Exploring the use of machine learning outlier detection algorithms for DDoS identification

Abstract

Servers and users rely on safe defenses against multiple attacks. Usual practices, however, normally are unable to deal with huge distributed attacks, such as DDoS. This is a malicious practice that aims to interrupt the flow of a network causing data congestion. Moreover, DDoS is a stealthy practice, as its traffic might present similar attributes to usual ones. With this in mind, in this paper, we use unsupervised, semi-supervised, and supervised machine learning algorithms to automatically analyze a selected network, detecting possible DDoS flows using PyOD library. We evaluate each of those types of algorithms and also explore the effects of previous feature selection on them.