DDOS attack detection method and device based on lstm prediction model

Abstract

The invention provides DDoS attack detection method based on a LSTM (Long Short-Term Memory) prediction model. The method comprises the following steps: sampling normal network traffic for n times according to certain sampling period, and calculating to obtain the IP packet statistical feature values of n normal networks, wherein n belongs to N; training the to-be-trained LSTM prediction model according to the IP packet statistical feature values of the n normal networks; determining the probability (Dropout=0.2) of selectively discarding a neuron by using grid search and hyper-parameter optimization, so as to correct the LSTM prediction model and relieve the over-fitting phenomenon; according to the corrected LSTM prediction model, calculating the predicted values of the IP packet statistical feature values in a further time interval; judging whether current network experiences DDoS attack according to the predicted values.

Description

technical field [0001] The invention relates to the technical field of network communication technology, in particular to a DDoS attack detection method and device based on an LSTM prediction model. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, referred to as DDoS) attack is currently hackers often use and difficult to prevent attacks. In recent years, with the rapid development of electronic encrypted virtual currency and the continuous increase of Internet of Things devices, DDoS attack methods have become more diversified, posing a huge threat to Internet security. [0003] In the prior art, Zheng Y et al. analyzed from the data packet level and session level, and proposed a detection algorithm based on PCC time series, but this detection method cannot distinguish DDoS attacks and flash crowd events well, resulting in false positives. The return rate is higher. Nezhad S M T et al proposed a DoS and DDoS attack detection algo...

AI Technical Summary

Problems solved by technology

[0003] In the prior art, Zheng Y et al. analyzed from the data packet level and session level, and proposed a detection algorithm based on PCC time series, but this detection method cannot distinguish DDoS attacks and flash crowd events well, resulting in false positives. higher return rate

Nezhad S M T et al proposed a DoS and DDoS attack detection algorithm based on the ARIMA time series model and the chaotic system in the computer network, but this method only uses a certain number of data packets and source IP address information, and uses message information Fewer and can only detect a single type of DDoS attack

Andrysiak T et al. used the conditional variational method to optimize the parameters of the time series model to detect DDoS attacks. This detection method can improve the detection rate of DDoS attacks to a certain extent, but its algorithm complexity is high, so there is a certain lag in the detection results. sex

Images