Abstract:Application‐layer distributed denial of service (DDoS) attacks have become the main threat to Web server security. Because application‐layer DDoS attacks have strong concealability and high authenticity, intrusion detection technologies that rely solely on judging client authenticity cannot accurately detect such attacks. In addition, application‐layer DDoS attacks are periodic and repetitive, and attack targets suddenly in a short period. In this study, we propose an efficient application‐layer DDoS detection system based on improved random forest. Firstly, the Web logs are preprocessed to extract the user session characteristics. Subsequently, we propose a Session Identification based on Separation and Aggregation (SISA) method to accurately capture user sessions. Lastly, we propose an improved random forest classification algorithm based on feature weighting to address the issue of an increasing number of features leading to prolonged calculation times in the random forest algorithm, and as the feature dimension increases, there might be instances where no subfeature is related to the category to be classified. More importantly, we compare the request source IP with the malicious IP in the threat intelligence library to deal with the periodicity and repetition of application‐layer DDoS attacks. We conducted a comprehensive experiment on the publicly available Web log dataset and the threat intelligence database of the laboratory as well as the simulated generated attack log dataset in the laboratory environment. The experimental results show that the proposed detection system can control the false alarm rate and false alarm rate within a reasonable range, improving the detection efficiency further, the detection rate is 99.85%. In secondary attack detection experiments, our proposed detection method achieves a higher detection rate in a shorter time.

Design a Hybrid Flooding Attack Defense Scheme under the Cloud Computing Environment

Multi-resource Max-Min Fairness and Support Vector Machine Based DDoS Defense

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

FIDS: Fuzzy Intrusion Detection System for simultaneous detection of DoS/DDoS attacks in Cloud computing

A method of DDoS attack detection using HTTP packet pattern and rule engine in cloud computing environment

RAM: A Resource-Aware DDoS Attack Mitigation Framework in Clouds

A Method Based on AMHI for DDoS Attacks Detection and Defense

Efficient Distributed Denial-of-Service Attack Defense in SDN-Based Cloud

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques

A Lightweight Ddos Flooding Attack Detection Algorithm Based On Synchronous Long Flows

Efficient Based on Improved Random Forest Defense System Against Application‐Layer DDoS Attacks

Identifying Hybrid DDoS Attacks in Deterministic Machine-to-Machine Networks on a Per-Deterministic-Flow Basis

Can We Beat DDoS Attacks in Clouds ? ( Supplementary Material )

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

An Efficient Scheme to Defend Data-to-Control-Plane Saturation Attacks in Software-Defined Networking

DDoS attack protection in the era of cloud computing and Software-Defined Networking

Minimizing Financial Cost of DDoS Attack Defense in Clouds With Fine-Grained Resource Management

FloodShield: Securing the SDN Infrastructure Against Denial-of-Service Attacks.

Design and Implementation of IoT DDoS Attacks Detection System based on Machine Learning

An Online Entropy-based DDoS Flooding Attack Detection System with Dynamic Threshold

A confidence-based filtering method for DDoS attack defense in cloud environment