Detecting DDoS Attacks Using Conditional Random Fields

Abstract:

In recent years, the detection technology based on machine learning algorithms for distributed denialof-service (DDoS) attacks has made great progress. However, previous methods fail to make full use of contextual information and rely heavily on the probability distribution of the input data. To avoid those pitfalls, the Conditional Random Fields (CRF) model is introduced in this paper for DDoS attacks detection. Firstly, the CRF is trained to build the classification model for DDoS attacks based on three groups of statistical features including conditional entropy, flag ratios and protocol ratios. Then, the trained CRF models are used to identify the attacks with model inference. Experimental results demonstrate that, the proposed approach can accurately distinguish between attacks and normal network traffic, and is more robust to resist disturbance of background traffic than its counterparts.

• Periodical: Applied Mechanics and Materials (Volumes 513-517)
• Pages: 522-526
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.513-517.522
• Online since: February 2014
• Authors: Yun Liu*, Si Yu Jiang, Xiao Jie Yuan
• Keywords: Conditional Random Fields, Distributed Denial of Service, Machine Learning

References

[1] Moore D, Voelker G, Savage, S. Inferring internet denial-of-service activity[C]. In: 10th USENIX Security Symposium. Washington, (2001).

DOI: 10.21236/ada400003

[2] Lafferty J, McCallum A, Pereira F. Conditional random fields: Probabilistic models for segmenting and labeling sequence data[C]. In: Brodley C, Danyluk A, eds. Proc. of the 18th Int'l Conf. on Machine Learning (ICML 2001), San Francisco, (2001).

DOI: 10.1145/1015330.1015422

[3] Yun Liu, Jianping Yin, Jieren Cheng, ea al. Detecting DDoS Attacks Using Conditional Entropy[C]. The International Conference on Computer Application and System Modeling, (2010).

DOI: 10.1109/iccasm.2010.5622759

[4] Sanguk N, Gihyun J, Kyunghee C, ea al. Compiling network traffic into rules using soft computing methods for the detection of flooding attacks[J]. Applied Soft Computing 2008, 8(3): 1200-1210.

DOI: 10.1016/j.asoc.2007.02.016

[5] Kumar S, Hebert M. Discriminative random fields: A discriminative framework for contextual interaction in cassification. In: Proc. of the IEEE Int'l Conf. on Computer Vision. 2003. 1150-1157.

DOI: 10.1109/iccv.2003.1238478

[6] Kumar S, Hebert M. Discriminative fields for modeling spatial dependencies in natural images. In: Proc. of the Conf. on Advances in Neural Information Processing Systems. 2003. 1531-1538.

[7] MIT Lincoln Laboratory. 2000. http: /www. ll. mit. edu/mission/communications/ist/corpora/ ideval/data/index. html.

[8] Vapnik V N. An overview of statistical learning theory. IEEE Transactions on Neural Networks, 1999, 10(5) : 988-999.

DOI: 10.1109/72.788640

[9] Rabiner L R. A Tutorial on Hidden Markov Models and Selected Application in Speech Recognition[J]. Proceedings of the IEEE, 1989, 77(2): 257-285.

DOI: 10.1109/5.18626