用逻辑回归与SVM检测并分类网络层和应用层的分布式拒绝服务攻击。
Detecting Distributed Denial of Service Attacks Using Logistic Regression and SVM Methods
- 基于网络属性特征，用LR与SVM对流量进行分类。
- 两种方法准确率均达98.65%，优于此前同数据集实验。
- 适合网络安全研究者与网络运维人员参考。
分布式拒绝服务（DDoS）攻击通过多台被控恶意设备持续发送大量服务请求，淹没目标服务器或其邻近基础设施，造成网络瘫痪。现代网络中，此类攻击多发生在网络层与应用层，如HTTP洪水、UDP洪水、SIDDOS、SMURF、SNMP洪水、IP NULL等。本文旨在从所有服务请求中检测并识别不同类别的DDoS攻击。研究采用从互联网获取的标准数据集，包含多个网络属性及其对应的攻击类别标签。分别使用支持向量机（SVM）与逻辑回归（Logistic Regression）两种机器学习方法进行检测与分类，并在准确率、精确率和召回率上进行对比。结果表明，两种方法均达到98.65%的分类准确率，为该数据集上当前最高水平。
原文摘要 · Abstract (English)
A distributed denial-of-service (DDoS) attack is an attempt to produce humongous traffic within a network by overwhelming a targeted server or its neighboring infrastructure with a flood of service requests ceaselessly coming from multiple remotely controlled malware-infected computers or network-connected devices. Thus, exploring DDoS attacks by recognizing their functionalities and differentiating them from normal traffic services are the primary concerns of network security issues particularly for online businesses. In modern networks, most DDoS attacks occur in the network and application layer including HTTP flood, UDP flood, SIDDOS, SMURF, SNMP flood, IP NULL, etc. The goal of this paper is to detect DDoS attacks from all service requests and classify them according to DDoS classes. In this regard, a standard dataset is collected from the internet which contains several network-related attributes and their corresponding DDoS attack class name. Two(2) different machine learning approaches, SVM and Logistic Regression, are implemented in the dataset for detecting and classifying DDoS attacks, and a comparative study is accomplished among them in terms of accuracy, precision, and recall rates. Logistic Regression and SVM both achieve 98.65% classification accuracy which is the highest achieved accuracy among other previous experiments with the same dataset.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。