Abstract:Application‐layer distributed denial of service (DDoS) attacks have become the main threat to Web server security. Because application‐layer DDoS attacks have strong concealability and high authenticity, intrusion detection technologies that rely solely on judging client authenticity cannot accurately detect such attacks. In addition, application‐layer DDoS attacks are periodic and repetitive, and attack targets suddenly in a short period. In this study, we propose an efficient application‐layer DDoS detection system based on improved random forest. Firstly, the Web logs are preprocessed to extract the user session characteristics. Subsequently, we propose a Session Identification based on Separation and Aggregation (SISA) method to accurately capture user sessions. Lastly, we propose an improved random forest classification algorithm based on feature weighting to address the issue of an increasing number of features leading to prolonged calculation times in the random forest algorithm, and as the feature dimension increases, there might be instances where no subfeature is related to the category to be classified. More importantly, we compare the request source IP with the malicious IP in the threat intelligence library to deal with the periodicity and repetition of application‐layer DDoS attacks. We conducted a comprehensive experiment on the publicly available Web log dataset and the threat intelligence database of the laboratory as well as the simulated generated attack log dataset in the laboratory environment. The experimental results show that the proposed detection system can control the false alarm rate and false alarm rate within a reasonable range, improving the detection efficiency further, the detection rate is 99.85%. In secondary attack detection experiments, our proposed detection method achieves a higher detection rate in a shorter time.

A Statistical Threat Detection Method Based on Dynamic Time Threshold

Real-Time Online Detection Method for Web Attack Based on Flow Data Analysis

Group Testing Based Detection of Web Service DDoS Attackers.

Threaten Quantitative And Analyse Of A Large-scale Network Security Events

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

APT Traffic Detection Based on Time Transform

A Temporal Correlation and Traffic Analysis Approach for APT Attacks Detection.

Potential threats mining methods based on correlation analysis of multi-type logs.

High Fidelity Data Reduction for Big Data Security Dependency Analyses.

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

A New Multistage Approach to Detect Subtle DDoS Attacks.

Detection of advanced persistent threats using hashing and graph-based learning on streaming data

Efficient Based on Improved Random Forest Defense System Against Application‐Layer DDoS Attacks

Real-Time Detection of Application-Layer DDoS Attack Using Time Series Analysis

Mining Network Traffic with the k -Means Clustering Algorithm for Stepping-Stone Intrusion Detection

Intrusion Intention Identification Methods Based on Dynamic Bayesian Networks

Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data

Detecting DDoS Attacks Against Web Server Using Time Series Analysis

Dynamic threshold strategy optimization for security protection in Internet of Things: An adversarial deep learning‐based game‐theoretical approach

Abnormal Event Correlation and Detection Based on Network Big Data Analysis

Real-Time DDoS Attack Detection System Using Big Data Approach