基于深度学习和集成学习的DDoS攻击检测方法  

DDoS attack detection method based on deep learning and ensemble learning

作　　者：葛浩伟 杨启航 石乐义[2] GE Haowei;YANG Qihang;SHI Leyi(College of Oceanography and Space Informatics,China University of Petroleum(East China),Qingdao 266580,China;College of Computer Science and Technology,China University of Petroleum(East China),Qingdao 266580,China)

机构地区：[1]中国石油大学(华东)海洋与空间信息学院,山东青岛266580 [2]中国石油大学(华东)计算机科学与技术学院,山东青岛266580

出　　处：《现代电子技术》2024年第3期63-67,共5页Modern Electronics Technique

基　　金：国家自然科学基金国际合作交流项目(6201101324);国家重点研发计划子课题(2019YFF0301801)基金。

摘　　要：针对DDoS攻击检测问题,提出一种深度集成学习算法,可以有效检测DDoS攻击并解决分类不平衡问题。该算法使用一种类权重投票算法并由若干深度学习子模型组成,子模型采用1D-CNN和BILSTM提高模型时序提取性能,并利用2D-CNN提取空间特征,综合捕捉了样本的时空特性。在数据处理方面,通过对实验数据流量基于IP等特征进行分段,并将其转换为灰度图像,增强了模型对时空特征的感知能力,同时避免了传统手动特征提取可能引起的数据缺失问题。实验结果表明,该方法在多分类问题上达到了99.63%的准确率,可以准确检测DDoS攻击流量。This study addresses the issue of DDoS(distributed denial of service)attack detection and proposes a deep ensemble learning algorithm that can effectively detect DDoS attacks and mitigates classification imbalance.In the algorithm,a class⁃weighted voting mechanism is introduced.The algorithm is composed of multiple deep learning sub⁃models.These sub⁃models employ 1D⁃CNN and BILSTM(bi⁃directional long short⁃term memory)to enhance the model′s temporal feature extraction capability while utilizing 2D⁃CNN to extract spatial features,which comprehensively captures the spatiotemporal characteristics of the samples.In terms of data processing,the experimental data flow is segmented based on IP and other features,and then transformed into grayscale images.This approach enhances the model′s ability to perceive spatiotemporal features,while avoiding potential data loss that could arise from traditional manual feature extraction methods.The experimental results demonstrate that the method can achieve an accuracy of 99.63%in multi⁃classification,and can accurately detect DDoS attack traffic.

关 键 词：CNN LSTM DDOS 集成学习 深度学习 灰度图 

分 类 号：TN915.08-34[电子电信—通信与信息系统] TP393.0[电子电信—信息与通信工程]