A Small Sample DDoS Attack Detection Method Based on Deep Transfer Learning

He, Jiawei; Tan, Yejin; Guo, Wangshu; Xian, Ming

doi:10.1109/ccns50731.2020.00019

Cited by 17 publications

(8 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With the in-depth development of deep learning, many researchers also apply new architectures to optimize DDoS detection performance. In 2020, He et al [ 10 ] employed transfer learning for small-sample DDoS detection. They also define the transfer ability to evaluate different networks and select the best network structure and parameters.…”

Section: Related Workmentioning

confidence: 99%

“…Calculate the total time T and average time T that fall into period t i ; (8) num num + 1; (9) P.append(num); (10) extract features on t i , such as duration, interval, and bits; (11) save as 12) for (i 1; i ≤ m; i + +) do (13) for (j 1; j ≤ p[i − 1]; j + +)do (14) if graph G m does not contain node N src or N des of C i j then (15) add edge N src , N des to graph G m ; (16) if graph G m contains the edge between N src and N des then (17) add extracted time attributes edge i num to the edge N src , N des ; ( 18) else (19) create an edge between N src and N des ; (20) add extracted time attributes edge i num to the edge N src , N des ; (21) return G ALGORITHM 1: Construction of dynamic DDoS topology graph based on time series. used for error metrics cannot be represented by consecutive integers with uneven differences.…”

Section: 3mentioning

confidence: 99%

“…ese studies usually improve performance by improving or fusing network architectures. For example, convolutional neural network (CNN) and recurrent neural network (RNN) are used to process the relationship between features in time and space [8], RNN and automatic codec are combined to improve the detection sensitivity on SDN [9], and adaptive transfer learning is introduced to achieve small sample detection [10]. ese methods achieve good performance by exploiting the efficient information in the input as much as possible through elaborate devised architecture and parameters.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Guo¹,

Qiu²,

Liu³

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Distributed denial of service (DDoS) attacks are the most common means of cyberattacks against infrastructure, and detection is the first step in combating them. The current DDoS detection mainly uses the improvement or fusion of machine learning and deep learning methods to improve classification performance. However, most classifiers are trained with statistical flow features as input, ignoring topological connection changes. This one-sidedness affects the detection accuracy and cannot provide a basis for the distribution of attack sources for defense deployment. In this study, we propose a topological and flow feature-based deep learning method (GLD-Net), which simultaneously extracts flow and topological features from time-series flow data and exploits graph attention network (GAT) to mine correlations between non-Euclidean features to fuse flow and topological features. The long short-term memory (LSTM) network connected behind GAT obtains the node neighborhood relationship, and the fully connected layer is utilized to achieve feature dimension reduction and traffic type mapping. Experiments on the NSL-KDD2009 and CIC-IDS2017 datasets show that the detection accuracy of the GLD-Net method for two classifications (normal and DDoS flow) and three classifications (normal, fast DDoS flow, and slow DDoS flow) reaches 0.993 and 0.942, respectively. Compared with the existing DDoS attack detection methods, its average improvement is 0.11 and 0.081, respectively. In addition, the correlation coefficient between the detection accuracy of attack flow and the four source distribution indicators ranges from 0.7 to 0.83, which lays a foundation for the inference of attack source distribution. Notably, we are the first to fuse topology and flow features and achieve high-performance DDoS attack intrusion detection through graph-style neural networks. This study has important implications for related research and development of network security systems in other fields.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: 3mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Guo¹,

Qiu²,

Liu³

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…e authors proposed a minimal-degree DoS assault revealing method centred on the Pearson relationship, which uses the Pearson coefficient of correlation based on the Hilbert spectrum net congestion, to characterize network traffic information, and compares this information with a threshold to detect low-rate attacks against TCP [3]. Author analyzed the sequence similarity between the minimal-degree DDoS assault pulses at the victim end from the perspective of sequence matching, used the Smith-Waterman algorithm, and designed a doublethreshold rule to detect TCP-based low-rate attacks [4]. e authors proposed a method based on network self-similarity to analyze the impact of low-rate attacks on traffic selfsimilarity and used H-index combined with thresholds to identify attacks and legitimate traffic [5].…”

Section: Related Workmentioning

confidence: 99%

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

Kumar

Aoudni

Ortiz

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

The minimal-degree distributed denial-of-service attack takes advantage of flaws in the adaptive mechanisms of network protocols, which could have a big impact on network service quality. It is very hard to find, has a low attack rate, and comes at a set time. Detection methods that have been used before have problems because they only use one type of detection and are not very good at identifying the object. In the end, a way to detect many sorts of minimal DDoS assaults that use deep hybrid learning is suggested. To construct multi-type limited DDoS threat data sets and mimic diverse sorts DDoS assaults and legitimate traffic in varying situations in the 5G setting, collect congestion at the networking entry and extract flow feature info are considered. From a statistical threshold and feature engineering point of view, these data sets show how many sorts of minimal DDoS assaults are there. This study aims to develop a deep hybrid learning-based multi-type low-rate DDoS attack detection solution for 5G networks which is the novel model that is recently deployed, and a hybrid deep learning algorithm was used to train the algorithm offline, and the algorithm’s performance was compared to that of the LSTM-Light GBM and LSTM-RF algorithms. The CNN-RF revealing model was then used to detect minimal DDoS assaults at the gateway, so that multiple attacks could be detected at the same time. It can identify 4 sorts of low-rate DDoS assaults like Slow-Headers, Slow-Body, Slow-Read, and Shrew assaults, in a 120-second window. The false intercept rate is 11.03 percent. This means that 96.22 percent of traffic could be found. Using the strategy suggested can help cut down on the traffic concentration of minimal DDoS attacks at the net ingress. It can also be used in real-world situations.

show abstract

“…Substations, as a crucial component of the smart grid, play an irreplaceable role in power generation, transmission, and distribution. Therefore, status monitoring and fault diagnosis of substations is a crucial objective of the smart grid [1,2].…”

Section: Introductionmentioning

confidence: 99%

Few-Shot Metering Anomaly Diagnosis with Variable Relation Mining

Sun,

Zhang,

Guo

et al. 2024

Energies

View full text Add to dashboard Cite

Metering anomalies not only mean huge economic losses but also indicate the faults of equipment and power lines, especially within the substation. As a result, metering anomaly diagnosis is becoming one of the most important missions in smart grids. However, due to the insufficient and imbalanced anomaly cases, identifying the anomalies in smart meter data accurately and efficiently remains challenging. Existing methods usually employ few-shot learning models in computer vision directly, which requires the rich experience of human experts and sufficient abnormal cases for training. It blocks model generalizing to various application scenarios. To address these shortcomings, we propose a novel framework for metering anomaly diagnosis based on few-shot learning, named FSMAD. Firstly, we design a fault data injection model to emulate anomalies, so that no abnormal samples are required in the training phase. Secondly, we provide a learnable variable transformation to reveal inherent relationships among various smart meter data and help FSMAD extract more efficient features. Finally, the deeper metric network is equipped to support FSMAD in obtaining powerful comparison capability. Extensive experiments on a real-world dataset demonstrate the advantages of our FSMAD over state-of-the-art methods.

show abstract

A Small Sample DDoS Attack Detection Method Based on Deep Transfer Learning

Cited by 17 publications

References 6 publications

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

GLD-Net: Deep Learning to Detect DDoS Attack via Topological and Traffic Feature Fusion

Light Weighted CNN Model to Detect DDoS Attack over Distributed Scenario

Few-Shot Metering Anomaly Diagnosis with Variable Relation Mining

Contact Info

Product

Resources

About