关键词: 多类型, 应用层DDoS攻击, 分布式拒绝服务攻击, 机器学习, 集成学习

Abstract: Abstract: Aiming at the problems that there are many types of application-layer DDoS attacks and it is difficult to detect them, an application-layer DDoS attacks detection method based on integrated learning was proposed to detect multiple types of application-layer DDoS attacks. First, the data set generation module simulated normal and attack traffic, filtered and extracted corresponding characteristic information, and generated 47-dimensional characteristic information that characterized CC, HTTP Flood, HTTP Post and HTTP Get attacks; secondly, the offline training module processed the effective characteristics. After the information was input and integrated, the Stacking detection model was trained to obtain a detection model that can detect multiple types of application-layer DDoS attacks; finally, the online detection module judged the specific traffic type of the traffic to be detected through the detection model deployed online. The experimental results show that, compared with the classification models constructed by Bagging, Adaboost and XGBoost, the Stacking model improves the accuracy by 0.18%, 0.21% and 0.19% respectively, and the malicious traffic detection rate reaches 98% under the optimal time window. It can be seen that the proposed method has good performance in detecting multi-type application layer DDoS attacks.

Key words: Keywords: multiple types, application-layer DDoS attacks, distributed denial of service attacks, machine learning, integrated learning