SDN下基于CNN-LGBM的DDoS攻击检测研究  

Research on DDoS Attack Detection in SDN Based on Machine Learning

作　　者：杨国庆 李欣雨 张金莎 王小英[1,2] YANG Guo-qing;LI Xin-yu;ZHANG Jin-sha;WANG Xiao-ying(Institute of Disaster Prevention,Sanhe 065201,China;Langfang Key Laboratory of Network Emergency Protection and Network Security,Sanhe 065201,China)

机构地区：[1]防灾科技学院,河北三河065201 [2]廊坊市网络应急保障与网络安全重点实验室,河北三河065201

出　　处：《电脑与电信》2024年第12期53-57,共5页Computer & Telecommunication

摘　　要：软件定义网络(SDN)因其灵活性和敏捷性在网络管理中备受关注,但分布式拒绝服务(DDoS)攻击成为其主要威胁。为了解决现有检测方法误报漏报率高,计算和检测效率低以及公开数据集缺乏真实网络环境多样性等问题,提出了一种基于卷积神经网络(CNN)和LightGBM的DDoS攻击检测方法。在SDN环境下模拟攻击,构建包含攻击流量和正常流量的数据集。通过CNN提取特征,LightGBM进行分类。实验结果显示,所提出的CNN-LightGBM堆叠模型在准确率上显著优于传统方法,分类准确率超过99.96%。实验表明,该方法对于DDoS攻击检测具有较高的检测效果,提高了检测效率。Software-defined networking(SDN)is gaining significant attention in network management due to its flexibility and agility,but distributed denial of service(DDoS)attacks have emerged as a major threat.To address issues such as high false positive and false negative rates,low computational and detection efficiency,and the lack of diversity in real network environments in public datasets,this paper proposes a DDoS attack detection method based on convolutional neural networks(CNN)and LightGBM.We simulate attacks in an SDN environment and construct a dataset that includes both attack and normal traffic.CNN is used for feature extraction,and LightGBM for classification.Experimental results show that the proposed CNN-LightGBM stacked model significantly outperforms traditional methods,with a classification accuracy exceeding 99.96%.The experiments demonstrate that this method achieves high detection performance for DDoS attacks and improves detection efficiency.

关 键 词：软件定义网络 卷积神经网络 LightGBM 分布式拒绝服务 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]