Towards real-time ML-based DDoS detection via cost-efficient window-based feature extraction  

作　　者：Haibin LI Yi ZHAO Wenbing YAO Ke XU Qi LI 

机构地区：[1]Department of Computer Science and Technology,Tsinghua University,Beijing 100084,China [2]Institute for Network Sciences and Cyberspace,Tsinghua University,Beijing 100084,China [3]Beijing National Research Center for Information Science and Technology(BNRist),Beijing 100084,China

出　　处：《Science China(Information Sciences)》2023年第5期110-125,共16页中国科学（信息科学）（英文版）

基　　金：supported in part by China National Funds for Distinguished Young Scientists(Grant No.61825204);National Natural Science Foundation of China(Grant Nos.61932016,62132011,62202258);Beijing Outstanding Young Scientist Program(Grant No.BJJWZYJH01201910003011);China Postdoctoral Science Foundation(Grant No.2021M701894);China National Postdoctoral Program for Innovative Talents;Shuimu Tsinghua Scholar Program。

摘　　要：Distributed denial of service(DDoS)detection is still an open and challenging problem.In particular,sophisticated attacks,e.g.,attacks that disguise attack packets as benign traffic always appear,which can easily evade traditional signature-based methods.Due to the low requirements for computing resources compared to deep learning,many machine learning(ML)-based methods have been realistically deployed to address this issue.However,most existing ML-based DDo S detection methods are highly dependent on the features extracted from each flow,which incur remarkable detection delay and computation overhead.This article investigates the limitations of typical ML-based DDo S detection methods caused by the extraction of flow-level features.Moreover,we develop a cost-efficient window-based method that extracts features from a fixed number of packets periodically,instead of per flow,aiming to reduce the detection delay and computation overhead.The newly proposed window-based method has the advantages of well-controlled overhead and wide support of common routers due to its simplicity and high efficiency by design.Through extensive experiments on real datasets,we evaluate the performance of flow-based and window-based methods.The experimental results demonstrate that our proposed window-based method can significantly reduce the detection delay and computation overhead while ensuring detection accuracy.

关 键 词：DDoS attack machine learning feature extraction detection delay COST-EFFICIENCY 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]