Flow Correlation Degree Optimization Driven Random Forest for Detecting DDoS Attacks in Cloud Computing

Abstract

Distributed denial-of-service (DDoS) has caused major damage to cloud computing, and the false- and missing-alarm rates of existing DDoS attack-detection methods are relatively high in cloud environment. In this paper, we propose a DDoS attack-detection method with enhanced random forest (RF) optimized by genetic algorithm based on flow correlation degree (FCD) feature. We define the FCD feature according to the asymmetric and semidirectivity interaction characteristics and use the two-tuples FCD feature consisting of packet-statistical degree (PSD) and semidirectivity interaction abnormality (SDIA) to describe the features of attack flow and normal flow. Then we use a genetic algorithm based on the FCD feature sequences to optimize two key parameters of the decision tree in the RF: the maximum number of decision trees and the maximum depth of every single decision tree. We apply the trained RF model with optimized parameters to generate the classifier to be used for DDoS attack-detection. The experiment shows that the proposed method can effectively detect DDoS attacks in cloud environment with a higher accuracy rate and lower false- and missing-alarm rates compared to existing DDoS attack-detection methods.

Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning

“…e Smart Detection system has reached high accuracy and low false-positive rate. Experiments were conducted using two Virtual Linux boxes, Define all the descriptor database variables as the current variables; (5) while True do (6) Split dataset in training and test partitions; (7) Create and train the model using training data partition; (8) Select the most important variables from the trained model; (9) Calculate the cumulative importance of variables from the trained model; (10) if max (cumulative importance of variables) < Variable importance threshold then (11) Exit loop; (12) end (13) Train the model using only the most important variables; (14) Test the trained model and calculate the accuracy; (15) if Calculated accuracy < Accuracy threshold then (16) Exit loop; (17) end (18) Add current model to optimized model set; (19) Define the most important variables from the trained model as the current variables; (20) end (21) end (22) Group the models by number of variables; (23) Remove outliers from the grouped model set; (24) Select the group of models with the highest frequency and their number of variables "N"; (25) Rank the variables by the mean of the importance calculated in step 7; (26) Return the "N" most important variables; [2004][2005] have been used by the researchers to evaluate the performance of their proposed intrusion detection and prevention approaches. However, many such datasets are out of date and unreliable to use [25].…”

“…Finding the balance between academic propositions and the industrial practice of combating DDoS is a big challenge. e academy invests in techniques such as machine learning (ML) and proposes to apply them in areas such as DDoS detection in Internet of ings (IoT) [20,21] sensors, wireless sensors [22], cloud computing [23] and softwaredefined networking (SDN) [18] and work on producing more realistic datasets [24,25] and more effective means of result validation [26,27]. On the other hand, industry segments gradually invested in new paradigms in their solutions such as network function virtualization (NFV) and SDN [28,29] to apply scientific discoveries and modernize network structures.…”

Recent Analysis of Forged Request Headers Constituted by HTTP DDoS

“…However, adoption of absolute database leads to a misclassification of false positive and false negative due to a high possibility of occurrence. Cheng, et al [ 13 ] noted that this approach requires information from the available dataset to capture the behavior and information about various attacks. The signature-based detection was built based on the network behavior and there are also various terms that have been used to describe it including misuse, knowledge-based, rule-based and pattern-based detection [ 13 , 14 ].…”

A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment

“…Recently, an abnormal network flow based DDoS detection method was presented [14], which showed a better performance among other existing methods. Also, Jieren C. proposed an DDoS detection method for socially aware networking [15] and a method using flow correlation degree [16]. Ruizhi Z. presented a DDoS attack security situation assessment model [17] that formed the basic evaluation solution to the attacks.Security detection is an important tool that can strengthen the security of information and communication in networks [18][19][20][21][22].…”