Detecting DDoS Attacks Using Conditional Random Fields

Abstract

In recent years, the detection technology based on machine learning algorithms for distributed denialof-service (DDoS) attacks has made great progress. However, previous methods fail to make full use of contextual information and rely heavily on the probability distribution of the input data. To avoid those pitfalls, the Conditional Random Fields (CRF) model is introduced in this paper for DDoS attacks detection. Firstly, the CRF is trained to build the classification model for DDoS attacks based on three groups of statistical features including conditional entropy, flag ratios and protocol ratios. Then, the trained CRF models are used to identify the attacks with model inference. Experimental results demonstrate that, the proposed approach can accurately distinguish between attacks and normal network traffic, and is more robust to resist disturbance of background traffic than its counterparts.