using Machine Learning Techniques, Open Challenges, and Blockchain Applicability: A Review.png)
IEEE ACCESS
OAAI
IEEE ACCESSIF3.6
OAAIShareSave
ShareSavePrivacy-Preserving DDoS Attack Detection Using Cross-Domain Traffic in Software Defined NetworksOAAI
OAAIShareSaveThe use of the area under the roc curve in the evaluation of machine learning algorithmsPATTERN RECOGNITIONOAAI
PATTERN RECOGNITIONIF7.6
OAAIShareSaveUmbrella: Enabling ISPs to Offer Readily Deployable and Privacy-Preserving DDoS Prevention ServicesOAAI
OAAIShareSaveShareSaveShareSave
View more