DeepDefense: Identifying DDoS Attack via Deep Learning

By Xiaoyong Yuan, Chuanhuang Li, Xiaolin Li. International Conference on Smart Computing, 2017

341 citations recorded by the source corpus.

Distributed Denial of Service (DDoS) attacks grow rapidly and become one of the fatal threats to the Internet. Automatically detecting DDoS attack packets is one of the main defense mechanisms. Conventional solutions monitor network traffic and identify attack activities from legitimate network traffic based on statistical divergence. Machine learning is another method to improve identifying performance based on statistical features. However, conventional machine learning techniques are limited by the shallow representation models. In this paper, we propose a deep learning based DDoS attack detection approach (DeepDefense). Deep learning approach can automatically extract high-level features from low-level ones and gain powerful representation and inference. We design a recurrent deep neural network to learn patterns from sequences of network traffic and trace network attack activities. The experimental results demonstrate a better performance of our model compared with conventional machine learning models. We reduce the error rate from 7.517% to 2.103% compared with conventional machine learning method in the larger data set.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/2550d4f922f9652c4755695c822e492161524bce

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Deep Learning Models for Cyber Security in IoT Networks (2019, background): “According to information provided in [4] the denial of service attack will reach 17 million by 2020.”
Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection (2020, methodology): “However, setting n = 100 not only maximises the F1 score, but also enables a fair comparison with state-of-theart approaches such as DeepDefense [4] (Section V), where the authors trained their neural networks using n = 100 (in [4], the hyper-parameter is denoted as T).”
Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey (2019, methodology): “[56] Session CNN and LSTM ISCX 2012 Radford et al.”