Distributed denial of service attack detection method based on C4.5 decision tree algorithm

Abstract

The invention discloses a distributed denial of service attack detection method based on a C4.5 decision tree algorithm in software defined network environment, and the method comprises the followingsteps: collecting flow table information returned back by an OpenFlow switch through an OpenFlow protocol; extracting field information related to a DDoS attack from the flow table information, converting the extracted information into parameters capable of analyzing network flow distribution variation and taking the parameters as attributes, and forming a training set of a decision tree; classifying flows with the C4.5 decision tree algorithm, calculating class information entropy according to training set data classes; orderly calculating conditional entropy of the attributes, gain of information, information entropy of the attributes and information gain ratio of the attributes; selecting the attribute with the highest information gain ratio as a root node of the decision tree, and selecting the attributes with highest information gain ratio from the residual attributes as a fork node, and repeating the steps above until forming the decision tree; and using the finally formed decision tree to perform classification operation for the new network flow, and detecting whether the DDoS attack exists. The method can detect the DDoS attack more accurately.

Description

Technical field [0001] The invention relates to the field of computer communication technology, and is a method for detecting a denial of service attack in a software-defined environment, in particular to a method for detecting a distributed denial of service attack based on a C4.5 decision tree algorithm. Background technique [0002] At present, the number of network devices connected to the Internet is increasing rapidly. Not only is the rapid increase of mobile devices, but the development of emerging technologies has also led to a rapid increase in the number of network devices. Correspondingly, the continuous expansion of network scale will lead to more complex networks and bring more challenges. However, the existing network technology and facilities cannot realize such an increasingly complex system. In order to design future networks that can meet these rapidly developing needs, many methods have been proposed, and software-defined networking is one of the more importan...

AI Technical Summary

Problems solved by technology

In addition, potential victims and attackers can be found through continuous monitoring of data packet flow; the detection success rate of these methods is low and the frequency of false alarms is relatively high

Images