A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment
Distributed Denial of Service (DDoS) has developed multiple variants, one of which is Distributed Reflective Denial of Service (DRDoS). With the increasing number of Internet of Things (IoT) devices, the threat of DRDoS attack is growing, and the damage of a DRDoS attack is more destructive than oth...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2019-01-01
|
| Series: | Symmetry |
| Subjects: | |
| Online Access: | http://www.mdpi.com/2073-8994/11/1/78 |
| _version_ | 1817988804640768000 |
|---|---|
| author | Ruomeng Xu Jieren Cheng Fengkai Wang Xiangyan Tang Jinying Xu |
| author_facet | Ruomeng Xu Jieren Cheng Fengkai Wang Xiangyan Tang Jinying Xu |
| author_sort | Ruomeng Xu |
| collection | DOAJ |
| description | Distributed Denial of Service (DDoS) has developed multiple variants, one of which is Distributed Reflective Denial of Service (DRDoS). With the increasing number of Internet of Things (IoT) devices, the threat of DRDoS attack is growing, and the damage of a DRDoS attack is more destructive than other types. The existing DDoS detection methods cannot be generalized in DRDoS early detection, which leads to heavy load or degradation of service when deployed at the final point. In this paper, we propose a DRDoS detection and defense method based on deep forest model (DDDF), and then we integrate differentiated service into defense model to filter out DRDoS attack flow. Firstly, from the statistics perspective on different stages of DRDoS attack flow in the big data environment, we extract a host-based DRDoS threat index (HDTI) from the network flows. Secondly, using the HDTI feature we build a DRDoS detection and defense model based on the deep forest, which consists of 1 extreme gradient boost (XGBoost) forest estimator, 2 random forest estimators, and 2 extra random forest estimators in each layer. Lastly, the differentiated service procedure applies the detection result from DDDF to drop the traffic identified in different stages and different detection points. Theoretical analysis and experiments show that the method we proposed can effectively identify DRDoS attack with higher detection rate and a lower false alarm rate, the defense model also shows distinguishing ability to effectively eliminate the DRDoS attack flows, and dramatically mitigate the damage of a DRDoS attack. |
| first_indexed | 2024-04-14T00:39:01Z |
| format | Article |
| id | doaj.art-b99d32d1b35e48cd9bbe9866fa1e22d6 |
| institution | Directory Open Access Journal |
| issn | 2073-8994 |
| language | English |
| last_indexed | 2024-04-14T00:39:01Z |
| publishDate | 2019-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Symmetry |
| spelling | doaj.art-b99d32d1b35e48cd9bbe9866fa1e22d62022-12-22T02:22:16ZengMDPI AGSymmetry2073-89942019-01-011117810.3390/sym11010078sym11010078A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data EnvironmentRuomeng Xu0Jieren Cheng1Fengkai Wang2Xiangyan Tang3Jinying Xu4School of Information Science and Technology, Hainan University, Haikou 570228, ChinaSchool of Information Science and Technology, Hainan University, Haikou 570228, ChinaRossier School, University of Southern California, California, CA 90089, USASchool of Information Science and Technology, Hainan University, Haikou 570228, ChinaZhejiang Science and Technology Information Institute, Hangzhou 310006, ChinaDistributed Denial of Service (DDoS) has developed multiple variants, one of which is Distributed Reflective Denial of Service (DRDoS). With the increasing number of Internet of Things (IoT) devices, the threat of DRDoS attack is growing, and the damage of a DRDoS attack is more destructive than other types. The existing DDoS detection methods cannot be generalized in DRDoS early detection, which leads to heavy load or degradation of service when deployed at the final point. In this paper, we propose a DRDoS detection and defense method based on deep forest model (DDDF), and then we integrate differentiated service into defense model to filter out DRDoS attack flow. Firstly, from the statistics perspective on different stages of DRDoS attack flow in the big data environment, we extract a host-based DRDoS threat index (HDTI) from the network flows. Secondly, using the HDTI feature we build a DRDoS detection and defense model based on the deep forest, which consists of 1 extreme gradient boost (XGBoost) forest estimator, 2 random forest estimators, and 2 extra random forest estimators in each layer. Lastly, the differentiated service procedure applies the detection result from DDDF to drop the traffic identified in different stages and different detection points. Theoretical analysis and experiments show that the method we proposed can effectively identify DRDoS attack with higher detection rate and a lower false alarm rate, the defense model also shows distinguishing ability to effectively eliminate the DRDoS attack flows, and dramatically mitigate the damage of a DRDoS attack.http://www.mdpi.com/2073-8994/11/1/78DRDoSdeep forestIoTbig datadifferentiated service |
| spellingShingle | Ruomeng Xu Jieren Cheng Fengkai Wang Xiangyan Tang Jinying Xu A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment Symmetry DRDoS deep forest IoT big data differentiated service |
| title | A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment |
| title_full | A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment |
| title_fullStr | A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment |
| title_full_unstemmed | A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment |
| title_short | A DRDoS Detection and Defense Method Based on Deep Forest in the Big Data Environment |
| title_sort | drdos detection and defense method based on deep forest in the big data environment |
| topic | DRDoS deep forest IoT big data differentiated service |
| url | http://www.mdpi.com/2073-8994/11/1/78 |
| work_keys_str_mv | AT ruomengxu adrdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT jierencheng adrdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT fengkaiwang adrdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT xiangyantang adrdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT jinyingxu adrdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT ruomengxu drdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT jierencheng drdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT fengkaiwang drdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT xiangyantang drdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment AT jinyingxu drdosdetectionanddefensemethodbasedondeepforestinthebigdataenvironment |