Efficient DDoS attack detection method based on explainable AI

Abstract

The present invention discloses a DDoS attack detection method based on explainable AI, CapNet, which aims to improve detection accuracy, explainability and computational efficiency. CapNet uses an optimized ResNet50 to extract features from one-dimensional network traffic, combines the SelfNet module to optimize classification performance, and introduces the Captum module to calculate feature contribution, thereby achieving model transparency and explainability. Experimental verification shows that CapNet's F1 score exceeds 99.9% in both binary and multi-classification tasks, and through feature selection, the number of features is reduced from 79 to 2, the training time is shortened by nearly 10 times, and an F1 score of more than 99% is maintained. The present invention is suitable for large-scale DDoS attack detection and is efficient and robust.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an efficient DDoS attack detection method based on explainable AI. Background Art

[0002] Digital transformation has significantly changed our lifestyles, while also creating new security challenges. Distributed denial-of-service (DDoS) attacks have become one of the most destructive threats in cyberspace. These attacks flood a targeted server or network with traffic, rendering it unable to provide services to legitimate users. According to statistics, approximately 7.9 million DDoS attacks were recorded globally in the first half of 2023. These attacks not only paralyze services but also severely impact user Quality of Service (QoS).

[0003] DDoS attacks are characterized by their significant distribution, suddenness, and stealth, posing significant challenges to network traffic analysis. Attackers often forge and proxy source addresses, leveraging "zombie computers" worldwide to launch attacks, making the source addresses widely distributed and difficult to track. Attack traffic surges in a very short period of time, causing a significant impact on the network. Furthermore, attack traffic disguised as normal traffic is extremely concealed. These characteristics make DDoS attacks difficult to prevent and detect.

[0004] Currently, many internet companies and cloud service providers invest heavily annually to combat DDoS attacks. However, relying on manual analysis of massive amounts of network data is no longer sufficient for real-time detection. Traditional attack signature-based detection systems rely on manually extracting features from known attacks and are ineffective against new DDoS attacks. Therefore, how to quickly and accurately identify DDoS attacks from complex network traffic and achieve refined traffic analysis and graphical display has become a pressing challenge in the field of network security.

[0005] For many years, machine learning has been widely used in DDoS attack detection. Traditional models, such as K-nearest neighbor (KNN), support vector machine (SVM), random forest (RF), and naive Bayes (NB), identify anomalies by classifying network traffic patterns. However, as DDoS attacks continue to evolve and become more sophisticated, the detection effectiveness of these methods has gradually declined.

[0006] In recent years, deep learning has provided new research directions for DDoS attack detection. Its powerful data representation capabilities enable it to identify complex traffic patterns. Convolutional neural networks (CNNs) have demonstrated promising DDoS detection potential by analyzing raw data patterns. Deep autoencoders can create concise data representations, capturing subtle malicious traffic patterns. Artificial neural networks (ANNs), through nonlinear activation functions, reveal complex relationships between input data, providing deep insights for detecting potential threats.

[0007] Although deep learning has significantly improved the accuracy, real-time nature, and automation of DDoS attack detection, it still faces four key challenges. First, as the number of network layers increases, the vanishing gradient problem becomes more common. Second, the changing distribution of data in open environments affects the robustness of the model. Third, complex deep learning models lack interpretability, making it difficult to track the causes of classification decisions. Finally, maintaining high accuracy and efficiency is challenging when dealing with large models and complex features, which can easily lead to overfitting and increased computational costs. Summary of the Invention

[0008] This paper proposes an efficient DDoS attack detection method based on explainable AI, CapNet, to optimize the vanishing gradient problem in DDoS attack detection, improve robustness, and enhance interpretability while maintaining high accuracy and efficiency. To achieve these goals, this paper adopts the following technical solutions. The system consists of:

[0009] 1. One-dimensional ResNet50

[0010] The one-dimensional ResNet50 model in CapNet adapts the original ResNet50's two-dimensional convolutional and pooling layers to a one-dimensional structure, adapting it to the characteristics of network traffic while retaining residual connections to prevent the vanishing gradient problem. Furthermore, the modified fully connected layers are better able to handle the output of one-dimensional features, thereby improving the model's classification performance and efficiency. These adjustments not only reduce computational resource consumption but also ensure high accuracy and robustness when processing large-scale DDoS attack data. Secondly, the model's robustness was verified through five-fold cross-validation and the introduction of new datasets.

