Semi-supervised learning approach using modified self-training algorithm to counter burst header packet flooding attack in optical burst switching network

Abstract

Burst header packet flooding is an attack on optical burst switching (OBS) network which may cause denial of service. Application of machine learning technique to detect malicious nodes in OBS network is relatively new. As finding sufficient amount of labeled data to perform supervised learning is difficult, semi-supervised method of learning (SSML) can be leveraged. In this paper, we studied the classical self-training algorithm (ST) which uses SSML paradigm. Generally, in ST, the available true-labeled data (L) is used to train a base classifier. Then it predicts the labels of unlabeled data (U). A portion from the newly labeled data is removed from U based on prediction confidence and combined with L. The resulting data is then used to re-train the classifier. This process is repeated until convergence. This paper proposes a modified self-training method (MST). We trained multiple classifiers on L in two stages and leveraged agreement among those classifiers to determine labels. The performance of MST was compared with ST on several datasets and significant improvement was found. We applied the MST on a simulated OBS network dataset and found very high accuracy with a small number of labeled data. Finally we compared this work with some related works.

A Comparative Analysis of Semi-Supervised Learning in Detecting Burst Header Packet Flooding Attack in Optical Burst Switching Network

“…The authors outlined that a limitation of the proposed model is that it linearly scales according to the number of classes in a dataset, which requires to re-estimate the generative likelihood for each of the classes during training. In [6][7][8], the authors discussed some SSML approaches for detecting BHP flooding attack using recorded OBS network data. In [6], K-Means clustering technique was used in an SSML framework.…”

“…In [7], Gaussian mixture model (GMM) was used in the same fashion as mentioned in [6]. In [8], a classical self-training (ST) algorithm and a modified version of the classical self-training algorithm was proposed for a BHP flooding attack detection using an OBS network dataset. The self-training [20][21][22] algorithm is a common choice for SSML.…”

“…Among them, semi-supervised learning-based works are fewer. To the best of our knowledge, the works [6][7][8] are the only available works on SSML approach for detecting BHP flooding attack in an OBS network dataset. SSML is very helpful when the available amount of labeled data is relatively much smaller than the unlabeled data.…”

“…This paper presents a comparative analysis of four semi supervised machine learning (SSML) approaches on an OBS network dataset for detecting a BHP flooding attack. In our previous studies [6][7][8], we applied four SSML approaches for detecting a BHP flooding attack. In [6], K-Means clustering technique was used in an SSML framework.…”

“…In [7], Gaussian mixture model (GMM) was used in the same fashion. In [8], a classical selftraining (ST) algorithm was examined and a modified version of the classical self-training algorithm was proposed for BHP flooding attack detection. In this study, we present a comparative analysis of these four SSML approaches on an OBS network dataset for detecting a BHP flooding attack.…”