基于注意力机制的DDoS攻击检测方法  

Detection method of DDoS attack based on attention mechanism

作　　者：贾婧 王庆生 陈永乐 郭旭敏[2] JIA Jing;WANG Qing-sheng;CHEN Yong-le;GUO Xu-min(College of Information and Computer,Taiyuan University of Technology,Jinzhong 030600,China;Department of Computer Information and Engineering,Shanxi Youth Vocational College,Taiyuan 030000,China)

机构地区：[1]太原理工大学信息与计算机学院,山西晋中030600 [2]山西青年职业学院计算机信息与工程系,山西太原030000

出　　处：《计算机工程与设计》2021年第9期2439-2445,共7页Computer Engineering and Design

基　　金：山西省重点研发计划基金项目(高新技术领域)(201903D121121)。

摘　　要：针对传统DDoS攻击检测中存在准确率低、误报率高、低速率攻击流量难以检测等问题,提出一种基于注意力机制的双向长短期记忆网络的DDoS攻击检测方法。将根据领域知识所提取的明显攻击特征向量与数据预处理后的数据流矩阵进行向量拼接,构成基于注意力机制的双向长短期记忆网络数据输入格式,实现从原始流量的复杂级特征快速聚焦于DDoS攻击的隐含信息。通过CAIDA-2007数据集训练模型,实验结果表明,所提模型与传统机器学习模型相比准确率达到98.9%,检测效果优于其它算法,能够有效实现DDoS攻击检测。Aiming at the problems of low accuracy,high false alarm rate and low rate attack traffic detection in traditional DDoS attack detection,a bidirectional long-short term memory(BiLSTM)based on attention mechanism(Att-BiLSTM)DDoS attack detection method was proposed.The clear attack feature vectorization extracted based on domain knowledge and the data flow matrix after the data attack was visualized to form the long-short term memory network input format of the basic research data,which quickly focused the implicit information of DDoS attack from the complex level features of the original traffic.Through CAIDA-2007 dataset training model,experimental results show that the accuracy of the proposed model is 98.9%compared with the traditional machine learning model,its detection effect is better than other algorithms,and it can effectively implement DDoS attack detection.

关 键 词：分布式拒绝服务 注意力机制 领域知识 双向长短期记忆网络 误报率低 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]