基于集成特征选择的DoS/DDoS攻击流量检测方法  

DoS/DDoS Attack Traffic Detection Method Based on Integrated Feature Selection

作　　者：陈晓 李志猛 张浩 阎少宏 CHEN Xiao;LI Zhi-meng;ZHANG Hao;YAN Shao-hong(College of Science,North China University of Science and Technology,Tangshan Hebei 063210,China;Key Laboratory of Data Science and Application of Hebei,Tangshan Hebei 063210,China;Tangshan Key Laboratory of Data Science,Tangshan Hebei 063210,China;Mathematical Modeling Innovation Laboratory of North China University of Science and Technology,Tangshan Hebei 063210,China)

机构地区：[1]华北理工大学理学院,河北唐山063210 [2]河北省数据科学与应用重点实验室,河北唐山063210 [3]唐山市数据科学重点实验室,河北唐山063210 [4]华北理工大学数学建模创新实验室,河北唐山063210

出　　处：《华北理工大学学报（自然科学版）》2023年第2期84-94,共11页Journal of North China University of Science and Technology：Natural Science Edition

基　　金：国家自然科学基金(51974131);河北省数据科学与应用重点实验室项目(10120201);唐山市数据科学重点实验室项目(10120301)。

摘　　要：随着网络规模的不断扩大以及复杂程度的不断增加,网络中拒绝服务(Denial of Service,DoS)攻击和分布式拒绝服务(Distributed Denial of Service,DDoS)攻击的发生频率越来越高。一般方法很难同时保证检测的实时性和准确性。针对上述问题,对网络流量中的DoS和DDoS攻击流量进行分析,提出了一种将过滤法和嵌入法结合的集成特征选择算法。首先使用过滤法中的相关系数法进行特征排序,按一定比例抽取特征序列组成特征子集。随后通过嵌入法中的随机森林算法对特征子集进行二次特征选择。最后通过决策树和随机森林分类器验证所提算法的分类准确率与分类效率。实验结果表明,与单一嵌入法相比,运用集成特征选择算法后,各项评价指标平均提升6%。与单一过滤法相比,仅需其特征总量的1/6即可达到同样效果。With the continuous expansion of the network scale and the increasing complexity,the frequency of Denial of Service(DoS)attacks and Distributed Denial of Service(DDoS)attacks in the network is also increasing.It is difficult for general methods to ensure the real-time and accuracy of detection at the same time.Aiming at the above problems,the DoS and DDoS attack traffic in network traffic was analyzed,and an integrated feature selection algorithm combining filtering method and embedding method was proposed.Firstly,the correlation coefficient method in the filtering method was used to sort the features,and the feature sequences were extracted according to a certain proportion to form a feature subset.Then,the feature subset was selected twice by the random forest algorithm in the embedding method.Finally,the classification accuracy and classification efficiency of the proposed algorithm were verified by decision tree and random forest classifier.The experimental results show that compared with the single embedding method,the evaluation indexes are improved by 6%on average after using the integrated feature selection algorithm.Compared with the single filtering method,only 1/6 of the total amount of characteristics can achieve the same effect.

关 键 词：特征选择 DOS DDOS 集成选择 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]