Abstract:Network attack detection plays a vital role in network security. Existing detection approaches focus on typical attack behaviors, such as Botnets and SQL injection. The widespread use of the SSL/TLS encryption protocol arises some emerging attack strategies against the SSL/TLS protocol. With the network traffic collection environment that built upon the implements of popular SSL/TLS attacks, a network traffic dataset including four SSL/TLS attacks, as well as benign flows was controlled. Considering the problems that limited observability of existing detection and limited separation of the original-flow spatiotemporal domains, a flow spectrum theory was proposed to map the threat behavior in the cyberspace from the original spatiotemporal domain to the transformed domain through the process of “potential change” and obtain the “potential variation spectrum”. The flow spectrum theory is based on a set of separable and observable feature representations to achieve efficient analysis of network flows. The key to the application of flow spectrum theory in actual cyberspace threat behavior detection is to find the potential basis matrix for a specific threat network flow under the condition of a given transformation operator. Since the SSL/TLS protocol has a strong timing relationship and state transition process in the handshake phase, and there are similarities between some SSL/TLS attacks, the detection of SSL/TLS attacks not only needs to consider timing context information, but also needs to consider the high-separation representation of TLS network flows. Based on the flow spectrum theory, the threat template idea was used to extract the potential basis matrix, and the potential basis mapping based on the long-short-term memory unit was used to map the SSL/TLS attack network flow to the flow spectrum domain space. On the self-built SSL/TLS attack network flow data set, the validity of the flow spectrum theory is verified by means of classification performance comparison, potential variation spectrum dimensionality reduction visualization, threat behavior feature weight evaluation, threat behavior spectrum division assessment, and potential variation base matrix heatmap visualization.

Real-Time Online Detection Method for Web Attack Based on Flow Data Analysis

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detection of SSL/TLS Protocol Attacks Based on Flow Spectrum Theory

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Group Testing Based Detection of Web Service DDoS Attackers.

LDoS attack detection method based on traffic time-frequency characteristics

A Method Based on AMHI for DDoS Attacks Detection and Defense

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

Low-rate DDoS attacks detection method using data compression and behavior divergence measurement

Towards Real-Time ML-based DDoS Detection Via Cost-Efficient Window-Based Feature Extraction

A Flow is a Stream of Packets: A Stream-Structured Data Approach for DDoS Detection

Exploiting Artificial Immune systems to detect unknown DoS attacks in real-time

Efficient Based on Improved Random Forest Defense System Against Application‐Layer DDoS Attacks

Detection of LDDoS Attacks Based on TCP Connection Parameters

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

Smart city infrastructure protection: real-time threat detection employing online reservoir computing architecture

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

Real-Time Detection of Application-Layer DDoS Attack Using Time Series Analysis