State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450002, China.
Comput Intell Neurosci. 2022 Aug 16;2022:4611331. doi: 10.1155/2022/4611331. eCollection 2022.
Distributed denial of service (DDoS) attacks are the most common means of cyberattacks against infrastructure, and detection is the first step in combating them. The current DDoS detection mainly uses the improvement or fusion of machine learning and deep learning methods to improve classification performance. However, most classifiers are trained with statistical flow features as input, ignoring topological connection changes. This one-sidedness affects the detection accuracy and cannot provide a basis for the distribution of attack sources for defense deployment. In this study, we propose a topological and flow feature-based deep learning method (GLD-Net), which simultaneously extracts flow and topological features from time-series flow data and exploits graph attention network (GAT) to mine correlations between non-Euclidean features to fuse flow and topological features. The long short-term memory (LSTM) network connected behind GAT obtains the node neighborhood relationship, and the fully connected layer is utilized to achieve feature dimension reduction and traffic type mapping. Experiments on the NSL-KDD2009 and CIC-IDS2017 datasets show that the detection accuracy of the GLD-Net method for two classifications (normal and DDoS flow) and three classifications (normal, fast DDoS flow, and slow DDoS flow) reaches 0.993 and 0.942, respectively. Compared with the existing DDoS attack detection methods, its average improvement is 0.11 and 0.081, respectively. In addition, the correlation coefficient between the detection accuracy of attack flow and the four source distribution indicators ranges from 0.7 to 0.83, which lays a foundation for the inference of attack source distribution. Notably, we are the first to fuse topology and flow features and achieve high-performance DDoS attack intrusion detection through graph-style neural networks. This study has important implications for related research and development of network security systems in other fields.
分布式拒绝服务 (DDoS) 攻击是针对基础设施的最常见的网络攻击手段，检测是打击此类攻击的第一步。当前的 DDoS 检测主要通过改进或融合机器学习和深度学习方法来提高分类性能。然而，大多数分类器都是使用统计流特征作为输入进行训练的，忽略了拓扑连接的变化。这种片面性会影响检测精度，并且无法为防御部署提供攻击源分布的依据。在本研究中，我们提出了一种基于拓扑和流特征的深度学习方法（GLD-Net），它可以从时间序列流数据中同时提取流特征和拓扑特征，并利用图注意力网络（GAT）挖掘非欧几里得特征之间的相关性，以融合流特征和拓扑特征。连接在 GAT 后面的长短时记忆（LSTM）网络获取节点邻域关系，再利用全连接层实现特征维度降低和流量类型映射。在 NSL-KDD2009 和 CIC-IDS2017 数据集上的实验表明，GLD-Net 方法对两类（正常和 DDoS 流量）和三类（正常、快速 DDoS 流量和慢速 DDoS 流量）的检测精度分别达到 0.993 和 0.942。与现有的 DDoS 攻击检测方法相比，其平均提高分别为 0.11 和 0.081。此外，攻击流量检测精度与四个源分布指标之间的相关系数在 0.7 到 0.83 之间，这为攻击源分布的推断奠定了基础。值得注意的是，我们首次融合拓扑和流特征，并通过图式神经网络实现高性能的 DDoS 攻击入侵检测。本研究对网络安全系统在其他领域的相关研究和开发具有重要意义。