[0011] 2. SelfNet module

[0012] Although ResNet50 already has powerful feature extraction capabilities, relying solely on ResNet50 may not be sufficient to fully meet the requirements of specific tasks when processing complex network traffic data, especially when high-precision detection of DDoS attacks is required. Therefore, the SelfNet module is introduced to optimize feature extraction. Its main components include multiple fully connected layers, which further abstract and optimize the features extracted from ResNet50 through nonlinear mapping. SelfNet works by stacking fully connected layers layer by layer, performing feature conversion and activation function processing on each layer, and thus capturing complex feature relationships and high-level abstract information. This design enables the model to more effectively improve classification performance when processing complex network traffic, ensure the refinement of feature extraction, and thus enhance the overall performance of the model.

[0013] 3.Captum module

[0014] The main purpose of introducing the Captum module is to address the "black box" nature of deep learning models, namely the lack of explainability of the model's decision-making process. DDoS attack detection systems require clear explanations of the contribution of each feature so that network administrators can understand and trust the model's output.

[0015] The Captum module is a key component in CapNet that enhances model interpretability. Its primary function is to quantify the contribution of each input feature to the model's output, making the model's decision-making process more transparent and easier for users to understand why the model makes a certain prediction. Captum's core mechanism calculates the impact of each input feature on the final prediction using methods such as the integrated gradient method.

[0016] The working principle of the Captum module can be summarized in the following steps:

[0017] S31. Select baseline input: First, select a baseline input as a reference point, usually a zero vector or other standard input. This baseline input serves as the starting point for feature contributions.

[0018] S32. Interpolated Input Data: Captum generates multiple interpolation points between the baseline input and the actual input. These interpolation points represent the transition state from "no features" to "actual features".

[0019] S33. Calculate gradients: For each interpolation point, Captum calculates the gradient of the model output relative to the input features, quantifying the contribution of each feature to the model prediction.

[0020] S4. Cumulative contribution: By integrating the gradients of all interpolation points, Captum finally generates the total contribution of each input feature to the model output.

[0021] The formula is as follows:

[0022]

[0023] in:

[0024] Official IG i (x) represents the input feature x i Contribution to the model prediction result f(x). i is the i-th feature of the actual input, x′ i is the i-th feature of the baseline input, usually the zero vector or the minimum value of the input. The parameter α is an interpolation parameter ranging from 0 to 1. The expression Represents the partial derivative of the model output with respect to the input feature x_i at the point x′+α(xx′) on the interpolation path.

[0025] The following steps are involved:

[0026] S1. Obtain the input DDoS traffic data set and preprocess the traffic data into a one-dimensional tensor.

[0027] S2. Input the one-dimensional tensor into the CapNet model to obtain the traffic classification results and feature contribution.

[0028] S3. Further select feature combinations based on feature contribution to achieve the goal of efficiently detecting DDoS attacks.

[0029] Furthermore, S1 includes the following steps:

[0030] S11, data loading: read the DDoS traffic dataset through the CSV file;

[0031] S12. Data type conversion and processing: Try to convert the feature column into numeric data. Replace the parts that cannot be converted with NaN to ensure data consistency, and delete records containing missing values.

[0032] S13, Feature Normalization: Normalize the data to ensure that the features have the same scale and reduce the impact on the model;

[0033] S14. Dataset division: Use the cross-validation method to divide the dataset into training and test sets to ensure the generalization performance of the model;

[0034] S15, Tensor conversion: Convert the preprocessed training data and test data into one-dimensional tensors to prepare for subsequent deep learning model input.

[0035] Furthermore, S2 includes the following steps:

[0036] The traffic input data is subjected to feature extraction through several ResNet residual blocks, ultimately obtaining the traffic classification results. The residual blocks use a combination of local and global feature extraction to extract multi-level features of the input traffic.

[0037] Furthermore: the local feature extraction module includes a first one-dimensional convolutional layer, a batch normalization layer (BatchNorm1d) and a ReLU activation function connected in sequence.

[0038] Furthermore: the global feature extraction module is a global average pooling layer (GlobalAverage Pooling), which is used to extract the global representation of local features and input it into the fully connected layer for classification.

