Abstract:Application‐layer distributed denial of service (DDoS) attacks have become the main threat to Web server security. Because application‐layer DDoS attacks have strong concealability and high authenticity, intrusion detection technologies that rely solely on judging client authenticity cannot accurately detect such attacks. In addition, application‐layer DDoS attacks are periodic and repetitive, and attack targets suddenly in a short period. In this study, we propose an efficient application‐layer DDoS detection system based on improved random forest. Firstly, the Web logs are preprocessed to extract the user session characteristics. Subsequently, we propose a Session Identification based on Separation and Aggregation (SISA) method to accurately capture user sessions. Lastly, we propose an improved random forest classification algorithm based on feature weighting to address the issue of an increasing number of features leading to prolonged calculation times in the random forest algorithm, and as the feature dimension increases, there might be instances where no subfeature is related to the category to be classified. More importantly, we compare the request source IP with the malicious IP in the threat intelligence library to deal with the periodicity and repetition of application‐layer DDoS attacks. We conducted a comprehensive experiment on the publicly available Web log dataset and the threat intelligence database of the laboratory as well as the simulated generated attack log dataset in the laboratory environment. The experimental results show that the proposed detection system can control the false alarm rate and false alarm rate within a reasonable range, improving the detection efficiency further, the detection rate is 99.85%. In secondary attack detection experiments, our proposed detection method achieves a higher detection rate in a shorter time.

Real-Time Detection of Application-Layer DDoS Attack Using Time Series Analysis

Low-rate DoS Attack Detection Method Based on Hybrid Deep Neural Networks.

Detection of low-rate DDoS attack based on self-similarity

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Group Testing Based Detection of Web Service DDoS Attackers.

An intelligent behavioral-based DDOS attack detection method using adaptive time intervals

A New Multistage Approach to Detect Subtle DDoS Attacks.

Efficient Based on Improved Random Forest Defense System Against Application‐Layer DDoS Attacks

A DDoS attack detection and defense scheme using time-series analysis for SDN

Real-Time DDoS Attack Detection System Using Big Data Approach

Weighted Fuzzy Clustering for Online Detection of Application DDoS Attacks in Encrypted Network Traffic

LDoS attack detection method based on traffic time-frequency characteristics

Distributed Denial of Service (DDoS) detection by traffic pattern analysis

Reconstruction-based LSTM-Autoencoder for Anomaly-based DDoS Attack Detection over Multivariate Time-Series Data

Detecting DDOS Attack Based on Network Self-Similarity

DDoS detection and analysis system based on comprehensive scoring

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

Towards Real-Time ML-based DDoS Detection Via Cost-Efficient Window-Based Feature Extraction

Towards Detecting Flooding DDOS Attacks Over Software Defined Networks Using Machine Learning Techniques