DDoS attack detection model based on Bayesian ARTMAP in software-defined networks

doi:10.3969/j.issn.1000-1565.2021.06.013

Abstract

Abstract: In order to solve the problem of distributed denial of service(DDoS)attack detection under software defined network(SDN)architecture, a DDoS attack detection model based on Bayesian ARTMAP is proposed: the traffic statistics module mainly collects the captured flow table information, and then sends it to the feature extraction module. The feature extraction module extracts the key information in the flow table and provides the key features according to the set method, and these features are finally sent to the classification detection module. Classification detection module extracts classification rules by Bayesian ARTMAP, and optimizes parameters by particle swarm optimization to classify new data sets. Experiments show that the 5 yuan features extracted by the model are effective, and the detection success rate of the model is increased by 0.96%-3.71%, and the false alarm rate is reduced by 0.67%-2.92% compared with the three DDoS attack detection models based on C4.5 decision tree, feature pattern graph model and K-means algorithm model.

Key words: software-defined network, DDoS attack, Bayesian ARTMAP, feature extraction, detection model

CLC Number:

TP309

LIU Zhenpeng, ZHANG Qingwen, LI Zeyuan, LIU Jiahang, DONG Shuhui, ZHAO Yonggang. DDoS attack detection model based on Bayesian ARTMAP in software-defined networks[J]. Journal of Hebei University(Natural Science Edition), 2021, 41(6): 728-733.

References

[1] SINGN J, BEHAL S. Detection and mitigation of DDoS attacks in SDN: a comprehensive review, research challenges and future directions[J]. Computer Science Review, 2020,37: 100279. DOI:10.1016/j.cosrev.2020.100279.
[2] LIU Y F, ZHAO B, ZHAO P Y, et al. A survey: Typical security issues of software-defined networking[J]. China Communications, 2019,16(7):13-31. DOI:10.23919/JCC.2019.07.002.
[3] 岳猛,王怀远,吴志军,等. 云计算中DDoS攻防技术研究综述[J].计算机学报,2020,43(12):2315-2336. DOI:10.11897/SP.J.1016.2020.02315.
[4] 刘俊杰,王珺,王梦林,等. SDN中基于C4.5决策树的DDoS攻击检测[J].计算机工程与应用, 2019,55(20):84-88. DOI:10.3778/j.issn.1002-8331.1808-0343.
[5] 张龙,王劲松. SDN中基于信息熵与DNN的DDoS攻击检测模型[J].计算机研究与发展, 2019,56(5):909-918. DOI:10.7544/issn1000-1239.2019.20190017.
[6] 曹永轶,金伟正,吴静,等. 一种面向SDN的跨平面协作DDoS检测与防御方法[J].计算机工程, 2020,46(11):148-156. DOI:10.19678/j.issn.1000-3428.0055831.
[7] XIAO Y, FAN Z J, NAYAK A, et al. Discovery method for distributed denial-of-service attack behavior in SDNs using a feature-pattern graph model[J]. Frontiers of Information Technology & Electronic Engineering, 2019,20(9):1195-1208. DOI:10.1631/FITEE.1800436.
[8] SASU L M, ANDONIE R. Bayesian ARTMAP for regression[J]. Neural Networks, 2013,46:23-31. DOI:10.1016/j.neunet.2013.04.006.
[9] MASUYAMA N, LOO C K, DAWOOD F. Kernel Bayesian art and artmap[J]. Neural networks, 2018,98:76-86. DOI:10.1016/j.neunet.2017.11.003.
[10] 田俊峰,齐鎏岭. SDN中基于条件熵和GHSOM的DDoS攻击检测方法[J].通信学报, 2018,39(8):140-149. DOI:10.11959/j.issn.1000-436x.2018140.
[11] 刘振鹏,贺玉鹏,王文胜,等. SDN环境下的DDoS攻击检测方案[J].武汉大学学报(理学版), 2019,65(2):178-184. DOI:10.14188/j.1671-8836.2019.02.006.
[12] 杨志,韩俐. SDN环境下基于目的IP地址熵的DDoS攻击检测与易损机制研究[J]. 天津理工大学学报, 2020,36(4):39-44. DOI:10.3969/j.issn.1673-095X.2020.04.008.
[13] CHEN L, SINGH V P. Entropy-based derivation of generalized distributions for hydrometeorological frequency analysis[J]. Journal of Hydrology, 2018,557:699-712. DOI:10.1016/j.jhydrol.2017.12.066.
[14] FOULADI R F, ERMIS O, ANARIM E. A DDoS attack detection and defense scheme using time-series analysis for SDN[J].Journal of Information Security and Applications,2020,54:102587. DOI:10.1016/j.jisa.2020.102587.
[15] 汤可宗,李慧颖,李娟,等.一种求解复杂优化问题的改进粒子群优化算法[J].南京理工大学学报, 2015,39(4):386-391. DOI:10.14177/j.cnki.32-1397n.2015.39.04.002.
[16] 刘向举,刘鹏程,徐辉,等.基于软件定义物联网的分布式拒绝服务攻击检测方法[J].计算机应用, 2020,40(3):753-759. DOI:10.11772/j.issn.1001-9081.2019091611. (