[0039] The specific steps are as follows:

[0040] SA1, convolution and initial feature extraction: The one-dimensional tensor is input into the network, and the initial feature extraction is performed through the first one-dimensional convolution layer (kernel size is 7, stride is 2), and after batch normalization (BatchNorm1d) and ReLU activation function, the initial feature map is output.

[0041] SA2, Residual Block Processing: The initial feature map passes through multiple residual blocks, each consisting of two layers of one-dimensional convolution, batch normalization, and ReLU activation. Residual connections ensure that input and output features can be superimposed, effectively alleviating the vanishing gradient problem and enhancing feature learning capabilities.

[0042] SA3, global feature extraction: After being processed by the residual block, the feature map passes through the global average pooling layer to compress all feature dimensions into a global feature representation of a fixed length.

[0043] SA4. Classification result output: The global feature representation passes through the fully connected layer (FC layer) and is processed by several linear layers and ReLU activation layers to finally output the traffic classification result.

[0044] Furthermore, in S3, feature combinations are further selected based on feature contribution to achieve the purpose of efficiently detecting DDoS attacks. The specific method is as follows:

[0045] S31. Calculate Feature Contribution: The Captum module uses the integrated gradient method to perform an importance analysis on the input features and calculate the contribution of each feature to the model output. This method quantifies the impact of each feature on the model classification result by integrating the gradient of the model output with respect to each input feature.

[0046] S32. Screening for important features: Based on the calculated feature contributions, select the most contributing feature combinations and retain the features that have a significant impact on DDoS attack detection. Low-contribution or redundant features will be removed to improve the model's detection efficiency and accuracy.

[0047] S33. Optimize feature sets: By iteratively adjusting feature combinations and verifying the impact of different feature combinations on DDoS attack detection, an optimal feature subset is determined to ensure that the computational complexity of the model is reduced while retaining detection accuracy.

[0048] S34. Final detection: Use the selected feature combination to perform the final detection of the model, effectively improving the speed and accuracy of DDoS attack detection.

[0049] The beneficial effects of the present invention are:

[0050] (1) The present invention provides a fast and efficient DDoS attack detection method based on explainable AI - CapNet. By combining the optimized ResNet50 model with the SelfNet module, the detection speed and accuracy of DDoS attacks in network traffic are effectively improved. The CapNet model is optimized for one-dimensional traffic data, which greatly reduces the consumption of computing resources while improving the response speed of the model. The SelfNet module further enhances the effect of feature extraction, thereby improving the accuracy of classification. In order to increase the interpretability of the model, the Captum module is added to help users understand the decision-making process of the model by analyzing the contribution of each feature to the detection results. Compared with existing methods, the present invention significantly improves the detection efficiency and accuracy of DDoS attacks.

[0051] (2) The purpose of the present invention is to quickly and accurately detect DDoS attacks in the network. By combining the optimized ResNet50 structure and the SelfNet module, a detection method that can efficiently process one-dimensional network traffic data is proposed. The present invention not only improves the detection speed of DDoS attacks, but also improves the detection accuracy. The analysis of feature contributions by the Captum module further enhances the interpretability of the model, helping users understand how the model derives detection results, thereby achieving fast and reliable DDoS attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a model diagram of the present invention;

[0053] Figure 2 This is the SelfNet module structure diagram. DETAILED DESCRIPTION

[0054] This paper proposes a DDoS attack detection model CapNet based on explainable AI. By using deep learning technology and feature selection methods, it can efficiently and accurately detect DDoS attacks in the network. The specific implementation steps are as follows:

[0055] S1, input data preprocessing;

[0056] S2. Input the data into the CapNet model to obtain the traffic classification results and feature contribution;

[0057] S3. Further select feature combinations based on feature contribution to find the minimum feature combination to achieve efficient DDoS attack detection.

[0058] S4. Use the key feature set after feature screening to verify on other datasets;

[0059] The S1 comprises the following sub-steps:

[0060] S11. The input network traffic data contains 79 features. Missing and invalid values ​​are processed through data cleaning.

[0061] S12. Use feature scaling technology to standardize the data to ensure fairness between features;

[0062] S13. Convert the traffic data into a one-dimensional tensor.

