DDOS attack detection method based on Riemannian manifold structure of streaming data

Abstract

The invention discloses a DDoS attack detection method based on the Riemannian manifold structure of flow data. The present invention first performs mathematical modeling on flow data, preprocesses high-dimensional and complex flow data features, and finally takes "work" as the only feature describing flow data; then, uses Fourier transform to obtain the frequency of "work" The domain information and the information entropy of calculating "work" are used as the input features of machine learning. The method of the invention is a light-weight detection method, which has few data features for training, and has a fast detection speed for DDoS attacks; meanwhile, the method has low technical difficulty but high accuracy.

Description

technical field [0001] The invention relates to the technical field of DDoS attack detection, in particular to a DDoS attack detection method based on the Riemannian manifold structure of flow data. Background technique [0002] In recent years, the research hotspots for DDoS attack detection are mainly concentrated in the field of machine learning. However, most machine learning methods require a large number of high-quality data sets as training data, or use relatively difficult deep learning algorithms to obtain better detection results. This leads to excessive detection costs and resource consumption of these methods, resulting in the cost of detecting and defending against DDoS attacks being much higher than the cost of attack implementation. Detection products for DDoS attacks are expensive and not easy to popularize. [0003] For example, David J et al. (David J, Thomas C. DDoS attack detection using fastentropy approach on flow-based network traffic [J]. Procedia Co...

AI Technical Summary

Problems solved by technology

In the network environment with complex data flow, it is still doubtful whether this method has good feasibility

[0006] There are two relatively concentrated problems in the existing technology: 1) the data to be detected lacks a strict mathematical model for data preprocessing; 2) the detection method using machine learning often ignores the characteristics or laws of the attack itself, and it is relatively simple to rely on machine The computing power of learning to "violently classify" data

Images