• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

Computer Engineering & Science

Previous Articles     Next Articles

An adaptive DDoS attack detection
method based on multiple-kernel learning

ZHANG Chen1,TANG Xiang-yan1,2,CHENG Jie-ren1,2,3,DONG Zhe1,LI Jun-qi1   

  1. (1.School of Computer Science & Cyberspace Security,Hainan University,Haikou 570228;
    2.Key Laboratory of Internet Information Retrieval of Hainan Province,Hainan University,Haikou 570228;
    3.State Key Laboratory of Marine Resource Utilization in South China Sea,Hainan University,Haikou 570228,China)
     
     
  • Received:2018-12-21 Revised:2019-03-19 Online:2019-08-25 Published:2019-08-25

Abstract:

The distributed denial of service (DDoS) attack is one of the main threats to internet security. Most of the current detection methods based on single feature cannot effectively detect early DDoS attacks in big data environment. We propose a feature adaptive DDoS attack detection method (FADADM) based on multiple kernel learning. We define five features to describe the characteristics of network flow according to the burstiness of DDoS attack flow, the distribution of address and the interactivity of communication. Based on ensemble learning framework, the weight of each dimension is adaptively adjusted by increasing the ratio of variance to mean (IS/M)and reducing the ratio of variance to the mean (RS/M), and by training the simple multiple kernel learning (SimpleMKL) model, two multiple-kernel learning models (IS/M-SimpleMKL and RS/M-SimpleMKL) with different characteristics are establish to identify early DDoS attacks. Experimental results show that the proposed method can detect early DDoS attacks quickly and accurately.
 

Key words: multiple-kernel learning, DDoS attack, self-adaption, ensemble learning