[0063] In S2, the CapNet model is based on the ResNet50 architecture and optimizes the residual network to handle one-dimensional traffic data. The model is trained using a pre-processed feature set. The SelfNet module further optimizes the features extracted from ResNet50 to improve model accuracy. The Captum module calculates feature contributions, enhancing interpretability and model transparency.

[0064] like Figure 1 As shown, in this embodiment, the CapNet model consists of optimized ResNet50, SelfNet and Captum modules, which are used to efficiently detect DDoS attacks in the network. First, the input 79-dimensional network traffic feature sequence is preliminarily processed by the optimized structure of ResNet50. The convolution layer of ResNet50 has been adjusted to a one-dimensional convolution layer (Conv1d), which can process one-dimensional traffic data characteristics and extract the initial time series features through a one-dimensional convolution kernel. Subsequently, the data stream passes through multiple bottleneck blocks (BottleneckBlock) in sequence. Each bottleneck block contains three convolution operations and batch normalization (BatchNormalization). The residual connection ensures effective information transmission, avoids gradient disappearance, and fully extracts the key features in the time series. Through the adaptive average pooling layer (AdaptiveAvgPool1d), input sequences of different lengths are compressed into feature representations of uniform size to ensure the uniformity and stability of subsequent processing.

[0065] Then, the data after ResNet50 feature extraction enters the SelfNet module for deep optimization. Figure 2As shown in the figure, the SelfNet module consists of multiple fully connected layers designed to further abstract and optimize the features extracted from ResNet50. First, the features are linearly transformed through fully connected layers. Batch Normalization is then used to maintain numerical stability and prevent data distortion during inter-layer transmission. Nonlinearity is introduced through the ReLU activation function to enhance the model's ability to represent complex features. This process is iterative, abstracting high-level feature information layer by layer, ultimately generating the most optimized feature representation in the final fully connected layer. Through the processing of the SelfNet module, the model can more accurately identify complex patterns in network traffic, effectively improving the detection accuracy of DDoS attacks and the robustness of the model.

[0066] Finally, the Captum module was introduced for feature importance analysis. This module uses the integrated gradient method to calculate the contribution of each input feature to the model's prediction results. By interpolating the input features with the baseline input, Captum calculates the gradient of the model output with respect to the feature and integrates the gradient at the interpolation point to ultimately determine the contribution of each feature. Captum's feature analysis significantly improves the interpretability of the model, allowing users to intuitively understand which features have a critical impact on the final classification results, enhancing the model's transparency and credibility. The model ultimately outputs the network traffic classification results and the contribution of each feature, providing a reliable basis for efficient DDoS attack detection.

[0067] In S3, the Captum module uses the integrated gradient method to calculate the contribution of each feature to the model output. The specific calculation steps are as follows: First, a baseline input is selected as a reference (usually a vector of all zeros or a minimum value). Then, the actual input is interpolated with the baseline input to generate multiple intermediate input points. For each interpolation point, the gradient of the model output with respect to each input feature is calculated. Finally, these gradient values ​​are integrated along the interpolation path to obtain the overall contribution of each feature to the model output. Through this method, Captum can effectively quantify the impact of each input feature on the classification result, thereby helping to guide feature selection and find the minimum feature set to maintain efficient DDoS attack detection performance. S31. The 79 features initially selected achieved an F1 score of 99.96% after training. Feature contribution analysis identified 15 key features: Total Fwd Packets, Total Length of Bwd Packets, Fwd Packet Length Min, Bwd Packet Length Std, Bwd Urg Flags, Bwd Packets / s, Max Packet Length, PSHFlag Count, ACK Flag Count, Average Packet Size, Avg Bwd Segment Size, BwdAvg BulkRate, Subflow Bwd Bytes, Init Winbytesbackward, and Similar HTTP. These features were used to train the model.

[0068] S32. After further feature selection, the model accuracy was 99.81%. Four features were selected: Total Fwd Packets, Fwd Packet Length Min, Max Packet Length, and ACK Flag Count. The model was then trained based on these features.

[0069] S33. After the second round of feature screening, the model's F1 score was 99.75%. Finally, the two most contributing features were selected: Maximum Packet Length and Acknowledgement Flag Count.

