电子学报 ›› 2022, Vol. 50 ›› Issue (2): 508-512.DOI: 10.12263/DZXB.20210009

• 科研通信 • 上一篇    下一篇

基于多模态深度神经网络的应用层DDoS攻击检测模型

周奕涛1,2, 张斌1,2, 刘自豪3   

  1. 1.战略支援部队信息工程大学,河南 郑州 450001
    2.河南省信息安全重点实验室,河南 郑州 450001
    3.61660部队,北京 100080
  • 收稿日期:2020-12-22 修回日期:2021-11-12 出版日期:2022-02-25 发布日期:2022-02-25
  • 作者简介:周奕涛 男,1996年生,湖南怀化人,信息工程大学硕士.主要研究方向为应用层DDoS攻击检测.E-mail: zyt1996715@163.com
    张 斌 男,1969年生,河南郑州人.现为信息工程大学教授,博士生导师.主要研究方向为网络空间安全.
  • 基金资助:
    信息保障技术重点实验室开放基金(KJ-15-109);信息工程大学新兴科研方向培育基金(2016604703);信息工程大学科研项目(2019f3303)

Application Layer DDoS Detection Model Based on Multimodal Deep Learning Neural Network

ZHOU Yi-tao1,2, ZHANG Bin1,2, LIU Zi-hao3   

  1. 1.SSF Information Engineering University,Zhengzhou,Henan 450001,China
    2.Key Laboratory of Information Security,Zhengzhou,Henan 450001,China
    3.No. 61660 Troop,Beijing 100080,China
  • Received:2020-12-22 Revised:2021-11-12 Online:2022-02-25 Published:2022-02-25

摘要:

为进一步提升应用层DDoS攻击检测准确率,提出一种将流量与用户行为特征相结合且模型参数可高效更新的应用层DDoS攻击检测模型.为统一处理流量与用户行为特征的异源数据,利用多模态深度(Multimodal Deep Learning,MDL)神经网络从数据流量与网页日志中提取流量与用户行为深层特征后输入汇聚深度神经网络进行检测.为减少MDL神经网络参数更新时的灾难性遗忘现象,在模型参数更新过程中基于弹性权重保持(Elastic Weight Consolidation,EWC)算法为重要模型参数增加惩罚项,保持对初始训练数据集检测准确率的同时,提升对新数据集的检测性能.最后,基于K-Means算法获得模型初始训练数据集聚类,并筛选出新数据集中聚类外数据进行模型参数更新,防止EWC算法因数据相关性过高而失效.实验表明,所提应用层DDoS检测模型检测准确率可达98.2%,且相对MLP_Whole方法模型参数更新性能较好.

关键词: 应用层DDoS攻击, 攻击检测模型, 多模态深度神经网络, 弹性权重保持算法, 参数更新

Abstract:

To further improve the accuracy of application-layer DDoS attack detection, an application-layer DDoS attack detection model is proposed to combine traffic and user behavior features and to update model parameters efficiently. To integrate the heterogeneous data of traffic and user behavior characteristics, a multimodal deep learning(MDL) neural network is applied to extract the deep features of traffic and user behavior, which are employed for detection. To alleviate catastrophic forgetting in the update process of the MDL neural network, a penalty item is added to the important parameters based on the elastic weight consolidation(EWC) algorithm. The detection performance on the new dataset is improved while maintaining the detection accuracy of the initial training dataset. Based on the K-Means algorithm, the clusters of the initial training dataset are calculated. To prevent the EWC algorithm from failing due to high data correlation, the data outside the clusters are used to update model parameters. Experiments show that the detection accuracy of the proposed application layer DDoS detection model reaches 98.2%, and it has better model update performance than the MLP_Whole method.

Key words: application layer DDoS attack, attack detection model, multimodal deep learning network, elastic weight consolidation algorithm, parameter update

中图分类号: