All-Packets-Based Multi-Rate DDoS Attack Detection Method in ISP Layer

Abstract

Distributed denial of service (DDoS) is a fundamental security problem in the ISP layer of the internet of things. However, most existing DDoS detection methods are based on NetFlow data, which cannot handle the huge detection delay of flow generation and massive network traffic. Besides, it is extremely hard to obtain the real DDoS attack traffic to construct a traditional supervised binary classification model. To solve these problems, this paper proposes a novel all-packets-based DDoS attack detection method (APDD). Firstly, a new probabilistic storage model square sketch is designed, which has structural characteristics of parallelization, accumulation, and recompression. The model and its characteristics are conducive to fast and efficient traffic storage and compression. All network packets are mapped into square sketch, and the compressed square sketch is obtained. Secondly, in order to overcome the problem of poor real DDoS attack samples, only according to the recompressed square sketch of the normal network, a one-class classifier is constructed by generative adversarial networks to form a DDoS attack detection model. The likelihood score of a recompressed square sketch is obtained to judge this square sketch whether or not it belongs to a normal network state. Finally, two real network traffic data sets of the high-throughput network are utilized to evaluate the proposed method. Compared with several existing methods, the experimental results show that the APDD method has good time efficiency and detection performance.