A Machine Learning Based Approach for Detecting DRDoS Attacks and Its Performance Evaluation

摘要: DRDoS (Distributed Reflection Denial of Service) attack is a kind DoS (Denial attack, in which third-party servers are tricked into sending large amounts data to the victims. That is, attackers use source address IP spoofing hide their identity and cause third-parties send victims as identified by field packet. This called reflection because benign services "reflecting" traffic The most typical existing detection methods such attacks designed based on known protocol difficult detect unknown ones. According our investigations, one protocol-independent method has been existing, assumption that strong linear relationship exists among abnormal flows from reflector victim. Moreover, assumed all packets reflectors when attacked, clearly not reasonable. In this study, we found five features effective for detecting attacks, proposed using these machine learning algorithms. Its performance experimentally examined experimental result indicates proposal better performance.