基于深度学习的实时DDoS攻击检测  

Real-time DDoS attack detection based on deep learning

作　　者：李传煌[1] 孙正君[1] 袁小雍 李晓林[2] 龚梁[1] 王伟明[1] 

机构地区：[1]浙江工商大学信息与电子工程学院,浙江杭州310018 [2]美国佛罗里达大学大规模智能系统实验室,美国佛罗里达州盖恩斯维尔32611

出　　处：《电信科学》2017年第7期53-65,共13页Telecommunications Science

基　　金：国家高技术研究发展计划("863"计划)基金资助项目(No.2015AA011901);国家自然科学基金资助项目(No.61402408;No.61379120);浙江省重点研发计划基金资助项目(No.2017C03058)~~

摘　　要：分布式拒绝服务(DDoS)攻击是一种分布式、协作式的大规模网络攻击方式,提出了一种基于深度学习的DDoS攻击检测方法,该方法包含特征处理和模型检测两个阶段:特征处理阶段对输入的数据分组进行特征提取、格式转换和维度重构;模型检测阶段将处理后的特征输入深度学习网络模型进行检测,判断输入的数据分组是否为DDoS攻击分组。通过ISCX2012数据集训练模型,并通过实时的DDoS攻击对模型进行验证。结果表明,基于深度学习的DDoS攻击检测方法具有高检测精度、对软硬件设备依赖小、深度学习网络模型易于更新等优点。Distributed denial of service （DDoS） is a special form of denial of service （DOS） attack based on denial of service（DoS）. It is a distributed, collaborative large-scale network attack. A DDoS detection method based on deep learning was presented. The method included two stages： feature processing and model detection： feature extraction, format conversion and dimension reconstruction of the input data packet was performed in feature processing stage; in the model detection stage, the processed features were input to the depth learning network model to detect whether the input data packets was DDoS attack packet. The model was trained by the ISCX2012 dataset, and the model was validated by real-time DDoS attack. The experimental results show that DDoS attack detection method based on deep learning has high detection precision, little dependency on hardware and software equipment, and the model of depth learning network is easy to update.

关 键 词：分布式拒绝服务 拒绝服务 深度学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]