[0070] S34. Finally, the model trained using these two features achieved an F1 score of 99.17%. Feature contribution analysis shows that these two features are representative in DDoS attack detection:

[0071] Maximum packet length: Used to detect DDoS attacks. DDoS attacks often manifest as a flood of large or small packets, leading to excessive consumption of network resources. Therefore, maximum packet length is a key feature for identifying attacks.

[0072] Acknowledgement Flag Count (ACK Flag Count): Used to distinguish normal traffic from abnormal traffic. The ACK flag reflects the stability of the TCP connection and the reliability of data transmission in normal traffic. By monitoring the ACK flag count, you can effectively distinguish normal traffic from abnormal traffic.

[0073] By further reducing the number of features, the training time of the model is significantly shortened, from 246.77 seconds for 2 features to 2840.63 seconds for 79 features, a reduction of nearly 10 times.

[0074] In S4, the model's generalization and robustness were further evaluated by applying the most representative features identified in the initial screening to various datasets. During validation, the model maintained high-accuracy DDoS attack detection across these datasets, achieving an F1 score of 98.78%, demonstrating the model's adaptability and detection stability across diverse network environments. This validation step ensured the model's broad applicability in diverse scenarios, effectively addressing DDoS attack detection requirements across diverse network structures and traffic patterns.

[0075] Due to the wide variety of DDoS attacks and the significant differences in traffic characteristics between different attack types, it is necessary to ensure that the model can not only detect a single type of DDoS attack, but also maintain efficient detection performance when facing multiple attack types. In order to verify the generalization ability and robustness of the CapNet model in dealing with multiple types of attacks, this paper conducted a multi-classification experiment covering a variety of common DDoS attack types, namely PORTMAP, LDAP, MSSQL, NetBIOS, SYN, UDP, and UDPLag. The specific steps are as follows: S1, dataset preprocessing;

[0076] S2. Model training and classification.

[0077] The specific steps in S1 include:

[0078] S11. Obtain a network traffic dataset containing various DDoS attack types. Ensure that the dataset covers common attack types (PORTMAP, LDAP, MSSQL, NetBIOS, SYN, UDP, UDPLag) as well as normal traffic to ensure data diversity and representativeness.

[0079] S12. Standardize the acquired traffic data so that each feature dimension has the same numerical range, ensure the dimensional consistency between features, and eliminate the impact caused by scale differences between features;

[0080] S13. Convert the standardized traffic data into a one-dimensional tensor suitable for deep learning model processing as input for subsequent model training and inference.

[0081] The specific steps in S2 include:

[0082] S21. Train the CapNet model on the preprocessed traffic data. First, perform preliminary feature extraction using the optimized ResNet50 network. Use one-dimensional convolutional layers to process the temporal characteristics of network traffic. Use residual connections to prevent gradient vanishing and extract deep features. The extracted features are then fed into the SelfNet module for further nonlinear feature mapping and high-dimensional feature optimization to enhance the model's classification performance.

[0083] S22. Conduct multiple experiments using different feature combinations (79 features, 15 features, 4 features, and 2 features) to evaluate the effectiveness of each feature combination in multi-classification tasks, compare the impact of different combinations on classification accuracy, training time, and model robustness, and ultimately select the optimal feature subset to achieve efficient and accurate DDoS attack detection.

[0084] In the multi-classification experiment of the present invention, the CapNet model was tested on various DDoS attack types (including PORTMAP, LDAP, MSSQL, NetBIOS, SYN, UDP, and UDPLag). The experimental results show that different feature combinations have a significant impact on the classification performance of the model. When using 79 features, the model's classification accuracy for each attack type is close to 100%, such as PORTMAP (99.76%), LDAP (99.35%), MSSQL (99.75%), SYN (99.86%), and UDPLag (100%), indicating that the model has extremely high classification performance under full features. When using 15 features, although the overall accuracy decreases, the model can still maintain a high classification performance. For example, the accuracy for types such as PORTMAP (99.08%) and NetBIOS (98.95%) is close to 98%, but the accuracy of some types such as UDP (92.71%) decreases. When using four features, the overall model accuracy decreased, especially for LDAP (94.82%) and UDP (88.41%) types, indicating that reducing the number of features has an impact on model performance. When using two features, the model's accuracy remains high for some types, such as MSSQL (99.95%) and SYN (99.90%), but its accuracy is significantly lower for types such as UDP (87.31%) and UDPLag (84.55%), indicating that oversimplification of features is ineffective in detecting some attack types.

