Abstract:The article considers the possibility of early prediction of cyberattacks based on the analysis of suspicious activity in the network, which will provide additional opportunities for information protection services in countering such attacks. A feature of a slow DDoS attack is the use of a vulnerability in the TCP protocol, where interruptions can be caused intentionally or unintentionally as a result of delays in the communication channel. It is well known that detection of slow DDoS attacks is significantly different from volume-based attacks, as slow attacks do not increase network traffic. The general problem is to detect the start time of such an attack, since traffic parameters do not change dramatically. An assumption is made about the dependence of the slow attack on the user’s behavior. Using machine learning methods based on the analysis of similar situations in the past, it is possible to create an integrated system for transforming large volumes of publicly available data to predict the behavior of attackers in the network. A method of detecting such attacks based on research and prediction of suspicious user activity is proposed. The possibilities of using this method have been proven on the basis of modeling RUDY attacks on HTTP services. The characteristics of forecasting accuracy depending on the accumulated traffic and attack statistics are given. It is concluded that this method can be used to detect different types of slow DDoS attacks. Predicting suspicious traffic provides a solution to the problem of detecting slow DDoS attacks based on an algorithm for finding unknown future values for a time series of traffic parameters. The proposed method combines the advantages of artificial intelligence and statistical analysis and is capable of self-learning in case of replenishment of attack statistics. This approach allows you to accurately determine the random process at the control points and ensure a minimum of the mean square error of approximation in the intervals between these points.

Peak Traffic Volume Prediction Method Based on Machine Learning

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Effective DDoS Mitigation Via ML-Driven In-network Traffic Shaping

Predict And Prevent DDOS Attacks Using Machine Learning and Statistical Algorithms

Prediction of dynamics of suspicious network activity based on network traffic analysis

A New Multistage Approach to Detect Subtle DDoS Attacks.

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Prediction Approach against DDoS Attack based on Machine Learning Multiclassfier

DDoS attack prediction using a honey badger optimization algorithm based feature selection and Bi-LSTM in cloud environment

Early Signals from Volumetric DDoS Attacks: An Empirical Study

Real-Time DDoS Attack Detection System Using Big Data Approach

A DDoS Attack Detection Method Based on SVM in Software Defined Network

Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection

DDoS attack detection method based on feature extraction of deep belief network

Towards Real-Time ML-based DDoS Detection Via Cost-Efficient Window-Based Feature Extraction

VMFCVD: An Optimized Framework to Combat Volumetric DDoS Attacks using Machine Learning

A Machine Learning Approach for DDoS Detection on IoT Devices

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment