An Efficient DDoS Detection Method Based on Packet Grouping via Online Data Flow Processing

IF 3 3区 计算机科学 Q2 COMPUTER SCIENCE, HARDWARE & ARCHITECTURE
Mingshu He;Xiaowei Zhao;Xiaojuan Wang
{"title":"An Efficient DDoS Detection Method Based on Packet Grouping via Online Data Flow Processing","authors":"Mingshu He;Xiaowei Zhao;Xiaojuan Wang","doi":"10.1109/TSUSC.2024.3409712","DOIUrl":null,"url":null,"abstract":"Distributed Denial of Service attacks are considered to be one of the most common and effective threats in the security field, aiming to deny or weaken the service providing of its victims. Most traditional solutions are only for DDoS detection in offline scenarios, which are challenging to detect real-time DDoS attacks. Therefore, the application scenarios are limited. In this paper, we propose a packet grouping-based DDoS detection method, which uses an online data flow processing mechanism to focus on data collection and processing efforts, which is suitable for online and offline detection. The proposed method simulates the process of real-time packet capture by grouping packets through a time window and realizes the binary classification of traffic through the lightweight CNN model. Most crucially, selecting the optimal number of packets per time window minimizes the time overhead without affecting detection accuracy. To further improve the accuracy in offline scenarios, we perform ensemble learning on the prediction results of packet groups. The proposed method attains 99.99<inline-formula><tex-math>$\\%$</tex-math></inline-formula> accuracy on the CICIDS2017 offline dataset and demonstrates a latency of only 1.05 seconds with a 99.86<inline-formula><tex-math>$\\%$</tex-math></inline-formula> accuracy in online testing, surpassing other methods in terms of response speed.","PeriodicalId":13268,"journal":{"name":"IEEE Transactions on Sustainable Computing","volume":"10 2","pages":"202-216"},"PeriodicalIF":3.0000,"publicationDate":"2024-06-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"IEEE Transactions on Sustainable Computing","FirstCategoryId":"94","ListUrlMain":"https://ieeexplore.ieee.org/document/10549828/","RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q2","JCRName":"COMPUTER SCIENCE, HARDWARE & ARCHITECTURE","Score":null,"Total":0}
引用次数: 0

Abstract

Distributed Denial of Service attacks are considered to be one of the most common and effective threats in the security field, aiming to deny or weaken the service providing of its victims. Most traditional solutions are only for DDoS detection in offline scenarios, which are challenging to detect real-time DDoS attacks. Therefore, the application scenarios are limited. In this paper, we propose a packet grouping-based DDoS detection method, which uses an online data flow processing mechanism to focus on data collection and processing efforts, which is suitable for online and offline detection. The proposed method simulates the process of real-time packet capture by grouping packets through a time window and realizes the binary classification of traffic through the lightweight CNN model. Most crucially, selecting the optimal number of packets per time window minimizes the time overhead without affecting detection accuracy. To further improve the accuracy in offline scenarios, we perform ensemble learning on the prediction results of packet groups. The proposed method attains 99.99$\%$ accuracy on the CICIDS2017 offline dataset and demonstrates a latency of only 1.05 seconds with a 99.86$\%$ accuracy in online testing, surpassing other methods in terms of response speed.
基于在线数据流处理分组的高效DDoS检测方法
分布式拒绝服务攻击被认为是安全领域最常见和最有效的威胁之一,其目的是拒绝或削弱受害者提供的服务。传统的DDoS检测方案大多只支持离线场景下的DDoS检测,难以实时检测到DDoS攻击。因此,应用场景有限。本文提出了一种基于分组的DDoS检测方法,该方法采用在线数据流处理机制,专注于数据的收集和处理工作,适用于在线和离线检测。该方法通过一个时间窗口对数据包进行分组,模拟实时抓包过程,并通过轻量级CNN模型实现流量的二值分类。最重要的是,选择每个时间窗口的最佳数据包数量可以在不影响检测准确性的情况下最小化时间开销。为了进一步提高离线场景下的准确性,我们对分组的预测结果进行了集成学习。所提出的方法在CICIDS2017离线数据集上达到99.99$\%$的准确率,并且在在线测试中显示延迟仅为1.05秒,准确率为99.86$\%$,在响应速度方面优于其他方法。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 求助全文
来源期刊
IEEE Transactions on Sustainable Computing
IEEE Transactions on Sustainable Computing Mathematics-Control and Optimization
CiteScore
7.70
自引率
2.60%
发文量
54
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
确定
请完成安全验证×
copy
已复制链接
快去分享给好友吧!
我知道了
右上角分享
点击右上角分享
0
联系我们:info@booksci.cn Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术官方微信