[0085] In general, as the number of features decreases, the classification accuracy of the model will decrease, but with the combination of two features, the model can still maintain a high accuracy in most attack types.

[0086] The advantages of the present invention are as follows:

[0087] 1. Efficient DDoS attack detection: By combining optimized ResNet50, SelfNet, and Captum modules, it can accurately identify DDoS attack patterns in network traffic and effectively filter out the most representative features through an integrated gradient method, thereby maintaining high-precision detection while reducing the feature set.

[0088] 2. Significantly Reduced Training Time: By analyzing feature contribution, we gradually narrowed down the set of 79 features to the final two key features, significantly reducing model training time. Compared to the full feature set, this reduced feature set reduced training time by nearly 90%, significantly improving model training efficiency and computing resource utilization.

[0089] 3. Enhanced model interpretability: The Captum module uses an integrated gradient method to calculate the contribution of each feature to the model output, making the model highly interpretable. Users can clearly understand which features have the greatest impact on the classification results, improving the transparency and credibility of the model.

[0090] 4. Wide adaptability: The present invention demonstrates strong generalization and robustness across multiple datasets, with detection accuracy consistently above 99%. This demonstrates the model's wide adaptability across diverse network scenarios and its suitability for DDoS attack detection in various complex network environments.

[0091] 5. Improved Resource Utilization: This invention reduces model complexity through feature screening, significantly reducing computing resource consumption. Ultimately, efficient detection is achieved with only two features, significantly improving the system's real-time performance and resource efficiency, and making the model highly applicable in large-scale traffic monitoring. In summary, this invention proposes CapNet, an efficient DDoS attack detection model based on explainable AI. By combining optimized ResNet50, SelfNet, and Captum modules, this model significantly improves the efficiency of DDoS attack detection in network traffic while maintaining detection accuracy and enhancing model interpretability. By introducing one-dimensional convolution to extract features from time series of traffic data, CapNet effectively captures the characteristics of DDoS attacks. The SelfNet module further optimizes features, enhancing the model's classification capabilities in complex traffic. The Captum module calculates feature contributions, enhancing model transparency and helping users understand the model's decision-making process. In multi-classification experiments, CapNet demonstrated superior detection capabilities for various types of DDoS attacks. Even with a reduced number of features, the model maintains high detection accuracy and robustness, demonstrating its efficiency and reliability in large-scale DDoS attack detection. The detection method provided by this invention is not only applicable to binary classification tasks but can also effectively address multiple attack scenarios. It has broad application prospects and can provide an efficient, accurate, and explainable DDoS attack detection solution for network security.

Claims

1. A DDoS attack detection method based on explainable AI, characterized by: The following steps are involved: S1: Preprocess network traffic data; S2: Convert the preprocessed traffic data into a one-dimensional tensor and input it into the CapNet model for classification and output feature contribution; The CapNet model consists of a one-dimensional ResNet50 model, a SelfNet module, and a Captum module; The SelfNet module performs deep optimization on the features initially extracted by the one-dimensional ResNet50 model. Specifically, the SelfNet module performs a linear transformation on the initially extracted features through a fully connected layer, uses batch normalization to maintain numerical stability, and introduces nonlinearity through the ReLU activation function. This process is repeated multiple times, abstracting high-level feature information layer by layer, and ultimately generating an optimized feature representation in the final fully connected layer, outputting the traffic classification result. The Captum module uses an integrated gradient method to calculate the feature contribution of each feature to the model output, specifically including: selecting a baseline input as a reference point; generating multiple interpolation points between the baseline input and the actual input; for each interpolation point, calculating the gradient of the model output relative to each input feature; and finally generating the feature contribution of each input feature to the model output by integrating the gradients of all interpolation points.

2. The DDoS attack detection method based on explainable AI according to claim 1 is characterized in that: The step S1 includes the following sub-steps: S11: Process missing values ​​and invalid values ​​through data cleaning; S12： Feature scaling techniques are used to standardize the data.

3. The DDoS attack detection method based on explainable AI according to claim 1, characterized in that: Based on the feature contribution output by the Captum module, the features that contribute most to DDoS attack detection are further selected.

Images