DDoS Detection Based on Second-Order Features and Machine Learning

Abstract

In recent years, there appeared several new forms of DDoS attacks, such as DDoS using botnet, DNS Amplification attack and NTP Amplification attack, posing a great threat to network security and seriously affecting the stability and reliability of the network. Therefore, detecting the DDoS attacks accurately and timely has positive significance to mitigate DDoS attacks as soon as possible and reduce the impact of DDoS attacks. Previously, most of the researchers focused on extracting features of traffic and finding effective approaches to detect DDoS attack, while ignoring the correlativity between features. This paper applies second-order features to machine learning algorithms in order to study the correlativity between features and use sliding window mechanism to improve the model. We use KDD CUP 99 dataset for evaluating the methods. The evaluation results show that the correlativity between features can accurately differentiate DDoS attacks from normal traffic.